From 8088fdd044ba82e0299ff181359058e7ae2dde6a Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Mon, 17 Jul 2023 08:04:50 -0400
Subject: [PATCH] Drop the recent additions while -rcs are out

---
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 queue-4.14/series                             |   9 -
 queue-4.14/udp6-fix-udp6_ehashfn-typo.patch   |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 queue-4.19/series                             |  12 -
 queue-4.19/udp6-fix-udp6_ehashfn-typo.patch   |  40 -
 ...t-icmp6inmsgs-on-the-original-netdev.patch | 127 ---
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...t-riscv-jit-to-provide-bpf_line_info.patch |  75 --
 ...-add-connector_type-for-innolux_at04.patch |  39 -
 ...-add-powertip-ph800480t013-drm_displ.patch |  38 -
 ...nite-loop-in-z_erofs_do_read_page-wh.patch |  54 --
 ...default-duplex-configuration-to-full.patch |  43 -
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...erting-of-empty-frame-for-launchtime.patch | 128 ---
 ...fix-launchtime-before-start-of-cycle.patch |  46 -
 ...e-delay-during-tx-ring-configuration.patch |  46 -
 ...n-supported-and-advertising-fields-o.patch |  39 -
 ...ove-warn_on-to-prevent-panic_on_warn.patch |  42 -
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...ne-turning-irqs-off-to-avoid-soc-han.patch |  55 --
 ...for-not_ready-flag-state-after-locki.patch | 133 ---
 ...uble-free-in-mlx5e_destroy_flow_tabl.patch |  38 -
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...corruption-on-frag-list-segmentation.patch | 102 ---
 ...-fix-improper-refcount-update-leads-.patch |  62 --
 ...-ensure-both-minimum-and-maximum-por.patch |  82 --
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...q-account-for-stab-overhead-in-qfq_e.patch |  96 --
 ...q-refactor-parsing-of-netlink-parame.patch |  87 --
 ...initialized-data-in-nsim_dev_trap_fa.patch |  55 --
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 ...-direction-of-unmapping-integrity-da.patch |  41 -
 ...-break-possible-infinite-loop-when-p.patch |  84 --
 .../platform-x86-wmi-move-variables.patch     |  80 --
 ...-x86-wmi-remove-unnecessary-argument.patch |  75 --
 ...rm-x86-wmi-use-guid_t-and-guid_equal.patch | 177 ----
 queue-5.10/riscv-bpf-avoid-breaking-w-x.patch |  45 -
 ...ix-inconsistent-jit-image-generation.patch | 137 ---
 ...pf_jit_alloc_exec-and-bpf_jit_free_e.patch |  69 --
 ...x-fix-error-code-in-qla2x00_start_sp.patch |  38 -
 queue-5.10/series                             |  39 -
 queue-5.10/udp6-fix-udp6_ehashfn-typo.patch   |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...x-memory-leak-in-cpu_map_update_elem.patch | 138 ---
 ...tack-depth-check-for-async-callbacks.patch |  59 --
 ...t-riscv-jit-to-provide-bpf_line_info.patch |  75 --
 ...sn65dsi86-fix-auxiliary-bus-lifetime.patch | 110 ---
 ...ix-one-wrong-caching-mode-enum-usage.patch |  45 -
 ...-add-connector_type-for-innolux_at04.patch |  39 -
 ...-add-powertip-ph800480t013-drm_displ.patch |  38 -
 ...nite-loop-in-z_erofs_do_read_page-wh.patch |  54 --
 ...-basic-mount-options-from-fs_context.patch | 330 -------
 ...unavailability-for-chunk-based-regul.patch |  42 -
 ...default-duplex-configuration-to-full.patch |  43 -
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...erting-of-empty-frame-for-launchtime.patch | 128 ---
 ...fix-launchtime-before-start-of-cycle.patch |  46 -
 ...tart-time-programming-for-past-time-.patch | 109 ---
 ...e-delay-during-tx-ring-configuration.patch |  46 -
 ...n-supported-and-advertising-fields-o.patch |  39 -
 ...ove-warn_on-to-prevent-panic_on_warn.patch |  42 -
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-cleanup-logic-of-enable_trace_eprob.patch |  71 --
 ...ne-turning-irqs-off-to-avoid-soc-han.patch |  55 --
 ...for-not_ready-flag-state-after-locki.patch | 133 ---
 ...uble-free-in-mlx5e_destroy_flow_tabl.patch |  38 -
 ...5e-fix-memory-leak-in-mlx5e_ptp_open.patch |  44 -
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...corruption-on-frag-list-segmentation.patch | 102 ---
 ...-fix-improper-refcount-update-leads-.patch |  62 --
 ...-ensure-both-minimum-and-maximum-por.patch |  82 --
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...q-account-for-stab-overhead-in-qfq_e.patch |  96 --
 ...q-refactor-parsing-of-netlink-parame.patch |  87 --
 ...initialized-data-in-nsim_dev_trap_fa.patch |  55 --
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 ...-direction-of-unmapping-integrity-da.patch |  40 -
 ...-pci-remove-nvme_queue-from-nvme_iod.patch | 121 ---
 ...-add-additional-check-for-mcam-rules.patch |  71 --
 ...-break-possible-infinite-loop-when-p.patch |  84 --
 .../platform-x86-wmi-move-variables.patch     |  80 --
 ...-x86-wmi-remove-unnecessary-argument.patch |  75 --
 ...rm-x86-wmi-use-guid_t-and-guid_equal.patch | 177 ----
 ...ix-inconsistent-jit-image-generation.patch | 137 ---
 ...cv-mm-fix-truncation-warning-on-rv32.patch |  46 -
 ...x-fix-error-code-in-qla2x00_start_sp.patch |  38 -
 queue-5.15/series                             |  49 -
 queue-5.15/udp6-fix-udp6_ehashfn-typo.patch   |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...xtack-support-for-src-and-dst-port-r.patch |  78 --
 ...el-add-and-fill-drm_panel-type-field.patch | 854 ------------------
 ...lise-panel-dev-and-funcs-through-drm.patch | 724 ---------------
 ...-add-connector_type-for-innolux_at04.patch |  39 -
 ...nite-loop-in-z_erofs_do_read_page-wh.patch |  54 --
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...e-delay-during-tx-ring-configuration.patch |  46 -
 ...n-supported-and-advertising-fields-o.patch |  39 -
 ...c-clean-irq-affinity-on-queue-deinit.patch |  38 -
 .../ionic-improve-irq-numa-locality.patch     |  42 -
 ...nic-ionic_intr_free-parameter-change.patch |  68 --
 .../ionic-move-irq-request-to-qcq-alloc.patch | 140 ---
 ...ove-warn_on-to-prevent-panic_on_warn.patch |  42 -
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...-fix-improper-refcount-update-leads-.patch |  62 --
 ...-ensure-both-minimum-and-maximum-por.patch |  82 --
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 ...-break-possible-infinite-loop-when-p.patch |  84 --
 ...86-wmi-fix-indentation-in-some-cases.patch |  48 -
 .../platform-x86-wmi-move-variables.patch     |  80 --
 ...-x86-wmi-remove-unnecessary-argument.patch |  75 --
 ...-replace-uuid-redefinitions-by-their.patch | 100 --
 ...rm-x86-wmi-use-guid_t-and-guid_equal.patch | 177 ----
 ...x-fix-error-code-in-qla2x00_start_sp.patch |  38 -
 queue-5.4/series                              |  32 -
 queue-5.4/udp6-fix-udp6_ehashfn-typo.patch    |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...ynamic-lock-class-for-blk_crypto_pro.patch | 110 ---
 ...x-memory-leak-in-cpu_map_update_elem.patch | 138 ---
 ...tack-depth-check-for-async-callbacks.patch |  59 --
 ...sn65dsi86-fix-auxiliary-bus-lifetime.patch | 112 ---
 ...reserve-dpll_hw_state-for-slave-crtc.patch |  41 -
 ...ix-one-wrong-caching-mode-enum-usage.patch |  45 -
 ...-add-connector_type-for-innolux_at04.patch |  39 -
 ...-add-powertip-ph800480t013-drm_displ.patch |  38 -
 ...nite-loop-in-z_erofs_do_read_page-wh.patch |  54 --
 ...ess-loops-in-z_erofs_pcluster_readmo.patch |  46 -
 ...unavailability-for-chunk-based-regul.patch |  42 -
 ...default-duplex-configuration-to-full.patch |  43 -
 ...-check-while-configuring-tx-rate-lim.patch |  86 --
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...erting-of-empty-frame-for-launchtime.patch | 128 ---
 ...fix-launchtime-before-start-of-cycle.patch |  46 -
 ...tart-time-programming-for-past-time-.patch | 109 ---
 ...e-delay-during-tx-ring-configuration.patch |  46 -
 ...n-supported-and-advertising-fields-o.patch |  39 -
 ...ove-warn_on-to-prevent-panic_on_warn.patch |  42 -
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-cleanup-logic-of-enable_trace_eprob.patch |  71 --
 ...ne-turning-irqs-off-to-avoid-soc-han.patch |  55 --
 ...net-dsa-qca8k-add-check-for-skb_copy.patch |  38 -
 ...for-not_ready-flag-state-after-locki.patch | 133 ---
 ...uble-free-in-mlx5e_destroy_flow_tabl.patch |  38 -
 ...mory-leak-in-mlx5e_fs_tt_redirect_an.patch |  51 --
 ...5e-fix-memory-leak-in-mlx5e_ptp_open.patch |  44 -
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...corruption-on-frag-list-segmentation.patch | 102 ---
 ...-fix-improper-refcount-update-leads-.patch |  62 --
 ...-ensure-both-minimum-and-maximum-por.patch |  82 --
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...q-account-for-stab-overhead-in-qfq_e.patch |  96 --
 ...q-refactor-parsing-of-netlink-parame.patch |  87 --
 ...initialized-data-in-nsim_dev_trap_fa.patch |  55 --
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 ...e-nvme_id_ns_nvm_sts_mask-definition.patch |  36 -
 ...-direction-of-unmapping-integrity-da.patch |  40 -
 ...e-validation-of-ptp-pointer-before-i.patch | 110 ---
 ...-promisc-enable-disable-through-mbox.patch | 118 ---
 ...-add-additional-check-for-mcam-rules.patch |  71 --
 ...-break-possible-infinite-loop-when-p.patch |  84 --
 ...ix-inconsistent-jit-image-generation.patch | 137 ---
 ...cv-mm-fix-truncation-warning-on-rv32.patch |  46 -
 ...x-fix-error-code-in-qla2x00_start_sp.patch |  38 -
 ...iatek-add-dependency-for-reset_contr.patch |  55 --
 queue-6.1/series                              |  57 --
 ...et-the-number-of-areas-before-alloca.patch |  85 --
 ...he-number-of-areas-to-match-actual-m.patch | 114 ---
 ...he-swiotlb-buffer-size-on-allocation.patch | 123 ---
 queue-6.1/udp6-fix-udp6_ehashfn-typo.patch    |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...-fix-error-code-in-rtw89_debug_priv_.patch |  51 --
 ...ynamic-lock-class-for-blk_crypto_pro.patch | 110 ---
 ...x-memory-leak-in-cpu_map_update_elem.patch | 138 ---
 ...tack-depth-check-for-async-callbacks.patch |  59 --
 ...w_hdmi-fix-connector-access-for-scdc.patch |  81 --
 ...sn65dsi86-fix-auxiliary-bus-lifetime.patch | 112 ---
 ...x-documented-default-preferred_bpp-v.patch |  42 -
 ...reserve-dpll_hw_state-for-slave-crtc.patch |  41 -
 ...ix-one-wrong-caching-mode-enum-usage.patch |  45 -
 ...abort-loading-acr-if-no-firmware-was.patch |  38 -
 ...g-back-blit-subchannel-for-pre-nv50-.patch |  93 --
 .../drm-nouveau-disp-fix-hdmi-on-gt215.patch  |  37 -
 .../drm-nouveau-disp-g94-enable-hdmi.patch    |  36 -
 ...-add-connector_type-for-innolux_at04.patch |  39 -
 ...-add-powertip-ph800480t013-drm_displ.patch |  38 -
 ...nite-loop-in-z_erofs_do_read_page-wh.patch |  54 --
 ...ess-loops-in-z_erofs_pcluster_readmo.patch |  46 -
 ...unavailability-for-chunk-based-regul.patch |  42 -
 ...k-to-match-a-succeeded-ftrace_test_r.patch |  50 -
 ...default-duplex-configuration-to-full.patch |  43 -
 ...-avoid-struct-memcpy-overrun-warning.patch |  65 --
 ...-check-while-configuring-tx-rate-lim.patch |  86 --
 ...e-rate-limit-when-tcs-are-configured.patch | 123 ---
 ...tr-deref-of-ip6_null_entry-rt6i_idev.patch | 145 ---
 ...n-for-qbv_config_change_errors-count.patch |  66 --
 ..._buff-wrapper-for-xdp_buff-in-driver.patch | 104 ---
 ...igc-add-xdp-hints-kfuncs-for-rx-hash.patch | 145 ---
 ...e-taprio-offload-for-invalid-argumen.patch | 109 ---
 ...erting-of-empty-frame-for-launchtime.patch | 128 ---
 ...fix-launchtime-before-start-of-cycle.patch |  46 -
 ...x-hang-issue-when-qbv-gate-is-closed.patch | 316 -------
 ...dy-enabled-taprio-offload-for-baseti.patch |  62 --
 ...tart-time-programming-for-past-time-.patch | 109 ---
 ...length-type-field-and-vlan-tag-in-qu.patch |  68 --
 ...-mode-in-pure-launchtime-cbs-offload.patch | 153 ----
 ...e-delay-during-tx-ring-configuration.patch |  46 -
 ...-qbv_enable-to-taprio_offload_enable.patch |  87 --
 ...n-supported-and-advertising-fields-o.patch |  39 -
 ...ove-warn_on-to-prevent-panic_on_warn.patch |  42 -
 ...x-a-potential-refcount-underflow-for.patch |  53 --
 ...-cleanup-logic-of-enable_trace_eprob.patch |  71 --
 ...ne-turning-irqs-off-to-avoid-soc-han.patch |  55 --
 ...ke-vsc9959_tas_guard_bands_update-vi.patch | 100 --
 ...net-dsa-qca8k-add-check-for-skb_copy.patch |  38 -
 ...unneeded-of_node_put-in-felix_parse_.patch |  38 -
 ...-the-size-of-tx-ring-and-update-tx_w.patch |  83 --
 ...cle-pages-for-transmitted-xdp-frames.patch | 297 ------
 ...ast_bdp-from-fec_enet_txq_xmit_frame.patch |  64 --
 ...ec-remove-useless-fec_enet_reset_skb.patch |  66 --
 ...-query-hca_cap_2-only-when-supported.patch |  42 -
 ...ter-a-unique-thermal-zone-per-device.patch |  84 --
 ...for-not_ready-flag-state-after-locki.patch | 133 ---
 ...uble-free-in-mlx5e_destroy_flow_tabl.patch |  38 -
 ...mory-leak-in-mlx5e_fs_tt_redirect_an.patch |  51 --
 ...5e-fix-memory-leak-in-mlx5e_ptp_open.patch |  44 -
 ...-flush-and-close-release-flow-of-reg.patch |  52 --
 ...-page_pool-page-fragment-tracking-fo.patch | 124 ---
 ...x5e-tc-ct-offload-ct-clear-only-once.patch |  92 --
 ...fix-oversize-frame-dropping-for-pree.patch | 133 ---
 ...-fix-txq_map-in-case-of-txq_number-1.patch |  48 -
 ...corruption-on-frag-list-segmentation.patch | 102 ---
 ...-fix-improper-refcount-update-leads-.patch |  62 --
 ...-ensure-both-minimum-and-maximum-por.patch |  82 --
 ...sched-make-psched_mtu-rtnl-less-safe.patch |  49 -
 ...q-account-for-stab-overhead-in-qfq_e.patch |  96 --
 ...q-reintroduce-lmax-bound-check-for-m.patch |  52 --
 ...-replace-tc_taprio_qopt_offload-enab.patch | 390 --------
 ...t-txgbe-fix-eeprom-calculation-error.patch |  40 -
 ...initialized-data-in-nsim_dev_trap_fa.patch |  55 --
 ...ack-don-t-fold-port-numbers-into-add.patch |  94 --
 ..._tables-report-use-refcount-overflow.patch | 752 ---------------
 ...r-handling-in-amd_ntb_pci_driver_ini.patch |  64 --
 ...rror-handling-in-idt_pci_driver_init.patch |  66 --
 ...ror-handling-in-intel_ntb_pci_driver.patch |  65 --
 ...-ntb_tool-add-check-for-devm_kcalloc.patch |  39 -
 ...t-fix-possible-memory-leak-while-dev.patch |  42 -
 ...e-nvme_id_ns_nvm_sts_mask-definition.patch |  36 -
 ...-direction-of-unmapping-integrity-da.patch |  40 -
 ...e-validation-of-ptp-pointer-before-i.patch | 110 ---
 ...-promisc-enable-disable-through-mbox.patch | 118 ---
 ...-add-additional-check-for-mcam-rules.patch |  71 --
 ...pcsr-and-oldmask-in-sigcontext-to-un.patch |  75 --
 ...-break-possible-infinite-loop-when-p.patch |  84 --
 ...ix-inconsistent-jit-image-generation.patch | 137 ---
 ...cv-mm-fix-truncation-warning-on-rv32.patch |  46 -
 ...unregister-clients-with-registered-d.patch |  74 --
 ...-simplify-add-remove-callback-handli.patch | 242 -----
 ...king-for-forwarding-of-irqs-and-even.patch | 209 -----
 ...x-fix-error-code-in-qla2x00_start_sp.patch |  38 -
 ...iatek-add-dependency-for-reset_contr.patch |  55 --
 queue-6.4/series                              |  98 --
 ...et-the-number-of-areas-before-alloca.patch |  85 --
 ...he-number-of-areas-to-match-actual-m.patch | 114 ---
 ...ng-call-into-udp_fail_queue_rcv_skb-.patch |  57 --
 queue-6.4/udp6-fix-udp6_ehashfn-typo.patch    |  40 -
 ...uninitialized-warning-in-airo_get_ra.patch |  47 -
 ...-fix-error-code-in-rtw89_debug_priv_.patch |  51 --
 queue-6.4/x86-fineibt-poison-endbr-at-0.patch |  89 --
 ...rusted-arguments-in-xdp-hints-kfuncs.patch |  53 --
 ...ull-deref-when-a-bridge-of-pci-root-.patch |  90 --
 303 files changed, 24265 deletions(-)
 delete mode 100644 queue-4.14/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-4.14/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-4.14/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-4.14/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-4.14/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-4.14/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-4.14/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-4.14/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-4.14/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-4.19/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-4.19/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-4.19/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-4.19/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-4.19/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-4.19/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-4.19/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-4.19/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-4.19/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-4.19/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-4.19/vrf-increment-icmp6inmsgs-on-the-original-netdev.patch
 delete mode 100644 queue-4.19/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-5.10/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
 delete mode 100644 queue-5.10/drm-panel-simple-add-connector_type-for-innolux_at04.patch
 delete mode 100644 queue-5.10/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
 delete mode 100644 queue-5.10/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
 delete mode 100644 queue-5.10/gve-set-default-duplex-configuration-to-full.patch
 delete mode 100644 queue-5.10/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-5.10/igc-fix-inserting-of-empty-frame-for-launchtime.patch
 delete mode 100644 queue-5.10/igc-fix-launchtime-before-start-of-cycle.patch
 delete mode 100644 queue-5.10/igc-remove-delay-during-tx-ring-configuration.patch
 delete mode 100644 queue-5.10/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
 delete mode 100644 queue-5.10/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
 delete mode 100644 queue-5.10/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-5.10/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
 delete mode 100644 queue-5.10/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
 delete mode 100644 queue-5.10/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
 delete mode 100644 queue-5.10/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-5.10/net-prevent-skb-corruption-on-frag-list-segmentation.patch
 delete mode 100644 queue-5.10/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
 delete mode 100644 queue-5.10/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
 delete mode 100644 queue-5.10/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-5.10/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
 delete mode 100644 queue-5.10/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
 delete mode 100644 queue-5.10/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
 delete mode 100644 queue-5.10/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-5.10/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-5.10/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-5.10/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-5.10/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-5.10/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
 delete mode 100644 queue-5.10/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
 delete mode 100644 queue-5.10/platform-x86-wmi-move-variables.patch
 delete mode 100644 queue-5.10/platform-x86-wmi-remove-unnecessary-argument.patch
 delete mode 100644 queue-5.10/platform-x86-wmi-use-guid_t-and-guid_equal.patch
 delete mode 100644 queue-5.10/riscv-bpf-avoid-breaking-w-x.patch
 delete mode 100644 queue-5.10/riscv-bpf-fix-inconsistent-jit-image-generation.patch
 delete mode 100644 queue-5.10/riscv-bpf-move-bpf_jit_alloc_exec-and-bpf_jit_free_e.patch
 delete mode 100644 queue-5.10/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
 delete mode 100644 queue-5.10/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-5.10/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-5.15/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
 delete mode 100644 queue-5.15/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
 delete mode 100644 queue-5.15/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
 delete mode 100644 queue-5.15/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
 delete mode 100644 queue-5.15/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
 delete mode 100644 queue-5.15/drm-panel-simple-add-connector_type-for-innolux_at04.patch
 delete mode 100644 queue-5.15/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
 delete mode 100644 queue-5.15/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
 delete mode 100644 queue-5.15/erofs-decouple-basic-mount-options-from-fs_context.patch
 delete mode 100644 queue-5.15/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
 delete mode 100644 queue-5.15/gve-set-default-duplex-configuration-to-full.patch
 delete mode 100644 queue-5.15/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-5.15/igc-fix-inserting-of-empty-frame-for-launchtime.patch
 delete mode 100644 queue-5.15/igc-fix-launchtime-before-start-of-cycle.patch
 delete mode 100644 queue-5.15/igc-handle-pps-start-time-programming-for-past-time-.patch
 delete mode 100644 queue-5.15/igc-remove-delay-during-tx-ring-configuration.patch
 delete mode 100644 queue-5.15/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
 delete mode 100644 queue-5.15/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
 delete mode 100644 queue-5.15/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-5.15/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
 delete mode 100644 queue-5.15/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
 delete mode 100644 queue-5.15/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
 delete mode 100644 queue-5.15/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
 delete mode 100644 queue-5.15/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
 delete mode 100644 queue-5.15/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-5.15/net-prevent-skb-corruption-on-frag-list-segmentation.patch
 delete mode 100644 queue-5.15/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
 delete mode 100644 queue-5.15/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
 delete mode 100644 queue-5.15/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-5.15/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
 delete mode 100644 queue-5.15/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
 delete mode 100644 queue-5.15/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
 delete mode 100644 queue-5.15/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-5.15/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-5.15/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-5.15/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-5.15/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-5.15/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
 delete mode 100644 queue-5.15/nvme-pci-remove-nvme_queue-from-nvme_iod.patch
 delete mode 100644 queue-5.15/octeontx2-pf-add-additional-check-for-mcam-rules.patch
 delete mode 100644 queue-5.15/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
 delete mode 100644 queue-5.15/platform-x86-wmi-move-variables.patch
 delete mode 100644 queue-5.15/platform-x86-wmi-remove-unnecessary-argument.patch
 delete mode 100644 queue-5.15/platform-x86-wmi-use-guid_t-and-guid_equal.patch
 delete mode 100644 queue-5.15/riscv-bpf-fix-inconsistent-jit-image-generation.patch
 delete mode 100644 queue-5.15/riscv-mm-fix-truncation-warning-on-rv32.patch
 delete mode 100644 queue-5.15/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
 delete mode 100644 queue-5.15/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-5.15/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-5.4/cls_flower-add-extack-support-for-src-and-dst-port-r.patch
 delete mode 100644 queue-5.4/drm-panel-add-and-fill-drm_panel-type-field.patch
 delete mode 100644 queue-5.4/drm-panel-initialise-panel-dev-and-funcs-through-drm.patch
 delete mode 100644 queue-5.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
 delete mode 100644 queue-5.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
 delete mode 100644 queue-5.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-5.4/igc-remove-delay-during-tx-ring-configuration.patch
 delete mode 100644 queue-5.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
 delete mode 100644 queue-5.4/ionic-clean-irq-affinity-on-queue-deinit.patch
 delete mode 100644 queue-5.4/ionic-improve-irq-numa-locality.patch
 delete mode 100644 queue-5.4/ionic-ionic_intr_free-parameter-change.patch
 delete mode 100644 queue-5.4/ionic-move-irq-request-to-qcq-alloc.patch
 delete mode 100644 queue-5.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
 delete mode 100644 queue-5.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-5.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-5.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
 delete mode 100644 queue-5.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
 delete mode 100644 queue-5.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-5.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-5.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-5.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-5.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-5.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-fix-indentation-in-some-cases.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-move-variables.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-remove-unnecessary-argument.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-replace-uuid-redefinitions-by-their.patch
 delete mode 100644 queue-5.4/platform-x86-wmi-use-guid_t-and-guid_equal.patch
 delete mode 100644 queue-5.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
 delete mode 100644 queue-5.4/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-5.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-6.1/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
 delete mode 100644 queue-6.1/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
 delete mode 100644 queue-6.1/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
 delete mode 100644 queue-6.1/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
 delete mode 100644 queue-6.1/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
 delete mode 100644 queue-6.1/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
 delete mode 100644 queue-6.1/drm-panel-simple-add-connector_type-for-innolux_at04.patch
 delete mode 100644 queue-6.1/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
 delete mode 100644 queue-6.1/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
 delete mode 100644 queue-6.1/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
 delete mode 100644 queue-6.1/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
 delete mode 100644 queue-6.1/gve-set-default-duplex-configuration-to-full.patch
 delete mode 100644 queue-6.1/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
 delete mode 100644 queue-6.1/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-6.1/igc-fix-inserting-of-empty-frame-for-launchtime.patch
 delete mode 100644 queue-6.1/igc-fix-launchtime-before-start-of-cycle.patch
 delete mode 100644 queue-6.1/igc-handle-pps-start-time-programming-for-past-time-.patch
 delete mode 100644 queue-6.1/igc-remove-delay-during-tx-ring-configuration.patch
 delete mode 100644 queue-6.1/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
 delete mode 100644 queue-6.1/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
 delete mode 100644 queue-6.1/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-6.1/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
 delete mode 100644 queue-6.1/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
 delete mode 100644 queue-6.1/net-dsa-qca8k-add-check-for-skb_copy.patch
 delete mode 100644 queue-6.1/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
 delete mode 100644 queue-6.1/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
 delete mode 100644 queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
 delete mode 100644 queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
 delete mode 100644 queue-6.1/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-6.1/net-prevent-skb-corruption-on-frag-list-segmentation.patch
 delete mode 100644 queue-6.1/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
 delete mode 100644 queue-6.1/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
 delete mode 100644 queue-6.1/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-6.1/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
 delete mode 100644 queue-6.1/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
 delete mode 100644 queue-6.1/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
 delete mode 100644 queue-6.1/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-6.1/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-6.1/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-6.1/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-6.1/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-6.1/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
 delete mode 100644 queue-6.1/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
 delete mode 100644 queue-6.1/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
 delete mode 100644 queue-6.1/octeontx2-af-promisc-enable-disable-through-mbox.patch
 delete mode 100644 queue-6.1/octeontx2-pf-add-additional-check-for-mcam-rules.patch
 delete mode 100644 queue-6.1/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
 delete mode 100644 queue-6.1/riscv-bpf-fix-inconsistent-jit-image-generation.patch
 delete mode 100644 queue-6.1/riscv-mm-fix-truncation-warning-on-rv32.patch
 delete mode 100644 queue-6.1/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
 delete mode 100644 queue-6.1/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
 delete mode 100644 queue-6.1/swiotlb-always-set-the-number-of-areas-before-alloca.patch
 delete mode 100644 queue-6.1/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
 delete mode 100644 queue-6.1/swiotlb-reduce-the-swiotlb-buffer-size-on-allocation.patch
 delete mode 100644 queue-6.1/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-6.1/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-6.1/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
 delete mode 100644 queue-6.4/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
 delete mode 100644 queue-6.4/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
 delete mode 100644 queue-6.4/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
 delete mode 100644 queue-6.4/drm-bridge-dw_hdmi-fix-connector-access-for-scdc.patch
 delete mode 100644 queue-6.4/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
 delete mode 100644 queue-6.4/drm-fbdev-dma-fix-documented-default-preferred_bpp-v.patch
 delete mode 100644 queue-6.4/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
 delete mode 100644 queue-6.4/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
 delete mode 100644 queue-6.4/drm-nouveau-acr-abort-loading-acr-if-no-firmware-was.patch
 delete mode 100644 queue-6.4/drm-nouveau-bring-back-blit-subchannel-for-pre-nv50-.patch
 delete mode 100644 queue-6.4/drm-nouveau-disp-fix-hdmi-on-gt215.patch
 delete mode 100644 queue-6.4/drm-nouveau-disp-g94-enable-hdmi.patch
 delete mode 100644 queue-6.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
 delete mode 100644 queue-6.4/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
 delete mode 100644 queue-6.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
 delete mode 100644 queue-6.4/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
 delete mode 100644 queue-6.4/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
 delete mode 100644 queue-6.4/fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch
 delete mode 100644 queue-6.4/gve-set-default-duplex-configuration-to-full.patch
 delete mode 100644 queue-6.4/hid-hyperv-avoid-struct-memcpy-overrun-warning.patch
 delete mode 100644 queue-6.4/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
 delete mode 100644 queue-6.4/ice-fix-tx-queue-rate-limit-when-tcs-are-configured.patch
 delete mode 100644 queue-6.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
 delete mode 100644 queue-6.4/igc-add-condition-for-qbv_config_change_errors-count.patch
 delete mode 100644 queue-6.4/igc-add-igc_xdp_buff-wrapper-for-xdp_buff-in-driver.patch
 delete mode 100644 queue-6.4/igc-add-xdp-hints-kfuncs-for-rx-hash.patch
 delete mode 100644 queue-6.4/igc-do-not-enable-taprio-offload-for-invalid-argumen.patch
 delete mode 100644 queue-6.4/igc-fix-inserting-of-empty-frame-for-launchtime.patch
 delete mode 100644 queue-6.4/igc-fix-launchtime-before-start-of-cycle.patch
 delete mode 100644 queue-6.4/igc-fix-tx-hang-issue-when-qbv-gate-is-closed.patch
 delete mode 100644 queue-6.4/igc-handle-already-enabled-taprio-offload-for-baseti.patch
 delete mode 100644 queue-6.4/igc-handle-pps-start-time-programming-for-past-time-.patch
 delete mode 100644 queue-6.4/igc-include-the-length-type-field-and-vlan-tag-in-qu.patch
 delete mode 100644 queue-6.4/igc-no-strict-mode-in-pure-launchtime-cbs-offload.patch
 delete mode 100644 queue-6.4/igc-remove-delay-during-tx-ring-configuration.patch
 delete mode 100644 queue-6.4/igc-rename-qbv_enable-to-taprio_offload_enable.patch
 delete mode 100644 queue-6.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
 delete mode 100644 queue-6.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
 delete mode 100644 queue-6.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
 delete mode 100644 queue-6.4/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
 delete mode 100644 queue-6.4/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
 delete mode 100644 queue-6.4/net-dsa-felix-make-vsc9959_tas_guard_bands_update-vi.patch
 delete mode 100644 queue-6.4/net-dsa-qca8k-add-check-for-skb_copy.patch
 delete mode 100644 queue-6.4/net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch
 delete mode 100644 queue-6.4/net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch
 delete mode 100644 queue-6.4/net-fec-recycle-pages-for-transmitted-xdp-frames.patch
 delete mode 100644 queue-6.4/net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch
 delete mode 100644 queue-6.4/net-fec-remove-useless-fec_enet_reset_skb.patch
 delete mode 100644 queue-6.4/net-mlx5-query-hca_cap_2-only-when-supported.patch
 delete mode 100644 queue-6.4/net-mlx5-register-a-unique-thermal-zone-per-device.patch
 delete mode 100644 queue-6.4/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
 delete mode 100644 queue-6.4/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
 delete mode 100644 queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
 delete mode 100644 queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
 delete mode 100644 queue-6.4/net-mlx5e-rx-fix-flush-and-close-release-flow-of-reg.patch
 delete mode 100644 queue-6.4/net-mlx5e-rx-fix-page_pool-page-fragment-tracking-fo.patch
 delete mode 100644 queue-6.4/net-mlx5e-tc-ct-offload-ct-clear-only-once.patch
 delete mode 100644 queue-6.4/net-mscc-ocelot-fix-oversize-frame-dropping-for-pree.patch
 delete mode 100644 queue-6.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
 delete mode 100644 queue-6.4/net-prevent-skb-corruption-on-frag-list-segmentation.patch
 delete mode 100644 queue-6.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
 delete mode 100644 queue-6.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
 delete mode 100644 queue-6.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
 delete mode 100644 queue-6.4/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
 delete mode 100644 queue-6.4/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch
 delete mode 100644 queue-6.4/net-sched-taprio-replace-tc_taprio_qopt_offload-enab.patch
 delete mode 100644 queue-6.4/net-txgbe-fix-eeprom-calculation-error.patch
 delete mode 100644 queue-6.4/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
 delete mode 100644 queue-6.4/netfilter-conntrack-don-t-fold-port-numbers-into-add.patch
 delete mode 100644 queue-6.4/netfilter-nf_tables-report-use-refcount-overflow.patch
 delete mode 100644 queue-6.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
 delete mode 100644 queue-6.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
 delete mode 100644 queue-6.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
 delete mode 100644 queue-6.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
 delete mode 100644 queue-6.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
 delete mode 100644 queue-6.4/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
 delete mode 100644 queue-6.4/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
 delete mode 100644 queue-6.4/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
 delete mode 100644 queue-6.4/octeontx2-af-promisc-enable-disable-through-mbox.patch
 delete mode 100644 queue-6.4/octeontx2-pf-add-additional-check-for-mcam-rules.patch
 delete mode 100644 queue-6.4/openrisc-union-fpcsr-and-oldmask-in-sigcontext-to-un.patch
 delete mode 100644 queue-6.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
 delete mode 100644 queue-6.4/riscv-bpf-fix-inconsistent-jit-image-generation.patch
 delete mode 100644 queue-6.4/riscv-mm-fix-truncation-warning-on-rv32.patch
 delete mode 100644 queue-6.4/s390-ism-do-not-unregister-clients-with-registered-d.patch
 delete mode 100644 queue-6.4/s390-ism-fix-and-simplify-add-remove-callback-handli.patch
 delete mode 100644 queue-6.4/s390-ism-fix-locking-for-forwarding-of-irqs-and-even.patch
 delete mode 100644 queue-6.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
 delete mode 100644 queue-6.4/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
 delete mode 100644 queue-6.4/swiotlb-always-set-the-number-of-areas-before-alloca.patch
 delete mode 100644 queue-6.4/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
 delete mode 100644 queue-6.4/udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch
 delete mode 100644 queue-6.4/udp6-fix-udp6_ehashfn-typo.patch
 delete mode 100644 queue-6.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
 delete mode 100644 queue-6.4/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
 delete mode 100644 queue-6.4/x86-fineibt-poison-endbr-at-0.patch
 delete mode 100644 queue-6.4/xdp-use-trusted-arguments-in-xdp-hints-kfuncs.patch
 delete mode 100644 queue-6.4/xen-virtio-fix-null-deref-when-a-bridge-of-pci-root-.patch

diff --git a/queue-4.14/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-4.14/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index e0aaf0f20b1..00000000000
--- a/queue-4.14/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From efb0a2b5d1896beed319a1b35adca84329d92410 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 0d3e76b160a5b..6703a5b65e4a6 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -325,9 +325,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-4.14/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-4.14/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index 59eca8dfdd0..00000000000
--- a/queue-4.14/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 64b36917f1cd006357f7c39b8a6e839a6e55022a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index dbed8fbedd8a8..eff7c65fbe3c7 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1402,7 +1402,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -3387,7 +3387,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-4.14/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-4.14/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index d81b5b8e453..00000000000
--- a/queue-4.14/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From b6c132433f1d835573ee3121e095aff6539d2a8c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 85e059d3bc233..7b6024f2d4eaa 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -133,7 +133,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline bool is_classid_clsact_ingress(u32 classid)
--- 
-2.39.2
-
diff --git a/queue-4.14/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-4.14/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index 47c6f19a26e..00000000000
--- a/queue-4.14/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 228e20785a039ed281240f51e0e776c45b0c193d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 72a7981ef73fb..05693edaba11b 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1135,12 +1135,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.14/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-4.14/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index b64925346a2..00000000000
--- a/queue-4.14/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 304a44f7c6326a4c06ac4b7002f5dbe8091d06e2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index b68e2cad74cc7..d6f68a17bbd91 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2689,6 +2689,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2696,7 +2697,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.14/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-4.14/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index f09cf28829e..00000000000
--- a/queue-4.14/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 429118da81c9f29e126a6de55cd1f9d0d1335b85 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_intel.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
-index 58068f1447bb2..6b1484b4351d8 100644
---- a/drivers/ntb/hw/intel/ntb_hw_intel.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
-@@ -3041,12 +3041,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.14/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-4.14/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index f6b4d2c25a1..00000000000
--- a/queue-4.14/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From b8a902d10adf9b89e0d697a60c0b4b209fe4a334 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index 18339b7e88a46..a58ced5d60433 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -395,7 +395,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-4.14/series b/queue-4.14/series
index 9f44e177d62..5adb1884d92 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -89,12 +89,3 @@ netfilter-nf_tables-add-nft_trans_prepare_error-to-deal-with-bound-set-chain.pat
 netfilter-nf_tables-unbind-non-anonymous-set-if-rule-construction-fails.patch
 netfilter-conntrack-avoid-nf_ct_helper_hash-uses-after-free.patch
 netfilter-nf_tables-prevent-oob-access-in-nft_byteorder_eval.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
diff --git a/queue-4.14/udp6-fix-udp6_ehashfn-typo.patch b/queue-4.14/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index fbfe6df582a..00000000000
--- a/queue-4.14/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 2927d67c624afeb44315f11920007eaa63c4fff7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index ea681360a522f..3fee10cc5d5dc 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -99,7 +99,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- static u32 udp6_portaddr_hash(const struct net *net,
--- 
-2.39.2
-
diff --git a/queue-4.14/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-4.14/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index 75c1afd5072..00000000000
--- a/queue-4.14/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 43182c3eb375b8f03b25d7831c442b9753b1a3cd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index d06dc446a3931..ca4a3330337d7 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6102,8 +6102,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-4.19/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-4.19/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index 3227658c36f..00000000000
--- a/queue-4.19/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 46ae827efd8dbae05deb396bf8beb1545f27f411 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index 1b86a2e03d049..bfafd7649ccb3 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -407,7 +407,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-4.19/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-4.19/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index eeacf645c73..00000000000
--- a/queue-4.19/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From b6b485d5880cefb054197d49b212532df8ee9263 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index f261c6d7f1f28..23edc325f70be 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -316,9 +316,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-4.19/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-4.19/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index 987b2a40ed8..00000000000
--- a/queue-4.19/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From f9e8a622e20536ae06e72b75b9d71051521991fb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index f1a4b11ce0d19..512f9cd68070a 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1415,7 +1415,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -3665,7 +3665,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-4.19/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-4.19/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index 0b060652053..00000000000
--- a/queue-4.19/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 19bfe7281d835cff53c41f2059bbd4222c112960 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index e09ea6917c061..83a16f3bd6e6a 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -131,7 +131,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-4.19/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-4.19/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index 50404b9a780..00000000000
--- a/queue-4.19/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 5d7e064f00a219bea355726f35ad8949bc616514 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 0b1fbb5dba9b6..7de7616803935 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1139,12 +1139,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.19/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-4.19/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index 2613d7d0cfa..00000000000
--- a/queue-4.19/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 6c414abbd187488cca9dedbfb323305e19628e74 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index a67ef23e81bca..82e08f583980b 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2692,6 +2692,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2699,7 +2700,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.19/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-4.19/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index e1e8747c123..00000000000
--- a/queue-4.19/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 358aa040c10230eb3cb6ebcf84c9dfe99ded0948 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index 2ad263f708da7..084bd1d1ac1dc 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2052,12 +2052,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-4.19/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-4.19/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index eb80d5ff7cf..00000000000
--- a/queue-4.19/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From f72bc20308a55f4ea33714c839246367d246b89d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 6301aa413c3b8..1f64146546221 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-4.19/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-4.19/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index 8fd7c5128b6..00000000000
--- a/queue-4.19/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 7b07412afefa9dcd30ba063fc844a1f2104b6fae Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index 9398959664769..2d647a1cd0ee5 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -393,7 +393,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-4.19/series b/queue-4.19/series
index fa35ca48a01..ae4e36dbf20 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -134,15 +134,3 @@ netfilter-nf_tables-unbind-non-anonymous-set-if-rule-construction-fails.patch
 netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
 netfilter-conntrack-avoid-nf_ct_helper_hash-uses-after-free.patch
 netfilter-nf_tables-prevent-oob-access-in-nft_byteorder_eval.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-vrf-increment-icmp6inmsgs-on-the-original-netdev.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
diff --git a/queue-4.19/udp6-fix-udp6_ehashfn-typo.patch b/queue-4.19/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index 83cd000c763..00000000000
--- a/queue-4.19/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From dd4780f2e582e32ee8f5c8c08d03b8b73e369d5c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 9274603514e54..cf0bbe2e3a79f 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -99,7 +99,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-4.19/vrf-increment-icmp6inmsgs-on-the-original-netdev.patch b/queue-4.19/vrf-increment-icmp6inmsgs-on-the-original-netdev.patch
deleted file mode 100644
index fd7f5edd549..00000000000
--- a/queue-4.19/vrf-increment-icmp6inmsgs-on-the-original-netdev.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From ca9b3ac6d3bbb8860c544487324e18a6481a20d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jun 2019 10:32:50 -0400
-Subject: vrf: Increment Icmp6InMsgs on the original netdev
-
-From: Stephen Suryaputra <ssuryaextr@gmail.com>
-
-[ Upstream commit e1ae5c2ea4783b1fd87be250f9fcc9d9e1a6ba3f ]
-
-Get the ingress interface and increment ICMP counters based on that
-instead of skb->dev when the the dev is a VRF device.
-
-This is a follow up on the following message:
-https://www.spinics.net/lists/netdev/msg560268.html
-
-v2: Avoid changing skb->dev since it has unintended effect for local
-    delivery (David Ahern).
-Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
-Reviewed-by: David Ahern <dsahern@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 2aaa8a15de73 ("icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/addrconf.h | 16 ++++++++++++++++
- net/ipv6/icmp.c        | 17 +++++++++++------
- net/ipv6/reassembly.c  |  4 ++--
- 3 files changed, 29 insertions(+), 8 deletions(-)
-
-diff --git a/include/net/addrconf.h b/include/net/addrconf.h
-index db2a87981dd46..9583d3bbab039 100644
---- a/include/net/addrconf.h
-+++ b/include/net/addrconf.h
-@@ -340,6 +340,22 @@ static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
- 	return rcu_dereference_rtnl(dev->ip6_ptr);
- }
- 
-+/**
-+ * __in6_dev_stats_get - get inet6_dev pointer for stats
-+ * @dev: network device
-+ * @skb: skb for original incoming interface if neeeded
-+ *
-+ * Caller must hold rcu_read_lock or RTNL, because this function
-+ * does not take a reference on the inet6_dev.
-+ */
-+static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,
-+						    const struct sk_buff *skb)
-+{
-+	if (netif_is_l3_master(dev))
-+		dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
-+	return __in6_dev_get(dev);
-+}
-+
- /**
-  * __in6_dev_get_safely - get inet6_dev pointer from netdevice
-  * @dev: network device
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index fbc8746371b6d..1b86a2e03d049 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -395,23 +395,28 @@ static struct dst_entry *icmpv6_route_lookup(struct net *net,
- 	return ERR_PTR(err);
- }
- 
--static int icmp6_iif(const struct sk_buff *skb)
-+static struct net_device *icmp6_dev(const struct sk_buff *skb)
- {
--	int iif = skb->dev->ifindex;
-+	struct net_device *dev = skb->dev;
- 
- 	/* for local traffic to local address, skb dev is the loopback
- 	 * device. Check if there is a dst attached to the skb and if so
- 	 * get the real device index. Same is needed for replies to a link
- 	 * local address on a device enslaved to an L3 master device
- 	 */
--	if (unlikely(iif == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
-+	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
- 		if (rt6)
--			iif = rt6->rt6i_idev->dev->ifindex;
-+			dev = rt6->rt6i_idev->dev;
- 	}
- 
--	return iif;
-+	return dev;
-+}
-+
-+static int icmp6_iif(const struct sk_buff *skb)
-+{
-+	return icmp6_dev(skb)->ifindex;
- }
- 
- /*
-@@ -800,7 +805,7 @@ void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
- static int icmpv6_rcv(struct sk_buff *skb)
- {
- 	struct net *net = dev_net(skb->dev);
--	struct net_device *dev = skb->dev;
-+	struct net_device *dev = icmp6_dev(skb);
- 	struct inet6_dev *idev = __in6_dev_get(dev);
- 	const struct in6_addr *saddr, *daddr;
- 	struct icmp6hdr *hdr;
-diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
-index 60dfd0d118512..b596727f04978 100644
---- a/net/ipv6/reassembly.c
-+++ b/net/ipv6/reassembly.c
-@@ -302,7 +302,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
- 			   skb_network_header_len(skb));
- 
- 	rcu_read_lock();
--	__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
-+	__IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMOKS);
- 	rcu_read_unlock();
- 	fq->q.fragments = NULL;
- 	fq->q.rb_fragments = RB_ROOT;
-@@ -317,7 +317,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
- 	net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
- out_fail:
- 	rcu_read_lock();
--	__IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
-+	__IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMFAILS);
- 	rcu_read_unlock();
- 	inet_frag_kill(&fq->q);
- 	return -1;
--- 
-2.39.2
-
diff --git a/queue-4.19/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-4.19/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index e6a83160c61..00000000000
--- a/queue-4.19/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5f65296a9458994473a1830d34aed8a66606adf3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index 5a6ee0b014da0..a01b42c7c07ac 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6100,8 +6100,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-5.10/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch b/queue-5.10/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
deleted file mode 100644
index dfa0414e7c7..00000000000
--- a/queue-5.10/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 08e94dd671f1cf66d7c8791d504ecf41c85a776f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 17:28:11 +0800
-Subject: bpf, riscv: Support riscv jit to provide bpf_line_info
-
-From: Pu Lehui <pulehui@huawei.com>
-
-[ Upstream commit 3cb70413041fdf028fa1ba3986fd0c6aec9e3dcb ]
-
-Add support for riscv jit to provide bpf_line_info. We need to
-consider the prologue offset in ctx->offset, but unlike x86 and
-arm64, ctx->offset of riscv does not provide an extra slot for
-the prologue, so here we just calculate the len of prologue and
-add it to ctx->offset at the end. Both RV64 and RV32 have been
-tested.
-
-Signed-off-by: Pu Lehui <pulehui@huawei.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20220530092815.1112406-3-pulehui@huawei.com
-Stable-dep-of: c56fb2aab235 ("riscv, bpf: Fix inconsistent JIT image generation")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      | 1 +
- arch/riscv/net/bpf_jit_core.c | 8 +++++++-
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index 75c1e99968675..ab0cd6d10ccf3 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,6 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
-+	int body_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	unsigned long flags;
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 5d247198c30d3..750b15c319d5d 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -43,7 +43,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- {
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, i;
-+	int pass = 0, prev_ninsns = 0, prologue_len, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 	unsigned int image_size = 0;
-@@ -95,6 +95,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
-+		ctx->body_len = ctx->ninsns;
- 		bpf_jit_build_prologue(ctx);
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
-@@ -154,6 +155,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
-+		prologue_len = ctx->epilogue_offset - ctx->body_len;
-+		for (i = 0; i < prog->len; i++)
-+			ctx->offset[i] = ninsns_rvoff(prologue_len +
-+						      ctx->offset[i]);
-+		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
- 		kfree(jit_data);
--- 
-2.39.2
-
diff --git a/queue-5.10/drm-panel-simple-add-connector_type-for-innolux_at04.patch b/queue-5.10/drm-panel-simple-add-connector_type-for-innolux_at04.patch
deleted file mode 100644
index 5ac1deb819f..00000000000
--- a/queue-5.10/drm-panel-simple-add-connector_type-for-innolux_at04.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 31d7ebc306aee8cd050979655f24bf30429400b9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 08:22:02 -0300
-Subject: drm/panel: simple: Add connector_type for innolux_at043tn24
-
-From: Fabio Estevam <festevam@denx.de>
-
-[ Upstream commit 2c56a751845ddfd3078ebe79981aaaa182629163 ]
-
-The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type'
-information to avoid the following warning:
-
-panel-simple panel: Specify missing connector_type
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24")
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index b0b92f436879a..ffda99c204356 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2091,6 +2091,7 @@ static const struct panel_desc innolux_at043tn24 = {
- 		.height = 54,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
-+	.connector_type = DRM_MODE_CONNECTOR_DPI,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch b/queue-5.10/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
deleted file mode 100644
index 6adae45da16..00000000000
--- a/queue-5.10/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0b1bddd8f52eb2d2c5215e3046b6c2ca1b3442f8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 22:16:02 +0200
-Subject: drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
-
-From: Marek Vasut <marex@denx.de>
-
-[ Upstream commit 1c519980aced3da1fae37c1339cf43b24eccdee7 ]
-
-Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC
-flags. Those are used by various bridges in the pipeline to correctly
-configure its sync signals polarity.
-
-Fixes: d69de69f2be1 ("drm/panel: simple: Add Powertip PH800480T013 panel")
-Signed-off-by: Marek Vasut <marex@denx.de>
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230615201602.565948-1-marex@denx.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index ffda99c204356..7b69f81444ebd 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3153,6 +3153,7 @@ static const struct drm_display_mode powertip_ph800480t013_idf02_mode = {
- 	.vsync_start = 480 + 49,
- 	.vsync_end = 480 + 49 + 2,
- 	.vtotal = 480 + 49 + 2 + 22,
-+	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
- };
- 
- static const struct panel_desc powertip_ph800480t013_idf02  = {
--- 
-2.39.2
-
diff --git a/queue-5.10/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch b/queue-5.10/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
deleted file mode 100644
index 5b52f7c4520..00000000000
--- a/queue-5.10/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From ab418c2e4ce893c2f6c065ff11c691b4fa2419ee Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 17:34:10 +0800
-Subject: erofs: avoid infinite loop in z_erofs_do_read_page() when reading
- beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ]
-
-z_erofs_do_read_page() may loop infinitely due to the inappropriate
-truncation in the below statement. Since the offset is 64 bits and min_t()
-truncates the result to 32 bits. The solution is to replace unsigned int
-with a 64-bit type, such as erofs_off_t.
-    cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-
-    - For example:
-        - offset = 0x400160000
-        - end = 0x370
-        - map->m_la = 0x160370
-        - offset + end - map->m_la = 0x400000000
-        - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
-    - Expected result:
-        - cur = 0
-    - Actual result:
-        - cur = 0x370
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index 8cb2cf612e49b..9cff927382599 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -629,7 +629,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 	tight &= (clt->mode >= COLLECT_PRIMARY_HOOKED &&
- 		  clt->mode != COLLECT_PRIMARY_FOLLOWED_NOINPLACE);
- 
--	cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-+	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
- 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
- 		zero_user_segment(page, cur, end);
- 		goto next_part;
--- 
-2.39.2
-
diff --git a/queue-5.10/gve-set-default-duplex-configuration-to-full.patch b/queue-5.10/gve-set-default-duplex-configuration-to-full.patch
deleted file mode 100644
index e2ab8b698b4..00000000000
--- a/queue-5.10/gve-set-default-duplex-configuration-to-full.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 16788fe6a3213dc782c2135f0e2e7ba48ec48d54 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 12:41:28 +0800
-Subject: gve: Set default duplex configuration to full
-
-From: Junfeng Guo <junfeng.guo@intel.com>
-
-[ Upstream commit 0503efeadbf6bb8bf24397613a73b67e665eac5f ]
-
-Current duplex mode was unset in the driver, resulting in the default
-parameter being set to 0, which corresponds to half duplex. It might
-mislead users to have incorrect expectation about the driver's
-transmission capabilities.
-Set the default duplex configuration to full, as the driver runs in
-full duplex mode at this point.
-
-Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.")
-Signed-off-by: Junfeng Guo <junfeng.guo@intel.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Message-ID: <20230706044128.2726747-1-junfeng.guo@intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/google/gve/gve_ethtool.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
-index e0449cc24fbdb..cbfd007449351 100644
---- a/drivers/net/ethernet/google/gve/gve_ethtool.c
-+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
-@@ -516,6 +516,9 @@ static int gve_get_link_ksettings(struct net_device *netdev,
- 		err = gve_adminq_report_link_speed(priv);
- 
- 	cmd->base.speed = priv->link_speed;
-+
-+	cmd->base.duplex = DUPLEX_FULL;
-+
- 	return err;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-5.10/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index aa2256cec62..00000000000
--- a/queue-5.10/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From fd4812e25f97d7173396b96409ed2a2b0b4ed5df Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index fd1f896115c1e..d01165bb6a32b 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -429,7 +429,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/igc-fix-inserting-of-empty-frame-for-launchtime.patch b/queue-5.10/igc-fix-inserting-of-empty-frame-for-launchtime.patch
deleted file mode 100644
index ea7234f31a1..00000000000
--- a/queue-5.10/igc-fix-inserting-of-empty-frame-for-launchtime.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 28e19afbca0fa1e531bf500dfb1772f86514af4d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:14 +0200
-Subject: igc: Fix inserting of empty frame for launchtime
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 0bcc62858d6ba62cbade957d69745e6adeed5f3d ]
-
-The insertion of an empty frame was introduced with
-commit db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-in order to ensure that the current cycle has at least one packet if
-there is some packet to be scheduled for the next cycle.
-
-However, the current implementation does not properly check if
-a packet is already scheduled for the current cycle. Currently,
-an empty packet is always inserted if and only if
-txtime >= end_of_cycle && txtime > last_tx_cycle
-but since last_tx_cycle is always either the end of the current
-cycle (end_of_cycle) or the end of a previous cycle, the
-second part (txtime > last_tx_cycle) is always true unless
-txtime == last_tx_cycle.
-
-What actually needs to be checked here is if the last_tx_cycle
-was already written within the current cycle, so an empty frame
-should only be inserted if and only if
-txtime >= end_of_cycle && end_of_cycle > last_tx_cycle.
-
-This patch does not only avoid an unnecessary insertion, but it
-can actually be harmful to insert an empty packet if packets
-are already scheduled in the current cycle, because it can lead
-to a situation where the empty packet is actually processed
-as the first packet in the upcoming cycle shifting the packet
-with the first_flag even one cycle into the future, finally leading
-to a TX hang.
-
-The TX hang can be reproduced on a i225 with:
-
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x1 \
-	    txtime-delay 500000 \
-	    clockid CLOCK_TAI
-    sudo tc qdisc replace dev enp1s0 parent 100:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload \
-	    skip_sock_check
-
-and traffic generator
-
-    sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns
-
-with traffic.cfg
-
-    #define ETH_P_IP        0x0800
-
-    {
-      /* Ethernet Header */
-      0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e,  # MAC Dest - adapt as needed
-      0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36,  # MAC Src  - adapt as needed
-      const16(ETH_P_IP),
-
-      /* IPv4 Header */
-      0b01000101, 0,   # IPv4 version, IHL, TOS
-      const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))
-      const16(2),      # IPv4 ident
-      0b01000000, 0,   # IPv4 flags, fragmentation off
-      64,              # IPv4 TTL
-      17,              # Protocol UDP
-      csumip(14, 33),  # IPv4 checksum
-
-      /* UDP Header */
-      10,  0, 48, 1,   # IP Src - adapt as needed
-      10,  0, 48, 10,  # IP Dest - adapt as needed
-      const16(5555),   # UDP Src Port
-      const16(6666),   # UDP Dest Port
-      const16(1008),   # UDP length (UDP header 8 bytes + payload length)
-      csumudp(14, 34), # UDP checksum
-
-      /* Payload */
-      fill('W', 1000),
-    }
-
-and the observed message with that is for example
-
- igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang
-   Tx Queue             <0>
-   TDH                  <32>
-   TDT                  <3c>
-   next_to_use          <3c>
-   next_to_clean        <32>
- buffer_info[next_to_clean]
-   time_stamp           <ffff26a8>
-   next_to_watch        <00000000632a1828>
-   jiffies              <ffff27f8>
-   desc.status          <1048000>
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 051b1048eb41b..631ce793fb2ec 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -918,7 +918,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 			*first_flag = true;
- 			ring->last_ff_cycle = baset_est;
- 
--			if (ktime_compare(txtime, ring->last_tx_cycle) > 0)
-+			if (ktime_compare(end_of_cycle, ring->last_tx_cycle) > 0)
- 				*insert_empty = true;
- 		}
- 	}
--- 
-2.39.2
-
diff --git a/queue-5.10/igc-fix-launchtime-before-start-of-cycle.patch b/queue-5.10/igc-fix-launchtime-before-start-of-cycle.patch
deleted file mode 100644
index a52262e4338..00000000000
--- a/queue-5.10/igc-fix-launchtime-before-start-of-cycle.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5bd9a05d5faa13c4939b72db846ba1a409b9bc39 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:13 +0200
-Subject: igc: Fix launchtime before start of cycle
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit c1bca9ac0bcb355be11354c2e68bc7bf31f5ac5a ]
-
-It is possible (verified on a running system) that frames are processed
-by igc_tx_launchtime with a txtime before the start of the cycle
-(baset_est).
-
-However, the result of txtime - baset_est is written into a u32,
-leading to a wrap around to a positive number. The following
-launchtime > 0 check will only branch to executing launchtime = 0
-if launchtime is already 0.
-
-Fix it by using a s32 before checking launchtime > 0.
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 2b51ee87a2def..051b1048eb41b 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -905,7 +905,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 	ktime_t base_time = adapter->base_time;
- 	ktime_t now = ktime_get_clocktai();
- 	ktime_t baset_est, end_of_cycle;
--	u32 launchtime;
-+	s32 launchtime;
- 	s64 n;
- 
- 	n = div64_s64(ktime_sub_ns(now, base_time), cycle_time);
--- 
-2.39.2
-
diff --git a/queue-5.10/igc-remove-delay-during-tx-ring-configuration.patch b/queue-5.10/igc-remove-delay-during-tx-ring-configuration.patch
deleted file mode 100644
index a0e9e75312a..00000000000
--- a/queue-5.10/igc-remove-delay-during-tx-ring-configuration.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 2db76a308aa7625f060b0945befbf2f97128673c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 May 2023 08:18:12 +0800
-Subject: igc: Remove delay during TX ring configuration
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit cca28ceac7c7857bc2d313777017585aef00bcc4 ]
-
-Remove unnecessary delay during the TX ring configuration.
-This will cause delay, especially during link down and
-link up activity.
-
-Furthermore, old SKUs like as I225 will call the reset_adapter
-to reset the controller during TSN mode Gate Control List (GCL)
-setting. This will add more time to the configuration of the
-real-time use case.
-
-It doesn't mentioned about this delay in the Software User Manual.
-It might have been ported from legacy code I210 in the past.
-
-Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index a15e4b6d7fa40..2b51ee87a2def 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -600,7 +600,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter,
- 	/* disable the queue */
- 	wr32(IGC_TXDCTL(reg_idx), 0);
- 	wrfl();
--	mdelay(10);
- 
- 	wr32(IGC_TDLEN(reg_idx),
- 	     ring->count * sizeof(union igc_adv_tx_desc));
--- 
-2.39.2
-
diff --git a/queue-5.10/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch b/queue-5.10/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
deleted file mode 100644
index 96864b40f9e..00000000000
--- a/queue-5.10/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From b8e41a5723d033d84e74fa79a056bb31a3ed303b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 5 Jun 2023 11:09:01 -0700
-Subject: igc: set TP bit in 'supported' and 'advertising' fields of
- ethtool_link_ksettings
-
-From: Prasad Koya <prasad@arista.com>
-
-[ Upstream commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 ]
-
-set TP bit in the 'supported' and 'advertising' fields. i225/226 parts
-only support twisted pair copper.
-
-Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
-Signed-off-by: Prasad Koya <prasad@arista.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-index da259cd59adda..d28ac3a025ab1 100644
---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-@@ -1673,6 +1673,8 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
- 	/* twisted pair */
- 	cmd->base.port = PORT_TP;
- 	cmd->base.phy_address = hw->phy.addr;
-+	ethtool_link_ksettings_add_link_mode(cmd, supported, TP);
-+	ethtool_link_ksettings_add_link_mode(cmd, advertising, TP);
- 
- 	/* advertising link modes */
- 	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
--- 
-2.39.2
-
diff --git a/queue-5.10/ionic-remove-warn_on-to-prevent-panic_on_warn.patch b/queue-5.10/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
deleted file mode 100644
index 7ec6e836161..00000000000
--- a/queue-5.10/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From d882c5c49b84da8cf2d6039045449ef7fb0316bf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 11:20:06 -0700
-Subject: ionic: remove WARN_ON to prevent panic_on_warn
-
-From: Nitya Sunkad <nitya.sunkad@amd.com>
-
-[ Upstream commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 ]
-
-Remove unnecessary early code development check and the WARN_ON
-that it uses.  The irq alloc and free paths have long been
-cleaned up and this check shouldn't have stuck around so long.
-
-Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
-Signed-off-by: Nitya Sunkad <nitya.sunkad@amd.com>
-Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index fcd4213c99b83..098772601df8c 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -433,11 +433,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif)
- static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
--	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
--		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
--	}
--
- 	n_qcq->intr.vector = src_qcq->intr.vector;
- 	n_qcq->intr.index = src_qcq->intr.index;
- }
--- 
-2.39.2
-
diff --git a/queue-5.10/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-5.10/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index 4dd464c4d2a..00000000000
--- a/queue-5.10/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 07fc730e8fffd463605d4bd1de5a3366e57fae89 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index ed1e5bfc97b31..d5d10496b4aef 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -314,9 +314,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-5.10/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch b/queue-5.10/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
deleted file mode 100644
index 6ca6484e626..00000000000
--- a/queue-5.10/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From ed50cac1312221bd55775880bbadd85707d48851 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 08:53:25 +0200
-Subject: net: bgmac: postpone turning IRQs off to avoid SoC hangs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Rafał Miłecki <rafal@milecki.pl>
-
-[ Upstream commit e7731194fdf085f46d58b1adccfddbd0dfee4873 ]
-
-Turning IRQs off is done by accessing Ethernet controller registers.
-That can't be done until device's clock is enabled. It results in a SoC
-hang otherwise.
-
-This bug remained unnoticed for years as most bootloaders keep all
-Ethernet interfaces turned on. It seems to only affect a niche SoC
-family BCM47189. It has two Ethernet controllers but CFE bootloader uses
-only the first one.
-
-Fixes: 34322615cbaa ("net: bgmac: Mask interrupts during probe")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/broadcom/bgmac.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
-index bb999e67d7736..ab8ee93316354 100644
---- a/drivers/net/ethernet/broadcom/bgmac.c
-+++ b/drivers/net/ethernet/broadcom/bgmac.c
-@@ -1492,8 +1492,6 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 
- 	bgmac->in_init = true;
- 
--	bgmac_chip_intrs_off(bgmac);
--
- 	net_dev->irq = bgmac->irq;
- 	SET_NETDEV_DEV(net_dev, bgmac->dev);
- 	dev_set_drvdata(bgmac->dev, bgmac);
-@@ -1511,6 +1509,8 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 	 */
- 	bgmac_clk_enable(bgmac, 0);
- 
-+	bgmac_chip_intrs_off(bgmac);
-+
- 	/* This seems to be fixing IRQ by assigning OOB #6 to the core */
- 	if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
- 		if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
--- 
-2.39.2
-
diff --git a/queue-5.10/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch b/queue-5.10/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
deleted file mode 100644
index 7f37aaa9fa5..00000000000
--- a/queue-5.10/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 4fab9166cfad1448f3e5a54a365ade31178e240e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 8 Jun 2023 09:32:10 +0200
-Subject: net/mlx5e: Check for NOT_READY flag state after locking
-
-From: Vlad Buslov <vladbu@nvidia.com>
-
-[ Upstream commit 65e64640e97c0f223e77f9ea69b5a46186b93470 ]
-
-Currently the check for NOT_READY flag is performed before obtaining the
-necessary lock. This opens a possibility for race condition when the flow
-is concurrently removed from unready_flows list by the workqueue task,
-which causes a double-removal from the list and a crash[0]. Fix the issue
-by moving the flag check inside the section protected by
-uplink_priv->unready_flows_lock mutex.
-
-[0]:
-[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP
-[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1
-[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
-[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.402999] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.403787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-[44376.406339] Call Trace:
-[44376.406651]  <TASK>
-[44376.406939]  ? die_addr+0x33/0x90
-[44376.407311]  ? exc_general_protection+0x192/0x390
-[44376.407795]  ? asm_exc_general_protection+0x22/0x30
-[44376.408292]  ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.408876]  __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]
-[44376.409482]  mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]
-[44376.410055]  mlx5e_flow_put+0x25/0x50 [mlx5_core]
-[44376.410529]  mlx5e_delete_flower+0x24b/0x350 [mlx5_core]
-[44376.411043]  tc_setup_cb_reoffload+0x22/0x80
-[44376.411462]  fl_reoffload+0x261/0x2f0 [cls_flower]
-[44376.411907]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.412481]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.413044]  tcf_block_playback_offloads+0x76/0x170
-[44376.413497]  tcf_block_unbind+0x7b/0xd0
-[44376.413881]  tcf_block_setup+0x17d/0x1c0
-[44376.414269]  tcf_block_offload_cmd.isra.0+0xf1/0x130
-[44376.414725]  tcf_block_offload_unbind+0x43/0x70
-[44376.415153]  __tcf_block_put+0x82/0x150
-[44376.415532]  ingress_destroy+0x22/0x30 [sch_ingress]
-[44376.415986]  qdisc_destroy+0x3b/0xd0
-[44376.416343]  qdisc_graft+0x4d0/0x620
-[44376.416706]  tc_get_qdisc+0x1c9/0x3b0
-[44376.417074]  rtnetlink_rcv_msg+0x29c/0x390
-[44376.419978]  ? rep_movs_alternative+0x3a/0xa0
-[44376.420399]  ? rtnl_calcit.isra.0+0x120/0x120
-[44376.420813]  netlink_rcv_skb+0x54/0x100
-[44376.421192]  netlink_unicast+0x1f6/0x2c0
-[44376.421573]  netlink_sendmsg+0x232/0x4a0
-[44376.421980]  sock_sendmsg+0x38/0x60
-[44376.422328]  ____sys_sendmsg+0x1d0/0x1e0
-[44376.422709]  ? copy_msghdr_from_user+0x6d/0xa0
-[44376.423127]  ___sys_sendmsg+0x80/0xc0
-[44376.423495]  ? ___sys_recvmsg+0x8b/0xc0
-[44376.423869]  __sys_sendmsg+0x51/0x90
-[44376.424226]  do_syscall_64+0x3d/0x90
-[44376.424587]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
-[44376.425046] RIP: 0033:0x7f045134f887
-[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
-[44376.426914] RSP: 002b:00007ffd63a82b98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
-[44376.427592] RAX: ffffffffffffffda RBX: 000000006481955f RCX: 00007f045134f887
-[44376.428195] RDX: 0000000000000000 RSI: 00007ffd63a82c00 RDI: 0000000000000003
-[44376.428796] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
-[44376.429404] R10: 00007f0451208708 R11: 0000000000000246 R12: 0000000000000001
-[44376.430039] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
-[44376.430644]  </TASK>
-[44376.430907] Modules linked in: mlx5_ib mlx5_core act_mirred act_tunnel_key cls_flower vxlan dummy sch_ingress openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_g
-ss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core]
-[44376.433936] ---[ end trace 0000000000000000 ]---
-[44376.434373] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.434951] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.436452] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.436924] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.437530] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.438179] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.438786] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.439393] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.439998] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.440714] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.441225] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.441843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.442471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-
-Fixes: ad86755b18d5 ("net/mlx5e: Protect unready flows with dedicated lock")
-Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
-Reviewed-by: Roi Dayan <roid@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-index 16846442717dc..c6a81a51530d2 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -1334,7 +1334,8 @@ static void remove_unready_flow(struct mlx5e_tc_flow *flow)
- 	uplink_priv = &rpriv->uplink_priv;
- 
- 	mutex_lock(&uplink_priv->unready_flows_lock);
--	unready_flow_del(flow);
-+	if (flow_flag_test(flow, NOT_READY))
-+		unready_flow_del(flow);
- 	mutex_unlock(&uplink_priv->unready_flows_lock);
- }
- 
-@@ -1475,8 +1476,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
- 
- 	mlx5e_put_flow_tunnel_id(flow);
- 
--	if (flow_flag_test(flow, NOT_READY))
--		remove_unready_flow(flow);
-+	remove_unready_flow(flow);
- 
- 	if (mlx5e_is_offloaded_flow(flow)) {
- 		if (flow_flag_test(flow, SLOW))
--- 
-2.39.2
-
diff --git a/queue-5.10/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch b/queue-5.10/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
deleted file mode 100644
index 390629d9fcf..00000000000
--- a/queue-5.10/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 51c1d01a8df6ae61c3421a1b34f59d4ff6474735 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 08:59:34 +0800
-Subject: net/mlx5e: fix double free in mlx5e_destroy_flow_table
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 884abe45a9014d0de2e6edb0630dfd64f23f1d1b ]
-
-In function accel_fs_tcp_create_groups(), when the ft->g memory is
-successfully allocated but the 'in' memory fails to be allocated, the
-memory pointed to by ft->g is released once. And in function
-accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
-the memory pointed to by ft->g again. This will cause double free problem.
-
-Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-index e51f60b55daa4..2da90f6649d17 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-@@ -194,6 +194,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
- 	in = kvzalloc(inlen, GFP_KERNEL);
- 	if  (!in || !ft->g) {
- 		kfree(ft->g);
-+		ft->g = NULL;
- 		kvfree(in);
- 		return -ENOMEM;
- 	}
--- 
-2.39.2
-
diff --git a/queue-5.10/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-5.10/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index 48d4f71190f..00000000000
--- a/queue-5.10/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 8d474071fb65277ad4a185d716e67d58a5603536 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index f5567d485e91a..3656a3937eca6 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1471,7 +1471,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -4165,7 +4165,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-5.10/net-prevent-skb-corruption-on-frag-list-segmentation.patch b/queue-5.10/net-prevent-skb-corruption-on-frag-list-segmentation.patch
deleted file mode 100644
index 469cf66b8f0..00000000000
--- a/queue-5.10/net-prevent-skb-corruption-on-frag-list-segmentation.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 26aa2d34f0d6c8d867b7723dbaeb20226317bd4e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 10:11:10 +0200
-Subject: net: prevent skb corruption on frag list segmentation
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]
-
-Ian reported several skb corruptions triggered by rx-gro-list,
-collecting different oops alike:
-
-[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
-[   62.631083] #PF: supervisor read access in kernel mode
-[   62.636312] #PF: error_code(0x0000) - not-present page
-[   62.641541] PGD 0 P4D 0
-[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
-[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
-[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
-[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
-./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
-net/ipv4/udp_offload.c:277)
-[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
-[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
-[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
-[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
-[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
-[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
-[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
-knlGS:0000000000000000
-[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
-[   62.749948] Call Trace:
-[   62.752498]  <TASK>
-[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
-[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
-[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
-[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
-net/core/dev.c:3659)
-[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
-[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
-[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
-net/netfilter/core.c:626)
-[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
-[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
-[   62.829420] br_flood (net/bridge/br_forward.c:233)
-[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
-[   62.837403] br_handle_frame (net/bridge/br_input.c:298
-net/bridge/br_input.c:416)
-[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
-[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
-[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
-net/core/dev.c:5727)
-[   62.876795] napi_complete_done (./include/linux/list.h:37
-./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
-[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
-[   62.893534] __napi_poll (net/core/dev.c:6498)
-[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
-net/core/dev.c:6640)
-[   62.905276] kthread (kernel/kthread.c:379)
-[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
-[   62.917119]  </TASK>
-
-In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
-bridge, both to the local input path and to an egress device (tun).
-
-The segmentation of such packets unsafely writes to the cloned skbs
-with shared heads.
-
-This change addresses the issue by uncloning as needed the
-to-be-segmented skbs.
-
-Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
-Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
-Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/skbuff.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index e203172b9b9e7..b10285d06a2ca 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -3685,6 +3685,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
- 
- 	skb_push(skb, -skb_network_offset(skb) + offset);
- 
-+	/* Ensure the head is writeable before touching the shared info */
-+	err = skb_unclone(skb, GFP_ATOMIC);
-+	if (err)
-+		goto err_linearize;
-+
- 	skb_shinfo(skb)->frag_list = NULL;
- 
- 	while (list_skb) {
--- 
-2.39.2
-
diff --git a/queue-5.10/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch b/queue-5.10/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
deleted file mode 100644
index 26a7b7a3f8f..00000000000
--- a/queue-5.10/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From a5dfedd80251cd7f449b05be9ca3bfee01513642 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 12:15:30 -0400
-Subject: net/sched: cls_fw: Fix improper refcount update leads to
- use-after-free
-
-From: M A Ramdhan <ramdhan@starlabs.sg>
-
-[ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ]
-
-In the event of a failure in tcf_change_indev(), fw_set_parms() will
-immediately return an error after incrementing or decrementing
-reference counter in tcf_bind_filter().  If attacker can control
-reference counter to zero and make reference freed, leading to
-use after free.
-
-In order to prevent this, move the point of possible failure above the
-point where the TC_FW_CLASSID is handled.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
-Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
-Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_fw.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
-index ec945294626a8..41f0898a5a565 100644
---- a/net/sched/cls_fw.c
-+++ b/net/sched/cls_fw.c
-@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_FW_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
--	}
--
- 	if (tb[TCA_FW_INDEV]) {
- 		int ret;
- 		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
-@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	} else if (head->mask != 0xFFFFFFFF)
- 		return err;
- 
-+	if (tb[TCA_FW_CLASSID]) {
-+		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
-+		tcf_bind_filter(tp, &f->res, base);
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/net-sched-flower-ensure-both-minimum-and-maximum-por.patch b/queue-5.10/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
deleted file mode 100644
index 3df73ff13f1..00000000000
--- a/queue-5.10/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 1b7c76fe6d9b400849874bef849242b3832a3ed2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 10:08:09 +0300
-Subject: net/sched: flower: Ensure both minimum and maximum ports are
- specified
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit d3f87278bcb80bd7f9519669d928b43320363d4f ]
-
-The kernel does not currently validate that both the minimum and maximum
-ports of a port range are specified. This can lead user space to think
-that a filter matching on a port range was successfully added, when in
-fact it was not. For example, with a patched (buggy) iproute2 that only
-sends the minimum port, the following commands do not return an error:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
-
- # tc filter show dev swp1 ingress
- filter protocol ip pref 1 flower chain 0
- filter protocol ip pref 1 flower chain 0 handle 0x1
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 1 ref 1 bind 1
-
- filter protocol ip pref 1 flower chain 0 handle 0x2
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 2 ref 1 bind 1
-
-Fix by returning an error unless both ports are specified:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
- Error: Both min and max source ports must be specified.
- We have an error talking to the kernel
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
- Error: Both min and max destination ports must be specified.
- We have an error talking to the kernel
-
-Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Petr Machata <petrm@nvidia.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index caf1a05bfbde4..dcf21d99f132c 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -778,6 +778,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
-+	if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max destination ports must be specified");
-+		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max source ports must be specified");
-+		return -EINVAL;
-+	}
- 	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
- 	    ntohs(key->tp_range.tp_max.dst) <=
- 	    ntohs(key->tp_range.tp_min.dst)) {
--- 
-2.39.2
-
diff --git a/queue-5.10/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-5.10/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index 73e21bed4e9..00000000000
--- a/queue-5.10/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 138f6a37f75054e68b1ab8f84c79d3580fbbbba5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index ba781e0aaf566..e186b2bd8c860 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -136,7 +136,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-5.10/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch b/queue-5.10/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
deleted file mode 100644
index a0a40945e6c..00000000000
--- a/queue-5.10/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From f2f7cbdad43b636ff9da4a90f187be4aeb8562b3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 18:01:02 -0300
-Subject: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 ]
-
-Lion says:
--------
-In the QFQ scheduler a similar issue to CVE-2023-31436
-persists.
-
-Consider the following code in net/sched/sch_qfq.c:
-
-static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
-                struct sk_buff **to_free)
-{
-     unsigned int len = qdisc_pkt_len(skb), gso_segs;
-
-    // ...
-
-     if (unlikely(cl->agg->lmax < len)) {
-         pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
-              cl->agg->lmax, len, cl->common.classid);
-         err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
-         if (err) {
-             cl->qstats.drops++;
-             return qdisc_drop(skb, sch, to_free);
-         }
-
-    // ...
-
-     }
-
-Similarly to CVE-2023-31436, "lmax" is increased without any bounds
-checks according to the packet length "len". Usually this would not
-impose a problem because packet sizes are naturally limited.
-
-This is however not the actual packet length, rather the
-"qdisc_pkt_len(skb)" which might apply size transformations according to
-"struct qdisc_size_table" as created by "qdisc_get_stab()" in
-net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.
-
-A user may choose virtually any size using such a table.
-
-As a result the same issue as in CVE-2023-31436 can occur, allowing heap
-out-of-bounds read / writes in the kmalloc-8192 cache.
--------
-
-We can create the issue with the following commands:
-
-tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
-overhead 999999999 linklayer ethernet qfq
-tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
-tc filter add dev $DEV parent 1: matchall classid 1:1
-ping -I $DEV 1.1.1.2
-
-This is caused by incorrectly assuming that qdisc_pkt_len() returns a
-length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.
-
-Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
-Reported-by: Lion <nnamrec@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 975e444f2d820..616d1798cfef6 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -381,8 +381,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight,
- 			   u32 lmax)
- {
- 	struct qfq_sched *q = qdisc_priv(sch);
--	struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight);
-+	struct qfq_aggregate *new_agg;
- 
-+	/* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */
-+	if (lmax > QFQ_MAX_LMAX)
-+		return -EINVAL;
-+
-+	new_agg = qfq_find_agg(q, lmax, weight);
- 	if (new_agg == NULL) { /* create new aggregate */
- 		new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC);
- 		if (new_agg == NULL)
--- 
-2.39.2
-
diff --git a/queue-5.10/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch b/queue-5.10/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
deleted file mode 100644
index 3ee34ddd5ec..00000000000
--- a/queue-5.10/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 53538e9ed4bd86297de2fe1e408f4b207ed8b82d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Apr 2023 12:56:11 -0300
-Subject: net/sched: sch_qfq: refactor parsing of netlink parameters
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 25369891fcef373540f8b4e0b3bccf77a04490d5 ]
-
-Two parameters can be transformed into netlink policies and
-validated while parsing the netlink message.
-
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 3e337087c3b5 ("net/sched: sch_qfq: account for stab overhead in qfq_enqueue")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 25 +++++++++++--------------
- 1 file changed, 11 insertions(+), 14 deletions(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index cad7deacf60a4..975e444f2d820 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -113,6 +113,7 @@
- 
- #define QFQ_MTU_SHIFT		16	/* to support TSO/GSO */
- #define QFQ_MIN_LMAX		512	/* see qfq_slot_insert */
-+#define QFQ_MAX_LMAX		(1UL << QFQ_MTU_SHIFT)
- 
- #define QFQ_MAX_AGG_CLASSES	8 /* max num classes per aggregate allowed */
- 
-@@ -214,9 +215,14 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
- 	return container_of(clc, struct qfq_class, common);
- }
- 
-+static struct netlink_range_validation lmax_range = {
-+	.min = QFQ_MIN_LMAX,
-+	.max = QFQ_MAX_LMAX,
-+};
-+
- static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
--	[TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
--	[TCA_QFQ_LMAX] = { .type = NLA_U32 },
-+	[TCA_QFQ_WEIGHT] = NLA_POLICY_RANGE(NLA_U32, 1, QFQ_MAX_WEIGHT),
-+	[TCA_QFQ_LMAX] = NLA_POLICY_FULL_RANGE(NLA_U32, &lmax_range),
- };
- 
- /*
-@@ -408,17 +414,13 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	}
- 
- 	err = nla_parse_nested_deprecated(tb, TCA_QFQ_MAX, tca[TCA_OPTIONS],
--					  qfq_policy, NULL);
-+					  qfq_policy, extack);
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_QFQ_WEIGHT]) {
-+	if (tb[TCA_QFQ_WEIGHT])
- 		weight = nla_get_u32(tb[TCA_QFQ_WEIGHT]);
--		if (!weight || weight > (1UL << QFQ_MAX_WSHIFT)) {
--			pr_notice("qfq: invalid weight %u\n", weight);
--			return -EINVAL;
--		}
--	} else
-+	else
- 		weight = 1;
- 
- 	if (tb[TCA_QFQ_LMAX])
-@@ -426,11 +428,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	else
- 		lmax = psched_mtu(qdisc_dev(sch));
- 
--	if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
--		pr_notice("qfq: invalid max length %u\n", lmax);
--		return -EINVAL;
--	}
--
- 	inv_w = ONE_FP / weight;
- 	weight = ONE_FP / inv_w;
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch b/queue-5.10/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
deleted file mode 100644
index 565885a1e48..00000000000
--- a/queue-5.10/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From a372d451f1e494f60eb06515981309299843c920 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 11:52:26 +0300
-Subject: netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 ]
-
-The simple_write_to_buffer() function is designed to handle partial
-writes.  It returns negatives on error, otherwise it returns the number
-of bytes that were able to be copied.  This code doesn't check the
-return properly.  We only know that the first byte is written, the rest
-of the buffer might be uninitialized.
-
-There is no need to use the simple_write_to_buffer() function.
-Partial writes are prohibited by the "if (*ppos != 0)" check at the
-start of the function.  Just use memdup_user() and copy the whole
-buffer.
-
-Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Reviewed-by: Ido Schimmel <idosch@nvidia.com>
-Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/netdevsim/dev.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
-index 9bbecf4d159b4..bcf354719745c 100644
---- a/drivers/net/netdevsim/dev.c
-+++ b/drivers/net/netdevsim/dev.c
-@@ -149,13 +149,10 @@ static ssize_t nsim_dev_trap_fa_cookie_write(struct file *file,
- 	cookie_len = (count - 1) / 2;
- 	if ((count - 1) % 2)
- 		return -EINVAL;
--	buf = kmalloc(count, GFP_KERNEL | __GFP_NOWARN);
--	if (!buf)
--		return -ENOMEM;
- 
--	ret = simple_write_to_buffer(buf, count, ppos, data, count);
--	if (ret < 0)
--		goto free_buf;
-+	buf = memdup_user(data, count);
-+	if (IS_ERR(buf))
-+		return PTR_ERR(buf);
- 
- 	fa_cookie = kmalloc(sizeof(*fa_cookie) + cookie_len,
- 			    GFP_KERNEL | __GFP_NOWARN);
--- 
-2.39.2
-
diff --git a/queue-5.10/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-5.10/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index d17921103f2..00000000000
--- a/queue-5.10/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From acb70e7fad57fad2b84b9cef5f7abdbafd1deea1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 71428d8cbcfc5..ac401ad7884a6 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1344,12 +1344,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-5.10/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index 420401f97cb..00000000000
--- a/queue-5.10/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 901c9a0805498149af8ac8ca51b1ca8cba34d3d2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index d54261f508519..99711dd0b6e8e 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2902,6 +2902,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2909,7 +2910,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-5.10/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index 2a289bac2d2..00000000000
--- a/queue-5.10/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From f716610f915b3ea672a36b1d2b7d9c5077b6ef2c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index 093dd20057b92..4f1add57d81de 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2068,12 +2068,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-5.10/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index 5f429a789e6..00000000000
--- a/queue-5.10/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 8b3f4f715a23299487155e9d8bd3d2eb1e0c320c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 5ee0afa621a95..eeeb4b1c97d2c 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-5.10/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-5.10/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index 8d734829721..00000000000
--- a/queue-5.10/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 38ff45890011895a2d3548a48689e979c73e0e5c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index 4a02561cfb965..d18cb44765603 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -412,7 +412,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch b/queue-5.10/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
deleted file mode 100644
index 6d20415c506..00000000000
--- a/queue-5.10/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 90f48bef4f8592b123adc792884d4b154d75b5b7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jul 2023 17:26:20 +0800
-Subject: nvme-pci: fix DMA direction of unmapping integrity data
-
-From: Ming Lei <ming.lei@redhat.com>
-
-[ Upstream commit b8f6446b6853768cb99e7c201bddce69ca60c15e ]
-
-DMA direction should be taken in dma_unmap_page() for unmapping integrity
-data.
-
-Fix this DMA direction, and reported in Guangwu's test.
-
-Reported-by: Guangwu Zhang <guazhang@redhat.com>
-Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data")
-Signed-off-by: Ming Lei <ming.lei@redhat.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/pci.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index c47512da9872a..3aaead9b3a570 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -968,7 +968,8 @@ static void nvme_pci_complete_rq(struct request *req)
- 
- 	if (blk_integrity_rq(req))
- 		dma_unmap_page(dev->dev, iod->meta_dma,
--			       rq_integrity_vec(req)->bv_len, rq_data_dir(req));
-+			       rq_integrity_vec(req)->bv_len, rq_dma_dir(req));
-+
- 	if (blk_rq_nr_phys_segments(req))
- 		nvme_unmap_data(dev, req);
- 	nvme_complete_rq(req);
--- 
-2.39.2
-
diff --git a/queue-5.10/platform-x86-wmi-break-possible-infinite-loop-when-p.patch b/queue-5.10/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
deleted file mode 100644
index 8b72a463740..00000000000
--- a/queue-5.10/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 0933ab92bd2131f9808f5c3297b0767d3cb65a9b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 18:11:54 +0300
-Subject: platform/x86: wmi: Break possible infinite loop when parsing GUID
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
-
-The while-loop may break on one of the two conditions, either ID string
-is empty or GUID matches. The second one, may never be reached if the
-parsed string is not correct GUID. In such a case the loop will never
-advance to check the next ID.
-
-Break possible infinite loop by factoring out guid_parse_and_compare()
-helper which may be moved to the generic header for everyone later on
-and preventing from similar mistake in the future.
-
-Interestingly that firstly it appeared when WMI was turned into a bus
-driver, but later when duplicated GUIDs were checked, the while-loop
-has been replaced by for-loop and hence no mistake made again.
-
-Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
-Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com
-Tested-by: Armin Wolf <W_Armin@gmx.de>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 22 ++++++++++++----------
- 1 file changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 5e4c03f7db7c0..567c28705cb1b 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -130,6 +130,16 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	return false;
- }
- 
-+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
-+{
-+	guid_t guid_input;
-+
-+	if (guid_parse(string, &guid_input))
-+		return false;
-+
-+	return guid_equal(&guid_input, guid);
-+}
-+
- static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
-@@ -142,11 +152,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
--		guid_t guid_input;
--
--		if (guid_parse(id->guid_string, &guid_input))
--			continue;
--		if (guid_equal(&wblock->gblock.guid, &guid_input))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return id->context;
- 		id++;
- 	}
-@@ -804,11 +810,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		guid_t driver_guid;
--
--		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
--			continue;
--		if (guid_equal(&driver_guid, &wblock->gblock.guid))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
--- 
-2.39.2
-
diff --git a/queue-5.10/platform-x86-wmi-move-variables.patch b/queue-5.10/platform-x86-wmi-move-variables.patch
deleted file mode 100644
index c6a9f372333..00000000000
--- a/queue-5.10/platform-x86-wmi-move-variables.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 2b2a2dfecf816da3761256e2e96ac17431e4840c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:56:10 +0000
-Subject: platform/x86: wmi: move variables
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit f5431bf1e6781e876bdc8ae10fb1e7da6f1aa9b5 ]
-
-Move some variables in order to keep them
-in the narrowest possible scope.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-22-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 18c4080d4a71e..5e4c03f7db7c0 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -134,7 +134,6 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
- 	const struct wmi_device_id *id;
--	guid_t guid_input;
- 
- 	if (wblock == NULL || wdriver == NULL)
- 		return NULL;
-@@ -143,6 +142,8 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
-+		guid_t guid_input;
-+
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
- 		if (guid_equal(&wblock->gblock.guid, &guid_input))
-@@ -615,7 +616,6 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- {
- 	struct acpi_object_list input;
- 	union acpi_object params[1];
--	struct guid_block *gblock;
- 	struct wmi_block *wblock;
- 
- 	input.count = 1;
-@@ -624,7 +624,7 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- 	params[0].integer.value = event;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		gblock = &wblock->gblock;
-+		struct guid_block *gblock = &wblock->gblock;
- 
- 		if ((gblock->flags & ACPI_WMI_EVENT) &&
- 			(gblock->notify_id == event))
-@@ -1281,12 +1281,11 @@ acpi_wmi_ec_space_handler(u32 function, acpi_physical_address address,
- static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 				    void *context)
- {
--	struct guid_block *block;
- 	struct wmi_block *wblock;
- 	bool found_it = false;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		block = &wblock->gblock;
-+		struct guid_block *block = &wblock->gblock;
- 
- 		if (wblock->acpi_device->handle == handle &&
- 		    (block->flags & ACPI_WMI_EVENT) &&
--- 
-2.39.2
-
diff --git a/queue-5.10/platform-x86-wmi-remove-unnecessary-argument.patch b/queue-5.10/platform-x86-wmi-remove-unnecessary-argument.patch
deleted file mode 100644
index b34586d641e..00000000000
--- a/queue-5.10/platform-x86-wmi-remove-unnecessary-argument.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 8f06216a815ddd37f9408c5f4f4167c790cc507e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:16 +0000
-Subject: platform/x86: wmi: remove unnecessary argument
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 84eacf7e6413d5e2d2f4f9dddf9216c18a3631cf ]
-
-The GUID block is available for `wmi_create_device()`
-through `wblock->gblock`. Use that consistently in
-the function instead of using a mix of `gblock` and
-`wblock->gblock`.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-8-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 1f80b26281628..9a6dc2717e1d4 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -1042,7 +1042,6 @@ static const struct device_type wmi_type_data = {
- };
- 
- static int wmi_create_device(struct device *wmi_bus_dev,
--			     const struct guid_block *gblock,
- 			     struct wmi_block *wblock,
- 			     struct acpi_device *device)
- {
-@@ -1050,12 +1049,12 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	char method[5];
- 	int result;
- 
--	if (gblock->flags & ACPI_WMI_EVENT) {
-+	if (wblock->gblock.flags & ACPI_WMI_EVENT) {
- 		wblock->dev.dev.type = &wmi_type_event;
- 		goto out_init;
- 	}
- 
--	if (gblock->flags & ACPI_WMI_METHOD) {
-+	if (wblock->gblock.flags & ACPI_WMI_METHOD) {
- 		wblock->dev.dev.type = &wmi_type_method;
- 		mutex_init(&wblock->char_mutex);
- 		goto out_init;
-@@ -1105,7 +1104,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", gblock->guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1197,7 +1196,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		wblock->acpi_device = device;
- 		wblock->gblock = gblock[i];
- 
--		retval = wmi_create_device(wmi_bus_dev, &gblock[i], wblock, device);
-+		retval = wmi_create_device(wmi_bus_dev, wblock, device);
- 		if (retval) {
- 			kfree(wblock);
- 			continue;
--- 
-2.39.2
-
diff --git a/queue-5.10/platform-x86-wmi-use-guid_t-and-guid_equal.patch b/queue-5.10/platform-x86-wmi-use-guid_t-and-guid_equal.patch
deleted file mode 100644
index b71731e768b..00000000000
--- a/queue-5.10/platform-x86-wmi-use-guid_t-and-guid_equal.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From 41fd3e4cb930244953bc634c695a4d13fc02655a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:39 +0000
-Subject: platform/x86: wmi: use guid_t and guid_equal()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 67f472fdacf4a691b1c3c20c27800b23ce31e2de ]
-
-Instead of hard-coding a 16 long byte array,
-use the available `guid_t` type and related methods.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-15-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 9a6dc2717e1d4..18c4080d4a71e 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -40,7 +40,7 @@ MODULE_LICENSE("GPL");
- static LIST_HEAD(wmi_block_list);
- 
- struct guid_block {
--	char guid[16];
-+	guid_t guid;
- 	union {
- 		char object_id[2];
- 		struct {
-@@ -121,7 +121,7 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
- 		block = &wblock->gblock;
- 
--		if (memcmp(block->guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->guid, &guid_input)) {
- 			if (out)
- 				*out = wblock;
- 			return true;
-@@ -145,7 +145,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 	while (*id->guid_string) {
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
--		if (!memcmp(wblock->gblock.guid, &guid_input, 16))
-+		if (guid_equal(&wblock->gblock.guid, &guid_input))
- 			return id->context;
- 		id++;
- 	}
-@@ -457,7 +457,7 @@ EXPORT_SYMBOL_GPL(wmi_set_block);
- 
- static void wmi_dump_wdg(const struct guid_block *g)
- {
--	pr_info("%pUL:\n", g->guid);
-+	pr_info("%pUL:\n", &g->guid);
- 	if (g->flags & ACPI_WMI_EVENT)
- 		pr_info("\tnotify_id: 0x%02X\n", g->notify_id);
- 	else
-@@ -539,7 +539,7 @@ wmi_notify_handler handler, void *data)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (block->handler &&
- 			    block->handler != wmi_notify_debug)
- 				return AE_ALREADY_ACQUIRED;
-@@ -579,7 +579,7 @@ acpi_status wmi_remove_notify_handler(const char *guid)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (!block->handler ||
- 			    block->handler == wmi_notify_debug)
- 				return AE_NULL_ENTRY;
-@@ -685,7 +685,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "wmi:%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "wmi:%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(modalias);
- 
-@@ -694,7 +694,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(guid);
- 
-@@ -777,10 +777,10 @@ static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
--	if (add_uevent_var(env, "WMI_GUID=%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "WMI_GUID=%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
- 	return 0;
-@@ -808,7 +808,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 
- 		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
- 			continue;
--		if (!memcmp(&driver_guid, wblock->gblock.guid, 16))
-+		if (guid_equal(&driver_guid, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
-@@ -1104,7 +1104,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1124,12 +1124,12 @@ static void wmi_free_devices(struct acpi_device *device)
- 	}
- }
- 
--static bool guid_already_parsed(struct acpi_device *device, const u8 *guid)
-+static bool guid_already_parsed(struct acpi_device *device, const guid_t *guid)
- {
- 	struct wmi_block *wblock;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		if (memcmp(wblock->gblock.guid, guid, 16) == 0) {
-+		if (guid_equal(&wblock->gblock.guid, guid)) {
- 			/*
- 			 * Because we historically didn't track the relationship
- 			 * between GUIDs and ACPI nodes, we don't know whether
-@@ -1184,7 +1184,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		 * case yet, so for now, we'll just ignore the duplicate
- 		 * for device creation.
- 		 */
--		if (guid_already_parsed(device, gblock[i].guid))
-+		if (guid_already_parsed(device, &gblock[i].guid))
- 			continue;
- 
- 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
-@@ -1221,7 +1221,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		retval = device_add(&wblock->dev.dev);
- 		if (retval) {
- 			dev_err(wmi_bus_dev, "failed to register %pUL\n",
--				wblock->gblock.guid);
-+				&wblock->gblock.guid);
- 			if (debug_event)
- 				wmi_method_enable(wblock, 0);
- 			list_del(&wblock->list);
-@@ -1335,7 +1335,7 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 	}
- 
- 	if (debug_event)
--		pr_info("DEBUG Event GUID: %pUL\n", wblock->gblock.guid);
-+		pr_info("DEBUG Event GUID: %pUL\n", &wblock->gblock.guid);
- 
- 	acpi_bus_generate_netlink_event(
- 		wblock->acpi_device->pnp.device_class,
--- 
-2.39.2
-
diff --git a/queue-5.10/riscv-bpf-avoid-breaking-w-x.patch b/queue-5.10/riscv-bpf-avoid-breaking-w-x.patch
deleted file mode 100644
index dc317b5c188..00000000000
--- a/queue-5.10/riscv-bpf-avoid-breaking-w-x.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 4050c9f9f0d0ac97014d29d95259e3be1ebede8a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 Mar 2021 02:25:21 +0800
-Subject: riscv: bpf: Avoid breaking W^X
-
-From: Jisheng Zhang <jszhang@kernel.org>
-
-[ Upstream commit fc8504765ec5e812135b8ccafca7101069a0c6d8 ]
-
-We allocate Non-executable pages, then call bpf_jit_binary_lock_ro()
-to enable executable permission after mapping them read-only. This is
-to prepare for STRICT_MODULE_RWX in following patch.
-
-Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
-Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
-Stable-dep-of: c56fb2aab235 ("riscv, bpf: Fix inconsistent JIT image generation")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit_core.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index e295c9eed9e93..5d247198c30d3 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -153,6 +153,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns);
- 
- 	if (!prog->is_func || extra_pass) {
-+		bpf_jit_binary_lock_ro(jit_data->header);
- out_offset:
- 		kfree(ctx->offset);
- 		kfree(jit_data);
-@@ -170,7 +171,7 @@ void *bpf_jit_alloc_exec(unsigned long size)
- {
- 	return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,
- 				    BPF_JIT_REGION_END, GFP_KERNEL,
--				    PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
-+				    PAGE_KERNEL, 0, NUMA_NO_NODE,
- 				    __builtin_return_address(0));
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.10/riscv-bpf-fix-inconsistent-jit-image-generation.patch b/queue-5.10/riscv-bpf-fix-inconsistent-jit-image-generation.patch
deleted file mode 100644
index 96f8fc15ac6..00000000000
--- a/queue-5.10/riscv-bpf-fix-inconsistent-jit-image-generation.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 1630d20fd0e8a85705dd35377dedae41556087dc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:41:31 +0200
-Subject: riscv, bpf: Fix inconsistent JIT image generation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Björn Töpel <bjorn@rivosinc.com>
-
-[ Upstream commit c56fb2aab23505bb7160d06097c8de100b82b851 ]
-
-In order to generate the prologue and epilogue, the BPF JIT needs to
-know which registers that are clobbered. Therefore, the during
-pre-final passes, the prologue is generated after the body of the
-program body-prologue-epilogue. Then, in the final pass, a proper
-prologue-body-epilogue JITted image is generated.
-
-This scheme has worked most of the time. However, for some large
-programs with many jumps, e.g. the test_kmod.sh BPF selftest with
-hardening enabled (blinding constants), this has shown to be
-incorrect. For the final pass, when the proper prologue-body-epilogue
-is generated, the image has not converged. This will lead to that the
-final image will have incorrect jump offsets. The following is an
-excerpt from an incorrect image:
-
-  | ...
-  |     3b8:       00c50663                beq     a0,a2,3c4 <.text+0x3c4>
-  |     3bc:       0020e317                auipc   t1,0x20e
-  |     3c0:       49630067                jalr    zero,1174(t1) # 20e852 <.text+0x20e852>
-  | ...
-  |  20e84c:       8796                    c.mv    a5,t0
-  |  20e84e:       6422                    c.ldsp  s0,8(sp)    # Epilogue start
-  |  20e850:       6141                    c.addi16sp      sp,16
-  |  20e852:       853e                    c.mv    a0,a5       # Incorrect jump target
-  |  20e854:       8082                    c.jr    ra
-
-The image has shrunk, and the epilogue offset is incorrect in the
-final pass.
-
-Correct the problem by always generating proper prologue-body-epilogue
-outputs, which means that the first pass will only generate the body
-to track what registers that are touched.
-
-Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
-Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20230710074131.19596-1-bjorn@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      |  6 +++---
- arch/riscv/net/bpf_jit_core.c | 19 +++++++++++++------
- 2 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index ab0cd6d10ccf3..ef336fe160044 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,7 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
--	int body_len;
-+	int prologue_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	unsigned long flags;
-@@ -215,8 +215,8 @@ static inline int rv_offset(int insn, int off, struct rv_jit_context *ctx)
- 	int from, to;
- 
- 	off++; /* BPF branch is from PC+1, RV is from PC */
--	from = (insn > 0) ? ctx->offset[insn - 1] : 0;
--	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : 0;
-+	from = (insn > 0) ? ctx->offset[insn - 1] : ctx->prologue_len;
-+	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : ctx->prologue_len;
- 	return ninsns_rvoff(to - from);
- }
- 
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 750b15c319d5d..ef17bc8055d4c 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -43,7 +43,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- {
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, prologue_len, i;
-+	int pass = 0, prev_ninsns = 0, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 	unsigned int image_size = 0;
-@@ -83,6 +83,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 		prog = orig_prog;
- 		goto out_offset;
- 	}
-+
-+	if (build_body(ctx, extra_pass, NULL)) {
-+		prog = orig_prog;
-+		goto out_offset;
-+	}
-+
- 	for (i = 0; i < prog->len; i++) {
- 		prev_ninsns += 32;
- 		ctx->offset[i] = prev_ninsns;
-@@ -91,12 +97,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
- 		pass++;
- 		ctx->ninsns = 0;
-+
-+		bpf_jit_build_prologue(ctx);
-+		ctx->prologue_len = ctx->ninsns;
-+
- 		if (build_body(ctx, extra_pass, ctx->offset)) {
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
--		ctx->body_len = ctx->ninsns;
--		bpf_jit_build_prologue(ctx);
-+
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
- 
-@@ -155,10 +164,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
--		prologue_len = ctx->epilogue_offset - ctx->body_len;
- 		for (i = 0; i < prog->len; i++)
--			ctx->offset[i] = ninsns_rvoff(prologue_len +
--						      ctx->offset[i]);
-+			ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- 		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
--- 
-2.39.2
-
diff --git a/queue-5.10/riscv-bpf-move-bpf_jit_alloc_exec-and-bpf_jit_free_e.patch b/queue-5.10/riscv-bpf-move-bpf_jit_alloc_exec-and-bpf_jit_free_e.patch
deleted file mode 100644
index 1166c62f4d7..00000000000
--- a/queue-5.10/riscv-bpf-move-bpf_jit_alloc_exec-and-bpf_jit_free_e.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 6d498f474443359b0bee68babcd44efc6cf38cbc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 Mar 2021 02:24:54 +0800
-Subject: riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core
-
-From: Jisheng Zhang <jszhang@kernel.org>
-
-[ Upstream commit 1d27d854425faec98f352cf88ec3e2a8844429a4 ]
-
-We will drop the executable permissions of the code pages from the
-mapping at allocation time soon. Move bpf_jit_alloc_exec() and
-bpf_jit_free_exec() to bpf_jit_core.c so that they can be shared by
-both RV64I and RV32I.
-
-Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
-Acked-by: Luke Nelson <luke.r.nels@gmail.com>
-Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
-Stable-dep-of: c56fb2aab235 ("riscv, bpf: Fix inconsistent JIT image generation")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit_comp64.c | 13 -------------
- arch/riscv/net/bpf_jit_core.c   | 13 +++++++++++++
- 2 files changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
-index c113ae818b14e..053dc83e323b6 100644
---- a/arch/riscv/net/bpf_jit_comp64.c
-+++ b/arch/riscv/net/bpf_jit_comp64.c
-@@ -1144,16 +1144,3 @@ void bpf_jit_build_epilogue(struct rv_jit_context *ctx)
- {
- 	__build_epilogue(false, ctx);
- }
--
--void *bpf_jit_alloc_exec(unsigned long size)
--{
--	return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,
--				    BPF_JIT_REGION_END, GFP_KERNEL,
--				    PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
--				    __builtin_return_address(0));
--}
--
--void bpf_jit_free_exec(void *addr)
--{
--	return vfree(addr);
--}
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index cbf7d2414886e..e295c9eed9e93 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -165,3 +165,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 					   tmp : orig_prog);
- 	return prog;
- }
-+
-+void *bpf_jit_alloc_exec(unsigned long size)
-+{
-+	return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,
-+				    BPF_JIT_REGION_END, GFP_KERNEL,
-+				    PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
-+				    __builtin_return_address(0));
-+}
-+
-+void bpf_jit_free_exec(void *addr)
-+{
-+	return vfree(addr);
-+}
--- 
-2.39.2
-
diff --git a/queue-5.10/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch b/queue-5.10/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
deleted file mode 100644
index a708f5dfc3a..00000000000
--- a/queue-5.10/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 5804ed9cd312ce0843bff3fc159ae27613447512 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 13:58:47 +0300
-Subject: scsi: qla2xxx: Fix error code in qla2x00_start_sp()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 ]
-
-This should be negative -EAGAIN instead of positive.  The callers treat
-non-zero error codes the same so it doesn't really impact runtime beyond
-some trivial differences to debug output.
-
-Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
-index e54cc2a761dd4..f0af76c3de7e3 100644
---- a/drivers/scsi/qla2xxx/qla_iocb.c
-+++ b/drivers/scsi/qla2xxx/qla_iocb.c
-@@ -3713,7 +3713,7 @@ qla2x00_start_sp(srb_t *sp)
- 	spin_lock_irqsave(qp->qp_lock_ptr, flags);
- 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
- 	if (!pkt) {
--		rval = EAGAIN;
-+		rval = -EAGAIN;
- 		ql_log(ql_log_warn, vha, 0x700c,
- 		    "qla2x00_alloc_iocbs failed.\n");
- 		goto done;
--- 
-2.39.2
-
diff --git a/queue-5.10/series b/queue-5.10/series
index 0e47ddf562b..8dbb2cfd6f8 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -332,42 +332,3 @@ tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platform.patch
 rcu-tasks-mark-trc_reader_nesting-data-races.patch
 rcu-tasks-mark-trc_reader_special.b.need_qs-data-races.patch
 rcu-tasks-simplify-trc_read_check_handler-atomic-operations.patch
-drm-panel-simple-add-connector_type-for-innolux_at04.patch
-drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
-igc-remove-delay-during-tx-ring-configuration.patch
-net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
-net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
-igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
-scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
-gve-set-default-duplex-configuration-to-full.patch
-ionic-remove-warn_on-to-prevent-panic_on_warn.patch
-net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
-net-prevent-skb-corruption-on-frag-list-segmentation.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-platform-x86-wmi-remove-unnecessary-argument.patch
-platform-x86-wmi-use-guid_t-and-guid_equal.patch
-platform-x86-wmi-move-variables.patch
-platform-x86-wmi-break-possible-infinite-loop-when-p.patch
-igc-fix-launchtime-before-start-of-cycle.patch
-igc-fix-inserting-of-empty-frame-for-launchtime.patch
-riscv-bpf-move-bpf_jit_alloc_exec-and-bpf_jit_free_e.patch
-riscv-bpf-avoid-breaking-w-x.patch
-bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
-riscv-bpf-fix-inconsistent-jit-image-generation.patch
-erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-net-sched-flower-ensure-both-minimum-and-maximum-por.patch
-netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
-net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
-net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
-nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
diff --git a/queue-5.10/udp6-fix-udp6_ehashfn-typo.patch b/queue-5.10/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index bb54a6e7102..00000000000
--- a/queue-5.10/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 279a8ca0c53b60a63609bd8055b756cfb4af296a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 19c0721399d9e..788bb19f32e99 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -87,7 +87,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-5.10/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-5.10/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index 91f85139ff2..00000000000
--- a/queue-5.10/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From dae3b37a715c8a9b65c38b1aadefc8cf0152d738 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index 8c9c6bfbaeee7..aa1d12f6f5c3b 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6150,8 +6150,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-5.15/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch b/queue-5.15/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
deleted file mode 100644
index fd93d201e74..00000000000
--- a/queue-5.15/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From 45b1b44a8c10a6d827b89abc0f463a3299adc57f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 19:58:48 +0800
-Subject: bpf: cpumap: Fix memory leak in cpu_map_update_elem
-
-From: Pu Lehui <pulehui@huawei.com>
-
-[ Upstream commit 4369016497319a9635702da010d02af1ebb1849d ]
-
-Syzkaller reported a memory leak as follows:
-
-BUG: memory leak
-unreferenced object 0xff110001198ef748 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00  ....J...........
-    00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff  ........(.......
-  backtrace:
-    [<ffffffffadd28087>] __cpu_map_entry_alloc+0xf7/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff110001198ef528 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-  backtrace:
-    [<ffffffffadd281f0>] __cpu_map_entry_alloc+0x260/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff1100010fd93d68 (size 8):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 8 bytes):
-    00 00 00 00 00 00 00 00                          ........
-  backtrace:
-    [<ffffffffade5db3e>] kvmalloc_node+0x11e/0x170
-    [<ffffffffadd28280>] __cpu_map_entry_alloc+0x2f0/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-In the cpu_map_update_elem flow, when kthread_stop is called before
-calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit
-of kthread has been set by kthread_stop, the threadfn of rcpu->kthread
-will never be executed, and rcpu->refcnt will never be 0, which will
-lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be
-released.
-
-Calling kthread_stop before executing kthread's threadfn will return
--EINTR. We can complete the release of memory resources in this state.
-
-Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
-Signed-off-by: Pu Lehui <pulehui@huawei.com>
-Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
-Acked-by: Hou Tao <houtao1@huawei.com>
-Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/cpumap.c | 40 ++++++++++++++++++++++++----------------
- 1 file changed, 24 insertions(+), 16 deletions(-)
-
-diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
-index 585b2b77ccc4f..db6221773e43f 100644
---- a/kernel/bpf/cpumap.c
-+++ b/kernel/bpf/cpumap.c
-@@ -126,22 +126,6 @@ static void get_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	atomic_inc(&rcpu->refcnt);
- }
- 
--/* called from workqueue, to workaround syscall using preempt_disable */
--static void cpu_map_kthread_stop(struct work_struct *work)
--{
--	struct bpf_cpu_map_entry *rcpu;
--
--	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
--
--	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
--	 * as it waits until all in-flight call_rcu() callbacks complete.
--	 */
--	rcu_barrier();
--
--	/* kthread_stop will wake_up_process and wait for it to complete */
--	kthread_stop(rcpu->kthread);
--}
--
- static void __cpu_map_ring_cleanup(struct ptr_ring *ring)
- {
- 	/* The tear-down procedure should have made sure that queue is
-@@ -169,6 +153,30 @@ static void put_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	}
- }
- 
-+/* called from workqueue, to workaround syscall using preempt_disable */
-+static void cpu_map_kthread_stop(struct work_struct *work)
-+{
-+	struct bpf_cpu_map_entry *rcpu;
-+	int err;
-+
-+	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
-+
-+	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
-+	 * as it waits until all in-flight call_rcu() callbacks complete.
-+	 */
-+	rcu_barrier();
-+
-+	/* kthread_stop will wake_up_process and wait for it to complete */
-+	err = kthread_stop(rcpu->kthread);
-+	if (err) {
-+		/* kthread_stop may be called before cpu_map_kthread_run
-+		 * is executed, so we need to release the memory related
-+		 * to rcpu.
-+		 */
-+		put_cpu_map_entry(rcpu);
-+	}
-+}
-+
- static void cpu_map_bpf_prog_run_skb(struct bpf_cpu_map_entry *rcpu,
- 				     struct list_head *listp,
- 				     struct xdp_cpumap_stats *stats)
--- 
-2.39.2
-
diff --git a/queue-5.15/bpf-fix-max-stack-depth-check-for-async-callbacks.patch b/queue-5.15/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
deleted file mode 100644
index 7933b609c6b..00000000000
--- a/queue-5.15/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 55cdae98eb5599d22f834a51825f1a914abbf29a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 20:17:29 +0530
-Subject: bpf: Fix max stack depth check for async callbacks
-
-From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-
-[ Upstream commit 5415ccd50a8620c8cbaa32d6f18c946c453566f5 ]
-
-The check_max_stack_depth pass happens after the verifier's symbolic
-execution, and attempts to walk the call graph of the BPF program,
-ensuring that the stack usage stays within bounds for all possible call
-chains. There are two cases to consider: bpf_pseudo_func and
-bpf_pseudo_call. In the former case, the callback pointer is loaded into
-a register, and is assumed that it is passed to some helper later which
-calls it (however there is no way to be sure), but the check remains
-conservative and accounts the stack usage anyway. For this particular
-case, asynchronous callbacks are skipped as they execute asynchronously
-when their corresponding event fires.
-
-The case of bpf_pseudo_call is simpler and we know that the call is
-definitely made, hence the stack depth of the subprog is accounted for.
-
-However, the current check still skips an asynchronous callback even if
-a bpf_pseudo_call was made for it. This is erroneous, as it will miss
-accounting for the stack usage of the asynchronous callback, which can
-be used to breach the maximum stack depth limit.
-
-Fix this by only skipping asynchronous callbacks when the instruction is
-not a pseudo call to the subprog.
-
-Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.")
-Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-Link: https://lore.kernel.org/r/20230705144730.235802-2-memxor@gmail.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/verifier.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index 7a70595c3c15a..bd31aa6407a78 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -3765,8 +3765,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
- 				verbose(env, "verifier bug. subprog has tail_call and async cb\n");
- 				return -EFAULT;
- 			}
--			 /* async callbacks don't increase bpf prog stack size */
--			continue;
-+			/* async callbacks don't increase bpf prog stack size unless called directly */
-+			if (!bpf_pseudo_call(insn + i))
-+				continue;
- 		}
- 		i = next_insn;
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch b/queue-5.15/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
deleted file mode 100644
index 3a57151dfec..00000000000
--- a/queue-5.15/bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 2a1cf795e868d7f8e25c072723014a450378c0c0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 May 2022 17:28:11 +0800
-Subject: bpf, riscv: Support riscv jit to provide bpf_line_info
-
-From: Pu Lehui <pulehui@huawei.com>
-
-[ Upstream commit 3cb70413041fdf028fa1ba3986fd0c6aec9e3dcb ]
-
-Add support for riscv jit to provide bpf_line_info. We need to
-consider the prologue offset in ctx->offset, but unlike x86 and
-arm64, ctx->offset of riscv does not provide an extra slot for
-the prologue, so here we just calculate the len of prologue and
-add it to ctx->offset at the end. Both RV64 and RV32 have been
-tested.
-
-Signed-off-by: Pu Lehui <pulehui@huawei.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
-Link: https://lore.kernel.org/bpf/20220530092815.1112406-3-pulehui@huawei.com
-Stable-dep-of: c56fb2aab235 ("riscv, bpf: Fix inconsistent JIT image generation")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      | 1 +
- arch/riscv/net/bpf_jit_core.c | 8 +++++++-
- 2 files changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index 75c1e99968675..ab0cd6d10ccf3 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,6 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
-+	int body_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	unsigned long flags;
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 753d85bdfad07..ff644452b88db 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -43,7 +43,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- {
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, i;
-+	int pass = 0, prev_ninsns = 0, prologue_len, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 	unsigned int image_size = 0;
-@@ -95,6 +95,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
-+		ctx->body_len = ctx->ninsns;
- 		bpf_jit_build_prologue(ctx);
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
-@@ -154,6 +155,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
-+		prologue_len = ctx->epilogue_offset - ctx->body_len;
-+		for (i = 0; i < prog->len; i++)
-+			ctx->offset[i] = ninsns_rvoff(prologue_len +
-+						      ctx->offset[i]);
-+		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
- 		kfree(jit_data);
--- 
-2.39.2
-
diff --git a/queue-5.15/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch b/queue-5.15/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
deleted file mode 100644
index 61feab6c822..00000000000
--- a/queue-5.15/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 1988a81913c7178e56bb2c95b48f1c61485216bc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 13 Jun 2023 06:58:13 -0700
-Subject: drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
-
-From: Douglas Anderson <dianders@chromium.org>
-
-[ Upstream commit 7aa83fbd712a6f08ffa67890061f26d140c2a84f ]
-
-Memory for the "struct device" for any given device isn't supposed to
-be released until the device's release() is called. This is important
-because someone might be holding a kobject reference to the "struct
-device" and might try to access one of its members even after any
-other cleanup/uninitialization has happened.
-
-Code analysis of ti-sn65dsi86 shows that this isn't quite right. When
-the code was written, it was believed that we could rely on the fact
-that the child devices would all be freed before the parent devices
-and thus we didn't need to worry about a release() function. While I
-still believe that the parent's "struct device" is guaranteed to
-outlive the child's "struct device" (because the child holds a kobject
-reference to the parent), the parent's "devm" allocated memory is a
-different story. That appears to be freed much earlier.
-
-Let's make this better for ti-sn65dsi86 by allocating each auxiliary
-with kzalloc and then free that memory in the release().
-
-Fixes: bf73537f411b ("drm/bridge: ti-sn65dsi86: Break GPIO and MIPI-to-eDP bridge into sub-drivers")
-Suggested-by: Stephen Boyd <swboyd@chromium.org>
-Reviewed-by: Stephen Boyd <swboyd@chromium.org>
-Signed-off-by: Douglas Anderson <dianders@chromium.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230613065812.v2.1.I24b838a5b4151fb32bccd6f36397998ea2df9fbb@changeid
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 33 +++++++++++++++++----------
- 1 file changed, 21 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-index bbedce0eeddae..22c2ff5272c60 100644
---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-@@ -147,9 +147,9 @@
-  *                each other's read-modify-write.
-  */
- struct ti_sn65dsi86 {
--	struct auxiliary_device		bridge_aux;
--	struct auxiliary_device		gpio_aux;
--	struct auxiliary_device		aux_aux;
-+	struct auxiliary_device		*bridge_aux;
-+	struct auxiliary_device		*gpio_aux;
-+	struct auxiliary_device		*aux_aux;
- 
- 	struct device			*dev;
- 	struct regmap			*regmap;
-@@ -412,27 +412,34 @@ static void ti_sn65dsi86_delete_aux(void *data)
- 	auxiliary_device_delete(data);
- }
- 
--/*
-- * AUX bus docs say that a non-NULL release is mandatory, but it makes no
-- * sense for the model used here where all of the aux devices are allocated
-- * in the single shared structure. We'll use this noop as a workaround.
-- */
--static void ti_sn65dsi86_noop(struct device *dev) {}
-+static void ti_sn65dsi86_aux_device_release(struct device *dev)
-+{
-+	struct auxiliary_device *aux = container_of(dev, struct auxiliary_device, dev);
-+
-+	kfree(aux);
-+}
- 
- static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
--				       struct auxiliary_device *aux,
-+				       struct auxiliary_device **aux_out,
- 				       const char *name)
- {
- 	struct device *dev = pdata->dev;
-+	struct auxiliary_device *aux;
- 	int ret;
- 
-+	aux = kzalloc(sizeof(*aux), GFP_KERNEL);
-+	if (!aux)
-+		return -ENOMEM;
-+
- 	aux->name = name;
- 	aux->dev.parent = dev;
--	aux->dev.release = ti_sn65dsi86_noop;
-+	aux->dev.release = ti_sn65dsi86_aux_device_release;
- 	device_set_of_node_from_dev(&aux->dev, dev);
- 	ret = auxiliary_device_init(aux);
--	if (ret)
-+	if (ret) {
-+		kfree(aux);
- 		return ret;
-+	}
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_uninit_aux, aux);
- 	if (ret)
- 		return ret;
-@@ -441,6 +448,8 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
- 	if (ret)
- 		return ret;
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_delete_aux, aux);
-+	if (!ret)
-+		*aux_out = aux;
- 
- 	return ret;
- }
--- 
-2.39.2
-
diff --git a/queue-5.15/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch b/queue-5.15/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
deleted file mode 100644
index 2a7a20d3ed4..00000000000
--- a/queue-5.15/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 738cb33610deac306e20935bc4eb7e297519b060 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 13:55:03 +0100
-Subject: drm/i915: Fix one wrong caching mode enum usage
-
-From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-
-[ Upstream commit 113899c2669dff148b2a5bea4780123811aecc13 ]
-
-Commit a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch
-buffer") mistakenly passed in uapi I915_CACHING_CACHED as argument to
-i915_gem_object_set_cache_coherency(), which actually takes internal
-enum i915_cache_level.
-
-No functional issue since the value matches I915_CACHE_LLC (1 == 1), which
-is the intended caching mode, but lets clean it up nevertheless.
-
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Fixes: a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch buffer")
-Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
-Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230707125503.3965817-1-tvrtko.ursulin@linux.intel.com
-(cherry picked from commit 49c60b2f0867ac36fd54d513882a48431aeccae7)
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/i915/gt/intel_gtt.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/gt/intel_gtt.c b/drivers/gpu/drm/i915/gt/intel_gtt.c
-index 2d3a979736cc1..f9d4094916e3d 100644
---- a/drivers/gpu/drm/i915/gt/intel_gtt.c
-+++ b/drivers/gpu/drm/i915/gt/intel_gtt.c
-@@ -547,7 +547,7 @@ __vm_create_scratch_for_read(struct i915_address_space *vm, unsigned long size)
- 	if (IS_ERR(obj))
- 		return ERR_CAST(obj);
- 
--	i915_gem_object_set_cache_coherency(obj, I915_CACHING_CACHED);
-+	i915_gem_object_set_cache_coherency(obj, I915_CACHE_LLC);
- 
- 	vma = i915_vma_instance(obj, vm, NULL);
- 	if (IS_ERR(vma)) {
--- 
-2.39.2
-
diff --git a/queue-5.15/drm-panel-simple-add-connector_type-for-innolux_at04.patch b/queue-5.15/drm-panel-simple-add-connector_type-for-innolux_at04.patch
deleted file mode 100644
index ab4b3837537..00000000000
--- a/queue-5.15/drm-panel-simple-add-connector_type-for-innolux_at04.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From adebed5d4cf8db520ee5829eff7ae641ce7a659f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 08:22:02 -0300
-Subject: drm/panel: simple: Add connector_type for innolux_at043tn24
-
-From: Fabio Estevam <festevam@denx.de>
-
-[ Upstream commit 2c56a751845ddfd3078ebe79981aaaa182629163 ]
-
-The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type'
-information to avoid the following warning:
-
-panel-simple panel: Specify missing connector_type
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24")
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index 2f85266cdb2e3..2b628b6be08f3 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2469,6 +2469,7 @@ static const struct panel_desc innolux_at043tn24 = {
- 		.height = 54,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
-+	.connector_type = DRM_MODE_CONNECTOR_DPI,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch b/queue-5.15/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
deleted file mode 100644
index 08ec978f606..00000000000
--- a/queue-5.15/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 95d5b0261cebe41f81a2a8abe75eb7cac171d537 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 22:16:02 +0200
-Subject: drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
-
-From: Marek Vasut <marex@denx.de>
-
-[ Upstream commit 1c519980aced3da1fae37c1339cf43b24eccdee7 ]
-
-Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC
-flags. Those are used by various bridges in the pipeline to correctly
-configure its sync signals polarity.
-
-Fixes: d69de69f2be1 ("drm/panel: simple: Add Powertip PH800480T013 panel")
-Signed-off-by: Marek Vasut <marex@denx.de>
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230615201602.565948-1-marex@denx.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index 2b628b6be08f3..391d73d2638a8 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3651,6 +3651,7 @@ static const struct drm_display_mode powertip_ph800480t013_idf02_mode = {
- 	.vsync_start = 480 + 49,
- 	.vsync_end = 480 + 49 + 2,
- 	.vtotal = 480 + 49 + 2 + 22,
-+	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
- };
- 
- static const struct panel_desc powertip_ph800480t013_idf02  = {
--- 
-2.39.2
-
diff --git a/queue-5.15/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch b/queue-5.15/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
deleted file mode 100644
index 01f68588beb..00000000000
--- a/queue-5.15/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From e91f73caf4336f047ff714b7ad27d0759c2801eb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 17:34:10 +0800
-Subject: erofs: avoid infinite loop in z_erofs_do_read_page() when reading
- beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ]
-
-z_erofs_do_read_page() may loop infinitely due to the inappropriate
-truncation in the below statement. Since the offset is 64 bits and min_t()
-truncates the result to 32 bits. The solution is to replace unsigned int
-with a 64-bit type, such as erofs_off_t.
-    cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-
-    - For example:
-        - offset = 0x400160000
-        - end = 0x370
-        - map->m_la = 0x160370
-        - offset + end - map->m_la = 0x400000000
-        - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
-    - Expected result:
-        - cur = 0
-    - Actual result:
-        - cur = 0x370
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index eb51df4a9f770..3fd91a0efdbb7 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -713,7 +713,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 	tight &= (clt->mode >= COLLECT_PRIMARY_HOOKED &&
- 		  clt->mode != COLLECT_PRIMARY_FOLLOWED_NOINPLACE);
- 
--	cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-+	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
- 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
- 		zero_user_segment(page, cur, end);
- 		goto next_part;
--- 
-2.39.2
-
diff --git a/queue-5.15/erofs-decouple-basic-mount-options-from-fs_context.patch b/queue-5.15/erofs-decouple-basic-mount-options-from-fs_context.patch
deleted file mode 100644
index 8a08de48323..00000000000
--- a/queue-5.15/erofs-decouple-basic-mount-options-from-fs_context.patch
+++ /dev/null
@@ -1,330 +0,0 @@
-From 3384e34175abf8b05dfe534bbb8afe900f35a556 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 7 Oct 2021 15:02:23 +0800
-Subject: erofs: decouple basic mount options from fs_context
-
-From: Gao Xiang <hsiangkao@linux.alibaba.com>
-
-[ Upstream commit e62424651f43cb37e17ca26a7ee9ee42675f24bd ]
-
-Previously, EROFS mount options are all in the basic types, so
-erofs_fs_context can be directly copied with assignment. However,
-when the multiple device feature is introduced, it's hard to handle
-multiple device information like the other basic mount options.
-
-Let's separate basic mount option usage from fs_context, thus
-multiple device information can be handled gracefully then.
-
-No logic changes.
-
-Link: https://lore.kernel.org/r/20211007070224.12833-1-hsiangkao@linux.alibaba.com
-Reviewed-by: Chao Yu <chao@kernel.org>
-Reviewed-by: Liu Bo <bo.liu@linux.alibaba.com>
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Stable-dep-of: 18bddc5b6703 ("erofs: fix fsdax unavailability for chunk-based regular files")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/inode.c    |  2 +-
- fs/erofs/internal.h | 16 ++++++++-----
- fs/erofs/super.c    | 58 ++++++++++++++++++++++-----------------------
- fs/erofs/xattr.c    |  4 ++--
- fs/erofs/zdata.c    |  8 +++----
- 5 files changed, 45 insertions(+), 43 deletions(-)
-
-diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
-index 0c293ff6697b5..3ff36514cff25 100644
---- a/fs/erofs/inode.c
-+++ b/fs/erofs/inode.c
-@@ -192,7 +192,7 @@ static struct page *erofs_read_inode(struct inode *inode,
- 	inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec;
- 
- 	inode->i_flags &= ~S_DAX;
--	if (test_opt(&sbi->ctx, DAX_ALWAYS) && S_ISREG(inode->i_mode) &&
-+	if (test_opt(&sbi->opt, DAX_ALWAYS) && S_ISREG(inode->i_mode) &&
- 	    vi->datalayout == EROFS_INODE_FLAT_PLAIN)
- 		inode->i_flags |= S_DAX;
- 	if (!nblks)
-diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
-index beadb06d8feb9..323e46d800e9e 100644
---- a/fs/erofs/internal.h
-+++ b/fs/erofs/internal.h
-@@ -47,7 +47,7 @@ typedef u64 erofs_off_t;
- /* data type for filesystem-wide blocks number */
- typedef u32 erofs_blk_t;
- 
--struct erofs_fs_context {
-+struct erofs_mount_opts {
- #ifdef CONFIG_EROFS_FS_ZIP
- 	/* current strategy of how to use managed cache */
- 	unsigned char cache_strategy;
-@@ -60,6 +60,10 @@ struct erofs_fs_context {
- 	unsigned int mount_opt;
- };
- 
-+struct erofs_fs_context {
-+	struct erofs_mount_opts opt;
-+};
-+
- /* all filesystem-wide lz4 configurations */
- struct erofs_sb_lz4_info {
- 	/* # of pages needed for EROFS lz4 rolling decompression */
-@@ -69,6 +73,8 @@ struct erofs_sb_lz4_info {
- };
- 
- struct erofs_sb_info {
-+	struct erofs_mount_opts opt;	/* options */
-+
- #ifdef CONFIG_EROFS_FS_ZIP
- 	/* list for all registered superblocks, mainly for shrinker */
- 	struct list_head list;
-@@ -108,8 +114,6 @@ struct erofs_sb_info {
- 	u8 volume_name[16];             /* volume name */
- 	u32 feature_compat;
- 	u32 feature_incompat;
--
--	struct erofs_fs_context ctx;	/* options */
- };
- 
- #define EROFS_SB(sb) ((struct erofs_sb_info *)(sb)->s_fs_info)
-@@ -121,9 +125,9 @@ struct erofs_sb_info {
- #define EROFS_MOUNT_DAX_ALWAYS		0x00000040
- #define EROFS_MOUNT_DAX_NEVER		0x00000080
- 
--#define clear_opt(ctx, option)	((ctx)->mount_opt &= ~EROFS_MOUNT_##option)
--#define set_opt(ctx, option)	((ctx)->mount_opt |= EROFS_MOUNT_##option)
--#define test_opt(ctx, option)	((ctx)->mount_opt & EROFS_MOUNT_##option)
-+#define clear_opt(opt, option)	((opt)->mount_opt &= ~EROFS_MOUNT_##option)
-+#define set_opt(opt, option)	((opt)->mount_opt |= EROFS_MOUNT_##option)
-+#define test_opt(opt, option)	((opt)->mount_opt & EROFS_MOUNT_##option)
- 
- enum {
- 	EROFS_ZIP_CACHE_DISABLED,
-diff --git a/fs/erofs/super.c b/fs/erofs/super.c
-index 11b88559f8bfa..25f6b8b37f287 100644
---- a/fs/erofs/super.c
-+++ b/fs/erofs/super.c
-@@ -340,15 +340,15 @@ static int erofs_read_superblock(struct super_block *sb)
- static void erofs_default_options(struct erofs_fs_context *ctx)
- {
- #ifdef CONFIG_EROFS_FS_ZIP
--	ctx->cache_strategy = EROFS_ZIP_CACHE_READAROUND;
--	ctx->max_sync_decompress_pages = 3;
--	ctx->readahead_sync_decompress = false;
-+	ctx->opt.cache_strategy = EROFS_ZIP_CACHE_READAROUND;
-+	ctx->opt.max_sync_decompress_pages = 3;
-+	ctx->opt.readahead_sync_decompress = false;
- #endif
- #ifdef CONFIG_EROFS_FS_XATTR
--	set_opt(ctx, XATTR_USER);
-+	set_opt(&ctx->opt, XATTR_USER);
- #endif
- #ifdef CONFIG_EROFS_FS_POSIX_ACL
--	set_opt(ctx, POSIX_ACL);
-+	set_opt(&ctx->opt, POSIX_ACL);
- #endif
- }
- 
-@@ -392,12 +392,12 @@ static bool erofs_fc_set_dax_mode(struct fs_context *fc, unsigned int mode)
- 	switch (mode) {
- 	case EROFS_MOUNT_DAX_ALWAYS:
- 		warnfc(fc, "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
--		set_opt(ctx, DAX_ALWAYS);
--		clear_opt(ctx, DAX_NEVER);
-+		set_opt(&ctx->opt, DAX_ALWAYS);
-+		clear_opt(&ctx->opt, DAX_NEVER);
- 		return true;
- 	case EROFS_MOUNT_DAX_NEVER:
--		set_opt(ctx, DAX_NEVER);
--		clear_opt(ctx, DAX_ALWAYS);
-+		set_opt(&ctx->opt, DAX_NEVER);
-+		clear_opt(&ctx->opt, DAX_ALWAYS);
- 		return true;
- 	default:
- 		DBG_BUGON(1);
-@@ -424,9 +424,9 @@ static int erofs_fc_parse_param(struct fs_context *fc,
- 	case Opt_user_xattr:
- #ifdef CONFIG_EROFS_FS_XATTR
- 		if (result.boolean)
--			set_opt(ctx, XATTR_USER);
-+			set_opt(&ctx->opt, XATTR_USER);
- 		else
--			clear_opt(ctx, XATTR_USER);
-+			clear_opt(&ctx->opt, XATTR_USER);
- #else
- 		errorfc(fc, "{,no}user_xattr options not supported");
- #endif
-@@ -434,16 +434,16 @@ static int erofs_fc_parse_param(struct fs_context *fc,
- 	case Opt_acl:
- #ifdef CONFIG_EROFS_FS_POSIX_ACL
- 		if (result.boolean)
--			set_opt(ctx, POSIX_ACL);
-+			set_opt(&ctx->opt, POSIX_ACL);
- 		else
--			clear_opt(ctx, POSIX_ACL);
-+			clear_opt(&ctx->opt, POSIX_ACL);
- #else
- 		errorfc(fc, "{,no}acl options not supported");
- #endif
- 		break;
- 	case Opt_cache_strategy:
- #ifdef CONFIG_EROFS_FS_ZIP
--		ctx->cache_strategy = result.uint_32;
-+		ctx->opt.cache_strategy = result.uint_32;
- #else
- 		errorfc(fc, "compression not supported, cache_strategy ignored");
- #endif
-@@ -540,15 +540,16 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
- 		return -ENOMEM;
- 
- 	sb->s_fs_info = sbi;
-+	sbi->opt = ctx->opt;
- 	sbi->dax_dev = fs_dax_get_by_bdev(sb->s_bdev);
- 	err = erofs_read_superblock(sb);
- 	if (err)
- 		return err;
- 
--	if (test_opt(ctx, DAX_ALWAYS) &&
-+	if (test_opt(&sbi->opt, DAX_ALWAYS) &&
- 	    !dax_supported(sbi->dax_dev, sb->s_bdev, EROFS_BLKSIZ, 0, bdev_nr_sectors(sb->s_bdev))) {
- 		errorfc(fc, "DAX unsupported by block device. Turning off DAX.");
--		clear_opt(ctx, DAX_ALWAYS);
-+		clear_opt(&sbi->opt, DAX_ALWAYS);
- 	}
- 	sb->s_flags |= SB_RDONLY | SB_NOATIME;
- 	sb->s_maxbytes = MAX_LFS_FILESIZE;
-@@ -557,13 +558,11 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
- 	sb->s_op = &erofs_sops;
- 	sb->s_xattr = erofs_xattr_handlers;
- 
--	if (test_opt(ctx, POSIX_ACL))
-+	if (test_opt(&sbi->opt, POSIX_ACL))
- 		sb->s_flags |= SB_POSIXACL;
- 	else
- 		sb->s_flags &= ~SB_POSIXACL;
- 
--	sbi->ctx = *ctx;
--
- #ifdef CONFIG_EROFS_FS_ZIP
- 	xa_init(&sbi->managed_pslots);
- #endif
-@@ -607,12 +606,12 @@ static int erofs_fc_reconfigure(struct fs_context *fc)
- 
- 	DBG_BUGON(!sb_rdonly(sb));
- 
--	if (test_opt(ctx, POSIX_ACL))
-+	if (test_opt(&ctx->opt, POSIX_ACL))
- 		fc->sb_flags |= SB_POSIXACL;
- 	else
- 		fc->sb_flags &= ~SB_POSIXACL;
- 
--	sbi->ctx = *ctx;
-+	sbi->opt = ctx->opt;
- 
- 	fc->sb_flags |= SB_RDONLY;
- 	return 0;
-@@ -640,7 +639,6 @@ static int erofs_init_fs_context(struct fs_context *fc)
- 	erofs_default_options(fc->fs_private);
- 
- 	fc->ops = &erofs_context_ops;
--
- 	return 0;
- }
- 
-@@ -763,31 +761,31 @@ static int erofs_statfs(struct dentry *dentry, struct kstatfs *buf)
- static int erofs_show_options(struct seq_file *seq, struct dentry *root)
- {
- 	struct erofs_sb_info *sbi = EROFS_SB(root->d_sb);
--	struct erofs_fs_context *ctx = &sbi->ctx;
-+	struct erofs_mount_opts *opt = &sbi->opt;
- 
- #ifdef CONFIG_EROFS_FS_XATTR
--	if (test_opt(ctx, XATTR_USER))
-+	if (test_opt(opt, XATTR_USER))
- 		seq_puts(seq, ",user_xattr");
- 	else
- 		seq_puts(seq, ",nouser_xattr");
- #endif
- #ifdef CONFIG_EROFS_FS_POSIX_ACL
--	if (test_opt(ctx, POSIX_ACL))
-+	if (test_opt(opt, POSIX_ACL))
- 		seq_puts(seq, ",acl");
- 	else
- 		seq_puts(seq, ",noacl");
- #endif
- #ifdef CONFIG_EROFS_FS_ZIP
--	if (ctx->cache_strategy == EROFS_ZIP_CACHE_DISABLED)
-+	if (opt->cache_strategy == EROFS_ZIP_CACHE_DISABLED)
- 		seq_puts(seq, ",cache_strategy=disabled");
--	else if (ctx->cache_strategy == EROFS_ZIP_CACHE_READAHEAD)
-+	else if (opt->cache_strategy == EROFS_ZIP_CACHE_READAHEAD)
- 		seq_puts(seq, ",cache_strategy=readahead");
--	else if (ctx->cache_strategy == EROFS_ZIP_CACHE_READAROUND)
-+	else if (opt->cache_strategy == EROFS_ZIP_CACHE_READAROUND)
- 		seq_puts(seq, ",cache_strategy=readaround");
- #endif
--	if (test_opt(ctx, DAX_ALWAYS))
-+	if (test_opt(opt, DAX_ALWAYS))
- 		seq_puts(seq, ",dax=always");
--	if (test_opt(ctx, DAX_NEVER))
-+	if (test_opt(opt, DAX_NEVER))
- 		seq_puts(seq, ",dax=never");
- 	return 0;
- }
-diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c
-index 778f2c52295d1..01c581e93c5f8 100644
---- a/fs/erofs/xattr.c
-+++ b/fs/erofs/xattr.c
-@@ -429,7 +429,7 @@ static int shared_getxattr(struct inode *inode, struct getxattr_iter *it)
- 
- static bool erofs_xattr_user_list(struct dentry *dentry)
- {
--	return test_opt(&EROFS_SB(dentry->d_sb)->ctx, XATTR_USER);
-+	return test_opt(&EROFS_SB(dentry->d_sb)->opt, XATTR_USER);
- }
- 
- static bool erofs_xattr_trusted_list(struct dentry *dentry)
-@@ -476,7 +476,7 @@ static int erofs_xattr_generic_get(const struct xattr_handler *handler,
- 
- 	switch (handler->flags) {
- 	case EROFS_XATTR_INDEX_USER:
--		if (!test_opt(&sbi->ctx, XATTR_USER))
-+		if (!test_opt(&sbi->opt, XATTR_USER))
- 			return -EOPNOTSUPP;
- 		break;
- 	case EROFS_XATTR_INDEX_TRUSTED:
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index 3fd91a0efdbb7..c247b1bf57cc8 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -695,7 +695,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 		goto err_out;
- 
- 	/* preload all compressed pages (maybe downgrade role if necessary) */
--	if (should_alloc_managed_pages(fe, sbi->ctx.cache_strategy, map->m_la))
-+	if (should_alloc_managed_pages(fe, sbi->opt.cache_strategy, map->m_la))
- 		cache_strategy = TRYALLOC;
- 	else
- 		cache_strategy = DONTALLOC;
-@@ -797,7 +797,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,
- 	/* Use workqueue and sync decompression for atomic contexts only */
- 	if (in_atomic() || irqs_disabled()) {
- 		queue_work(z_erofs_workqueue, &io->u.work);
--		sbi->ctx.readahead_sync_decompress = true;
-+		sbi->opt.readahead_sync_decompress = true;
- 		return;
- 	}
- 	z_erofs_decompressqueue_work(&io->u.work);
-@@ -1412,8 +1412,8 @@ static void z_erofs_readahead(struct readahead_control *rac)
- 	struct erofs_sb_info *const sbi = EROFS_I_SB(inode);
- 
- 	unsigned int nr_pages = readahead_count(rac);
--	bool sync = (sbi->ctx.readahead_sync_decompress &&
--			nr_pages <= sbi->ctx.max_sync_decompress_pages);
-+	bool sync = (sbi->opt.readahead_sync_decompress &&
-+			nr_pages <= sbi->opt.max_sync_decompress_pages);
- 	struct z_erofs_decompress_frontend f = DECOMPRESS_FRONTEND_INIT(inode);
- 	struct page *page, *head = NULL;
- 	LIST_HEAD(pagepool);
--- 
-2.39.2
-
diff --git a/queue-5.15/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch b/queue-5.15/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
deleted file mode 100644
index 7dfbd51fee6..00000000000
--- a/queue-5.15/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 5de6c17168f163c7f0f91dc8d407fb8e5192bd2b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 14:21:30 +0800
-Subject: erofs: fix fsdax unavailability for chunk-based regular files
-
-From: Xin Yin <yinxin.x@bytedance.com>
-
-[ Upstream commit 18bddc5b67038722cb88fcf51fbf41a0277092cb ]
-
-DAX can be used to share page cache between VMs, reducing guest memory
-overhead. And chunk based data format is widely used for VM and
-container image. So enable dax support for it, make erofs better used
-for VM scenarios.
-
-Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
-Signed-off-by: Xin Yin <yinxin.x@bytedance.com>
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230711062130.7860-1-yinxin.x@bytedance.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/inode.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
-index 3ff36514cff25..638bb70d0d65b 100644
---- a/fs/erofs/inode.c
-+++ b/fs/erofs/inode.c
-@@ -193,7 +193,8 @@ static struct page *erofs_read_inode(struct inode *inode,
- 
- 	inode->i_flags &= ~S_DAX;
- 	if (test_opt(&sbi->opt, DAX_ALWAYS) && S_ISREG(inode->i_mode) &&
--	    vi->datalayout == EROFS_INODE_FLAT_PLAIN)
-+	    (vi->datalayout == EROFS_INODE_FLAT_PLAIN ||
-+	     vi->datalayout == EROFS_INODE_CHUNK_BASED))
- 		inode->i_flags |= S_DAX;
- 	if (!nblks)
- 		/* measure inode.i_blocks as generic filesystems */
--- 
-2.39.2
-
diff --git a/queue-5.15/gve-set-default-duplex-configuration-to-full.patch b/queue-5.15/gve-set-default-duplex-configuration-to-full.patch
deleted file mode 100644
index 3c21b05ecf9..00000000000
--- a/queue-5.15/gve-set-default-duplex-configuration-to-full.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 64c90d58bff99ed864149056fccab860788024b1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 12:41:28 +0800
-Subject: gve: Set default duplex configuration to full
-
-From: Junfeng Guo <junfeng.guo@intel.com>
-
-[ Upstream commit 0503efeadbf6bb8bf24397613a73b67e665eac5f ]
-
-Current duplex mode was unset in the driver, resulting in the default
-parameter being set to 0, which corresponds to half duplex. It might
-mislead users to have incorrect expectation about the driver's
-transmission capabilities.
-Set the default duplex configuration to full, as the driver runs in
-full duplex mode at this point.
-
-Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.")
-Signed-off-by: Junfeng Guo <junfeng.guo@intel.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Message-ID: <20230706044128.2726747-1-junfeng.guo@intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/google/gve/gve_ethtool.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
-index 6a0663aadd1e9..1f8cc722aae30 100644
---- a/drivers/net/ethernet/google/gve/gve_ethtool.c
-+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
-@@ -532,6 +532,9 @@ static int gve_get_link_ksettings(struct net_device *netdev,
- 		err = gve_adminq_report_link_speed(priv);
- 
- 	cmd->base.speed = priv->link_speed;
-+
-+	cmd->base.duplex = DUPLEX_FULL;
-+
- 	return err;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-5.15/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index 206b8c2f3a9..00000000000
--- a/queue-5.15/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 0d387327c93d9935b1b3c8900414753c6abf12a3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index 716e7717fe8fe..71a69166a6bd2 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -430,7 +430,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/igc-fix-inserting-of-empty-frame-for-launchtime.patch b/queue-5.15/igc-fix-inserting-of-empty-frame-for-launchtime.patch
deleted file mode 100644
index 3d1134ab9fc..00000000000
--- a/queue-5.15/igc-fix-inserting-of-empty-frame-for-launchtime.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From e12b128ab3cdcdc5a42f45bb4880e80f599c7de1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:14 +0200
-Subject: igc: Fix inserting of empty frame for launchtime
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 0bcc62858d6ba62cbade957d69745e6adeed5f3d ]
-
-The insertion of an empty frame was introduced with
-commit db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-in order to ensure that the current cycle has at least one packet if
-there is some packet to be scheduled for the next cycle.
-
-However, the current implementation does not properly check if
-a packet is already scheduled for the current cycle. Currently,
-an empty packet is always inserted if and only if
-txtime >= end_of_cycle && txtime > last_tx_cycle
-but since last_tx_cycle is always either the end of the current
-cycle (end_of_cycle) or the end of a previous cycle, the
-second part (txtime > last_tx_cycle) is always true unless
-txtime == last_tx_cycle.
-
-What actually needs to be checked here is if the last_tx_cycle
-was already written within the current cycle, so an empty frame
-should only be inserted if and only if
-txtime >= end_of_cycle && end_of_cycle > last_tx_cycle.
-
-This patch does not only avoid an unnecessary insertion, but it
-can actually be harmful to insert an empty packet if packets
-are already scheduled in the current cycle, because it can lead
-to a situation where the empty packet is actually processed
-as the first packet in the upcoming cycle shifting the packet
-with the first_flag even one cycle into the future, finally leading
-to a TX hang.
-
-The TX hang can be reproduced on a i225 with:
-
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x1 \
-	    txtime-delay 500000 \
-	    clockid CLOCK_TAI
-    sudo tc qdisc replace dev enp1s0 parent 100:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload \
-	    skip_sock_check
-
-and traffic generator
-
-    sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns
-
-with traffic.cfg
-
-    #define ETH_P_IP        0x0800
-
-    {
-      /* Ethernet Header */
-      0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e,  # MAC Dest - adapt as needed
-      0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36,  # MAC Src  - adapt as needed
-      const16(ETH_P_IP),
-
-      /* IPv4 Header */
-      0b01000101, 0,   # IPv4 version, IHL, TOS
-      const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))
-      const16(2),      # IPv4 ident
-      0b01000000, 0,   # IPv4 flags, fragmentation off
-      64,              # IPv4 TTL
-      17,              # Protocol UDP
-      csumip(14, 33),  # IPv4 checksum
-
-      /* UDP Header */
-      10,  0, 48, 1,   # IP Src - adapt as needed
-      10,  0, 48, 10,  # IP Dest - adapt as needed
-      const16(5555),   # UDP Src Port
-      const16(6666),   # UDP Dest Port
-      const16(1008),   # UDP length (UDP header 8 bytes + payload length)
-      csumudp(14, 34), # UDP checksum
-
-      /* Payload */
-      fill('W', 1000),
-    }
-
-and the observed message with that is for example
-
- igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang
-   Tx Queue             <0>
-   TDH                  <32>
-   TDT                  <3c>
-   next_to_use          <3c>
-   next_to_clean        <32>
- buffer_info[next_to_clean]
-   time_stamp           <ffff26a8>
-   next_to_watch        <00000000632a1828>
-   jiffies              <ffff27f8>
-   desc.status          <1048000>
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 491b80407df49..db48979cdecbc 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1026,7 +1026,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 			*first_flag = true;
- 			ring->last_ff_cycle = baset_est;
- 
--			if (ktime_compare(txtime, ring->last_tx_cycle) > 0)
-+			if (ktime_compare(end_of_cycle, ring->last_tx_cycle) > 0)
- 				*insert_empty = true;
- 		}
- 	}
--- 
-2.39.2
-
diff --git a/queue-5.15/igc-fix-launchtime-before-start-of-cycle.patch b/queue-5.15/igc-fix-launchtime-before-start-of-cycle.patch
deleted file mode 100644
index 59cc7140d3d..00000000000
--- a/queue-5.15/igc-fix-launchtime-before-start-of-cycle.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From b12ced94910b133fa504dc2c81a9f876f1a96c84 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:13 +0200
-Subject: igc: Fix launchtime before start of cycle
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit c1bca9ac0bcb355be11354c2e68bc7bf31f5ac5a ]
-
-It is possible (verified on a running system) that frames are processed
-by igc_tx_launchtime with a txtime before the start of the cycle
-(baset_est).
-
-However, the result of txtime - baset_est is written into a u32,
-leading to a wrap around to a positive number. The following
-launchtime > 0 check will only branch to executing launchtime = 0
-if launchtime is already 0.
-
-Fix it by using a s32 before checking launchtime > 0.
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index e5cbf867034e3..491b80407df49 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1013,7 +1013,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 	ktime_t base_time = adapter->base_time;
- 	ktime_t now = ktime_get_clocktai();
- 	ktime_t baset_est, end_of_cycle;
--	u32 launchtime;
-+	s32 launchtime;
- 	s64 n;
- 
- 	n = div64_s64(ktime_sub_ns(now, base_time), cycle_time);
--- 
-2.39.2
-
diff --git a/queue-5.15/igc-handle-pps-start-time-programming-for-past-time-.patch b/queue-5.15/igc-handle-pps-start-time-programming-for-past-time-.patch
deleted file mode 100644
index fe07062b623..00000000000
--- a/queue-5.15/igc-handle-pps-start-time-programming-for-past-time-.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From ee4b190bc6ab1fb3c0f0aea2842e01edc5150410 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 12:00:43 +0530
-Subject: igc: Handle PPS start time programming for past time values
-
-From: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-
-[ Upstream commit 84a192e46106355de1a314d709e657231d4b1026 ]
-
-I225/6 hardware can be programmed to start PPS output once
-the time in Target Time registers is reached. The time
-programmed in these registers should always be into future.
-Only then PPS output is triggered when SYSTIM register
-reaches the programmed value. There are two modes in i225/6
-hardware to program PPS, pulse and clock mode.
-
-There were issues reported where PPS is not generated when
-start time is in past.
-
-Example 1, "echo 0 0 0 2 0 > /sys/class/ptp/ptp0/period"
-
-In the current implementation, a value of '0' is programmed
-into Target time registers and PPS output is in pulse mode.
-Eventually an interrupt which is triggered upon SYSTIM
-register reaching Target time is not fired. Thus no PPS
-output is generated.
-
-Example 2, "echo 0 0 0 1 0 > /sys/class/ptp/ptp0/period"
-
-Above case, a value of '0' is programmed into Target time
-registers and PPS output is in clock mode. Here, HW tries to
-catch-up the current time by incrementing Target Time
-register. This catch-up time seem to vary according to
-programmed PPS period time as per the HW design. In my
-experiments, the delay ranged between few tens of seconds to
-few minutes. The PPS output is only generated after the
-Target time register reaches current time.
-
-In my experiments, I also observed PPS stopped working with
-below test and could not recover until module is removed and
-loaded again.
-
-1) echo 0 <future time> 0 1 0 > /sys/class/ptp/ptp1/period
-2) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-3) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-
-After this PPS did not work even if i re-program with proper
-values. I could only get this back working by reloading the
-driver.
-
-This patch takes care of calculating and programming
-appropriate future time value into Target Time registers.
-
-Fixes: 5e91c72e560c ("igc: Fix PPS delta between two synchronized end-points")
-Signed-off-by: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-Reviewed-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ptp.c | 25 +++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
-index 6803d91cf71cd..556750b61c98f 100644
---- a/drivers/net/ethernet/intel/igc/igc_ptp.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
-@@ -357,16 +357,35 @@ static int igc_ptp_feature_enable_i225(struct ptp_clock_info *ptp,
- 			tsim &= ~IGC_TSICR_TT0;
- 		}
- 		if (on) {
-+			struct timespec64 safe_start;
- 			int i = rq->perout.index;
- 
- 			igc_pin_perout(igc, i, pin, use_freq);
--			igc->perout[i].start.tv_sec = rq->perout.start.sec;
-+			igc_ptp_read(igc, &safe_start);
-+
-+			/* PPS output start time is triggered by Target time(TT)
-+			 * register. Programming any past time value into TT
-+			 * register will cause PPS to never start. Need to make
-+			 * sure we program the TT register a time ahead in
-+			 * future. There isn't a stringent need to fire PPS out
-+			 * right away. Adding +2 seconds should take care of
-+			 * corner cases. Let's say if the SYSTIML is close to
-+			 * wrap up and the timer keeps ticking as we program the
-+			 * register, adding +2seconds is safe bet.
-+			 */
-+			safe_start.tv_sec += 2;
-+
-+			if (rq->perout.start.sec < safe_start.tv_sec)
-+				igc->perout[i].start.tv_sec = safe_start.tv_sec;
-+			else
-+				igc->perout[i].start.tv_sec = rq->perout.start.sec;
- 			igc->perout[i].start.tv_nsec = rq->perout.start.nsec;
- 			igc->perout[i].period.tv_sec = ts.tv_sec;
- 			igc->perout[i].period.tv_nsec = ts.tv_nsec;
--			wr32(trgttimh, rq->perout.start.sec);
-+			wr32(trgttimh, (u32)igc->perout[i].start.tv_sec);
- 			/* For now, always select timer 0 as source. */
--			wr32(trgttiml, rq->perout.start.nsec | IGC_TT_IO_TIMER_SEL_SYSTIM0);
-+			wr32(trgttiml, (u32)(igc->perout[i].start.tv_nsec |
-+					     IGC_TT_IO_TIMER_SEL_SYSTIM0));
- 			if (use_freq)
- 				wr32(freqout, ns);
- 			tsauxc |= tsauxc_mask;
--- 
-2.39.2
-
diff --git a/queue-5.15/igc-remove-delay-during-tx-ring-configuration.patch b/queue-5.15/igc-remove-delay-during-tx-ring-configuration.patch
deleted file mode 100644
index ca4c283d3a0..00000000000
--- a/queue-5.15/igc-remove-delay-during-tx-ring-configuration.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 3313141ca663dc0f23bc910e0298cc2a1975a8ca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 May 2023 08:18:12 +0800
-Subject: igc: Remove delay during TX ring configuration
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit cca28ceac7c7857bc2d313777017585aef00bcc4 ]
-
-Remove unnecessary delay during the TX ring configuration.
-This will cause delay, especially during link down and
-link up activity.
-
-Furthermore, old SKUs like as I225 will call the reset_adapter
-to reset the controller during TSN mode Gate Control List (GCL)
-setting. This will add more time to the configuration of the
-real-time use case.
-
-It doesn't mentioned about this delay in the Software User Manual.
-It might have been ported from legacy code I210 in the past.
-
-Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index abc63ca9d28bf..e5cbf867034e3 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -708,7 +708,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter,
- 	/* disable the queue */
- 	wr32(IGC_TXDCTL(reg_idx), 0);
- 	wrfl();
--	mdelay(10);
- 
- 	wr32(IGC_TDLEN(reg_idx),
- 	     ring->count * sizeof(union igc_adv_tx_desc));
--- 
-2.39.2
-
diff --git a/queue-5.15/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch b/queue-5.15/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
deleted file mode 100644
index d918c842dd1..00000000000
--- a/queue-5.15/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 588a2be7bea7d92cdfa528bd4b68700843bae107 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 5 Jun 2023 11:09:01 -0700
-Subject: igc: set TP bit in 'supported' and 'advertising' fields of
- ethtool_link_ksettings
-
-From: Prasad Koya <prasad@arista.com>
-
-[ Upstream commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 ]
-
-set TP bit in the 'supported' and 'advertising' fields. i225/226 parts
-only support twisted pair copper.
-
-Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
-Signed-off-by: Prasad Koya <prasad@arista.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-index e0a76ac1bbbcd..859ddc07fbbfe 100644
---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-@@ -1701,6 +1701,8 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
- 	/* twisted pair */
- 	cmd->base.port = PORT_TP;
- 	cmd->base.phy_address = hw->phy.addr;
-+	ethtool_link_ksettings_add_link_mode(cmd, supported, TP);
-+	ethtool_link_ksettings_add_link_mode(cmd, advertising, TP);
- 
- 	/* advertising link modes */
- 	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
--- 
-2.39.2
-
diff --git a/queue-5.15/ionic-remove-warn_on-to-prevent-panic_on_warn.patch b/queue-5.15/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
deleted file mode 100644
index 2660a655e24..00000000000
--- a/queue-5.15/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 377bc5d0afdf35a34e63a584f51807b7d81dc4b7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 11:20:06 -0700
-Subject: ionic: remove WARN_ON to prevent panic_on_warn
-
-From: Nitya Sunkad <nitya.sunkad@amd.com>
-
-[ Upstream commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 ]
-
-Remove unnecessary early code development check and the WARN_ON
-that it uses.  The irq alloc and free paths have long been
-cleaned up and this check shouldn't have stuck around so long.
-
-Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
-Signed-off-by: Nitya Sunkad <nitya.sunkad@amd.com>
-Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 6fbd2a51d66ce..2cc126d378353 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -451,11 +451,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif)
- static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
--	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
--		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
--	}
--
- 	n_qcq->intr.vector = src_qcq->intr.vector;
- 	n_qcq->intr.index = src_qcq->intr.index;
- }
--- 
-2.39.2
-
diff --git a/queue-5.15/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-5.15/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index 787833f61bd..00000000000
--- a/queue-5.15/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From efe85c6893ae4fac909f925a76c4dd2c75b4015a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 6ba34f51c411f..e0d3909172a84 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -323,9 +323,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-5.15/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch b/queue-5.15/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
deleted file mode 100644
index ae8885132d7..00000000000
--- a/queue-5.15/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 25fb63b80c864a4788aec31778e7dff5a315a323 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 3 Jul 2023 07:28:53 +0300
-Subject: kernel/trace: Fix cleanup logic of enable_trace_eprobe
-
-From: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-
-[ Upstream commit cf0a624dc706c306294c14e6b3e7694702f25191 ]
-
-The enable_trace_eprobe() function enables all event probes, attached
-to given trace probe. If an error occurs in enabling one of the event
-probes, all others should be roll backed. There is a bug in that roll
-back logic - instead of all event probes, only the failed one is
-disabled.
-
-Link: https://lore.kernel.org/all/20230703042853.1427493-1-tz.stoyanov@gmail.com/
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events")
-Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
-Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/trace/trace_eprobe.c | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
-index 9806316af1279..085f056e66f19 100644
---- a/kernel/trace/trace_eprobe.c
-+++ b/kernel/trace/trace_eprobe.c
-@@ -725,6 +725,7 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 	struct trace_eprobe *ep;
- 	bool enabled;
- 	int ret = 0;
-+	int cnt = 0;
- 
- 	tp = trace_probe_primary_from_call(call);
- 	if (WARN_ON_ONCE(!tp))
-@@ -748,12 +749,25 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 		if (ret)
- 			break;
- 		enabled = true;
-+		cnt++;
- 	}
- 
- 	if (ret) {
- 		/* Failed to enable one of them. Roll back all */
--		if (enabled)
--			disable_eprobe(ep, file->tr);
-+		if (enabled) {
-+			/*
-+			 * It's a bug if one failed for something other than memory
-+			 * not being available but another eprobe succeeded.
-+			 */
-+			WARN_ON_ONCE(ret != -ENOMEM);
-+
-+			list_for_each_entry(pos, trace_probe_probe_list(tp), list) {
-+				ep = container_of(pos, struct trace_eprobe, tp);
-+				disable_eprobe(ep, file->tr);
-+				if (!--cnt)
-+					break;
-+			}
-+		}
- 		if (file)
- 			trace_probe_remove_file(tp, file);
- 		else
--- 
-2.39.2
-
diff --git a/queue-5.15/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch b/queue-5.15/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
deleted file mode 100644
index 55c41b098b0..00000000000
--- a/queue-5.15/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From b332ea06653a19cb4f111ba3e9a526a9e8ec4491 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 08:53:25 +0200
-Subject: net: bgmac: postpone turning IRQs off to avoid SoC hangs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Rafał Miłecki <rafal@milecki.pl>
-
-[ Upstream commit e7731194fdf085f46d58b1adccfddbd0dfee4873 ]
-
-Turning IRQs off is done by accessing Ethernet controller registers.
-That can't be done until device's clock is enabled. It results in a SoC
-hang otherwise.
-
-This bug remained unnoticed for years as most bootloaders keep all
-Ethernet interfaces turned on. It seems to only affect a niche SoC
-family BCM47189. It has two Ethernet controllers but CFE bootloader uses
-only the first one.
-
-Fixes: 34322615cbaa ("net: bgmac: Mask interrupts during probe")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/broadcom/bgmac.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
-index f8fd65ab663ee..54ff28c9b2148 100644
---- a/drivers/net/ethernet/broadcom/bgmac.c
-+++ b/drivers/net/ethernet/broadcom/bgmac.c
-@@ -1492,8 +1492,6 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 
- 	bgmac->in_init = true;
- 
--	bgmac_chip_intrs_off(bgmac);
--
- 	net_dev->irq = bgmac->irq;
- 	SET_NETDEV_DEV(net_dev, bgmac->dev);
- 	dev_set_drvdata(bgmac->dev, bgmac);
-@@ -1511,6 +1509,8 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 	 */
- 	bgmac_clk_enable(bgmac, 0);
- 
-+	bgmac_chip_intrs_off(bgmac);
-+
- 	/* This seems to be fixing IRQ by assigning OOB #6 to the core */
- 	if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
- 		if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
--- 
-2.39.2
-
diff --git a/queue-5.15/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch b/queue-5.15/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
deleted file mode 100644
index be0be45c1dc..00000000000
--- a/queue-5.15/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From eaf6ba5c401bce0407ef41a83ae165183d027eec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 8 Jun 2023 09:32:10 +0200
-Subject: net/mlx5e: Check for NOT_READY flag state after locking
-
-From: Vlad Buslov <vladbu@nvidia.com>
-
-[ Upstream commit 65e64640e97c0f223e77f9ea69b5a46186b93470 ]
-
-Currently the check for NOT_READY flag is performed before obtaining the
-necessary lock. This opens a possibility for race condition when the flow
-is concurrently removed from unready_flows list by the workqueue task,
-which causes a double-removal from the list and a crash[0]. Fix the issue
-by moving the flag check inside the section protected by
-uplink_priv->unready_flows_lock mutex.
-
-[0]:
-[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP
-[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1
-[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
-[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.402999] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.403787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-[44376.406339] Call Trace:
-[44376.406651]  <TASK>
-[44376.406939]  ? die_addr+0x33/0x90
-[44376.407311]  ? exc_general_protection+0x192/0x390
-[44376.407795]  ? asm_exc_general_protection+0x22/0x30
-[44376.408292]  ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.408876]  __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]
-[44376.409482]  mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]
-[44376.410055]  mlx5e_flow_put+0x25/0x50 [mlx5_core]
-[44376.410529]  mlx5e_delete_flower+0x24b/0x350 [mlx5_core]
-[44376.411043]  tc_setup_cb_reoffload+0x22/0x80
-[44376.411462]  fl_reoffload+0x261/0x2f0 [cls_flower]
-[44376.411907]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.412481]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.413044]  tcf_block_playback_offloads+0x76/0x170
-[44376.413497]  tcf_block_unbind+0x7b/0xd0
-[44376.413881]  tcf_block_setup+0x17d/0x1c0
-[44376.414269]  tcf_block_offload_cmd.isra.0+0xf1/0x130
-[44376.414725]  tcf_block_offload_unbind+0x43/0x70
-[44376.415153]  __tcf_block_put+0x82/0x150
-[44376.415532]  ingress_destroy+0x22/0x30 [sch_ingress]
-[44376.415986]  qdisc_destroy+0x3b/0xd0
-[44376.416343]  qdisc_graft+0x4d0/0x620
-[44376.416706]  tc_get_qdisc+0x1c9/0x3b0
-[44376.417074]  rtnetlink_rcv_msg+0x29c/0x390
-[44376.419978]  ? rep_movs_alternative+0x3a/0xa0
-[44376.420399]  ? rtnl_calcit.isra.0+0x120/0x120
-[44376.420813]  netlink_rcv_skb+0x54/0x100
-[44376.421192]  netlink_unicast+0x1f6/0x2c0
-[44376.421573]  netlink_sendmsg+0x232/0x4a0
-[44376.421980]  sock_sendmsg+0x38/0x60
-[44376.422328]  ____sys_sendmsg+0x1d0/0x1e0
-[44376.422709]  ? copy_msghdr_from_user+0x6d/0xa0
-[44376.423127]  ___sys_sendmsg+0x80/0xc0
-[44376.423495]  ? ___sys_recvmsg+0x8b/0xc0
-[44376.423869]  __sys_sendmsg+0x51/0x90
-[44376.424226]  do_syscall_64+0x3d/0x90
-[44376.424587]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
-[44376.425046] RIP: 0033:0x7f045134f887
-[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
-[44376.426914] RSP: 002b:00007ffd63a82b98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
-[44376.427592] RAX: ffffffffffffffda RBX: 000000006481955f RCX: 00007f045134f887
-[44376.428195] RDX: 0000000000000000 RSI: 00007ffd63a82c00 RDI: 0000000000000003
-[44376.428796] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
-[44376.429404] R10: 00007f0451208708 R11: 0000000000000246 R12: 0000000000000001
-[44376.430039] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
-[44376.430644]  </TASK>
-[44376.430907] Modules linked in: mlx5_ib mlx5_core act_mirred act_tunnel_key cls_flower vxlan dummy sch_ingress openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_g
-ss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core]
-[44376.433936] ---[ end trace 0000000000000000 ]---
-[44376.434373] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.434951] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.436452] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.436924] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.437530] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.438179] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.438786] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.439393] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.439998] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.440714] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.441225] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.441843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.442471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-
-Fixes: ad86755b18d5 ("net/mlx5e: Protect unready flows with dedicated lock")
-Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
-Reviewed-by: Roi Dayan <roid@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-index 5cef556223e2c..d123d9b4adf5e 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -1282,7 +1282,8 @@ static void remove_unready_flow(struct mlx5e_tc_flow *flow)
- 	uplink_priv = &rpriv->uplink_priv;
- 
- 	mutex_lock(&uplink_priv->unready_flows_lock);
--	unready_flow_del(flow);
-+	if (flow_flag_test(flow, NOT_READY))
-+		unready_flow_del(flow);
- 	mutex_unlock(&uplink_priv->unready_flows_lock);
- }
- 
-@@ -1525,8 +1526,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
- 	esw_attr = attr->esw_attr;
- 	mlx5e_put_flow_tunnel_id(flow);
- 
--	if (flow_flag_test(flow, NOT_READY))
--		remove_unready_flow(flow);
-+	remove_unready_flow(flow);
- 
- 	if (mlx5e_is_offloaded_flow(flow)) {
- 		if (flow_flag_test(flow, SLOW))
--- 
-2.39.2
-
diff --git a/queue-5.15/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch b/queue-5.15/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
deleted file mode 100644
index 3be3297ecde..00000000000
--- a/queue-5.15/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8c2284fd513f74f18890f19294ab4e05aa8e47d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 08:59:34 +0800
-Subject: net/mlx5e: fix double free in mlx5e_destroy_flow_table
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 884abe45a9014d0de2e6edb0630dfd64f23f1d1b ]
-
-In function accel_fs_tcp_create_groups(), when the ft->g memory is
-successfully allocated but the 'in' memory fails to be allocated, the
-memory pointed to by ft->g is released once. And in function
-accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
-the memory pointed to by ft->g again. This will cause double free problem.
-
-Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-index 4c4ee524176c7..153c16e3ff3bf 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-@@ -194,6 +194,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
- 	in = kvzalloc(inlen, GFP_KERNEL);
- 	if  (!in || !ft->g) {
- 		kfree(ft->g);
-+		ft->g = NULL;
- 		kvfree(in);
- 		return -ENOMEM;
- 	}
--- 
-2.39.2
-
diff --git a/queue-5.15/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch b/queue-5.15/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
deleted file mode 100644
index 05bb9b4d3af..00000000000
--- a/queue-5.15/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 216f20de5eb5d285043eccb89c7cbb4b37dd6e7e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 09:49:03 +0800
-Subject: net/mlx5e: fix memory leak in mlx5e_ptp_open
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit d543b649ffe58a0cb4b6948b3305069c5980a1fa ]
-
-When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
-pointed by "c" or "cparams" is not freed, which can lead to a memory
-leak. Fix by freeing the array in the error path.
-
-Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
-Reviewed-by: Gal Pressman <gal@nvidia.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-index ee95cc3a03786..ce941e6091c57 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-@@ -676,8 +676,10 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params,
- 
- 	c = kvzalloc_node(sizeof(*c), GFP_KERNEL, dev_to_node(mlx5_core_dma_dev(mdev)));
- 	cparams = kvzalloc(sizeof(*cparams), GFP_KERNEL);
--	if (!c || !cparams)
--		return -ENOMEM;
-+	if (!c || !cparams) {
-+		err = -ENOMEM;
-+		goto err_free;
-+	}
- 
- 	c->priv     = priv;
- 	c->mdev     = priv->mdev;
--- 
-2.39.2
-
diff --git a/queue-5.15/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-5.15/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index e0b160e3ef9..00000000000
--- a/queue-5.15/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 6987c59b41eac027a149a810085d2efbbdeea4ed Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index 5c431a3697622..f5b5ae58c2691 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1474,7 +1474,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -4185,7 +4185,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-5.15/net-prevent-skb-corruption-on-frag-list-segmentation.patch b/queue-5.15/net-prevent-skb-corruption-on-frag-list-segmentation.patch
deleted file mode 100644
index 9052c720eb7..00000000000
--- a/queue-5.15/net-prevent-skb-corruption-on-frag-list-segmentation.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From e7d9176fca675a364948af3046519d0abca3f57a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 10:11:10 +0200
-Subject: net: prevent skb corruption on frag list segmentation
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]
-
-Ian reported several skb corruptions triggered by rx-gro-list,
-collecting different oops alike:
-
-[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
-[   62.631083] #PF: supervisor read access in kernel mode
-[   62.636312] #PF: error_code(0x0000) - not-present page
-[   62.641541] PGD 0 P4D 0
-[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
-[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
-[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
-[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
-./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
-net/ipv4/udp_offload.c:277)
-[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
-[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
-[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
-[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
-[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
-[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
-[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
-knlGS:0000000000000000
-[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
-[   62.749948] Call Trace:
-[   62.752498]  <TASK>
-[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
-[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
-[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
-[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
-net/core/dev.c:3659)
-[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
-[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
-[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
-net/netfilter/core.c:626)
-[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
-[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
-[   62.829420] br_flood (net/bridge/br_forward.c:233)
-[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
-[   62.837403] br_handle_frame (net/bridge/br_input.c:298
-net/bridge/br_input.c:416)
-[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
-[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
-[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
-net/core/dev.c:5727)
-[   62.876795] napi_complete_done (./include/linux/list.h:37
-./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
-[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
-[   62.893534] __napi_poll (net/core/dev.c:6498)
-[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
-net/core/dev.c:6640)
-[   62.905276] kthread (kernel/kthread.c:379)
-[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
-[   62.917119]  </TASK>
-
-In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
-bridge, both to the local input path and to an egress device (tun).
-
-The segmentation of such packets unsafely writes to the cloned skbs
-with shared heads.
-
-This change addresses the issue by uncloning as needed the
-to-be-segmented skbs.
-
-Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
-Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
-Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/skbuff.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index f3850c88cdda2..e01dd4cad0fc0 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -3882,6 +3882,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
- 
- 	skb_push(skb, -skb_network_offset(skb) + offset);
- 
-+	/* Ensure the head is writeable before touching the shared info */
-+	err = skb_unclone(skb, GFP_ATOMIC);
-+	if (err)
-+		goto err_linearize;
-+
- 	skb_shinfo(skb)->frag_list = NULL;
- 
- 	while (list_skb) {
--- 
-2.39.2
-
diff --git a/queue-5.15/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch b/queue-5.15/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
deleted file mode 100644
index 4d7b6a1c842..00000000000
--- a/queue-5.15/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 5cd2235cbcfe698a051c0c291ee3571932772730 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 12:15:30 -0400
-Subject: net/sched: cls_fw: Fix improper refcount update leads to
- use-after-free
-
-From: M A Ramdhan <ramdhan@starlabs.sg>
-
-[ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ]
-
-In the event of a failure in tcf_change_indev(), fw_set_parms() will
-immediately return an error after incrementing or decrementing
-reference counter in tcf_bind_filter().  If attacker can control
-reference counter to zero and make reference freed, leading to
-use after free.
-
-In order to prevent this, move the point of possible failure above the
-point where the TC_FW_CLASSID is handled.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
-Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
-Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_fw.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
-index 8654b0ce997c1..ea52c320f67c4 100644
---- a/net/sched/cls_fw.c
-+++ b/net/sched/cls_fw.c
-@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_FW_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
--	}
--
- 	if (tb[TCA_FW_INDEV]) {
- 		int ret;
- 		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
-@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	} else if (head->mask != 0xFFFFFFFF)
- 		return err;
- 
-+	if (tb[TCA_FW_CLASSID]) {
-+		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
-+		tcf_bind_filter(tp, &f->res, base);
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/net-sched-flower-ensure-both-minimum-and-maximum-por.patch b/queue-5.15/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
deleted file mode 100644
index 392487bd5be..00000000000
--- a/queue-5.15/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 44622fbc074e9b9ae5c44939d4a707ac687c3e4b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 10:08:09 +0300
-Subject: net/sched: flower: Ensure both minimum and maximum ports are
- specified
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit d3f87278bcb80bd7f9519669d928b43320363d4f ]
-
-The kernel does not currently validate that both the minimum and maximum
-ports of a port range are specified. This can lead user space to think
-that a filter matching on a port range was successfully added, when in
-fact it was not. For example, with a patched (buggy) iproute2 that only
-sends the minimum port, the following commands do not return an error:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
-
- # tc filter show dev swp1 ingress
- filter protocol ip pref 1 flower chain 0
- filter protocol ip pref 1 flower chain 0 handle 0x1
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 1 ref 1 bind 1
-
- filter protocol ip pref 1 flower chain 0 handle 0x2
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 2 ref 1 bind 1
-
-Fix by returning an error unless both ports are specified:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
- Error: Both min and max source ports must be specified.
- We have an error talking to the kernel
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
- Error: Both min and max destination ports must be specified.
- We have an error talking to the kernel
-
-Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Petr Machata <petrm@nvidia.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index ee137d5c20a4f..bff0a5f24aca8 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -784,6 +784,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
-+	if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max destination ports must be specified");
-+		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max source ports must be specified");
-+		return -EINVAL;
-+	}
- 	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
- 	    ntohs(key->tp_range.tp_max.dst) <=
- 	    ntohs(key->tp_range.tp_min.dst)) {
--- 
-2.39.2
-
diff --git a/queue-5.15/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-5.15/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index 08d95286a3b..00000000000
--- a/queue-5.15/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From df78367e2626cd92a32e4625af3b52a641f51857 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 9cd2d4e84913f..d0d9dd2483dd3 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -141,7 +141,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-5.15/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch b/queue-5.15/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
deleted file mode 100644
index 422ff5bc980..00000000000
--- a/queue-5.15/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From bc4da92bf8187d27dfa4d9cd8c4a72d1f2c94199 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 18:01:02 -0300
-Subject: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 ]
-
-Lion says:
--------
-In the QFQ scheduler a similar issue to CVE-2023-31436
-persists.
-
-Consider the following code in net/sched/sch_qfq.c:
-
-static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
-                struct sk_buff **to_free)
-{
-     unsigned int len = qdisc_pkt_len(skb), gso_segs;
-
-    // ...
-
-     if (unlikely(cl->agg->lmax < len)) {
-         pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
-              cl->agg->lmax, len, cl->common.classid);
-         err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
-         if (err) {
-             cl->qstats.drops++;
-             return qdisc_drop(skb, sch, to_free);
-         }
-
-    // ...
-
-     }
-
-Similarly to CVE-2023-31436, "lmax" is increased without any bounds
-checks according to the packet length "len". Usually this would not
-impose a problem because packet sizes are naturally limited.
-
-This is however not the actual packet length, rather the
-"qdisc_pkt_len(skb)" which might apply size transformations according to
-"struct qdisc_size_table" as created by "qdisc_get_stab()" in
-net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.
-
-A user may choose virtually any size using such a table.
-
-As a result the same issue as in CVE-2023-31436 can occur, allowing heap
-out-of-bounds read / writes in the kmalloc-8192 cache.
--------
-
-We can create the issue with the following commands:
-
-tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
-overhead 999999999 linklayer ethernet qfq
-tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
-tc filter add dev $DEV parent 1: matchall classid 1:1
-ping -I $DEV 1.1.1.2
-
-This is caused by incorrectly assuming that qdisc_pkt_len() returns a
-length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.
-
-Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
-Reported-by: Lion <nnamrec@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 8fb30b20425f8..3ba6a766601cf 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -381,8 +381,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight,
- 			   u32 lmax)
- {
- 	struct qfq_sched *q = qdisc_priv(sch);
--	struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight);
-+	struct qfq_aggregate *new_agg;
- 
-+	/* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */
-+	if (lmax > QFQ_MAX_LMAX)
-+		return -EINVAL;
-+
-+	new_agg = qfq_find_agg(q, lmax, weight);
- 	if (new_agg == NULL) { /* create new aggregate */
- 		new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC);
- 		if (new_agg == NULL)
--- 
-2.39.2
-
diff --git a/queue-5.15/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch b/queue-5.15/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
deleted file mode 100644
index f230af07292..00000000000
--- a/queue-5.15/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From dd001548e7c56b718402923a327fac8681e8fec7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Apr 2023 12:56:11 -0300
-Subject: net/sched: sch_qfq: refactor parsing of netlink parameters
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 25369891fcef373540f8b4e0b3bccf77a04490d5 ]
-
-Two parameters can be transformed into netlink policies and
-validated while parsing the netlink message.
-
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 3e337087c3b5 ("net/sched: sch_qfq: account for stab overhead in qfq_enqueue")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 25 +++++++++++--------------
- 1 file changed, 11 insertions(+), 14 deletions(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 4c51aeb78f141..8fb30b20425f8 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -113,6 +113,7 @@
- 
- #define QFQ_MTU_SHIFT		16	/* to support TSO/GSO */
- #define QFQ_MIN_LMAX		512	/* see qfq_slot_insert */
-+#define QFQ_MAX_LMAX		(1UL << QFQ_MTU_SHIFT)
- 
- #define QFQ_MAX_AGG_CLASSES	8 /* max num classes per aggregate allowed */
- 
-@@ -214,9 +215,14 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
- 	return container_of(clc, struct qfq_class, common);
- }
- 
-+static struct netlink_range_validation lmax_range = {
-+	.min = QFQ_MIN_LMAX,
-+	.max = QFQ_MAX_LMAX,
-+};
-+
- static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
--	[TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
--	[TCA_QFQ_LMAX] = { .type = NLA_U32 },
-+	[TCA_QFQ_WEIGHT] = NLA_POLICY_RANGE(NLA_U32, 1, QFQ_MAX_WEIGHT),
-+	[TCA_QFQ_LMAX] = NLA_POLICY_FULL_RANGE(NLA_U32, &lmax_range),
- };
- 
- /*
-@@ -408,17 +414,13 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	}
- 
- 	err = nla_parse_nested_deprecated(tb, TCA_QFQ_MAX, tca[TCA_OPTIONS],
--					  qfq_policy, NULL);
-+					  qfq_policy, extack);
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_QFQ_WEIGHT]) {
-+	if (tb[TCA_QFQ_WEIGHT])
- 		weight = nla_get_u32(tb[TCA_QFQ_WEIGHT]);
--		if (!weight || weight > (1UL << QFQ_MAX_WSHIFT)) {
--			pr_notice("qfq: invalid weight %u\n", weight);
--			return -EINVAL;
--		}
--	} else
-+	else
- 		weight = 1;
- 
- 	if (tb[TCA_QFQ_LMAX])
-@@ -426,11 +428,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	else
- 		lmax = psched_mtu(qdisc_dev(sch));
- 
--	if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
--		pr_notice("qfq: invalid max length %u\n", lmax);
--		return -EINVAL;
--	}
--
- 	inv_w = ONE_FP / weight;
- 	weight = ONE_FP / inv_w;
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch b/queue-5.15/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
deleted file mode 100644
index 64f1cd0de3b..00000000000
--- a/queue-5.15/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 545d27957daccdd4feda04e785a0256c46ac004a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 11:52:26 +0300
-Subject: netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 ]
-
-The simple_write_to_buffer() function is designed to handle partial
-writes.  It returns negatives on error, otherwise it returns the number
-of bytes that were able to be copied.  This code doesn't check the
-return properly.  We only know that the first byte is written, the rest
-of the buffer might be uninitialized.
-
-There is no need to use the simple_write_to_buffer() function.
-Partial writes are prohibited by the "if (*ppos != 0)" check at the
-start of the function.  Just use memdup_user() and copy the whole
-buffer.
-
-Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Reviewed-by: Ido Schimmel <idosch@nvidia.com>
-Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/netdevsim/dev.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
-index 94490dfae6568..a7279356299af 100644
---- a/drivers/net/netdevsim/dev.c
-+++ b/drivers/net/netdevsim/dev.c
-@@ -168,13 +168,10 @@ static ssize_t nsim_dev_trap_fa_cookie_write(struct file *file,
- 	cookie_len = (count - 1) / 2;
- 	if ((count - 1) % 2)
- 		return -EINVAL;
--	buf = kmalloc(count, GFP_KERNEL | __GFP_NOWARN);
--	if (!buf)
--		return -ENOMEM;
- 
--	ret = simple_write_to_buffer(buf, count, ppos, data, count);
--	if (ret < 0)
--		goto free_buf;
-+	buf = memdup_user(data, count);
-+	if (IS_ERR(buf))
-+		return PTR_ERR(buf);
- 
- 	fa_cookie = kmalloc(sizeof(*fa_cookie) + cookie_len,
- 			    GFP_KERNEL | __GFP_NOWARN);
--- 
-2.39.2
-
diff --git a/queue-5.15/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-5.15/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index 1acb50df7c3..00000000000
--- a/queue-5.15/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 7a3367eb6384d797bcdb727dcd047d232a3a41ec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 87847c3800516..1c03a78c125b0 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1336,12 +1336,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-5.15/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index 3301e93bcf1..00000000000
--- a/queue-5.15/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 6138a10490cf126eb0122ccc1d95553a24bbd4ad Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index 733557231ed0b..72060acb9cafc 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2891,6 +2891,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2898,7 +2899,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-5.15/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index a75160bc4f2..00000000000
--- a/queue-5.15/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 95fe5c8810bafa8b84d1e7ab1a995ca4a8fcb871 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index e5f14e20a9ff7..41897167abc71 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2060,12 +2060,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-5.15/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index 5ab539fe07f..00000000000
--- a/queue-5.15/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From fd1eae568cc3501fd2054b3b56a21a47c615394e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 5ee0afa621a95..eeeb4b1c97d2c 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-5.15/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-5.15/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index 5d1f0425de8..00000000000
--- a/queue-5.15/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 941723092892a50b12ab43d8de7f97457df1c671 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index a9b97ebc71ac5..2abd2235bbcab 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -410,7 +410,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-5.15/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch b/queue-5.15/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
deleted file mode 100644
index 79c05d4264f..00000000000
--- a/queue-5.15/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From ec938d787af448ae6f83fabdf14cb5dc51f7c9d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jul 2023 17:26:20 +0800
-Subject: nvme-pci: fix DMA direction of unmapping integrity data
-
-From: Ming Lei <ming.lei@redhat.com>
-
-[ Upstream commit b8f6446b6853768cb99e7c201bddce69ca60c15e ]
-
-DMA direction should be taken in dma_unmap_page() for unmapping integrity
-data.
-
-Fix this DMA direction, and reported in Guangwu's test.
-
-Reported-by: Guangwu Zhang <guazhang@redhat.com>
-Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data")
-Signed-off-by: Ming Lei <ming.lei@redhat.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/pci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 26b315c5025ad..bb3813e8474f4 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -965,7 +965,7 @@ static void nvme_pci_complete_rq(struct request *req)
- 	        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
- 
- 		dma_unmap_page(dev->dev, iod->meta_dma,
--			       rq_integrity_vec(req)->bv_len, rq_data_dir(req));
-+			       rq_integrity_vec(req)->bv_len, rq_dma_dir(req));
- 	}
- 
- 	if (blk_rq_nr_phys_segments(req))
--- 
-2.39.2
-
diff --git a/queue-5.15/nvme-pci-remove-nvme_queue-from-nvme_iod.patch b/queue-5.15/nvme-pci-remove-nvme_queue-from-nvme_iod.patch
deleted file mode 100644
index 7fa7777eda9..00000000000
--- a/queue-5.15/nvme-pci-remove-nvme_queue-from-nvme_iod.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From 2949c5431c2aa6a207eb437ab0e8e6a223f79bb9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 6 Sep 2022 09:07:35 -0700
-Subject: nvme-pci: remove nvme_queue from nvme_iod
-
-From: Keith Busch <kbusch@kernel.org>
-
-[ Upstream commit a53232cb3abef51524f06ee9d8fbc3364ad95794 ]
-
-We can get the nvme_queue from the req just as easily, so remove the
-duplicate path to the same structure to save some space.
-
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Stable-dep-of: b8f6446b6853 ("nvme-pci: fix DMA direction of unmapping integrity data")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/pci.c | 28 +++++++++++++---------------
- 1 file changed, 13 insertions(+), 15 deletions(-)
-
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index a646757f76b34..26b315c5025ad 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -224,7 +224,6 @@ struct nvme_queue {
- struct nvme_iod {
- 	struct nvme_request req;
- 	struct nvme_command cmd;
--	struct nvme_queue *nvmeq;
- 	bool use_sgl;
- 	int aborted;
- 	int npages;		/* In the PRP list. 0 means small pool in use */
-@@ -422,11 +421,6 @@ static int nvme_init_request(struct blk_mq_tag_set *set, struct request *req,
- {
- 	struct nvme_dev *dev = set->driver_data;
- 	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
--	int queue_idx = (set == &dev->tagset) ? hctx_idx + 1 : 0;
--	struct nvme_queue *nvmeq = &dev->queues[queue_idx];
--
--	BUG_ON(!nvmeq);
--	iod->nvmeq = nvmeq;
- 
- 	nvme_req(req)->ctrl = &dev->ctrl;
- 	nvme_req(req)->cmd = &iod->cmd;
-@@ -529,7 +523,7 @@ static void **nvme_pci_iod_list(struct request *req)
- 
- static inline bool nvme_pci_use_sgls(struct nvme_dev *dev, struct request *req)
- {
--	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
-+	struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
- 	int nseg = blk_rq_nr_phys_segments(req);
- 	unsigned int avg_seg_size;
- 
-@@ -537,7 +531,7 @@ static inline bool nvme_pci_use_sgls(struct nvme_dev *dev, struct request *req)
- 
- 	if (!nvme_ctrl_sgl_supported(&dev->ctrl))
- 		return false;
--	if (!iod->nvmeq->qid)
-+	if (!nvmeq->qid)
- 		return false;
- 	if (!sgl_threshold || avg_seg_size < sgl_threshold)
- 		return false;
-@@ -846,6 +840,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
- 	int nr_mapped;
- 
- 	if (blk_rq_nr_phys_segments(req) == 1) {
-+		struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
- 		struct bio_vec bv = req_bvec(req);
- 
- 		if (!is_pci_p2pdma_page(bv.bv_page)) {
-@@ -853,7 +848,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
- 				return nvme_setup_prp_simple(dev, req,
- 							     &cmnd->rw, &bv);
- 
--			if (iod->nvmeq->qid && sgl_threshold &&
-+			if (nvmeq->qid && sgl_threshold &&
- 			    nvme_ctrl_sgl_supported(&dev->ctrl))
- 				return nvme_setup_sgl_simple(dev, req,
- 							     &cmnd->rw, &bv);
-@@ -963,12 +958,16 @@ static blk_status_t nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
- 
- static void nvme_pci_complete_rq(struct request *req)
- {
--	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
--	struct nvme_dev *dev = iod->nvmeq->dev;
-+	struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
-+	struct nvme_dev *dev = nvmeq->dev;
-+
-+	if (blk_integrity_rq(req)) {
-+	        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
- 
--	if (blk_integrity_rq(req))
- 		dma_unmap_page(dev->dev, iod->meta_dma,
- 			       rq_integrity_vec(req)->bv_len, rq_data_dir(req));
-+	}
-+
- 	if (blk_rq_nr_phys_segments(req))
- 		nvme_unmap_data(dev, req);
- 	nvme_complete_rq(req);
-@@ -1194,8 +1193,7 @@ static int adapter_delete_sq(struct nvme_dev *dev, u16 sqid)
- 
- static void abort_endio(struct request *req, blk_status_t error)
- {
--	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
--	struct nvme_queue *nvmeq = iod->nvmeq;
-+	struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
- 
- 	dev_warn(nvmeq->dev->ctrl.device,
- 		 "Abort status: 0x%x", nvme_req(req)->status);
-@@ -1249,7 +1247,7 @@ static void nvme_warn_reset(struct nvme_dev *dev, u32 csts)
- static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
- {
- 	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
--	struct nvme_queue *nvmeq = iod->nvmeq;
-+	struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
- 	struct nvme_dev *dev = nvmeq->dev;
- 	struct request *abort_req;
- 	struct nvme_command cmd = { };
--- 
-2.39.2
-
diff --git a/queue-5.15/octeontx2-pf-add-additional-check-for-mcam-rules.patch b/queue-5.15/octeontx2-pf-add-additional-check-for-mcam-rules.patch
deleted file mode 100644
index 1e1828ccee1..00000000000
--- a/queue-5.15/octeontx2-pf-add-additional-check-for-mcam-rules.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From e1868fd98f774cd9994c7d3b52d188104e5ff612 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 16:00:27 +0530
-Subject: octeontx2-pf: Add additional check for MCAM rules
-
-From: Suman Ghosh <sumang@marvell.com>
-
-[ Upstream commit 8278ee2a2646b9acf747317895e47a640ba933c9 ]
-
-Due to hardware limitation, MCAM drop rule with
-ether_type == 802.1Q and vlan_id == 0 is not supported. Hence rejecting
-such rules.
-
-Fixes: dce677da57c0 ("octeontx2-pf: Add vlan-etype to ntuple filters")
-Signed-off-by: Suman Ghosh <sumang@marvell.com>
-Link: https://lore.kernel.org/r/20230710103027.2244139-1-sumang@marvell.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/nic/otx2_flows.c   |  8 ++++++++
- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c  | 15 +++++++++++++++
- 2 files changed, 23 insertions(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-index 63889449b8f61..483f660cebc40 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-@@ -827,6 +827,14 @@ static int otx2_prepare_flow_request(struct ethtool_rx_flow_spec *fsp,
- 				return -EINVAL;
- 
- 			vlan_etype = be16_to_cpu(fsp->h_ext.vlan_etype);
-+
-+			/* Drop rule with vlan_etype == 802.1Q
-+			 * and vlan_id == 0 is not supported
-+			 */
-+			if (vlan_etype == ETH_P_8021Q && !fsp->m_ext.vlan_tci &&
-+			    fsp->ring_cookie == RX_CLS_FLOW_DISC)
-+				return -EINVAL;
-+
- 			/* Only ETH_P_8021Q and ETH_P_802AD types supported */
- 			if (vlan_etype != ETH_P_8021Q &&
- 			    vlan_etype != ETH_P_8021AD)
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-index a42373e6f2593..26231c59b0241 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-@@ -536,6 +536,21 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,
- 			return -EOPNOTSUPP;
- 		}
- 
-+		if (!match.mask->vlan_id) {
-+			struct flow_action_entry *act;
-+			int i;
-+
-+			flow_action_for_each(i, act, &rule->action) {
-+				if (act->id == FLOW_ACTION_DROP) {
-+					netdev_err(nic->netdev,
-+						   "vlan tpid 0x%x with vlan_id %d is not supported for DROP rule.\n",
-+						   ntohs(match.key->vlan_tpid),
-+						   match.key->vlan_id);
-+					return -EOPNOTSUPP;
-+				}
-+			}
-+		}
-+
- 		if (match.mask->vlan_id ||
- 		    match.mask->vlan_dei ||
- 		    match.mask->vlan_priority) {
--- 
-2.39.2
-
diff --git a/queue-5.15/platform-x86-wmi-break-possible-infinite-loop-when-p.patch b/queue-5.15/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
deleted file mode 100644
index 06452ada256..00000000000
--- a/queue-5.15/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From b699e076bfd54e82c238f8758903584e83f2c020 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 18:11:54 +0300
-Subject: platform/x86: wmi: Break possible infinite loop when parsing GUID
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
-
-The while-loop may break on one of the two conditions, either ID string
-is empty or GUID matches. The second one, may never be reached if the
-parsed string is not correct GUID. In such a case the loop will never
-advance to check the next ID.
-
-Break possible infinite loop by factoring out guid_parse_and_compare()
-helper which may be moved to the generic header for everyone later on
-and preventing from similar mistake in the future.
-
-Interestingly that firstly it appeared when WMI was turned into a bus
-driver, but later when duplicated GUIDs were checked, the while-loop
-has been replaced by for-loop and hence no mistake made again.
-
-Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
-Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com
-Tested-by: Armin Wolf <W_Armin@gmx.de>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 22 ++++++++++++----------
- 1 file changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 6a51220c37a2b..7ce0408d3bfdd 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -133,6 +133,16 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	return false;
- }
- 
-+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
-+{
-+	guid_t guid_input;
-+
-+	if (guid_parse(string, &guid_input))
-+		return false;
-+
-+	return guid_equal(&guid_input, guid);
-+}
-+
- static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
-@@ -145,11 +155,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
--		guid_t guid_input;
--
--		if (guid_parse(id->guid_string, &guid_input))
--			continue;
--		if (guid_equal(&wblock->gblock.guid, &guid_input))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return id->context;
- 		id++;
- 	}
-@@ -811,11 +817,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		guid_t driver_guid;
--
--		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
--			continue;
--		if (guid_equal(&driver_guid, &wblock->gblock.guid))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
--- 
-2.39.2
-
diff --git a/queue-5.15/platform-x86-wmi-move-variables.patch b/queue-5.15/platform-x86-wmi-move-variables.patch
deleted file mode 100644
index 15e0b0f2d29..00000000000
--- a/queue-5.15/platform-x86-wmi-move-variables.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From bb3aa58a0937fa07d34d0a2acf165bbed5b50555 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:56:10 +0000
-Subject: platform/x86: wmi: move variables
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit f5431bf1e6781e876bdc8ae10fb1e7da6f1aa9b5 ]
-
-Move some variables in order to keep them
-in the narrowest possible scope.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-22-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index d55770711a831..6a51220c37a2b 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -137,7 +137,6 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
- 	const struct wmi_device_id *id;
--	guid_t guid_input;
- 
- 	if (wblock == NULL || wdriver == NULL)
- 		return NULL;
-@@ -146,6 +145,8 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
-+		guid_t guid_input;
-+
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
- 		if (guid_equal(&wblock->gblock.guid, &guid_input))
-@@ -618,7 +619,6 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- {
- 	struct acpi_object_list input;
- 	union acpi_object params[1];
--	struct guid_block *gblock;
- 	struct wmi_block *wblock;
- 
- 	input.count = 1;
-@@ -627,7 +627,7 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- 	params[0].integer.value = event;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		gblock = &wblock->gblock;
-+		struct guid_block *gblock = &wblock->gblock;
- 
- 		if ((gblock->flags & ACPI_WMI_EVENT) &&
- 			(gblock->notify_id == event))
-@@ -1282,12 +1282,11 @@ acpi_wmi_ec_space_handler(u32 function, acpi_physical_address address,
- static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 				    void *context)
- {
--	struct guid_block *block;
- 	struct wmi_block *wblock;
- 	bool found_it = false;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		block = &wblock->gblock;
-+		struct guid_block *block = &wblock->gblock;
- 
- 		if (wblock->acpi_device->handle == handle &&
- 		    (block->flags & ACPI_WMI_EVENT) &&
--- 
-2.39.2
-
diff --git a/queue-5.15/platform-x86-wmi-remove-unnecessary-argument.patch b/queue-5.15/platform-x86-wmi-remove-unnecessary-argument.patch
deleted file mode 100644
index 93ed25dcbfe..00000000000
--- a/queue-5.15/platform-x86-wmi-remove-unnecessary-argument.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From b39874d4130dbd333f1f8d07508a1de2694a475c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:16 +0000
-Subject: platform/x86: wmi: remove unnecessary argument
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 84eacf7e6413d5e2d2f4f9dddf9216c18a3631cf ]
-
-The GUID block is available for `wmi_create_device()`
-through `wblock->gblock`. Use that consistently in
-the function instead of using a mix of `gblock` and
-`wblock->gblock`.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-8-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index c4f917d45b51d..529f725271e99 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -1046,7 +1046,6 @@ static const struct device_type wmi_type_data = {
- };
- 
- static int wmi_create_device(struct device *wmi_bus_dev,
--			     const struct guid_block *gblock,
- 			     struct wmi_block *wblock,
- 			     struct acpi_device *device)
- {
-@@ -1054,12 +1053,12 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	char method[5];
- 	int result;
- 
--	if (gblock->flags & ACPI_WMI_EVENT) {
-+	if (wblock->gblock.flags & ACPI_WMI_EVENT) {
- 		wblock->dev.dev.type = &wmi_type_event;
- 		goto out_init;
- 	}
- 
--	if (gblock->flags & ACPI_WMI_METHOD) {
-+	if (wblock->gblock.flags & ACPI_WMI_METHOD) {
- 		wblock->dev.dev.type = &wmi_type_method;
- 		mutex_init(&wblock->char_mutex);
- 		goto out_init;
-@@ -1109,7 +1108,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", gblock->guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1201,7 +1200,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		wblock->acpi_device = device;
- 		wblock->gblock = gblock[i];
- 
--		retval = wmi_create_device(wmi_bus_dev, &gblock[i], wblock, device);
-+		retval = wmi_create_device(wmi_bus_dev, wblock, device);
- 		if (retval) {
- 			kfree(wblock);
- 			continue;
--- 
-2.39.2
-
diff --git a/queue-5.15/platform-x86-wmi-use-guid_t-and-guid_equal.patch b/queue-5.15/platform-x86-wmi-use-guid_t-and-guid_equal.patch
deleted file mode 100644
index 9767aac42bf..00000000000
--- a/queue-5.15/platform-x86-wmi-use-guid_t-and-guid_equal.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From bf3bf85fd547854a57a1b4a114bf75bfe407d556 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:39 +0000
-Subject: platform/x86: wmi: use guid_t and guid_equal()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 67f472fdacf4a691b1c3c20c27800b23ce31e2de ]
-
-Instead of hard-coding a 16 long byte array,
-use the available `guid_t` type and related methods.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-15-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 529f725271e99..d55770711a831 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -39,7 +39,7 @@ MODULE_LICENSE("GPL");
- static LIST_HEAD(wmi_block_list);
- 
- struct guid_block {
--	char guid[16];
-+	guid_t guid;
- 	union {
- 		char object_id[2];
- 		struct {
-@@ -124,7 +124,7 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
- 		block = &wblock->gblock;
- 
--		if (memcmp(block->guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->guid, &guid_input)) {
- 			if (out)
- 				*out = wblock;
- 			return true;
-@@ -148,7 +148,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 	while (*id->guid_string) {
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
--		if (!memcmp(wblock->gblock.guid, &guid_input, 16))
-+		if (guid_equal(&wblock->gblock.guid, &guid_input))
- 			return id->context;
- 		id++;
- 	}
-@@ -460,7 +460,7 @@ EXPORT_SYMBOL_GPL(wmi_set_block);
- 
- static void wmi_dump_wdg(const struct guid_block *g)
- {
--	pr_info("%pUL:\n", g->guid);
-+	pr_info("%pUL:\n", &g->guid);
- 	if (g->flags & ACPI_WMI_EVENT)
- 		pr_info("\tnotify_id: 0x%02X\n", g->notify_id);
- 	else
-@@ -542,7 +542,7 @@ wmi_notify_handler handler, void *data)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (block->handler &&
- 			    block->handler != wmi_notify_debug)
- 				return AE_ALREADY_ACQUIRED;
-@@ -582,7 +582,7 @@ acpi_status wmi_remove_notify_handler(const char *guid)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (!block->handler ||
- 			    block->handler == wmi_notify_debug)
- 				return AE_NULL_ENTRY;
-@@ -693,7 +693,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "wmi:%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "wmi:%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(modalias);
- 
-@@ -702,7 +702,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(guid);
- 
-@@ -785,10 +785,10 @@ static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
--	if (add_uevent_var(env, "WMI_GUID=%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "WMI_GUID=%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
- 	return 0;
-@@ -815,7 +815,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 
- 		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
- 			continue;
--		if (!memcmp(&driver_guid, wblock->gblock.guid, 16))
-+		if (guid_equal(&driver_guid, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
-@@ -1108,7 +1108,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1128,12 +1128,12 @@ static void wmi_free_devices(struct acpi_device *device)
- 	}
- }
- 
--static bool guid_already_parsed(struct acpi_device *device, const u8 *guid)
-+static bool guid_already_parsed(struct acpi_device *device, const guid_t *guid)
- {
- 	struct wmi_block *wblock;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		if (memcmp(wblock->gblock.guid, guid, 16) == 0) {
-+		if (guid_equal(&wblock->gblock.guid, guid)) {
- 			/*
- 			 * Because we historically didn't track the relationship
- 			 * between GUIDs and ACPI nodes, we don't know whether
-@@ -1188,7 +1188,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		 * case yet, so for now, we'll just ignore the duplicate
- 		 * for device creation.
- 		 */
--		if (guid_already_parsed(device, gblock[i].guid))
-+		if (guid_already_parsed(device, &gblock[i].guid))
- 			continue;
- 
- 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
-@@ -1225,7 +1225,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		retval = device_add(&wblock->dev.dev);
- 		if (retval) {
- 			dev_err(wmi_bus_dev, "failed to register %pUL\n",
--				wblock->gblock.guid);
-+				&wblock->gblock.guid);
- 			if (debug_event)
- 				wmi_method_enable(wblock, 0);
- 			list_del(&wblock->list);
-@@ -1333,7 +1333,7 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 	}
- 
- 	if (debug_event)
--		pr_info("DEBUG Event GUID: %pUL\n", wblock->gblock.guid);
-+		pr_info("DEBUG Event GUID: %pUL\n", &wblock->gblock.guid);
- 
- 	acpi_bus_generate_netlink_event(
- 		wblock->acpi_device->pnp.device_class,
--- 
-2.39.2
-
diff --git a/queue-5.15/riscv-bpf-fix-inconsistent-jit-image-generation.patch b/queue-5.15/riscv-bpf-fix-inconsistent-jit-image-generation.patch
deleted file mode 100644
index bfc522d6093..00000000000
--- a/queue-5.15/riscv-bpf-fix-inconsistent-jit-image-generation.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 5bf82cf91133bef91c06c0975ea8b26b24e3a36c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:41:31 +0200
-Subject: riscv, bpf: Fix inconsistent JIT image generation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Björn Töpel <bjorn@rivosinc.com>
-
-[ Upstream commit c56fb2aab23505bb7160d06097c8de100b82b851 ]
-
-In order to generate the prologue and epilogue, the BPF JIT needs to
-know which registers that are clobbered. Therefore, the during
-pre-final passes, the prologue is generated after the body of the
-program body-prologue-epilogue. Then, in the final pass, a proper
-prologue-body-epilogue JITted image is generated.
-
-This scheme has worked most of the time. However, for some large
-programs with many jumps, e.g. the test_kmod.sh BPF selftest with
-hardening enabled (blinding constants), this has shown to be
-incorrect. For the final pass, when the proper prologue-body-epilogue
-is generated, the image has not converged. This will lead to that the
-final image will have incorrect jump offsets. The following is an
-excerpt from an incorrect image:
-
-  | ...
-  |     3b8:       00c50663                beq     a0,a2,3c4 <.text+0x3c4>
-  |     3bc:       0020e317                auipc   t1,0x20e
-  |     3c0:       49630067                jalr    zero,1174(t1) # 20e852 <.text+0x20e852>
-  | ...
-  |  20e84c:       8796                    c.mv    a5,t0
-  |  20e84e:       6422                    c.ldsp  s0,8(sp)    # Epilogue start
-  |  20e850:       6141                    c.addi16sp      sp,16
-  |  20e852:       853e                    c.mv    a0,a5       # Incorrect jump target
-  |  20e854:       8082                    c.jr    ra
-
-The image has shrunk, and the epilogue offset is incorrect in the
-final pass.
-
-Correct the problem by always generating proper prologue-body-epilogue
-outputs, which means that the first pass will only generate the body
-to track what registers that are touched.
-
-Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
-Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20230710074131.19596-1-bjorn@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      |  6 +++---
- arch/riscv/net/bpf_jit_core.c | 19 +++++++++++++------
- 2 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index ab0cd6d10ccf3..ef336fe160044 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,7 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
--	int body_len;
-+	int prologue_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	unsigned long flags;
-@@ -215,8 +215,8 @@ static inline int rv_offset(int insn, int off, struct rv_jit_context *ctx)
- 	int from, to;
- 
- 	off++; /* BPF branch is from PC+1, RV is from PC */
--	from = (insn > 0) ? ctx->offset[insn - 1] : 0;
--	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : 0;
-+	from = (insn > 0) ? ctx->offset[insn - 1] : ctx->prologue_len;
-+	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : ctx->prologue_len;
- 	return ninsns_rvoff(to - from);
- }
- 
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index ff644452b88db..b95c60f663d44 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -43,7 +43,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- {
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, prologue_len, i;
-+	int pass = 0, prev_ninsns = 0, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 	unsigned int image_size = 0;
-@@ -83,6 +83,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 		prog = orig_prog;
- 		goto out_offset;
- 	}
-+
-+	if (build_body(ctx, extra_pass, NULL)) {
-+		prog = orig_prog;
-+		goto out_offset;
-+	}
-+
- 	for (i = 0; i < prog->len; i++) {
- 		prev_ninsns += 32;
- 		ctx->offset[i] = prev_ninsns;
-@@ -91,12 +97,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
- 		pass++;
- 		ctx->ninsns = 0;
-+
-+		bpf_jit_build_prologue(ctx);
-+		ctx->prologue_len = ctx->ninsns;
-+
- 		if (build_body(ctx, extra_pass, ctx->offset)) {
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
--		ctx->body_len = ctx->ninsns;
--		bpf_jit_build_prologue(ctx);
-+
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
- 
-@@ -155,10 +164,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
--		prologue_len = ctx->epilogue_offset - ctx->body_len;
- 		for (i = 0; i < prog->len; i++)
--			ctx->offset[i] = ninsns_rvoff(prologue_len +
--						      ctx->offset[i]);
-+			ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- 		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
--- 
-2.39.2
-
diff --git a/queue-5.15/riscv-mm-fix-truncation-warning-on-rv32.patch b/queue-5.15/riscv-mm-fix-truncation-warning-on-rv32.patch
deleted file mode 100644
index df2014e99b3..00000000000
--- a/queue-5.15/riscv-mm-fix-truncation-warning-on-rv32.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 62b852f87a381fad15c88d1537b4ce16b42d9a24 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 01:10:36 +0800
-Subject: riscv: mm: fix truncation warning on RV32
-
-From: Jisheng Zhang <jszhang@kernel.org>
-
-[ Upstream commit b690e266dae2f85f4dfea21fa6a05e3500a51054 ]
-
-lkp reports below sparse warning when building for RV32:
-arch/riscv/mm/init.c:1204:48: sparse: warning: cast truncates bits from
-constant value (100000000 becomes 0)
-
-IMO, the reason we didn't see this truncates bug in real world is "0"
-means MEMBLOCK_ALLOC_ACCESSIBLE in memblock and there's no RV32 HW
-with more than 4GB memory.
-
-Fix it anyway to make sparse happy.
-
-Fixes: decf89f86ecd ("riscv: try to allocate crashkern region from 32bit addressible memory")
-Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202306080034.SLiCiOMn-lkp@intel.com/
-Link: https://lore.kernel.org/r/20230709171036.1906-1-jszhang@kernel.org
-Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/mm/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
-index f8bfbe983517c..d7115acab3501 100644
---- a/arch/riscv/mm/init.c
-+++ b/arch/riscv/mm/init.c
-@@ -843,7 +843,7 @@ static void __init reserve_crashkernel(void)
- 	 */
- 	crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
- 					       search_start,
--					       min(search_end, (unsigned long) SZ_4G));
-+					       min(search_end, (unsigned long)(SZ_4G - 1)));
- 	if (crash_base == 0) {
- 		/* Try again without restricting region to 32bit addressible memory */
- 		crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
--- 
-2.39.2
-
diff --git a/queue-5.15/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch b/queue-5.15/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
deleted file mode 100644
index 74b38548ab1..00000000000
--- a/queue-5.15/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 8c2f4754fc535e4c50b9dccff123bc772f37ef9f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 13:58:47 +0300
-Subject: scsi: qla2xxx: Fix error code in qla2x00_start_sp()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 ]
-
-This should be negative -EAGAIN instead of positive.  The callers treat
-non-zero error codes the same so it doesn't really impact runtime beyond
-some trivial differences to debug output.
-
-Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
-index 4f48f098ea5a6..605e94f973189 100644
---- a/drivers/scsi/qla2xxx/qla_iocb.c
-+++ b/drivers/scsi/qla2xxx/qla_iocb.c
-@@ -3898,7 +3898,7 @@ qla2x00_start_sp(srb_t *sp)
- 
- 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
- 	if (!pkt) {
--		rval = EAGAIN;
-+		rval = -EAGAIN;
- 		ql_log(ql_log_warn, vha, 0x700c,
- 		    "qla2x00_alloc_iocbs failed.\n");
- 		goto done;
--- 
-2.39.2
-
diff --git a/queue-5.15/series b/queue-5.15/series
index 264fc551c3c..1d74f7b79ca 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -387,52 +387,3 @@ netfilter-nf_tables-prevent-oob-access-in-nft_byteorder_eval.patch
 wireguard-queueing-use-saner-cpu-selection-wrapping.patch
 wireguard-netlink-send-staged-packets-when-setting-initial-private-key.patch
 tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platform.patch
-drm-panel-simple-add-connector_type-for-innolux_at04.patch
-drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
-drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
-igc-remove-delay-during-tx-ring-configuration.patch
-net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
-net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
-net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
-igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
-igc-handle-pps-start-time-programming-for-past-time-.patch
-scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
-bpf-fix-max-stack-depth-check-for-async-callbacks.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
-gve-set-default-duplex-configuration-to-full.patch
-ionic-remove-warn_on-to-prevent-panic_on_warn.patch
-net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
-net-prevent-skb-corruption-on-frag-list-segmentation.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-platform-x86-wmi-remove-unnecessary-argument.patch
-platform-x86-wmi-use-guid_t-and-guid_equal.patch
-platform-x86-wmi-move-variables.patch
-platform-x86-wmi-break-possible-infinite-loop-when-p.patch
-kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
-igc-fix-launchtime-before-start-of-cycle.patch
-igc-fix-inserting-of-empty-frame-for-launchtime.patch
-bpf-riscv-support-riscv-jit-to-provide-bpf_line_info.patch
-riscv-bpf-fix-inconsistent-jit-image-generation.patch
-drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
-octeontx2-pf-add-additional-check-for-mcam-rules.patch
-erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
-erofs-decouple-basic-mount-options-from-fs_context.patch
-erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
-net-sched-flower-ensure-both-minimum-and-maximum-por.patch
-riscv-mm-fix-truncation-warning-on-rv32.patch
-netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
-net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
-net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
-nvme-pci-remove-nvme_queue-from-nvme_iod.patch
-nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
diff --git a/queue-5.15/udp6-fix-udp6_ehashfn-typo.patch b/queue-5.15/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index e21104b8f1e..00000000000
--- a/queue-5.15/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From f63bff8bc395960a5e6d9545ab4f26638784ff93 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 5161e98f6fcfd..a746abbe81b5f 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -88,7 +88,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-5.15/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-5.15/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index edf567eb512..00000000000
--- a/queue-5.15/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From f6e504ab4ef0b23e302e77eabce8b8a229925637 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index fc19ecbc4c088..bcbf197fa9372 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6147,8 +6147,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-5.4/cls_flower-add-extack-support-for-src-and-dst-port-r.patch b/queue-5.4/cls_flower-add-extack-support-for-src-and-dst-port-r.patch
deleted file mode 100644
index a55d61f927b..00000000000
--- a/queue-5.4/cls_flower-add-extack-support-for-src-and-dst-port-r.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From baa5899647027ec01ba907ae23c434d7daca9cb8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2020 21:48:51 +0100
-Subject: cls_flower: Add extack support for src and dst port range options
-
-From: Guillaume Nault <gnault@redhat.com>
-
-[ Upstream commit bd7d4c12819b60b161939bc2f43053955d24d0df ]
-
-Pass extack down to fl_set_key_port_range() and set message on error.
-
-Both the min and max ports would qualify as invalid attributes here.
-Report the min one as invalid, as it's probably what makes the most
-sense from a user point of view.
-
-Signed-off-by: Guillaume Nault <gnault@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: d3f87278bcb8 ("net/sched: flower: Ensure both minimum and maximum ports are specified")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 26 ++++++++++++++++++--------
- 1 file changed, 18 insertions(+), 8 deletions(-)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index f21c97f02d361..f0010e4850eb6 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -719,7 +719,8 @@ static void fl_set_key_val(struct nlattr **tb,
- }
- 
- static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
--				 struct fl_flow_key *mask)
-+				 struct fl_flow_key *mask,
-+				 struct netlink_ext_ack *extack)
- {
- 	fl_set_key_val(tb, &key->tp_range.tp_min.dst,
- 		       TCA_FLOWER_KEY_PORT_DST_MIN, &mask->tp_range.tp_min.dst,
-@@ -734,13 +735,22 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
--	if ((mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
--	     htons(key->tp_range.tp_max.dst) <=
--		 htons(key->tp_range.tp_min.dst)) ||
--	    (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src &&
--	     htons(key->tp_range.tp_max.src) <=
--		 htons(key->tp_range.tp_min.src)))
-+	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
-+	    htons(key->tp_range.tp_max.dst) <=
-+	    htons(key->tp_range.tp_min.dst)) {
-+		NL_SET_ERR_MSG_ATTR(extack,
-+				    tb[TCA_FLOWER_KEY_PORT_DST_MIN],
-+				    "Invalid destination port range (min must be strictly smaller than max)");
- 		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src &&
-+	    htons(key->tp_range.tp_max.src) <=
-+	    htons(key->tp_range.tp_min.src)) {
-+		NL_SET_ERR_MSG_ATTR(extack,
-+				    tb[TCA_FLOWER_KEY_PORT_SRC_MIN],
-+				    "Invalid source port range (min must be strictly smaller than max)");
-+		return -EINVAL;
-+	}
- 
- 	return 0;
- }
-@@ -1211,7 +1221,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
- 	if (key->basic.ip_proto == IPPROTO_TCP ||
- 	    key->basic.ip_proto == IPPROTO_UDP ||
- 	    key->basic.ip_proto == IPPROTO_SCTP) {
--		ret = fl_set_key_port_range(tb, key, mask);
-+		ret = fl_set_key_port_range(tb, key, mask, extack);
- 		if (ret)
- 			return ret;
- 	}
--- 
-2.39.2
-
diff --git a/queue-5.4/drm-panel-add-and-fill-drm_panel-type-field.patch b/queue-5.4/drm-panel-add-and-fill-drm_panel-type-field.patch
deleted file mode 100644
index 09cac7cd32f..00000000000
--- a/queue-5.4/drm-panel-add-and-fill-drm_panel-type-field.patch
+++ /dev/null
@@ -1,854 +0,0 @@
-From d0adebec16ee01a75fe118ee44ae27ed4ee7d584 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 4 Sep 2019 16:28:03 +0300
-Subject: drm/panel: Add and fill drm_panel type field
-
-From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-
-[ Upstream commit 9a2654c0f62a1704f36acb6329f9ccbd539f75ad ]
-
-Add a type field to the drm_panel structure to report the panel type,
-using DRM_MODE_CONNECTOR_* macros (the values that make sense are LVDS,
-eDP, DSI and DPI). This will be used to initialise the corresponding
-connector type.
-
-Update all panel drivers accordingly. The panel-simple driver only
-specifies the type for the known to be LVDS panels, while all other
-panels are left as unknown and will be converted on a case-by-case
-basis as they all need to be carefully reviewed.
-
-Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
-Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20190904132804.29680-2-laurent.pinchart@ideasonboard.com
-Stable-dep-of: 2c56a751845d ("drm/panel: simple: Add connector_type for innolux_at043tn24")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/drm_panel.c                   |  5 +++-
- drivers/gpu/drm/panel/panel-arm-versatile.c   |  3 ++-
- .../drm/panel/panel-feiyang-fy07024di26a30d.c |  3 ++-
- drivers/gpu/drm/panel/panel-ilitek-ili9322.c  |  3 ++-
- drivers/gpu/drm/panel/panel-ilitek-ili9881c.c |  3 ++-
- drivers/gpu/drm/panel/panel-innolux-p079zca.c |  3 ++-
- .../gpu/drm/panel/panel-jdi-lt070me05000.c    |  3 ++-
- .../drm/panel/panel-kingdisplay-kd097d04.c    |  2 +-
- drivers/gpu/drm/panel/panel-lg-lb035q02.c     |  3 ++-
- drivers/gpu/drm/panel/panel-lg-lg4573.c       |  3 ++-
- drivers/gpu/drm/panel/panel-lvds.c            |  3 ++-
- drivers/gpu/drm/panel/panel-nec-nl8048hl11.c  |  3 ++-
- drivers/gpu/drm/panel/panel-novatek-nt39016.c |  3 ++-
- .../drm/panel/panel-olimex-lcd-olinuxino.c    |  3 ++-
- .../gpu/drm/panel/panel-orisetech-otm8009a.c  |  3 ++-
- .../drm/panel/panel-osd-osd101t2587-53ts.c    |  2 +-
- .../drm/panel/panel-panasonic-vvx10f034n00.c  |  2 +-
- .../drm/panel/panel-raspberrypi-touchscreen.c |  3 ++-
- drivers/gpu/drm/panel/panel-raydium-rm67191.c |  3 ++-
- drivers/gpu/drm/panel/panel-raydium-rm68200.c |  3 ++-
- .../drm/panel/panel-rocktech-jh057n00900.c    |  3 ++-
- drivers/gpu/drm/panel/panel-ronbo-rb070d30.c  |  3 ++-
- drivers/gpu/drm/panel/panel-samsung-ld9040.c  |  3 ++-
- drivers/gpu/drm/panel/panel-samsung-s6d16d0.c |  3 ++-
- drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c |  3 ++-
- .../gpu/drm/panel/panel-samsung-s6e63j0x03.c  |  3 ++-
- drivers/gpu/drm/panel/panel-samsung-s6e63m0.c |  3 ++-
- drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c |  3 ++-
- drivers/gpu/drm/panel/panel-seiko-43wvf1g.c   |  3 ++-
- .../gpu/drm/panel/panel-sharp-lq101r1sx01.c   |  3 ++-
- .../gpu/drm/panel/panel-sharp-ls037v7dw01.c   |  3 ++-
- .../gpu/drm/panel/panel-sharp-ls043t1le01.c   |  2 +-
- drivers/gpu/drm/panel/panel-simple.c          | 26 ++++++++++++++++++-
- drivers/gpu/drm/panel/panel-sitronix-st7701.c |  3 ++-
- .../gpu/drm/panel/panel-sitronix-st7789v.c    |  3 ++-
- drivers/gpu/drm/panel/panel-sony-acx565akm.c  |  3 ++-
- drivers/gpu/drm/panel/panel-tpo-td028ttec1.c  |  3 ++-
- drivers/gpu/drm/panel/panel-tpo-td043mtea1.c  |  3 ++-
- drivers/gpu/drm/panel/panel-tpo-tpg110.c      |  3 ++-
- drivers/gpu/drm/panel/panel-truly-nt35597.c   |  3 ++-
- include/drm/drm_panel.h                       | 12 ++++++++-
- 41 files changed, 112 insertions(+), 41 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
-index ba2fad4c96489..ed7985c0535a2 100644
---- a/drivers/gpu/drm/drm_panel.c
-+++ b/drivers/gpu/drm/drm_panel.c
-@@ -46,16 +46,19 @@ static LIST_HEAD(panel_list);
-  * @panel: DRM panel
-  * @dev: parent device of the panel
-  * @funcs: panel operations
-+ * @connector_type: the connector type (DRM_MODE_CONNECTOR_*) corresponding to
-+ *	the panel interface
-  *
-  * Initialize the panel structure for subsequent registration with
-  * drm_panel_add().
-  */
- void drm_panel_init(struct drm_panel *panel, struct device *dev,
--		    const struct drm_panel_funcs *funcs)
-+		    const struct drm_panel_funcs *funcs, int connector_type)
- {
- 	INIT_LIST_HEAD(&panel->list);
- 	panel->dev = dev;
- 	panel->funcs = funcs;
-+	panel->connector_type = connector_type;
- }
- EXPORT_SYMBOL(drm_panel_init);
- 
-diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c
-index a4333ed0f20ca..a0574dc03e16f 100644
---- a/drivers/gpu/drm/panel/panel-arm-versatile.c
-+++ b/drivers/gpu/drm/panel/panel-arm-versatile.c
-@@ -350,7 +350,8 @@ static int versatile_panel_probe(struct platform_device *pdev)
- 			dev_info(dev, "panel mounted on IB2 daughterboard\n");
- 	}
- 
--	drm_panel_init(&vpanel->panel, dev, &versatile_panel_drm_funcs);
-+	drm_panel_init(&vpanel->panel, dev, &versatile_panel_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&vpanel->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-index 7d5d7455bc01f..98f184b811873 100644
---- a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-+++ b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-@@ -204,7 +204,8 @@ static int feiyang_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel, &dsi->dev, &feiyang_funcs);
-+	drm_panel_init(&ctx->panel, &dsi->dev, &feiyang_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ctx->dvdd = devm_regulator_get(&dsi->dev, "dvdd");
- 	if (IS_ERR(ctx->dvdd)) {
-diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-index ad2405baa0ac5..24955bec1958b 100644
---- a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-@@ -895,7 +895,8 @@ static int ili9322_probe(struct spi_device *spi)
- 		ili->input = ili->conf->input;
- 	}
- 
--	drm_panel_init(&ili->panel, dev, &ili9322_drm_funcs);
-+	drm_panel_init(&ili->panel, dev, &ili9322_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&ili->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-index 1d714f961c009..e8789e460a169 100644
---- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-@@ -433,7 +433,8 @@ static int ili9881c_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs);
-+	drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ctx->power = devm_regulator_get(&dsi->dev, "power");
- 	if (IS_ERR(ctx->power)) {
-diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-index 8f3647804a1e4..327fca97977ee 100644
---- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-@@ -487,7 +487,8 @@ static int innolux_panel_add(struct mipi_dsi_device *dsi,
- 	if (IS_ERR(innolux->backlight))
- 		return PTR_ERR(innolux->backlight);
- 
--	drm_panel_init(&innolux->base, dev, &innolux_panel_funcs);
-+	drm_panel_init(&innolux->base, dev, &innolux_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	err = drm_panel_add(&innolux->base);
- 	if (err < 0)
-diff --git a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-index 7bfdbfbc868ed..56364a93f0b81 100644
---- a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-+++ b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-@@ -437,7 +437,8 @@ static int jdi_panel_add(struct jdi_panel *jdi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&jdi->base, &jdi->dsi->dev, &jdi_panel_funcs);
-+	drm_panel_init(&jdi->base, &jdi->dsi->dev, &jdi_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ret = drm_panel_add(&jdi->base);
- 
-diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-index bb131749a0b92..2c576e7eee72f 100644
---- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-@@ -392,7 +392,7 @@ static int kingdisplay_panel_add(struct kingdisplay_panel *kingdisplay)
- 		return PTR_ERR(kingdisplay->backlight);
- 
- 	drm_panel_init(&kingdisplay->base, &kingdisplay->link->dev,
--		       &kingdisplay_panel_funcs);
-+		       &kingdisplay_panel_funcs, DRM_MODE_CONNECTOR_DSI);
- 
- 	return drm_panel_add(&kingdisplay->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lg-lb035q02.c b/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-index c7b9b47849bb8..7a1385e834f0e 100644
---- a/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-+++ b/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-@@ -196,7 +196,8 @@ static int lb035q02_probe(struct spi_device *spi)
- 	if (ret < 0)
- 		return ret;
- 
--	drm_panel_init(&lcd->panel, &lcd->spi->dev, &lb035q02_funcs);
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &lb035q02_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lg-lg4573.c b/drivers/gpu/drm/panel/panel-lg-lg4573.c
-index 608f2de91662d..db4865a4c2b98 100644
---- a/drivers/gpu/drm/panel/panel-lg-lg4573.c
-+++ b/drivers/gpu/drm/panel/panel-lg-lg4573.c
-@@ -259,7 +259,8 @@ static int lg4573_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel, &spi->dev, &lg4573_drm_funcs);
-+	drm_panel_init(&ctx->panel, &spi->dev, &lg4573_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&ctx->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
-index ff1e305d56a02..2405f26e5d31f 100644
---- a/drivers/gpu/drm/panel/panel-lvds.c
-+++ b/drivers/gpu/drm/panel/panel-lvds.c
-@@ -254,7 +254,8 @@ static int panel_lvds_probe(struct platform_device *pdev)
- 	 */
- 
- 	/* Register the panel. */
--	drm_panel_init(&lvds->panel, lvds->dev, &panel_lvds_funcs);
-+	drm_panel_init(&lvds->panel, lvds->dev, &panel_lvds_funcs,
-+		       DRM_MODE_CONNECTOR_LVDS);
- 
- 	ret = drm_panel_add(&lvds->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-index 272a1434e1558..fd593532ab23c 100644
---- a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-+++ b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-@@ -205,7 +205,8 @@ static int nl8048_probe(struct spi_device *spi)
- 	if (ret < 0)
- 		return ret;
- 
--	drm_panel_init(&lcd->panel, &lcd->spi->dev, &nl8048_funcs);
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &nl8048_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-novatek-nt39016.c b/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-index 64cfe111aaadb..60ccedce530c2 100644
---- a/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-+++ b/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-@@ -292,7 +292,8 @@ static int nt39016_probe(struct spi_device *spi)
- 		return err;
- 	}
- 
--	drm_panel_init(&panel->drm_panel, dev, &nt39016_funcs);
-+	drm_panel_init(&panel->drm_panel, dev, &nt39016_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	err = drm_panel_add(&panel->drm_panel);
- 	if (err < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-index f2d6a4ec00467..f2a72ee6ee07d 100644
---- a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-+++ b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-@@ -288,7 +288,8 @@ static int lcd_olinuxino_probe(struct i2c_client *client,
- 	if (IS_ERR(lcd->backlight))
- 		return PTR_ERR(lcd->backlight);
- 
--	drm_panel_init(&lcd->panel, dev, &lcd_olinuxino_funcs);
-+	drm_panel_init(&lcd->panel, dev, &lcd_olinuxino_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-index 5aacd632c6f69..938826f326658 100644
---- a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-+++ b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-@@ -455,7 +455,8 @@ static int otm8009a_probe(struct mipi_dsi_device *dsi)
- 	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
- 			  MIPI_DSI_MODE_LPM;
- 
--	drm_panel_init(&ctx->panel, dev, &otm8009a_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &otm8009a_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ctx->bl_dev = devm_backlight_device_register(dev, dev_name(dev),
- 						     dev, ctx,
-diff --git a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-index 38f114b03b897..2b40913899d88 100644
---- a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-+++ b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-@@ -167,7 +167,7 @@ static int osd101t2587_panel_add(struct osd101t2587_panel *osd101t2587)
- 		return PTR_ERR(osd101t2587->backlight);
- 
- 	drm_panel_init(&osd101t2587->base, &osd101t2587->dsi->dev,
--		       &osd101t2587_panel_funcs);
-+		       &osd101t2587_panel_funcs, DRM_MODE_CONNECTOR_DSI);
- 
- 	return drm_panel_add(&osd101t2587->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-index 6035bf4580744..664605071d342 100644
---- a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-+++ b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-@@ -224,7 +224,7 @@ static int wuxga_nt_panel_add(struct wuxga_nt_panel *wuxga_nt)
- 	}
- 
- 	drm_panel_init(&wuxga_nt->base, &wuxga_nt->dsi->dev,
--		       &wuxga_nt_panel_funcs);
-+		       &wuxga_nt_panel_funcs, DRM_MODE_CONNECTOR_DSI);
- 
- 	ret = drm_panel_add(&wuxga_nt->base);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-index cded730f29ad2..2ccb74debc8ab 100644
---- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-@@ -433,7 +433,8 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
- 		return PTR_ERR(ts->dsi);
- 	}
- 
--	drm_panel_init(&ts->base, dev, &rpi_touchscreen_funcs);
-+	drm_panel_init(&ts->base, dev, &rpi_touchscreen_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	/* This appears last, as it's what will unblock the DSI host
- 	 * driver's component bind function.
-diff --git a/drivers/gpu/drm/panel/panel-raydium-rm67191.c b/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-index f82a1f69f13ba..fd67fc6185c4f 100644
---- a/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-+++ b/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-@@ -606,7 +606,8 @@ static int rad_panel_probe(struct mipi_dsi_device *dsi)
- 	if (ret)
- 		return ret;
- 
--	drm_panel_init(&panel->panel, dev, &rad_panel_funcs);
-+	drm_panel_init(&panel->panel, dev, &rad_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 	dev_set_drvdata(dev, panel);
- 
- 	ret = drm_panel_add(&panel->panel);
-diff --git a/drivers/gpu/drm/panel/panel-raydium-rm68200.c b/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-index f004b78fb8bc9..994e855721f4b 100644
---- a/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-+++ b/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-@@ -404,7 +404,8 @@ static int rm68200_probe(struct mipi_dsi_device *dsi)
- 	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
- 			  MIPI_DSI_MODE_LPM;
- 
--	drm_panel_init(&ctx->panel, dev, &rm68200_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &rm68200_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	drm_panel_add(&ctx->panel);
- 
-diff --git a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-index d7f56374f2f17..31234b79d3b1a 100644
---- a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-+++ b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-@@ -343,7 +343,8 @@ static int jh057n_probe(struct mipi_dsi_device *dsi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel, dev, &jh057n_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &jh057n_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	drm_panel_add(&ctx->panel);
- 
-diff --git a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-index 8708fbbe76376..170a5cda21b93 100644
---- a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-+++ b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-@@ -173,7 +173,8 @@ static int rb070d30_panel_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel, &dsi->dev, &rb070d30_panel_funcs);
-+	drm_panel_init(&ctx->panel, &dsi->dev, &rb070d30_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ctx->gpios.reset = devm_gpiod_get(&dsi->dev, "reset", GPIOD_OUT_LOW);
- 	if (IS_ERR(ctx->gpios.reset)) {
-diff --git a/drivers/gpu/drm/panel/panel-samsung-ld9040.c b/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-index 71a292dbec478..250809ba37c7e 100644
---- a/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-@@ -351,7 +351,8 @@ static int ld9040_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel, dev, &ld9040_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &ld9040_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&ctx->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-index 4d25c96e842cf..e3a0397e953ee 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-@@ -215,7 +215,8 @@ static int s6d16d0_probe(struct mipi_dsi_device *dsi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&s6->panel, dev, &s6d16d0_drm_funcs);
-+	drm_panel_init(&s6->panel, dev, &s6d16d0_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ret = drm_panel_add(&s6->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-index 42a3aaab49eb4..938ab72c55404 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-@@ -732,7 +732,8 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi)
- 	ctx->bl_dev->props.brightness = S6E3HA2_DEFAULT_BRIGHTNESS;
- 	ctx->bl_dev->props.power = FB_BLANK_POWERDOWN;
- 
--	drm_panel_init(&ctx->panel, dev, &s6e3ha2_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &s6e3ha2_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ret = drm_panel_add(&ctx->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-index b4d879bf4d03d..a60635e9226da 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-@@ -466,7 +466,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi)
- 		return PTR_ERR(ctx->reset_gpio);
- 	}
- 
--	drm_panel_init(&ctx->panel, dev, &s6e63j0x03_funcs);
-+	drm_panel_init(&ctx->panel, dev, &s6e63j0x03_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ctx->bl_dev = backlight_device_register("s6e63j0x03", dev, ctx,
- 						&s6e63j0x03_bl_ops, NULL);
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-index 61259c2833ab8..ba01af0b14fd3 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-@@ -473,7 +473,8 @@ static int s6e63m0_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel, dev, &s6e63m0_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &s6e63m0_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	ret = s6e63m0_backlight_register(ctx);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-index 35dbffabd5267..dbced65012045 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-@@ -1017,7 +1017,8 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi)
- 
- 	ctx->brightness = GAMMA_LEVEL_NUM - 1;
- 
--	drm_panel_init(&ctx->panel, dev, &s6e8aa0_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &s6e8aa0_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	ret = drm_panel_add(&ctx->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-index 0833d0c03adc9..b3619ba443bd2 100644
---- a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-+++ b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-@@ -274,7 +274,8 @@ static int seiko_panel_probe(struct device *dev,
- 			return -EPROBE_DEFER;
- 	}
- 
--	drm_panel_init(&panel->base, dev, &seiko_panel_funcs);
-+	drm_panel_init(&panel->base, dev, &seiko_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	err = drm_panel_add(&panel->base);
- 	if (err < 0)
-diff --git a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-index 87a58cb4d9455..5e136c3ba1850 100644
---- a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-@@ -329,7 +329,8 @@ static int sharp_panel_add(struct sharp_panel *sharp)
- 	if (IS_ERR(sharp->backlight))
- 		return PTR_ERR(sharp->backlight);
- 
--	drm_panel_init(&sharp->base, &sharp->link1->dev, &sharp_panel_funcs);
-+	drm_panel_init(&sharp->base, &sharp->link1->dev, &sharp_panel_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	return drm_panel_add(&sharp->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-index 96e3deb0e305c..eeab7998c7de4 100644
---- a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-@@ -185,7 +185,8 @@ static int ls037v7dw01_probe(struct platform_device *pdev)
- 		return PTR_ERR(lcd->ud_gpio);
- 	}
- 
--	drm_panel_init(&lcd->panel, &pdev->dev, &ls037v7dw01_funcs);
-+	drm_panel_init(&lcd->panel, &pdev->dev, &ls037v7dw01_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-index ffa844ee82ad4..b963ba4ab5898 100644
---- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-@@ -265,7 +265,7 @@ static int sharp_nt_panel_add(struct sharp_nt_panel *sharp_nt)
- 		return PTR_ERR(sharp_nt->backlight);
- 
- 	drm_panel_init(&sharp_nt->base, &sharp_nt->dsi->dev,
--		       &sharp_nt_panel_funcs);
-+		       &sharp_nt_panel_funcs, DRM_MODE_CONNECTOR_DSI);
- 
- 	return drm_panel_add(&sharp_nt->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index 156bd4d551dc3..af71365fb99b3 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -94,6 +94,7 @@ struct panel_desc {
- 
- 	u32 bus_format;
- 	u32 bus_flags;
-+	int connector_type;
- };
- 
- struct panel_simple {
-@@ -464,7 +465,8 @@ static int panel_simple_probe(struct device *dev, const struct panel_desc *desc)
- 	if (!of_get_display_timing(dev->of_node, "panel-timing", &dt))
- 		panel_simple_parse_panel_timing_node(dev, panel, &dt);
- 
--	drm_panel_init(&panel->base, dev, &panel_simple_funcs);
-+	drm_panel_init(&panel->base, dev, &panel_simple_funcs,
-+		       desc->connector_type);
- 
- 	err = drm_panel_add(&panel->base);
- 	if (err < 0)
-@@ -831,6 +833,7 @@ static const struct panel_desc auo_g133han01 = {
- 		.unprepare = 1000,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing auo_g185han01_timings = {
-@@ -860,6 +863,7 @@ static const struct panel_desc auo_g185han01 = {
- 		.unprepare = 1000,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing auo_p320hvn03_timings = {
-@@ -888,6 +892,7 @@ static const struct panel_desc auo_p320hvn03 = {
- 		.unprepare = 500,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode auo_t215hvn01_mode = {
-@@ -1203,6 +1208,7 @@ static const struct panel_desc dlc_dlc0700yzg_1 = {
- 		.disable = 200,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing dlc_dlc1010gig_timing = {
-@@ -1233,6 +1239,7 @@ static const struct panel_desc dlc_dlc1010gig = {
- 		.unprepare = 60,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode edt_et035012dm6_mode = {
-@@ -1499,6 +1506,7 @@ static const struct panel_desc hannstar_hsd070pww1 = {
- 		.height = 94,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing hannstar_hsd100pxn1_timing = {
-@@ -1523,6 +1531,7 @@ static const struct panel_desc hannstar_hsd100pxn1 = {
- 		.height = 152,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode hitachi_tx23d38vm0caa_mode = {
-@@ -1629,6 +1638,7 @@ static const struct panel_desc innolux_g070y2_l01 = {
- 		.unprepare = 800,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing innolux_g101ice_l01_timing = {
-@@ -1657,6 +1667,7 @@ static const struct panel_desc innolux_g101ice_l01 = {
- 		.disable = 200,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing innolux_g121i1_l01_timing = {
-@@ -1684,6 +1695,7 @@ static const struct panel_desc innolux_g121i1_l01 = {
- 		.disable = 20,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode innolux_g121x1_l03_mode = {
-@@ -1867,6 +1879,7 @@ static const struct panel_desc koe_tx31d200vm0baa = {
- 		.height = 109,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing kyo_tcg121xglp_timing = {
-@@ -1891,6 +1904,7 @@ static const struct panel_desc kyo_tcg121xglp = {
- 		.height = 184,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode lemaker_bl035_rgb_002_mode = {
-@@ -1939,6 +1953,7 @@ static const struct panel_desc lg_lb070wv8 = {
- 		.height = 91,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode lg_lp079qx1_sp0v_mode = {
-@@ -2095,6 +2110,7 @@ static const struct panel_desc mitsubishi_aa070mc01 = {
- 		.disable = 400,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
- };
- 
-@@ -2123,6 +2139,7 @@ static const struct panel_desc nec_nl12880bc20_05 = {
- 		.disable = 50,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode nec_nl4827hc19_05b_mode = {
-@@ -2225,6 +2242,7 @@ static const struct panel_desc nlt_nl192108ac18_02d = {
- 		.unprepare = 500,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode nvd_9128_mode = {
-@@ -2248,6 +2266,7 @@ static const struct panel_desc nvd_9128 = {
- 		.height = 88,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing okaya_rs800480t_7x0gp_timing = {
-@@ -2660,6 +2679,7 @@ static const struct panel_desc sharp_lq101k1ly04 = {
- 		.height = 136,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing sharp_lq123p1jx31_timing = {
-@@ -2839,6 +2859,7 @@ static const struct panel_desc tianma_tm070jdhg30 = {
- 		.height = 95,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct display_timing tianma_tm070rvhg71_timing = {
-@@ -2863,6 +2884,7 @@ static const struct panel_desc tianma_tm070rvhg71 = {
- 		.height = 86,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode ti_nspire_cx_lcd_mode[] = {
-@@ -2945,6 +2967,7 @@ static const struct panel_desc toshiba_lt089ac29000 = {
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct drm_display_mode tpk_f07a_0102_mode = {
-@@ -3015,6 +3038,7 @@ static const struct panel_desc urt_umsh_8596md_lvds = {
- 		.height = 91,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
-+	.connector_type = DRM_MODE_CONNECTOR_LVDS,
- };
- 
- static const struct panel_desc urt_umsh_8596md_parallel = {
-diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-index 77a3f6b9aec1d..1d2fd6cc66740 100644
---- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-+++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-@@ -369,7 +369,8 @@ static int st7701_dsi_probe(struct mipi_dsi_device *dsi)
- 	if (IS_ERR(st7701->backlight))
- 		return PTR_ERR(st7701->backlight);
- 
--	drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs);
-+	drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 
- 	/**
- 	 * Once sleep out has been issued, ST7701 IC required to wait 120ms
-diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-index 2eeaeee0dd7f3..108a85bb66672 100644
---- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-+++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-@@ -381,7 +381,8 @@ static int st7789v_probe(struct spi_device *spi)
- 	spi_set_drvdata(spi, ctx);
- 	ctx->spi = spi;
- 
--	drm_panel_init(&ctx->panel, &spi->dev, &st7789v_drm_funcs);
-+	drm_panel_init(&ctx->panel, &spi->dev, &st7789v_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	ctx->power = devm_regulator_get(&spi->dev, "power");
- 	if (IS_ERR(ctx->power))
-diff --git a/drivers/gpu/drm/panel/panel-sony-acx565akm.c b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-index 1e39067387a61..d6387d8f88a3f 100644
---- a/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-+++ b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-@@ -648,7 +648,8 @@ static int acx565akm_probe(struct spi_device *spi)
- 			return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel, &lcd->spi->dev, &acx565akm_funcs);
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &acx565akm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	ret = drm_panel_add(&lcd->panel);
- 	if (ret < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-index 76cfca89c3c78..c44d6a65c0aa2 100644
---- a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-@@ -347,7 +347,8 @@ static int td028ttec1_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td028ttec1_funcs);
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td028ttec1_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-index afd7c5ed53c45..621b65feec070 100644
---- a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-@@ -458,7 +458,8 @@ static int td043mtea1_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td043mtea1_funcs);
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td043mtea1_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 
- 	ret = drm_panel_add(&lcd->panel);
- 	if (ret < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-index 25524c26b241b..1a5418ae2ccf3 100644
---- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-@@ -457,7 +457,8 @@ static int tpg110_probe(struct spi_device *spi)
- 	if (ret)
- 		return ret;
- 
--	drm_panel_init(&tpg->panel, dev, &tpg110_drm_funcs);
-+	drm_panel_init(&tpg->panel, dev, &tpg110_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DPI);
- 	spi_set_drvdata(spi, tpg);
- 
- 	return drm_panel_add(&tpg->panel);
-diff --git a/drivers/gpu/drm/panel/panel-truly-nt35597.c b/drivers/gpu/drm/panel/panel-truly-nt35597.c
-index c3714be788375..0feea2456e14b 100644
---- a/drivers/gpu/drm/panel/panel-truly-nt35597.c
-+++ b/drivers/gpu/drm/panel/panel-truly-nt35597.c
-@@ -518,7 +518,8 @@ static int truly_nt35597_panel_add(struct truly_nt35597 *ctx)
- 	/* dual port */
- 	gpiod_set_value(ctx->mode_gpio, 0);
- 
--	drm_panel_init(&ctx->panel, dev, &truly_nt35597_drm_funcs);
-+	drm_panel_init(&ctx->panel, dev, &truly_nt35597_drm_funcs,
-+		       DRM_MODE_CONNECTOR_DSI);
- 	drm_panel_add(&ctx->panel);
- 
- 	return 0;
-diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
-index 4b9c656dc15e3..ce8da64022b43 100644
---- a/include/drm/drm_panel.h
-+++ b/include/drm/drm_panel.h
-@@ -139,6 +139,15 @@ struct drm_panel {
- 	 */
- 	const struct drm_panel_funcs *funcs;
- 
-+	/**
-+	 * @connector_type:
-+	 *
-+	 * Type of the panel as a DRM_MODE_CONNECTOR_* value. This is used to
-+	 * initialise the drm_connector corresponding to the panel with the
-+	 * correct connector type.
-+	 */
-+	int connector_type;
-+
- 	/**
- 	 * @list:
- 	 *
-@@ -148,7 +157,8 @@ struct drm_panel {
- };
- 
- void drm_panel_init(struct drm_panel *panel, struct device *dev,
--		    const struct drm_panel_funcs *funcs);
-+		    const struct drm_panel_funcs *funcs,
-+		    int connector_type);
- 
- int drm_panel_add(struct drm_panel *panel);
- void drm_panel_remove(struct drm_panel *panel);
--- 
-2.39.2
-
diff --git a/queue-5.4/drm-panel-initialise-panel-dev-and-funcs-through-drm.patch b/queue-5.4/drm-panel-initialise-panel-dev-and-funcs-through-drm.patch
deleted file mode 100644
index 09ae6751e89..00000000000
--- a/queue-5.4/drm-panel-initialise-panel-dev-and-funcs-through-drm.patch
+++ /dev/null
@@ -1,724 +0,0 @@
-From f849202961ea5bcb40ab2762d74ce17555110c64 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 23 Aug 2019 22:32:43 +0300
-Subject: drm/panel: Initialise panel dev and funcs through drm_panel_init()
-
-From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-
-[ Upstream commit 6dbe0c4b0fc0646442b2b1580d022404e582fd7b ]
-
-Instead of requiring all drivers to set the dev and funcs fields of
-drm_panel manually after calling drm_panel_init(), pass the data as
-arguments to the function. This simplifies the panel drivers, and will
-help future refactoring when adding new arguments to drm_panel_init().
-
-The panel drivers have been updated with the following Coccinelle
-semantic patch, with manual inspection to verify that no call to
-drm_panel_init() with a single argument still exists.
-
-@@
-expression panel;
-expression device;
-identifier ops;
-@@
- drm_panel_init(&panel
-+	, device, &ops
- );
- ...
-(
--panel.dev = device;
--panel.funcs = &ops;
-|
--panel.funcs = &ops;
--panel.dev = device;
-)
-
-Suggested-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20190823193245.23876-3-laurent.pinchart@ideasonboard.com
-Stable-dep-of: 2c56a751845d ("drm/panel: simple: Add connector_type for innolux_at043tn24")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/drm_panel.c                           | 11 ++++++++---
- drivers/gpu/drm/panel/panel-arm-versatile.c           |  4 +---
- drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c |  4 +---
- drivers/gpu/drm/panel/panel-ilitek-ili9322.c          |  4 +---
- drivers/gpu/drm/panel/panel-ilitek-ili9881c.c         |  4 +---
- drivers/gpu/drm/panel/panel-innolux-p079zca.c         |  4 +---
- drivers/gpu/drm/panel/panel-jdi-lt070me05000.c        |  4 +---
- drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c    |  5 ++---
- drivers/gpu/drm/panel/panel-lg-lb035q02.c             |  4 +---
- drivers/gpu/drm/panel/panel-lg-lg4573.c               |  4 +---
- drivers/gpu/drm/panel/panel-lvds.c                    |  4 +---
- drivers/gpu/drm/panel/panel-nec-nl8048hl11.c          |  4 +---
- drivers/gpu/drm/panel/panel-novatek-nt39016.c         |  4 +---
- drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c    |  4 +---
- drivers/gpu/drm/panel/panel-orisetech-otm8009a.c      |  4 +---
- drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c    |  5 ++---
- drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c  |  5 ++---
- drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c |  4 +---
- drivers/gpu/drm/panel/panel-raydium-rm67191.c         |  4 +---
- drivers/gpu/drm/panel/panel-raydium-rm68200.c         |  4 +---
- drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c    |  4 +---
- drivers/gpu/drm/panel/panel-ronbo-rb070d30.c          |  4 +---
- drivers/gpu/drm/panel/panel-samsung-ld9040.c          |  4 +---
- drivers/gpu/drm/panel/panel-samsung-s6d16d0.c         |  4 +---
- drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c         |  4 +---
- drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c      |  4 +---
- drivers/gpu/drm/panel/panel-samsung-s6e63m0.c         |  4 +---
- drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c         |  4 +---
- drivers/gpu/drm/panel/panel-seiko-43wvf1g.c           |  4 +---
- drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c       |  4 +---
- drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c       |  4 +---
- drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c       |  5 ++---
- drivers/gpu/drm/panel/panel-simple.c                  |  4 +---
- drivers/gpu/drm/panel/panel-sitronix-st7701.c         |  4 +---
- drivers/gpu/drm/panel/panel-sitronix-st7789v.c        |  4 +---
- drivers/gpu/drm/panel/panel-sony-acx565akm.c          |  4 +---
- drivers/gpu/drm/panel/panel-tpo-td028ttec1.c          |  4 +---
- drivers/gpu/drm/panel/panel-tpo-td043mtea1.c          |  4 +---
- drivers/gpu/drm/panel/panel-tpo-tpg110.c              |  4 +---
- drivers/gpu/drm/panel/panel-truly-nt35597.c           |  4 +---
- include/drm/drm_panel.h                               |  3 ++-
- 41 files changed, 53 insertions(+), 121 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
-index 6b0bf42039cfa..ba2fad4c96489 100644
---- a/drivers/gpu/drm/drm_panel.c
-+++ b/drivers/gpu/drm/drm_panel.c
-@@ -44,13 +44,18 @@ static LIST_HEAD(panel_list);
- /**
-  * drm_panel_init - initialize a panel
-  * @panel: DRM panel
-+ * @dev: parent device of the panel
-+ * @funcs: panel operations
-  *
-- * Sets up internal fields of the panel so that it can subsequently be added
-- * to the registry.
-+ * Initialize the panel structure for subsequent registration with
-+ * drm_panel_add().
-  */
--void drm_panel_init(struct drm_panel *panel)
-+void drm_panel_init(struct drm_panel *panel, struct device *dev,
-+		    const struct drm_panel_funcs *funcs)
- {
- 	INIT_LIST_HEAD(&panel->list);
-+	panel->dev = dev;
-+	panel->funcs = funcs;
- }
- EXPORT_SYMBOL(drm_panel_init);
- 
-diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c
-index 5f72c922a04b1..a4333ed0f20ca 100644
---- a/drivers/gpu/drm/panel/panel-arm-versatile.c
-+++ b/drivers/gpu/drm/panel/panel-arm-versatile.c
-@@ -350,9 +350,7 @@ static int versatile_panel_probe(struct platform_device *pdev)
- 			dev_info(dev, "panel mounted on IB2 daughterboard\n");
- 	}
- 
--	drm_panel_init(&vpanel->panel);
--	vpanel->panel.dev = dev;
--	vpanel->panel.funcs = &versatile_panel_drm_funcs;
-+	drm_panel_init(&vpanel->panel, dev, &versatile_panel_drm_funcs);
- 
- 	return drm_panel_add(&vpanel->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-index dabf59e0f56fa..7d5d7455bc01f 100644
---- a/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-+++ b/drivers/gpu/drm/panel/panel-feiyang-fy07024di26a30d.c
-@@ -204,9 +204,7 @@ static int feiyang_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = &dsi->dev;
--	ctx->panel.funcs = &feiyang_funcs;
-+	drm_panel_init(&ctx->panel, &dsi->dev, &feiyang_funcs);
- 
- 	ctx->dvdd = devm_regulator_get(&dsi->dev, "dvdd");
- 	if (IS_ERR(ctx->dvdd)) {
-diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-index 3c58f63adbf7e..ad2405baa0ac5 100644
---- a/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9322.c
-@@ -895,9 +895,7 @@ static int ili9322_probe(struct spi_device *spi)
- 		ili->input = ili->conf->input;
- 	}
- 
--	drm_panel_init(&ili->panel);
--	ili->panel.dev = dev;
--	ili->panel.funcs = &ili9322_drm_funcs;
-+	drm_panel_init(&ili->panel, dev, &ili9322_drm_funcs);
- 
- 	return drm_panel_add(&ili->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-index 3ad4a46c4e945..1d714f961c009 100644
---- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
-@@ -433,9 +433,7 @@ static int ili9881c_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = &dsi->dev;
--	ctx->panel.funcs = &ili9881c_funcs;
-+	drm_panel_init(&ctx->panel, &dsi->dev, &ili9881c_funcs);
- 
- 	ctx->power = devm_regulator_get(&dsi->dev, "power");
- 	if (IS_ERR(ctx->power)) {
-diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-index df90b66079816..8f3647804a1e4 100644
---- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-+++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
-@@ -487,9 +487,7 @@ static int innolux_panel_add(struct mipi_dsi_device *dsi,
- 	if (IS_ERR(innolux->backlight))
- 		return PTR_ERR(innolux->backlight);
- 
--	drm_panel_init(&innolux->base);
--	innolux->base.funcs = &innolux_panel_funcs;
--	innolux->base.dev = dev;
-+	drm_panel_init(&innolux->base, dev, &innolux_panel_funcs);
- 
- 	err = drm_panel_add(&innolux->base);
- 	if (err < 0)
-diff --git a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-index ff3e89e61e3fc..7bfdbfbc868ed 100644
---- a/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-+++ b/drivers/gpu/drm/panel/panel-jdi-lt070me05000.c
-@@ -437,9 +437,7 @@ static int jdi_panel_add(struct jdi_panel *jdi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&jdi->base);
--	jdi->base.funcs = &jdi_panel_funcs;
--	jdi->base.dev = &jdi->dsi->dev;
-+	drm_panel_init(&jdi->base, &jdi->dsi->dev, &jdi_panel_funcs);
- 
- 	ret = drm_panel_add(&jdi->base);
- 
-diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-index 1e7fecab72a9f..bb131749a0b92 100644
---- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-+++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c
-@@ -391,9 +391,8 @@ static int kingdisplay_panel_add(struct kingdisplay_panel *kingdisplay)
- 	if (IS_ERR(kingdisplay->backlight))
- 		return PTR_ERR(kingdisplay->backlight);
- 
--	drm_panel_init(&kingdisplay->base);
--	kingdisplay->base.funcs = &kingdisplay_panel_funcs;
--	kingdisplay->base.dev = &kingdisplay->link->dev;
-+	drm_panel_init(&kingdisplay->base, &kingdisplay->link->dev,
-+		       &kingdisplay_panel_funcs);
- 
- 	return drm_panel_add(&kingdisplay->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lg-lb035q02.c b/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-index ee4379729a5b8..c7b9b47849bb8 100644
---- a/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-+++ b/drivers/gpu/drm/panel/panel-lg-lb035q02.c
-@@ -196,9 +196,7 @@ static int lb035q02_probe(struct spi_device *spi)
- 	if (ret < 0)
- 		return ret;
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &lcd->spi->dev;
--	lcd->panel.funcs = &lb035q02_funcs;
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &lb035q02_funcs);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lg-lg4573.c b/drivers/gpu/drm/panel/panel-lg-lg4573.c
-index 41bf02d122a1f..608f2de91662d 100644
---- a/drivers/gpu/drm/panel/panel-lg-lg4573.c
-+++ b/drivers/gpu/drm/panel/panel-lg-lg4573.c
-@@ -259,9 +259,7 @@ static int lg4573_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = &spi->dev;
--	ctx->panel.funcs = &lg4573_drm_funcs;
-+	drm_panel_init(&ctx->panel, &spi->dev, &lg4573_drm_funcs);
- 
- 	return drm_panel_add(&ctx->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
-index bf5fcc3e53791..ff1e305d56a02 100644
---- a/drivers/gpu/drm/panel/panel-lvds.c
-+++ b/drivers/gpu/drm/panel/panel-lvds.c
-@@ -254,9 +254,7 @@ static int panel_lvds_probe(struct platform_device *pdev)
- 	 */
- 
- 	/* Register the panel. */
--	drm_panel_init(&lvds->panel);
--	lvds->panel.dev = lvds->dev;
--	lvds->panel.funcs = &panel_lvds_funcs;
-+	drm_panel_init(&lvds->panel, lvds->dev, &panel_lvds_funcs);
- 
- 	ret = drm_panel_add(&lvds->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-index 20f17e46e65da..272a1434e1558 100644
---- a/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-+++ b/drivers/gpu/drm/panel/panel-nec-nl8048hl11.c
-@@ -205,9 +205,7 @@ static int nl8048_probe(struct spi_device *spi)
- 	if (ret < 0)
- 		return ret;
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &lcd->spi->dev;
--	lcd->panel.funcs = &nl8048_funcs;
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &nl8048_funcs);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-novatek-nt39016.c b/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-index 2ad1063b068d5..64cfe111aaadb 100644
---- a/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-+++ b/drivers/gpu/drm/panel/panel-novatek-nt39016.c
-@@ -292,9 +292,7 @@ static int nt39016_probe(struct spi_device *spi)
- 		return err;
- 	}
- 
--	drm_panel_init(&panel->drm_panel);
--	panel->drm_panel.dev = dev;
--	panel->drm_panel.funcs = &nt39016_funcs;
-+	drm_panel_init(&panel->drm_panel, dev, &nt39016_funcs);
- 
- 	err = drm_panel_add(&panel->drm_panel);
- 	if (err < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-index 2bae1db3ff344..f2d6a4ec00467 100644
---- a/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-+++ b/drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.c
-@@ -288,9 +288,7 @@ static int lcd_olinuxino_probe(struct i2c_client *client,
- 	if (IS_ERR(lcd->backlight))
- 		return PTR_ERR(lcd->backlight);
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = dev;
--	lcd->panel.funcs = &lcd_olinuxino_funcs;
-+	drm_panel_init(&lcd->panel, dev, &lcd_olinuxino_funcs);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-index 3ee265f1755f4..5aacd632c6f69 100644
---- a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-+++ b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
-@@ -455,9 +455,7 @@ static int otm8009a_probe(struct mipi_dsi_device *dsi)
- 	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
- 			  MIPI_DSI_MODE_LPM;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &otm8009a_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &otm8009a_drm_funcs);
- 
- 	ctx->bl_dev = devm_backlight_device_register(dev, dev_name(dev),
- 						     dev, ctx,
-diff --git a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-index e0e20ecff916d..38f114b03b897 100644
---- a/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-+++ b/drivers/gpu/drm/panel/panel-osd-osd101t2587-53ts.c
-@@ -166,9 +166,8 @@ static int osd101t2587_panel_add(struct osd101t2587_panel *osd101t2587)
- 	if (IS_ERR(osd101t2587->backlight))
- 		return PTR_ERR(osd101t2587->backlight);
- 
--	drm_panel_init(&osd101t2587->base);
--	osd101t2587->base.funcs = &osd101t2587_panel_funcs;
--	osd101t2587->base.dev = &osd101t2587->dsi->dev;
-+	drm_panel_init(&osd101t2587->base, &osd101t2587->dsi->dev,
-+		       &osd101t2587_panel_funcs);
- 
- 	return drm_panel_add(&osd101t2587->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-index 3dff0b3f73c23..6035bf4580744 100644
---- a/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-+++ b/drivers/gpu/drm/panel/panel-panasonic-vvx10f034n00.c
-@@ -223,9 +223,8 @@ static int wuxga_nt_panel_add(struct wuxga_nt_panel *wuxga_nt)
- 			return -EPROBE_DEFER;
- 	}
- 
--	drm_panel_init(&wuxga_nt->base);
--	wuxga_nt->base.funcs = &wuxga_nt_panel_funcs;
--	wuxga_nt->base.dev = &wuxga_nt->dsi->dev;
-+	drm_panel_init(&wuxga_nt->base, &wuxga_nt->dsi->dev,
-+		       &wuxga_nt_panel_funcs);
- 
- 	ret = drm_panel_add(&wuxga_nt->base);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-index a621dd28ff70d..cded730f29ad2 100644
---- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
-@@ -433,9 +433,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
- 		return PTR_ERR(ts->dsi);
- 	}
- 
--	drm_panel_init(&ts->base);
--	ts->base.dev = dev;
--	ts->base.funcs = &rpi_touchscreen_funcs;
-+	drm_panel_init(&ts->base, dev, &rpi_touchscreen_funcs);
- 
- 	/* This appears last, as it's what will unblock the DSI host
- 	 * driver's component bind function.
-diff --git a/drivers/gpu/drm/panel/panel-raydium-rm67191.c b/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-index 6a5d37006103e..f82a1f69f13ba 100644
---- a/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-+++ b/drivers/gpu/drm/panel/panel-raydium-rm67191.c
-@@ -606,9 +606,7 @@ static int rad_panel_probe(struct mipi_dsi_device *dsi)
- 	if (ret)
- 		return ret;
- 
--	drm_panel_init(&panel->panel);
--	panel->panel.funcs = &rad_panel_funcs;
--	panel->panel.dev = dev;
-+	drm_panel_init(&panel->panel, dev, &rad_panel_funcs);
- 	dev_set_drvdata(dev, panel);
- 
- 	ret = drm_panel_add(&panel->panel);
-diff --git a/drivers/gpu/drm/panel/panel-raydium-rm68200.c b/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-index ba889625ad435..f004b78fb8bc9 100644
---- a/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-+++ b/drivers/gpu/drm/panel/panel-raydium-rm68200.c
-@@ -404,9 +404,7 @@ static int rm68200_probe(struct mipi_dsi_device *dsi)
- 	dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
- 			  MIPI_DSI_MODE_LPM;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &rm68200_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &rm68200_drm_funcs);
- 
- 	drm_panel_add(&ctx->panel);
- 
-diff --git a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-index b9109922397ff..d7f56374f2f17 100644
---- a/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-+++ b/drivers/gpu/drm/panel/panel-rocktech-jh057n00900.c
-@@ -343,9 +343,7 @@ static int jh057n_probe(struct mipi_dsi_device *dsi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &jh057n_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &jh057n_drm_funcs);
- 
- 	drm_panel_add(&ctx->panel);
- 
-diff --git a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-index 3c15764f0c039..8708fbbe76376 100644
---- a/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-+++ b/drivers/gpu/drm/panel/panel-ronbo-rb070d30.c
-@@ -173,9 +173,7 @@ static int rb070d30_panel_dsi_probe(struct mipi_dsi_device *dsi)
- 	mipi_dsi_set_drvdata(dsi, ctx);
- 	ctx->dsi = dsi;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = &dsi->dev;
--	ctx->panel.funcs = &rb070d30_panel_funcs;
-+	drm_panel_init(&ctx->panel, &dsi->dev, &rb070d30_panel_funcs);
- 
- 	ctx->gpios.reset = devm_gpiod_get(&dsi->dev, "reset", GPIOD_OUT_LOW);
- 	if (IS_ERR(ctx->gpios.reset)) {
-diff --git a/drivers/gpu/drm/panel/panel-samsung-ld9040.c b/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-index 3be902dcedc02..71a292dbec478 100644
---- a/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-ld9040.c
-@@ -351,9 +351,7 @@ static int ld9040_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &ld9040_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &ld9040_drm_funcs);
- 
- 	return drm_panel_add(&ctx->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-index f75bef24e0504..4d25c96e842cf 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6d16d0.c
-@@ -215,9 +215,7 @@ static int s6d16d0_probe(struct mipi_dsi_device *dsi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&s6->panel);
--	s6->panel.dev = dev;
--	s6->panel.funcs = &s6d16d0_drm_funcs;
-+	drm_panel_init(&s6->panel, dev, &s6d16d0_drm_funcs);
- 
- 	ret = drm_panel_add(&s6->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-index b923de23ed654..42a3aaab49eb4 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
-@@ -732,9 +732,7 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi)
- 	ctx->bl_dev->props.brightness = S6E3HA2_DEFAULT_BRIGHTNESS;
- 	ctx->bl_dev->props.power = FB_BLANK_POWERDOWN;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &s6e3ha2_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &s6e3ha2_drm_funcs);
- 
- 	ret = drm_panel_add(&ctx->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-index cd90fa700c493..b4d879bf4d03d 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
-@@ -466,9 +466,7 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi)
- 		return PTR_ERR(ctx->reset_gpio);
- 	}
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &s6e63j0x03_funcs;
-+	drm_panel_init(&ctx->panel, dev, &s6e63j0x03_funcs);
- 
- 	ctx->bl_dev = backlight_device_register("s6e63j0x03", dev, ctx,
- 						&s6e63j0x03_bl_ops, NULL);
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-index 142d395ea5129..61259c2833ab8 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
-@@ -473,9 +473,7 @@ static int s6e63m0_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &s6e63m0_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &s6e63m0_drm_funcs);
- 
- 	ret = s6e63m0_backlight_register(ctx);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-index 81858267723ad..35dbffabd5267 100644
---- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-+++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
-@@ -1017,9 +1017,7 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi)
- 
- 	ctx->brightness = GAMMA_LEVEL_NUM - 1;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &s6e8aa0_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &s6e8aa0_drm_funcs);
- 
- 	ret = drm_panel_add(&ctx->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-index 18b22b1294fbc..0833d0c03adc9 100644
---- a/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-+++ b/drivers/gpu/drm/panel/panel-seiko-43wvf1g.c
-@@ -274,9 +274,7 @@ static int seiko_panel_probe(struct device *dev,
- 			return -EPROBE_DEFER;
- 	}
- 
--	drm_panel_init(&panel->base);
--	panel->base.dev = dev;
--	panel->base.funcs = &seiko_panel_funcs;
-+	drm_panel_init(&panel->base, dev, &seiko_panel_funcs);
- 
- 	err = drm_panel_add(&panel->base);
- 	if (err < 0)
-diff --git a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-index e910b4ad13104..87a58cb4d9455 100644
---- a/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-lq101r1sx01.c
-@@ -329,9 +329,7 @@ static int sharp_panel_add(struct sharp_panel *sharp)
- 	if (IS_ERR(sharp->backlight))
- 		return PTR_ERR(sharp->backlight);
- 
--	drm_panel_init(&sharp->base);
--	sharp->base.funcs = &sharp_panel_funcs;
--	sharp->base.dev = &sharp->link1->dev;
-+	drm_panel_init(&sharp->base, &sharp->link1->dev, &sharp_panel_funcs);
- 
- 	return drm_panel_add(&sharp->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-index 46cd9a2501298..96e3deb0e305c 100644
---- a/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-ls037v7dw01.c
-@@ -185,9 +185,7 @@ static int ls037v7dw01_probe(struct platform_device *pdev)
- 		return PTR_ERR(lcd->ud_gpio);
- 	}
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &pdev->dev;
--	lcd->panel.funcs = &ls037v7dw01_funcs;
-+	drm_panel_init(&lcd->panel, &pdev->dev, &ls037v7dw01_funcs);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-index c39abde9f9f10..ffa844ee82ad4 100644
---- a/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-+++ b/drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c
-@@ -264,9 +264,8 @@ static int sharp_nt_panel_add(struct sharp_nt_panel *sharp_nt)
- 	if (IS_ERR(sharp_nt->backlight))
- 		return PTR_ERR(sharp_nt->backlight);
- 
--	drm_panel_init(&sharp_nt->base);
--	sharp_nt->base.funcs = &sharp_nt_panel_funcs;
--	sharp_nt->base.dev = &sharp_nt->dsi->dev;
-+	drm_panel_init(&sharp_nt->base, &sharp_nt->dsi->dev,
-+		       &sharp_nt_panel_funcs);
- 
- 	return drm_panel_add(&sharp_nt->base);
- }
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index ec0085e664365..156bd4d551dc3 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -464,9 +464,7 @@ static int panel_simple_probe(struct device *dev, const struct panel_desc *desc)
- 	if (!of_get_display_timing(dev->of_node, "panel-timing", &dt))
- 		panel_simple_parse_panel_timing_node(dev, panel, &dt);
- 
--	drm_panel_init(&panel->base);
--	panel->base.dev = dev;
--	panel->base.funcs = &panel_simple_funcs;
-+	drm_panel_init(&panel->base, dev, &panel_simple_funcs);
- 
- 	err = drm_panel_add(&panel->base);
- 	if (err < 0)
-diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-index 638f605acb2db..77a3f6b9aec1d 100644
---- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-+++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
-@@ -369,7 +369,7 @@ static int st7701_dsi_probe(struct mipi_dsi_device *dsi)
- 	if (IS_ERR(st7701->backlight))
- 		return PTR_ERR(st7701->backlight);
- 
--	drm_panel_init(&st7701->panel);
-+	drm_panel_init(&st7701->panel, &dsi->dev, &st7701_funcs);
- 
- 	/**
- 	 * Once sleep out has been issued, ST7701 IC required to wait 120ms
-@@ -381,8 +381,6 @@ static int st7701_dsi_probe(struct mipi_dsi_device *dsi)
- 	 * ts8550b and there is no valid documentation for that.
- 	 */
- 	st7701->sleep_delay = 120 + desc->panel_sleep_delay;
--	st7701->panel.funcs = &st7701_funcs;
--	st7701->panel.dev = &dsi->dev;
- 
- 	ret = drm_panel_add(&st7701->panel);
- 	if (ret < 0)
-diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-index 3b2612ae931e8..2eeaeee0dd7f3 100644
---- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-+++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
-@@ -381,9 +381,7 @@ static int st7789v_probe(struct spi_device *spi)
- 	spi_set_drvdata(spi, ctx);
- 	ctx->spi = spi;
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = &spi->dev;
--	ctx->panel.funcs = &st7789v_drm_funcs;
-+	drm_panel_init(&ctx->panel, &spi->dev, &st7789v_drm_funcs);
- 
- 	ctx->power = devm_regulator_get(&spi->dev, "power");
- 	if (IS_ERR(ctx->power))
-diff --git a/drivers/gpu/drm/panel/panel-sony-acx565akm.c b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-index 3d5b9c4f68d98..1e39067387a61 100644
---- a/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-+++ b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
-@@ -648,9 +648,7 @@ static int acx565akm_probe(struct spi_device *spi)
- 			return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &lcd->spi->dev;
--	lcd->panel.funcs = &acx565akm_funcs;
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &acx565akm_funcs);
- 
- 	ret = drm_panel_add(&lcd->panel);
- 	if (ret < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-index f2baff827f507..76cfca89c3c78 100644
---- a/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-td028ttec1.c
-@@ -347,9 +347,7 @@ static int td028ttec1_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &lcd->spi->dev;
--	lcd->panel.funcs = &td028ttec1_funcs;
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td028ttec1_funcs);
- 
- 	return drm_panel_add(&lcd->panel);
- }
-diff --git a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-index ba163c779084c..afd7c5ed53c45 100644
---- a/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-td043mtea1.c
-@@ -458,9 +458,7 @@ static int td043mtea1_probe(struct spi_device *spi)
- 		return ret;
- 	}
- 
--	drm_panel_init(&lcd->panel);
--	lcd->panel.dev = &lcd->spi->dev;
--	lcd->panel.funcs = &td043mtea1_funcs;
-+	drm_panel_init(&lcd->panel, &lcd->spi->dev, &td043mtea1_funcs);
- 
- 	ret = drm_panel_add(&lcd->panel);
- 	if (ret < 0) {
-diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-index 71591e5f59383..25524c26b241b 100644
---- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-+++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
-@@ -457,9 +457,7 @@ static int tpg110_probe(struct spi_device *spi)
- 	if (ret)
- 		return ret;
- 
--	drm_panel_init(&tpg->panel);
--	tpg->panel.dev = dev;
--	tpg->panel.funcs = &tpg110_drm_funcs;
-+	drm_panel_init(&tpg->panel, dev, &tpg110_drm_funcs);
- 	spi_set_drvdata(spi, tpg);
- 
- 	return drm_panel_add(&tpg->panel);
-diff --git a/drivers/gpu/drm/panel/panel-truly-nt35597.c b/drivers/gpu/drm/panel/panel-truly-nt35597.c
-index 77e1311b7c692..c3714be788375 100644
---- a/drivers/gpu/drm/panel/panel-truly-nt35597.c
-+++ b/drivers/gpu/drm/panel/panel-truly-nt35597.c
-@@ -518,9 +518,7 @@ static int truly_nt35597_panel_add(struct truly_nt35597 *ctx)
- 	/* dual port */
- 	gpiod_set_value(ctx->mode_gpio, 0);
- 
--	drm_panel_init(&ctx->panel);
--	ctx->panel.dev = dev;
--	ctx->panel.funcs = &truly_nt35597_drm_funcs;
-+	drm_panel_init(&ctx->panel, dev, &truly_nt35597_drm_funcs);
- 	drm_panel_add(&ctx->panel);
- 
- 	return 0;
-diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
-index 624bd15ecfab6..4b9c656dc15e3 100644
---- a/include/drm/drm_panel.h
-+++ b/include/drm/drm_panel.h
-@@ -147,7 +147,8 @@ struct drm_panel {
- 	struct list_head list;
- };
- 
--void drm_panel_init(struct drm_panel *panel);
-+void drm_panel_init(struct drm_panel *panel, struct device *dev,
-+		    const struct drm_panel_funcs *funcs);
- 
- int drm_panel_add(struct drm_panel *panel);
- void drm_panel_remove(struct drm_panel *panel);
--- 
-2.39.2
-
diff --git a/queue-5.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch b/queue-5.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
deleted file mode 100644
index 0288c2cc55f..00000000000
--- a/queue-5.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 15a2f19a825813ff4508488feb70893b2903eee2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 08:22:02 -0300
-Subject: drm/panel: simple: Add connector_type for innolux_at043tn24
-
-From: Fabio Estevam <festevam@denx.de>
-
-[ Upstream commit 2c56a751845ddfd3078ebe79981aaaa182629163 ]
-
-The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type'
-information to avoid the following warning:
-
-panel-simple panel: Specify missing connector_type
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24")
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index af71365fb99b3..a87b79c8d76f7 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -1584,6 +1584,7 @@ static const struct panel_desc innolux_at043tn24 = {
- 		.height = 54,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
-+	.connector_type = DRM_MODE_CONNECTOR_DPI,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch b/queue-5.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
deleted file mode 100644
index b4af1f14cdb..00000000000
--- a/queue-5.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 3099608e5a6ce78608c3eada9fdad4a1193a66f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 17:34:10 +0800
-Subject: erofs: avoid infinite loop in z_erofs_do_read_page() when reading
- beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ]
-
-z_erofs_do_read_page() may loop infinitely due to the inappropriate
-truncation in the below statement. Since the offset is 64 bits and min_t()
-truncates the result to 32 bits. The solution is to replace unsigned int
-with a 64-bit type, such as erofs_off_t.
-    cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-
-    - For example:
-        - offset = 0x400160000
-        - end = 0x370
-        - map->m_la = 0x160370
-        - offset + end - map->m_la = 0x400000000
-        - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
-    - Expected result:
-        - cur = 0
-    - Actual result:
-        - cur = 0x370
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index fdd18c2508115..dcc377094f90b 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -636,7 +636,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 	tight &= (clt->mode >= COLLECT_PRIMARY_HOOKED &&
- 		  clt->mode != COLLECT_PRIMARY_FOLLOWED_NOINPLACE);
- 
--	cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-+	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
- 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
- 		zero_user_segment(page, cur, end);
- 		goto next_part;
--- 
-2.39.2
-
diff --git a/queue-5.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-5.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index d9c91e65a55..00000000000
--- a/queue-5.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From dfabf3cb2a6e619faed5ac9bc76d21417cb33a66 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index 3db10cae7b178..169467b5c98a6 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -410,7 +410,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/igc-remove-delay-during-tx-ring-configuration.patch b/queue-5.4/igc-remove-delay-during-tx-ring-configuration.patch
deleted file mode 100644
index e997d50d333..00000000000
--- a/queue-5.4/igc-remove-delay-during-tx-ring-configuration.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 18266409139cf087182a9f927249e2718306dbe8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 May 2023 08:18:12 +0800
-Subject: igc: Remove delay during TX ring configuration
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit cca28ceac7c7857bc2d313777017585aef00bcc4 ]
-
-Remove unnecessary delay during the TX ring configuration.
-This will cause delay, especially during link down and
-link up activity.
-
-Furthermore, old SKUs like as I225 will call the reset_adapter
-to reset the controller during TSN mode Gate Control List (GCL)
-setting. This will add more time to the configuration of the
-real-time use case.
-
-It doesn't mentioned about this delay in the Software User Manual.
-It might have been ported from legacy code I210 in the past.
-
-Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index b8297a63a7fd2..3839ca8bdf6dd 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -610,7 +610,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter,
- 	/* disable the queue */
- 	wr32(IGC_TXDCTL(reg_idx), 0);
- 	wrfl();
--	mdelay(10);
- 
- 	wr32(IGC_TDLEN(reg_idx),
- 	     ring->count * sizeof(union igc_adv_tx_desc));
--- 
-2.39.2
-
diff --git a/queue-5.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch b/queue-5.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
deleted file mode 100644
index 11c9f783998..00000000000
--- a/queue-5.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From bc13bf08dc0fa6def9892f176aeb46da47ff6c44 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 5 Jun 2023 11:09:01 -0700
-Subject: igc: set TP bit in 'supported' and 'advertising' fields of
- ethtool_link_ksettings
-
-From: Prasad Koya <prasad@arista.com>
-
-[ Upstream commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 ]
-
-set TP bit in the 'supported' and 'advertising' fields. i225/226 parts
-only support twisted pair copper.
-
-Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
-Signed-off-by: Prasad Koya <prasad@arista.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-index cbcb8611ab50d..0a4e7f5f292ac 100644
---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-@@ -1668,6 +1668,8 @@ static int igc_get_link_ksettings(struct net_device *netdev,
- 	/* twisted pair */
- 	cmd->base.port = PORT_TP;
- 	cmd->base.phy_address = hw->phy.addr;
-+	ethtool_link_ksettings_add_link_mode(cmd, supported, TP);
-+	ethtool_link_ksettings_add_link_mode(cmd, advertising, TP);
- 
- 	/* advertising link modes */
- 	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
--- 
-2.39.2
-
diff --git a/queue-5.4/ionic-clean-irq-affinity-on-queue-deinit.patch b/queue-5.4/ionic-clean-irq-affinity-on-queue-deinit.patch
deleted file mode 100644
index bc23ac84923..00000000000
--- a/queue-5.4/ionic-clean-irq-affinity-on-queue-deinit.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 4841f8e63e8937054dbda88c0209bc33b0996695 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 19 Mar 2020 19:31:52 -0700
-Subject: ionic: clean irq affinity on queue deinit
-
-From: Shannon Nelson <snelson@pensando.io>
-
-[ Upstream commit b9c17d39d5d19b321414a1737c754a819878424a ]
-
-Add a little more cleanup when tearing down the queues.
-
-Fixes: 1d062b7b6f64 ("ionic: Add basic adminq support")
-Signed-off-by: Shannon Nelson <snelson@pensando.io>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: abfb2a58a537 ("ionic: remove WARN_ON to prevent panic_on_warn")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 975cda9377ec4..fa57a526b60f6 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -269,8 +269,10 @@ static void ionic_lif_qcq_deinit(struct ionic_lif *lif, struct ionic_qcq *qcq)
- 	if (qcq->flags & IONIC_QCQ_F_INTR) {
- 		ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
- 				IONIC_INTR_MASK_SET);
-+		irq_set_affinity_hint(qcq->intr.vector, NULL);
- 		devm_free_irq(dev, qcq->intr.vector, &qcq->napi);
- 		netif_napi_del(&qcq->napi);
-+		qcq->intr.vector = 0;
- 	}
- 
- 	qcq->flags &= ~IONIC_QCQ_F_INITED;
--- 
-2.39.2
-
diff --git a/queue-5.4/ionic-improve-irq-numa-locality.patch b/queue-5.4/ionic-improve-irq-numa-locality.patch
deleted file mode 100644
index bc02dfcf7a5..00000000000
--- a/queue-5.4/ionic-improve-irq-numa-locality.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 5d239f70262c25e06b3fb08385d492bedc01d318 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 6 Mar 2020 17:04:03 -0800
-Subject: ionic: improve irq numa locality
-
-From: Shannon Nelson <snelson@pensando.io>
-
-[ Upstream commit b7f55b81f2ac40e52c5a56e22c80488eac531c91 ]
-
-Spreading the interrupts across the CPU cores is good for load
-balancing, but not necessarily as good when using a CPU/core
-that is not part of the NUMA local CPU.  If it can be localized,
-the kernel's cpumask_local_spread() service will pick a core
-that is on the node close to the PCI device.
-
-Signed-off-by: Shannon Nelson <snelson@pensando.io>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: abfb2a58a537 ("ionic: remove WARN_ON to prevent panic_on_warn")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index d0841836cf705..975cda9377ec4 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -418,8 +418,9 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 		ionic_intr_mask_assert(idev->intr_ctrl, new->intr.index,
- 				       IONIC_INTR_MASK_SET);
- 
--		new->intr.cpu = new->intr.index % num_online_cpus();
--		if (cpu_online(new->intr.cpu))
-+		new->intr.cpu = cpumask_local_spread(new->intr.index,
-+						     dev_to_node(dev));
-+		if (new->intr.cpu != -1)
- 			cpumask_set_cpu(new->intr.cpu,
- 					&new->intr.affinity_mask);
- 	} else {
--- 
-2.39.2
-
diff --git a/queue-5.4/ionic-ionic_intr_free-parameter-change.patch b/queue-5.4/ionic-ionic_intr_free-parameter-change.patch
deleted file mode 100644
index 2a2cf1ebcf3..00000000000
--- a/queue-5.4/ionic-ionic_intr_free-parameter-change.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 7c93ad29af052cdebe41ee38afa14873e8ac76a9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 11 May 2020 17:59:33 -0700
-Subject: ionic: ionic_intr_free parameter change
-
-From: Shannon Nelson <snelson@pensando.io>
-
-[ Upstream commit 36ac2c50924892a28e17ff463e354fec7650ee19 ]
-
-Change the ionic_intr_free parameter from struct ionic_lif to
-struct ionic since that's what it actually cares about.
-
-Signed-off-by: Shannon Nelson <snelson@pensando.io>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: abfb2a58a537 ("ionic: remove WARN_ON to prevent panic_on_warn")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 3fc9ac1e8b7b7..52d291383c233 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -167,10 +167,10 @@ static int ionic_intr_alloc(struct ionic_lif *lif, struct ionic_intr_info *intr)
- 	return 0;
- }
- 
--static void ionic_intr_free(struct ionic_lif *lif, int index)
-+static void ionic_intr_free(struct ionic *ionic, int index)
- {
--	if (index != INTR_INDEX_NOT_ASSIGNED && index < lif->ionic->nintrs)
--		clear_bit(index, lif->ionic->intrs);
-+	if (index != INTR_INDEX_NOT_ASSIGNED && index < ionic->nintrs)
-+		clear_bit(index, ionic->intrs);
- }
- 
- static int ionic_qcq_enable(struct ionic_qcq *qcq)
-@@ -289,7 +289,7 @@ static void ionic_qcq_free(struct ionic_lif *lif, struct ionic_qcq *qcq)
- 		irq_set_affinity_hint(qcq->intr.vector, NULL);
- 		devm_free_irq(dev, qcq->intr.vector, &qcq->napi);
- 		qcq->intr.vector = 0;
--		ionic_intr_free(lif, qcq->intr.index);
-+		ionic_intr_free(lif->ionic, qcq->intr.index);
- 	}
- 
- 	devm_kfree(dev, qcq->cq.info);
-@@ -333,7 +333,7 @@ static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
- 	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif, n_qcq->intr.index);
-+		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
- 		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
- 	}
- 
-@@ -485,7 +485,7 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 		devm_free_irq(dev, new->intr.vector, &new->napi);
- err_out_free_intr:
- 	if (flags & IONIC_QCQ_F_INTR)
--		ionic_intr_free(lif, new->intr.index);
-+		ionic_intr_free(lif->ionic, new->intr.index);
- err_out:
- 	dev_err(dev, "qcq alloc of %s%d failed %d\n", name, index, err);
- 	return err;
--- 
-2.39.2
-
diff --git a/queue-5.4/ionic-move-irq-request-to-qcq-alloc.patch b/queue-5.4/ionic-move-irq-request-to-qcq-alloc.patch
deleted file mode 100644
index 956ec94b82a..00000000000
--- a/queue-5.4/ionic-move-irq-request-to-qcq-alloc.patch
+++ /dev/null
@@ -1,140 +0,0 @@
-From 157c71022d07073d2f4d4e279fb05962e68e784c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 27 Mar 2020 20:14:44 -0700
-Subject: ionic: move irq request to qcq alloc
-
-From: Shannon Nelson <snelson@pensando.io>
-
-[ Upstream commit 0b0641009b8918c8d5f6e7ed300d569c9d811de5 ]
-
-Move the irq request and free out of the qcq_init and deinit
-and into the alloc and free routines where they belong for
-better resource management.
-
-Signed-off-by: Shannon Nelson <snelson@pensando.io>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: abfb2a58a537 ("ionic: remove WARN_ON to prevent panic_on_warn")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/pensando/ionic/ionic_lif.c   | 41 +++++++++----------
- 1 file changed, 19 insertions(+), 22 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index fa57a526b60f6..3fc9ac1e8b7b7 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -256,7 +256,6 @@ static int ionic_qcq_disable(struct ionic_qcq *qcq)
- static void ionic_lif_qcq_deinit(struct ionic_lif *lif, struct ionic_qcq *qcq)
- {
- 	struct ionic_dev *idev = &lif->ionic->idev;
--	struct device *dev = lif->ionic->dev;
- 
- 	if (!qcq)
- 		return;
-@@ -269,10 +268,7 @@ static void ionic_lif_qcq_deinit(struct ionic_lif *lif, struct ionic_qcq *qcq)
- 	if (qcq->flags & IONIC_QCQ_F_INTR) {
- 		ionic_intr_mask(idev->intr_ctrl, qcq->intr.index,
- 				IONIC_INTR_MASK_SET);
--		irq_set_affinity_hint(qcq->intr.vector, NULL);
--		devm_free_irq(dev, qcq->intr.vector, &qcq->napi);
- 		netif_napi_del(&qcq->napi);
--		qcq->intr.vector = 0;
- 	}
- 
- 	qcq->flags &= ~IONIC_QCQ_F_INITED;
-@@ -289,8 +285,12 @@ static void ionic_qcq_free(struct ionic_lif *lif, struct ionic_qcq *qcq)
- 	qcq->base = NULL;
- 	qcq->base_pa = 0;
- 
--	if (qcq->flags & IONIC_QCQ_F_INTR)
-+	if (qcq->flags & IONIC_QCQ_F_INTR) {
-+		irq_set_affinity_hint(qcq->intr.vector, NULL);
-+		devm_free_irq(dev, qcq->intr.vector, &qcq->napi);
-+		qcq->intr.vector = 0;
- 		ionic_intr_free(lif, qcq->intr.index);
-+	}
- 
- 	devm_kfree(dev, qcq->cq.info);
- 	qcq->cq.info = NULL;
-@@ -420,6 +420,12 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 		ionic_intr_mask_assert(idev->intr_ctrl, new->intr.index,
- 				       IONIC_INTR_MASK_SET);
- 
-+		err = ionic_request_irq(lif, new);
-+		if (err) {
-+			netdev_warn(lif->netdev, "irq request failed %d\n", err);
-+			goto err_out_free_intr;
-+		}
-+
- 		new->intr.cpu = cpumask_local_spread(new->intr.index,
- 						     dev_to_node(dev));
- 		if (new->intr.cpu != -1)
-@@ -434,13 +440,13 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 	if (!new->cq.info) {
- 		netdev_err(lif->netdev, "Cannot allocate completion queue info\n");
- 		err = -ENOMEM;
--		goto err_out_free_intr;
-+		goto err_out_free_irq;
- 	}
- 
- 	err = ionic_cq_init(lif, &new->cq, &new->intr, num_descs, cq_desc_size);
- 	if (err) {
- 		netdev_err(lif->netdev, "Cannot initialize completion queue\n");
--		goto err_out_free_intr;
-+		goto err_out_free_irq;
- 	}
- 
- 	new->base = dma_alloc_coherent(dev, total_size, &new->base_pa,
-@@ -448,7 +454,7 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 	if (!new->base) {
- 		netdev_err(lif->netdev, "Cannot allocate queue DMA memory\n");
- 		err = -ENOMEM;
--		goto err_out_free_intr;
-+		goto err_out_free_irq;
- 	}
- 
- 	new->total_size = total_size;
-@@ -474,8 +480,12 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
- 
- 	return 0;
- 
-+err_out_free_irq:
-+	if (flags & IONIC_QCQ_F_INTR)
-+		devm_free_irq(dev, new->intr.vector, &new->napi);
- err_out_free_intr:
--	ionic_intr_free(lif, new->intr.index);
-+	if (flags & IONIC_QCQ_F_INTR)
-+		ionic_intr_free(lif, new->intr.index);
- err_out:
- 	dev_err(dev, "qcq alloc of %s%d failed %d\n", name, index, err);
- 	return err;
-@@ -650,12 +660,6 @@ static int ionic_lif_rxq_init(struct ionic_lif *lif, struct ionic_qcq *qcq)
- 	netif_napi_add(lif->netdev, &qcq->napi, ionic_rx_napi,
- 		       NAPI_POLL_WEIGHT);
- 
--	err = ionic_request_irq(lif, qcq);
--	if (err) {
--		netif_napi_del(&qcq->napi);
--		return err;
--	}
--
- 	qcq->flags |= IONIC_QCQ_F_INITED;
- 
- 	ionic_debugfs_add_qcq(lif, qcq);
-@@ -1873,13 +1877,6 @@ static int ionic_lif_adminq_init(struct ionic_lif *lif)
- 	netif_napi_add(lif->netdev, &qcq->napi, ionic_adminq_napi,
- 		       NAPI_POLL_WEIGHT);
- 
--	err = ionic_request_irq(lif, qcq);
--	if (err) {
--		netdev_warn(lif->netdev, "adminq irq request failed %d\n", err);
--		netif_napi_del(&qcq->napi);
--		return err;
--	}
--
- 	napi_enable(&qcq->napi);
- 
- 	if (qcq->flags & IONIC_QCQ_F_INTR)
--- 
-2.39.2
-
diff --git a/queue-5.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch b/queue-5.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
deleted file mode 100644
index af5f8466274..00000000000
--- a/queue-5.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 113c4ac1bad18d282992e71eb7f76fa46d2d8a9e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 11:20:06 -0700
-Subject: ionic: remove WARN_ON to prevent panic_on_warn
-
-From: Nitya Sunkad <nitya.sunkad@amd.com>
-
-[ Upstream commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 ]
-
-Remove unnecessary early code development check and the WARN_ON
-that it uses.  The irq alloc and free paths have long been
-cleaned up and this check shouldn't have stuck around so long.
-
-Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
-Signed-off-by: Nitya Sunkad <nitya.sunkad@amd.com>
-Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 52d291383c233..d718c1a6d5fc7 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -332,11 +332,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif)
- static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
--	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
--		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
--	}
--
- 	n_qcq->intr.vector = src_qcq->intr.vector;
- 	n_qcq->intr.index = src_qcq->intr.index;
- }
--- 
-2.39.2
-
diff --git a/queue-5.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-5.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index 37e74ea8a7b..00000000000
--- a/queue-5.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From a5cdf1f335af33aa38bbf67ce4622dc786cb1828 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index a0123760fb2c7..46e3c939958bb 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -313,9 +313,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-5.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-5.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index 2d485172992..00000000000
--- a/queue-5.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From b16067bdb0ebf87601933839b3764c64ddc0bbdc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index 977c2961aa2c2..110221a16bf6d 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1422,7 +1422,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -3762,7 +3762,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-5.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch b/queue-5.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
deleted file mode 100644
index 61825887c73..00000000000
--- a/queue-5.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 1f32ffb150708bd9e10a0e84679ec8d6c3e7c3d6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 12:15:30 -0400
-Subject: net/sched: cls_fw: Fix improper refcount update leads to
- use-after-free
-
-From: M A Ramdhan <ramdhan@starlabs.sg>
-
-[ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ]
-
-In the event of a failure in tcf_change_indev(), fw_set_parms() will
-immediately return an error after incrementing or decrementing
-reference counter in tcf_bind_filter().  If attacker can control
-reference counter to zero and make reference freed, leading to
-use after free.
-
-In order to prevent this, move the point of possible failure above the
-point where the TC_FW_CLASSID is handled.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
-Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
-Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_fw.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
-index ec945294626a8..41f0898a5a565 100644
---- a/net/sched/cls_fw.c
-+++ b/net/sched/cls_fw.c
-@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_FW_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
--	}
--
- 	if (tb[TCA_FW_INDEV]) {
- 		int ret;
- 		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
-@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	} else if (head->mask != 0xFFFFFFFF)
- 		return err;
- 
-+	if (tb[TCA_FW_CLASSID]) {
-+		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
-+		tcf_bind_filter(tp, &f->res, base);
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch b/queue-5.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
deleted file mode 100644
index 845219a596c..00000000000
--- a/queue-5.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From f0e4752295b946e7bf100b3dd10d2626968e66f7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 10:08:09 +0300
-Subject: net/sched: flower: Ensure both minimum and maximum ports are
- specified
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit d3f87278bcb80bd7f9519669d928b43320363d4f ]
-
-The kernel does not currently validate that both the minimum and maximum
-ports of a port range are specified. This can lead user space to think
-that a filter matching on a port range was successfully added, when in
-fact it was not. For example, with a patched (buggy) iproute2 that only
-sends the minimum port, the following commands do not return an error:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
-
- # tc filter show dev swp1 ingress
- filter protocol ip pref 1 flower chain 0
- filter protocol ip pref 1 flower chain 0 handle 0x1
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 1 ref 1 bind 1
-
- filter protocol ip pref 1 flower chain 0 handle 0x2
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 2 ref 1 bind 1
-
-Fix by returning an error unless both ports are specified:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
- Error: Both min and max source ports must be specified.
- We have an error talking to the kernel
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
- Error: Both min and max destination ports must be specified.
- We have an error talking to the kernel
-
-Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Petr Machata <petrm@nvidia.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index f0010e4850eb6..c92318f68f92d 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -735,6 +735,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
-+	if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max destination ports must be specified");
-+		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max source ports must be specified");
-+		return -EINVAL;
-+	}
- 	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
- 	    htons(key->tp_range.tp_max.dst) <=
- 	    htons(key->tp_range.tp_min.dst)) {
--- 
-2.39.2
-
diff --git a/queue-5.4/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-5.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index eb049a499cb..00000000000
--- a/queue-5.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 9b66de5361a5a5387ec152b9d37fceb56fee8dca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 2d932834ed5bf..fd99650a2e229 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -131,7 +131,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-5.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-5.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index 0c8cc6a576c..00000000000
--- a/queue-5.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 2e98e6c87f04443127e5606b13ea075b6ef49577 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index abb37659de343..50983d77329ea 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1153,12 +1153,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-5.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index 6090eed3c9c..00000000000
--- a/queue-5.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 52c09ad833ec6fa1e44be33a1551a422a3678e2d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index dcf2346805350..a0091900b0cfb 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2908,6 +2908,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2915,7 +2916,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-5.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index 2e7486e1545..00000000000
--- a/queue-5.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 6a6c978dd2cf3ce1b4ca8012454c522d2142c785 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index bb57ec2390299..8d8739bff9f3c 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2065,12 +2065,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-5.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index 84059f98e54..00000000000
--- a/queue-5.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From cd15fb43ec3eaa15b043cecae779f693ef7e9ee7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 6301aa413c3b8..1f64146546221 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-5.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-5.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index e9bd3ce8837..00000000000
--- a/queue-5.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From afbb71de53d84a6a5469fd81b15266391e189cec Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index 00a5d5764993c..3cc0e8ebcdd5c 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -412,7 +412,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch b/queue-5.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
deleted file mode 100644
index 4a894ceda6d..00000000000
--- a/queue-5.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 202d5f392162a5bbd1d8ed12a371cfc74ebc500f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 18:11:54 +0300
-Subject: platform/x86: wmi: Break possible infinite loop when parsing GUID
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
-
-The while-loop may break on one of the two conditions, either ID string
-is empty or GUID matches. The second one, may never be reached if the
-parsed string is not correct GUID. In such a case the loop will never
-advance to check the next ID.
-
-Break possible infinite loop by factoring out guid_parse_and_compare()
-helper which may be moved to the generic header for everyone later on
-and preventing from similar mistake in the future.
-
-Interestingly that firstly it appeared when WMI was turned into a bus
-driver, but later when duplicated GUIDs were checked, the while-loop
-has been replaced by for-loop and hence no mistake made again.
-
-Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
-Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com
-Tested-by: Armin Wolf <W_Armin@gmx.de>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 22 ++++++++++++----------
- 1 file changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 8d1a7923c03b6..67c4ec554ada8 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -129,6 +129,16 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	return false;
- }
- 
-+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
-+{
-+	guid_t guid_input;
-+
-+	if (guid_parse(string, &guid_input))
-+		return false;
-+
-+	return guid_equal(&guid_input, guid);
-+}
-+
- static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
-@@ -141,11 +151,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
--		guid_t guid_input;
--
--		if (guid_parse(id->guid_string, &guid_input))
--			continue;
--		if (guid_equal(&wblock->gblock.guid, &guid_input))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return id->context;
- 		id++;
- 	}
-@@ -801,11 +807,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		guid_t driver_guid;
--
--		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
--			continue;
--		if (guid_equal(&driver_guid, &wblock->gblock.guid))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-fix-indentation-in-some-cases.patch b/queue-5.4/platform-x86-wmi-fix-indentation-in-some-cases.patch
deleted file mode 100644
index 2102a647561..00000000000
--- a/queue-5.4/platform-x86-wmi-fix-indentation-in-some-cases.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From e879a7db78a688c30bc440337341769a13faf12e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 23 Apr 2020 15:30:15 +0300
-Subject: platform/x86: wmi: Fix indentation in some cases
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 6701cc8f70710826a4de69cbb1f66c52db2c36ac ]
-
-There is no need to split lines as they perfectly fit 80 character limit.
-
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 62b146af35679..1aa29d594b7ab 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -1122,8 +1122,7 @@ static void wmi_free_devices(struct acpi_device *device)
- 	}
- }
- 
--static bool guid_already_parsed(struct acpi_device *device,
--				const u8 *guid)
-+static bool guid_already_parsed(struct acpi_device *device, const u8 *guid)
- {
- 	struct wmi_block *wblock;
- 
-@@ -1333,10 +1332,8 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 		wblock->handler(event, wblock->handler_data);
- 	}
- 
--	if (debug_event) {
--		pr_info("DEBUG Event GUID: %pUL\n",
--			wblock->gblock.guid);
--	}
-+	if (debug_event)
-+		pr_info("DEBUG Event GUID: %pUL\n", wblock->gblock.guid);
- 
- 	acpi_bus_generate_netlink_event(
- 		wblock->acpi_device->pnp.device_class,
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-move-variables.patch b/queue-5.4/platform-x86-wmi-move-variables.patch
deleted file mode 100644
index c1b574dcd64..00000000000
--- a/queue-5.4/platform-x86-wmi-move-variables.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 8fd2c43c42e8b4baaba5d9cdcd83836460096406 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:56:10 +0000
-Subject: platform/x86: wmi: move variables
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit f5431bf1e6781e876bdc8ae10fb1e7da6f1aa9b5 ]
-
-Move some variables in order to keep them
-in the narrowest possible scope.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-22-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 41a680b39f9d1..8d1a7923c03b6 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -133,7 +133,6 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
- 	const struct wmi_device_id *id;
--	guid_t guid_input;
- 
- 	if (wblock == NULL || wdriver == NULL)
- 		return NULL;
-@@ -142,6 +141,8 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
-+		guid_t guid_input;
-+
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
- 		if (guid_equal(&wblock->gblock.guid, &guid_input))
-@@ -612,7 +613,6 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- {
- 	struct acpi_object_list input;
- 	union acpi_object params[1];
--	struct guid_block *gblock;
- 	struct wmi_block *wblock;
- 
- 	input.count = 1;
-@@ -621,7 +621,7 @@ acpi_status wmi_get_event_data(u32 event, struct acpi_buffer *out)
- 	params[0].integer.value = event;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		gblock = &wblock->gblock;
-+		struct guid_block *gblock = &wblock->gblock;
- 
- 		if ((gblock->flags & ACPI_WMI_EVENT) &&
- 			(gblock->notify_id == event))
-@@ -1278,12 +1278,11 @@ acpi_wmi_ec_space_handler(u32 function, acpi_physical_address address,
- static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 				    void *context)
- {
--	struct guid_block *block;
- 	struct wmi_block *wblock;
- 	bool found_it = false;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		block = &wblock->gblock;
-+		struct guid_block *block = &wblock->gblock;
- 
- 		if (wblock->acpi_device->handle == handle &&
- 		    (block->flags & ACPI_WMI_EVENT) &&
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-remove-unnecessary-argument.patch b/queue-5.4/platform-x86-wmi-remove-unnecessary-argument.patch
deleted file mode 100644
index 368421c969e..00000000000
--- a/queue-5.4/platform-x86-wmi-remove-unnecessary-argument.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From ff057dce1ee797ad683ec89dfb6397527cbd1c70 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:16 +0000
-Subject: platform/x86: wmi: remove unnecessary argument
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 84eacf7e6413d5e2d2f4f9dddf9216c18a3631cf ]
-
-The GUID block is available for `wmi_create_device()`
-through `wblock->gblock`. Use that consistently in
-the function instead of using a mix of `gblock` and
-`wblock->gblock`.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-8-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 1aa29d594b7ab..7de866ca30e51 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -1039,7 +1039,6 @@ static const struct device_type wmi_type_data = {
- };
- 
- static int wmi_create_device(struct device *wmi_bus_dev,
--			     const struct guid_block *gblock,
- 			     struct wmi_block *wblock,
- 			     struct acpi_device *device)
- {
-@@ -1047,12 +1046,12 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	char method[5];
- 	int result;
- 
--	if (gblock->flags & ACPI_WMI_EVENT) {
-+	if (wblock->gblock.flags & ACPI_WMI_EVENT) {
- 		wblock->dev.dev.type = &wmi_type_event;
- 		goto out_init;
- 	}
- 
--	if (gblock->flags & ACPI_WMI_METHOD) {
-+	if (wblock->gblock.flags & ACPI_WMI_METHOD) {
- 		wblock->dev.dev.type = &wmi_type_method;
- 		mutex_init(&wblock->char_mutex);
- 		goto out_init;
-@@ -1102,7 +1101,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", gblock->guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1194,7 +1193,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		wblock->acpi_device = device;
- 		wblock->gblock = gblock[i];
- 
--		retval = wmi_create_device(wmi_bus_dev, &gblock[i], wblock, device);
-+		retval = wmi_create_device(wmi_bus_dev, wblock, device);
- 		if (retval) {
- 			kfree(wblock);
- 			continue;
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-replace-uuid-redefinitions-by-their.patch b/queue-5.4/platform-x86-wmi-replace-uuid-redefinitions-by-their.patch
deleted file mode 100644
index 88ab04faa04..00000000000
--- a/queue-5.4/platform-x86-wmi-replace-uuid-redefinitions-by-their.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From c9a6ff7affc212a596d7671d1c265748941228d5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 21 Apr 2017 16:36:06 +0300
-Subject: platform/x86: wmi: Replace UUID redefinitions by their originals
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit f9dffc1417130a2d465e2edaf6663d99738792a3 ]
-
-There are types and helpers that are redefined with old names.
-Convert the WMI library to use those types and helpers directly.
-
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 20 ++++++++++----------
- 1 file changed, 10 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index cb029126a68c6..62b146af35679 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -110,11 +110,11 @@ static struct platform_driver acpi_wmi_driver = {
- 
- static bool find_guid(const char *guid_string, struct wmi_block **out)
- {
--	uuid_le guid_input;
-+	guid_t guid_input;
- 	struct wmi_block *wblock;
- 	struct guid_block *block;
- 
--	if (uuid_le_to_bin(guid_string, &guid_input))
-+	if (guid_parse(guid_string, &guid_input))
- 		return false;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
-@@ -133,7 +133,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 				      struct wmi_driver *wdriver)
- {
- 	const struct wmi_device_id *id;
--	uuid_le guid_input;
-+	guid_t guid_input;
- 
- 	if (wblock == NULL || wdriver == NULL)
- 		return NULL;
-@@ -142,7 +142,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 
- 	id = wdriver->id_table;
- 	while (*id->guid_string) {
--		if (uuid_le_to_bin(id->guid_string, &guid_input))
-+		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
- 		if (!memcmp(wblock->gblock.guid, &guid_input, 16))
- 			return id->context;
-@@ -526,12 +526,12 @@ wmi_notify_handler handler, void *data)
- {
- 	struct wmi_block *block;
- 	acpi_status status = AE_NOT_EXIST;
--	uuid_le guid_input;
-+	guid_t guid_input;
- 
- 	if (!guid || !handler)
- 		return AE_BAD_PARAMETER;
- 
--	if (uuid_le_to_bin(guid, &guid_input))
-+	if (guid_parse(guid, &guid_input))
- 		return AE_BAD_PARAMETER;
- 
- 	list_for_each_entry(block, &wmi_block_list, list) {
-@@ -565,12 +565,12 @@ acpi_status wmi_remove_notify_handler(const char *guid)
- {
- 	struct wmi_block *block;
- 	acpi_status status = AE_NOT_EXIST;
--	uuid_le guid_input;
-+	guid_t guid_input;
- 
- 	if (!guid)
- 		return AE_BAD_PARAMETER;
- 
--	if (uuid_le_to_bin(guid, &guid_input))
-+	if (guid_parse(guid, &guid_input))
- 		return AE_BAD_PARAMETER;
- 
- 	list_for_each_entry(block, &wmi_block_list, list) {
-@@ -801,9 +801,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		uuid_le driver_guid;
-+		guid_t driver_guid;
- 
--		if (WARN_ON(uuid_le_to_bin(id->guid_string, &driver_guid)))
-+		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
- 			continue;
- 		if (!memcmp(&driver_guid, wblock->gblock.guid, 16))
- 			return 1;
--- 
-2.39.2
-
diff --git a/queue-5.4/platform-x86-wmi-use-guid_t-and-guid_equal.patch b/queue-5.4/platform-x86-wmi-use-guid_t-and-guid_equal.patch
deleted file mode 100644
index 907dbc5f3cf..00000000000
--- a/queue-5.4/platform-x86-wmi-use-guid_t-and-guid_equal.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From 709e8d534f129b213be59fd0bee783bd48565bb1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 4 Sep 2021 17:55:39 +0000
-Subject: platform/x86: wmi: use guid_t and guid_equal()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Barnabás Pőcze <pobrn@protonmail.com>
-
-[ Upstream commit 67f472fdacf4a691b1c3c20c27800b23ce31e2de ]
-
-Instead of hard-coding a 16 long byte array,
-use the available `guid_t` type and related methods.
-
-Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-Link: https://lore.kernel.org/r/20210904175450.156801-15-pobrn@protonmail.com
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Stable-dep-of: 028e6e204ace ("platform/x86: wmi: Break possible infinite loop when parsing GUID")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 7de866ca30e51..41a680b39f9d1 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -39,7 +39,7 @@ MODULE_LICENSE("GPL");
- static LIST_HEAD(wmi_block_list);
- 
- struct guid_block {
--	char guid[16];
-+	guid_t guid;
- 	union {
- 		char object_id[2];
- 		struct {
-@@ -120,7 +120,7 @@ static bool find_guid(const char *guid_string, struct wmi_block **out)
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
- 		block = &wblock->gblock;
- 
--		if (memcmp(block->guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->guid, &guid_input)) {
- 			if (out)
- 				*out = wblock;
- 			return true;
-@@ -144,7 +144,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 	while (*id->guid_string) {
- 		if (guid_parse(id->guid_string, &guid_input))
- 			continue;
--		if (!memcmp(wblock->gblock.guid, &guid_input, 16))
-+		if (guid_equal(&wblock->gblock.guid, &guid_input))
- 			return id->context;
- 		id++;
- 	}
-@@ -456,7 +456,7 @@ EXPORT_SYMBOL_GPL(wmi_set_block);
- 
- static void wmi_dump_wdg(const struct guid_block *g)
- {
--	pr_info("%pUL:\n", g->guid);
-+	pr_info("%pUL:\n", &g->guid);
- 	if (g->flags & ACPI_WMI_EVENT)
- 		pr_info("\tnotify_id: 0x%02X\n", g->notify_id);
- 	else
-@@ -537,7 +537,7 @@ wmi_notify_handler handler, void *data)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (block->handler &&
- 			    block->handler != wmi_notify_debug)
- 				return AE_ALREADY_ACQUIRED;
-@@ -576,7 +576,7 @@ acpi_status wmi_remove_notify_handler(const char *guid)
- 	list_for_each_entry(block, &wmi_block_list, list) {
- 		acpi_status wmi_status;
- 
--		if (memcmp(block->gblock.guid, &guid_input, 16) == 0) {
-+		if (guid_equal(&block->gblock.guid, &guid_input)) {
- 			if (!block->handler ||
- 			    block->handler == wmi_notify_debug)
- 				return AE_NULL_ENTRY;
-@@ -682,7 +682,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "wmi:%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "wmi:%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(modalias);
- 
-@@ -691,7 +691,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	return sprintf(buf, "%pUL\n", wblock->gblock.guid);
-+	return sprintf(buf, "%pUL\n", &wblock->gblock.guid);
- }
- static DEVICE_ATTR_RO(guid);
- 
-@@ -774,10 +774,10 @@ static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
- {
- 	struct wmi_block *wblock = dev_to_wblock(dev);
- 
--	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "MODALIAS=wmi:%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
--	if (add_uevent_var(env, "WMI_GUID=%pUL", wblock->gblock.guid))
-+	if (add_uevent_var(env, "WMI_GUID=%pUL", &wblock->gblock.guid))
- 		return -ENOMEM;
- 
- 	return 0;
-@@ -805,7 +805,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 
- 		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
- 			continue;
--		if (!memcmp(&driver_guid, wblock->gblock.guid, 16))
-+		if (guid_equal(&driver_guid, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
-@@ -1101,7 +1101,7 @@ static int wmi_create_device(struct device *wmi_bus_dev,
- 	wblock->dev.dev.bus = &wmi_bus_type;
- 	wblock->dev.dev.parent = wmi_bus_dev;
- 
--	dev_set_name(&wblock->dev.dev, "%pUL", wblock->gblock.guid);
-+	dev_set_name(&wblock->dev.dev, "%pUL", &wblock->gblock.guid);
- 
- 	device_initialize(&wblock->dev.dev);
- 
-@@ -1121,12 +1121,12 @@ static void wmi_free_devices(struct acpi_device *device)
- 	}
- }
- 
--static bool guid_already_parsed(struct acpi_device *device, const u8 *guid)
-+static bool guid_already_parsed(struct acpi_device *device, const guid_t *guid)
- {
- 	struct wmi_block *wblock;
- 
- 	list_for_each_entry(wblock, &wmi_block_list, list) {
--		if (memcmp(wblock->gblock.guid, guid, 16) == 0) {
-+		if (guid_equal(&wblock->gblock.guid, guid)) {
- 			/*
- 			 * Because we historically didn't track the relationship
- 			 * between GUIDs and ACPI nodes, we don't know whether
-@@ -1181,7 +1181,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		 * case yet, so for now, we'll just ignore the duplicate
- 		 * for device creation.
- 		 */
--		if (guid_already_parsed(device, gblock[i].guid))
-+		if (guid_already_parsed(device, &gblock[i].guid))
- 			continue;
- 
- 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
-@@ -1218,7 +1218,7 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
- 		retval = device_add(&wblock->dev.dev);
- 		if (retval) {
- 			dev_err(wmi_bus_dev, "failed to register %pUL\n",
--				wblock->gblock.guid);
-+				&wblock->gblock.guid);
- 			if (debug_event)
- 				wmi_method_enable(wblock, 0);
- 			list_del(&wblock->list);
-@@ -1332,7 +1332,7 @@ static void acpi_wmi_notify_handler(acpi_handle handle, u32 event,
- 	}
- 
- 	if (debug_event)
--		pr_info("DEBUG Event GUID: %pUL\n", wblock->gblock.guid);
-+		pr_info("DEBUG Event GUID: %pUL\n", &wblock->gblock.guid);
- 
- 	acpi_bus_generate_netlink_event(
- 		wblock->acpi_device->pnp.device_class,
--- 
-2.39.2
-
diff --git a/queue-5.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch b/queue-5.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
deleted file mode 100644
index 5cef55a89e9..00000000000
--- a/queue-5.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 49654d52e468856ea4004f6d3ac2178d67f99cfd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 13:58:47 +0300
-Subject: scsi: qla2xxx: Fix error code in qla2x00_start_sp()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 ]
-
-This should be negative -EAGAIN instead of positive.  The callers treat
-non-zero error codes the same so it doesn't really impact runtime beyond
-some trivial differences to debug output.
-
-Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
-index 103288b0377e0..cbdc84fdc52c1 100644
---- a/drivers/scsi/qla2xxx/qla_iocb.c
-+++ b/drivers/scsi/qla2xxx/qla_iocb.c
-@@ -3665,7 +3665,7 @@ qla2x00_start_sp(srb_t *sp)
- 	spin_lock_irqsave(qp->qp_lock_ptr, flags);
- 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
- 	if (!pkt) {
--		rval = EAGAIN;
-+		rval = -EAGAIN;
- 		ql_log(ql_log_warn, vha, 0x700c,
- 		    "qla2x00_alloc_iocbs failed.\n");
- 		goto done;
--- 
-2.39.2
-
diff --git a/queue-5.4/series b/queue-5.4/series
index 8e3d4b51fee..221b039e194 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -191,35 +191,3 @@ netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
 netfilter-conntrack-avoid-nf_ct_helper_hash-uses-after-free.patch
 netfilter-nf_tables-prevent-oob-access-in-nft_byteorder_eval.patch
 tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platform.patch
-drm-panel-initialise-panel-dev-and-funcs-through-drm.patch
-drm-panel-add-and-fill-drm_panel-type-field.patch
-drm-panel-simple-add-connector_type-for-innolux_at04.patch
-igc-remove-delay-during-tx-ring-configuration.patch
-igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
-scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
-ionic-improve-irq-numa-locality.patch
-ionic-clean-irq-affinity-on-queue-deinit.patch
-ionic-move-irq-request-to-qcq-alloc.patch
-ionic-ionic_intr_free-parameter-change.patch
-ionic-remove-warn_on-to-prevent-panic_on_warn.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-platform-x86-wmi-replace-uuid-redefinitions-by-their.patch
-platform-x86-wmi-fix-indentation-in-some-cases.patch
-platform-x86-wmi-remove-unnecessary-argument.patch
-platform-x86-wmi-use-guid_t-and-guid_equal.patch
-platform-x86-wmi-move-variables.patch
-platform-x86-wmi-break-possible-infinite-loop-when-p.patch
-erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-cls_flower-add-extack-support-for-src-and-dst-port-r.patch
-net-sched-flower-ensure-both-minimum-and-maximum-por.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
diff --git a/queue-5.4/udp6-fix-udp6_ehashfn-typo.patch b/queue-5.4/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index ce9107975b6..00000000000
--- a/queue-5.4/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From a7d9235386176f89cbf5c25a4186b73b60a03f66 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 797d45ceb2c74..93eb622219756 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -87,7 +87,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-5.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-5.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index dbdf1d55d51..00000000000
--- a/queue-5.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 30e1defc749aedf9906d96856cf4526fbbfe2d5b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index da0d3834b5f01..ebf0d3072290e 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6104,8 +6104,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-6.1/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch b/queue-6.1/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
deleted file mode 100644
index 8fa6d007be2..00000000000
--- a/queue-6.1/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 001e59f3c22f0560e8378bf0c2acca66255f7ff6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 23:11:39 -0700
-Subject: blk-crypto: use dynamic lock class for blk_crypto_profile::lock
-
-From: Eric Biggers <ebiggers@google.com>
-
-[ Upstream commit 2fb48d88e77f29bf9d278f25bcfe82cf59a0e09b ]
-
-When a device-mapper device is passing through the inline encryption
-support of an underlying device, calls to blk_crypto_evict_key() take
-the blk_crypto_profile::lock of the device-mapper device, then take the
-blk_crypto_profile::lock of the underlying device (nested).  This isn't
-a real deadlock, but it causes a lockdep report because there is only
-one lock class for all instances of this lock.
-
-Lockdep subclasses don't really work here because the hierarchy of block
-devices is dynamic and could have more than 2 levels.
-
-Instead, register a dynamic lock class for each blk_crypto_profile, and
-associate that with the lock.
-
-This avoids false-positive lockdep reports like the following:
-
-    ============================================
-    WARNING: possible recursive locking detected
-    6.4.0-rc5 #2 Not tainted
-    --------------------------------------------
-    fscryptctl/1421 is trying to acquire lock:
-    ffffff80829ca418 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0x44/0x1c0
-
-                   but task is already holding lock:
-    ffffff8086b68ca8 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0xc8/0x1c0
-
-                   other info that might help us debug this:
-     Possible unsafe locking scenario:
-
-           CPU0
-           ----
-      lock(&profile->lock);
-      lock(&profile->lock);
-
-                    *** DEADLOCK ***
-
-     May be due to missing lock nesting notation
-
-Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption")
-Reported-by: Bart Van Assche <bvanassche@acm.org>
-Signed-off-by: Eric Biggers <ebiggers@google.com>
-Reviewed-by: Bart Van Assche <bvanassche@acm.org>
-Link: https://lore.kernel.org/r/20230610061139.212085-1-ebiggers@kernel.org
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-crypto-profile.c         | 12 ++++++++++--
- include/linux/blk-crypto-profile.h |  1 +
- 2 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/block/blk-crypto-profile.c b/block/blk-crypto-profile.c
-index 3290c03c9918d..aa7fc1436893c 100644
---- a/block/blk-crypto-profile.c
-+++ b/block/blk-crypto-profile.c
-@@ -79,7 +79,14 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile,
- 	unsigned int slot_hashtable_size;
- 
- 	memset(profile, 0, sizeof(*profile));
--	init_rwsem(&profile->lock);
-+
-+	/*
-+	 * profile->lock of an underlying device can nest inside profile->lock
-+	 * of a device-mapper device, so use a dynamic lock class to avoid
-+	 * false-positive lockdep reports.
-+	 */
-+	lockdep_register_key(&profile->lockdep_key);
-+	__init_rwsem(&profile->lock, "&profile->lock", &profile->lockdep_key);
- 
- 	if (num_slots == 0)
- 		return 0;
-@@ -89,7 +96,7 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile,
- 	profile->slots = kvcalloc(num_slots, sizeof(profile->slots[0]),
- 				  GFP_KERNEL);
- 	if (!profile->slots)
--		return -ENOMEM;
-+		goto err_destroy;
- 
- 	profile->num_slots = num_slots;
- 
-@@ -441,6 +448,7 @@ void blk_crypto_profile_destroy(struct blk_crypto_profile *profile)
- {
- 	if (!profile)
- 		return;
-+	lockdep_unregister_key(&profile->lockdep_key);
- 	kvfree(profile->slot_hashtable);
- 	kvfree_sensitive(profile->slots,
- 			 sizeof(profile->slots[0]) * profile->num_slots);
-diff --git a/include/linux/blk-crypto-profile.h b/include/linux/blk-crypto-profile.h
-index e6802b69cdd64..90ab33cb5d0ef 100644
---- a/include/linux/blk-crypto-profile.h
-+++ b/include/linux/blk-crypto-profile.h
-@@ -111,6 +111,7 @@ struct blk_crypto_profile {
- 	 * keyslots while ensuring that they can't be changed concurrently.
- 	 */
- 	struct rw_semaphore lock;
-+	struct lock_class_key lockdep_key;
- 
- 	/* List of idle slots, with least recently used slot at front */
- 	wait_queue_head_t idle_slots_wait_queue;
--- 
-2.39.2
-
diff --git a/queue-6.1/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch b/queue-6.1/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
deleted file mode 100644
index ba289b9d4f2..00000000000
--- a/queue-6.1/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From 7dd7b5690a5af8d39e4179235e3f8c29b2c8d39c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 19:58:48 +0800
-Subject: bpf: cpumap: Fix memory leak in cpu_map_update_elem
-
-From: Pu Lehui <pulehui@huawei.com>
-
-[ Upstream commit 4369016497319a9635702da010d02af1ebb1849d ]
-
-Syzkaller reported a memory leak as follows:
-
-BUG: memory leak
-unreferenced object 0xff110001198ef748 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00  ....J...........
-    00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff  ........(.......
-  backtrace:
-    [<ffffffffadd28087>] __cpu_map_entry_alloc+0xf7/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff110001198ef528 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-  backtrace:
-    [<ffffffffadd281f0>] __cpu_map_entry_alloc+0x260/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff1100010fd93d68 (size 8):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 8 bytes):
-    00 00 00 00 00 00 00 00                          ........
-  backtrace:
-    [<ffffffffade5db3e>] kvmalloc_node+0x11e/0x170
-    [<ffffffffadd28280>] __cpu_map_entry_alloc+0x2f0/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-In the cpu_map_update_elem flow, when kthread_stop is called before
-calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit
-of kthread has been set by kthread_stop, the threadfn of rcpu->kthread
-will never be executed, and rcpu->refcnt will never be 0, which will
-lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be
-released.
-
-Calling kthread_stop before executing kthread's threadfn will return
--EINTR. We can complete the release of memory resources in this state.
-
-Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
-Signed-off-by: Pu Lehui <pulehui@huawei.com>
-Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
-Acked-by: Hou Tao <houtao1@huawei.com>
-Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/cpumap.c | 40 ++++++++++++++++++++++++----------------
- 1 file changed, 24 insertions(+), 16 deletions(-)
-
-diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
-index b5ba34ddd4b64..09141351d5457 100644
---- a/kernel/bpf/cpumap.c
-+++ b/kernel/bpf/cpumap.c
-@@ -127,22 +127,6 @@ static void get_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	atomic_inc(&rcpu->refcnt);
- }
- 
--/* called from workqueue, to workaround syscall using preempt_disable */
--static void cpu_map_kthread_stop(struct work_struct *work)
--{
--	struct bpf_cpu_map_entry *rcpu;
--
--	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
--
--	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
--	 * as it waits until all in-flight call_rcu() callbacks complete.
--	 */
--	rcu_barrier();
--
--	/* kthread_stop will wake_up_process and wait for it to complete */
--	kthread_stop(rcpu->kthread);
--}
--
- static void __cpu_map_ring_cleanup(struct ptr_ring *ring)
- {
- 	/* The tear-down procedure should have made sure that queue is
-@@ -170,6 +154,30 @@ static void put_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	}
- }
- 
-+/* called from workqueue, to workaround syscall using preempt_disable */
-+static void cpu_map_kthread_stop(struct work_struct *work)
-+{
-+	struct bpf_cpu_map_entry *rcpu;
-+	int err;
-+
-+	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
-+
-+	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
-+	 * as it waits until all in-flight call_rcu() callbacks complete.
-+	 */
-+	rcu_barrier();
-+
-+	/* kthread_stop will wake_up_process and wait for it to complete */
-+	err = kthread_stop(rcpu->kthread);
-+	if (err) {
-+		/* kthread_stop may be called before cpu_map_kthread_run
-+		 * is executed, so we need to release the memory related
-+		 * to rcpu.
-+		 */
-+		put_cpu_map_entry(rcpu);
-+	}
-+}
-+
- static void cpu_map_bpf_prog_run_skb(struct bpf_cpu_map_entry *rcpu,
- 				     struct list_head *listp,
- 				     struct xdp_cpumap_stats *stats)
--- 
-2.39.2
-
diff --git a/queue-6.1/bpf-fix-max-stack-depth-check-for-async-callbacks.patch b/queue-6.1/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
deleted file mode 100644
index cd27b5b2ecc..00000000000
--- a/queue-6.1/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 629021e337dc94d5ec14f7bf5446f42484a771b0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 20:17:29 +0530
-Subject: bpf: Fix max stack depth check for async callbacks
-
-From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-
-[ Upstream commit 5415ccd50a8620c8cbaa32d6f18c946c453566f5 ]
-
-The check_max_stack_depth pass happens after the verifier's symbolic
-execution, and attempts to walk the call graph of the BPF program,
-ensuring that the stack usage stays within bounds for all possible call
-chains. There are two cases to consider: bpf_pseudo_func and
-bpf_pseudo_call. In the former case, the callback pointer is loaded into
-a register, and is assumed that it is passed to some helper later which
-calls it (however there is no way to be sure), but the check remains
-conservative and accounts the stack usage anyway. For this particular
-case, asynchronous callbacks are skipped as they execute asynchronously
-when their corresponding event fires.
-
-The case of bpf_pseudo_call is simpler and we know that the call is
-definitely made, hence the stack depth of the subprog is accounted for.
-
-However, the current check still skips an asynchronous callback even if
-a bpf_pseudo_call was made for it. This is erroneous, as it will miss
-accounting for the stack usage of the asynchronous callback, which can
-be used to breach the maximum stack depth limit.
-
-Fix this by only skipping asynchronous callbacks when the instruction is
-not a pseudo call to the subprog.
-
-Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.")
-Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-Link: https://lore.kernel.org/r/20230705144730.235802-2-memxor@gmail.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/verifier.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index 49c6b5e0855cd..8c3ededef3172 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -4357,8 +4357,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
- 				verbose(env, "verifier bug. subprog has tail_call and async cb\n");
- 				return -EFAULT;
- 			}
--			 /* async callbacks don't increase bpf prog stack size */
--			continue;
-+			/* async callbacks don't increase bpf prog stack size unless called directly */
-+			if (!bpf_pseudo_call(insn + i))
-+				continue;
- 		}
- 		i = next_insn;
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch b/queue-6.1/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
deleted file mode 100644
index ea6c6c756ea..00000000000
--- a/queue-6.1/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From f0b080c9bf0bbc1647af4ded16c4222153ea047c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 13 Jun 2023 06:58:13 -0700
-Subject: drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
-
-From: Douglas Anderson <dianders@chromium.org>
-
-[ Upstream commit 7aa83fbd712a6f08ffa67890061f26d140c2a84f ]
-
-Memory for the "struct device" for any given device isn't supposed to
-be released until the device's release() is called. This is important
-because someone might be holding a kobject reference to the "struct
-device" and might try to access one of its members even after any
-other cleanup/uninitialization has happened.
-
-Code analysis of ti-sn65dsi86 shows that this isn't quite right. When
-the code was written, it was believed that we could rely on the fact
-that the child devices would all be freed before the parent devices
-and thus we didn't need to worry about a release() function. While I
-still believe that the parent's "struct device" is guaranteed to
-outlive the child's "struct device" (because the child holds a kobject
-reference to the parent), the parent's "devm" allocated memory is a
-different story. That appears to be freed much earlier.
-
-Let's make this better for ti-sn65dsi86 by allocating each auxiliary
-with kzalloc and then free that memory in the release().
-
-Fixes: bf73537f411b ("drm/bridge: ti-sn65dsi86: Break GPIO and MIPI-to-eDP bridge into sub-drivers")
-Suggested-by: Stephen Boyd <swboyd@chromium.org>
-Reviewed-by: Stephen Boyd <swboyd@chromium.org>
-Signed-off-by: Douglas Anderson <dianders@chromium.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230613065812.v2.1.I24b838a5b4151fb32bccd6f36397998ea2df9fbb@changeid
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 35 +++++++++++++++++----------
- 1 file changed, 22 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-index d16775c973c4e..b89f7f7ca1885 100644
---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-@@ -170,10 +170,10 @@
-  * @pwm_refclk_freq: Cache for the reference clock input to the PWM.
-  */
- struct ti_sn65dsi86 {
--	struct auxiliary_device		bridge_aux;
--	struct auxiliary_device		gpio_aux;
--	struct auxiliary_device		aux_aux;
--	struct auxiliary_device		pwm_aux;
-+	struct auxiliary_device		*bridge_aux;
-+	struct auxiliary_device		*gpio_aux;
-+	struct auxiliary_device		*aux_aux;
-+	struct auxiliary_device		*pwm_aux;
- 
- 	struct device			*dev;
- 	struct regmap			*regmap;
-@@ -468,27 +468,34 @@ static void ti_sn65dsi86_delete_aux(void *data)
- 	auxiliary_device_delete(data);
- }
- 
--/*
-- * AUX bus docs say that a non-NULL release is mandatory, but it makes no
-- * sense for the model used here where all of the aux devices are allocated
-- * in the single shared structure. We'll use this noop as a workaround.
-- */
--static void ti_sn65dsi86_noop(struct device *dev) {}
-+static void ti_sn65dsi86_aux_device_release(struct device *dev)
-+{
-+	struct auxiliary_device *aux = container_of(dev, struct auxiliary_device, dev);
-+
-+	kfree(aux);
-+}
- 
- static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
--				       struct auxiliary_device *aux,
-+				       struct auxiliary_device **aux_out,
- 				       const char *name)
- {
- 	struct device *dev = pdata->dev;
-+	struct auxiliary_device *aux;
- 	int ret;
- 
-+	aux = kzalloc(sizeof(*aux), GFP_KERNEL);
-+	if (!aux)
-+		return -ENOMEM;
-+
- 	aux->name = name;
- 	aux->dev.parent = dev;
--	aux->dev.release = ti_sn65dsi86_noop;
-+	aux->dev.release = ti_sn65dsi86_aux_device_release;
- 	device_set_of_node_from_dev(&aux->dev, dev);
- 	ret = auxiliary_device_init(aux);
--	if (ret)
-+	if (ret) {
-+		kfree(aux);
- 		return ret;
-+	}
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_uninit_aux, aux);
- 	if (ret)
- 		return ret;
-@@ -497,6 +504,8 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
- 	if (ret)
- 		return ret;
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_delete_aux, aux);
-+	if (!ret)
-+		*aux_out = aux;
- 
- 	return ret;
- }
--- 
-2.39.2
-
diff --git a/queue-6.1/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch b/queue-6.1/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
deleted file mode 100644
index 24be09aa224..00000000000
--- a/queue-6.1/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 8904663c93f143e08f994361105e4c026edf709c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 17:10:17 +0300
-Subject: drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
-
-[ Upstream commit 5c413188c68da0e4bffc93de1c80257e20741e69 ]
-
-If we are using Bigjoiner dpll_hw_state is supposed to be exactly
-same as for master crtc, so no need to save it's state for slave crtc.
-
-Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
-Fixes: 0ff0e219d9b8 ("drm/i915: Compute clocks earlier")
-Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230628141017.18937-1-stanislav.lisovskiy@intel.com
-(cherry picked from commit cbaf758809952c95ec00e796695049babb08bb60)
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/i915/display/intel_display.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
-index 455d9ae6c41c9..da9b995b54c8f 100644
---- a/drivers/gpu/drm/i915/display/intel_display.c
-+++ b/drivers/gpu/drm/i915/display/intel_display.c
-@@ -5133,7 +5133,6 @@ copy_bigjoiner_crtc_state_modeset(struct intel_atomic_state *state,
- 	saved_state->uapi = slave_crtc_state->uapi;
- 	saved_state->scaler_state = slave_crtc_state->scaler_state;
- 	saved_state->shared_dpll = slave_crtc_state->shared_dpll;
--	saved_state->dpll_hw_state = slave_crtc_state->dpll_hw_state;
- 	saved_state->crc_enabled = slave_crtc_state->crc_enabled;
- 
- 	intel_crtc_free_hw_state(slave_crtc_state);
--- 
-2.39.2
-
diff --git a/queue-6.1/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch b/queue-6.1/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
deleted file mode 100644
index c18eea90865..00000000000
--- a/queue-6.1/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From af77ab19f6ed0aaca5fe1aedcbf30b39aa643961 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 13:55:03 +0100
-Subject: drm/i915: Fix one wrong caching mode enum usage
-
-From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-
-[ Upstream commit 113899c2669dff148b2a5bea4780123811aecc13 ]
-
-Commit a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch
-buffer") mistakenly passed in uapi I915_CACHING_CACHED as argument to
-i915_gem_object_set_cache_coherency(), which actually takes internal
-enum i915_cache_level.
-
-No functional issue since the value matches I915_CACHE_LLC (1 == 1), which
-is the intended caching mode, but lets clean it up nevertheless.
-
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Fixes: a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch buffer")
-Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
-Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230707125503.3965817-1-tvrtko.ursulin@linux.intel.com
-(cherry picked from commit 49c60b2f0867ac36fd54d513882a48431aeccae7)
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/i915/gt/intel_gtt.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/gt/intel_gtt.c b/drivers/gpu/drm/i915/gt/intel_gtt.c
-index 2eaeba14319e9..f4879f437bfa3 100644
---- a/drivers/gpu/drm/i915/gt/intel_gtt.c
-+++ b/drivers/gpu/drm/i915/gt/intel_gtt.c
-@@ -611,7 +611,7 @@ __vm_create_scratch_for_read(struct i915_address_space *vm, unsigned long size)
- 	if (IS_ERR(obj))
- 		return ERR_CAST(obj);
- 
--	i915_gem_object_set_cache_coherency(obj, I915_CACHING_CACHED);
-+	i915_gem_object_set_cache_coherency(obj, I915_CACHE_LLC);
- 
- 	vma = i915_vma_instance(obj, vm, NULL);
- 	if (IS_ERR(vma)) {
--- 
-2.39.2
-
diff --git a/queue-6.1/drm-panel-simple-add-connector_type-for-innolux_at04.patch b/queue-6.1/drm-panel-simple-add-connector_type-for-innolux_at04.patch
deleted file mode 100644
index 9ebf73768d8..00000000000
--- a/queue-6.1/drm-panel-simple-add-connector_type-for-innolux_at04.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From fbc486a8ab2fc5a60890acd817ecaf9dc6abb97e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 08:22:02 -0300
-Subject: drm/panel: simple: Add connector_type for innolux_at043tn24
-
-From: Fabio Estevam <festevam@denx.de>
-
-[ Upstream commit 2c56a751845ddfd3078ebe79981aaaa182629163 ]
-
-The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type'
-information to avoid the following warning:
-
-panel-simple panel: Specify missing connector_type
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24")
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index 7ca00b0323362..e49d352339ff8 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2117,6 +2117,7 @@ static const struct panel_desc innolux_at043tn24 = {
- 		.height = 54,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
-+	.connector_type = DRM_MODE_CONNECTOR_DPI,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch b/queue-6.1/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
deleted file mode 100644
index e544f472d20..00000000000
--- a/queue-6.1/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 202fd1cdf183a7a28f2c6f0238e9f598b00352a4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 22:16:02 +0200
-Subject: drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
-
-From: Marek Vasut <marex@denx.de>
-
-[ Upstream commit 1c519980aced3da1fae37c1339cf43b24eccdee7 ]
-
-Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC
-flags. Those are used by various bridges in the pipeline to correctly
-configure its sync signals polarity.
-
-Fixes: d69de69f2be1 ("drm/panel: simple: Add Powertip PH800480T013 panel")
-Signed-off-by: Marek Vasut <marex@denx.de>
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230615201602.565948-1-marex@denx.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index e49d352339ff8..f851aaf2c5917 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3110,6 +3110,7 @@ static const struct drm_display_mode powertip_ph800480t013_idf02_mode = {
- 	.vsync_start = 480 + 49,
- 	.vsync_end = 480 + 49 + 2,
- 	.vtotal = 480 + 49 + 2 + 22,
-+	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
- };
- 
- static const struct panel_desc powertip_ph800480t013_idf02  = {
--- 
-2.39.2
-
diff --git a/queue-6.1/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch b/queue-6.1/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
deleted file mode 100644
index fb1554539af..00000000000
--- a/queue-6.1/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 4321b4202567033173fa81cb819ed58544ae9b38 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 17:34:10 +0800
-Subject: erofs: avoid infinite loop in z_erofs_do_read_page() when reading
- beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ]
-
-z_erofs_do_read_page() may loop infinitely due to the inappropriate
-truncation in the below statement. Since the offset is 64 bits and min_t()
-truncates the result to 32 bits. The solution is to replace unsigned int
-with a 64-bit type, such as erofs_off_t.
-    cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-
-    - For example:
-        - offset = 0x400160000
-        - end = 0x370
-        - map->m_la = 0x160370
-        - offset + end - map->m_la = 0x400000000
-        - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
-    - Expected result:
-        - cur = 0
-    - Actual result:
-        - cur = 0x370
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index bf6a369f9c696..533e612b6a486 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -866,7 +866,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 	 */
- 	tight &= (fe->mode > Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
- 
--	cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-+	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
- 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
- 		zero_user_segment(page, cur, end);
- 		goto next_part;
--- 
-2.39.2
-
diff --git a/queue-6.1/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch b/queue-6.1/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
deleted file mode 100644
index 2c86e11c50c..00000000000
--- a/queue-6.1/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 7c3875a4dd9a05d9ab6ada7ab1fa2ea5e83926bd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 12:25:31 +0800
-Subject: erofs: avoid useless loops in z_erofs_pcluster_readmore() when
- reading beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 936aa701d82d397c2d1afcd18ce2c739471d978d ]
-
-z_erofs_pcluster_readmore() may take a long time to loop when the page
-offset is large enough, which is unnecessary should be prevented.
-
-For example, when the following case is encountered, it will loop 4691368
-times, taking about 27 seconds:
-    - offset = 19217289215
-    - inode_size = 1442672
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Yue Hu <huyue2@coolpad.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710042531.28761-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index 92b2e4ddb7ce9..bf6a369f9c696 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -1660,7 +1660,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_decompress_frontend *f,
- 	}
- 
- 	cur = map->m_la + map->m_llen - 1;
--	while (cur >= end) {
-+	while ((cur >= end) && (cur < i_size_read(inode))) {
- 		pgoff_t index = cur >> PAGE_SHIFT;
- 		struct page *page;
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch b/queue-6.1/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
deleted file mode 100644
index 2aeb2fcea38..00000000000
--- a/queue-6.1/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 105663b0f62d1b5cf58993ea946c5aab4f8b49c3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 14:21:30 +0800
-Subject: erofs: fix fsdax unavailability for chunk-based regular files
-
-From: Xin Yin <yinxin.x@bytedance.com>
-
-[ Upstream commit 18bddc5b67038722cb88fcf51fbf41a0277092cb ]
-
-DAX can be used to share page cache between VMs, reducing guest memory
-overhead. And chunk based data format is widely used for VM and
-container image. So enable dax support for it, make erofs better used
-for VM scenarios.
-
-Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
-Signed-off-by: Xin Yin <yinxin.x@bytedance.com>
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230711062130.7860-1-yinxin.x@bytedance.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/inode.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
-index 5aadc73d57652..e090bcd46db14 100644
---- a/fs/erofs/inode.c
-+++ b/fs/erofs/inode.c
-@@ -186,7 +186,8 @@ static void *erofs_read_inode(struct erofs_buf *buf,
- 
- 	inode->i_flags &= ~S_DAX;
- 	if (test_opt(&sbi->opt, DAX_ALWAYS) && S_ISREG(inode->i_mode) &&
--	    vi->datalayout == EROFS_INODE_FLAT_PLAIN)
-+	    (vi->datalayout == EROFS_INODE_FLAT_PLAIN ||
-+	     vi->datalayout == EROFS_INODE_CHUNK_BASED))
- 		inode->i_flags |= S_DAX;
- 	if (!nblks)
- 		/* measure inode.i_blocks as generic filesystems */
--- 
-2.39.2
-
diff --git a/queue-6.1/gve-set-default-duplex-configuration-to-full.patch b/queue-6.1/gve-set-default-duplex-configuration-to-full.patch
deleted file mode 100644
index dc9c6fa32a2..00000000000
--- a/queue-6.1/gve-set-default-duplex-configuration-to-full.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 44c1e1654c5421636043f5ca657491f8f9658bf0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 12:41:28 +0800
-Subject: gve: Set default duplex configuration to full
-
-From: Junfeng Guo <junfeng.guo@intel.com>
-
-[ Upstream commit 0503efeadbf6bb8bf24397613a73b67e665eac5f ]
-
-Current duplex mode was unset in the driver, resulting in the default
-parameter being set to 0, which corresponds to half duplex. It might
-mislead users to have incorrect expectation about the driver's
-transmission capabilities.
-Set the default duplex configuration to full, as the driver runs in
-full duplex mode at this point.
-
-Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.")
-Signed-off-by: Junfeng Guo <junfeng.guo@intel.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Message-ID: <20230706044128.2726747-1-junfeng.guo@intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/google/gve/gve_ethtool.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
-index 38df602f2869c..033f17cb96be0 100644
---- a/drivers/net/ethernet/google/gve/gve_ethtool.c
-+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
-@@ -541,6 +541,9 @@ static int gve_get_link_ksettings(struct net_device *netdev,
- 		err = gve_adminq_report_link_speed(priv);
- 
- 	cmd->base.speed = priv->link_speed;
-+
-+	cmd->base.duplex = DUPLEX_FULL;
-+
- 	return err;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch b/queue-6.1/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
deleted file mode 100644
index d6629274b81..00000000000
--- a/queue-6.1/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 0197e963bf602a4769b8fd245d427b957dd2a121 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 17:40:23 -0700
-Subject: ice: Fix max_rate check while configuring TX rate limits
-
-From: Sridhar Samudrala <sridhar.samudrala@intel.com>
-
-[ Upstream commit 5f16da6ee6ac32e6c8098bc4cfcc4f170694f9da ]
-
-Remove incorrect check in ice_validate_mqprio_opt() that limits
-filter configuration when sum of max_rates of all TCs exceeds
-the link speed. The max rate of each TC is unrelated to value
-used by other TCs and is valid as long as it is less than link
-speed.
-
-Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc")
-Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
-Signed-off-by: Sudheer Mogilappagari <sudheer.mogilappagari@intel.com>
-Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
-index 7a5ec3ce3407a..8f77088900e94 100644
---- a/drivers/net/ethernet/intel/ice/ice_main.c
-+++ b/drivers/net/ethernet/intel/ice/ice_main.c
-@@ -7852,10 +7852,10 @@ static int
- ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 			 struct tc_mqprio_qopt_offload *mqprio_qopt)
- {
--	u64 sum_max_rate = 0, sum_min_rate = 0;
- 	int non_power_of_2_qcount = 0;
- 	struct ice_pf *pf = vsi->back;
- 	int max_rss_q_cnt = 0;
-+	u64 sum_min_rate = 0;
- 	struct device *dev;
- 	int i, speed;
- 	u8 num_tc;
-@@ -7871,6 +7871,7 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 	dev = ice_pf_to_dev(pf);
- 	vsi->ch_rss_size = 0;
- 	num_tc = mqprio_qopt->qopt.num_tc;
-+	speed = ice_get_link_speed_kbps(vsi);
- 
- 	for (i = 0; num_tc; i++) {
- 		int qcount = mqprio_qopt->qopt.count[i];
-@@ -7911,7 +7912,6 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 		 */
- 		max_rate = mqprio_qopt->max_rate[i];
- 		max_rate = div_u64(max_rate, ICE_BW_KBPS_DIVISOR);
--		sum_max_rate += max_rate;
- 
- 		/* min_rate is minimum guaranteed rate and it can't be zero */
- 		min_rate = mqprio_qopt->min_rate[i];
-@@ -7924,6 +7924,12 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 			return -EINVAL;
- 		}
- 
-+		if (max_rate && max_rate > speed) {
-+			dev_err(dev, "TC%d: max_rate(%llu Kbps) > link speed of %u Kbps\n",
-+				i, max_rate, speed);
-+			return -EINVAL;
-+		}
-+
- 		iter_div_u64_rem(min_rate, ICE_MIN_BW_LIMIT, &rem);
- 		if (rem) {
- 			dev_err(dev, "TC%d: Min Rate not multiple of %u Kbps",
-@@ -7961,12 +7967,6 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 	    (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i]))
- 		return -EINVAL;
- 
--	speed = ice_get_link_speed_kbps(vsi);
--	if (sum_max_rate && sum_max_rate > (u64)speed) {
--		dev_err(dev, "Invalid max Tx rate(%llu) Kbps > speed(%u) Kbps specified\n",
--			sum_max_rate, speed);
--		return -EINVAL;
--	}
- 	if (sum_min_rate && sum_min_rate > (u64)speed) {
- 		dev_err(dev, "Invalid min Tx rate(%llu) Kbps > speed (%u) Kbps specified\n",
- 			sum_min_rate, speed);
--- 
-2.39.2
-
diff --git a/queue-6.1/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-6.1/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index 8a44179e5b6..00000000000
--- a/queue-6.1/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From bc87d431a818780513bdb58a18be88e653cb3a49 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index 9d92d51c47577..e2af7ab992821 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -422,7 +422,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/igc-fix-inserting-of-empty-frame-for-launchtime.patch b/queue-6.1/igc-fix-inserting-of-empty-frame-for-launchtime.patch
deleted file mode 100644
index bd542c7e0a9..00000000000
--- a/queue-6.1/igc-fix-inserting-of-empty-frame-for-launchtime.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From fa18e0267c199c88a21333e0bd3e8375ce87c3e9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:14 +0200
-Subject: igc: Fix inserting of empty frame for launchtime
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 0bcc62858d6ba62cbade957d69745e6adeed5f3d ]
-
-The insertion of an empty frame was introduced with
-commit db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-in order to ensure that the current cycle has at least one packet if
-there is some packet to be scheduled for the next cycle.
-
-However, the current implementation does not properly check if
-a packet is already scheduled for the current cycle. Currently,
-an empty packet is always inserted if and only if
-txtime >= end_of_cycle && txtime > last_tx_cycle
-but since last_tx_cycle is always either the end of the current
-cycle (end_of_cycle) or the end of a previous cycle, the
-second part (txtime > last_tx_cycle) is always true unless
-txtime == last_tx_cycle.
-
-What actually needs to be checked here is if the last_tx_cycle
-was already written within the current cycle, so an empty frame
-should only be inserted if and only if
-txtime >= end_of_cycle && end_of_cycle > last_tx_cycle.
-
-This patch does not only avoid an unnecessary insertion, but it
-can actually be harmful to insert an empty packet if packets
-are already scheduled in the current cycle, because it can lead
-to a situation where the empty packet is actually processed
-as the first packet in the upcoming cycle shifting the packet
-with the first_flag even one cycle into the future, finally leading
-to a TX hang.
-
-The TX hang can be reproduced on a i225 with:
-
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x1 \
-	    txtime-delay 500000 \
-	    clockid CLOCK_TAI
-    sudo tc qdisc replace dev enp1s0 parent 100:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload \
-	    skip_sock_check
-
-and traffic generator
-
-    sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns
-
-with traffic.cfg
-
-    #define ETH_P_IP        0x0800
-
-    {
-      /* Ethernet Header */
-      0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e,  # MAC Dest - adapt as needed
-      0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36,  # MAC Src  - adapt as needed
-      const16(ETH_P_IP),
-
-      /* IPv4 Header */
-      0b01000101, 0,   # IPv4 version, IHL, TOS
-      const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))
-      const16(2),      # IPv4 ident
-      0b01000000, 0,   # IPv4 flags, fragmentation off
-      64,              # IPv4 TTL
-      17,              # Protocol UDP
-      csumip(14, 33),  # IPv4 checksum
-
-      /* UDP Header */
-      10,  0, 48, 1,   # IP Src - adapt as needed
-      10,  0, 48, 10,  # IP Dest - adapt as needed
-      const16(5555),   # UDP Src Port
-      const16(6666),   # UDP Dest Port
-      const16(1008),   # UDP length (UDP header 8 bytes + payload length)
-      csumudp(14, 34), # UDP checksum
-
-      /* Payload */
-      fill('W', 1000),
-    }
-
-and the observed message with that is for example
-
- igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang
-   Tx Queue             <0>
-   TDH                  <32>
-   TDT                  <3c>
-   next_to_use          <3c>
-   next_to_clean        <32>
- buffer_info[next_to_clean]
-   time_stamp           <ffff26a8>
-   next_to_watch        <00000000632a1828>
-   jiffies              <ffff27f8>
-   desc.status          <1048000>
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 743d277896792..273941f90f066 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1027,7 +1027,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 			*first_flag = true;
- 			ring->last_ff_cycle = baset_est;
- 
--			if (ktime_compare(txtime, ring->last_tx_cycle) > 0)
-+			if (ktime_compare(end_of_cycle, ring->last_tx_cycle) > 0)
- 				*insert_empty = true;
- 		}
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.1/igc-fix-launchtime-before-start-of-cycle.patch b/queue-6.1/igc-fix-launchtime-before-start-of-cycle.patch
deleted file mode 100644
index 8f55bdebd5a..00000000000
--- a/queue-6.1/igc-fix-launchtime-before-start-of-cycle.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From c78a2bd7b765701cc9a7a12d7da2e028c4e87bd3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:13 +0200
-Subject: igc: Fix launchtime before start of cycle
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit c1bca9ac0bcb355be11354c2e68bc7bf31f5ac5a ]
-
-It is possible (verified on a running system) that frames are processed
-by igc_tx_launchtime with a txtime before the start of the cycle
-(baset_est).
-
-However, the result of txtime - baset_est is written into a u32,
-leading to a wrap around to a positive number. The following
-launchtime > 0 check will only branch to executing launchtime = 0
-if launchtime is already 0.
-
-Fix it by using a s32 before checking launchtime > 0.
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 93e90c353f1a8..743d277896792 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1014,7 +1014,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 	ktime_t base_time = adapter->base_time;
- 	ktime_t now = ktime_get_clocktai();
- 	ktime_t baset_est, end_of_cycle;
--	u32 launchtime;
-+	s32 launchtime;
- 	s64 n;
- 
- 	n = div64_s64(ktime_sub_ns(now, base_time), cycle_time);
--- 
-2.39.2
-
diff --git a/queue-6.1/igc-handle-pps-start-time-programming-for-past-time-.patch b/queue-6.1/igc-handle-pps-start-time-programming-for-past-time-.patch
deleted file mode 100644
index 5c2abeb09b4..00000000000
--- a/queue-6.1/igc-handle-pps-start-time-programming-for-past-time-.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From b724b2e932ce9dbc5f882562c96c8e3186e26a77 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 12:00:43 +0530
-Subject: igc: Handle PPS start time programming for past time values
-
-From: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-
-[ Upstream commit 84a192e46106355de1a314d709e657231d4b1026 ]
-
-I225/6 hardware can be programmed to start PPS output once
-the time in Target Time registers is reached. The time
-programmed in these registers should always be into future.
-Only then PPS output is triggered when SYSTIM register
-reaches the programmed value. There are two modes in i225/6
-hardware to program PPS, pulse and clock mode.
-
-There were issues reported where PPS is not generated when
-start time is in past.
-
-Example 1, "echo 0 0 0 2 0 > /sys/class/ptp/ptp0/period"
-
-In the current implementation, a value of '0' is programmed
-into Target time registers and PPS output is in pulse mode.
-Eventually an interrupt which is triggered upon SYSTIM
-register reaching Target time is not fired. Thus no PPS
-output is generated.
-
-Example 2, "echo 0 0 0 1 0 > /sys/class/ptp/ptp0/period"
-
-Above case, a value of '0' is programmed into Target time
-registers and PPS output is in clock mode. Here, HW tries to
-catch-up the current time by incrementing Target Time
-register. This catch-up time seem to vary according to
-programmed PPS period time as per the HW design. In my
-experiments, the delay ranged between few tens of seconds to
-few minutes. The PPS output is only generated after the
-Target time register reaches current time.
-
-In my experiments, I also observed PPS stopped working with
-below test and could not recover until module is removed and
-loaded again.
-
-1) echo 0 <future time> 0 1 0 > /sys/class/ptp/ptp1/period
-2) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-3) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-
-After this PPS did not work even if i re-program with proper
-values. I could only get this back working by reloading the
-driver.
-
-This patch takes care of calculating and programming
-appropriate future time value into Target Time registers.
-
-Fixes: 5e91c72e560c ("igc: Fix PPS delta between two synchronized end-points")
-Signed-off-by: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-Reviewed-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ptp.c | 25 +++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
-index 4e10ced736dbb..d96cdccdc1e1e 100644
---- a/drivers/net/ethernet/intel/igc/igc_ptp.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
-@@ -356,16 +356,35 @@ static int igc_ptp_feature_enable_i225(struct ptp_clock_info *ptp,
- 			tsim &= ~IGC_TSICR_TT0;
- 		}
- 		if (on) {
-+			struct timespec64 safe_start;
- 			int i = rq->perout.index;
- 
- 			igc_pin_perout(igc, i, pin, use_freq);
--			igc->perout[i].start.tv_sec = rq->perout.start.sec;
-+			igc_ptp_read(igc, &safe_start);
-+
-+			/* PPS output start time is triggered by Target time(TT)
-+			 * register. Programming any past time value into TT
-+			 * register will cause PPS to never start. Need to make
-+			 * sure we program the TT register a time ahead in
-+			 * future. There isn't a stringent need to fire PPS out
-+			 * right away. Adding +2 seconds should take care of
-+			 * corner cases. Let's say if the SYSTIML is close to
-+			 * wrap up and the timer keeps ticking as we program the
-+			 * register, adding +2seconds is safe bet.
-+			 */
-+			safe_start.tv_sec += 2;
-+
-+			if (rq->perout.start.sec < safe_start.tv_sec)
-+				igc->perout[i].start.tv_sec = safe_start.tv_sec;
-+			else
-+				igc->perout[i].start.tv_sec = rq->perout.start.sec;
- 			igc->perout[i].start.tv_nsec = rq->perout.start.nsec;
- 			igc->perout[i].period.tv_sec = ts.tv_sec;
- 			igc->perout[i].period.tv_nsec = ts.tv_nsec;
--			wr32(trgttimh, rq->perout.start.sec);
-+			wr32(trgttimh, (u32)igc->perout[i].start.tv_sec);
- 			/* For now, always select timer 0 as source. */
--			wr32(trgttiml, rq->perout.start.nsec | IGC_TT_IO_TIMER_SEL_SYSTIM0);
-+			wr32(trgttiml, (u32)(igc->perout[i].start.tv_nsec |
-+					     IGC_TT_IO_TIMER_SEL_SYSTIM0));
- 			if (use_freq)
- 				wr32(freqout, ns);
- 			tsauxc |= tsauxc_mask;
--- 
-2.39.2
-
diff --git a/queue-6.1/igc-remove-delay-during-tx-ring-configuration.patch b/queue-6.1/igc-remove-delay-during-tx-ring-configuration.patch
deleted file mode 100644
index f9cf98a6eb8..00000000000
--- a/queue-6.1/igc-remove-delay-during-tx-ring-configuration.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 4b3e566f4663b75cd0ed25bdedce8dd3a45b9133 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 May 2023 08:18:12 +0800
-Subject: igc: Remove delay during TX ring configuration
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit cca28ceac7c7857bc2d313777017585aef00bcc4 ]
-
-Remove unnecessary delay during the TX ring configuration.
-This will cause delay, especially during link down and
-link up activity.
-
-Furthermore, old SKUs like as I225 will call the reset_adapter
-to reset the controller during TSN mode Gate Control List (GCL)
-setting. This will add more time to the configuration of the
-real-time use case.
-
-It doesn't mentioned about this delay in the Software User Manual.
-It might have been ported from legacy code I210 in the past.
-
-Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index b67a6a81474f5..93e90c353f1a8 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -709,7 +709,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter,
- 	/* disable the queue */
- 	wr32(IGC_TXDCTL(reg_idx), 0);
- 	wrfl();
--	mdelay(10);
- 
- 	wr32(IGC_TDLEN(reg_idx),
- 	     ring->count * sizeof(union igc_adv_tx_desc));
--- 
-2.39.2
-
diff --git a/queue-6.1/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch b/queue-6.1/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
deleted file mode 100644
index 46eb644e8c2..00000000000
--- a/queue-6.1/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From c828e9fb40babbf0b703cf242797dae92f5060fd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 5 Jun 2023 11:09:01 -0700
-Subject: igc: set TP bit in 'supported' and 'advertising' fields of
- ethtool_link_ksettings
-
-From: Prasad Koya <prasad@arista.com>
-
-[ Upstream commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 ]
-
-set TP bit in the 'supported' and 'advertising' fields. i225/226 parts
-only support twisted pair copper.
-
-Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
-Signed-off-by: Prasad Koya <prasad@arista.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-index 8cc077b712add..511fc3f412087 100644
---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-@@ -1707,6 +1707,8 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
- 	/* twisted pair */
- 	cmd->base.port = PORT_TP;
- 	cmd->base.phy_address = hw->phy.addr;
-+	ethtool_link_ksettings_add_link_mode(cmd, supported, TP);
-+	ethtool_link_ksettings_add_link_mode(cmd, advertising, TP);
- 
- 	/* advertising link modes */
- 	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
--- 
-2.39.2
-
diff --git a/queue-6.1/ionic-remove-warn_on-to-prevent-panic_on_warn.patch b/queue-6.1/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
deleted file mode 100644
index 80d576c7a07..00000000000
--- a/queue-6.1/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 68bda054f4602f04bd6383c1263654613d5c4dca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 11:20:06 -0700
-Subject: ionic: remove WARN_ON to prevent panic_on_warn
-
-From: Nitya Sunkad <nitya.sunkad@amd.com>
-
-[ Upstream commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 ]
-
-Remove unnecessary early code development check and the WARN_ON
-that it uses.  The irq alloc and free paths have long been
-cleaned up and this check shouldn't have stuck around so long.
-
-Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
-Signed-off-by: Nitya Sunkad <nitya.sunkad@amd.com>
-Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 159bfcc76498c..a89ab455af67d 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -462,11 +462,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif)
- static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
--	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
--		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
--	}
--
- 	n_qcq->intr.vector = src_qcq->intr.vector;
- 	n_qcq->intr.index = src_qcq->intr.index;
- 	n_qcq->napi_qcq = src_qcq->napi_qcq;
--- 
-2.39.2
-
diff --git a/queue-6.1/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-6.1/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index 67d93f1be61..00000000000
--- a/queue-6.1/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 06a02c88d3a087d91221deedbf3c69aea072004c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index e6c7edcf68343..51bfc74805ecf 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -318,9 +318,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-6.1/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch b/queue-6.1/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
deleted file mode 100644
index 4f7ec360a35..00000000000
--- a/queue-6.1/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 5d488b6f7e845cc9ddf05f0dc69e34bdb3528588 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 3 Jul 2023 07:28:53 +0300
-Subject: kernel/trace: Fix cleanup logic of enable_trace_eprobe
-
-From: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-
-[ Upstream commit cf0a624dc706c306294c14e6b3e7694702f25191 ]
-
-The enable_trace_eprobe() function enables all event probes, attached
-to given trace probe. If an error occurs in enabling one of the event
-probes, all others should be roll backed. There is a bug in that roll
-back logic - instead of all event probes, only the failed one is
-disabled.
-
-Link: https://lore.kernel.org/all/20230703042853.1427493-1-tz.stoyanov@gmail.com/
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events")
-Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
-Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/trace/trace_eprobe.c | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
-index 753fc536525d3..d2370cdb4c1d6 100644
---- a/kernel/trace/trace_eprobe.c
-+++ b/kernel/trace/trace_eprobe.c
-@@ -743,6 +743,7 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 	struct trace_eprobe *ep;
- 	bool enabled;
- 	int ret = 0;
-+	int cnt = 0;
- 
- 	tp = trace_probe_primary_from_call(call);
- 	if (WARN_ON_ONCE(!tp))
-@@ -766,12 +767,25 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 		if (ret)
- 			break;
- 		enabled = true;
-+		cnt++;
- 	}
- 
- 	if (ret) {
- 		/* Failed to enable one of them. Roll back all */
--		if (enabled)
--			disable_eprobe(ep, file->tr);
-+		if (enabled) {
-+			/*
-+			 * It's a bug if one failed for something other than memory
-+			 * not being available but another eprobe succeeded.
-+			 */
-+			WARN_ON_ONCE(ret != -ENOMEM);
-+
-+			list_for_each_entry(pos, trace_probe_probe_list(tp), list) {
-+				ep = container_of(pos, struct trace_eprobe, tp);
-+				disable_eprobe(ep, file->tr);
-+				if (!--cnt)
-+					break;
-+			}
-+		}
- 		if (file)
- 			trace_probe_remove_file(tp, file);
- 		else
--- 
-2.39.2
-
diff --git a/queue-6.1/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch b/queue-6.1/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
deleted file mode 100644
index 9b77d16e87b..00000000000
--- a/queue-6.1/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From da8ab60d6a75bf12b663bdf6ddea7b72715d126b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 08:53:25 +0200
-Subject: net: bgmac: postpone turning IRQs off to avoid SoC hangs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Rafał Miłecki <rafal@milecki.pl>
-
-[ Upstream commit e7731194fdf085f46d58b1adccfddbd0dfee4873 ]
-
-Turning IRQs off is done by accessing Ethernet controller registers.
-That can't be done until device's clock is enabled. It results in a SoC
-hang otherwise.
-
-This bug remained unnoticed for years as most bootloaders keep all
-Ethernet interfaces turned on. It seems to only affect a niche SoC
-family BCM47189. It has two Ethernet controllers but CFE bootloader uses
-only the first one.
-
-Fixes: 34322615cbaa ("net: bgmac: Mask interrupts during probe")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/broadcom/bgmac.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
-index 1761df8fb7f96..10c7c232cc4ec 100644
---- a/drivers/net/ethernet/broadcom/bgmac.c
-+++ b/drivers/net/ethernet/broadcom/bgmac.c
-@@ -1492,8 +1492,6 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 
- 	bgmac->in_init = true;
- 
--	bgmac_chip_intrs_off(bgmac);
--
- 	net_dev->irq = bgmac->irq;
- 	SET_NETDEV_DEV(net_dev, bgmac->dev);
- 	dev_set_drvdata(bgmac->dev, bgmac);
-@@ -1511,6 +1509,8 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 	 */
- 	bgmac_clk_enable(bgmac, 0);
- 
-+	bgmac_chip_intrs_off(bgmac);
-+
- 	/* This seems to be fixing IRQ by assigning OOB #6 to the core */
- 	if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
- 		if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
--- 
-2.39.2
-
diff --git a/queue-6.1/net-dsa-qca8k-add-check-for-skb_copy.patch b/queue-6.1/net-dsa-qca8k-add-check-for-skb_copy.patch
deleted file mode 100644
index ec9e86537ca..00000000000
--- a/queue-6.1/net-dsa-qca8k-add-check-for-skb_copy.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0b62a31f05b0a2b6cac70f3ba28bc534cc13aef7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:39:07 +0800
-Subject: net: dsa: qca8k: Add check for skb_copy
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 87355b7c3da9bfd81935caba0ab763355147f7b0 ]
-
-Add check for the return value of skb_copy in order to avoid NULL pointer
-dereference.
-
-Fixes: 2cd548566384 ("net: dsa: qca8k: add support for phy read/write with mgmt Ethernet")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
-index 7a6166a0c9bcc..b3f7988668996 100644
---- a/drivers/net/dsa/qca/qca8k-8xxx.c
-+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
-@@ -469,6 +469,9 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
- 	bool ack;
- 	int ret;
- 
-+	if (!skb)
-+		return -ENOMEM;
-+
- 	reinit_completion(&mgmt_eth_data->rw_done);
- 
- 	/* Increment seq_num and set it in the copy pkt */
--- 
-2.39.2
-
diff --git a/queue-6.1/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch b/queue-6.1/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
deleted file mode 100644
index 506729ba2bf..00000000000
--- a/queue-6.1/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From dd99e55563cb3069d81b733806d4d7616408a27d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 8 Jun 2023 09:32:10 +0200
-Subject: net/mlx5e: Check for NOT_READY flag state after locking
-
-From: Vlad Buslov <vladbu@nvidia.com>
-
-[ Upstream commit 65e64640e97c0f223e77f9ea69b5a46186b93470 ]
-
-Currently the check for NOT_READY flag is performed before obtaining the
-necessary lock. This opens a possibility for race condition when the flow
-is concurrently removed from unready_flows list by the workqueue task,
-which causes a double-removal from the list and a crash[0]. Fix the issue
-by moving the flag check inside the section protected by
-uplink_priv->unready_flows_lock mutex.
-
-[0]:
-[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP
-[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1
-[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
-[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.402999] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.403787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-[44376.406339] Call Trace:
-[44376.406651]  <TASK>
-[44376.406939]  ? die_addr+0x33/0x90
-[44376.407311]  ? exc_general_protection+0x192/0x390
-[44376.407795]  ? asm_exc_general_protection+0x22/0x30
-[44376.408292]  ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.408876]  __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]
-[44376.409482]  mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]
-[44376.410055]  mlx5e_flow_put+0x25/0x50 [mlx5_core]
-[44376.410529]  mlx5e_delete_flower+0x24b/0x350 [mlx5_core]
-[44376.411043]  tc_setup_cb_reoffload+0x22/0x80
-[44376.411462]  fl_reoffload+0x261/0x2f0 [cls_flower]
-[44376.411907]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.412481]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.413044]  tcf_block_playback_offloads+0x76/0x170
-[44376.413497]  tcf_block_unbind+0x7b/0xd0
-[44376.413881]  tcf_block_setup+0x17d/0x1c0
-[44376.414269]  tcf_block_offload_cmd.isra.0+0xf1/0x130
-[44376.414725]  tcf_block_offload_unbind+0x43/0x70
-[44376.415153]  __tcf_block_put+0x82/0x150
-[44376.415532]  ingress_destroy+0x22/0x30 [sch_ingress]
-[44376.415986]  qdisc_destroy+0x3b/0xd0
-[44376.416343]  qdisc_graft+0x4d0/0x620
-[44376.416706]  tc_get_qdisc+0x1c9/0x3b0
-[44376.417074]  rtnetlink_rcv_msg+0x29c/0x390
-[44376.419978]  ? rep_movs_alternative+0x3a/0xa0
-[44376.420399]  ? rtnl_calcit.isra.0+0x120/0x120
-[44376.420813]  netlink_rcv_skb+0x54/0x100
-[44376.421192]  netlink_unicast+0x1f6/0x2c0
-[44376.421573]  netlink_sendmsg+0x232/0x4a0
-[44376.421980]  sock_sendmsg+0x38/0x60
-[44376.422328]  ____sys_sendmsg+0x1d0/0x1e0
-[44376.422709]  ? copy_msghdr_from_user+0x6d/0xa0
-[44376.423127]  ___sys_sendmsg+0x80/0xc0
-[44376.423495]  ? ___sys_recvmsg+0x8b/0xc0
-[44376.423869]  __sys_sendmsg+0x51/0x90
-[44376.424226]  do_syscall_64+0x3d/0x90
-[44376.424587]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
-[44376.425046] RIP: 0033:0x7f045134f887
-[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
-[44376.426914] RSP: 002b:00007ffd63a82b98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
-[44376.427592] RAX: ffffffffffffffda RBX: 000000006481955f RCX: 00007f045134f887
-[44376.428195] RDX: 0000000000000000 RSI: 00007ffd63a82c00 RDI: 0000000000000003
-[44376.428796] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
-[44376.429404] R10: 00007f0451208708 R11: 0000000000000246 R12: 0000000000000001
-[44376.430039] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
-[44376.430644]  </TASK>
-[44376.430907] Modules linked in: mlx5_ib mlx5_core act_mirred act_tunnel_key cls_flower vxlan dummy sch_ingress openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_g
-ss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core]
-[44376.433936] ---[ end trace 0000000000000000 ]---
-[44376.434373] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.434951] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.436452] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.436924] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.437530] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.438179] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.438786] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.439393] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.439998] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.440714] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.441225] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.441843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.442471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-
-Fixes: ad86755b18d5 ("net/mlx5e: Protect unready flows with dedicated lock")
-Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
-Reviewed-by: Roi Dayan <roid@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-index 7883b625634fb..7ab489520a873 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -1551,7 +1551,8 @@ static void remove_unready_flow(struct mlx5e_tc_flow *flow)
- 	uplink_priv = &rpriv->uplink_priv;
- 
- 	mutex_lock(&uplink_priv->unready_flows_lock);
--	unready_flow_del(flow);
-+	if (flow_flag_test(flow, NOT_READY))
-+		unready_flow_del(flow);
- 	mutex_unlock(&uplink_priv->unready_flows_lock);
- }
- 
-@@ -1896,8 +1897,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
- 	esw_attr = attr->esw_attr;
- 	mlx5e_put_flow_tunnel_id(flow);
- 
--	if (flow_flag_test(flow, NOT_READY))
--		remove_unready_flow(flow);
-+	remove_unready_flow(flow);
- 
- 	if (mlx5e_is_offloaded_flow(flow)) {
- 		if (flow_flag_test(flow, SLOW))
--- 
-2.39.2
-
diff --git a/queue-6.1/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch b/queue-6.1/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
deleted file mode 100644
index c9038384729..00000000000
--- a/queue-6.1/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 1a52206069716e094edbfdac1625ab8dae1f2a95 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 08:59:34 +0800
-Subject: net/mlx5e: fix double free in mlx5e_destroy_flow_table
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 884abe45a9014d0de2e6edb0630dfd64f23f1d1b ]
-
-In function accel_fs_tcp_create_groups(), when the ft->g memory is
-successfully allocated but the 'in' memory fails to be allocated, the
-memory pointed to by ft->g is released once. And in function
-accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
-the memory pointed to by ft->g again. This will cause double free problem.
-
-Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-index d7c020f724013..06c47404996bb 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-@@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
- 	in = kvzalloc(inlen, GFP_KERNEL);
- 	if  (!in || !ft->g) {
- 		kfree(ft->g);
-+		ft->g = NULL;
- 		kvfree(in);
- 		return -ENOMEM;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch b/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
deleted file mode 100644
index d4270899861..00000000000
--- a/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 8cc6b4a6532b8b77d5c94084ce45a67a4c323683 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 09:49:02 +0800
-Subject: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 3250affdc658557a41df9c5fb567723e421f8bf2 ]
-
-The memory pointed to by the fs->any pointer is not freed in the error
-path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
-Fix by freeing the memory in the error path, thereby making the error path
-identical to mlx5e_fs_tt_redirect_any_destroy().
-
-Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-index 03cb79adf912f..be83ad9db82a4 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-@@ -594,7 +594,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
- 
- 	err = fs_any_create_table(fs);
- 	if (err)
--		return err;
-+		goto err_free_any;
- 
- 	err = fs_any_enable(fs);
- 	if (err)
-@@ -606,8 +606,8 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
- 
- err_destroy_table:
- 	fs_any_destroy_table(fs_any);
--
--	kfree(fs_any);
-+err_free_any:
- 	mlx5e_fs_set_any(fs, NULL);
-+	kfree(fs_any);
- 	return err;
- }
--- 
-2.39.2
-
diff --git a/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch b/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
deleted file mode 100644
index 3aee03e4bbc..00000000000
--- a/queue-6.1/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From f41a1e782a6b2f77ad0f34e3be65080bfb49280c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 09:49:03 +0800
-Subject: net/mlx5e: fix memory leak in mlx5e_ptp_open
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit d543b649ffe58a0cb4b6948b3305069c5980a1fa ]
-
-When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
-pointed by "c" or "cparams" is not freed, which can lead to a memory
-leak. Fix by freeing the array in the error path.
-
-Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
-Reviewed-by: Gal Pressman <gal@nvidia.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-index efd02ce4425de..72b4781f0eb2f 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-@@ -729,8 +729,10 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params,
- 
- 	c = kvzalloc_node(sizeof(*c), GFP_KERNEL, dev_to_node(mlx5_core_dma_dev(mdev)));
- 	cparams = kvzalloc(sizeof(*cparams), GFP_KERNEL);
--	if (!c || !cparams)
--		return -ENOMEM;
-+	if (!c || !cparams) {
-+		err = -ENOMEM;
-+		goto err_free;
-+	}
- 
- 	c->priv     = priv;
- 	c->mdev     = priv->mdev;
--- 
-2.39.2
-
diff --git a/queue-6.1/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-6.1/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index d4a06891d29..00000000000
--- a/queue-6.1/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 3a44359fa0de0180914a76734b0335790d75fc61 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index 5aefaaff08711..aca5b72cfeec6 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1505,7 +1505,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -4294,7 +4294,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-6.1/net-prevent-skb-corruption-on-frag-list-segmentation.patch b/queue-6.1/net-prevent-skb-corruption-on-frag-list-segmentation.patch
deleted file mode 100644
index 49962661b29..00000000000
--- a/queue-6.1/net-prevent-skb-corruption-on-frag-list-segmentation.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From a12226bbf0255142f4f700edb13391af63e6fdef Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 10:11:10 +0200
-Subject: net: prevent skb corruption on frag list segmentation
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]
-
-Ian reported several skb corruptions triggered by rx-gro-list,
-collecting different oops alike:
-
-[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
-[   62.631083] #PF: supervisor read access in kernel mode
-[   62.636312] #PF: error_code(0x0000) - not-present page
-[   62.641541] PGD 0 P4D 0
-[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
-[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
-[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
-[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
-./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
-net/ipv4/udp_offload.c:277)
-[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
-[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
-[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
-[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
-[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
-[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
-[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
-knlGS:0000000000000000
-[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
-[   62.749948] Call Trace:
-[   62.752498]  <TASK>
-[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
-[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
-[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
-[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
-net/core/dev.c:3659)
-[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
-[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
-[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
-net/netfilter/core.c:626)
-[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
-[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
-[   62.829420] br_flood (net/bridge/br_forward.c:233)
-[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
-[   62.837403] br_handle_frame (net/bridge/br_input.c:298
-net/bridge/br_input.c:416)
-[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
-[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
-[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
-net/core/dev.c:5727)
-[   62.876795] napi_complete_done (./include/linux/list.h:37
-./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
-[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
-[   62.893534] __napi_poll (net/core/dev.c:6498)
-[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
-net/core/dev.c:6640)
-[   62.905276] kthread (kernel/kthread.c:379)
-[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
-[   62.917119]  </TASK>
-
-In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
-bridge, both to the local input path and to an egress device (tun).
-
-The segmentation of such packets unsafely writes to the cloned skbs
-with shared heads.
-
-This change addresses the issue by uncloning as needed the
-to-be-segmented skbs.
-
-Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
-Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
-Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/skbuff.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index ef9772b12624c..b6c16db86c719 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -4042,6 +4042,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
- 
- 	skb_push(skb, -skb_network_offset(skb) + offset);
- 
-+	/* Ensure the head is writeable before touching the shared info */
-+	err = skb_unclone(skb, GFP_ATOMIC);
-+	if (err)
-+		goto err_linearize;
-+
- 	skb_shinfo(skb)->frag_list = NULL;
- 
- 	while (list_skb) {
--- 
-2.39.2
-
diff --git a/queue-6.1/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch b/queue-6.1/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
deleted file mode 100644
index 3abbd5855fa..00000000000
--- a/queue-6.1/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 95caf069a15de66a6cb13f7400f78f950b1876bd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 12:15:30 -0400
-Subject: net/sched: cls_fw: Fix improper refcount update leads to
- use-after-free
-
-From: M A Ramdhan <ramdhan@starlabs.sg>
-
-[ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ]
-
-In the event of a failure in tcf_change_indev(), fw_set_parms() will
-immediately return an error after incrementing or decrementing
-reference counter in tcf_bind_filter().  If attacker can control
-reference counter to zero and make reference freed, leading to
-use after free.
-
-In order to prevent this, move the point of possible failure above the
-point where the TC_FW_CLASSID is handled.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
-Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
-Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_fw.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
-index a32351da968cd..1212b057b129c 100644
---- a/net/sched/cls_fw.c
-+++ b/net/sched/cls_fw.c
-@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_FW_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
--	}
--
- 	if (tb[TCA_FW_INDEV]) {
- 		int ret;
- 		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
-@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	} else if (head->mask != 0xFFFFFFFF)
- 		return err;
- 
-+	if (tb[TCA_FW_CLASSID]) {
-+		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
-+		tcf_bind_filter(tp, &f->res, base);
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/net-sched-flower-ensure-both-minimum-and-maximum-por.patch b/queue-6.1/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
deleted file mode 100644
index 0100201e65a..00000000000
--- a/queue-6.1/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 67552a91b905352bf7d5e8c7b0780980d459ab88 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 10:08:09 +0300
-Subject: net/sched: flower: Ensure both minimum and maximum ports are
- specified
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit d3f87278bcb80bd7f9519669d928b43320363d4f ]
-
-The kernel does not currently validate that both the minimum and maximum
-ports of a port range are specified. This can lead user space to think
-that a filter matching on a port range was successfully added, when in
-fact it was not. For example, with a patched (buggy) iproute2 that only
-sends the minimum port, the following commands do not return an error:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
-
- # tc filter show dev swp1 ingress
- filter protocol ip pref 1 flower chain 0
- filter protocol ip pref 1 flower chain 0 handle 0x1
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 1 ref 1 bind 1
-
- filter protocol ip pref 1 flower chain 0 handle 0x2
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 2 ref 1 bind 1
-
-Fix by returning an error unless both ports are specified:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
- Error: Both min and max source ports must be specified.
- We have an error talking to the kernel
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
- Error: Both min and max destination ports must be specified.
- We have an error talking to the kernel
-
-Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Petr Machata <petrm@nvidia.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index 3de72e7c1075a..10e6ec0f94981 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -793,6 +793,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
-+	if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max destination ports must be specified");
-+		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max source ports must be specified");
-+		return -EINVAL;
-+	}
- 	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
- 	    ntohs(key->tp_range.tp_max.dst) <=
- 	    ntohs(key->tp_range.tp_min.dst)) {
--- 
-2.39.2
-
diff --git a/queue-6.1/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-6.1/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index 93749f3286b..00000000000
--- a/queue-6.1/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 41607ef176aa6977f473d5dbbe08d97e2981ffb9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 8ab75128512ab..f99a513b40a92 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -135,7 +135,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-6.1/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch b/queue-6.1/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
deleted file mode 100644
index fc9369ef3cd..00000000000
--- a/queue-6.1/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 8c9c1a61f10391f067bceaeea6253f63f87e416e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 18:01:02 -0300
-Subject: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 ]
-
-Lion says:
--------
-In the QFQ scheduler a similar issue to CVE-2023-31436
-persists.
-
-Consider the following code in net/sched/sch_qfq.c:
-
-static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
-                struct sk_buff **to_free)
-{
-     unsigned int len = qdisc_pkt_len(skb), gso_segs;
-
-    // ...
-
-     if (unlikely(cl->agg->lmax < len)) {
-         pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
-              cl->agg->lmax, len, cl->common.classid);
-         err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
-         if (err) {
-             cl->qstats.drops++;
-             return qdisc_drop(skb, sch, to_free);
-         }
-
-    // ...
-
-     }
-
-Similarly to CVE-2023-31436, "lmax" is increased without any bounds
-checks according to the packet length "len". Usually this would not
-impose a problem because packet sizes are naturally limited.
-
-This is however not the actual packet length, rather the
-"qdisc_pkt_len(skb)" which might apply size transformations according to
-"struct qdisc_size_table" as created by "qdisc_get_stab()" in
-net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.
-
-A user may choose virtually any size using such a table.
-
-As a result the same issue as in CVE-2023-31436 can occur, allowing heap
-out-of-bounds read / writes in the kmalloc-8192 cache.
--------
-
-We can create the issue with the following commands:
-
-tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
-overhead 999999999 linklayer ethernet qfq
-tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
-tc filter add dev $DEV parent 1: matchall classid 1:1
-ping -I $DEV 1.1.1.2
-
-This is caused by incorrectly assuming that qdisc_pkt_len() returns a
-length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.
-
-Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
-Reported-by: Lion <nnamrec@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 2f3629c851584..d5610e145da20 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -381,8 +381,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight,
- 			   u32 lmax)
- {
- 	struct qfq_sched *q = qdisc_priv(sch);
--	struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight);
-+	struct qfq_aggregate *new_agg;
- 
-+	/* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */
-+	if (lmax > QFQ_MAX_LMAX)
-+		return -EINVAL;
-+
-+	new_agg = qfq_find_agg(q, lmax, weight);
- 	if (new_agg == NULL) { /* create new aggregate */
- 		new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC);
- 		if (new_agg == NULL)
--- 
-2.39.2
-
diff --git a/queue-6.1/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch b/queue-6.1/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
deleted file mode 100644
index bdbe4b8dc4a..00000000000
--- a/queue-6.1/net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 1f3f2e2d045f81f44d68e737993e020a3756de39 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 22 Apr 2023 12:56:11 -0300
-Subject: net/sched: sch_qfq: refactor parsing of netlink parameters
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 25369891fcef373540f8b4e0b3bccf77a04490d5 ]
-
-Two parameters can be transformed into netlink policies and
-validated while parsing the netlink message.
-
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 3e337087c3b5 ("net/sched: sch_qfq: account for stab overhead in qfq_enqueue")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 25 +++++++++++--------------
- 1 file changed, 11 insertions(+), 14 deletions(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 02098a02943eb..2f3629c851584 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -113,6 +113,7 @@
- 
- #define QFQ_MTU_SHIFT		16	/* to support TSO/GSO */
- #define QFQ_MIN_LMAX		512	/* see qfq_slot_insert */
-+#define QFQ_MAX_LMAX		(1UL << QFQ_MTU_SHIFT)
- 
- #define QFQ_MAX_AGG_CLASSES	8 /* max num classes per aggregate allowed */
- 
-@@ -214,9 +215,14 @@ static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
- 	return container_of(clc, struct qfq_class, common);
- }
- 
-+static struct netlink_range_validation lmax_range = {
-+	.min = QFQ_MIN_LMAX,
-+	.max = QFQ_MAX_LMAX,
-+};
-+
- static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
--	[TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
--	[TCA_QFQ_LMAX] = { .type = NLA_U32 },
-+	[TCA_QFQ_WEIGHT] = NLA_POLICY_RANGE(NLA_U32, 1, QFQ_MAX_WEIGHT),
-+	[TCA_QFQ_LMAX] = NLA_POLICY_FULL_RANGE(NLA_U32, &lmax_range),
- };
- 
- /*
-@@ -408,17 +414,13 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	}
- 
- 	err = nla_parse_nested_deprecated(tb, TCA_QFQ_MAX, tca[TCA_OPTIONS],
--					  qfq_policy, NULL);
-+					  qfq_policy, extack);
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_QFQ_WEIGHT]) {
-+	if (tb[TCA_QFQ_WEIGHT])
- 		weight = nla_get_u32(tb[TCA_QFQ_WEIGHT]);
--		if (!weight || weight > (1UL << QFQ_MAX_WSHIFT)) {
--			pr_notice("qfq: invalid weight %u\n", weight);
--			return -EINVAL;
--		}
--	} else
-+	else
- 		weight = 1;
- 
- 	if (tb[TCA_QFQ_LMAX])
-@@ -426,11 +428,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	else
- 		lmax = psched_mtu(qdisc_dev(sch));
- 
--	if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
--		pr_notice("qfq: invalid max length %u\n", lmax);
--		return -EINVAL;
--	}
--
- 	inv_w = ONE_FP / weight;
- 	weight = ONE_FP / inv_w;
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch b/queue-6.1/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
deleted file mode 100644
index ade1c714860..00000000000
--- a/queue-6.1/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 6f2ca3c8c1a7fda55fd52f9bb6deb07dd480418a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 11:52:26 +0300
-Subject: netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 ]
-
-The simple_write_to_buffer() function is designed to handle partial
-writes.  It returns negatives on error, otherwise it returns the number
-of bytes that were able to be copied.  This code doesn't check the
-return properly.  We only know that the first byte is written, the rest
-of the buffer might be uninitialized.
-
-There is no need to use the simple_write_to_buffer() function.
-Partial writes are prohibited by the "if (*ppos != 0)" check at the
-start of the function.  Just use memdup_user() and copy the whole
-buffer.
-
-Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Reviewed-by: Ido Schimmel <idosch@nvidia.com>
-Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/netdevsim/dev.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
-index 68e56e451b2be..c3fbdd6b68baf 100644
---- a/drivers/net/netdevsim/dev.c
-+++ b/drivers/net/netdevsim/dev.c
-@@ -184,13 +184,10 @@ static ssize_t nsim_dev_trap_fa_cookie_write(struct file *file,
- 	cookie_len = (count - 1) / 2;
- 	if ((count - 1) % 2)
- 		return -EINVAL;
--	buf = kmalloc(count, GFP_KERNEL | __GFP_NOWARN);
--	if (!buf)
--		return -ENOMEM;
- 
--	ret = simple_write_to_buffer(buf, count, ppos, data, count);
--	if (ret < 0)
--		goto free_buf;
-+	buf = memdup_user(data, count);
-+	if (IS_ERR(buf))
-+		return PTR_ERR(buf);
- 
- 	fa_cookie = kmalloc(sizeof(*fa_cookie) + cookie_len,
- 			    GFP_KERNEL | __GFP_NOWARN);
--- 
-2.39.2
-
diff --git a/queue-6.1/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-6.1/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index ad1f5cd5ad4..00000000000
--- a/queue-6.1/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 02c36801bbfb264b0b8a9241fed42c064a2dbe08 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 04550b1f984c6..730f2103b91d1 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1338,12 +1338,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-6.1/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index ced535ec291..00000000000
--- a/queue-6.1/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 0d3e744acbf28967be63072157b302b1ea66201f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index 0ed6f809ff2ee..51799fccf8404 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2891,6 +2891,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2898,7 +2899,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-6.1/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index 07e2672e663..00000000000
--- a/queue-6.1/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 68de370acd64ac8c119d8f145d6cd8a9022d6a0e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index 84772013812bf..60a4ebc7bf35a 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2064,12 +2064,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-6.1/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index 0e8df81dbd2..00000000000
--- a/queue-6.1/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From f2bb9d596e9772896cdbc9e4638e7b76b46e6613 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 5ee0afa621a95..eeeb4b1c97d2c 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-6.1/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-6.1/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index 856459c4e46..00000000000
--- a/queue-6.1/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 0f4e3f05e9406a68d728d0afa9cfef142bf0e90f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index a9b97ebc71ac5..2abd2235bbcab 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -410,7 +410,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch b/queue-6.1/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
deleted file mode 100644
index 94e189055cc..00000000000
--- a/queue-6.1/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 2e259784714ecf8af9c0fcf82e7535b3bd0372fb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 23 Jun 2023 18:08:05 +0530
-Subject: nvme: fix the NVME_ID_NS_NVM_STS_MASK definition
-
-From: Ankit Kumar <ankit.kumar@samsung.com>
-
-[ Upstream commit b938e6603660652dc3db66d3c915fbfed3bce21d ]
-
-As per NVMe command set specification 1.0c Storage tag size is 7 bits.
-
-Fixes: 4020aad85c67 ("nvme: add support for enhanced metadata")
-Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
-Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nvme.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/linux/nvme.h b/include/linux/nvme.h
-index d9fbc5afeaf72..e6fb36b71b59d 100644
---- a/include/linux/nvme.h
-+++ b/include/linux/nvme.h
-@@ -473,7 +473,7 @@ struct nvme_id_ns_nvm {
- };
- 
- enum {
--	NVME_ID_NS_NVM_STS_MASK		= 0x3f,
-+	NVME_ID_NS_NVM_STS_MASK		= 0x7f,
- 	NVME_ID_NS_NVM_GUARD_SHIFT	= 7,
- 	NVME_ID_NS_NVM_GUARD_MASK	= 0x3,
- };
--- 
-2.39.2
-
diff --git a/queue-6.1/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch b/queue-6.1/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
deleted file mode 100644
index 18ee81c7531..00000000000
--- a/queue-6.1/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From bc9ccd7125c55d66cc6d4718a236cf7328b57acc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jul 2023 17:26:20 +0800
-Subject: nvme-pci: fix DMA direction of unmapping integrity data
-
-From: Ming Lei <ming.lei@redhat.com>
-
-[ Upstream commit b8f6446b6853768cb99e7c201bddce69ca60c15e ]
-
-DMA direction should be taken in dma_unmap_page() for unmapping integrity
-data.
-
-Fix this DMA direction, and reported in Guangwu's test.
-
-Reported-by: Guangwu Zhang <guazhang@redhat.com>
-Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data")
-Signed-off-by: Ming Lei <ming.lei@redhat.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/pci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 145fa7ef3f740..ce2e628f94a05 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -1022,7 +1022,7 @@ static __always_inline void nvme_pci_unmap_rq(struct request *req)
- 	        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
- 
- 		dma_unmap_page(dev->dev, iod->meta_dma,
--			       rq_integrity_vec(req)->bv_len, rq_data_dir(req));
-+			       rq_integrity_vec(req)->bv_len, rq_dma_dir(req));
- 	}
- 
- 	if (blk_rq_nr_phys_segments(req))
--- 
-2.39.2
-
diff --git a/queue-6.1/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch b/queue-6.1/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
deleted file mode 100644
index 68b675e383e..00000000000
--- a/queue-6.1/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 14b7090b56e22ba04e7b11d8ff4a6fccf9ff234d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 13:59:36 +0530
-Subject: octeontx2-af: Move validation of ptp pointer before its usage
-
-From: Sai Krishna <saikrishnag@marvell.com>
-
-[ Upstream commit 7709fbd4922c197efabda03660d93e48a3e80323 ]
-
-Moved PTP pointer validation before its use to avoid smatch warning.
-Also used kzalloc/kfree instead of devm_kzalloc/devm_kfree.
-
-Fixes: 2ef4e45d99b1 ("octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon")
-Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/marvell/octeontx2/af/ptp.c   | 19 +++++++++----------
- .../net/ethernet/marvell/octeontx2/af/rvu.c   |  2 +-
- 2 files changed, 10 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/ptp.c b/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-index 3411e2e47d46b..0ee420a489fc4 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-@@ -208,7 +208,7 @@ struct ptp *ptp_get(void)
- 	/* Check driver is bound to PTP block */
- 	if (!ptp)
- 		ptp = ERR_PTR(-EPROBE_DEFER);
--	else
-+	else if (!IS_ERR(ptp))
- 		pci_dev_get(ptp->pdev);
- 
- 	return ptp;
-@@ -388,11 +388,10 @@ static int ptp_extts_on(struct ptp *ptp, int on)
- static int ptp_probe(struct pci_dev *pdev,
- 		     const struct pci_device_id *ent)
- {
--	struct device *dev = &pdev->dev;
- 	struct ptp *ptp;
- 	int err;
- 
--	ptp = devm_kzalloc(dev, sizeof(*ptp), GFP_KERNEL);
-+	ptp = kzalloc(sizeof(*ptp), GFP_KERNEL);
- 	if (!ptp) {
- 		err = -ENOMEM;
- 		goto error;
-@@ -428,20 +427,19 @@ static int ptp_probe(struct pci_dev *pdev,
- 	return 0;
- 
- error_free:
--	devm_kfree(dev, ptp);
-+	kfree(ptp);
- 
- error:
- 	/* For `ptp_get()` we need to differentiate between the case
- 	 * when the core has not tried to probe this device and the case when
--	 * the probe failed.  In the later case we pretend that the
--	 * initialization was successful and keep the error in
-+	 * the probe failed.  In the later case we keep the error in
- 	 * `dev->driver_data`.
- 	 */
- 	pci_set_drvdata(pdev, ERR_PTR(err));
- 	if (!first_ptp_block)
- 		first_ptp_block = ERR_PTR(err);
- 
--	return 0;
-+	return err;
- }
- 
- static void ptp_remove(struct pci_dev *pdev)
-@@ -449,16 +447,17 @@ static void ptp_remove(struct pci_dev *pdev)
- 	struct ptp *ptp = pci_get_drvdata(pdev);
- 	u64 clock_cfg;
- 
--	if (cn10k_ptp_errata(ptp) && hrtimer_active(&ptp->hrtimer))
--		hrtimer_cancel(&ptp->hrtimer);
--
- 	if (IS_ERR_OR_NULL(ptp))
- 		return;
- 
-+	if (cn10k_ptp_errata(ptp) && hrtimer_active(&ptp->hrtimer))
-+		hrtimer_cancel(&ptp->hrtimer);
-+
- 	/* Disable PTP clock */
- 	clock_cfg = readq(ptp->reg_base + PTP_CLOCK_CFG);
- 	clock_cfg &= ~PTP_CLOCK_CFG_PTP_EN;
- 	writeq(clock_cfg, ptp->reg_base + PTP_CLOCK_CFG);
-+	kfree(ptp);
- }
- 
- static const struct pci_device_id ptp_id_table[] = {
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-index 873f081c030de..733add3a9dc6b 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-@@ -3244,7 +3244,7 @@ static int rvu_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 	rvu->ptp = ptp_get();
- 	if (IS_ERR(rvu->ptp)) {
- 		err = PTR_ERR(rvu->ptp);
--		if (err == -EPROBE_DEFER)
-+		if (err)
- 			goto err_release_regions;
- 		rvu->ptp = NULL;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.1/octeontx2-af-promisc-enable-disable-through-mbox.patch b/queue-6.1/octeontx2-af-promisc-enable-disable-through-mbox.patch
deleted file mode 100644
index 9db15dff40b..00000000000
--- a/queue-6.1/octeontx2-af-promisc-enable-disable-through-mbox.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From b95e3eae3ce1b093ec6e8cc6972aea5b45262891 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 09:57:05 +0530
-Subject: octeontx2-af: Promisc enable/disable through mbox
-
-From: Ratheesh Kannoth <rkannoth@marvell.com>
-
-[ Upstream commit af42088bdaf292060b8d8a00d8644ca7b2b3f2d1 ]
-
-In legacy silicon, promiscuous mode is only modified
-through CGX mbox messages. In CN10KB silicon, it is modified
-from CGX mbox and NIX. This breaks legacy application
-behaviour. Fix this by removing call from NIX.
-
-Fixes: d6c9784baf59 ("octeontx2-af: Invoke exact match functions if supported")
-Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/af/rvu_nix.c   | 11 ++-------
- .../marvell/octeontx2/af/rvu_npc_hash.c       | 23 +++++++++++++++++--
- 2 files changed, 23 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-index 8cb2a0181fb9b..705325431dec3 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-@@ -3804,21 +3804,14 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
- 	}
- 
- 	/* install/uninstall promisc entry */
--	if (promisc) {
-+	if (promisc)
- 		rvu_npc_install_promisc_entry(rvu, pcifunc, nixlf,
- 					      pfvf->rx_chan_base,
- 					      pfvf->rx_chan_cnt);
--
--		if (rvu_npc_exact_has_match_table(rvu))
--			rvu_npc_exact_promisc_enable(rvu, pcifunc);
--	} else {
-+	else
- 		if (!nix_rx_multicast)
- 			rvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);
- 
--		if (rvu_npc_exact_has_match_table(rvu))
--			rvu_npc_exact_promisc_disable(rvu, pcifunc);
--	}
--
- 	return 0;
- }
- 
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-index 3b48b635977f6..3b0a66c0977a7 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-@@ -1168,8 +1168,10 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i
- {
- 	struct npc_exact_table *table;
- 	u16 *cnt, old_cnt;
-+	bool promisc;
- 
- 	table = rvu->hw->table;
-+	promisc = table->promisc_mode[drop_mcam_idx];
- 
- 	cnt = &table->cnt_cmd_rules[drop_mcam_idx];
- 	old_cnt = *cnt;
-@@ -1181,13 +1183,18 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i
- 
- 	*enable_or_disable_cam = false;
- 
--	/* If all rules are deleted, disable cam */
-+	if (promisc)
-+		goto done;
-+
-+	/* If all rules are deleted and not already in promisc mode;
-+	 * disable cam
-+	 */
- 	if (!*cnt && val < 0) {
- 		*enable_or_disable_cam = true;
- 		goto done;
- 	}
- 
--	/* If rule got added, enable cam */
-+	/* If rule got added and not already in promisc mode; enable cam */
- 	if (!old_cnt && val > 0) {
- 		*enable_or_disable_cam = true;
- 		goto done;
-@@ -1466,6 +1473,12 @@ int rvu_npc_exact_promisc_disable(struct rvu *rvu, u16 pcifunc)
- 	*promisc = false;
- 	mutex_unlock(&table->lock);
- 
-+	/* Enable drop rule */
-+	rvu_npc_enable_mcam_by_entry_index(rvu, drop_mcam_idx, NIX_INTF_RX,
-+					   true);
-+
-+	dev_dbg(rvu->dev, "%s: disabled  promisc mode (cgx=%d lmac=%d)\n",
-+		__func__, cgx_id, lmac_id);
- 	return 0;
- }
- 
-@@ -1507,6 +1520,12 @@ int rvu_npc_exact_promisc_enable(struct rvu *rvu, u16 pcifunc)
- 	*promisc = true;
- 	mutex_unlock(&table->lock);
- 
-+	/*  disable drop rule */
-+	rvu_npc_enable_mcam_by_entry_index(rvu, drop_mcam_idx, NIX_INTF_RX,
-+					   false);
-+
-+	dev_dbg(rvu->dev, "%s: Enabled promisc mode (cgx=%d lmac=%d)\n",
-+		__func__, cgx_id, lmac_id);
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.1/octeontx2-pf-add-additional-check-for-mcam-rules.patch b/queue-6.1/octeontx2-pf-add-additional-check-for-mcam-rules.patch
deleted file mode 100644
index df0d43c26cc..00000000000
--- a/queue-6.1/octeontx2-pf-add-additional-check-for-mcam-rules.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 265189a084ea8819eaeadaa4491089327fe3ba34 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 16:00:27 +0530
-Subject: octeontx2-pf: Add additional check for MCAM rules
-
-From: Suman Ghosh <sumang@marvell.com>
-
-[ Upstream commit 8278ee2a2646b9acf747317895e47a640ba933c9 ]
-
-Due to hardware limitation, MCAM drop rule with
-ether_type == 802.1Q and vlan_id == 0 is not supported. Hence rejecting
-such rules.
-
-Fixes: dce677da57c0 ("octeontx2-pf: Add vlan-etype to ntuple filters")
-Signed-off-by: Suman Ghosh <sumang@marvell.com>
-Link: https://lore.kernel.org/r/20230710103027.2244139-1-sumang@marvell.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/nic/otx2_flows.c   |  8 ++++++++
- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c  | 15 +++++++++++++++
- 2 files changed, 23 insertions(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-index d0554f6d26731..934c199667b59 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-@@ -867,6 +867,14 @@ static int otx2_prepare_flow_request(struct ethtool_rx_flow_spec *fsp,
- 				return -EINVAL;
- 
- 			vlan_etype = be16_to_cpu(fsp->h_ext.vlan_etype);
-+
-+			/* Drop rule with vlan_etype == 802.1Q
-+			 * and vlan_id == 0 is not supported
-+			 */
-+			if (vlan_etype == ETH_P_8021Q && !fsp->m_ext.vlan_tci &&
-+			    fsp->ring_cookie == RX_CLS_FLOW_DISC)
-+				return -EINVAL;
-+
- 			/* Only ETH_P_8021Q and ETH_P_802AD types supported */
- 			if (vlan_etype != ETH_P_8021Q &&
- 			    vlan_etype != ETH_P_8021AD)
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-index 6a01ab1a6e6f3..1aeb18a901b13 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-@@ -579,6 +579,21 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,
- 			return -EOPNOTSUPP;
- 		}
- 
-+		if (!match.mask->vlan_id) {
-+			struct flow_action_entry *act;
-+			int i;
-+
-+			flow_action_for_each(i, act, &rule->action) {
-+				if (act->id == FLOW_ACTION_DROP) {
-+					netdev_err(nic->netdev,
-+						   "vlan tpid 0x%x with vlan_id %d is not supported for DROP rule.\n",
-+						   ntohs(match.key->vlan_tpid),
-+						   match.key->vlan_id);
-+					return -EOPNOTSUPP;
-+				}
-+			}
-+		}
-+
- 		if (match.mask->vlan_id ||
- 		    match.mask->vlan_dei ||
- 		    match.mask->vlan_priority) {
--- 
-2.39.2
-
diff --git a/queue-6.1/platform-x86-wmi-break-possible-infinite-loop-when-p.patch b/queue-6.1/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
deleted file mode 100644
index 24431ee503e..00000000000
--- a/queue-6.1/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From f884a075428f73c16681b023bdede17618d31877 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 18:11:54 +0300
-Subject: platform/x86: wmi: Break possible infinite loop when parsing GUID
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
-
-The while-loop may break on one of the two conditions, either ID string
-is empty or GUID matches. The second one, may never be reached if the
-parsed string is not correct GUID. In such a case the loop will never
-advance to check the next ID.
-
-Break possible infinite loop by factoring out guid_parse_and_compare()
-helper which may be moved to the generic header for everyone later on
-and preventing from similar mistake in the future.
-
-Interestingly that firstly it appeared when WMI was turned into a bus
-driver, but later when duplicated GUIDs were checked, the while-loop
-has been replaced by for-loop and hence no mistake made again.
-
-Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
-Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com
-Tested-by: Armin Wolf <W_Armin@gmx.de>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 22 ++++++++++++----------
- 1 file changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index 223550a10d4dd..2fe6e147785e4 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -135,6 +135,16 @@ static acpi_status find_guid(const char *guid_string, struct wmi_block **out)
- 	return AE_NOT_FOUND;
- }
- 
-+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
-+{
-+	guid_t guid_input;
-+
-+	if (guid_parse(string, &guid_input))
-+		return false;
-+
-+	return guid_equal(&guid_input, guid);
-+}
-+
- static const void *find_guid_context(struct wmi_block *wblock,
- 				     struct wmi_driver *wdriver)
- {
-@@ -145,11 +155,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 		return NULL;
- 
- 	while (*id->guid_string) {
--		guid_t guid_input;
--
--		if (guid_parse(id->guid_string, &guid_input))
--			continue;
--		if (guid_equal(&wblock->gblock.guid, &guid_input))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return id->context;
- 		id++;
- 	}
-@@ -833,11 +839,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		guid_t driver_guid;
--
--		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
--			continue;
--		if (guid_equal(&driver_guid, &wblock->gblock.guid))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
--- 
-2.39.2
-
diff --git a/queue-6.1/riscv-bpf-fix-inconsistent-jit-image-generation.patch b/queue-6.1/riscv-bpf-fix-inconsistent-jit-image-generation.patch
deleted file mode 100644
index c602a86a6d5..00000000000
--- a/queue-6.1/riscv-bpf-fix-inconsistent-jit-image-generation.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 7b6ccc56fa28b86be4856b34b301dc1413f262ca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:41:31 +0200
-Subject: riscv, bpf: Fix inconsistent JIT image generation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Björn Töpel <bjorn@rivosinc.com>
-
-[ Upstream commit c56fb2aab23505bb7160d06097c8de100b82b851 ]
-
-In order to generate the prologue and epilogue, the BPF JIT needs to
-know which registers that are clobbered. Therefore, the during
-pre-final passes, the prologue is generated after the body of the
-program body-prologue-epilogue. Then, in the final pass, a proper
-prologue-body-epilogue JITted image is generated.
-
-This scheme has worked most of the time. However, for some large
-programs with many jumps, e.g. the test_kmod.sh BPF selftest with
-hardening enabled (blinding constants), this has shown to be
-incorrect. For the final pass, when the proper prologue-body-epilogue
-is generated, the image has not converged. This will lead to that the
-final image will have incorrect jump offsets. The following is an
-excerpt from an incorrect image:
-
-  | ...
-  |     3b8:       00c50663                beq     a0,a2,3c4 <.text+0x3c4>
-  |     3bc:       0020e317                auipc   t1,0x20e
-  |     3c0:       49630067                jalr    zero,1174(t1) # 20e852 <.text+0x20e852>
-  | ...
-  |  20e84c:       8796                    c.mv    a5,t0
-  |  20e84e:       6422                    c.ldsp  s0,8(sp)    # Epilogue start
-  |  20e850:       6141                    c.addi16sp      sp,16
-  |  20e852:       853e                    c.mv    a0,a5       # Incorrect jump target
-  |  20e854:       8082                    c.jr    ra
-
-The image has shrunk, and the epilogue offset is incorrect in the
-final pass.
-
-Correct the problem by always generating proper prologue-body-epilogue
-outputs, which means that the first pass will only generate the body
-to track what registers that are touched.
-
-Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
-Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20230710074131.19596-1-bjorn@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      |  6 +++---
- arch/riscv/net/bpf_jit_core.c | 19 +++++++++++++------
- 2 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index d926e0f7ef571..5ee21a19969c9 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,7 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
--	int body_len;
-+	int prologue_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	int nexentries;
-@@ -216,8 +216,8 @@ static inline int rv_offset(int insn, int off, struct rv_jit_context *ctx)
- 	int from, to;
- 
- 	off++; /* BPF branch is from PC+1, RV is from PC */
--	from = (insn > 0) ? ctx->offset[insn - 1] : 0;
--	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : 0;
-+	from = (insn > 0) ? ctx->offset[insn - 1] : ctx->prologue_len;
-+	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : ctx->prologue_len;
- 	return ninsns_rvoff(to - from);
- }
- 
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 737baf8715da7..7a26a3e1c73cf 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -44,7 +44,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	unsigned int prog_size = 0, extable_size = 0;
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, prologue_len, i;
-+	int pass = 0, prev_ninsns = 0, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 
-@@ -83,6 +83,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 		prog = orig_prog;
- 		goto out_offset;
- 	}
-+
-+	if (build_body(ctx, extra_pass, NULL)) {
-+		prog = orig_prog;
-+		goto out_offset;
-+	}
-+
- 	for (i = 0; i < prog->len; i++) {
- 		prev_ninsns += 32;
- 		ctx->offset[i] = prev_ninsns;
-@@ -91,12 +97,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
- 		pass++;
- 		ctx->ninsns = 0;
-+
-+		bpf_jit_build_prologue(ctx);
-+		ctx->prologue_len = ctx->ninsns;
-+
- 		if (build_body(ctx, extra_pass, ctx->offset)) {
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
--		ctx->body_len = ctx->ninsns;
--		bpf_jit_build_prologue(ctx);
-+
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
- 
-@@ -162,10 +171,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
--		prologue_len = ctx->epilogue_offset - ctx->body_len;
- 		for (i = 0; i < prog->len; i++)
--			ctx->offset[i] = ninsns_rvoff(prologue_len +
--						      ctx->offset[i]);
-+			ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- 		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
--- 
-2.39.2
-
diff --git a/queue-6.1/riscv-mm-fix-truncation-warning-on-rv32.patch b/queue-6.1/riscv-mm-fix-truncation-warning-on-rv32.patch
deleted file mode 100644
index 69a63233a48..00000000000
--- a/queue-6.1/riscv-mm-fix-truncation-warning-on-rv32.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From dee1a9728116f3c2b6626672c0d868bde92c42f9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 01:10:36 +0800
-Subject: riscv: mm: fix truncation warning on RV32
-
-From: Jisheng Zhang <jszhang@kernel.org>
-
-[ Upstream commit b690e266dae2f85f4dfea21fa6a05e3500a51054 ]
-
-lkp reports below sparse warning when building for RV32:
-arch/riscv/mm/init.c:1204:48: sparse: warning: cast truncates bits from
-constant value (100000000 becomes 0)
-
-IMO, the reason we didn't see this truncates bug in real world is "0"
-means MEMBLOCK_ALLOC_ACCESSIBLE in memblock and there's no RV32 HW
-with more than 4GB memory.
-
-Fix it anyway to make sparse happy.
-
-Fixes: decf89f86ecd ("riscv: try to allocate crashkern region from 32bit addressible memory")
-Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202306080034.SLiCiOMn-lkp@intel.com/
-Link: https://lore.kernel.org/r/20230709171036.1906-1-jszhang@kernel.org
-Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/mm/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
-index 9390cdff39ffc..7c4852af9e3f1 100644
---- a/arch/riscv/mm/init.c
-+++ b/arch/riscv/mm/init.c
-@@ -1187,7 +1187,7 @@ static void __init reserve_crashkernel(void)
- 	 */
- 	crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
- 					       search_start,
--					       min(search_end, (unsigned long) SZ_4G));
-+					       min(search_end, (unsigned long)(SZ_4G - 1)));
- 	if (crash_base == 0) {
- 		/* Try again without restricting region to 32bit addressible memory */
- 		crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
--- 
-2.39.2
-
diff --git a/queue-6.1/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch b/queue-6.1/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
deleted file mode 100644
index 5e9a31bb0eb..00000000000
--- a/queue-6.1/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 3cfdca1f3557b9f649763938dc39d44eb66edee0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 13:58:47 +0300
-Subject: scsi: qla2xxx: Fix error code in qla2x00_start_sp()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 ]
-
-This should be negative -EAGAIN instead of positive.  The callers treat
-non-zero error codes the same so it doesn't really impact runtime beyond
-some trivial differences to debug output.
-
-Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
-index 4f48f098ea5a6..605e94f973189 100644
---- a/drivers/scsi/qla2xxx/qla_iocb.c
-+++ b/drivers/scsi/qla2xxx/qla_iocb.c
-@@ -3898,7 +3898,7 @@ qla2x00_start_sp(srb_t *sp)
- 
- 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
- 	if (!pkt) {
--		rval = EAGAIN;
-+		rval = -EAGAIN;
- 		ql_log(ql_log_warn, vha, 0x700c,
- 		    "qla2x00_alloc_iocbs failed.\n");
- 		goto done;
--- 
-2.39.2
-
diff --git a/queue-6.1/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch b/queue-6.1/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
deleted file mode 100644
index 31c0b0b0e38..00000000000
--- a/queue-6.1/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 050be3b329aef1686f3b8443c5b98b80b3278f24 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 22:23:48 -0700
-Subject: scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 89f7ef7f2b23b2a7b8ce346c23161916eae5b15c ]
-
-When RESET_CONTROLLER is not set, kconfig complains about missing
-dependencies for RESET_TI_SYSCON, so add the missing dependency just as is
-done above for SCSI_UFS_QCOM.
-
-Silences this kconfig warning:
-
-WARNING: unmet direct dependencies detected for RESET_TI_SYSCON
-  Depends on [n]: RESET_CONTROLLER [=n] && HAS_IOMEM [=y]
-  Selected by [m]:
-  - SCSI_UFS_MEDIATEK [=m] && SCSI_UFSHCD [=y] && SCSI_UFSHCD_PLATFORM [=y] && ARCH_MEDIATEK [=y]
-
-Fixes: de48898d0cb6 ("scsi: ufs-mediatek: Create reset control device_link")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Link: lore.kernel.org/r/202306020859.1wHg9AaT-lkp@intel.com
-Link: https://lore.kernel.org/r/20230701052348.28046-1-rdunlap@infradead.org
-Cc: Stanley Chu <stanley.chu@mediatek.com>
-Cc: Peter Wang <peter.wang@mediatek.com>
-Cc: Paul Gazzillo <paul@pgazz.com>
-Cc: Necip Fazil Yildiran <fazilyildiran@gmail.com>
-Cc: linux-scsi@vger.kernel.org
-Cc: linux-arm-kernel@lists.infradead.org
-Cc: linux-mediatek@lists.infradead.org
-Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
-Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ufs/host/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/ufs/host/Kconfig b/drivers/ufs/host/Kconfig
-index 4cc2dbd79ed0e..9b39fd76031be 100644
---- a/drivers/ufs/host/Kconfig
-+++ b/drivers/ufs/host/Kconfig
-@@ -71,6 +71,7 @@ config SCSI_UFS_QCOM
- config SCSI_UFS_MEDIATEK
- 	tristate "Mediatek specific hooks to UFS controller platform driver"
- 	depends on SCSI_UFSHCD_PLATFORM && ARCH_MEDIATEK
-+	depends on RESET_CONTROLLER
- 	select PHY_MTK_UFS
- 	select RESET_TI_SYSCON
- 	help
--- 
-2.39.2
-
diff --git a/queue-6.1/series b/queue-6.1/series
index ac21fa72660..2674cfb16bd 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -589,60 +589,3 @@ netfilter-nf_tables-prevent-oob-access-in-nft_byteorder_eval.patch
 wireguard-queueing-use-saner-cpu-selection-wrapping.patch
 wireguard-netlink-send-staged-packets-when-setting-initial-private-key.patch
 tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platform.patch
-drm-panel-simple-add-connector_type-for-innolux_at04.patch
-drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
-swiotlb-always-set-the-number-of-areas-before-alloca.patch
-swiotlb-reduce-the-swiotlb-buffer-size-on-allocation.patch
-swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
-drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
-ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
-igc-remove-delay-during-tx-ring-configuration.patch
-net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
-net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
-net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
-net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
-igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
-igc-handle-pps-start-time-programming-for-past-time-.patch
-blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
-scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
-scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
-bpf-fix-max-stack-depth-check-for-async-callbacks.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
-gve-set-default-duplex-configuration-to-full.patch
-octeontx2-af-promisc-enable-disable-through-mbox.patch
-octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
-ionic-remove-warn_on-to-prevent-panic_on_warn.patch
-net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
-net-prevent-skb-corruption-on-frag-list-segmentation.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-net-dsa-qca8k-add-check-for-skb_copy.patch
-platform-x86-wmi-break-possible-infinite-loop-when-p.patch
-kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
-igc-fix-launchtime-before-start-of-cycle.patch
-igc-fix-inserting-of-empty-frame-for-launchtime.patch
-nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
-riscv-bpf-fix-inconsistent-jit-image-generation.patch
-drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
-drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
-octeontx2-pf-add-additional-check-for-mcam-rules.patch
-erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
-erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
-erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
-net-sched-flower-ensure-both-minimum-and-maximum-por.patch
-riscv-mm-fix-truncation-warning-on-rv32.patch
-netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
-wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
-net-sched-sch_qfq-refactor-parsing-of-netlink-parame.patch
-net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
-nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
diff --git a/queue-6.1/swiotlb-always-set-the-number-of-areas-before-alloca.patch b/queue-6.1/swiotlb-always-set-the-number-of-areas-before-alloca.patch
deleted file mode 100644
index 3bad89d0e78..00000000000
--- a/queue-6.1/swiotlb-always-set-the-number-of-areas-before-alloca.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 8883ecd2d1af7f85f13d7fd381dc3f1e8d7d5f87 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 15:01:03 +0200
-Subject: swiotlb: always set the number of areas before allocating the pool
-
-From: Petr Tesarik <petr.tesarik.ext@huawei.com>
-
-[ Upstream commit aabd12609f91155f26584508b01f548215cc3c0c ]
-
-The number of areas defaults to the number of possible CPUs. However, the
-total number of slots may have to be increased after adjusting the number
-of areas. Consequently, the number of areas must be determined before
-allocating the memory pool. This is even explained with a comment in
-swiotlb_init_remap(), but swiotlb_init_late() adjusts the number of areas
-after slots are already allocated. The areas may end up being smaller than
-IO_TLB_SEGSIZE, which breaks per-area locking.
-
-While fixing swiotlb_init_late(), move all relevant comments before the
-definition of swiotlb_adjust_nareas() and convert them to kernel-doc.
-
-Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock")
-Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
-Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/dma/swiotlb.c | 19 +++++++++++--------
- 1 file changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
-index 7f4ad5e70b40c..3961065412542 100644
---- a/kernel/dma/swiotlb.c
-+++ b/kernel/dma/swiotlb.c
-@@ -117,9 +117,16 @@ static bool round_up_default_nslabs(void)
- 	return true;
- }
- 
-+/**
-+ * swiotlb_adjust_nareas() - adjust the number of areas and slots
-+ * @nareas:	Desired number of areas. Zero is treated as 1.
-+ *
-+ * Adjust the default number of areas in a memory pool.
-+ * The default size of the memory pool may also change to meet minimum area
-+ * size requirements.
-+ */
- static void swiotlb_adjust_nareas(unsigned int nareas)
- {
--	/* use a single area when non is specified */
- 	if (!nareas)
- 		nareas = 1;
- 	else if (!is_power_of_2(nareas))
-@@ -318,10 +325,6 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 	if (swiotlb_force_disable)
- 		return;
- 
--	/*
--	 * default_nslabs maybe changed when adjust area number.
--	 * So allocate bounce buffer after adjusting area number.
--	 */
- 	if (!default_nareas)
- 		swiotlb_adjust_nareas(num_possible_cpus());
- 
-@@ -398,6 +401,9 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 	if (swiotlb_force_disable)
- 		return 0;
- 
-+	if (!default_nareas)
-+		swiotlb_adjust_nareas(num_possible_cpus());
-+
- retry:
- 	order = get_order(nslabs << IO_TLB_SHIFT);
- 	nslabs = SLABS_PER_PAGE << order;
-@@ -432,9 +438,6 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 			(PAGE_SIZE << order) >> 20);
- 	}
- 
--	if (!default_nareas)
--		swiotlb_adjust_nareas(num_possible_cpus());
--
- 	area_order = get_order(array_size(sizeof(*mem->areas),
- 		default_nareas));
- 	mem->areas = (struct io_tlb_area *)
--- 
-2.39.2
-
diff --git a/queue-6.1/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch b/queue-6.1/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
deleted file mode 100644
index c3787961cb9..00000000000
--- a/queue-6.1/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From b5a318236c968f18cbf207f75a11fd89ed54b05f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 15:01:04 +0200
-Subject: swiotlb: reduce the number of areas to match actual memory pool size
-
-From: Petr Tesarik <petr.tesarik.ext@huawei.com>
-
-[ Upstream commit 8ac04063354a01a484d2e55d20ed1958aa0d3392 ]
-
-Although the desired size of the SWIOTLB memory pool is increased in
-swiotlb_adjust_nareas() to match the number of areas, the actual allocation
-may be smaller, which may require reducing the number of areas.
-
-For example, Xen uses swiotlb_init_late(), which in turn uses the page
-allocator. On x86, page size is 4 KiB and MAX_ORDER is 10 (1024 pages),
-resulting in a maximum memory pool size of 4 MiB. This corresponds to 2048
-slots of 2 KiB each. The minimum area size is 128 (IO_TLB_SEGSIZE),
-allowing at most 2048 / 128 = 16 areas.
-
-If num_possible_cpus() is greater than the maximum number of areas, areas
-are smaller than IO_TLB_SEGSIZE and contiguous groups of free slots will
-span multiple areas. When allocating and freeing slots, only one area will
-be properly locked, causing race conditions on the unlocked slots and
-ultimately data corruption, kernel hangs and crashes.
-
-Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock")
-Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
-Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/dma/swiotlb.c | 27 ++++++++++++++++++++++++---
- 1 file changed, 24 insertions(+), 3 deletions(-)
-
-diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
-index cc0c55ed20429..491d3c86c2280 100644
---- a/kernel/dma/swiotlb.c
-+++ b/kernel/dma/swiotlb.c
-@@ -140,6 +140,23 @@ static void swiotlb_adjust_nareas(unsigned int nareas)
- 			(default_nslabs << IO_TLB_SHIFT) >> 20);
- }
- 
-+/**
-+ * limit_nareas() - get the maximum number of areas for a given memory pool size
-+ * @nareas:	Desired number of areas.
-+ * @nslots:	Total number of slots in the memory pool.
-+ *
-+ * Limit the number of areas to the maximum possible number of areas in
-+ * a memory pool of the given size.
-+ *
-+ * Return: Maximum possible number of areas.
-+ */
-+static unsigned int limit_nareas(unsigned int nareas, unsigned long nslots)
-+{
-+	if (nslots < nareas * IO_TLB_SEGSIZE)
-+		return nslots / IO_TLB_SEGSIZE;
-+	return nareas;
-+}
-+
- static int __init
- setup_io_tlb_npages(char *str)
- {
-@@ -347,6 +364,7 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- {
- 	struct io_tlb_mem *mem = &io_tlb_default_mem;
- 	unsigned long nslabs;
-+	unsigned int nareas;
- 	size_t alloc_size;
- 	void *tlb;
- 
-@@ -359,10 +377,12 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 		swiotlb_adjust_nareas(num_possible_cpus());
- 
- 	nslabs = default_nslabs;
-+	nareas = limit_nareas(default_nareas, nslabs);
- 	while ((tlb = swiotlb_memblock_alloc(nslabs, flags, remap)) == NULL) {
- 		if (nslabs <= IO_TLB_MIN_SLABS)
- 			return;
- 		nslabs = ALIGN(nslabs >> 1, IO_TLB_SEGSIZE);
-+		nareas = limit_nareas(nareas, nslabs);
- 	}
- 
- 	if (default_nslabs != nslabs) {
-@@ -408,6 +428,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- {
- 	struct io_tlb_mem *mem = &io_tlb_default_mem;
- 	unsigned long nslabs = ALIGN(size >> IO_TLB_SHIFT, IO_TLB_SEGSIZE);
-+	unsigned int nareas;
- 	unsigned char *vstart = NULL;
- 	unsigned int order, area_order;
- 	bool retried = false;
-@@ -453,8 +474,8 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 			(PAGE_SIZE << order) >> 20);
- 	}
- 
--	area_order = get_order(array_size(sizeof(*mem->areas),
--		default_nareas));
-+	nareas = limit_nareas(default_nareas, nslabs);
-+	area_order = get_order(array_size(sizeof(*mem->areas), nareas));
- 	mem->areas = (struct io_tlb_area *)
- 		__get_free_pages(GFP_KERNEL | __GFP_ZERO, area_order);
- 	if (!mem->areas)
-@@ -468,7 +489,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 	set_memory_decrypted((unsigned long)vstart,
- 			     (nslabs << IO_TLB_SHIFT) >> PAGE_SHIFT);
- 	swiotlb_init_io_tlb_mem(mem, virt_to_phys(vstart), nslabs, 0, true,
--				default_nareas);
-+				nareas);
- 
- 	swiotlb_print_info();
- 	return 0;
--- 
-2.39.2
-
diff --git a/queue-6.1/swiotlb-reduce-the-swiotlb-buffer-size-on-allocation.patch b/queue-6.1/swiotlb-reduce-the-swiotlb-buffer-size-on-allocation.patch
deleted file mode 100644
index 7f7441e5796..00000000000
--- a/queue-6.1/swiotlb-reduce-the-swiotlb-buffer-size-on-allocation.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From fa5816c6a9d111dad466bebe4c8d8f115019c375 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 31 Oct 2022 19:13:27 +1100
-Subject: swiotlb: reduce the swiotlb buffer size on allocation failure
-
-From: Alexey Kardashevskiy <aik@amd.com>
-
-[ Upstream commit 8d58aa484920c4f9be4834a7aeb446cdced21a37 ]
-
-At the moment the AMD encrypted platform reserves 6% of RAM for SWIOTLB
-or 1GB, whichever is less. However it is possible that there is no block
-big enough in the low memory which make SWIOTLB allocation fail and
-the kernel continues without DMA. In such case a VM hangs on DMA.
-
-This moves alloc+remap to a helper and calls it from a loop where
-the size is halved on each iteration.
-
-This updates default_nslabs on successful allocation which looks like
-an oversight as not doing so should have broken callers of
-swiotlb_size_or_default().
-
-Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
-Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Stable-dep-of: 8ac04063354a ("swiotlb: reduce the number of areas to match actual memory pool size")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/dma/swiotlb.c | 63 +++++++++++++++++++++++++++-----------------
- 1 file changed, 39 insertions(+), 24 deletions(-)
-
-diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
-index 3961065412542..cc0c55ed20429 100644
---- a/kernel/dma/swiotlb.c
-+++ b/kernel/dma/swiotlb.c
-@@ -307,6 +307,37 @@ static void swiotlb_init_io_tlb_mem(struct io_tlb_mem *mem, phys_addr_t start,
- 	return;
- }
- 
-+static void *swiotlb_memblock_alloc(unsigned long nslabs, unsigned int flags,
-+		int (*remap)(void *tlb, unsigned long nslabs))
-+{
-+	size_t bytes = PAGE_ALIGN(nslabs << IO_TLB_SHIFT);
-+	void *tlb;
-+
-+	/*
-+	 * By default allocate the bounce buffer memory from low memory, but
-+	 * allow to pick a location everywhere for hypervisors with guest
-+	 * memory encryption.
-+	 */
-+	if (flags & SWIOTLB_ANY)
-+		tlb = memblock_alloc(bytes, PAGE_SIZE);
-+	else
-+		tlb = memblock_alloc_low(bytes, PAGE_SIZE);
-+
-+	if (!tlb) {
-+		pr_warn("%s: Failed to allocate %zu bytes tlb structure\n",
-+			__func__, bytes);
-+		return NULL;
-+	}
-+
-+	if (remap && remap(tlb, nslabs) < 0) {
-+		memblock_free(tlb, PAGE_ALIGN(bytes));
-+		pr_warn("%s: Failed to remap %zu bytes\n", __func__, bytes);
-+		return NULL;
-+	}
-+
-+	return tlb;
-+}
-+
- /*
-  * Statically reserve bounce buffer space and initialize bounce buffer data
-  * structures for the software IO TLB used to implement the DMA API.
-@@ -317,7 +348,6 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 	struct io_tlb_mem *mem = &io_tlb_default_mem;
- 	unsigned long nslabs;
- 	size_t alloc_size;
--	size_t bytes;
- 	void *tlb;
- 
- 	if (!addressing_limit && !swiotlb_force_bounce)
-@@ -329,31 +359,16 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 		swiotlb_adjust_nareas(num_possible_cpus());
- 
- 	nslabs = default_nslabs;
--	/*
--	 * By default allocate the bounce buffer memory from low memory, but
--	 * allow to pick a location everywhere for hypervisors with guest
--	 * memory encryption.
--	 */
--retry:
--	bytes = PAGE_ALIGN(nslabs << IO_TLB_SHIFT);
--	if (flags & SWIOTLB_ANY)
--		tlb = memblock_alloc(bytes, PAGE_SIZE);
--	else
--		tlb = memblock_alloc_low(bytes, PAGE_SIZE);
--	if (!tlb) {
--		pr_warn("%s: failed to allocate tlb structure\n", __func__);
--		return;
--	}
--
--	if (remap && remap(tlb, nslabs) < 0) {
--		memblock_free(tlb, PAGE_ALIGN(bytes));
--
-+	while ((tlb = swiotlb_memblock_alloc(nslabs, flags, remap)) == NULL) {
-+		if (nslabs <= IO_TLB_MIN_SLABS)
-+			return;
- 		nslabs = ALIGN(nslabs >> 1, IO_TLB_SEGSIZE);
--		if (nslabs >= IO_TLB_MIN_SLABS)
--			goto retry;
-+	}
- 
--		pr_warn("%s: Failed to remap %zu bytes\n", __func__, bytes);
--		return;
-+	if (default_nslabs != nslabs) {
-+		pr_info("SWIOTLB bounce buffer size adjusted %lu -> %lu slabs",
-+			default_nslabs, nslabs);
-+		default_nslabs = nslabs;
- 	}
- 
- 	alloc_size = PAGE_ALIGN(array_size(sizeof(*mem->slots), nslabs));
--- 
-2.39.2
-
diff --git a/queue-6.1/udp6-fix-udp6_ehashfn-typo.patch b/queue-6.1/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index f0521da4be0..00000000000
--- a/queue-6.1/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 67060c56abaab910c6cd54ae78876ace1a93512c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index c029222ce46b0..04f1d696503cd 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -90,7 +90,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-6.1/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-6.1/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index 3bcd185c04c..00000000000
--- a/queue-6.1/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From fa647c0fe8a5cd52742db66ea9931a01ca7ca69b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index fb2c35bd73bb1..f6362429b735b 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6146,8 +6146,11 @@ static int airo_get_rate(struct net_device *dev,
- {
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-6.1/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch b/queue-6.1/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
deleted file mode 100644
index 31ba8a9ee89..00000000000
--- a/queue-6.1/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 0d35501866349383cc507854289b2e91736728da Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 10:45:00 +0800
-Subject: wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set()
-
-From: Zhang Shurong <zhang_shurong@foxmail.com>
-
-[ Upstream commit 4f4626cd049576af1276c7568d5b44eb3f7bb1b1 ]
-
-If there is a failure during rtw89_fw_h2c_raw() rtw89_debug_priv_send_h2c
-should return negative error code instead of a positive value count.
-Fix this bug by returning correct error code.
-
-Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
-Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://lore.kernel.org/r/tencent_AD09A61BC4DA92AD1EB0790F5C850E544D07@qq.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw89/debug.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
-index 50701c55ed602..ec0af903961f0 100644
---- a/drivers/net/wireless/realtek/rtw89/debug.c
-+++ b/drivers/net/wireless/realtek/rtw89/debug.c
-@@ -2130,17 +2130,18 @@ static ssize_t rtw89_debug_priv_send_h2c_set(struct file *filp,
- 	struct rtw89_debugfs_priv *debugfs_priv = filp->private_data;
- 	struct rtw89_dev *rtwdev = debugfs_priv->rtwdev;
- 	u8 *h2c;
-+	int ret;
- 	u16 h2c_len = count / 2;
- 
- 	h2c = rtw89_hex2bin_user(rtwdev, user_buf, count);
- 	if (IS_ERR(h2c))
- 		return -EFAULT;
- 
--	rtw89_fw_h2c_raw(rtwdev, h2c, h2c_len);
-+	ret = rtw89_fw_h2c_raw(rtwdev, h2c, h2c_len);
- 
- 	kfree(h2c);
- 
--	return count;
-+	return ret ? ret : count;
- }
- 
- static int
--- 
-2.39.2
-
diff --git a/queue-6.4/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch b/queue-6.4/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
deleted file mode 100644
index aeea9893971..00000000000
--- a/queue-6.4/blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 049354d92774b515eee4d0942a55012adfdfd0ed Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 23:11:39 -0700
-Subject: blk-crypto: use dynamic lock class for blk_crypto_profile::lock
-
-From: Eric Biggers <ebiggers@google.com>
-
-[ Upstream commit 2fb48d88e77f29bf9d278f25bcfe82cf59a0e09b ]
-
-When a device-mapper device is passing through the inline encryption
-support of an underlying device, calls to blk_crypto_evict_key() take
-the blk_crypto_profile::lock of the device-mapper device, then take the
-blk_crypto_profile::lock of the underlying device (nested).  This isn't
-a real deadlock, but it causes a lockdep report because there is only
-one lock class for all instances of this lock.
-
-Lockdep subclasses don't really work here because the hierarchy of block
-devices is dynamic and could have more than 2 levels.
-
-Instead, register a dynamic lock class for each blk_crypto_profile, and
-associate that with the lock.
-
-This avoids false-positive lockdep reports like the following:
-
-    ============================================
-    WARNING: possible recursive locking detected
-    6.4.0-rc5 #2 Not tainted
-    --------------------------------------------
-    fscryptctl/1421 is trying to acquire lock:
-    ffffff80829ca418 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0x44/0x1c0
-
-                   but task is already holding lock:
-    ffffff8086b68ca8 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0xc8/0x1c0
-
-                   other info that might help us debug this:
-     Possible unsafe locking scenario:
-
-           CPU0
-           ----
-      lock(&profile->lock);
-      lock(&profile->lock);
-
-                    *** DEADLOCK ***
-
-     May be due to missing lock nesting notation
-
-Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption")
-Reported-by: Bart Van Assche <bvanassche@acm.org>
-Signed-off-by: Eric Biggers <ebiggers@google.com>
-Reviewed-by: Bart Van Assche <bvanassche@acm.org>
-Link: https://lore.kernel.org/r/20230610061139.212085-1-ebiggers@kernel.org
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- block/blk-crypto-profile.c         | 12 ++++++++++--
- include/linux/blk-crypto-profile.h |  1 +
- 2 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/block/blk-crypto-profile.c b/block/blk-crypto-profile.c
-index 2a67d3fb63e5c..7fabc883e39f1 100644
---- a/block/blk-crypto-profile.c
-+++ b/block/blk-crypto-profile.c
-@@ -79,7 +79,14 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile,
- 	unsigned int slot_hashtable_size;
- 
- 	memset(profile, 0, sizeof(*profile));
--	init_rwsem(&profile->lock);
-+
-+	/*
-+	 * profile->lock of an underlying device can nest inside profile->lock
-+	 * of a device-mapper device, so use a dynamic lock class to avoid
-+	 * false-positive lockdep reports.
-+	 */
-+	lockdep_register_key(&profile->lockdep_key);
-+	__init_rwsem(&profile->lock, "&profile->lock", &profile->lockdep_key);
- 
- 	if (num_slots == 0)
- 		return 0;
-@@ -89,7 +96,7 @@ int blk_crypto_profile_init(struct blk_crypto_profile *profile,
- 	profile->slots = kvcalloc(num_slots, sizeof(profile->slots[0]),
- 				  GFP_KERNEL);
- 	if (!profile->slots)
--		return -ENOMEM;
-+		goto err_destroy;
- 
- 	profile->num_slots = num_slots;
- 
-@@ -435,6 +442,7 @@ void blk_crypto_profile_destroy(struct blk_crypto_profile *profile)
- {
- 	if (!profile)
- 		return;
-+	lockdep_unregister_key(&profile->lockdep_key);
- 	kvfree(profile->slot_hashtable);
- 	kvfree_sensitive(profile->slots,
- 			 sizeof(profile->slots[0]) * profile->num_slots);
-diff --git a/include/linux/blk-crypto-profile.h b/include/linux/blk-crypto-profile.h
-index e6802b69cdd64..90ab33cb5d0ef 100644
---- a/include/linux/blk-crypto-profile.h
-+++ b/include/linux/blk-crypto-profile.h
-@@ -111,6 +111,7 @@ struct blk_crypto_profile {
- 	 * keyslots while ensuring that they can't be changed concurrently.
- 	 */
- 	struct rw_semaphore lock;
-+	struct lock_class_key lockdep_key;
- 
- 	/* List of idle slots, with least recently used slot at front */
- 	wait_queue_head_t idle_slots_wait_queue;
--- 
-2.39.2
-
diff --git a/queue-6.4/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch b/queue-6.4/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
deleted file mode 100644
index 1458f7e9aea..00000000000
--- a/queue-6.4/bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-From a4e1b6b58194575ab350ac438efcc0521fe963dd Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 19:58:48 +0800
-Subject: bpf: cpumap: Fix memory leak in cpu_map_update_elem
-
-From: Pu Lehui <pulehui@huawei.com>
-
-[ Upstream commit 4369016497319a9635702da010d02af1ebb1849d ]
-
-Syzkaller reported a memory leak as follows:
-
-BUG: memory leak
-unreferenced object 0xff110001198ef748 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00  ....J...........
-    00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff  ........(.......
-  backtrace:
-    [<ffffffffadd28087>] __cpu_map_entry_alloc+0xf7/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff110001198ef528 (size 192):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 32 bytes):
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-  backtrace:
-    [<ffffffffadd281f0>] __cpu_map_entry_alloc+0x260/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-BUG: memory leak
-unreferenced object 0xff1100010fd93d68 (size 8):
-  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
-  hex dump (first 8 bytes):
-    00 00 00 00 00 00 00 00                          ........
-  backtrace:
-    [<ffffffffade5db3e>] kvmalloc_node+0x11e/0x170
-    [<ffffffffadd28280>] __cpu_map_entry_alloc+0x2f0/0xb00
-    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
-    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
-    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
-    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
-    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
-    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
-
-In the cpu_map_update_elem flow, when kthread_stop is called before
-calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit
-of kthread has been set by kthread_stop, the threadfn of rcpu->kthread
-will never be executed, and rcpu->refcnt will never be 0, which will
-lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be
-released.
-
-Calling kthread_stop before executing kthread's threadfn will return
--EINTR. We can complete the release of memory resources in this state.
-
-Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
-Signed-off-by: Pu Lehui <pulehui@huawei.com>
-Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
-Acked-by: Hou Tao <houtao1@huawei.com>
-Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/cpumap.c | 40 ++++++++++++++++++++++++----------------
- 1 file changed, 24 insertions(+), 16 deletions(-)
-
-diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
-index 8ec18faa74ac3..3da63be602d1c 100644
---- a/kernel/bpf/cpumap.c
-+++ b/kernel/bpf/cpumap.c
-@@ -126,22 +126,6 @@ static void get_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	atomic_inc(&rcpu->refcnt);
- }
- 
--/* called from workqueue, to workaround syscall using preempt_disable */
--static void cpu_map_kthread_stop(struct work_struct *work)
--{
--	struct bpf_cpu_map_entry *rcpu;
--
--	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
--
--	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
--	 * as it waits until all in-flight call_rcu() callbacks complete.
--	 */
--	rcu_barrier();
--
--	/* kthread_stop will wake_up_process and wait for it to complete */
--	kthread_stop(rcpu->kthread);
--}
--
- static void __cpu_map_ring_cleanup(struct ptr_ring *ring)
- {
- 	/* The tear-down procedure should have made sure that queue is
-@@ -169,6 +153,30 @@ static void put_cpu_map_entry(struct bpf_cpu_map_entry *rcpu)
- 	}
- }
- 
-+/* called from workqueue, to workaround syscall using preempt_disable */
-+static void cpu_map_kthread_stop(struct work_struct *work)
-+{
-+	struct bpf_cpu_map_entry *rcpu;
-+	int err;
-+
-+	rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq);
-+
-+	/* Wait for flush in __cpu_map_entry_free(), via full RCU barrier,
-+	 * as it waits until all in-flight call_rcu() callbacks complete.
-+	 */
-+	rcu_barrier();
-+
-+	/* kthread_stop will wake_up_process and wait for it to complete */
-+	err = kthread_stop(rcpu->kthread);
-+	if (err) {
-+		/* kthread_stop may be called before cpu_map_kthread_run
-+		 * is executed, so we need to release the memory related
-+		 * to rcpu.
-+		 */
-+		put_cpu_map_entry(rcpu);
-+	}
-+}
-+
- static void cpu_map_bpf_prog_run_skb(struct bpf_cpu_map_entry *rcpu,
- 				     struct list_head *listp,
- 				     struct xdp_cpumap_stats *stats)
--- 
-2.39.2
-
diff --git a/queue-6.4/bpf-fix-max-stack-depth-check-for-async-callbacks.patch b/queue-6.4/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
deleted file mode 100644
index 76fd0dd9603..00000000000
--- a/queue-6.4/bpf-fix-max-stack-depth-check-for-async-callbacks.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 13aba8cc9c46174b275c69e259ce56721c4fc8da Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 20:17:29 +0530
-Subject: bpf: Fix max stack depth check for async callbacks
-
-From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-
-[ Upstream commit 5415ccd50a8620c8cbaa32d6f18c946c453566f5 ]
-
-The check_max_stack_depth pass happens after the verifier's symbolic
-execution, and attempts to walk the call graph of the BPF program,
-ensuring that the stack usage stays within bounds for all possible call
-chains. There are two cases to consider: bpf_pseudo_func and
-bpf_pseudo_call. In the former case, the callback pointer is loaded into
-a register, and is assumed that it is passed to some helper later which
-calls it (however there is no way to be sure), but the check remains
-conservative and accounts the stack usage anyway. For this particular
-case, asynchronous callbacks are skipped as they execute asynchronously
-when their corresponding event fires.
-
-The case of bpf_pseudo_call is simpler and we know that the call is
-definitely made, hence the stack depth of the subprog is accounted for.
-
-However, the current check still skips an asynchronous callback even if
-a bpf_pseudo_call was made for it. This is erroneous, as it will miss
-accounting for the stack usage of the asynchronous callback, which can
-be used to breach the maximum stack depth limit.
-
-Fix this by only skipping asynchronous callbacks when the instruction is
-not a pseudo call to the subprog.
-
-Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.")
-Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
-Link: https://lore.kernel.org/r/20230705144730.235802-2-memxor@gmail.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/bpf/verifier.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index 30fabae47a07b..aac31e33323bb 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -5450,8 +5450,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
- 				verbose(env, "verifier bug. subprog has tail_call and async cb\n");
- 				return -EFAULT;
- 			}
--			 /* async callbacks don't increase bpf prog stack size */
--			continue;
-+			/* async callbacks don't increase bpf prog stack size unless called directly */
-+			if (!bpf_pseudo_call(insn + i))
-+				continue;
- 		}
- 		i = next_insn;
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-bridge-dw_hdmi-fix-connector-access-for-scdc.patch b/queue-6.4/drm-bridge-dw_hdmi-fix-connector-access-for-scdc.patch
deleted file mode 100644
index 9ab4155fc23..00000000000
--- a/queue-6.4/drm-bridge-dw_hdmi-fix-connector-access-for-scdc.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 55ccff99ae176eb0c945916524cfd9719d1abd4c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 1 Jun 2023 13:31:53 +0100
-Subject: drm: bridge: dw_hdmi: fix connector access for scdc
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Adrián Larumbe <adrian.larumbe@collabora.com>
-
-[ Upstream commit 98703e4e061fb8715c7613cd227e32cdfd136b23 ]
-
-Commit 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") changed the scdc
-interface to pick up an i2c adapter from a connector instead. However, in
-the case of dw-hdmi, the wrong connector was being used to pass i2c adapter
-information, since dw-hdmi's embedded connector structure is only populated
-when the bridge attachment callback explicitly asks for it.
-
-drm-meson is handling connector creation, so this won't happen, leading to
-a NULL pointer dereference.
-
-Fix it by having scdc functions access dw-hdmi's current connector pointer
-instead, which is assigned during the bridge enablement stage.
-
-Fixes: 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs")
-Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
-Reported-by: Lukas F. Hartmann <lukas@mntre.com>
-Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
-[narmstrong: moved Fixes tag before first S-o-b and added Reported-by tag]
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230601123153.196867-1-adrian.larumbe@collabora.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
-index 603bb3c51027b..3b40e0fdca5cb 100644
---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
-+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
-@@ -1426,9 +1426,9 @@ void dw_hdmi_set_high_tmds_clock_ratio(struct dw_hdmi *hdmi,
- 	/* Control for TMDS Bit Period/TMDS Clock-Period Ratio */
- 	if (dw_hdmi_support_scdc(hdmi, display)) {
- 		if (mtmdsclock > HDMI14_MAX_TMDSCLK)
--			drm_scdc_set_high_tmds_clock_ratio(&hdmi->connector, 1);
-+			drm_scdc_set_high_tmds_clock_ratio(hdmi->curr_conn, 1);
- 		else
--			drm_scdc_set_high_tmds_clock_ratio(&hdmi->connector, 0);
-+			drm_scdc_set_high_tmds_clock_ratio(hdmi->curr_conn, 0);
- 	}
- }
- EXPORT_SYMBOL_GPL(dw_hdmi_set_high_tmds_clock_ratio);
-@@ -2116,7 +2116,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
- 				min_t(u8, bytes, SCDC_MIN_SOURCE_VERSION));
- 
- 			/* Enabled Scrambling in the Sink */
--			drm_scdc_set_scrambling(&hdmi->connector, 1);
-+			drm_scdc_set_scrambling(hdmi->curr_conn, 1);
- 
- 			/*
- 			 * To activate the scrambler feature, you must ensure
-@@ -2132,7 +2132,7 @@ static void hdmi_av_composer(struct dw_hdmi *hdmi,
- 			hdmi_writeb(hdmi, 0, HDMI_FC_SCRAMBLER_CTRL);
- 			hdmi_writeb(hdmi, (u8)~HDMI_MC_SWRSTZ_TMDSSWRST_REQ,
- 				    HDMI_MC_SWRSTZ);
--			drm_scdc_set_scrambling(&hdmi->connector, 0);
-+			drm_scdc_set_scrambling(hdmi->curr_conn, 0);
- 		}
- 	}
- 
-@@ -3553,6 +3553,7 @@ struct dw_hdmi *dw_hdmi_probe(struct platform_device *pdev,
- 	hdmi->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID
- 			 | DRM_BRIDGE_OP_HPD;
- 	hdmi->bridge.interlace_allowed = true;
-+	hdmi->bridge.ddc = hdmi->ddc;
- #ifdef CONFIG_OF
- 	hdmi->bridge.of_node = pdev->dev.of_node;
- #endif
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch b/queue-6.4/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
deleted file mode 100644
index 0f6890212fa..00000000000
--- a/queue-6.4/drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 270b8bee9af7ad5cd07b9d7e5e88c3dfaa772065 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 13 Jun 2023 06:58:13 -0700
-Subject: drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime
-
-From: Douglas Anderson <dianders@chromium.org>
-
-[ Upstream commit 7aa83fbd712a6f08ffa67890061f26d140c2a84f ]
-
-Memory for the "struct device" for any given device isn't supposed to
-be released until the device's release() is called. This is important
-because someone might be holding a kobject reference to the "struct
-device" and might try to access one of its members even after any
-other cleanup/uninitialization has happened.
-
-Code analysis of ti-sn65dsi86 shows that this isn't quite right. When
-the code was written, it was believed that we could rely on the fact
-that the child devices would all be freed before the parent devices
-and thus we didn't need to worry about a release() function. While I
-still believe that the parent's "struct device" is guaranteed to
-outlive the child's "struct device" (because the child holds a kobject
-reference to the parent), the parent's "devm" allocated memory is a
-different story. That appears to be freed much earlier.
-
-Let's make this better for ti-sn65dsi86 by allocating each auxiliary
-with kzalloc and then free that memory in the release().
-
-Fixes: bf73537f411b ("drm/bridge: ti-sn65dsi86: Break GPIO and MIPI-to-eDP bridge into sub-drivers")
-Suggested-by: Stephen Boyd <swboyd@chromium.org>
-Reviewed-by: Stephen Boyd <swboyd@chromium.org>
-Signed-off-by: Douglas Anderson <dianders@chromium.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230613065812.v2.1.I24b838a5b4151fb32bccd6f36397998ea2df9fbb@changeid
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 35 +++++++++++++++++----------
- 1 file changed, 22 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-index 4676cf2900dfd..3c8fd6ea6d6a4 100644
---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
-@@ -170,10 +170,10 @@
-  * @pwm_refclk_freq: Cache for the reference clock input to the PWM.
-  */
- struct ti_sn65dsi86 {
--	struct auxiliary_device		bridge_aux;
--	struct auxiliary_device		gpio_aux;
--	struct auxiliary_device		aux_aux;
--	struct auxiliary_device		pwm_aux;
-+	struct auxiliary_device		*bridge_aux;
-+	struct auxiliary_device		*gpio_aux;
-+	struct auxiliary_device		*aux_aux;
-+	struct auxiliary_device		*pwm_aux;
- 
- 	struct device			*dev;
- 	struct regmap			*regmap;
-@@ -468,27 +468,34 @@ static void ti_sn65dsi86_delete_aux(void *data)
- 	auxiliary_device_delete(data);
- }
- 
--/*
-- * AUX bus docs say that a non-NULL release is mandatory, but it makes no
-- * sense for the model used here where all of the aux devices are allocated
-- * in the single shared structure. We'll use this noop as a workaround.
-- */
--static void ti_sn65dsi86_noop(struct device *dev) {}
-+static void ti_sn65dsi86_aux_device_release(struct device *dev)
-+{
-+	struct auxiliary_device *aux = container_of(dev, struct auxiliary_device, dev);
-+
-+	kfree(aux);
-+}
- 
- static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
--				       struct auxiliary_device *aux,
-+				       struct auxiliary_device **aux_out,
- 				       const char *name)
- {
- 	struct device *dev = pdata->dev;
-+	struct auxiliary_device *aux;
- 	int ret;
- 
-+	aux = kzalloc(sizeof(*aux), GFP_KERNEL);
-+	if (!aux)
-+		return -ENOMEM;
-+
- 	aux->name = name;
- 	aux->dev.parent = dev;
--	aux->dev.release = ti_sn65dsi86_noop;
-+	aux->dev.release = ti_sn65dsi86_aux_device_release;
- 	device_set_of_node_from_dev(&aux->dev, dev);
- 	ret = auxiliary_device_init(aux);
--	if (ret)
-+	if (ret) {
-+		kfree(aux);
- 		return ret;
-+	}
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_uninit_aux, aux);
- 	if (ret)
- 		return ret;
-@@ -497,6 +504,8 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
- 	if (ret)
- 		return ret;
- 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_delete_aux, aux);
-+	if (!ret)
-+		*aux_out = aux;
- 
- 	return ret;
- }
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-fbdev-dma-fix-documented-default-preferred_bpp-v.patch b/queue-6.4/drm-fbdev-dma-fix-documented-default-preferred_bpp-v.patch
deleted file mode 100644
index 45dae98556f..00000000000
--- a/queue-6.4/drm-fbdev-dma-fix-documented-default-preferred_bpp-v.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 9874576143edd04da17ddc4c1e193e5a747512f6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 17:30:31 +0200
-Subject: drm/fbdev-dma: Fix documented default preferred_bpp value
-
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-
-[ Upstream commit 15008052b34efaa86c1d56190ac73c4bf8c462f9 ]
-
-As of commit 6c80a93be62d398e ("drm/fb-helper: Initialize fb-helper's
-preferred BPP in prepare function"), the preferred_bpp parameter of
-drm_fb_helper_prepare() defaults to 32 instead of
-drm_mode_config.preferred_depth.  Hence this also applies to
-drm_fbdev_dma_setup(), which just passes its own preferred_bpp
-parameter.
-
-Fixes: b79fe9abd58bab73 ("drm/fbdev-dma: Implement fbdev emulation for GEM DMA helpers")
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
-Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
-Link: https://patchwork.freedesktop.org/patch/msgid/91f093ffe436a9f94d58fb2bfbc1407f1ebe8bb0.1688656591.git.geert+renesas@glider.be
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/drm_fbdev_dma.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/drm_fbdev_dma.c b/drivers/gpu/drm/drm_fbdev_dma.c
-index 728deffcc0d92..e85cdf69cd6c4 100644
---- a/drivers/gpu/drm/drm_fbdev_dma.c
-+++ b/drivers/gpu/drm/drm_fbdev_dma.c
-@@ -218,7 +218,7 @@ static const struct drm_client_funcs drm_fbdev_dma_client_funcs = {
-  * drm_fbdev_dma_setup() - Setup fbdev emulation for GEM DMA helpers
-  * @dev: DRM device
-  * @preferred_bpp: Preferred bits per pixel for the device.
-- *                 @dev->mode_config.preferred_depth is used if this is zero.
-+ *                 32 is used if this is zero.
-  *
-  * This function sets up fbdev emulation for GEM DMA drivers that support
-  * dumb buffers with a virtual address and that can be mmap'ed.
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch b/queue-6.4/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
deleted file mode 100644
index 1f9856602e4..00000000000
--- a/queue-6.4/drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From c33a440dd21cd1cbd590b5f9cc48a1f556c59732 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 17:10:17 +0300
-Subject: drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
-
-[ Upstream commit 5c413188c68da0e4bffc93de1c80257e20741e69 ]
-
-If we are using Bigjoiner dpll_hw_state is supposed to be exactly
-same as for master crtc, so no need to save it's state for slave crtc.
-
-Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
-Fixes: 0ff0e219d9b8 ("drm/i915: Compute clocks earlier")
-Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230628141017.18937-1-stanislav.lisovskiy@intel.com
-(cherry picked from commit cbaf758809952c95ec00e796695049babb08bb60)
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/i915/display/intel_display.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
-index 7749f95d5d02a..a805b57f3d912 100644
---- a/drivers/gpu/drm/i915/display/intel_display.c
-+++ b/drivers/gpu/drm/i915/display/intel_display.c
-@@ -4968,7 +4968,6 @@ copy_bigjoiner_crtc_state_modeset(struct intel_atomic_state *state,
- 	saved_state->uapi = slave_crtc_state->uapi;
- 	saved_state->scaler_state = slave_crtc_state->scaler_state;
- 	saved_state->shared_dpll = slave_crtc_state->shared_dpll;
--	saved_state->dpll_hw_state = slave_crtc_state->dpll_hw_state;
- 	saved_state->crc_enabled = slave_crtc_state->crc_enabled;
- 
- 	intel_crtc_free_hw_state(slave_crtc_state);
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch b/queue-6.4/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
deleted file mode 100644
index 1a23b03525c..00000000000
--- a/queue-6.4/drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 1b7eae674754c36f9db7a4d8ba556602591973ca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 13:55:03 +0100
-Subject: drm/i915: Fix one wrong caching mode enum usage
-
-From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-
-[ Upstream commit 113899c2669dff148b2a5bea4780123811aecc13 ]
-
-Commit a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch
-buffer") mistakenly passed in uapi I915_CACHING_CACHED as argument to
-i915_gem_object_set_cache_coherency(), which actually takes internal
-enum i915_cache_level.
-
-No functional issue since the value matches I915_CACHE_LLC (1 == 1), which
-is the intended caching mode, but lets clean it up nevertheless.
-
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Fixes: a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch buffer")
-Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
-Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230707125503.3965817-1-tvrtko.ursulin@linux.intel.com
-(cherry picked from commit 49c60b2f0867ac36fd54d513882a48431aeccae7)
-Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/i915/gt/intel_gtt.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/i915/gt/intel_gtt.c b/drivers/gpu/drm/i915/gt/intel_gtt.c
-index 4f436ba7a3c83..123b82f29a1bf 100644
---- a/drivers/gpu/drm/i915/gt/intel_gtt.c
-+++ b/drivers/gpu/drm/i915/gt/intel_gtt.c
-@@ -625,7 +625,7 @@ __vm_create_scratch_for_read(struct i915_address_space *vm, unsigned long size)
- 	if (IS_ERR(obj))
- 		return ERR_CAST(obj);
- 
--	i915_gem_object_set_cache_coherency(obj, I915_CACHING_CACHED);
-+	i915_gem_object_set_cache_coherency(obj, I915_CACHE_LLC);
- 
- 	vma = i915_vma_instance(obj, vm, NULL);
- 	if (IS_ERR(vma)) {
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-nouveau-acr-abort-loading-acr-if-no-firmware-was.patch b/queue-6.4/drm-nouveau-acr-abort-loading-acr-if-no-firmware-was.patch
deleted file mode 100644
index 8bbcb55f035..00000000000
--- a/queue-6.4/drm-nouveau-acr-abort-loading-acr-if-no-firmware-was.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 68f7b5d7a40cfd63e381066ace1770379c8a7c51 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 May 2023 22:18:38 +0200
-Subject: drm/nouveau/acr: Abort loading ACR if no firmware was found
-
-From: Karol Herbst <kherbst@redhat.com>
-
-[ Upstream commit 938a06c8b7913455073506c33ae3bff029c3c4ef ]
-
-This fixes a NULL pointer access inside nvkm_acr_oneinit in case necessary
-firmware files couldn't be loaded.
-
-Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/212
-Fixes: 4b569ded09fd ("drm/nouveau/acr/ga102: initial support")
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Reviewed-by: Dave Airlie <airlied@redhat.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230522201838.1496622-1-kherbst@redhat.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
-index 795f3a649b122..9b8ca4e898f90 100644
---- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c
-@@ -224,7 +224,7 @@ nvkm_acr_oneinit(struct nvkm_subdev *subdev)
- 	u64 falcons;
- 	int ret, i;
- 
--	if (list_empty(&acr->hsfw)) {
-+	if (list_empty(&acr->hsfw) || !acr->func || !acr->func->wpr_layout) {
- 		nvkm_debug(subdev, "No HSFW(s)\n");
- 		nvkm_acr_cleanup(acr);
- 		return 0;
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-nouveau-bring-back-blit-subchannel-for-pre-nv50-.patch b/queue-6.4/drm-nouveau-bring-back-blit-subchannel-for-pre-nv50-.patch
deleted file mode 100644
index dbb48294d8d..00000000000
--- a/queue-6.4/drm-nouveau-bring-back-blit-subchannel-for-pre-nv50-.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 6baa2918216778a5c148247d43684e5a2f83e6d1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 26 May 2023 11:10:52 +0200
-Subject: drm/nouveau: bring back blit subchannel for pre nv50 GPUs
-
-From: Karol Herbst <kherbst@redhat.com>
-
-[ Upstream commit 835a65f51790e1f72b1ab106ec89db9ac15b47d6 ]
-
-1ba6113a90a0 removed a lot of the kernel GPU channel, but method 0x128
-was important as otherwise the GPU spams us with `CACHE_ERROR` messages.
-
-We use the blit subchannel inside our vblank handling, so we should keep
-at least this part.
-
-v2: Only do it for NV11+ GPUs
-
-Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/201
-Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers")
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230526091052.2169044-1-kherbst@redhat.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/nouveau/nouveau_chan.c |  1 +
- drivers/gpu/drm/nouveau/nouveau_chan.h |  1 +
- drivers/gpu/drm/nouveau/nouveau_drm.c  | 20 +++++++++++++++++---
- 3 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c
-index e648ecd0c1a03..3dfbc374478e6 100644
---- a/drivers/gpu/drm/nouveau/nouveau_chan.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_chan.c
-@@ -90,6 +90,7 @@ nouveau_channel_del(struct nouveau_channel **pchan)
- 		if (cli)
- 			nouveau_svmm_part(chan->vmm->svmm, chan->inst);
- 
-+		nvif_object_dtor(&chan->blit);
- 		nvif_object_dtor(&chan->nvsw);
- 		nvif_object_dtor(&chan->gart);
- 		nvif_object_dtor(&chan->vram);
-diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.h b/drivers/gpu/drm/nouveau/nouveau_chan.h
-index e06a8ffed31a8..bad7466bd0d59 100644
---- a/drivers/gpu/drm/nouveau/nouveau_chan.h
-+++ b/drivers/gpu/drm/nouveau/nouveau_chan.h
-@@ -53,6 +53,7 @@ struct nouveau_channel {
- 	u32 user_put;
- 
- 	struct nvif_object user;
-+	struct nvif_object blit;
- 
- 	struct nvif_event kill;
- 	atomic_t killed;
-diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
-index 7aac9384600ed..40fb9a8349180 100644
---- a/drivers/gpu/drm/nouveau/nouveau_drm.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
-@@ -375,15 +375,29 @@ nouveau_accel_gr_init(struct nouveau_drm *drm)
- 		ret = nvif_object_ctor(&drm->channel->user, "drmNvsw",
- 				       NVDRM_NVSW, nouveau_abi16_swclass(drm),
- 				       NULL, 0, &drm->channel->nvsw);
-+
-+		if (ret == 0 && device->info.chipset >= 0x11) {
-+			ret = nvif_object_ctor(&drm->channel->user, "drmBlit",
-+					       0x005f, 0x009f,
-+					       NULL, 0, &drm->channel->blit);
-+		}
-+
- 		if (ret == 0) {
- 			struct nvif_push *push = drm->channel->chan.push;
--			ret = PUSH_WAIT(push, 2);
--			if (ret == 0)
-+			ret = PUSH_WAIT(push, 8);
-+			if (ret == 0) {
-+				if (device->info.chipset >= 0x11) {
-+					PUSH_NVSQ(push, NV05F, 0x0000, drm->channel->blit.handle);
-+					PUSH_NVSQ(push, NV09F, 0x0120, 0,
-+							       0x0124, 1,
-+							       0x0128, 2);
-+				}
- 				PUSH_NVSQ(push, NV_SW, 0x0000, drm->channel->nvsw.handle);
-+			}
- 		}
- 
- 		if (ret) {
--			NV_ERROR(drm, "failed to allocate sw class, %d\n", ret);
-+			NV_ERROR(drm, "failed to allocate sw or blit class, %d\n", ret);
- 			nouveau_accel_gr_fini(drm);
- 			return;
- 		}
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-nouveau-disp-fix-hdmi-on-gt215.patch b/queue-6.4/drm-nouveau-disp-fix-hdmi-on-gt215.patch
deleted file mode 100644
index 5334d54403b..00000000000
--- a/queue-6.4/drm-nouveau-disp-fix-hdmi-on-gt215.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From d92dc097c5c959d8a0645d0fdc7f502852665962 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 23:22:46 +0200
-Subject: drm/nouveau/disp: fix HDMI on gt215+
-
-From: Karol Herbst <kherbst@redhat.com>
-
-[ Upstream commit d94303699921bda8141ad33554ae55b615ddd149 ]
-
-Cc: Ben Skeggs <bskeggs@redhat.com>
-Cc: Lyude Paul <lyude@redhat.com>
-Fixes: f530bc60a30b ("drm/nouveau/disp: move HDMI config into acquire + infoframe methods")
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230628212248.3798605-1-kherbst@redhat.com
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/nouveau/nvkm/engine/disp/gt215.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gt215.c
-index a2c7c6f83dcdb..506ffbe7b8421 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gt215.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gt215.c
-@@ -125,7 +125,7 @@ gt215_sor_hdmi_infoframe_avi(struct nvkm_ior *ior, int head, void *data, u32 siz
- 	pack_hdmi_infoframe(&avi, data, size);
- 
- 	nvkm_mask(device, 0x61c520 + soff, 0x00000001, 0x00000000);
--	if (size)
-+	if (!size)
- 		return;
- 
- 	nvkm_wr32(device, 0x61c528 + soff, avi.header);
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-nouveau-disp-g94-enable-hdmi.patch b/queue-6.4/drm-nouveau-disp-g94-enable-hdmi.patch
deleted file mode 100644
index b9fd97a181d..00000000000
--- a/queue-6.4/drm-nouveau-disp-g94-enable-hdmi.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From c4673406b30a28d2fa8ed21b37962828adf965e2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 18:06:45 +0200
-Subject: drm/nouveau/disp/g94: enable HDMI
-
-From: Karol Herbst <kherbst@redhat.com>
-
-[ Upstream commit c177872cb056e0b499af4717d8d1977017fd53df ]
-
-Cc: Ben Skeggs <bskeggs@redhat.com>
-Cc: Lyude Paul <lyude@redhat.com>
-Fixes: f530bc60a30b ("drm/nouveau/disp: move HDMI config into acquire + infoframe methods")
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230630160645.3984596-1-kherbst@redhat.com
-Signed-off-by: Karol Herbst <kherbst@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/nouveau/nvkm/engine/disp/g94.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/g94.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/g94.c
-index a4853c4e5ee3a..67ef889a0c5f4 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/g94.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/g94.c
-@@ -295,6 +295,7 @@ g94_sor = {
- 	.clock = nv50_sor_clock,
- 	.war_2 = g94_sor_war_2,
- 	.war_3 = g94_sor_war_3,
-+	.hdmi = &g84_sor_hdmi,
- 	.dp = &g94_sor_dp,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch b/queue-6.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
deleted file mode 100644
index db25f0745c3..00000000000
--- a/queue-6.4/drm-panel-simple-add-connector_type-for-innolux_at04.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 6ca5c4bfdbae1b72a46946af102d9677577fcd6d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 08:22:02 -0300
-Subject: drm/panel: simple: Add connector_type for innolux_at043tn24
-
-From: Fabio Estevam <festevam@denx.de>
-
-[ Upstream commit 2c56a751845ddfd3078ebe79981aaaa182629163 ]
-
-The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type'
-information to avoid the following warning:
-
-panel-simple panel: Specify missing connector_type
-
-Signed-off-by: Fabio Estevam <festevam@denx.de>
-Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24")
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index d8efbcee9bc12..1927fef9aed67 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2117,6 +2117,7 @@ static const struct panel_desc innolux_at043tn24 = {
- 		.height = 54,
- 	},
- 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
-+	.connector_type = DRM_MODE_CONNECTOR_DPI,
- 	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch b/queue-6.4/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
deleted file mode 100644
index 99cfa6582f3..00000000000
--- a/queue-6.4/drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From e0bf3f1aa9d658c8219ebdd882c6aacb1bdf32ba Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 22:16:02 +0200
-Subject: drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
-
-From: Marek Vasut <marex@denx.de>
-
-[ Upstream commit 1c519980aced3da1fae37c1339cf43b24eccdee7 ]
-
-Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC
-flags. Those are used by various bridges in the pipeline to correctly
-configure its sync signals polarity.
-
-Fixes: d69de69f2be1 ("drm/panel: simple: Add Powertip PH800480T013 panel")
-Signed-off-by: Marek Vasut <marex@denx.de>
-Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
-Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
-Link: https://patchwork.freedesktop.org/patch/msgid/20230615201602.565948-1-marex@denx.de
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/panel/panel-simple.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
-index 1927fef9aed67..e02249b212c2a 100644
---- a/drivers/gpu/drm/panel/panel-simple.c
-+++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3110,6 +3110,7 @@ static const struct drm_display_mode powertip_ph800480t013_idf02_mode = {
- 	.vsync_start = 480 + 49,
- 	.vsync_end = 480 + 49 + 2,
- 	.vtotal = 480 + 49 + 2 + 22,
-+	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
- };
- 
- static const struct panel_desc powertip_ph800480t013_idf02  = {
--- 
-2.39.2
-
diff --git a/queue-6.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch b/queue-6.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
deleted file mode 100644
index c6cf620791c..00000000000
--- a/queue-6.4/erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 179c93cb4147df032e78c950833127e4fe6344e5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 17:34:10 +0800
-Subject: erofs: avoid infinite loop in z_erofs_do_read_page() when reading
- beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 ]
-
-z_erofs_do_read_page() may loop infinitely due to the inappropriate
-truncation in the below statement. Since the offset is 64 bits and min_t()
-truncates the result to 32 bits. The solution is to replace unsigned int
-with a 64-bit type, such as erofs_off_t.
-    cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-
-    - For example:
-        - offset = 0x400160000
-        - end = 0x370
-        - map->m_la = 0x160370
-        - offset + end - map->m_la = 0x400000000
-        - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
-    - Expected result:
-        - cur = 0
-    - Actual result:
-        - cur = 0x370
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index bedfff5d45faf..997ca4b32e87f 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -990,7 +990,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
- 	 */
- 	tight &= (fe->mode > Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE);
- 
--	cur = end - min_t(unsigned int, offset + end - map->m_la, end);
-+	cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
- 	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
- 		zero_user_segment(page, cur, end);
- 		goto next_part;
--- 
-2.39.2
-
diff --git a/queue-6.4/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch b/queue-6.4/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
deleted file mode 100644
index 0746f68d54e..00000000000
--- a/queue-6.4/erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 201f9e4e49bcb83a199bb05c153545ff504140bf Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 12:25:31 +0800
-Subject: erofs: avoid useless loops in z_erofs_pcluster_readmore() when
- reading beyond EOF
-
-From: Chunhai Guo <guochunhai@vivo.com>
-
-[ Upstream commit 936aa701d82d397c2d1afcd18ce2c739471d978d ]
-
-z_erofs_pcluster_readmore() may take a long time to loop when the page
-offset is large enough, which is unnecessary should be prevented.
-
-For example, when the following case is encountered, it will loop 4691368
-times, taking about 27 seconds:
-    - offset = 19217289215
-    - inode_size = 1442672
-
-Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
-Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy")
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Yue Hu <huyue2@coolpad.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230710042531.28761-1-guochunhai@vivo.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/zdata.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
-index 502893e3da010..bedfff5d45faf 100644
---- a/fs/erofs/zdata.c
-+++ b/fs/erofs/zdata.c
-@@ -1807,7 +1807,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_decompress_frontend *f,
- 	}
- 
- 	cur = map->m_la + map->m_llen - 1;
--	while (cur >= end) {
-+	while ((cur >= end) && (cur < i_size_read(inode))) {
- 		pgoff_t index = cur >> PAGE_SHIFT;
- 		struct page *page;
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch b/queue-6.4/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
deleted file mode 100644
index 9ac828578ca..00000000000
--- a/queue-6.4/erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 625c8bd6b37ff491ca8ee641313b1693e0a5d5f2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 14:21:30 +0800
-Subject: erofs: fix fsdax unavailability for chunk-based regular files
-
-From: Xin Yin <yinxin.x@bytedance.com>
-
-[ Upstream commit 18bddc5b67038722cb88fcf51fbf41a0277092cb ]
-
-DAX can be used to share page cache between VMs, reducing guest memory
-overhead. And chunk based data format is widely used for VM and
-container image. So enable dax support for it, make erofs better used
-for VM scenarios.
-
-Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files")
-Signed-off-by: Xin Yin <yinxin.x@bytedance.com>
-Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Reviewed-by: Chao Yu <chao@kernel.org>
-Link: https://lore.kernel.org/r/20230711062130.7860-1-yinxin.x@bytedance.com
-Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/erofs/inode.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
-index d70b12b81507f..e12592727a546 100644
---- a/fs/erofs/inode.c
-+++ b/fs/erofs/inode.c
-@@ -183,7 +183,8 @@ static void *erofs_read_inode(struct erofs_buf *buf,
- 
- 	inode->i_flags &= ~S_DAX;
- 	if (test_opt(&sbi->opt, DAX_ALWAYS) && S_ISREG(inode->i_mode) &&
--	    vi->datalayout == EROFS_INODE_FLAT_PLAIN)
-+	    (vi->datalayout == EROFS_INODE_FLAT_PLAIN ||
-+	     vi->datalayout == EROFS_INODE_CHUNK_BASED))
- 		inode->i_flags |= S_DAX;
- 
- 	if (!nblks)
--- 
-2.39.2
-
diff --git a/queue-6.4/fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch b/queue-6.4/fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch
deleted file mode 100644
index bda7ba8a935..00000000000
--- a/queue-6.4/fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 9ea6b366f8d472e6814dbc9aad4e5bfb1d00ac39 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 3 Jul 2023 17:23:36 +0800
-Subject: fprobe: add unlock to match a succeeded ftrace_test_recursion_trylock
-
-From: Ze Gao <zegao2021@gmail.com>
-
-[ Upstream commit 5f0c584daf7464f04114c65dd07269ee2bfedc13 ]
-
-Unlock ftrace recursion lock when fprobe_kprobe_handler() is failed
-because of some running kprobe.
-
-Link: https://lore.kernel.org/all/20230703092336.268371-1-zegao@tencent.com/
-
-Fixes: 3cc4e2c5fbae ("fprobe: make fprobe_kprobe_handler recursion free")
-Reported-by: Yafang <laoar.shao@gmail.com>
-Closes: https://lore.kernel.org/linux-trace-kernel/CALOAHbC6UpfFOOibdDiC7xFc5YFUgZnk3MZ=3Ny6we=AcrNbew@mail.gmail.com/
-Signed-off-by: Ze Gao <zegao@tencent.com>
-Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Acked-by: Yafang Shao <laoar.shao@gmail.com>
-Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
-Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/trace/fprobe.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
-index 18d36842faf57..93b3e361bb97a 100644
---- a/kernel/trace/fprobe.c
-+++ b/kernel/trace/fprobe.c
-@@ -102,12 +102,14 @@ static void fprobe_kprobe_handler(unsigned long ip, unsigned long parent_ip,
- 
- 	if (unlikely(kprobe_running())) {
- 		fp->nmissed++;
--		return;
-+		goto recursion_unlock;
- 	}
- 
- 	kprobe_busy_begin();
- 	__fprobe_handler(ip, parent_ip, ops, fregs);
- 	kprobe_busy_end();
-+
-+recursion_unlock:
- 	ftrace_test_recursion_unlock(bit);
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/gve-set-default-duplex-configuration-to-full.patch b/queue-6.4/gve-set-default-duplex-configuration-to-full.patch
deleted file mode 100644
index 3517d138933..00000000000
--- a/queue-6.4/gve-set-default-duplex-configuration-to-full.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 756748806f6ce7d1f3efe286826e4813f7725296 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 12:41:28 +0800
-Subject: gve: Set default duplex configuration to full
-
-From: Junfeng Guo <junfeng.guo@intel.com>
-
-[ Upstream commit 0503efeadbf6bb8bf24397613a73b67e665eac5f ]
-
-Current duplex mode was unset in the driver, resulting in the default
-parameter being set to 0, which corresponds to half duplex. It might
-mislead users to have incorrect expectation about the driver's
-transmission capabilities.
-Set the default duplex configuration to full, as the driver runs in
-full duplex mode at this point.
-
-Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.")
-Signed-off-by: Junfeng Guo <junfeng.guo@intel.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Message-ID: <20230706044128.2726747-1-junfeng.guo@intel.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/google/gve/gve_ethtool.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c
-index cfd4b8d284d12..50162ec9424df 100644
---- a/drivers/net/ethernet/google/gve/gve_ethtool.c
-+++ b/drivers/net/ethernet/google/gve/gve_ethtool.c
-@@ -590,6 +590,9 @@ static int gve_get_link_ksettings(struct net_device *netdev,
- 		err = gve_adminq_report_link_speed(priv);
- 
- 	cmd->base.speed = priv->link_speed;
-+
-+	cmd->base.duplex = DUPLEX_FULL;
-+
- 	return err;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/hid-hyperv-avoid-struct-memcpy-overrun-warning.patch b/queue-6.4/hid-hyperv-avoid-struct-memcpy-overrun-warning.patch
deleted file mode 100644
index 48fb7d1f04f..00000000000
--- a/queue-6.4/hid-hyperv-avoid-struct-memcpy-overrun-warning.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From b4bc4dd1ce538c2050276f4c029b3d91ea87604f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 16:02:24 +0200
-Subject: HID: hyperv: avoid struct memcpy overrun warning
-
-From: Arnd Bergmann <arnd@arndb.de>
-
-[ Upstream commit 5f151364b1da6bd217632fd4ee8cc24eaf66a497 ]
-
-A previous patch addressed the fortified memcpy warning for most
-builds, but I still see this one with gcc-9:
-
-In file included from include/linux/string.h:254,
-                 from drivers/hid/hid-hyperv.c:8:
-In function 'fortify_memcpy_chk',
-    inlined from 'mousevsc_on_receive' at drivers/hid/hid-hyperv.c:272:3:
-include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
-  583 |    __write_overflow_field(p_size_field, size);
-      |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-My guess is that the WARN_ON() itself is what confuses gcc, so it no
-longer sees that there is a correct range check. Rework the code in a
-way that helps readability and avoids the warning.
-
-Fixes: 542f25a94471 ("HID: hyperv: Replace one-element array with flexible-array member")
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Reviewed-by: Michael Kelley <mikelley@microsoft.com>
-Link: https://lore.kernel.org/r/20230705140242.844167-1-arnd@kernel.org
-Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/hid/hid-hyperv.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
-index 49d4a26895e76..f33485d83d24f 100644
---- a/drivers/hid/hid-hyperv.c
-+++ b/drivers/hid/hid-hyperv.c
-@@ -258,19 +258,17 @@ static void mousevsc_on_receive(struct hv_device *device,
- 
- 	switch (hid_msg_hdr->type) {
- 	case SYNTH_HID_PROTOCOL_RESPONSE:
-+		len = struct_size(pipe_msg, data, pipe_msg->size);
-+
- 		/*
- 		 * While it will be impossible for us to protect against
- 		 * malicious/buggy hypervisor/host, add a check here to
- 		 * ensure we don't corrupt memory.
- 		 */
--		if (struct_size(pipe_msg, data, pipe_msg->size)
--			> sizeof(struct mousevsc_prt_msg)) {
--			WARN_ON(1);
-+		if (WARN_ON(len > sizeof(struct mousevsc_prt_msg)))
- 			break;
--		}
- 
--		memcpy(&input_dev->protocol_resp, pipe_msg,
--				struct_size(pipe_msg, data, pipe_msg->size));
-+		memcpy(&input_dev->protocol_resp, pipe_msg, len);
- 		complete(&input_dev->wait_event);
- 		break;
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch b/queue-6.4/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
deleted file mode 100644
index 5b57d1a65c1..00000000000
--- a/queue-6.4/ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From c426f5ca59f9bd7765ca00379db289f3b8213478 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 17:40:23 -0700
-Subject: ice: Fix max_rate check while configuring TX rate limits
-
-From: Sridhar Samudrala <sridhar.samudrala@intel.com>
-
-[ Upstream commit 5f16da6ee6ac32e6c8098bc4cfcc4f170694f9da ]
-
-Remove incorrect check in ice_validate_mqprio_opt() that limits
-filter configuration when sum of max_rates of all TCs exceeds
-the link speed. The max rate of each TC is unrelated to value
-used by other TCs and is valid as long as it is less than link
-speed.
-
-Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc")
-Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
-Signed-off-by: Sudheer Mogilappagari <sudheer.mogilappagari@intel.com>
-Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
-index fcc027c938fda..eef7c1224887a 100644
---- a/drivers/net/ethernet/intel/ice/ice_main.c
-+++ b/drivers/net/ethernet/intel/ice/ice_main.c
-@@ -8114,10 +8114,10 @@ static int
- ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 			 struct tc_mqprio_qopt_offload *mqprio_qopt)
- {
--	u64 sum_max_rate = 0, sum_min_rate = 0;
- 	int non_power_of_2_qcount = 0;
- 	struct ice_pf *pf = vsi->back;
- 	int max_rss_q_cnt = 0;
-+	u64 sum_min_rate = 0;
- 	struct device *dev;
- 	int i, speed;
- 	u8 num_tc;
-@@ -8133,6 +8133,7 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 	dev = ice_pf_to_dev(pf);
- 	vsi->ch_rss_size = 0;
- 	num_tc = mqprio_qopt->qopt.num_tc;
-+	speed = ice_get_link_speed_kbps(vsi);
- 
- 	for (i = 0; num_tc; i++) {
- 		int qcount = mqprio_qopt->qopt.count[i];
-@@ -8173,7 +8174,6 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 		 */
- 		max_rate = mqprio_qopt->max_rate[i];
- 		max_rate = div_u64(max_rate, ICE_BW_KBPS_DIVISOR);
--		sum_max_rate += max_rate;
- 
- 		/* min_rate is minimum guaranteed rate and it can't be zero */
- 		min_rate = mqprio_qopt->min_rate[i];
-@@ -8186,6 +8186,12 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 			return -EINVAL;
- 		}
- 
-+		if (max_rate && max_rate > speed) {
-+			dev_err(dev, "TC%d: max_rate(%llu Kbps) > link speed of %u Kbps\n",
-+				i, max_rate, speed);
-+			return -EINVAL;
-+		}
-+
- 		iter_div_u64_rem(min_rate, ICE_MIN_BW_LIMIT, &rem);
- 		if (rem) {
- 			dev_err(dev, "TC%d: Min Rate not multiple of %u Kbps",
-@@ -8223,12 +8229,6 @@ ice_validate_mqprio_qopt(struct ice_vsi *vsi,
- 	    (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i]))
- 		return -EINVAL;
- 
--	speed = ice_get_link_speed_kbps(vsi);
--	if (sum_max_rate && sum_max_rate > (u64)speed) {
--		dev_err(dev, "Invalid max Tx rate(%llu) Kbps > speed(%u) Kbps specified\n",
--			sum_max_rate, speed);
--		return -EINVAL;
--	}
- 	if (sum_min_rate && sum_min_rate > (u64)speed) {
- 		dev_err(dev, "Invalid min Tx rate(%llu) Kbps > speed (%u) Kbps specified\n",
- 			sum_min_rate, speed);
--- 
-2.39.2
-
diff --git a/queue-6.4/ice-fix-tx-queue-rate-limit-when-tcs-are-configured.patch b/queue-6.4/ice-fix-tx-queue-rate-limit-when-tcs-are-configured.patch
deleted file mode 100644
index 96d134658ee..00000000000
--- a/queue-6.4/ice-fix-tx-queue-rate-limit-when-tcs-are-configured.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From 1f0c01f03b4c0b4ebc5b97bf3e0679fc1e9b7c3b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 17:40:24 -0700
-Subject: ice: Fix tx queue rate limit when TCs are configured
-
-From: Sridhar Samudrala <sridhar.samudrala@intel.com>
-
-[ Upstream commit 479cdfe388a04a16fdd127f3e9e9e019e45e5573 ]
-
-Configuring tx_maxrate via sysfs interface
-/sys/class/net/eth0/queues/tx-1/tx_maxrate was not working when
-TCs are configured because always main VSI was being used. Fix by
-using correct VSI in ice_set_tx_maxrate when TCs are configured.
-
-Fixes: 1ddef455f4a8 ("ice: Add NDO callback to set the maximum per-queue bitrate")
-Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
-Signed-off-by: Sudheer Mogilappagari <sudheer.mogilappagari@intel.com>
-Tested-by: Bharathi Sreenivas <bharathi.sreenivas@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/ice/ice_main.c   |  7 +++++++
- drivers/net/ethernet/intel/ice/ice_tc_lib.c | 22 ++++++++++-----------
- drivers/net/ethernet/intel/ice/ice_tc_lib.h |  1 +
- 3 files changed, 19 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
-index eef7c1224887a..1277e0a044ee4 100644
---- a/drivers/net/ethernet/intel/ice/ice_main.c
-+++ b/drivers/net/ethernet/intel/ice/ice_main.c
-@@ -5969,6 +5969,13 @@ ice_set_tx_maxrate(struct net_device *netdev, int queue_index, u32 maxrate)
- 	q_handle = vsi->tx_rings[queue_index]->q_handle;
- 	tc = ice_dcb_get_tc(vsi, queue_index);
- 
-+	vsi = ice_locate_vsi_using_queue(vsi, queue_index);
-+	if (!vsi) {
-+		netdev_err(netdev, "Invalid VSI for given queue %d\n",
-+			   queue_index);
-+		return -EINVAL;
-+	}
-+
- 	/* Set BW back to default, when user set maxrate to 0 */
- 	if (!maxrate)
- 		status = ice_cfg_q_bw_dflt_lmt(vsi->port_info, vsi->idx, tc,
-diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
-index d1a31f236d26a..8578dc1cb967d 100644
---- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
-+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
-@@ -735,17 +735,16 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)
- /**
-  * ice_locate_vsi_using_queue - locate VSI using queue (forward to queue action)
-  * @vsi: Pointer to VSI
-- * @tc_fltr: Pointer to tc_flower_filter
-+ * @queue: Queue index
-  *
-- * Locate the VSI using specified queue. When ADQ is not enabled, always
-- * return input VSI, otherwise locate corresponding VSI based on per channel
-- * offset and qcount
-+ * Locate the VSI using specified "queue". When ADQ is not enabled,
-+ * always return input VSI, otherwise locate corresponding
-+ * VSI based on per channel "offset" and "qcount"
-  */
--static struct ice_vsi *
--ice_locate_vsi_using_queue(struct ice_vsi *vsi,
--			   struct ice_tc_flower_fltr *tc_fltr)
-+struct ice_vsi *
-+ice_locate_vsi_using_queue(struct ice_vsi *vsi, int queue)
- {
--	int num_tc, tc, queue;
-+	int num_tc, tc;
- 
- 	/* if ADQ is not active, passed VSI is the candidate VSI */
- 	if (!ice_is_adq_active(vsi->back))
-@@ -755,7 +754,6 @@ ice_locate_vsi_using_queue(struct ice_vsi *vsi,
- 	 * upon queue number)
- 	 */
- 	num_tc = vsi->mqprio_qopt.qopt.num_tc;
--	queue = tc_fltr->action.fwd.q.queue;
- 
- 	for (tc = 0; tc < num_tc; tc++) {
- 		int qcount = vsi->mqprio_qopt.qopt.count[tc];
-@@ -797,6 +795,7 @@ ice_tc_forward_action(struct ice_vsi *vsi, struct ice_tc_flower_fltr *tc_fltr)
- 	struct ice_pf *pf = vsi->back;
- 	struct device *dev;
- 	u32 tc_class;
-+	int q;
- 
- 	dev = ice_pf_to_dev(pf);
- 
-@@ -825,7 +824,8 @@ ice_tc_forward_action(struct ice_vsi *vsi, struct ice_tc_flower_fltr *tc_fltr)
- 		/* Determine destination VSI even though the action is
- 		 * FWD_TO_QUEUE, because QUEUE is associated with VSI
- 		 */
--		dest_vsi = tc_fltr->dest_vsi;
-+		q = tc_fltr->action.fwd.q.queue;
-+		dest_vsi = ice_locate_vsi_using_queue(vsi, q);
- 		break;
- 	default:
- 		dev_err(dev,
-@@ -1702,7 +1702,7 @@ ice_tc_forward_to_queue(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr,
- 	/* If ADQ is configured, and the queue belongs to ADQ VSI, then prepare
- 	 * ADQ switch filter
- 	 */
--	ch_vsi = ice_locate_vsi_using_queue(vsi, fltr);
-+	ch_vsi = ice_locate_vsi_using_queue(vsi, fltr->action.fwd.q.queue);
- 	if (!ch_vsi)
- 		return -EINVAL;
- 	fltr->dest_vsi = ch_vsi;
-diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.h b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
-index 8d5e22ac7023c..189c73d885356 100644
---- a/drivers/net/ethernet/intel/ice/ice_tc_lib.h
-+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.h
-@@ -203,6 +203,7 @@ static inline int ice_chnl_dmac_fltr_cnt(struct ice_pf *pf)
- 	return pf->num_dmac_chnl_fltrs;
- }
- 
-+struct ice_vsi *ice_locate_vsi_using_queue(struct ice_vsi *vsi, int queue);
- int
- ice_add_cls_flower(struct net_device *netdev, struct ice_vsi *vsi,
- 		   struct flow_cls_offload *cls_flower);
--- 
-2.39.2
-
diff --git a/queue-6.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch b/queue-6.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
deleted file mode 100644
index ca6c596b525..00000000000
--- a/queue-6.4/icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From a22ee92cac3b600e237a63c814daa71e2083eb91 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 18:43:27 -0700
-Subject: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in
- icmp6_dev().
-
-From: Kuniyuki Iwashima <kuniyu@amazon.com>
-
-[ Upstream commit 2aaa8a15de73874847d62eb595c6683bface80fd ]
-
-With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
-has the link-local address as src and dst IP and will be forwarded to
-an external IP in the IPv6 Ext Hdr.
-
-For example, the script below generates a packet whose src IP is the
-link-local address and dst is updated to 11::.
-
-  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
-  # python3
-  >>> from socket import *
-  >>> from scapy.all import *
-  >>>
-  >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
-  >>>
-  >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
-  >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
-  >>>
-  >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
-  >>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
-
-For such a packet, we call ip6_route_input() to look up a route for the
-next destination in these three functions depending on the header type.
-
-  * ipv6_rthdr_rcv()
-  * ipv6_rpl_srh_rcv()
-  * ipv6_srh_rcv()
-
-If no route is found, ip6_null_entry is set to skb, and the following
-dst_input(skb) calls ip6_pkt_drop().
-
-Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
-as the input device is the loopback interface.  Then, we have to check if
-skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
-for ip6_null_entry.
-
-BUG: kernel NULL pointer dereference, address: 0000000000000000
- PF: supervisor read access in kernel mode
- PF: error_code(0x0000) - not-present page
-PGD 0 P4D 0
-Oops: 0000 [#1] PREEMPT SMP PTI
-CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
-Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Call Trace:
- <IRQ>
- ip6_pkt_drop (net/ipv6/route.c:4513)
- ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
- ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
- ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
- __netif_receive_skb_one_core (net/core/dev.c:5455)
- process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
- __napi_poll (net/core/dev.c:6460)
- net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
- __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
- do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
- </IRQ>
- <TASK>
- __local_bh_enable_ip (kernel/softirq.c:381)
- __dev_queue_xmit (net/core/dev.c:4231)
- ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
- rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
- sock_sendmsg (net/socket.c:725 net/socket.c:748)
- __sys_sendto (net/socket.c:2134)
- __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
- do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
- entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
-RIP: 0033:0x7f9dc751baea
-Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
-RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
-RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
-RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
-RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
-R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
-R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
- </TASK>
-Modules linked in:
-CR2: 0000000000000000
- ---[ end trace 0000000000000000 ]---
-RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
-Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
-RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
-RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
-RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
-RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
-R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
-R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
-FS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
-CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
-PKRU: 55555554
-Kernel panic - not syncing: Fatal exception in interrupt
-Kernel Offset: disabled
-
-Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
-Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/icmp.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
-index 9edf1f45b1ed6..65fa5014bc85e 100644
---- a/net/ipv6/icmp.c
-+++ b/net/ipv6/icmp.c
-@@ -424,7 +424,10 @@ static struct net_device *icmp6_dev(const struct sk_buff *skb)
- 	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
- 		const struct rt6_info *rt6 = skb_rt6_info(skb);
- 
--		if (rt6)
-+		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
-+		 * and ip6_null_entry could be set to skb if no route is found.
-+		 */
-+		if (rt6 && rt6->rt6i_idev)
- 			dev = rt6->rt6i_idev->dev;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-add-condition-for-qbv_config_change_errors-count.patch b/queue-6.4/igc-add-condition-for-qbv_config_change_errors-count.patch
deleted file mode 100644
index 958e18aa681..00000000000
--- a/queue-6.4/igc-add-condition-for-qbv_config_change_errors-count.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From b34edb600747de56af3d2abd046a7ba09ca8a345 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 15 May 2023 14:03:36 +0800
-Subject: igc: Add condition for qbv_config_change_errors counter
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit ed89b74d2dc920cb61d3094e0e97ec8775b13086 ]
-
-Add condition to increase the qbv counter during taprio qbv
-configuration only.
-
-There might be a case when TC already been setup then user configure
-the ETF/CBS qdisc and this counter will increase if no condition above.
-
-Fixes: ae4fe4698300 ("igc: Add qbv_config_change_errors counter")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc.h      | 1 +
- drivers/net/ethernet/intel/igc/igc_main.c | 2 ++
- drivers/net/ethernet/intel/igc/igc_tsn.c  | 1 +
- 3 files changed, 4 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
-index 9dc9b982a7ea6..9902f726f06a9 100644
---- a/drivers/net/ethernet/intel/igc/igc.h
-+++ b/drivers/net/ethernet/intel/igc/igc.h
-@@ -184,6 +184,7 @@ struct igc_adapter {
- 	u32 max_frame_size;
- 	u32 min_frame_size;
- 
-+	int tc_setup_type;
- 	ktime_t base_time;
- 	ktime_t cycle_time;
- 	bool qbv_enable;
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 5f2e8bcd75973..a8815ccf7887d 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -6295,6 +6295,8 @@ static int igc_setup_tc(struct net_device *dev, enum tc_setup_type type,
- {
- 	struct igc_adapter *adapter = netdev_priv(dev);
- 
-+	adapter->tc_setup_type = type;
-+
- 	switch (type) {
- 	case TC_QUERY_CAPS:
- 		return igc_tc_query_caps(adapter, type_data);
-diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c
-index 94a2b0dfb54d4..6b299b83e7ef2 100644
---- a/drivers/net/ethernet/intel/igc/igc_tsn.c
-+++ b/drivers/net/ethernet/intel/igc/igc_tsn.c
-@@ -249,6 +249,7 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter)
- 		 * Gate Control List (GCL) is running.
- 		 */
- 		if ((rd32(IGC_BASET_H) || rd32(IGC_BASET_L)) &&
-+		    (adapter->tc_setup_type == TC_SETUP_QDISC_TAPRIO) &&
- 		    tsn_mode_reconfig)
- 			adapter->qbv_config_change_errors++;
- 	} else {
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-add-igc_xdp_buff-wrapper-for-xdp_buff-in-driver.patch b/queue-6.4/igc-add-igc_xdp_buff-wrapper-for-xdp_buff-in-driver.patch
deleted file mode 100644
index 639a98e562e..00000000000
--- a/queue-6.4/igc-add-igc_xdp_buff-wrapper-for-xdp_buff-in-driver.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From 8c665525c75977297efb957a7a7e51b89b5ca546 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 18 Apr 2023 15:30:47 +0200
-Subject: igc: Add igc_xdp_buff wrapper for xdp_buff in driver
-
-From: Jesper Dangaard Brouer <brouer@redhat.com>
-
-[ Upstream commit 73b7123de0cfa4f6609677e927ab02cb05b593c2 ]
-
-Driver specific metadata data for XDP-hints kfuncs are propagated via tail
-extending the struct xdp_buff with a locally scoped driver struct.
-
-Zero-Copy AF_XDP/XSK does similar tricks via struct xdp_buff_xsk. This
-xdp_buff_xsk struct contains a CB area (24 bytes) that can be used for
-extending the locally scoped driver into. The XSK_CHECK_PRIV_TYPE define
-catch size violations build time.
-
-The changes needed for AF_XDP zero-copy in igc_clean_rx_irq_zc()
-is done in next patch, because the member rx_desc isn't available
-at this point.
-
-Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Acked-by: Song Yoong Siang <yoong.siang.song@intel.com>
-Link: https://lore.kernel.org/bpf/168182464779.616355.3761989884165609387.stgit@firesoul
-Stable-dep-of: 175c241288c0 ("igc: Fix TX Hang issue when QBV Gate is closed")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc.h      |  5 +++++
- drivers/net/ethernet/intel/igc/igc_main.c | 16 +++++++++-------
- 2 files changed, 14 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
-index 9902f726f06a9..3bb48840a249e 100644
---- a/drivers/net/ethernet/intel/igc/igc.h
-+++ b/drivers/net/ethernet/intel/igc/igc.h
-@@ -502,6 +502,11 @@ struct igc_rx_buffer {
- 	};
- };
- 
-+/* context wrapper around xdp_buff to provide access to descriptor metadata */
-+struct igc_xdp_buff {
-+	struct xdp_buff xdp;
-+};
-+
- struct igc_q_vector {
- 	struct igc_adapter *adapter;    /* backlink */
- 	void __iomem *itr_register;
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index b131c8f2b03df..c6169357f72fc 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -2246,6 +2246,8 @@ static bool igc_alloc_rx_buffers_zc(struct igc_ring *ring, u16 count)
- 	if (!count)
- 		return ok;
- 
-+	XSK_CHECK_PRIV_TYPE(struct igc_xdp_buff);
-+
- 	desc = IGC_RX_DESC(ring, i);
- 	bi = &ring->rx_buffer_info[i];
- 	i -= ring->count;
-@@ -2530,8 +2532,8 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
- 		union igc_adv_rx_desc *rx_desc;
- 		struct igc_rx_buffer *rx_buffer;
- 		unsigned int size, truesize;
-+		struct igc_xdp_buff ctx;
- 		ktime_t timestamp = 0;
--		struct xdp_buff xdp;
- 		int pkt_offset = 0;
- 		void *pktbuf;
- 
-@@ -2565,13 +2567,13 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
- 		}
- 
- 		if (!skb) {
--			xdp_init_buff(&xdp, truesize, &rx_ring->xdp_rxq);
--			xdp_prepare_buff(&xdp, pktbuf - igc_rx_offset(rx_ring),
-+			xdp_init_buff(&ctx.xdp, truesize, &rx_ring->xdp_rxq);
-+			xdp_prepare_buff(&ctx.xdp, pktbuf - igc_rx_offset(rx_ring),
- 					 igc_rx_offset(rx_ring) + pkt_offset,
- 					 size, true);
--			xdp_buff_clear_frags_flag(&xdp);
-+			xdp_buff_clear_frags_flag(&ctx.xdp);
- 
--			skb = igc_xdp_run_prog(adapter, &xdp);
-+			skb = igc_xdp_run_prog(adapter, &ctx.xdp);
- 		}
- 
- 		if (IS_ERR(skb)) {
-@@ -2593,9 +2595,9 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
- 		} else if (skb)
- 			igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
- 		else if (ring_uses_build_skb(rx_ring))
--			skb = igc_build_skb(rx_ring, rx_buffer, &xdp);
-+			skb = igc_build_skb(rx_ring, rx_buffer, &ctx.xdp);
- 		else
--			skb = igc_construct_skb(rx_ring, rx_buffer, &xdp,
-+			skb = igc_construct_skb(rx_ring, rx_buffer, &ctx.xdp,
- 						timestamp);
- 
- 		/* exit if we failed to retrieve a buffer */
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-add-xdp-hints-kfuncs-for-rx-hash.patch b/queue-6.4/igc-add-xdp-hints-kfuncs-for-rx-hash.patch
deleted file mode 100644
index 1f854268990..00000000000
--- a/queue-6.4/igc-add-xdp-hints-kfuncs-for-rx-hash.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 8f7e2ee37d15e7153091b9b0842b2e9cab18e3c7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 18 Apr 2023 15:30:52 +0200
-Subject: igc: Add XDP hints kfuncs for RX hash
-
-From: Jesper Dangaard Brouer <brouer@redhat.com>
-
-[ Upstream commit 8416814fffa9cfa74c18da149f522dd9e1850987 ]
-
-This implements XDP hints kfunc for RX-hash (xmo_rx_hash).
-The HW rss hash type is handled via mapping table.
-
-This igc driver (default config) does L3 hashing for UDP packets
-(excludes UDP src/dest ports in hash calc).  Meaning RSS hash type is
-L3 based.  Tested that the igc_rss_type_num for UDP is either
-IGC_RSS_TYPE_HASH_IPV4 or IGC_RSS_TYPE_HASH_IPV6.
-
-This patch also updates AF_XDP zero-copy function igc_clean_rx_irq_zc()
-to use the xdp_buff wrapper struct igc_xdp_buff.
-
-Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Acked-by: Song Yoong Siang <yoong.siang.song@intel.com>
-Link: https://lore.kernel.org/bpf/168182465285.616355.2701740913376314790.stgit@firesoul
-Stable-dep-of: 175c241288c0 ("igc: Fix TX Hang issue when QBV Gate is closed")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc.h      |  1 +
- drivers/net/ethernet/intel/igc/igc_main.c | 53 +++++++++++++++++++++++
- 2 files changed, 54 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
-index 3bb48840a249e..f09c6a65e3ab8 100644
---- a/drivers/net/ethernet/intel/igc/igc.h
-+++ b/drivers/net/ethernet/intel/igc/igc.h
-@@ -505,6 +505,7 @@ struct igc_rx_buffer {
- /* context wrapper around xdp_buff to provide access to descriptor metadata */
- struct igc_xdp_buff {
- 	struct xdp_buff xdp;
-+	union igc_adv_rx_desc *rx_desc;
- };
- 
- struct igc_q_vector {
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index c6169357f72fc..c0e21701e7817 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -2572,6 +2572,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
- 					 igc_rx_offset(rx_ring) + pkt_offset,
- 					 size, true);
- 			xdp_buff_clear_frags_flag(&ctx.xdp);
-+			ctx.rx_desc = rx_desc;
- 
- 			skb = igc_xdp_run_prog(adapter, &ctx.xdp);
- 		}
-@@ -2698,6 +2699,15 @@ static void igc_dispatch_skb_zc(struct igc_q_vector *q_vector,
- 	napi_gro_receive(&q_vector->napi, skb);
- }
- 
-+static struct igc_xdp_buff *xsk_buff_to_igc_ctx(struct xdp_buff *xdp)
-+{
-+	/* xdp_buff pointer used by ZC code path is alloc as xdp_buff_xsk. The
-+	 * igc_xdp_buff shares its layout with xdp_buff_xsk and private
-+	 * igc_xdp_buff fields fall into xdp_buff_xsk->cb
-+	 */
-+       return (struct igc_xdp_buff *)xdp;
-+}
-+
- static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
- {
- 	struct igc_adapter *adapter = q_vector->adapter;
-@@ -2716,6 +2726,7 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
- 	while (likely(total_packets < budget)) {
- 		union igc_adv_rx_desc *desc;
- 		struct igc_rx_buffer *bi;
-+		struct igc_xdp_buff *ctx;
- 		ktime_t timestamp = 0;
- 		unsigned int size;
- 		int res;
-@@ -2733,6 +2744,9 @@ static int igc_clean_rx_irq_zc(struct igc_q_vector *q_vector, const int budget)
- 
- 		bi = &ring->rx_buffer_info[ntc];
- 
-+		ctx = xsk_buff_to_igc_ctx(bi->xdp);
-+		ctx->rx_desc = desc;
-+
- 		if (igc_test_staterr(desc, IGC_RXDADV_STAT_TSIP)) {
- 			timestamp = igc_ptp_rx_pktstamp(q_vector->adapter,
- 							bi->xdp->data);
-@@ -6490,6 +6504,44 @@ u32 igc_rd32(struct igc_hw *hw, u32 reg)
- 	return value;
- }
- 
-+/* Mapping HW RSS Type to enum xdp_rss_hash_type */
-+static enum xdp_rss_hash_type igc_xdp_rss_type[IGC_RSS_TYPE_MAX_TABLE] = {
-+	[IGC_RSS_TYPE_NO_HASH]		= XDP_RSS_TYPE_L2,
-+	[IGC_RSS_TYPE_HASH_TCP_IPV4]	= XDP_RSS_TYPE_L4_IPV4_TCP,
-+	[IGC_RSS_TYPE_HASH_IPV4]	= XDP_RSS_TYPE_L3_IPV4,
-+	[IGC_RSS_TYPE_HASH_TCP_IPV6]	= XDP_RSS_TYPE_L4_IPV6_TCP,
-+	[IGC_RSS_TYPE_HASH_IPV6_EX]	= XDP_RSS_TYPE_L3_IPV6_EX,
-+	[IGC_RSS_TYPE_HASH_IPV6]	= XDP_RSS_TYPE_L3_IPV6,
-+	[IGC_RSS_TYPE_HASH_TCP_IPV6_EX] = XDP_RSS_TYPE_L4_IPV6_TCP_EX,
-+	[IGC_RSS_TYPE_HASH_UDP_IPV4]	= XDP_RSS_TYPE_L4_IPV4_UDP,
-+	[IGC_RSS_TYPE_HASH_UDP_IPV6]	= XDP_RSS_TYPE_L4_IPV6_UDP,
-+	[IGC_RSS_TYPE_HASH_UDP_IPV6_EX] = XDP_RSS_TYPE_L4_IPV6_UDP_EX,
-+	[10] = XDP_RSS_TYPE_NONE, /* RSS Type above 9 "Reserved" by HW  */
-+	[11] = XDP_RSS_TYPE_NONE, /* keep array sized for SW bit-mask   */
-+	[12] = XDP_RSS_TYPE_NONE, /* to handle future HW revisons       */
-+	[13] = XDP_RSS_TYPE_NONE,
-+	[14] = XDP_RSS_TYPE_NONE,
-+	[15] = XDP_RSS_TYPE_NONE,
-+};
-+
-+static int igc_xdp_rx_hash(const struct xdp_md *_ctx, u32 *hash,
-+			   enum xdp_rss_hash_type *rss_type)
-+{
-+	const struct igc_xdp_buff *ctx = (void *)_ctx;
-+
-+	if (!(ctx->xdp.rxq->dev->features & NETIF_F_RXHASH))
-+		return -ENODATA;
-+
-+	*hash = le32_to_cpu(ctx->rx_desc->wb.lower.hi_dword.rss);
-+	*rss_type = igc_xdp_rss_type[igc_rss_type(ctx->rx_desc)];
-+
-+	return 0;
-+}
-+
-+static const struct xdp_metadata_ops igc_xdp_metadata_ops = {
-+	.xmo_rx_hash			= igc_xdp_rx_hash,
-+};
-+
- /**
-  * igc_probe - Device Initialization Routine
-  * @pdev: PCI device information struct
-@@ -6563,6 +6615,7 @@ static int igc_probe(struct pci_dev *pdev,
- 	hw->hw_addr = adapter->io_addr;
- 
- 	netdev->netdev_ops = &igc_netdev_ops;
-+	netdev->xdp_metadata_ops = &igc_xdp_metadata_ops;
- 	igc_ethtool_set_ops(netdev);
- 	netdev->watchdog_timeo = 5 * HZ;
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-do-not-enable-taprio-offload-for-invalid-argumen.patch b/queue-6.4/igc-do-not-enable-taprio-offload-for-invalid-argumen.patch
deleted file mode 100644
index b7e158530c6..00000000000
--- a/queue-6.4/igc-do-not-enable-taprio-offload-for-invalid-argumen.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From 2c4ff73ed926e50f603809bb4611a7f59b76753e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:10 +0200
-Subject: igc: Do not enable taprio offload for invalid arguments
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 82ff5f29b7377d614f0c01fd74b5d0cb225f0adc ]
-
-Only set adapter->taprio_offload_enable after validating the arguments.
-Otherwise, it stays set even if the offload was not enabled.
-Since the subsequent code does not get executed in case of invalid
-arguments, it will not be read at first.
-However, by activating and then deactivating another offload
-(e.g. ETF/TX launchtime offload), taprio_offload_enable is read
-and erroneously keeps the offload feature of the NIC enabled.
-
-This can be reproduced as follows:
-
-    # TAPRIO offload (flags == 0x2) and negative base-time leading to expected -ERANGE
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time -1000 \
-	    sched-entry S 01 300000 \
-	    flags 0x2
-
-    # IGC_TQAVCTRL is 0x0 as expected (iomem=relaxed for reading register)
-    sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1
-
-    # Activate ETF offload
-    sudo tc qdisc replace dev enp1s0 parent root handle 6666 mqprio \
-	    num_tc 3 \
-	    map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 \
-	    queues 1@0 1@1 2@2 \
-	    hw 0
-    sudo tc qdisc add dev enp1s0 parent 6666:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload
-
-    # IGC_TQAVCTRL is 0x9 as expected
-    sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1
-
-    # Deactivate ETF offload again
-    sudo tc qdisc delete dev enp1s0 parent 6666:1
-
-    # IGC_TQAVCTRL should now be 0x0 again, but is observed as 0x9
-    sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1
-
-Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 18 ++++++------------
- 1 file changed, 6 insertions(+), 12 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 6bed12224120f..f051ca733af1b 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -6090,6 +6090,7 @@ static int igc_tsn_clear_schedule(struct igc_adapter *adapter)
- 
- 	adapter->base_time = 0;
- 	adapter->cycle_time = NSEC_PER_SEC;
-+	adapter->taprio_offload_enable = false;
- 	adapter->qbv_config_change_errors = 0;
- 	adapter->qbv_transition = false;
- 	adapter->qbv_count = 0;
-@@ -6117,20 +6118,12 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	size_t n;
- 	int i;
- 
--	switch (qopt->cmd) {
--	case TAPRIO_CMD_REPLACE:
--		adapter->taprio_offload_enable = true;
--		break;
--	case TAPRIO_CMD_DESTROY:
--		adapter->taprio_offload_enable = false;
--		break;
--	default:
--		return -EOPNOTSUPP;
--	}
--
--	if (!adapter->taprio_offload_enable)
-+	if (qopt->cmd == TAPRIO_CMD_DESTROY)
- 		return igc_tsn_clear_schedule(adapter);
- 
-+	if (qopt->cmd != TAPRIO_CMD_REPLACE)
-+		return -EOPNOTSUPP;
-+
- 	if (qopt->base_time < 0)
- 		return -ERANGE;
- 
-@@ -6142,6 +6135,7 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 
- 	adapter->cycle_time = qopt->cycle_time;
- 	adapter->base_time = qopt->base_time;
-+	adapter->taprio_offload_enable = true;
- 
- 	igc_ptp_read(adapter, &now);
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-fix-inserting-of-empty-frame-for-launchtime.patch b/queue-6.4/igc-fix-inserting-of-empty-frame-for-launchtime.patch
deleted file mode 100644
index 20fa4e6c94a..00000000000
--- a/queue-6.4/igc-fix-inserting-of-empty-frame-for-launchtime.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 6b68b0e96e9c61cab6fdc99d116c0f3373e355f5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:14 +0200
-Subject: igc: Fix inserting of empty frame for launchtime
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 0bcc62858d6ba62cbade957d69745e6adeed5f3d ]
-
-The insertion of an empty frame was introduced with
-commit db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-in order to ensure that the current cycle has at least one packet if
-there is some packet to be scheduled for the next cycle.
-
-However, the current implementation does not properly check if
-a packet is already scheduled for the current cycle. Currently,
-an empty packet is always inserted if and only if
-txtime >= end_of_cycle && txtime > last_tx_cycle
-but since last_tx_cycle is always either the end of the current
-cycle (end_of_cycle) or the end of a previous cycle, the
-second part (txtime > last_tx_cycle) is always true unless
-txtime == last_tx_cycle.
-
-What actually needs to be checked here is if the last_tx_cycle
-was already written within the current cycle, so an empty frame
-should only be inserted if and only if
-txtime >= end_of_cycle && end_of_cycle > last_tx_cycle.
-
-This patch does not only avoid an unnecessary insertion, but it
-can actually be harmful to insert an empty packet if packets
-are already scheduled in the current cycle, because it can lead
-to a situation where the empty packet is actually processed
-as the first packet in the upcoming cycle shifting the packet
-with the first_flag even one cycle into the future, finally leading
-to a TX hang.
-
-The TX hang can be reproduced on a i225 with:
-
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x1 \
-	    txtime-delay 500000 \
-	    clockid CLOCK_TAI
-    sudo tc qdisc replace dev enp1s0 parent 100:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload \
-	    skip_sock_check
-
-and traffic generator
-
-    sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns
-
-with traffic.cfg
-
-    #define ETH_P_IP        0x0800
-
-    {
-      /* Ethernet Header */
-      0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e,  # MAC Dest - adapt as needed
-      0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36,  # MAC Src  - adapt as needed
-      const16(ETH_P_IP),
-
-      /* IPv4 Header */
-      0b01000101, 0,   # IPv4 version, IHL, TOS
-      const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))
-      const16(2),      # IPv4 ident
-      0b01000000, 0,   # IPv4 flags, fragmentation off
-      64,              # IPv4 TTL
-      17,              # Protocol UDP
-      csumip(14, 33),  # IPv4 checksum
-
-      /* UDP Header */
-      10,  0, 48, 1,   # IP Src - adapt as needed
-      10,  0, 48, 10,  # IP Dest - adapt as needed
-      const16(5555),   # UDP Src Port
-      const16(6666),   # UDP Dest Port
-      const16(1008),   # UDP length (UDP header 8 bytes + payload length)
-      csumudp(14, 34), # UDP checksum
-
-      /* Payload */
-      fill('W', 1000),
-    }
-
-and the observed message with that is for example
-
- igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang
-   Tx Queue             <0>
-   TDH                  <32>
-   TDT                  <3c>
-   next_to_use          <3c>
-   next_to_clean        <32>
- buffer_info[next_to_clean]
-   time_stamp           <ffff26a8>
-   next_to_watch        <00000000632a1828>
-   jiffies              <ffff27f8>
-   desc.status          <1048000>
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 96a2f6e6f6b8a..44aa4342cbbb5 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1029,7 +1029,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 			*first_flag = true;
- 			ring->last_ff_cycle = baset_est;
- 
--			if (ktime_compare(txtime, ring->last_tx_cycle) > 0)
-+			if (ktime_compare(end_of_cycle, ring->last_tx_cycle) > 0)
- 				*insert_empty = true;
- 		}
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-fix-launchtime-before-start-of-cycle.patch b/queue-6.4/igc-fix-launchtime-before-start-of-cycle.patch
deleted file mode 100644
index e9b033a1744..00000000000
--- a/queue-6.4/igc-fix-launchtime-before-start-of-cycle.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From eb725bbffeb2dd4b8cf1e08c265041dc518ca66b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:13 +0200
-Subject: igc: Fix launchtime before start of cycle
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit c1bca9ac0bcb355be11354c2e68bc7bf31f5ac5a ]
-
-It is possible (verified on a running system) that frames are processed
-by igc_tx_launchtime with a txtime before the start of the cycle
-(baset_est).
-
-However, the result of txtime - baset_est is written into a u32,
-leading to a wrap around to a positive number. The following
-launchtime > 0 check will only branch to executing launchtime = 0
-if launchtime is already 0.
-
-Fix it by using a s32 before checking launchtime > 0.
-
-Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 97eb3c390de9a..96a2f6e6f6b8a 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1016,7 +1016,7 @@ static __le32 igc_tx_launchtime(struct igc_ring *ring, ktime_t txtime,
- 	ktime_t base_time = adapter->base_time;
- 	ktime_t now = ktime_get_clocktai();
- 	ktime_t baset_est, end_of_cycle;
--	u32 launchtime;
-+	s32 launchtime;
- 	s64 n;
- 
- 	n = div64_s64(ktime_sub_ns(now, base_time), cycle_time);
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-fix-tx-hang-issue-when-qbv-gate-is-closed.patch b/queue-6.4/igc-fix-tx-hang-issue-when-qbv-gate-is-closed.patch
deleted file mode 100644
index 37fe891ae56..00000000000
--- a/queue-6.4/igc-fix-tx-hang-issue-when-qbv-gate-is-closed.patch
+++ /dev/null
@@ -1,316 +0,0 @@
-From 42ea27f8a5e10b6150f8d50d0ee4ea639c8892e7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 3 Jun 2023 20:59:34 +0800
-Subject: igc: Fix TX Hang issue when QBV Gate is closed
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit 175c241288c09f81eb7b44d65c1ef6045efa4d1a ]
-
-If a user schedules a Gate Control List (GCL) to close one of
-the QBV gates while also transmitting a packet to that closed gate,
-TX Hang will be happen. HW would not drop any packet when the gate
-is closed and keep queuing up in HW TX FIFO until the gate is re-opened.
-This patch implements the solution to drop the packet for the closed
-gate.
-
-This patch will also reset the adapter to perform SW initialization
-for each 1st Gate Control List (GCL) to avoid hang.
-This is due to the HW design, where changing to TSN transmit mode
-requires SW initialization. Intel Discrete I225/6 transmit mode
-cannot be changed when in dynamic mode according to Software User
-Manual Section 7.5.2.1. Subsequent Gate Control List (GCL) operations
-will proceed without a reset, as they already are in TSN Mode.
-
-Step to reproduce:
-
-DUT:
-1) Configure GCL List with certain gate close.
-
-BASE=$(date +%s%N)
-tc qdisc replace dev $IFACE parent root handle 100 taprio \
-    num_tc 4 \
-    map 0 1 2 3 3 3 3 3 3 3 3 3 3 3 3 3 \
-    queues 1@0 1@1 1@2 1@3 \
-    base-time $BASE \
-    sched-entry S 0x8 500000 \
-    sched-entry S 0x4 500000 \
-    flags 0x2
-
-2) Transmit the packet to closed gate. You may use udp_tai
-application to transmit UDP packet to any of the closed gate.
-
-./udp_tai -i <interface> -P 100000 -p 90 -c 1 -t <0/1> -u 30004
-
-Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading")
-Co-developed-by: Tan Tee Min <tee.min.tan@linux.intel.com>
-Signed-off-by: Tan Tee Min <tee.min.tan@linux.intel.com>
-Tested-by: Chwee Lin Choong <chwee.lin.choong@intel.com>
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc.h      |  6 +++
- drivers/net/ethernet/intel/igc/igc_main.c | 58 +++++++++++++++++++++--
- drivers/net/ethernet/intel/igc/igc_tsn.c  | 41 ++++++++++------
- 3 files changed, 87 insertions(+), 18 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
-index f09c6a65e3ab8..c0a07af36cb23 100644
---- a/drivers/net/ethernet/intel/igc/igc.h
-+++ b/drivers/net/ethernet/intel/igc/igc.h
-@@ -14,6 +14,7 @@
- #include <linux/timecounter.h>
- #include <linux/net_tstamp.h>
- #include <linux/bitfield.h>
-+#include <linux/hrtimer.h>
- 
- #include "igc_hw.h"
- 
-@@ -101,6 +102,8 @@ struct igc_ring {
- 	u32 start_time;
- 	u32 end_time;
- 	u32 max_sdu;
-+	bool oper_gate_closed;		/* Operating gate. True if the TX Queue is closed */
-+	bool admin_gate_closed;		/* Future gate. True if the TX Queue will be closed */
- 
- 	/* CBS parameters */
- 	bool cbs_enable;                /* indicates if CBS is enabled */
-@@ -160,6 +163,7 @@ struct igc_adapter {
- 	struct timer_list watchdog_timer;
- 	struct timer_list dma_err_timer;
- 	struct timer_list phy_info_timer;
-+	struct hrtimer hrtimer;
- 
- 	u32 wol;
- 	u32 en_mng_pt;
-@@ -189,6 +193,8 @@ struct igc_adapter {
- 	ktime_t cycle_time;
- 	bool qbv_enable;
- 	u32 qbv_config_change_errors;
-+	bool qbv_transition;
-+	unsigned int qbv_count;
- 
- 	/* OS defined structs */
- 	struct pci_dev *pdev;
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index c0e21701e7817..826556e609800 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1572,6 +1572,9 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb,
- 	first->bytecount = skb->len;
- 	first->gso_segs = 1;
- 
-+	if (adapter->qbv_transition || tx_ring->oper_gate_closed)
-+		goto out_drop;
-+
- 	if (tx_ring->max_sdu > 0) {
- 		u32 max_sdu = 0;
- 
-@@ -3004,8 +3007,8 @@ static bool igc_clean_tx_irq(struct igc_q_vector *q_vector, int napi_budget)
- 		    time_after(jiffies, tx_buffer->time_stamp +
- 		    (adapter->tx_timeout_factor * HZ)) &&
- 		    !(rd32(IGC_STATUS) & IGC_STATUS_TXOFF) &&
--		    (rd32(IGC_TDH(tx_ring->reg_idx)) !=
--		     readl(tx_ring->tail))) {
-+		    (rd32(IGC_TDH(tx_ring->reg_idx)) != readl(tx_ring->tail)) &&
-+		    !tx_ring->oper_gate_closed) {
- 			/* detected Tx unit hang */
- 			netdev_err(tx_ring->netdev,
- 				   "Detected Tx Unit Hang\n"
-@@ -6095,6 +6098,8 @@ static int igc_tsn_clear_schedule(struct igc_adapter *adapter)
- 	adapter->base_time = 0;
- 	adapter->cycle_time = NSEC_PER_SEC;
- 	adapter->qbv_config_change_errors = 0;
-+	adapter->qbv_transition = false;
-+	adapter->qbv_count = 0;
- 
- 	for (i = 0; i < adapter->num_tx_queues; i++) {
- 		struct igc_ring *ring = adapter->tx_ring[i];
-@@ -6102,6 +6107,8 @@ static int igc_tsn_clear_schedule(struct igc_adapter *adapter)
- 		ring->start_time = 0;
- 		ring->end_time = NSEC_PER_SEC;
- 		ring->max_sdu = 0;
-+		ring->oper_gate_closed = false;
-+		ring->admin_gate_closed = false;
- 	}
- 
- 	return 0;
-@@ -6113,6 +6120,7 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	bool queue_configured[IGC_MAX_TX_QUEUES] = { };
- 	struct igc_hw *hw = &adapter->hw;
- 	u32 start_time = 0, end_time = 0;
-+	struct timespec64 now;
- 	size_t n;
- 	int i;
- 
-@@ -6133,6 +6141,8 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	adapter->cycle_time = qopt->cycle_time;
- 	adapter->base_time = qopt->base_time;
- 
-+	igc_ptp_read(adapter, &now);
-+
- 	for (n = 0; n < qopt->num_entries; n++) {
- 		struct tc_taprio_sched_entry *e = &qopt->entries[n];
- 
-@@ -6167,7 +6177,10 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 				ring->start_time = start_time;
- 			ring->end_time = end_time;
- 
--			queue_configured[i] = true;
-+			if (ring->start_time >= adapter->cycle_time)
-+				queue_configured[i] = false;
-+			else
-+				queue_configured[i] = true;
- 		}
- 
- 		start_time += e->interval;
-@@ -6177,8 +6190,20 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	 * If not, set the start and end time to be end time.
- 	 */
- 	for (i = 0; i < adapter->num_tx_queues; i++) {
-+		struct igc_ring *ring = adapter->tx_ring[i];
-+
-+		if (!is_base_time_past(qopt->base_time, &now)) {
-+			ring->admin_gate_closed = false;
-+		} else {
-+			ring->oper_gate_closed = false;
-+			ring->admin_gate_closed = false;
-+		}
-+
- 		if (!queue_configured[i]) {
--			struct igc_ring *ring = adapter->tx_ring[i];
-+			if (!is_base_time_past(qopt->base_time, &now))
-+				ring->admin_gate_closed = true;
-+			else
-+				ring->oper_gate_closed = true;
- 
- 			ring->start_time = end_time;
- 			ring->end_time = end_time;
-@@ -6542,6 +6567,27 @@ static const struct xdp_metadata_ops igc_xdp_metadata_ops = {
- 	.xmo_rx_hash			= igc_xdp_rx_hash,
- };
- 
-+static enum hrtimer_restart igc_qbv_scheduling_timer(struct hrtimer *timer)
-+{
-+	struct igc_adapter *adapter = container_of(timer, struct igc_adapter,
-+						   hrtimer);
-+	unsigned int i;
-+
-+	adapter->qbv_transition = true;
-+	for (i = 0; i < adapter->num_tx_queues; i++) {
-+		struct igc_ring *tx_ring = adapter->tx_ring[i];
-+
-+		if (tx_ring->admin_gate_closed) {
-+			tx_ring->admin_gate_closed = false;
-+			tx_ring->oper_gate_closed = true;
-+		} else {
-+			tx_ring->oper_gate_closed = false;
-+		}
-+	}
-+	adapter->qbv_transition = false;
-+	return HRTIMER_NORESTART;
-+}
-+
- /**
-  * igc_probe - Device Initialization Routine
-  * @pdev: PCI device information struct
-@@ -6720,6 +6766,9 @@ static int igc_probe(struct pci_dev *pdev,
- 	INIT_WORK(&adapter->reset_task, igc_reset_task);
- 	INIT_WORK(&adapter->watchdog_task, igc_watchdog_task);
- 
-+	hrtimer_init(&adapter->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-+	adapter->hrtimer.function = &igc_qbv_scheduling_timer;
-+
- 	/* Initialize link properties that are user-changeable */
- 	adapter->fc_autoneg = true;
- 	hw->mac.autoneg = true;
-@@ -6823,6 +6872,7 @@ static void igc_remove(struct pci_dev *pdev)
- 
- 	cancel_work_sync(&adapter->reset_task);
- 	cancel_work_sync(&adapter->watchdog_task);
-+	hrtimer_cancel(&adapter->hrtimer);
- 
- 	/* Release control of h/w to f/w.  If f/w is AMT enabled, this
- 	 * would have already happened in close and is redundant.
-diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c
-index 6b299b83e7ef2..3cdb0c9887283 100644
---- a/drivers/net/ethernet/intel/igc/igc_tsn.c
-+++ b/drivers/net/ethernet/intel/igc/igc_tsn.c
-@@ -114,7 +114,6 @@ static int igc_tsn_disable_offload(struct igc_adapter *adapter)
- static int igc_tsn_enable_offload(struct igc_adapter *adapter)
- {
- 	struct igc_hw *hw = &adapter->hw;
--	bool tsn_mode_reconfig = false;
- 	u32 tqavctrl, baset_l, baset_h;
- 	u32 sec, nsec, cycle;
- 	ktime_t base_time, systim;
-@@ -228,11 +227,10 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter)
- 
- 	tqavctrl = rd32(IGC_TQAVCTRL) & ~IGC_TQAVCTRL_FUTSCDDIS;
- 
--	if (tqavctrl & IGC_TQAVCTRL_TRANSMIT_MODE_TSN)
--		tsn_mode_reconfig = true;
--
- 	tqavctrl |= IGC_TQAVCTRL_TRANSMIT_MODE_TSN | IGC_TQAVCTRL_ENHANCED_QAV;
- 
-+	adapter->qbv_count++;
-+
- 	cycle = adapter->cycle_time;
- 	base_time = adapter->base_time;
- 
-@@ -250,17 +248,28 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter)
- 		 */
- 		if ((rd32(IGC_BASET_H) || rd32(IGC_BASET_L)) &&
- 		    (adapter->tc_setup_type == TC_SETUP_QDISC_TAPRIO) &&
--		    tsn_mode_reconfig)
-+		    (adapter->qbv_count > 1))
- 			adapter->qbv_config_change_errors++;
- 	} else {
--		/* According to datasheet section 7.5.2.9.3.3, FutScdDis bit
--		 * has to be configured before the cycle time and base time.
--		 * Tx won't hang if there is a GCL is already running,
--		 * so in this case we don't need to set FutScdDis.
--		 */
--		if (igc_is_device_id_i226(hw) &&
--		    !(rd32(IGC_BASET_H) || rd32(IGC_BASET_L)))
--			tqavctrl |= IGC_TQAVCTRL_FUTSCDDIS;
-+		if (igc_is_device_id_i226(hw)) {
-+			ktime_t adjust_time, expires_time;
-+
-+		       /* According to datasheet section 7.5.2.9.3.3, FutScdDis bit
-+			* has to be configured before the cycle time and base time.
-+			* Tx won't hang if a GCL is already running,
-+			* so in this case we don't need to set FutScdDis.
-+			*/
-+			if (!(rd32(IGC_BASET_H) || rd32(IGC_BASET_L)))
-+				tqavctrl |= IGC_TQAVCTRL_FUTSCDDIS;
-+
-+			nsec = rd32(IGC_SYSTIML);
-+			sec = rd32(IGC_SYSTIMH);
-+			systim = ktime_set(sec, nsec);
-+
-+			adjust_time = adapter->base_time;
-+			expires_time = ktime_sub_ns(adjust_time, systim);
-+			hrtimer_start(&adapter->hrtimer, expires_time, HRTIMER_MODE_REL);
-+		}
- 	}
- 
- 	wr32(IGC_TQAVCTRL, tqavctrl);
-@@ -306,7 +315,11 @@ int igc_tsn_offload_apply(struct igc_adapter *adapter)
- {
- 	struct igc_hw *hw = &adapter->hw;
- 
--	if (netif_running(adapter->netdev) && igc_is_device_id_i225(hw)) {
-+	/* Per I225/6 HW Design Section 7.5.2.1, transmit mode
-+	 * cannot be changed dynamically. Require reset the adapter.
-+	 */
-+	if (netif_running(adapter->netdev) &&
-+	    (igc_is_device_id_i225(hw) || !adapter->qbv_count)) {
- 		schedule_work(&adapter->reset_task);
- 		return 0;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-handle-already-enabled-taprio-offload-for-baseti.patch b/queue-6.4/igc-handle-already-enabled-taprio-offload-for-baseti.patch
deleted file mode 100644
index 038e2f7b08a..00000000000
--- a/queue-6.4/igc-handle-already-enabled-taprio-offload-for-baseti.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 5b7662266cd1b15b3162ed4f1c1bf7509118f885 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:11 +0200
-Subject: igc: Handle already enabled taprio offload for basetime 0
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit e5d88c53d03f8df864776431175d08c053645f50 ]
-
-Since commit e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv")
-it is possible to enable taprio offload with a basetime of 0.
-However, the check if taprio offload is already enabled (and thus -EALREADY
-should be returned for igc_save_qbv_schedule) still relied on
-adapter->base_time > 0.
-
-This can be reproduced as follows:
-
-    # TAPRIO offload (flags == 0x2) and base-time = 0
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x2
-
-    # The second call should fail with "Error: Device failed to setup taprio offload."
-    # But that only happens if base-time was != 0
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x2
-
-Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index f051ca733af1b..97eb3c390de9a 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -6127,7 +6127,7 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	if (qopt->base_time < 0)
- 		return -ERANGE;
- 
--	if (igc_is_device_id_i225(hw) && adapter->base_time)
-+	if (igc_is_device_id_i225(hw) && adapter->taprio_offload_enable)
- 		return -EALREADY;
- 
- 	if (!validate_schedule(adapter, qopt))
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-handle-pps-start-time-programming-for-past-time-.patch b/queue-6.4/igc-handle-pps-start-time-programming-for-past-time-.patch
deleted file mode 100644
index 2bcbc72c982..00000000000
--- a/queue-6.4/igc-handle-pps-start-time-programming-for-past-time-.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From e831b1688eeeb1e282688d82ce7d06c77c59889d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 12:00:43 +0530
-Subject: igc: Handle PPS start time programming for past time values
-
-From: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-
-[ Upstream commit 84a192e46106355de1a314d709e657231d4b1026 ]
-
-I225/6 hardware can be programmed to start PPS output once
-the time in Target Time registers is reached. The time
-programmed in these registers should always be into future.
-Only then PPS output is triggered when SYSTIM register
-reaches the programmed value. There are two modes in i225/6
-hardware to program PPS, pulse and clock mode.
-
-There were issues reported where PPS is not generated when
-start time is in past.
-
-Example 1, "echo 0 0 0 2 0 > /sys/class/ptp/ptp0/period"
-
-In the current implementation, a value of '0' is programmed
-into Target time registers and PPS output is in pulse mode.
-Eventually an interrupt which is triggered upon SYSTIM
-register reaching Target time is not fired. Thus no PPS
-output is generated.
-
-Example 2, "echo 0 0 0 1 0 > /sys/class/ptp/ptp0/period"
-
-Above case, a value of '0' is programmed into Target time
-registers and PPS output is in clock mode. Here, HW tries to
-catch-up the current time by incrementing Target Time
-register. This catch-up time seem to vary according to
-programmed PPS period time as per the HW design. In my
-experiments, the delay ranged between few tens of seconds to
-few minutes. The PPS output is only generated after the
-Target time register reaches current time.
-
-In my experiments, I also observed PPS stopped working with
-below test and could not recover until module is removed and
-loaded again.
-
-1) echo 0 <future time> 0 1 0 > /sys/class/ptp/ptp1/period
-2) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-3) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period
-
-After this PPS did not work even if i re-program with proper
-values. I could only get this back working by reloading the
-driver.
-
-This patch takes care of calculating and programming
-appropriate future time value into Target Time registers.
-
-Fixes: 5e91c72e560c ("igc: Fix PPS delta between two synchronized end-points")
-Signed-off-by: Aravindhan Gunasekaran <aravindhan.gunasekaran@intel.com>
-Reviewed-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ptp.c | 25 +++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
-index 32ef112f8291a..f0b979a706552 100644
---- a/drivers/net/ethernet/intel/igc/igc_ptp.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
-@@ -356,16 +356,35 @@ static int igc_ptp_feature_enable_i225(struct ptp_clock_info *ptp,
- 			tsim &= ~IGC_TSICR_TT0;
- 		}
- 		if (on) {
-+			struct timespec64 safe_start;
- 			int i = rq->perout.index;
- 
- 			igc_pin_perout(igc, i, pin, use_freq);
--			igc->perout[i].start.tv_sec = rq->perout.start.sec;
-+			igc_ptp_read(igc, &safe_start);
-+
-+			/* PPS output start time is triggered by Target time(TT)
-+			 * register. Programming any past time value into TT
-+			 * register will cause PPS to never start. Need to make
-+			 * sure we program the TT register a time ahead in
-+			 * future. There isn't a stringent need to fire PPS out
-+			 * right away. Adding +2 seconds should take care of
-+			 * corner cases. Let's say if the SYSTIML is close to
-+			 * wrap up and the timer keeps ticking as we program the
-+			 * register, adding +2seconds is safe bet.
-+			 */
-+			safe_start.tv_sec += 2;
-+
-+			if (rq->perout.start.sec < safe_start.tv_sec)
-+				igc->perout[i].start.tv_sec = safe_start.tv_sec;
-+			else
-+				igc->perout[i].start.tv_sec = rq->perout.start.sec;
- 			igc->perout[i].start.tv_nsec = rq->perout.start.nsec;
- 			igc->perout[i].period.tv_sec = ts.tv_sec;
- 			igc->perout[i].period.tv_nsec = ts.tv_nsec;
--			wr32(trgttimh, rq->perout.start.sec);
-+			wr32(trgttimh, (u32)igc->perout[i].start.tv_sec);
- 			/* For now, always select timer 0 as source. */
--			wr32(trgttiml, rq->perout.start.nsec | IGC_TT_IO_TIMER_SEL_SYSTIM0);
-+			wr32(trgttiml, (u32)(igc->perout[i].start.tv_nsec |
-+					     IGC_TT_IO_TIMER_SEL_SYSTIM0));
- 			if (use_freq)
- 				wr32(freqout, ns);
- 			tsauxc |= tsauxc_mask;
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-include-the-length-type-field-and-vlan-tag-in-qu.patch b/queue-6.4/igc-include-the-length-type-field-and-vlan-tag-in-qu.patch
deleted file mode 100644
index b1af1cd350e..00000000000
--- a/queue-6.4/igc-include-the-length-type-field-and-vlan-tag-in-qu.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 94e338939954b57bd1507d45a8dfdadaee968f5b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 9 Jun 2023 11:28:42 +0800
-Subject: igc: Include the length/type field and VLAN tag in queueMaxSDU
-
-From: Tan Tee Min <tee.min.tan@linux.intel.com>
-
-[ Upstream commit 25102893e409bc02761ab82dbcfa092006404790 ]
-
-IEEE 802.1Q does not have clear definitions of what constitutes an
-SDU (Service Data Unit), but IEEE Std 802.3 clause 3.1.2 does define
-the MAC service primitives and clause 3.2.7 does define the MAC Client
-Data for Q-tagged frames.
-
-It shows that the mac_service_data_unit (MSDU) does NOT contain the
-preamble, destination and source address, or FCS. The MSDU does contain
-the length/type field, MAC client data, VLAN tag and any padding
-data (prior to the FCS).
-
-Thus, the maximum 802.3 frame size that is allowed to be transmitted
-should be QueueMaxSDU (MSDU) + 16 (6 byte SA + 6 byte DA + 4 byte FCS).
-
-Fixes: 92a0dcb8427d ("igc: offload queue max SDU from tc-taprio")
-Signed-off-by: Tan Tee Min <tee.min.tan@linux.intel.com>
-Reviewed-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 15 ++++-----------
- 1 file changed, 4 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index 826556e609800..e7bd2c60ee383 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -1575,16 +1575,9 @@ static netdev_tx_t igc_xmit_frame_ring(struct sk_buff *skb,
- 	if (adapter->qbv_transition || tx_ring->oper_gate_closed)
- 		goto out_drop;
- 
--	if (tx_ring->max_sdu > 0) {
--		u32 max_sdu = 0;
--
--		max_sdu = tx_ring->max_sdu +
--			  (skb_vlan_tagged(first->skb) ? VLAN_HLEN : 0);
--
--		if (first->bytecount > max_sdu) {
--			adapter->stats.txdrop++;
--			goto out_drop;
--		}
-+	if (tx_ring->max_sdu > 0 && first->bytecount > tx_ring->max_sdu) {
-+		adapter->stats.txdrop++;
-+		goto out_drop;
- 	}
- 
- 	if (unlikely(test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags) &&
-@@ -6215,7 +6208,7 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 		struct net_device *dev = adapter->netdev;
- 
- 		if (qopt->max_sdu[i])
--			ring->max_sdu = qopt->max_sdu[i] + dev->hard_header_len;
-+			ring->max_sdu = qopt->max_sdu[i] + dev->hard_header_len - ETH_TLEN;
- 		else
- 			ring->max_sdu = 0;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-no-strict-mode-in-pure-launchtime-cbs-offload.patch b/queue-6.4/igc-no-strict-mode-in-pure-launchtime-cbs-offload.patch
deleted file mode 100644
index 82372c609ed..00000000000
--- a/queue-6.4/igc-no-strict-mode-in-pure-launchtime-cbs-offload.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From 61956d16d51fe7d6d2b7ae9f849d0920cdfc2e00 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:12 +0200
-Subject: igc: No strict mode in pure launchtime/CBS offload
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 8b86f10ab64eca0287ea8f7c94e9ad8b2e101c01 ]
-
-The flags IGC_TXQCTL_STRICT_CYCLE and IGC_TXQCTL_STRICT_END
-prevent the packet transmission over slot and cycle boundaries.
-This is important for taprio offload where the slots and
-cycles correspond to the slots and cycles configured for the
-network.
-
-However, the Qbv offload feature of the i225 is also used for
-enabling TX launchtime / ETF offload. In that case, however,
-the cycle has no meaning for the network and is only used
-internally to adapt the base time register after a second has
-passed.
-
-Enabling strict mode in this case would unnecessarily prevent
-the transmission of certain packets (i.e. at the boundary of a
-second) and thus interferes with the ETF qdisc that promises
-transmission at a certain point in time.
-
-Similar to ETF, this also applies to CBS offload that also should
-not be influenced by strict mode unless taprio offload would be
-enabled at the same time.
-
-This fully reverts
-commit d8f45be01dd9 ("igc: Use strict cycles for Qbv scheduling")
-but its commit message only describes what was already implemented
-before that commit. The difference to a plain revert of that commit
-is that it now copes with the base_time = 0 case that was fixed with
-commit e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv")
-
-In particular, enabling strict mode leads to TX hang situations
-under high traffic if taprio is applied WITHOUT taprio offload
-but WITH ETF offload, e.g. as in
-
-    sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \
-	    num_tc 1 \
-	    map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \
-	    queues 1@0 \
-	    base-time 0 \
-	    sched-entry S 01 300000 \
-	    flags 0x1 \
-	    txtime-delay 500000 \
-	    clockid CLOCK_TAI
-    sudo tc qdisc replace dev enp1s0 parent 100:1 etf \
-	    clockid CLOCK_TAI \
-	    delta 500000 \
-	    offload \
-	    skip_sock_check
-
-and traffic generator
-
-    sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns
-
-with traffic.cfg
-
-    #define ETH_P_IP        0x0800
-
-    {
-      /* Ethernet Header */
-      0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e,  # MAC Dest - adapt as needed
-      0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36,  # MAC Src  - adapt as needed
-      const16(ETH_P_IP),
-
-      /* IPv4 Header */
-      0b01000101, 0,   # IPv4 version, IHL, TOS
-      const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))
-      const16(2),      # IPv4 ident
-      0b01000000, 0,   # IPv4 flags, fragmentation off
-      64,              # IPv4 TTL
-      17,              # Protocol UDP
-      csumip(14, 33),  # IPv4 checksum
-
-      /* UDP Header */
-      10,  0, 48, 1,   # IP Src - adapt as needed
-      10,  0, 48, 10,  # IP Dest - adapt as needed
-      const16(5555),   # UDP Src Port
-      const16(6666),   # UDP Dest Port
-      const16(1008),   # UDP length (UDP header 8 bytes + payload length)
-      csumudp(14, 34), # UDP checksum
-
-      /* Payload */
-      fill('W', 1000),
-    }
-
-and the observed message with that is for example
-
- igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang
-   Tx Queue             <0>
-   TDH                  <d0>
-   TDT                  <f0>
-   next_to_use          <f0>
-   next_to_clean        <d0>
- buffer_info[next_to_clean]
-   time_stamp           <ffff661f>
-   next_to_watch        <00000000245a4efb>
-   jiffies              <ffff6e48>
-   desc.status          <1048000>
-
-Fixes: d8f45be01dd9 ("igc: Use strict cycles for Qbv scheduling")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_tsn.c | 24 ++++++++++++++++++++++--
- 1 file changed, 22 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c
-index b76ebfc10b1d5..a9c08321aca90 100644
---- a/drivers/net/ethernet/intel/igc/igc_tsn.c
-+++ b/drivers/net/ethernet/intel/igc/igc_tsn.c
-@@ -132,8 +132,28 @@ static int igc_tsn_enable_offload(struct igc_adapter *adapter)
- 		wr32(IGC_STQT(i), ring->start_time);
- 		wr32(IGC_ENDQT(i), ring->end_time);
- 
--		txqctl |= IGC_TXQCTL_STRICT_CYCLE |
--			IGC_TXQCTL_STRICT_END;
-+		if (adapter->taprio_offload_enable) {
-+			/* If taprio_offload_enable is set we are in "taprio"
-+			 * mode and we need to be strict about the
-+			 * cycles: only transmit a packet if it can be
-+			 * completed during that cycle.
-+			 *
-+			 * If taprio_offload_enable is NOT true when
-+			 * enabling TSN offload, the cycle should have
-+			 * no external effects, but is only used internally
-+			 * to adapt the base time register after a second
-+			 * has passed.
-+			 *
-+			 * Enabling strict mode in this case would
-+			 * unnecessarily prevent the transmission of
-+			 * certain packets (i.e. at the boundary of a
-+			 * second) and thus interfere with the launchtime
-+			 * feature that promises transmission at a
-+			 * certain point in time.
-+			 */
-+			txqctl |= IGC_TXQCTL_STRICT_CYCLE |
-+				IGC_TXQCTL_STRICT_END;
-+		}
- 
- 		if (ring->launchtime_enable)
- 			txqctl |= IGC_TXQCTL_QUEUE_MODE_LAUNCHT;
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-remove-delay-during-tx-ring-configuration.patch b/queue-6.4/igc-remove-delay-during-tx-ring-configuration.patch
deleted file mode 100644
index 78b46171113..00000000000
--- a/queue-6.4/igc-remove-delay-during-tx-ring-configuration.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 73bfe462e0a94fef7a5dc2bb51a4d33dd891aa8e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 17 May 2023 08:18:12 +0800
-Subject: igc: Remove delay during TX ring configuration
-
-From: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-
-[ Upstream commit cca28ceac7c7857bc2d313777017585aef00bcc4 ]
-
-Remove unnecessary delay during the TX ring configuration.
-This will cause delay, especially during link down and
-link up activity.
-
-Furthermore, old SKUs like as I225 will call the reset_adapter
-to reset the controller during TSN mode Gate Control List (GCL)
-setting. This will add more time to the configuration of the
-real-time use case.
-
-It doesn't mentioned about this delay in the Software User Manual.
-It might have been ported from legacy code I210 in the past.
-
-Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
-Signed-off-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_main.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index a8815ccf7887d..b131c8f2b03df 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -711,7 +711,6 @@ static void igc_configure_tx_ring(struct igc_adapter *adapter,
- 	/* disable the queue */
- 	wr32(IGC_TXDCTL(reg_idx), 0);
- 	wrfl();
--	mdelay(10);
- 
- 	wr32(IGC_TDLEN(reg_idx),
- 	     ring->count * sizeof(union igc_adv_tx_desc));
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-rename-qbv_enable-to-taprio_offload_enable.patch b/queue-6.4/igc-rename-qbv_enable-to-taprio_offload_enable.patch
deleted file mode 100644
index a8a95707462..00000000000
--- a/queue-6.4/igc-rename-qbv_enable-to-taprio_offload_enable.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From d1a187de552f05b69cea2eec119c49c6b8d52d27 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jun 2023 16:07:09 +0200
-Subject: igc: Rename qbv_enable to taprio_offload_enable
-
-From: Florian Kauer <florian.kauer@linutronix.de>
-
-[ Upstream commit 8046063df887bee35c002224267ba46f41be7cf6 ]
-
-In the current implementation the flags adapter->qbv_enable
-and IGC_FLAG_TSN_QBV_ENABLED have a similar name, but do not
-have the same meaning. The first one is used only to indicate
-taprio offload (i.e. when igc_save_qbv_schedule was called),
-while the second one corresponds to the Qbv mode of the hardware.
-However, the second one is also used to support the TX launchtime
-feature, i.e. ETF qdisc offload. This leads to situations where
-adapter->qbv_enable is false, but the flag IGC_FLAG_TSN_QBV_ENABLED
-is set. This is prone to confusion.
-
-The rename should reduce this confusion. Since it is a pure
-rename, it has no impact on functionality.
-
-Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv")
-Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>
-Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc.h      | 2 +-
- drivers/net/ethernet/intel/igc/igc_main.c | 6 +++---
- drivers/net/ethernet/intel/igc/igc_tsn.c  | 2 +-
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
-index c0a07af36cb23..345d3a4e8ed44 100644
---- a/drivers/net/ethernet/intel/igc/igc.h
-+++ b/drivers/net/ethernet/intel/igc/igc.h
-@@ -191,7 +191,7 @@ struct igc_adapter {
- 	int tc_setup_type;
- 	ktime_t base_time;
- 	ktime_t cycle_time;
--	bool qbv_enable;
-+	bool taprio_offload_enable;
- 	u32 qbv_config_change_errors;
- 	bool qbv_transition;
- 	unsigned int qbv_count;
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index ae986e44a4718..6bed12224120f 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -6119,16 +6119,16 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 
- 	switch (qopt->cmd) {
- 	case TAPRIO_CMD_REPLACE:
--		adapter->qbv_enable = true;
-+		adapter->taprio_offload_enable = true;
- 		break;
- 	case TAPRIO_CMD_DESTROY:
--		adapter->qbv_enable = false;
-+		adapter->taprio_offload_enable = false;
- 		break;
- 	default:
- 		return -EOPNOTSUPP;
- 	}
- 
--	if (!adapter->qbv_enable)
-+	if (!adapter->taprio_offload_enable)
- 		return igc_tsn_clear_schedule(adapter);
- 
- 	if (qopt->base_time < 0)
-diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c
-index 3cdb0c9887283..b76ebfc10b1d5 100644
---- a/drivers/net/ethernet/intel/igc/igc_tsn.c
-+++ b/drivers/net/ethernet/intel/igc/igc_tsn.c
-@@ -37,7 +37,7 @@ static unsigned int igc_tsn_new_flags(struct igc_adapter *adapter)
- {
- 	unsigned int new_flags = adapter->flags & ~IGC_FLAG_TSN_ANY_ENABLED;
- 
--	if (adapter->qbv_enable)
-+	if (adapter->taprio_offload_enable)
- 		new_flags |= IGC_FLAG_TSN_QBV_ENABLED;
- 
- 	if (is_any_launchtime(adapter))
--- 
-2.39.2
-
diff --git a/queue-6.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch b/queue-6.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
deleted file mode 100644
index d05c14e2102..00000000000
--- a/queue-6.4/igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 1d3082ab17cf6c7fcee80d799b5321636a266645 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 5 Jun 2023 11:09:01 -0700
-Subject: igc: set TP bit in 'supported' and 'advertising' fields of
- ethtool_link_ksettings
-
-From: Prasad Koya <prasad@arista.com>
-
-[ Upstream commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 ]
-
-set TP bit in the 'supported' and 'advertising' fields. i225/226 parts
-only support twisted pair copper.
-
-Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
-Signed-off-by: Prasad Koya <prasad@arista.com>
-Acked-by: Sasha Neftin <sasha.neftin@intel.com>
-Tested-by: Naama Meir <naamax.meir@linux.intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/intel/igc/igc_ethtool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-index 0e2cb00622d1a..93bce729be76a 100644
---- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
-+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
-@@ -1708,6 +1708,8 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
- 	/* twisted pair */
- 	cmd->base.port = PORT_TP;
- 	cmd->base.phy_address = hw->phy.addr;
-+	ethtool_link_ksettings_add_link_mode(cmd, supported, TP);
-+	ethtool_link_ksettings_add_link_mode(cmd, advertising, TP);
- 
- 	/* advertising link modes */
- 	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
--- 
-2.39.2
-
diff --git a/queue-6.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch b/queue-6.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
deleted file mode 100644
index 544ea4c1e5d..00000000000
--- a/queue-6.4/ionic-remove-warn_on-to-prevent-panic_on_warn.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 17988b459e31fad01e0ae817b91651d5da7ccab1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 11:20:06 -0700
-Subject: ionic: remove WARN_ON to prevent panic_on_warn
-
-From: Nitya Sunkad <nitya.sunkad@amd.com>
-
-[ Upstream commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 ]
-
-Remove unnecessary early code development check and the WARN_ON
-that it uses.  The irq alloc and free paths have long been
-cleaned up and this check shouldn't have stuck around so long.
-
-Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
-Signed-off-by: Nitya Sunkad <nitya.sunkad@amd.com>
-Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-index 957027e546b30..e03a94f2469ab 100644
---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
-@@ -474,11 +474,6 @@ static void ionic_qcqs_free(struct ionic_lif *lif)
- static void ionic_link_qcq_interrupts(struct ionic_qcq *src_qcq,
- 				      struct ionic_qcq *n_qcq)
- {
--	if (WARN_ON(n_qcq->flags & IONIC_QCQ_F_INTR)) {
--		ionic_intr_free(n_qcq->cq.lif->ionic, n_qcq->intr.index);
--		n_qcq->flags &= ~IONIC_QCQ_F_INTR;
--	}
--
- 	n_qcq->intr.vector = src_qcq->intr.vector;
- 	n_qcq->intr.index = src_qcq->intr.index;
- 	n_qcq->napi_qcq = src_qcq->napi_qcq;
--- 
-2.39.2
-
diff --git a/queue-6.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch b/queue-6.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
deleted file mode 100644
index 6c3f8960773..00000000000
--- a/queue-6.4/ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From b5b491a50e6aee6415aa41b22d508b32edea7c17 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 14:59:10 +0800
-Subject: ipv6/addrconf: fix a potential refcount underflow for idev
-
-From: Ziyang Xuan <william.xuanziyang@huawei.com>
-
-[ Upstream commit 06a0716949c22e2aefb648526580671197151acc ]
-
-Now in addrconf_mod_rs_timer(), reference idev depends on whether
-rs_timer is not pending. Then modify rs_timer timeout.
-
-There is a time gap in [1], during which if the pending rs_timer
-becomes not pending. It will miss to hold idev, but the rs_timer
-is activated. Thus rs_timer callback function addrconf_rs_timer()
-will be executed and put idev later without holding idev. A refcount
-underflow issue for idev can be caused by this.
-
-	if (!timer_pending(&idev->rs_timer))
-		in6_dev_hold(idev);
-		  <--------------[1]
-	mod_timer(&idev->rs_timer, jiffies + when);
-
-To fix the issue, hold idev if mod_timer() return 0.
-
-Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/addrconf.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 3797917237d03..5affca8e2f53a 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -318,9 +318,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
- static void addrconf_mod_rs_timer(struct inet6_dev *idev,
- 				  unsigned long when)
- {
--	if (!timer_pending(&idev->rs_timer))
-+	if (!mod_timer(&idev->rs_timer, jiffies + when))
- 		in6_dev_hold(idev);
--	mod_timer(&idev->rs_timer, jiffies + when);
- }
- 
- static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
--- 
-2.39.2
-
diff --git a/queue-6.4/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch b/queue-6.4/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
deleted file mode 100644
index 46b7d02f3a2..00000000000
--- a/queue-6.4/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 8653c27f9ad4d0d299c6fdc3694facc1e45869ba Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 3 Jul 2023 07:28:53 +0300
-Subject: kernel/trace: Fix cleanup logic of enable_trace_eprobe
-
-From: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-
-[ Upstream commit cf0a624dc706c306294c14e6b3e7694702f25191 ]
-
-The enable_trace_eprobe() function enables all event probes, attached
-to given trace probe. If an error occurs in enabling one of the event
-probes, all others should be roll backed. There is a bug in that roll
-back logic - instead of all event probes, only the failed one is
-disabled.
-
-Link: https://lore.kernel.org/all/20230703042853.1427493-1-tz.stoyanov@gmail.com/
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events")
-Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
-Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
-Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/trace/trace_eprobe.c | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
-index 67e854979d53e..3f04f0ffe0d70 100644
---- a/kernel/trace/trace_eprobe.c
-+++ b/kernel/trace/trace_eprobe.c
-@@ -675,6 +675,7 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 	struct trace_eprobe *ep;
- 	bool enabled;
- 	int ret = 0;
-+	int cnt = 0;
- 
- 	tp = trace_probe_primary_from_call(call);
- 	if (WARN_ON_ONCE(!tp))
-@@ -698,12 +699,25 @@ static int enable_trace_eprobe(struct trace_event_call *call,
- 		if (ret)
- 			break;
- 		enabled = true;
-+		cnt++;
- 	}
- 
- 	if (ret) {
- 		/* Failed to enable one of them. Roll back all */
--		if (enabled)
--			disable_eprobe(ep, file->tr);
-+		if (enabled) {
-+			/*
-+			 * It's a bug if one failed for something other than memory
-+			 * not being available but another eprobe succeeded.
-+			 */
-+			WARN_ON_ONCE(ret != -ENOMEM);
-+
-+			list_for_each_entry(pos, trace_probe_probe_list(tp), list) {
-+				ep = container_of(pos, struct trace_eprobe, tp);
-+				disable_eprobe(ep, file->tr);
-+				if (!--cnt)
-+					break;
-+			}
-+		}
- 		if (file)
- 			trace_probe_remove_file(tp, file);
- 		else
--- 
-2.39.2
-
diff --git a/queue-6.4/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch b/queue-6.4/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
deleted file mode 100644
index ff8137d92dc..00000000000
--- a/queue-6.4/net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From da4d7c5cc9088c82294ef515fadc245827befeda Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 08:53:25 +0200
-Subject: net: bgmac: postpone turning IRQs off to avoid SoC hangs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Rafał Miłecki <rafal@milecki.pl>
-
-[ Upstream commit e7731194fdf085f46d58b1adccfddbd0dfee4873 ]
-
-Turning IRQs off is done by accessing Ethernet controller registers.
-That can't be done until device's clock is enabled. It results in a SoC
-hang otherwise.
-
-This bug remained unnoticed for years as most bootloaders keep all
-Ethernet interfaces turned on. It seems to only affect a niche SoC
-family BCM47189. It has two Ethernet controllers but CFE bootloader uses
-only the first one.
-
-Fixes: 34322615cbaa ("net: bgmac: Mask interrupts during probe")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/broadcom/bgmac.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
-index 1761df8fb7f96..10c7c232cc4ec 100644
---- a/drivers/net/ethernet/broadcom/bgmac.c
-+++ b/drivers/net/ethernet/broadcom/bgmac.c
-@@ -1492,8 +1492,6 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 
- 	bgmac->in_init = true;
- 
--	bgmac_chip_intrs_off(bgmac);
--
- 	net_dev->irq = bgmac->irq;
- 	SET_NETDEV_DEV(net_dev, bgmac->dev);
- 	dev_set_drvdata(bgmac->dev, bgmac);
-@@ -1511,6 +1509,8 @@ int bgmac_enet_probe(struct bgmac *bgmac)
- 	 */
- 	bgmac_clk_enable(bgmac, 0);
- 
-+	bgmac_chip_intrs_off(bgmac);
-+
- 	/* This seems to be fixing IRQ by assigning OOB #6 to the core */
- 	if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
- 		if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
--- 
-2.39.2
-
diff --git a/queue-6.4/net-dsa-felix-make-vsc9959_tas_guard_bands_update-vi.patch b/queue-6.4/net-dsa-felix-make-vsc9959_tas_guard_bands_update-vi.patch
deleted file mode 100644
index 42691567394..00000000000
--- a/queue-6.4/net-dsa-felix-make-vsc9959_tas_guard_bands_update-vi.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 9c24e69609c9264256560c1ac114ed3bb51aed5d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 13:44:21 +0300
-Subject: net: dsa: felix: make vsc9959_tas_guard_bands_update() visible to
- ocelot->ops
-
-From: Vladimir Oltean <vladimir.oltean@nxp.com>
-
-[ Upstream commit c60819149b637d0f9f7f66e110d2a0d90a3993ea ]
-
-In a future change we will need to make
-ocelot_port_update_active_preemptible_tcs() call
-vsc9959_tas_guard_bands_update(), but that is currently not possible,
-since the ocelot switch lib does not have access to functions private to
-the DSA wrapper.
-
-Move the pointer to vsc9959_tas_guard_bands_update() from felix->info
-(which is private to the DSA driver) to ocelot->ops (which is also
-visible to the ocelot switch lib).
-
-Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
-Message-ID: <20230705104422.49025-3-vladimir.oltean@nxp.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Stable-dep-of: c6efb4ae387c ("net: mscc: ocelot: fix oversize frame dropping for preemptible TCs")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/ocelot/felix.c         | 5 ++---
- drivers/net/dsa/ocelot/felix.h         | 1 -
- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +-
- include/soc/mscc/ocelot.h              | 1 +
- 4 files changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
-index 70c0e2b1936b3..8348da2b3c97a 100644
---- a/drivers/net/dsa/ocelot/felix.c
-+++ b/drivers/net/dsa/ocelot/felix.c
-@@ -1786,14 +1786,13 @@ static int felix_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
- {
- 	struct ocelot *ocelot = ds->priv;
- 	struct ocelot_port *ocelot_port = ocelot->ports[port];
--	struct felix *felix = ocelot_to_felix(ocelot);
- 
- 	ocelot_port_set_maxlen(ocelot, port, new_mtu);
- 
- 	mutex_lock(&ocelot->tas_lock);
- 
--	if (ocelot_port->taprio && felix->info->tas_guard_bands_update)
--		felix->info->tas_guard_bands_update(ocelot, port);
-+	if (ocelot_port->taprio && ocelot->ops->tas_guard_bands_update)
-+		ocelot->ops->tas_guard_bands_update(ocelot, port);
- 
- 	mutex_unlock(&ocelot->tas_lock);
- 
-diff --git a/drivers/net/dsa/ocelot/felix.h b/drivers/net/dsa/ocelot/felix.h
-index 96008c046da53..1d4befe7cfe8e 100644
---- a/drivers/net/dsa/ocelot/felix.h
-+++ b/drivers/net/dsa/ocelot/felix.h
-@@ -57,7 +57,6 @@ struct felix_info {
- 	void	(*mdio_bus_free)(struct ocelot *ocelot);
- 	int	(*port_setup_tc)(struct dsa_switch *ds, int port,
- 				 enum tc_setup_type type, void *type_data);
--	void	(*tas_guard_bands_update)(struct ocelot *ocelot, int port);
- 	void	(*port_sched_speed_set)(struct ocelot *ocelot, int port,
- 					u32 speed);
- 	void	(*phylink_mac_config)(struct ocelot *ocelot, int port,
-diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
-index d172a3e9736c4..219fb672a68d7 100644
---- a/drivers/net/dsa/ocelot/felix_vsc9959.c
-+++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
-@@ -2600,6 +2600,7 @@ static const struct ocelot_ops vsc9959_ops = {
- 	.cut_through_fwd	= vsc9959_cut_through_fwd,
- 	.tas_clock_adjust	= vsc9959_tas_clock_adjust,
- 	.update_stats		= vsc9959_update_stats,
-+	.tas_guard_bands_update	= vsc9959_tas_guard_bands_update,
- };
- 
- static const struct felix_info felix_info_vsc9959 = {
-@@ -2625,7 +2626,6 @@ static const struct felix_info felix_info_vsc9959 = {
- 	.port_modes		= vsc9959_port_modes,
- 	.port_setup_tc		= vsc9959_port_setup_tc,
- 	.port_sched_speed_set	= vsc9959_sched_speed_set,
--	.tas_guard_bands_update	= vsc9959_tas_guard_bands_update,
- };
- 
- /* The INTB interrupt is shared between for PTP TX timestamp availability
-diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
-index 22aae505c813b..85a726fb006ca 100644
---- a/include/soc/mscc/ocelot.h
-+++ b/include/soc/mscc/ocelot.h
-@@ -663,6 +663,7 @@ struct ocelot_ops {
- 			      struct flow_stats *stats);
- 	void (*cut_through_fwd)(struct ocelot *ocelot);
- 	void (*tas_clock_adjust)(struct ocelot *ocelot);
-+	void (*tas_guard_bands_update)(struct ocelot *ocelot, int port);
- 	void (*update_stats)(struct ocelot *ocelot);
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/net-dsa-qca8k-add-check-for-skb_copy.patch b/queue-6.4/net-dsa-qca8k-add-check-for-skb_copy.patch
deleted file mode 100644
index b7f1d32bdf7..00000000000
--- a/queue-6.4/net-dsa-qca8k-add-check-for-skb_copy.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From b2967cb2e10684574c536ff370379d49e4f2d27b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:39:07 +0800
-Subject: net: dsa: qca8k: Add check for skb_copy
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 87355b7c3da9bfd81935caba0ab763355147f7b0 ]
-
-Add check for the return value of skb_copy in order to avoid NULL pointer
-dereference.
-
-Fixes: 2cd548566384 ("net: dsa: qca8k: add support for phy read/write with mgmt Ethernet")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/qca/qca8k-8xxx.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
-index 6d5ac7588a691..d775a14784f7e 100644
---- a/drivers/net/dsa/qca/qca8k-8xxx.c
-+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
-@@ -588,6 +588,9 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
- 	bool ack;
- 	int ret;
- 
-+	if (!skb)
-+		return -ENOMEM;
-+
- 	reinit_completion(&mgmt_eth_data->rw_done);
- 
- 	/* Increment seq_num and set it in the copy pkt */
--- 
-2.39.2
-
diff --git a/queue-6.4/net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch b/queue-6.4/net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch
deleted file mode 100644
index a8e7b48a6b1..00000000000
--- a/queue-6.4/net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From e63a1d795279609a3479ddd881e2263853d8e98e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 11:18:59 +0800
-Subject: net: dsa: Removed unneeded of_node_put in felix_parse_ports_node
-
-From: Lu Hongfei <luhongfei@vivo.com>
-
-[ Upstream commit 04499f28b40bfc24f20b0e2331008bb90a54a6cf ]
-
-Remove unnecessary of_node_put from the continue path to prevent
-child node from being released twice, which could avoid resource
-leak or other unexpected issues.
-
-Signed-off-by: Lu Hongfei <luhongfei@vivo.com>
-Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
-Fixes: de879a016a94 ("net: dsa: felix: add functionality when not all ports are supported")
-Link: https://lore.kernel.org/r/20230710031859.36784-1-luhongfei@vivo.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/ocelot/felix.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
-index 8348da2b3c97a..d78b4bd4787e8 100644
---- a/drivers/net/dsa/ocelot/felix.c
-+++ b/drivers/net/dsa/ocelot/felix.c
-@@ -1286,7 +1286,6 @@ static int felix_parse_ports_node(struct felix *felix,
- 		if (err < 0) {
- 			dev_info(dev, "Unsupported PHY mode %s on port %d\n",
- 				 phy_modes(phy_mode), port);
--			of_node_put(child);
- 
- 			/* Leave port_phy_modes[port] = 0, which is also
- 			 * PHY_INTERFACE_MODE_NA. This will perform a
--- 
-2.39.2
-
diff --git a/queue-6.4/net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch b/queue-6.4/net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch
deleted file mode 100644
index 23dfde6a422..00000000000
--- a/queue-6.4/net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 04b9c610dfeb96ae1fa770e036bf8e8d46994305 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 16:10:11 +0800
-Subject: net: fec: increase the size of tx ring and update tx_wake_threshold
-
-From: Wei Fang <wei.fang@nxp.com>
-
-[ Upstream commit 56b3c6ba53d0e9649ea5e4089b39cadde13aaef8 ]
-
-When the XDP feature is enabled and with heavy XDP frames to be
-transmitted, there is a considerable probability that available
-tx BDs are insufficient. This will lead to some XDP frames to be
-discarded and the "NOT enough BD for SG!" error log will appear
-in the console (as shown below).
-
-[  160.013112] fec 30be0000.ethernet eth0: NOT enough BD for SG!
-[  160.023116] fec 30be0000.ethernet eth0: NOT enough BD for SG!
-[  160.028926] fec 30be0000.ethernet eth0: NOT enough BD for SG!
-[  160.038946] fec 30be0000.ethernet eth0: NOT enough BD for SG!
-[  160.044758] fec 30be0000.ethernet eth0: NOT enough BD for SG!
-
-In the case of heavy XDP traffic, sometimes the speed of recycling
-tx BDs may be slower than the speed of sending XDP frames. There
-may be several specific reasons, such as the interrupt is not
-responsed in time, the efficiency of the NAPI callback function is
-too low due to all the queues (tx queues and rx queues) share the
-same NAPI, and so on.
-
-After trying various methods, I think that increase the size of tx
-BD ring is simple and effective. Maybe the best resolution is that
-allocate NAPI for each queue to improve the efficiency of the NAPI
-callback, but this change is a bit big and I didn't try this method.
-Perheps this method will be implemented in a future patch.
-
-This patch also updates the tx_wake_threshold of tx ring which is
-related to the size of tx ring in the previous logic. Otherwise,
-the tx_wake_threshold will be too high (403 BDs), which is more
-likely to impact the slow path in the case of heavy XDP traffic,
-because XDP path and slow path share the tx BD rings. According
-to Jakub's suggestion, the tx_wake_threshold is at least equal to
-tx_stop_threshold + 2 * MAX_SKB_FRAGS, if a queue of hundreds of
-entries is overflowing, we should be able to apply a hysteresis
-of a few tens of entries.
-
-Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support")
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/fec.h      | 2 +-
- drivers/net/ethernet/freescale/fec_main.c | 3 +--
- 2 files changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
-index 8c0226d061fec..63a053dea819d 100644
---- a/drivers/net/ethernet/freescale/fec.h
-+++ b/drivers/net/ethernet/freescale/fec.h
-@@ -355,7 +355,7 @@ struct bufdesc_ex {
- #define RX_RING_SIZE		(FEC_ENET_RX_FRPPG * FEC_ENET_RX_PAGES)
- #define FEC_ENET_TX_FRSIZE	2048
- #define FEC_ENET_TX_FRPPG	(PAGE_SIZE / FEC_ENET_TX_FRSIZE)
--#define TX_RING_SIZE		512	/* Must be power of two */
-+#define TX_RING_SIZE		1024	/* Must be power of two */
- #define TX_RING_MOD_MASK	511	/*   for this to work */
- 
- #define BD_ENET_RX_INT		0x00800000
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index e6ed36e5daefa..7659888a96917 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -3347,8 +3347,7 @@ static int fec_enet_alloc_queue(struct net_device *ndev)
- 		fep->total_tx_ring_size += fep->tx_queue[i]->bd.ring_size;
- 
- 		txq->tx_stop_threshold = FEC_MAX_SKB_DESCS;
--		txq->tx_wake_threshold =
--			(txq->bd.ring_size - txq->tx_stop_threshold) / 2;
-+		txq->tx_wake_threshold = FEC_MAX_SKB_DESCS + 2 * MAX_SKB_FRAGS;
- 
- 		txq->tso_hdrs = dma_alloc_coherent(&fep->pdev->dev,
- 					txq->bd.ring_size * TSO_HEADER_SIZE,
--- 
-2.39.2
-
diff --git a/queue-6.4/net-fec-recycle-pages-for-transmitted-xdp-frames.patch b/queue-6.4/net-fec-recycle-pages-for-transmitted-xdp-frames.patch
deleted file mode 100644
index 3aaac7af248..00000000000
--- a/queue-6.4/net-fec-recycle-pages-for-transmitted-xdp-frames.patch
+++ /dev/null
@@ -1,297 +0,0 @@
-From 9d13d0210d9db3c4192c3ce53045e1fe7e5217d6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 16:10:10 +0800
-Subject: net: fec: recycle pages for transmitted XDP frames
-
-From: Wei Fang <wei.fang@nxp.com>
-
-[ Upstream commit 20f797399035a8052dbd7297fdbe094079a9482e ]
-
-Once the XDP frames have been successfully transmitted through the
-ndo_xdp_xmit() interface, it's the driver responsibility to free
-the frames so that the page_pool can recycle the pages and reuse
-them. However, this action is not implemented in the fec driver.
-This leads to a user-visible problem that the console will print
-the following warning log.
-
-[  157.568851] page_pool_release_retry() stalled pool shutdown 1389 inflight 60 sec
-[  217.983446] page_pool_release_retry() stalled pool shutdown 1389 inflight 120 sec
-[  278.399006] page_pool_release_retry() stalled pool shutdown 1389 inflight 181 sec
-[  338.812885] page_pool_release_retry() stalled pool shutdown 1389 inflight 241 sec
-[  399.226946] page_pool_release_retry() stalled pool shutdown 1389 inflight 302 sec
-
-Therefore, to solve this issue, we free XDP frames via xdp_return_frame()
-while cleaning the tx BD ring.
-
-Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support")
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/fec.h      |  15 ++-
- drivers/net/ethernet/freescale/fec_main.c | 148 +++++++++++++++-------
- 2 files changed, 115 insertions(+), 48 deletions(-)
-
-diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
-index 9939ccafb5566..8c0226d061fec 100644
---- a/drivers/net/ethernet/freescale/fec.h
-+++ b/drivers/net/ethernet/freescale/fec.h
-@@ -544,10 +544,23 @@ enum {
- 	XDP_STATS_TOTAL,
- };
- 
-+enum fec_txbuf_type {
-+	FEC_TXBUF_T_SKB,
-+	FEC_TXBUF_T_XDP_NDO,
-+};
-+
-+struct fec_tx_buffer {
-+	union {
-+		struct sk_buff *skb;
-+		struct xdp_frame *xdp;
-+	};
-+	enum fec_txbuf_type type;
-+};
-+
- struct fec_enet_priv_tx_q {
- 	struct bufdesc_prop bd;
- 	unsigned char *tx_bounce[TX_RING_SIZE];
--	struct  sk_buff *tx_skbuff[TX_RING_SIZE];
-+	struct fec_tx_buffer tx_buf[TX_RING_SIZE];
- 
- 	unsigned short tx_stop_threshold;
- 	unsigned short tx_wake_threshold;
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index 40d71be45f604..e6ed36e5daefa 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -397,7 +397,7 @@ static void fec_dump(struct net_device *ndev)
- 			fec16_to_cpu(bdp->cbd_sc),
- 			fec32_to_cpu(bdp->cbd_bufaddr),
- 			fec16_to_cpu(bdp->cbd_datlen),
--			txq->tx_skbuff[index]);
-+			txq->tx_buf[index].skb);
- 		bdp = fec_enet_get_nextdesc(bdp, &txq->bd);
- 		index++;
- 	} while (bdp != txq->bd.base);
-@@ -654,7 +654,7 @@ static int fec_enet_txq_submit_skb(struct fec_enet_priv_tx_q *txq,
- 
- 	index = fec_enet_get_bd_index(last_bdp, &txq->bd);
- 	/* Save skb pointer */
--	txq->tx_skbuff[index] = skb;
-+	txq->tx_buf[index].skb = skb;
- 
- 	/* Make sure the updates to rest of the descriptor are performed before
- 	 * transferring ownership.
-@@ -672,9 +672,7 @@ static int fec_enet_txq_submit_skb(struct fec_enet_priv_tx_q *txq,
- 
- 	skb_tx_timestamp(skb);
- 
--	/* Make sure the update to bdp and tx_skbuff are performed before
--	 * txq->bd.cur.
--	 */
-+	/* Make sure the update to bdp is performed before txq->bd.cur. */
- 	wmb();
- 	txq->bd.cur = bdp;
- 
-@@ -862,7 +860,7 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq,
- 	}
- 
- 	/* Save skb pointer */
--	txq->tx_skbuff[index] = skb;
-+	txq->tx_buf[index].skb = skb;
- 
- 	skb_tx_timestamp(skb);
- 	txq->bd.cur = bdp;
-@@ -952,16 +950,33 @@ static void fec_enet_bd_init(struct net_device *dev)
- 		for (i = 0; i < txq->bd.ring_size; i++) {
- 			/* Initialize the BD for every fragment in the page. */
- 			bdp->cbd_sc = cpu_to_fec16(0);
--			if (bdp->cbd_bufaddr &&
--			    !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
--				dma_unmap_single(&fep->pdev->dev,
--						 fec32_to_cpu(bdp->cbd_bufaddr),
--						 fec16_to_cpu(bdp->cbd_datlen),
--						 DMA_TO_DEVICE);
--			if (txq->tx_skbuff[i]) {
--				dev_kfree_skb_any(txq->tx_skbuff[i]);
--				txq->tx_skbuff[i] = NULL;
-+			if (txq->tx_buf[i].type == FEC_TXBUF_T_SKB) {
-+				if (bdp->cbd_bufaddr &&
-+				    !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
-+					dma_unmap_single(&fep->pdev->dev,
-+							 fec32_to_cpu(bdp->cbd_bufaddr),
-+							 fec16_to_cpu(bdp->cbd_datlen),
-+							 DMA_TO_DEVICE);
-+				if (txq->tx_buf[i].skb) {
-+					dev_kfree_skb_any(txq->tx_buf[i].skb);
-+					txq->tx_buf[i].skb = NULL;
-+				}
-+			} else {
-+				if (bdp->cbd_bufaddr)
-+					dma_unmap_single(&fep->pdev->dev,
-+							 fec32_to_cpu(bdp->cbd_bufaddr),
-+							 fec16_to_cpu(bdp->cbd_datlen),
-+							 DMA_TO_DEVICE);
-+
-+				if (txq->tx_buf[i].xdp) {
-+					xdp_return_frame(txq->tx_buf[i].xdp);
-+					txq->tx_buf[i].xdp = NULL;
-+				}
-+
-+				/* restore default tx buffer type: FEC_TXBUF_T_SKB */
-+				txq->tx_buf[i].type = FEC_TXBUF_T_SKB;
- 			}
-+
- 			bdp->cbd_bufaddr = cpu_to_fec32(0);
- 			bdp = fec_enet_get_nextdesc(bdp, &txq->bd);
- 		}
-@@ -1360,6 +1375,7 @@ static void
- fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
- {
- 	struct	fec_enet_private *fep;
-+	struct xdp_frame *xdpf;
- 	struct bufdesc *bdp;
- 	unsigned short status;
- 	struct	sk_buff	*skb;
-@@ -1387,16 +1403,31 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
- 
- 		index = fec_enet_get_bd_index(bdp, &txq->bd);
- 
--		skb = txq->tx_skbuff[index];
--		txq->tx_skbuff[index] = NULL;
--		if (!IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
--			dma_unmap_single(&fep->pdev->dev,
--					 fec32_to_cpu(bdp->cbd_bufaddr),
--					 fec16_to_cpu(bdp->cbd_datlen),
--					 DMA_TO_DEVICE);
--		bdp->cbd_bufaddr = cpu_to_fec32(0);
--		if (!skb)
--			goto skb_done;
-+		if (txq->tx_buf[index].type == FEC_TXBUF_T_SKB) {
-+			skb = txq->tx_buf[index].skb;
-+			txq->tx_buf[index].skb = NULL;
-+			if (bdp->cbd_bufaddr &&
-+			    !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
-+				dma_unmap_single(&fep->pdev->dev,
-+						 fec32_to_cpu(bdp->cbd_bufaddr),
-+						 fec16_to_cpu(bdp->cbd_datlen),
-+						 DMA_TO_DEVICE);
-+			bdp->cbd_bufaddr = cpu_to_fec32(0);
-+			if (!skb)
-+				goto tx_buf_done;
-+		} else {
-+			xdpf = txq->tx_buf[index].xdp;
-+			if (bdp->cbd_bufaddr)
-+				dma_unmap_single(&fep->pdev->dev,
-+						 fec32_to_cpu(bdp->cbd_bufaddr),
-+						 fec16_to_cpu(bdp->cbd_datlen),
-+						 DMA_TO_DEVICE);
-+			bdp->cbd_bufaddr = cpu_to_fec32(0);
-+			if (!xdpf) {
-+				txq->tx_buf[index].type = FEC_TXBUF_T_SKB;
-+				goto tx_buf_done;
-+			}
-+		}
- 
- 		/* Check for errors. */
- 		if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
-@@ -1415,21 +1446,11 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
- 				ndev->stats.tx_carrier_errors++;
- 		} else {
- 			ndev->stats.tx_packets++;
--			ndev->stats.tx_bytes += skb->len;
--		}
- 
--		/* NOTE: SKBTX_IN_PROGRESS being set does not imply it's we who
--		 * are to time stamp the packet, so we still need to check time
--		 * stamping enabled flag.
--		 */
--		if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS &&
--			     fep->hwts_tx_en) &&
--		    fep->bufdesc_ex) {
--			struct skb_shared_hwtstamps shhwtstamps;
--			struct bufdesc_ex *ebdp = (struct bufdesc_ex *)bdp;
--
--			fec_enet_hwtstamp(fep, fec32_to_cpu(ebdp->ts), &shhwtstamps);
--			skb_tstamp_tx(skb, &shhwtstamps);
-+			if (txq->tx_buf[index].type == FEC_TXBUF_T_SKB)
-+				ndev->stats.tx_bytes += skb->len;
-+			else
-+				ndev->stats.tx_bytes += xdpf->len;
- 		}
- 
- 		/* Deferred means some collisions occurred during transmit,
-@@ -1438,10 +1459,32 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
- 		if (status & BD_ENET_TX_DEF)
- 			ndev->stats.collisions++;
- 
--		/* Free the sk buffer associated with this last transmit */
--		dev_kfree_skb_any(skb);
--skb_done:
--		/* Make sure the update to bdp and tx_skbuff are performed
-+		if (txq->tx_buf[index].type == FEC_TXBUF_T_SKB) {
-+			/* NOTE: SKBTX_IN_PROGRESS being set does not imply it's we who
-+			 * are to time stamp the packet, so we still need to check time
-+			 * stamping enabled flag.
-+			 */
-+			if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS &&
-+				     fep->hwts_tx_en) && fep->bufdesc_ex) {
-+				struct skb_shared_hwtstamps shhwtstamps;
-+				struct bufdesc_ex *ebdp = (struct bufdesc_ex *)bdp;
-+
-+				fec_enet_hwtstamp(fep, fec32_to_cpu(ebdp->ts), &shhwtstamps);
-+				skb_tstamp_tx(skb, &shhwtstamps);
-+			}
-+
-+			/* Free the sk buffer associated with this last transmit */
-+			dev_kfree_skb_any(skb);
-+		} else {
-+			xdp_return_frame(xdpf);
-+
-+			txq->tx_buf[index].xdp = NULL;
-+			/* restore default tx buffer type: FEC_TXBUF_T_SKB */
-+			txq->tx_buf[index].type = FEC_TXBUF_T_SKB;
-+		}
-+
-+tx_buf_done:
-+		/* Make sure the update to bdp and tx_buf are performed
- 		 * before dirty_tx
- 		 */
- 		wmb();
-@@ -3247,9 +3290,19 @@ static void fec_enet_free_buffers(struct net_device *ndev)
- 		for (i = 0; i < txq->bd.ring_size; i++) {
- 			kfree(txq->tx_bounce[i]);
- 			txq->tx_bounce[i] = NULL;
--			skb = txq->tx_skbuff[i];
--			txq->tx_skbuff[i] = NULL;
--			dev_kfree_skb(skb);
-+
-+			if (txq->tx_buf[i].type == FEC_TXBUF_T_SKB) {
-+				skb = txq->tx_buf[i].skb;
-+				txq->tx_buf[i].skb = NULL;
-+				dev_kfree_skb(skb);
-+			} else {
-+				if (txq->tx_buf[i].xdp) {
-+					xdp_return_frame(txq->tx_buf[i].xdp);
-+					txq->tx_buf[i].xdp = NULL;
-+				}
-+
-+				txq->tx_buf[i].type = FEC_TXBUF_T_SKB;
-+			}
- 		}
- 	}
- }
-@@ -3809,7 +3862,8 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
- 		ebdp->cbd_esc = cpu_to_fec32(estatus);
- 	}
- 
--	txq->tx_skbuff[index] = NULL;
-+	txq->tx_buf[index].type = FEC_TXBUF_T_XDP_NDO;
-+	txq->tx_buf[index].xdp = frame;
- 
- 	/* Make sure the updates to rest of the descriptor are performed before
- 	 * transferring ownership.
--- 
-2.39.2
-
diff --git a/queue-6.4/net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch b/queue-6.4/net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch
deleted file mode 100644
index d2476079809..00000000000
--- a/queue-6.4/net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From b9d9804caf6a9776a5772f3c89ce55fe04f60fdc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 May 2023 10:26:15 +0800
-Subject: net: fec: remove last_bdp from fec_enet_txq_xmit_frame()
-
-From: Wei Fang <wei.fang@nxp.com>
-
-[ Upstream commit bc638eabfed90fdc798fd5765e67e41abea76152 ]
-
-The last_bdp is initialized to bdp, and both last_bdp and bdp are
-not changed. That is to say that last_bdp and bdp are always equal.
-So bdp can be used directly.
-
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230529022615.669589-1-wei.fang@nxp.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Stable-dep-of: 20f797399035 ("net: fec: recycle pages for transmitted XDP frames")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/fec_main.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index c08331f7da7b3..40d71be45f604 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -3770,7 +3770,7 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
- 				   struct xdp_frame *frame)
- {
- 	unsigned int index, status, estatus;
--	struct bufdesc *bdp, *last_bdp;
-+	struct bufdesc *bdp;
- 	dma_addr_t dma_addr;
- 	int entries_free;
- 
-@@ -3782,7 +3782,6 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
- 
- 	/* Fill in a Tx ring entry */
- 	bdp = txq->bd.cur;
--	last_bdp = bdp;
- 	status = fec16_to_cpu(bdp->cbd_sc);
- 	status &= ~BD_ENET_TX_STATS;
- 
-@@ -3810,7 +3809,6 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
- 		ebdp->cbd_esc = cpu_to_fec32(estatus);
- 	}
- 
--	index = fec_enet_get_bd_index(last_bdp, &txq->bd);
- 	txq->tx_skbuff[index] = NULL;
- 
- 	/* Make sure the updates to rest of the descriptor are performed before
-@@ -3825,7 +3823,7 @@ static int fec_enet_txq_xmit_frame(struct fec_enet_private *fep,
- 	bdp->cbd_sc = cpu_to_fec16(status);
- 
- 	/* If this was the last BD in the ring, start at the beginning again. */
--	bdp = fec_enet_get_nextdesc(last_bdp, &txq->bd);
-+	bdp = fec_enet_get_nextdesc(bdp, &txq->bd);
- 
- 	/* Make sure the update to bdp are performed before txq->bd.cur. */
- 	dma_wmb();
--- 
-2.39.2
-
diff --git a/queue-6.4/net-fec-remove-useless-fec_enet_reset_skb.patch b/queue-6.4/net-fec-remove-useless-fec_enet_reset_skb.patch
deleted file mode 100644
index e5305f47ff5..00000000000
--- a/queue-6.4/net-fec-remove-useless-fec_enet_reset_skb.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From f09a2cd78c7abcfe06f26e33813370a6caced0b0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 19 May 2023 10:01:13 +0800
-Subject: net: fec: remove useless fec_enet_reset_skb()
-
-From: Wei Fang <wei.fang@nxp.com>
-
-[ Upstream commit 2ae9c66b04554bf5b3eeaab8c12a0bfb9f28ebde ]
-
-This patch is a cleanup for fec driver. The fec_enet_reset_skb()
-is used to free skb buffers for tx queues and is only invoked in
-fec_restart(). However, fec_enet_bd_init() also resets skb buffers
-and is invoked in fec_restart() too. So fec_enet_reset_skb() is
-redundant and useless.
-
-Signed-off-by: Wei Fang <wei.fang@nxp.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 20f797399035 ("net: fec: recycle pages for transmitted XDP frames")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/freescale/fec_main.c | 21 ---------------------
- 1 file changed, 21 deletions(-)
-
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index 38e5b5abe067c..c08331f7da7b3 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -1011,24 +1011,6 @@ static void fec_enet_enable_ring(struct net_device *ndev)
- 	}
- }
- 
--static void fec_enet_reset_skb(struct net_device *ndev)
--{
--	struct fec_enet_private *fep = netdev_priv(ndev);
--	struct fec_enet_priv_tx_q *txq;
--	int i, j;
--
--	for (i = 0; i < fep->num_tx_queues; i++) {
--		txq = fep->tx_queue[i];
--
--		for (j = 0; j < txq->bd.ring_size; j++) {
--			if (txq->tx_skbuff[j]) {
--				dev_kfree_skb_any(txq->tx_skbuff[j]);
--				txq->tx_skbuff[j] = NULL;
--			}
--		}
--	}
--}
--
- /*
-  * This function is called to start or restart the FEC during a link
-  * change, transmit timeout, or to reconfigure the FEC.  The network
-@@ -1071,9 +1053,6 @@ fec_restart(struct net_device *ndev)
- 
- 	fec_enet_enable_ring(ndev);
- 
--	/* Reset tx SKB buffers. */
--	fec_enet_reset_skb(ndev);
--
- 	/* Enable MII mode */
- 	if (fep->full_duplex == DUPLEX_FULL) {
- 		/* FD enable */
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5-query-hca_cap_2-only-when-supported.patch b/queue-6.4/net-mlx5-query-hca_cap_2-only-when-supported.patch
deleted file mode 100644
index 98ec5bc2a1f..00000000000
--- a/queue-6.4/net-mlx5-query-hca_cap_2-only-when-supported.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From a34d2ad002d2b201833052ecee081b78e238b9e3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 20 Jun 2023 14:07:03 +0300
-Subject: net/mlx5: Query hca_cap_2 only when supported
-
-From: Maher Sanalla <msanalla@nvidia.com>
-
-[ Upstream commit 6496357aa5f710eec96f91345b9da1b37c3231f6 ]
-
-On vport enable, where fw's hca caps are queried, the driver queries
-hca_caps_2 without checking if fw truly supports them, causing a false
-failure of vfs vport load and blocking SRIOV enablement on old devices
-such as CX4 where hca_caps_2 support is missing.
-
-Thus, add a check for the said caps support before accessing them.
-
-Fixes: e5b9642a33be ("net/mlx5: E-Switch, Implement devlink port function cmds to control migratable")
-Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
-Reviewed-by: Shay Drory <shayd@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
-index 901c53751b0aa..f81c6d8d5e0f4 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
-@@ -800,6 +800,9 @@ static int mlx5_esw_vport_caps_get(struct mlx5_eswitch *esw, struct mlx5_vport *
- 	hca_caps = MLX5_ADDR_OF(query_hca_cap_out, query_ctx, capability);
- 	vport->info.roce_enabled = MLX5_GET(cmd_hca_cap, hca_caps, roce);
- 
-+	if (!MLX5_CAP_GEN_MAX(esw->dev, hca_cap_2))
-+		goto out_free;
-+
- 	memset(query_ctx, 0, query_out_sz);
- 	err = mlx5_vport_get_other_func_cap(esw->dev, vport->vport, query_ctx,
- 					    MLX5_CAP_GENERAL_2);
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5-register-a-unique-thermal-zone-per-device.patch b/queue-6.4/net-mlx5-register-a-unique-thermal-zone-per-device.patch
deleted file mode 100644
index 2d0e06e08b5..00000000000
--- a/queue-6.4/net-mlx5-register-a-unique-thermal-zone-per-device.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 52acc5f90291c9483639677ab04e86981279f2ca Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 20:36:41 -0700
-Subject: net/mlx5: Register a unique thermal zone per device
-
-From: Saeed Mahameed <saeedm@nvidia.com>
-
-[ Upstream commit 631079e08aa4a20b73e70de4cf457886194f029f ]
-
-Prior to this patch only one "mlx5" thermal zone could have been
-registered regardless of the number of individual mlx5 devices in the
-system.
-
-To fix this setup a unique name per device to register its own thermal
-zone.
-
-In order to not register a thermal zone for a virtual device (VF/SF) add
-a check for PF device type.
-
-The new name is a concatenation between "mlx5_" and "<PCI_DEV_BDF>", which
-will also help associating a thermal zone with its PCI device.
-
-$ lspci | grep ConnectX
-00:04.0 Ethernet controller: Mellanox Technologies MT2892 Family [ConnectX-6 Dx]
-00:05.0 Ethernet controller: Mellanox Technologies MT2892 Family [ConnectX-6 Dx]
-
-$ cat /sys/devices/virtual/thermal/thermal_zone0/type
-mlx5_0000:00:04.0
-$ cat /sys/devices/virtual/thermal/thermal_zone1/type
-mlx5_0000:00:05.0
-
-Fixes: c1fef618d611 ("net/mlx5: Implement thermal zone")
-CC: Sandipan Patra <spatra@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/mellanox/mlx5/core/thermal.c | 19 ++++++++++++-------
- 1 file changed, 12 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/thermal.c b/drivers/net/ethernet/mellanox/mlx5/core/thermal.c
-index e47fa6fb836f1..89a22ff04cb60 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/thermal.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/thermal.c
-@@ -68,14 +68,19 @@ static struct thermal_zone_device_ops mlx5_thermal_ops = {
- 
- int mlx5_thermal_init(struct mlx5_core_dev *mdev)
- {
-+	char data[THERMAL_NAME_LENGTH];
- 	struct mlx5_thermal *thermal;
--	struct thermal_zone_device *tzd;
--	const char *data = "mlx5";
-+	int err;
- 
--	tzd = thermal_zone_get_zone_by_name(data);
--	if (!IS_ERR(tzd))
-+	if (!mlx5_core_is_pf(mdev) && !mlx5_core_is_ecpf(mdev))
- 		return 0;
- 
-+	err = snprintf(data, sizeof(data), "mlx5_%s", dev_name(mdev->device));
-+	if (err < 0 || err >= sizeof(data)) {
-+		mlx5_core_err(mdev, "Failed to setup thermal zone name, %d\n", err);
-+		return -EINVAL;
-+	}
-+
- 	thermal = kzalloc(sizeof(*thermal), GFP_KERNEL);
- 	if (!thermal)
- 		return -ENOMEM;
-@@ -88,10 +93,10 @@ int mlx5_thermal_init(struct mlx5_core_dev *mdev)
- 						      &mlx5_thermal_ops,
- 						      NULL, 0, MLX5_THERMAL_POLL_INT_MSEC);
- 	if (IS_ERR(thermal->tzdev)) {
--		dev_err(mdev->device, "Failed to register thermal zone device (%s) %ld\n",
--			data, PTR_ERR(thermal->tzdev));
-+		err = PTR_ERR(thermal->tzdev);
-+		mlx5_core_err(mdev, "Failed to register thermal zone device (%s) %d\n", data, err);
- 		kfree(thermal);
--		return -EINVAL;
-+		return err;
- 	}
- 
- 	mdev->thermal = thermal;
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch b/queue-6.4/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
deleted file mode 100644
index ea3817a13f2..00000000000
--- a/queue-6.4/net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From ff417c1989674958a9b8ca169580be9bde998850 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 8 Jun 2023 09:32:10 +0200
-Subject: net/mlx5e: Check for NOT_READY flag state after locking
-
-From: Vlad Buslov <vladbu@nvidia.com>
-
-[ Upstream commit 65e64640e97c0f223e77f9ea69b5a46186b93470 ]
-
-Currently the check for NOT_READY flag is performed before obtaining the
-necessary lock. This opens a possibility for race condition when the flow
-is concurrently removed from unready_flows list by the workqueue task,
-which causes a double-removal from the list and a crash[0]. Fix the issue
-by moving the flag check inside the section protected by
-uplink_priv->unready_flows_lock mutex.
-
-[0]:
-[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP
-[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1
-[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
-[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.402999] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.403787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-[44376.406339] Call Trace:
-[44376.406651]  <TASK>
-[44376.406939]  ? die_addr+0x33/0x90
-[44376.407311]  ? exc_general_protection+0x192/0x390
-[44376.407795]  ? asm_exc_general_protection+0x22/0x30
-[44376.408292]  ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.408876]  __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]
-[44376.409482]  mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]
-[44376.410055]  mlx5e_flow_put+0x25/0x50 [mlx5_core]
-[44376.410529]  mlx5e_delete_flower+0x24b/0x350 [mlx5_core]
-[44376.411043]  tc_setup_cb_reoffload+0x22/0x80
-[44376.411462]  fl_reoffload+0x261/0x2f0 [cls_flower]
-[44376.411907]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.412481]  ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
-[44376.413044]  tcf_block_playback_offloads+0x76/0x170
-[44376.413497]  tcf_block_unbind+0x7b/0xd0
-[44376.413881]  tcf_block_setup+0x17d/0x1c0
-[44376.414269]  tcf_block_offload_cmd.isra.0+0xf1/0x130
-[44376.414725]  tcf_block_offload_unbind+0x43/0x70
-[44376.415153]  __tcf_block_put+0x82/0x150
-[44376.415532]  ingress_destroy+0x22/0x30 [sch_ingress]
-[44376.415986]  qdisc_destroy+0x3b/0xd0
-[44376.416343]  qdisc_graft+0x4d0/0x620
-[44376.416706]  tc_get_qdisc+0x1c9/0x3b0
-[44376.417074]  rtnetlink_rcv_msg+0x29c/0x390
-[44376.419978]  ? rep_movs_alternative+0x3a/0xa0
-[44376.420399]  ? rtnl_calcit.isra.0+0x120/0x120
-[44376.420813]  netlink_rcv_skb+0x54/0x100
-[44376.421192]  netlink_unicast+0x1f6/0x2c0
-[44376.421573]  netlink_sendmsg+0x232/0x4a0
-[44376.421980]  sock_sendmsg+0x38/0x60
-[44376.422328]  ____sys_sendmsg+0x1d0/0x1e0
-[44376.422709]  ? copy_msghdr_from_user+0x6d/0xa0
-[44376.423127]  ___sys_sendmsg+0x80/0xc0
-[44376.423495]  ? ___sys_recvmsg+0x8b/0xc0
-[44376.423869]  __sys_sendmsg+0x51/0x90
-[44376.424226]  do_syscall_64+0x3d/0x90
-[44376.424587]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
-[44376.425046] RIP: 0033:0x7f045134f887
-[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
-[44376.426914] RSP: 002b:00007ffd63a82b98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
-[44376.427592] RAX: ffffffffffffffda RBX: 000000006481955f RCX: 00007f045134f887
-[44376.428195] RDX: 0000000000000000 RSI: 00007ffd63a82c00 RDI: 0000000000000003
-[44376.428796] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
-[44376.429404] R10: 00007f0451208708 R11: 0000000000000246 R12: 0000000000000001
-[44376.430039] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400
-[44376.430644]  </TASK>
-[44376.430907] Modules linked in: mlx5_ib mlx5_core act_mirred act_tunnel_key cls_flower vxlan dummy sch_ingress openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_g
-ss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core]
-[44376.433936] ---[ end trace 0000000000000000 ]---
-[44376.434373] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
-[44376.434951] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
-[44376.436452] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
-[44376.436924] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
-[44376.437530] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
-[44376.438179] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
-[44376.438786] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
-[44376.439393] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
-[44376.439998] FS:  00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
-[44376.440714] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[44376.441225] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
-[44376.441843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
-[44376.442471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
-
-Fixes: ad86755b18d5 ("net/mlx5e: Protect unready flows with dedicated lock")
-Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
-Reviewed-by: Roi Dayan <roid@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-index b9b1da751a3b8..ed05ac8ae1de5 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
-@@ -1639,7 +1639,8 @@ static void remove_unready_flow(struct mlx5e_tc_flow *flow)
- 	uplink_priv = &rpriv->uplink_priv;
- 
- 	mutex_lock(&uplink_priv->unready_flows_lock);
--	unready_flow_del(flow);
-+	if (flow_flag_test(flow, NOT_READY))
-+		unready_flow_del(flow);
- 	mutex_unlock(&uplink_priv->unready_flows_lock);
- }
- 
-@@ -1932,8 +1933,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
- 	esw_attr = attr->esw_attr;
- 	mlx5e_put_flow_tunnel_id(flow);
- 
--	if (flow_flag_test(flow, NOT_READY))
--		remove_unready_flow(flow);
-+	remove_unready_flow(flow);
- 
- 	if (mlx5e_is_offloaded_flow(flow)) {
- 		if (flow_flag_test(flow, SLOW))
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch b/queue-6.4/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
deleted file mode 100644
index 2375796c99a..00000000000
--- a/queue-6.4/net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From d7e4e0b298f7e025a8d1d477793ef1fc0ddad78a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 08:59:34 +0800
-Subject: net/mlx5e: fix double free in mlx5e_destroy_flow_table
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 884abe45a9014d0de2e6edb0630dfd64f23f1d1b ]
-
-In function accel_fs_tcp_create_groups(), when the ft->g memory is
-successfully allocated but the 'in' memory fails to be allocated, the
-memory pointed to by ft->g is released once. And in function
-accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
-the memory pointed to by ft->g again. This will cause double free problem.
-
-Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-index 88a5aed9d6781..c7d191f66ad1b 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
-@@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
- 	in = kvzalloc(inlen, GFP_KERNEL);
- 	if  (!in || !ft->g) {
- 		kfree(ft->g);
-+		ft->g = NULL;
- 		kvfree(in);
- 		return -ENOMEM;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch b/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
deleted file mode 100644
index 652c792b696..00000000000
--- a/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 98b9d970ea12c3f1cdc033d3db131647cf868f8c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 09:49:02 +0800
-Subject: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit 3250affdc658557a41df9c5fb567723e421f8bf2 ]
-
-The memory pointed to by the fs->any pointer is not freed in the error
-path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
-Fix by freeing the memory in the error path, thereby making the error path
-identical to mlx5e_fs_tt_redirect_any_destroy().
-
-Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-index 03cb79adf912f..be83ad9db82a4 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
-@@ -594,7 +594,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
- 
- 	err = fs_any_create_table(fs);
- 	if (err)
--		return err;
-+		goto err_free_any;
- 
- 	err = fs_any_enable(fs);
- 	if (err)
-@@ -606,8 +606,8 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
- 
- err_destroy_table:
- 	fs_any_destroy_table(fs_any);
--
--	kfree(fs_any);
-+err_free_any:
- 	mlx5e_fs_set_any(fs, NULL);
-+	kfree(fs_any);
- 	return err;
- }
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch b/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
deleted file mode 100644
index 5fdef13faa9..00000000000
--- a/queue-6.4/net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From c7fe10d9e258be469ad14d38f7e422c7c5b53fc7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 09:49:03 +0800
-Subject: net/mlx5e: fix memory leak in mlx5e_ptp_open
-
-From: Zhengchao Shao <shaozhengchao@huawei.com>
-
-[ Upstream commit d543b649ffe58a0cb4b6948b3305069c5980a1fa ]
-
-When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
-pointed by "c" or "cparams" is not freed, which can lead to a memory
-leak. Fix by freeing the array in the error path.
-
-Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
-Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
-Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
-Reviewed-by: Gal Pressman <gal@nvidia.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-index 3cbebfba582bd..b0b429a0321ed 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
-@@ -729,8 +729,10 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params,
- 
- 	c = kvzalloc_node(sizeof(*c), GFP_KERNEL, dev_to_node(mlx5_core_dma_dev(mdev)));
- 	cparams = kvzalloc(sizeof(*cparams), GFP_KERNEL);
--	if (!c || !cparams)
--		return -ENOMEM;
-+	if (!c || !cparams) {
-+		err = -ENOMEM;
-+		goto err_free;
-+	}
- 
- 	c->priv     = priv;
- 	c->mdev     = priv->mdev;
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-rx-fix-flush-and-close-release-flow-of-reg.patch b/queue-6.4/net-mlx5e-rx-fix-flush-and-close-release-flow-of-reg.patch
deleted file mode 100644
index 53066e5e8db..00000000000
--- a/queue-6.4/net-mlx5e-rx-fix-flush-and-close-release-flow-of-reg.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From f7c41e83186a2321edeb0617b48d595a94c0f87b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 22 May 2023 21:18:53 +0300
-Subject: net/mlx5e: RX, Fix flush and close release flow of regular rq for
- legacy rq
-
-From: Dragos Tatulea <dtatulea@nvidia.com>
-
-[ Upstream commit 2e2d1965794d22fbe86df45bf4f933216743577d ]
-
-Regular (non-XSK) RQs get flushed on XSK setup and re-activated on XSK
-close. If the same regular RQ is closed (a config change for example)
-soon after the XSK close, a double release occurs because the missing
-wqes get released a second time.
-
-Fixes: 3f93f82988bc ("net/mlx5e: RX, Defer page release in legacy rq for better recycling")
-Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
-Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-index 69634829558e2..111f6a4a64b64 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-@@ -390,10 +390,18 @@ static void mlx5e_dealloc_rx_wqe(struct mlx5e_rq *rq, u16 ix)
- {
- 	struct mlx5e_wqe_frag_info *wi = get_frag(rq, ix);
- 
--	if (rq->xsk_pool)
-+	if (rq->xsk_pool) {
- 		mlx5e_xsk_free_rx_wqe(wi);
--	else
-+	} else {
- 		mlx5e_free_rx_wqe(rq, wi);
-+
-+		/* Avoid a second release of the wqe pages: dealloc is called
-+		 * for the same missing wqes on regular RQ flush and on regular
-+		 * RQ close. This happens when XSK RQs come into play.
-+		 */
-+		for (int i = 0; i < rq->wqe.info.num_frags; i++, wi++)
-+			wi->flags |= BIT(MLX5E_WQE_FRAG_SKIP_RELEASE);
-+	}
- }
- 
- static void mlx5e_xsk_free_rx_wqes(struct mlx5e_rq *rq, u16 ix, int wqe_bulk)
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-rx-fix-page_pool-page-fragment-tracking-fo.patch b/queue-6.4/net-mlx5e-rx-fix-page_pool-page-fragment-tracking-fo.patch
deleted file mode 100644
index e2f5dfee88f..00000000000
--- a/queue-6.4/net-mlx5e-rx-fix-page_pool-page-fragment-tracking-fo.patch
+++ /dev/null
@@ -1,124 +0,0 @@
-From 59ad05f1f9dbd8088f1ca0e32352df75c7c095a6 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 31 May 2023 21:18:49 +0300
-Subject: net/mlx5e: RX, Fix page_pool page fragment tracking for XDP
-
-From: Dragos Tatulea <dtatulea@nvidia.com>
-
-[ Upstream commit 7abd955a58fb0fcd4e756fa2065c03ae488fcfa7 ]
-
-Currently mlx5e releases pages directly to the page_pool for XDP_TX and
-does page fragment counting for XDP_REDIRECT. RX pages from the
-page_pool are leaking on XDP_REDIRECT because the xdp core will release
-only one fragment out of MLX5E_PAGECNT_BIAS_MAX and subsequently the page
-is marked as "skip release" which avoids the driver release.
-
-A fix would be to take an extra fragment for XDP_REDIRECT and not set the
-"skip release" bit so that the release on the driver side can handle the
-remaining bias fragments. But this would be a shortsighted solution.
-Instead, this patch converges the two XDP paths (XDP_TX and XDP_REDIRECT) to
-always do fragment tracking. The "skip release" bit is no longer
-necessary for XDP.
-
-Fixes: 6f5742846053 ("net/mlx5e: RX, Enable skb page recycling through the page_pool")
-Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
-Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  3 +-
- .../net/ethernet/mellanox/mlx5/core/en_rx.c   | 32 +++++++------------
- 2 files changed, 13 insertions(+), 22 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
-index f0e6095809faf..40589cebb7730 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
-@@ -662,8 +662,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
- 				/* No need to check ((page->pp_magic & ~0x3UL) == PP_SIGNATURE)
- 				 * as we know this is a page_pool page.
- 				 */
--				page_pool_put_defragged_page(page->pp,
--							     page, -1, true);
-+				page_pool_recycle_direct(page->pp, page);
- 			} while (++n < num);
- 
- 			break;
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-index 111f6a4a64b64..08e08489f4220 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-@@ -1753,11 +1753,11 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi
- 
- 	prog = rcu_dereference(rq->xdp_prog);
- 	if (prog && mlx5e_xdp_handle(rq, prog, &mxbuf)) {
--		if (test_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) {
-+		if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) {
- 			struct mlx5e_wqe_frag_info *pwi;
- 
- 			for (pwi = head_wi; pwi < wi; pwi++)
--				pwi->flags |= BIT(MLX5E_WQE_FRAG_SKIP_RELEASE);
-+				pwi->frag_page->frags++;
- 		}
- 		return NULL; /* page/packet was consumed by XDP */
- 	}
-@@ -1827,12 +1827,8 @@ static void mlx5e_handle_rx_cqe(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe)
- 			      rq, wi, cqe, cqe_bcnt);
- 	if (!skb) {
- 		/* probably for XDP */
--		if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) {
--			/* do not return page to cache,
--			 * it will be returned on XDP_TX completion.
--			 */
--			wi->flags |= BIT(MLX5E_WQE_FRAG_SKIP_RELEASE);
--		}
-+		if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags))
-+			wi->frag_page->frags++;
- 		goto wq_cyc_pop;
- 	}
- 
-@@ -1878,12 +1874,8 @@ static void mlx5e_handle_rx_cqe_rep(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe)
- 			      rq, wi, cqe, cqe_bcnt);
- 	if (!skb) {
- 		/* probably for XDP */
--		if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) {
--			/* do not return page to cache,
--			 * it will be returned on XDP_TX completion.
--			 */
--			wi->flags |= BIT(MLX5E_WQE_FRAG_SKIP_RELEASE);
--		}
-+		if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags))
-+			wi->frag_page->frags++;
- 		goto wq_cyc_pop;
- 	}
- 
-@@ -2062,12 +2054,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w
- 	if (prog) {
- 		if (mlx5e_xdp_handle(rq, prog, &mxbuf)) {
- 			if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) {
--				int i;
-+				struct mlx5e_frag_page *pfp;
-+
-+				for (pfp = head_page; pfp < frag_page; pfp++)
-+					pfp->frags++;
- 
--				for (i = 0; i < sinfo->nr_frags; i++)
--					/* non-atomic */
--					__set_bit(page_idx + i, wi->skip_release_bitmap);
--				return NULL;
-+				wi->linear_page.frags++;
- 			}
- 			mlx5e_page_release_fragmented(rq, &wi->linear_page);
- 			return NULL; /* page/packet was consumed by XDP */
-@@ -2165,7 +2157,7 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
- 				 cqe_bcnt, &mxbuf);
- 		if (mlx5e_xdp_handle(rq, prog, &mxbuf)) {
- 			if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags))
--				__set_bit(page_idx, wi->skip_release_bitmap); /* non-atomic */
-+				frag_page->frags++;
- 			return NULL; /* page/packet was consumed by XDP */
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mlx5e-tc-ct-offload-ct-clear-only-once.patch b/queue-6.4/net-mlx5e-tc-ct-offload-ct-clear-only-once.patch
deleted file mode 100644
index 596630e0950..00000000000
--- a/queue-6.4/net-mlx5e-tc-ct-offload-ct-clear-only-once.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From e31e91b5b2ccba22c8394e1c6632516613d95bbb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 4 Jun 2023 12:45:38 +0300
-Subject: net/mlx5e: TC, CT: Offload ct clear only once
-
-From: Yevgeny Kliteynik <kliteyn@nvidia.com>
-
-[ Upstream commit f7a485115ad4cfc560833942014bf791abf1f827 ]
-
-Non-clear CT action causes a flow rule split, while CT clear action
-doesn't and is just a header-rewrite to the current flow rule.
-But ct offload is done in post_parse and is per ct action instance,
-so ct clear offload is parsed multiple times, while its deleted once.
-
-Fix this by post_parsing the ct action only once per flow attribute
-(which is per flow rule) by using a offloaded ct_attr flag.
-
-Fixes: 08fe94ec5f77 ("net/mlx5e: TC, Remove special handling of CT action")
-Signed-off-by: Paul Blakey <paulb@nvidia.com>
-Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
-Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 14 +++++++++++---
- drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.h |  1 +
- 2 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
-index a254e728ac954..fadfa8b50bebe 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
-@@ -1545,7 +1545,8 @@ mlx5_tc_ct_parse_action(struct mlx5_tc_ct_priv *priv,
- 
- 	attr->ct_attr.ct_action |= act->ct.action; /* So we can have clear + ct */
- 	attr->ct_attr.zone = act->ct.zone;
--	attr->ct_attr.nf_ft = act->ct.flow_table;
-+	if (!(act->ct.action & TCA_CT_ACT_CLEAR))
-+		attr->ct_attr.nf_ft = act->ct.flow_table;
- 	attr->ct_attr.act_miss_cookie = act->miss_cookie;
- 
- 	return 0;
-@@ -1990,6 +1991,9 @@ mlx5_tc_ct_flow_offload(struct mlx5_tc_ct_priv *priv, struct mlx5_flow_attr *att
- 	if (!priv)
- 		return -EOPNOTSUPP;
- 
-+	if (attr->ct_attr.offloaded)
-+		return 0;
-+
- 	if (attr->ct_attr.ct_action & TCA_CT_ACT_CLEAR) {
- 		err = mlx5_tc_ct_entry_set_registers(priv, &attr->parse_attr->mod_hdr_acts,
- 						     0, 0, 0, 0);
-@@ -1999,11 +2003,15 @@ mlx5_tc_ct_flow_offload(struct mlx5_tc_ct_priv *priv, struct mlx5_flow_attr *att
- 		attr->action |= MLX5_FLOW_CONTEXT_ACTION_MOD_HDR;
- 	}
- 
--	if (!attr->ct_attr.nf_ft) /* means only ct clear action, and not ct_clear,ct() */
-+	if (!attr->ct_attr.nf_ft) { /* means only ct clear action, and not ct_clear,ct() */
-+		attr->ct_attr.offloaded = true;
- 		return 0;
-+	}
- 
- 	mutex_lock(&priv->control_lock);
- 	err = __mlx5_tc_ct_flow_offload(priv, attr);
-+	if (!err)
-+		attr->ct_attr.offloaded = true;
- 	mutex_unlock(&priv->control_lock);
- 
- 	return err;
-@@ -2021,7 +2029,7 @@ void
- mlx5_tc_ct_delete_flow(struct mlx5_tc_ct_priv *priv,
- 		       struct mlx5_flow_attr *attr)
- {
--	if (!attr->ct_attr.ft) /* no ct action, return */
-+	if (!attr->ct_attr.offloaded) /* no ct action, return */
- 		return;
- 	if (!attr->ct_attr.nf_ft) /* means only ct clear action, and not ct_clear,ct() */
- 		return;
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.h
-index 8e9316fa46d4b..b66c5f98067f7 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.h
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.h
-@@ -29,6 +29,7 @@ struct mlx5_ct_attr {
- 	u32 ct_labels_id;
- 	u32 act_miss_mapping;
- 	u64 act_miss_cookie;
-+	bool offloaded;
- 	struct mlx5_ct_ft *ft;
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mscc-ocelot-fix-oversize-frame-dropping-for-pree.patch b/queue-6.4/net-mscc-ocelot-fix-oversize-frame-dropping-for-pree.patch
deleted file mode 100644
index 50a9344544c..00000000000
--- a/queue-6.4/net-mscc-ocelot-fix-oversize-frame-dropping-for-pree.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From fea32e0ddf5b2d1794d710488bd9e12dea65d7ea Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 13:44:22 +0300
-Subject: net: mscc: ocelot: fix oversize frame dropping for preemptible TCs
-
-From: Vladimir Oltean <vladimir.oltean@nxp.com>
-
-[ Upstream commit c6efb4ae387c79bf0d4da286108c810b7b40de3c ]
-
-This switch implements Hold/Release in a strange way, with no control
-from the user as required by IEEE 802.1Q-2018 through Set-And-Hold-MAC
-and Set-And-Release-MAC, but rather, it emits HOLD requests implicitly
-based on the schedule.
-
-Namely, when the gate of a preemptible TC is about to close (actually
-QSYS::PREEMPTION_CFG.HOLD_ADVANCE octet times in advance of this event),
-the QSYS seems to emit a HOLD request pulse towards the MAC which
-preempts the currently transmitted packet, and further packets are held
-back in the queue system.
-
-This allows large frames to be squeezed through small time slots,
-because HOLD requests initiated by the gate events result in the frame
-being segmented in multiple fragments, the bit time of which is equal to
-the size of the time slot.
-
-It has been reported that the vsc9959_tas_guard_bands_update() logic
-breaks this, because it doesn't take preemptible TCs into account, and
-enables oversized frame dropping when the time slot doesn't allow a full
-MTU to be sent, but it does allow 2*minFragSize to be sent (128B).
-Packets larger than 128B are dropped instead of being sent in multiple
-fragments.
-
-Confusingly, the manual says:
-
-| For guard band, SDU calculation of a traffic class of a port, if
-| preemption is enabled (through 'QSYS::PREEMPTION_CFG.P_QUEUES') then
-| QSYS::PREEMPTION_CFG.HOLD_ADVANCE is used, otherwise
-| QSYS::QMAXSDU_CFG_*.QMAXSDU_* is used.
-
-but this only refers to the static guard band durations, and the
-QMAXSDU_CFG_* registers have dual purpose - the other being oversized
-frame dropping, which takes place irrespective of whether frames are
-preemptible or express.
-
-So, to fix the problem, we need to call vsc9959_tas_guard_bands_update()
-from ocelot_port_update_active_preemptible_tcs(), and modify the guard
-band logic to consider a different (lower) oversize limit for
-preemptible traffic classes.
-
-Fixes: 403ffc2c34de ("net: mscc: ocelot: add support for preemptible traffic classes")
-Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
-Message-ID: <20230705104422.49025-4-vladimir.oltean@nxp.com>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/ocelot/felix_vsc9959.c | 21 +++++++++++++++++----
- drivers/net/ethernet/mscc/ocelot_mm.c  |  7 +++++--
- 2 files changed, 22 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
-index 219fb672a68d7..bd11f9fb95e54 100644
---- a/drivers/net/dsa/ocelot/felix_vsc9959.c
-+++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
-@@ -1221,11 +1221,13 @@ static u32 vsc9959_tas_tc_max_sdu(struct tc_taprio_qopt_offload *taprio, int tc)
- static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port)
- {
- 	struct ocelot_port *ocelot_port = ocelot->ports[port];
-+	struct ocelot_mm_state *mm = &ocelot->mm[port];
- 	struct tc_taprio_qopt_offload *taprio;
- 	u64 min_gate_len[OCELOT_NUM_TC];
-+	u32 val, maxlen, add_frag_size;
-+	u64 needed_min_frag_time_ps;
- 	int speed, picos_per_byte;
- 	u64 needed_bit_time_ps;
--	u32 val, maxlen;
- 	u8 tas_speed;
- 	int tc;
- 
-@@ -1265,9 +1267,18 @@ static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port)
- 	 */
- 	needed_bit_time_ps = (u64)(maxlen + 24) * picos_per_byte;
- 
-+	/* Preemptible TCs don't need to pass a full MTU, the port will
-+	 * automatically emit a HOLD request when a preemptible TC gate closes
-+	 */
-+	val = ocelot_read_rix(ocelot, QSYS_PREEMPTION_CFG, port);
-+	add_frag_size = QSYS_PREEMPTION_CFG_MM_ADD_FRAG_SIZE_X(val);
-+	needed_min_frag_time_ps = picos_per_byte *
-+		(u64)(24 + 2 * ethtool_mm_frag_size_add_to_min(add_frag_size));
-+
- 	dev_dbg(ocelot->dev,
--		"port %d: max frame size %d needs %llu ps at speed %d\n",
--		port, maxlen, needed_bit_time_ps, speed);
-+		"port %d: max frame size %d needs %llu ps, %llu ps for mPackets at speed %d\n",
-+		port, maxlen, needed_bit_time_ps, needed_min_frag_time_ps,
-+		speed);
- 
- 	vsc9959_tas_min_gate_lengths(taprio, min_gate_len);
- 
-@@ -1281,7 +1292,9 @@ static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port)
- 		remaining_gate_len_ps =
- 			vsc9959_tas_remaining_gate_len_ps(min_gate_len[tc]);
- 
--		if (remaining_gate_len_ps > needed_bit_time_ps) {
-+		if ((mm->active_preemptible_tcs & BIT(tc)) ?
-+		    remaining_gate_len_ps > needed_min_frag_time_ps :
-+		    remaining_gate_len_ps > needed_bit_time_ps) {
- 			/* Setting QMAXSDU_CFG to 0 disables oversized frame
- 			 * dropping.
- 			 */
-diff --git a/drivers/net/ethernet/mscc/ocelot_mm.c b/drivers/net/ethernet/mscc/ocelot_mm.c
-index fb3145118d686..99b29d1e62449 100644
---- a/drivers/net/ethernet/mscc/ocelot_mm.c
-+++ b/drivers/net/ethernet/mscc/ocelot_mm.c
-@@ -67,10 +67,13 @@ void ocelot_port_update_active_preemptible_tcs(struct ocelot *ocelot, int port)
- 		val = mm->preemptible_tcs;
- 
- 	/* Cut through switching doesn't work for preemptible priorities,
--	 * so first make sure it is disabled.
-+	 * so first make sure it is disabled. Also, changing the preemptible
-+	 * TCs affects the oversized frame dropping logic, so that needs to be
-+	 * re-triggered. And since tas_guard_bands_update() also implicitly
-+	 * calls cut_through_fwd(), we don't need to explicitly call it.
- 	 */
- 	mm->active_preemptible_tcs = val;
--	ocelot->ops->cut_through_fwd(ocelot);
-+	ocelot->ops->tas_guard_bands_update(ocelot, port);
- 
- 	dev_dbg(ocelot->dev,
- 		"port %d %s/%s, MM TX %s, preemptible TCs 0x%x, active 0x%x\n",
--- 
-2.39.2
-
diff --git a/queue-6.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch b/queue-6.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
deleted file mode 100644
index 9d3a6bdf6e1..00000000000
--- a/queue-6.4/net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From bbbecf69e697b454d49b4534c8578fac9b3928f1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 07:37:12 +0200
-Subject: net: mvneta: fix txq_map in case of txq_number==1
-
-From: Klaus Kudielka <klaus.kudielka@gmail.com>
-
-[ Upstream commit 21327f81db6337c8843ce755b01523c7d3df715b ]
-
-If we boot with mvneta.txq_number=1, the txq_map is set incorrectly:
-MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is
-initialized. Fix this.
-
-Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support")
-Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/marvell/mvneta.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index 2cad76d0a50ef..4401fad31fb98 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -1505,7 +1505,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
- 			 */
- 			if (txq_number == 1)
- 				txq_map = (cpu == pp->rxq_def) ?
--					MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+					MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 
- 		} else {
- 			txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
-@@ -4295,7 +4295,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
- 		 */
- 		if (txq_number == 1)
- 			txq_map = (cpu == elected_cpu) ?
--				MVNETA_CPU_TXQ_ACCESS(1) : 0;
-+				MVNETA_CPU_TXQ_ACCESS(0) : 0;
- 		else
- 			txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
- 				MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
--- 
-2.39.2
-
diff --git a/queue-6.4/net-prevent-skb-corruption-on-frag-list-segmentation.patch b/queue-6.4/net-prevent-skb-corruption-on-frag-list-segmentation.patch
deleted file mode 100644
index 197960b446d..00000000000
--- a/queue-6.4/net-prevent-skb-corruption-on-frag-list-segmentation.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From e38314d12545f455b99b83eca2878449aefaef47 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 10:11:10 +0200
-Subject: net: prevent skb corruption on frag list segmentation
-
-From: Paolo Abeni <pabeni@redhat.com>
-
-[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]
-
-Ian reported several skb corruptions triggered by rx-gro-list,
-collecting different oops alike:
-
-[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
-[   62.631083] #PF: supervisor read access in kernel mode
-[   62.636312] #PF: error_code(0x0000) - not-present page
-[   62.641541] PGD 0 P4D 0
-[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
-[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
-[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
-[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
-./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
-net/ipv4/udp_offload.c:277)
-[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
-[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
-[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
-[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
-[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
-[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
-[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
-knlGS:0000000000000000
-[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
-[   62.749948] Call Trace:
-[   62.752498]  <TASK>
-[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
-[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
-[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
-[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
-net/core/dev.c:3659)
-[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
-[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
-[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
-net/netfilter/core.c:626)
-[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
-[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
-[   62.829420] br_flood (net/bridge/br_forward.c:233)
-[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
-[   62.837403] br_handle_frame (net/bridge/br_input.c:298
-net/bridge/br_input.c:416)
-[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
-[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
-[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
-net/core/dev.c:5727)
-[   62.876795] napi_complete_done (./include/linux/list.h:37
-./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
-[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
-[   62.893534] __napi_poll (net/core/dev.c:6498)
-[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
-net/core/dev.c:6640)
-[   62.905276] kthread (kernel/kthread.c:379)
-[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
-[   62.917119]  </TASK>
-
-In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
-bridge, both to the local input path and to an egress device (tun).
-
-The segmentation of such packets unsafely writes to the cloned skbs
-with shared heads.
-
-This change addresses the issue by uncloning as needed the
-to-be-segmented skbs.
-
-Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
-Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
-Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/skbuff.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index cea28d30abb55..1b6a1d99869dc 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -4270,6 +4270,11 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
- 
- 	skb_push(skb, -skb_network_offset(skb) + offset);
- 
-+	/* Ensure the head is writeable before touching the shared info */
-+	err = skb_unclone(skb, GFP_ATOMIC);
-+	if (err)
-+		goto err_linearize;
-+
- 	skb_shinfo(skb)->frag_list = NULL;
- 
- 	while (list_skb) {
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch b/queue-6.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
deleted file mode 100644
index 8be08683961..00000000000
--- a/queue-6.4/net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From f6a83e813f95e57de0c82a8c14e364de598faf03 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 5 Jul 2023 12:15:30 -0400
-Subject: net/sched: cls_fw: Fix improper refcount update leads to
- use-after-free
-
-From: M A Ramdhan <ramdhan@starlabs.sg>
-
-[ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ]
-
-In the event of a failure in tcf_change_indev(), fw_set_parms() will
-immediately return an error after incrementing or decrementing
-reference counter in tcf_bind_filter().  If attacker can control
-reference counter to zero and make reference freed, leading to
-use after free.
-
-In order to prevent this, move the point of possible failure above the
-point where the TC_FW_CLASSID is handled.
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
-Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
-Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_fw.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
-index ae9439a6c56c9..8641f80593179 100644
---- a/net/sched/cls_fw.c
-+++ b/net/sched/cls_fw.c
-@@ -212,11 +212,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	if (err < 0)
- 		return err;
- 
--	if (tb[TCA_FW_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
--	}
--
- 	if (tb[TCA_FW_INDEV]) {
- 		int ret;
- 		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
-@@ -233,6 +228,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
- 	} else if (head->mask != 0xFFFFFFFF)
- 		return err;
- 
-+	if (tb[TCA_FW_CLASSID]) {
-+		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
-+		tcf_bind_filter(tp, &f->res, base);
-+	}
-+
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch b/queue-6.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
deleted file mode 100644
index ddcc34c0b9c..00000000000
--- a/queue-6.4/net-sched-flower-ensure-both-minimum-and-maximum-por.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From deadee03222c098c10faf927753a1bb2e00a2762 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 10:08:09 +0300
-Subject: net/sched: flower: Ensure both minimum and maximum ports are
- specified
-
-From: Ido Schimmel <idosch@nvidia.com>
-
-[ Upstream commit d3f87278bcb80bd7f9519669d928b43320363d4f ]
-
-The kernel does not currently validate that both the minimum and maximum
-ports of a port range are specified. This can lead user space to think
-that a filter matching on a port range was successfully added, when in
-fact it was not. For example, with a patched (buggy) iproute2 that only
-sends the minimum port, the following commands do not return an error:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
-
- # tc filter show dev swp1 ingress
- filter protocol ip pref 1 flower chain 0
- filter protocol ip pref 1 flower chain 0 handle 0x1
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 1 ref 1 bind 1
-
- filter protocol ip pref 1 flower chain 0 handle 0x2
-   eth_type ipv4
-   ip_proto udp
-   not_in_hw
-         action order 1: gact action pass
-          random type none pass val 0
-          index 2 ref 1 bind 1
-
-Fix by returning an error unless both ports are specified:
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass
- Error: Both min and max source ports must be specified.
- We have an error talking to the kernel
-
- # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass
- Error: Both min and max destination ports must be specified.
- We have an error talking to the kernel
-
-Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges")
-Signed-off-by: Ido Schimmel <idosch@nvidia.com>
-Reviewed-by: Petr Machata <petrm@nvidia.com>
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/cls_flower.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index 815c3e416bc54..652158f612fc2 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -799,6 +799,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key,
- 		       TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
- 		       TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
- 
-+	if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max destination ports must be specified");
-+		return -EINVAL;
-+	}
-+	if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
-+		NL_SET_ERR_MSG(extack,
-+			       "Both min and max source ports must be specified");
-+		return -EINVAL;
-+	}
- 	if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
- 	    ntohs(key->tp_range.tp_max.dst) <=
- 	    ntohs(key->tp_range.tp_min.dst)) {
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-make-psched_mtu-rtnl-less-safe.patch b/queue-6.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
deleted file mode 100644
index d93417c2bc6..00000000000
--- a/queue-6.4/net-sched-make-psched_mtu-rtnl-less-safe.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 10d76bd0d19f2b3e7cf085d812e9f2ba3263efee Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 23:16:34 -0300
-Subject: net/sched: make psched_mtu() RTNL-less safe
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 150e33e62c1fa4af5aaab02776b6c3812711d478 ]
-
-Eric Dumazet says[1]:
--------
-Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it
-without holding RTNL, so dev->mtu can be changed underneath.
-KCSAN could issue a warning.
--------
-
-Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning.
-
-[1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/
-
-v1 -> v2: Fix commit message
-
-Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme")
-Suggested-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/pkt_sched.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 7dba1c3a7b801..2465d1e79d10e 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -134,7 +134,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
-  */
- static inline unsigned int psched_mtu(const struct net_device *dev)
- {
--	return dev->mtu + dev->hard_header_len;
-+	return READ_ONCE(dev->mtu) + dev->hard_header_len;
- }
- 
- static inline struct net *qdisc_net(struct Qdisc *q)
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch b/queue-6.4/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
deleted file mode 100644
index a60164fad47..00000000000
--- a/queue-6.4/net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 6a853a023604a3d01a17866ce9b4d5a5355edc97 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 18:01:02 -0300
-Subject: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 ]
-
-Lion says:
--------
-In the QFQ scheduler a similar issue to CVE-2023-31436
-persists.
-
-Consider the following code in net/sched/sch_qfq.c:
-
-static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
-                struct sk_buff **to_free)
-{
-     unsigned int len = qdisc_pkt_len(skb), gso_segs;
-
-    // ...
-
-     if (unlikely(cl->agg->lmax < len)) {
-         pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
-              cl->agg->lmax, len, cl->common.classid);
-         err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
-         if (err) {
-             cl->qstats.drops++;
-             return qdisc_drop(skb, sch, to_free);
-         }
-
-    // ...
-
-     }
-
-Similarly to CVE-2023-31436, "lmax" is increased without any bounds
-checks according to the packet length "len". Usually this would not
-impose a problem because packet sizes are naturally limited.
-
-This is however not the actual packet length, rather the
-"qdisc_pkt_len(skb)" which might apply size transformations according to
-"struct qdisc_size_table" as created by "qdisc_get_stab()" in
-net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.
-
-A user may choose virtually any size using such a table.
-
-As a result the same issue as in CVE-2023-31436 can occur, allowing heap
-out-of-bounds read / writes in the kmalloc-8192 cache.
--------
-
-We can create the issue with the following commands:
-
-tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
-overhead 999999999 linklayer ethernet qfq
-tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
-tc filter add dev $DEV parent 1: matchall classid 1:1
-ping -I $DEV 1.1.1.2
-
-This is caused by incorrectly assuming that qdisc_pkt_len() returns a
-length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.
-
-Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
-Reported-by: Lion <nnamrec@gmail.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index 63a5b277c117f..befaf74b33caa 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -381,8 +381,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight,
- 			   u32 lmax)
- {
- 	struct qfq_sched *q = qdisc_priv(sch);
--	struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight);
-+	struct qfq_aggregate *new_agg;
- 
-+	/* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */
-+	if (lmax > QFQ_MAX_LMAX)
-+		return -EINVAL;
-+
-+	new_agg = qfq_find_agg(q, lmax, weight);
- 	if (new_agg == NULL) { /* create new aggregate */
- 		new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC);
- 		if (new_agg == NULL)
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch b/queue-6.4/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch
deleted file mode 100644
index 57fad1fd183..00000000000
--- a/queue-6.4/net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 995657ed88cb063b7ecfad81292ee1ca3ae6f64e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 18:01:00 -0300
-Subject: net/sched: sch_qfq: reintroduce lmax bound check for MTU
-
-From: Pedro Tammela <pctammela@mojatatu.com>
-
-[ Upstream commit 158810b261d02fc7dd92ca9c392d8f8a211a2401 ]
-
-25369891fcef deletes a check for the case where no 'lmax' is
-specified which 3037933448f6 previously fixed as 'lmax'
-could be set to the device's MTU without any bound checking
-for QFQ_LMAX_MIN and QFQ_LMAX_MAX. Therefore, reintroduce the check.
-
-Fixes: 25369891fcef ("net/sched: sch_qfq: refactor parsing of netlink parameters")
-Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
-Reviewed-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
-Reviewed-by: Simon Horman <simon.horman@corigine.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/sched/sch_qfq.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
-index dfd9a99e62570..63a5b277c117f 100644
---- a/net/sched/sch_qfq.c
-+++ b/net/sched/sch_qfq.c
-@@ -423,10 +423,17 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
- 	else
- 		weight = 1;
- 
--	if (tb[TCA_QFQ_LMAX])
-+	if (tb[TCA_QFQ_LMAX]) {
- 		lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
--	else
-+	} else {
-+		/* MTU size is user controlled */
- 		lmax = psched_mtu(qdisc_dev(sch));
-+		if (lmax < QFQ_MIN_LMAX || lmax > QFQ_MAX_LMAX) {
-+			NL_SET_ERR_MSG_MOD(extack,
-+					   "MTU size out of bounds for qfq");
-+			return -EINVAL;
-+		}
-+	}
- 
- 	inv_w = ONE_FP / weight;
- 	weight = ONE_FP / inv_w;
--- 
-2.39.2
-
diff --git a/queue-6.4/net-sched-taprio-replace-tc_taprio_qopt_offload-enab.patch b/queue-6.4/net-sched-taprio-replace-tc_taprio_qopt_offload-enab.patch
deleted file mode 100644
index 5849dee6534..00000000000
--- a/queue-6.4/net-sched-taprio-replace-tc_taprio_qopt_offload-enab.patch
+++ /dev/null
@@ -1,390 +0,0 @@
-From b56c299a48f29f6799850dcc1ba7c0497b531ed9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 30 May 2023 12:19:45 +0300
-Subject: net/sched: taprio: replace tc_taprio_qopt_offload :: enable with a
- "cmd" enum
-
-From: Vladimir Oltean <vladimir.oltean@nxp.com>
-
-[ Upstream commit 2d800bc500fb3fb07a0fb42e2d0a1356fb9e1e8f ]
-
-Inspired from struct flow_cls_offload :: cmd, in order for taprio to be
-able to report statistics (which is future work), it seems that we need
-to drill one step further with the ndo_setup_tc(TC_SETUP_QDISC_TAPRIO)
-multiplexing, and pass the command as part of the common portion of the
-muxed structure.
-
-Since we already have an "enable" variable in tc_taprio_qopt_offload,
-refactor all drivers to check for "cmd" instead of "enable", and reject
-every other command except "replace" and "destroy" - to be future proof.
-
-Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
-Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com> # for lan966x
-Acked-by: Kurt Kanzenbach <kurt@linutronix.de> # hellcreek
-Reviewed-by: Muhammad Husaini Zulkifli <muhammad.husaini.zulkifli@intel.com>
-Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Stable-dep-of: 8046063df887 ("igc: Rename qbv_enable to taprio_offload_enable")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/dsa/hirschmann/hellcreek.c             | 14 +++++++++-----
- drivers/net/dsa/ocelot/felix_vsc9959.c             |  4 +++-
- drivers/net/dsa/sja1105/sja1105_tas.c              |  7 +++++--
- drivers/net/ethernet/engleder/tsnep_selftests.c    | 12 ++++++------
- drivers/net/ethernet/engleder/tsnep_tc.c           |  4 +++-
- drivers/net/ethernet/freescale/enetc/enetc_qos.c   |  6 +++++-
- drivers/net/ethernet/intel/igc/igc_main.c          | 13 +++++++++++--
- .../net/ethernet/microchip/lan966x/lan966x_tc.c    | 10 ++++++++--
- drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |  7 +++++--
- drivers/net/ethernet/ti/am65-cpsw-qos.c            | 11 ++++++++---
- include/net/pkt_sched.h                            |  7 ++++++-
- net/sched/sch_taprio.c                             |  4 ++--
- 12 files changed, 71 insertions(+), 28 deletions(-)
-
-diff --git a/drivers/net/dsa/hirschmann/hellcreek.c b/drivers/net/dsa/hirschmann/hellcreek.c
-index 595a548bb0a80..af50001ccdd4e 100644
---- a/drivers/net/dsa/hirschmann/hellcreek.c
-+++ b/drivers/net/dsa/hirschmann/hellcreek.c
-@@ -1885,13 +1885,17 @@ static int hellcreek_port_setup_tc(struct dsa_switch *ds, int port,
- 	case TC_SETUP_QDISC_TAPRIO: {
- 		struct tc_taprio_qopt_offload *taprio = type_data;
- 
--		if (!hellcreek_validate_schedule(hellcreek, taprio))
--			return -EOPNOTSUPP;
-+		switch (taprio->cmd) {
-+		case TAPRIO_CMD_REPLACE:
-+			if (!hellcreek_validate_schedule(hellcreek, taprio))
-+				return -EOPNOTSUPP;
- 
--		if (taprio->enable)
- 			return hellcreek_port_set_schedule(ds, port, taprio);
--
--		return hellcreek_port_del_schedule(ds, port);
-+		case TAPRIO_CMD_DESTROY:
-+			return hellcreek_port_del_schedule(ds, port);
-+		default:
-+			return -EOPNOTSUPP;
-+		}
- 	}
- 	default:
- 		return -EOPNOTSUPP;
-diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
-index bd11f9fb95e54..772f8b817390b 100644
---- a/drivers/net/dsa/ocelot/felix_vsc9959.c
-+++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
-@@ -1436,7 +1436,7 @@ static int vsc9959_qos_port_tas_set(struct ocelot *ocelot, int port,
- 
- 	mutex_lock(&ocelot->tas_lock);
- 
--	if (!taprio->enable) {
-+	if (taprio->cmd == TAPRIO_CMD_DESTROY) {
- 		ocelot_port_mqprio(ocelot, port, &taprio->mqprio);
- 		ocelot_rmw_rix(ocelot, 0, QSYS_TAG_CONFIG_ENABLE,
- 			       QSYS_TAG_CONFIG, port);
-@@ -1448,6 +1448,8 @@ static int vsc9959_qos_port_tas_set(struct ocelot *ocelot, int port,
- 
- 		mutex_unlock(&ocelot->tas_lock);
- 		return 0;
-+	} else if (taprio->cmd != TAPRIO_CMD_REPLACE) {
-+		return -EOPNOTSUPP;
- 	}
- 
- 	ret = ocelot_port_mqprio(ocelot, port, &taprio->mqprio);
-diff --git a/drivers/net/dsa/sja1105/sja1105_tas.c b/drivers/net/dsa/sja1105/sja1105_tas.c
-index e6153848a9509..d7818710bc028 100644
---- a/drivers/net/dsa/sja1105/sja1105_tas.c
-+++ b/drivers/net/dsa/sja1105/sja1105_tas.c
-@@ -516,10 +516,11 @@ int sja1105_setup_tc_taprio(struct dsa_switch *ds, int port,
- 	/* Can't change an already configured port (must delete qdisc first).
- 	 * Can't delete the qdisc from an unconfigured port.
- 	 */
--	if (!!tas_data->offload[port] == admin->enable)
-+	if ((!!tas_data->offload[port] && admin->cmd == TAPRIO_CMD_REPLACE) ||
-+	    (!tas_data->offload[port] && admin->cmd == TAPRIO_CMD_DESTROY))
- 		return -EINVAL;
- 
--	if (!admin->enable) {
-+	if (admin->cmd == TAPRIO_CMD_DESTROY) {
- 		taprio_offload_free(tas_data->offload[port]);
- 		tas_data->offload[port] = NULL;
- 
-@@ -528,6 +529,8 @@ int sja1105_setup_tc_taprio(struct dsa_switch *ds, int port,
- 			return rc;
- 
- 		return sja1105_static_config_reload(priv, SJA1105_SCHEDULING);
-+	} else if (admin->cmd != TAPRIO_CMD_REPLACE) {
-+		return -EOPNOTSUPP;
- 	}
- 
- 	/* The cycle time extension is the amount of time the last cycle from
-diff --git a/drivers/net/ethernet/engleder/tsnep_selftests.c b/drivers/net/ethernet/engleder/tsnep_selftests.c
-index 1581d6b222320..8a9145f93147c 100644
---- a/drivers/net/ethernet/engleder/tsnep_selftests.c
-+++ b/drivers/net/ethernet/engleder/tsnep_selftests.c
-@@ -329,7 +329,7 @@ static bool disable_taprio(struct tsnep_adapter *adapter)
- 	int retval;
- 
- 	memset(&qopt, 0, sizeof(qopt));
--	qopt.enable = 0;
-+	qopt.cmd = TAPRIO_CMD_DESTROY;
- 	retval = tsnep_tc_setup(adapter->netdev, TC_SETUP_QDISC_TAPRIO, &qopt);
- 	if (retval)
- 		return false;
-@@ -360,7 +360,7 @@ static bool tsnep_test_taprio(struct tsnep_adapter *adapter)
- 	for (i = 0; i < 255; i++)
- 		qopt->entries[i].command = TC_TAPRIO_CMD_SET_GATES;
- 
--	qopt->enable = 1;
-+	qopt->cmd = TAPRIO_CMD_REPLACE;
- 	qopt->base_time = ktime_set(0, 0);
- 	qopt->cycle_time = 1500000;
- 	qopt->cycle_time_extension = 0;
-@@ -382,7 +382,7 @@ static bool tsnep_test_taprio(struct tsnep_adapter *adapter)
- 	if (!run_taprio(adapter, qopt, 100))
- 		goto failed;
- 
--	qopt->enable = 1;
-+	qopt->cmd = TAPRIO_CMD_REPLACE;
- 	qopt->base_time = ktime_set(0, 0);
- 	qopt->cycle_time = 411854;
- 	qopt->cycle_time_extension = 0;
-@@ -406,7 +406,7 @@ static bool tsnep_test_taprio(struct tsnep_adapter *adapter)
- 	if (!run_taprio(adapter, qopt, 100))
- 		goto failed;
- 
--	qopt->enable = 1;
-+	qopt->cmd = TAPRIO_CMD_REPLACE;
- 	qopt->base_time = ktime_set(0, 0);
- 	delay_base_time(adapter, qopt, 12);
- 	qopt->cycle_time = 125000;
-@@ -457,7 +457,7 @@ static bool tsnep_test_taprio_change(struct tsnep_adapter *adapter)
- 	for (i = 0; i < 255; i++)
- 		qopt->entries[i].command = TC_TAPRIO_CMD_SET_GATES;
- 
--	qopt->enable = 1;
-+	qopt->cmd = TAPRIO_CMD_REPLACE;
- 	qopt->base_time = ktime_set(0, 0);
- 	qopt->cycle_time = 100000;
- 	qopt->cycle_time_extension = 0;
-@@ -610,7 +610,7 @@ static bool tsnep_test_taprio_extension(struct tsnep_adapter *adapter)
- 	for (i = 0; i < 255; i++)
- 		qopt->entries[i].command = TC_TAPRIO_CMD_SET_GATES;
- 
--	qopt->enable = 1;
-+	qopt->cmd = TAPRIO_CMD_REPLACE;
- 	qopt->base_time = ktime_set(0, 0);
- 	qopt->cycle_time = 100000;
- 	qopt->cycle_time_extension = 50000;
-diff --git a/drivers/net/ethernet/engleder/tsnep_tc.c b/drivers/net/ethernet/engleder/tsnep_tc.c
-index d083e6684f120..745b191a55402 100644
---- a/drivers/net/ethernet/engleder/tsnep_tc.c
-+++ b/drivers/net/ethernet/engleder/tsnep_tc.c
-@@ -325,7 +325,7 @@ static int tsnep_taprio(struct tsnep_adapter *adapter,
- 	if (!adapter->gate_control)
- 		return -EOPNOTSUPP;
- 
--	if (!qopt->enable) {
-+	if (qopt->cmd == TAPRIO_CMD_DESTROY) {
- 		/* disable gate control if active */
- 		mutex_lock(&adapter->gate_control_lock);
- 
-@@ -337,6 +337,8 @@ static int tsnep_taprio(struct tsnep_adapter *adapter,
- 		mutex_unlock(&adapter->gate_control_lock);
- 
- 		return 0;
-+	} else if (qopt->cmd != TAPRIO_CMD_REPLACE) {
-+		return -EOPNOTSUPP;
- 	}
- 
- 	retval = tsnep_validate_gcl(qopt);
-diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
-index 126007ab70f61..dfec50106106f 100644
---- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
-+++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
-@@ -65,7 +65,7 @@ static int enetc_setup_taprio(struct net_device *ndev,
- 	gcl_len = admin_conf->num_entries;
- 
- 	tge = enetc_rd(hw, ENETC_PTGCR);
--	if (!admin_conf->enable) {
-+	if (admin_conf->cmd == TAPRIO_CMD_DESTROY) {
- 		enetc_wr(hw, ENETC_PTGCR, tge & ~ENETC_PTGCR_TGE);
- 		enetc_reset_ptcmsdur(hw);
- 
-@@ -138,6 +138,10 @@ int enetc_setup_tc_taprio(struct net_device *ndev, void *type_data)
- 	struct enetc_ndev_priv *priv = netdev_priv(ndev);
- 	int err, i;
- 
-+	if (taprio->cmd != TAPRIO_CMD_REPLACE &&
-+	    taprio->cmd != TAPRIO_CMD_DESTROY)
-+		return -EOPNOTSUPP;
-+
- 	/* TSD and Qbv are mutually exclusive in hardware */
- 	for (i = 0; i < priv->num_tx_rings; i++)
- 		if (priv->tx_ring[i]->tsd_enable)
-diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
-index e7bd2c60ee383..ae986e44a4718 100644
---- a/drivers/net/ethernet/intel/igc/igc_main.c
-+++ b/drivers/net/ethernet/intel/igc/igc_main.c
-@@ -6117,9 +6117,18 @@ static int igc_save_qbv_schedule(struct igc_adapter *adapter,
- 	size_t n;
- 	int i;
- 
--	adapter->qbv_enable = qopt->enable;
-+	switch (qopt->cmd) {
-+	case TAPRIO_CMD_REPLACE:
-+		adapter->qbv_enable = true;
-+		break;
-+	case TAPRIO_CMD_DESTROY:
-+		adapter->qbv_enable = false;
-+		break;
-+	default:
-+		return -EOPNOTSUPP;
-+	}
- 
--	if (!qopt->enable)
-+	if (!adapter->qbv_enable)
- 		return igc_tsn_clear_schedule(adapter);
- 
- 	if (qopt->base_time < 0)
-diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_tc.c b/drivers/net/ethernet/microchip/lan966x/lan966x_tc.c
-index cf0cc7562d042..ee652f2d23595 100644
---- a/drivers/net/ethernet/microchip/lan966x/lan966x_tc.c
-+++ b/drivers/net/ethernet/microchip/lan966x/lan966x_tc.c
-@@ -21,8 +21,14 @@ static int lan966x_tc_setup_qdisc_mqprio(struct lan966x_port *port,
- static int lan966x_tc_setup_qdisc_taprio(struct lan966x_port *port,
- 					 struct tc_taprio_qopt_offload *taprio)
- {
--	return taprio->enable ? lan966x_taprio_add(port, taprio) :
--				lan966x_taprio_del(port);
-+	switch (taprio->cmd) {
-+	case TAPRIO_CMD_REPLACE:
-+		return lan966x_taprio_add(port, taprio);
-+	case TAPRIO_CMD_DESTROY:
-+		return lan966x_taprio_del(port);
-+	default:
-+		return -EOPNOTSUPP;
-+	}
- }
- 
- static int lan966x_tc_setup_qdisc_tbf(struct lan966x_port *port,
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
-index 9d55226479b4a..ac41ef4cbd2f0 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
-@@ -966,8 +966,11 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
- 		return -EOPNOTSUPP;
- 	}
- 
--	if (!qopt->enable)
-+	if (qopt->cmd == TAPRIO_CMD_DESTROY)
- 		goto disable;
-+	else if (qopt->cmd != TAPRIO_CMD_REPLACE)
-+		return -EOPNOTSUPP;
-+
- 	if (qopt->num_entries >= dep)
- 		return -EINVAL;
- 	if (!qopt->cycle_time)
-@@ -988,7 +991,7 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
- 
- 	mutex_lock(&priv->plat->est->lock);
- 	priv->plat->est->gcl_size = size;
--	priv->plat->est->enable = qopt->enable;
-+	priv->plat->est->enable = qopt->cmd == TAPRIO_CMD_REPLACE;
- 	mutex_unlock(&priv->plat->est->lock);
- 
- 	for (i = 0; i < size; i++) {
-diff --git a/drivers/net/ethernet/ti/am65-cpsw-qos.c b/drivers/net/ethernet/ti/am65-cpsw-qos.c
-index 3a908db6e5b22..eced87fa261c9 100644
---- a/drivers/net/ethernet/ti/am65-cpsw-qos.c
-+++ b/drivers/net/ethernet/ti/am65-cpsw-qos.c
-@@ -450,7 +450,7 @@ static int am65_cpsw_configure_taprio(struct net_device *ndev,
- 
- 	am65_cpsw_est_update_state(ndev);
- 
--	if (!est_new->taprio.enable) {
-+	if (est_new->taprio.cmd == TAPRIO_CMD_DESTROY) {
- 		am65_cpsw_stop_est(ndev);
- 		return ret;
- 	}
-@@ -476,7 +476,7 @@ static int am65_cpsw_configure_taprio(struct net_device *ndev,
- 	am65_cpsw_est_set_sched_list(ndev, est_new);
- 	am65_cpsw_port_est_assign_buf_num(ndev, est_new->buf);
- 
--	am65_cpsw_est_set(ndev, est_new->taprio.enable);
-+	am65_cpsw_est_set(ndev, est_new->taprio.cmd == TAPRIO_CMD_REPLACE);
- 
- 	if (tact == TACT_PROG) {
- 		ret = am65_cpsw_timer_set(ndev, est_new);
-@@ -520,7 +520,7 @@ static int am65_cpsw_set_taprio(struct net_device *ndev, void *type_data)
- 	am65_cpsw_cp_taprio(taprio, &est_new->taprio);
- 	ret = am65_cpsw_configure_taprio(ndev, est_new);
- 	if (!ret) {
--		if (taprio->enable) {
-+		if (taprio->cmd == TAPRIO_CMD_REPLACE) {
- 			devm_kfree(&ndev->dev, port->qos.est_admin);
- 
- 			port->qos.est_admin = est_new;
-@@ -564,8 +564,13 @@ static void am65_cpsw_est_link_up(struct net_device *ndev, int link_speed)
- static int am65_cpsw_setup_taprio(struct net_device *ndev, void *type_data)
- {
- 	struct am65_cpsw_port *port = am65_ndev_to_port(ndev);
-+	struct tc_taprio_qopt_offload *taprio = type_data;
- 	struct am65_cpsw_common *common = port->common;
- 
-+	if (taprio->cmd != TAPRIO_CMD_REPLACE &&
-+	    taprio->cmd != TAPRIO_CMD_DESTROY)
-+		return -EOPNOTSUPP;
-+
- 	if (!IS_ENABLED(CONFIG_TI_AM65_CPSW_TAS))
- 		return -ENODEV;
- 
-diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
-index 5722931d83d43..7dba1c3a7b801 100644
---- a/include/net/pkt_sched.h
-+++ b/include/net/pkt_sched.h
-@@ -187,6 +187,11 @@ struct tc_taprio_caps {
- 	bool broken_mqprio:1;
- };
- 
-+enum tc_taprio_qopt_cmd {
-+	TAPRIO_CMD_REPLACE,
-+	TAPRIO_CMD_DESTROY,
-+};
-+
- struct tc_taprio_sched_entry {
- 	u8 command; /* TC_TAPRIO_CMD_* */
- 
-@@ -198,7 +203,7 @@ struct tc_taprio_sched_entry {
- struct tc_taprio_qopt_offload {
- 	struct tc_mqprio_qopt_offload mqprio;
- 	struct netlink_ext_ack *extack;
--	u8 enable;
-+	enum tc_taprio_qopt_cmd cmd;
- 	ktime_t base_time;
- 	u64 cycle_time;
- 	u64 cycle_time_extension;
-diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
-index cf0e61ed92253..4caf80ddc6721 100644
---- a/net/sched/sch_taprio.c
-+++ b/net/sched/sch_taprio.c
-@@ -1527,7 +1527,7 @@ static int taprio_enable_offload(struct net_device *dev,
- 			       "Not enough memory for enabling offload mode");
- 		return -ENOMEM;
- 	}
--	offload->enable = 1;
-+	offload->cmd = TAPRIO_CMD_REPLACE;
- 	offload->extack = extack;
- 	mqprio_qopt_reconstruct(dev, &offload->mqprio.qopt);
- 	offload->mqprio.extack = extack;
-@@ -1575,7 +1575,7 @@ static int taprio_disable_offload(struct net_device *dev,
- 			       "Not enough memory to disable offload mode");
- 		return -ENOMEM;
- 	}
--	offload->enable = 0;
-+	offload->cmd = TAPRIO_CMD_DESTROY;
- 
- 	err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_TAPRIO, offload);
- 	if (err < 0) {
--- 
-2.39.2
-
diff --git a/queue-6.4/net-txgbe-fix-eeprom-calculation-error.patch b/queue-6.4/net-txgbe-fix-eeprom-calculation-error.patch
deleted file mode 100644
index c4f34d05a4a..00000000000
--- a/queue-6.4/net-txgbe-fix-eeprom-calculation-error.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From a1a847163ec939ce74bf72f6a3e83a252842afac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 14:34:14 +0800
-Subject: net: txgbe: fix eeprom calculation error
-
-From: Jiawen Wu <jiawenwu@trustnetic.com>
-
-[ Upstream commit aa846677a9fb19a0f2c58154c140398aa92a87ba ]
-
-For some device types like TXGBE_ID_XAUI, *checksum computed in
-txgbe_calc_eeprom_checksum() is larger than TXGBE_EEPROM_SUM. Remove the
-limit on the size of *checksum.
-
-Fixes: 049fe5365324 ("net: txgbe: Add operations to interact with firmware")
-Fixes: 5e2ea7801fac ("net: txgbe: Fix unsigned comparison to zero in txgbe_calc_eeprom_checksum()")
-Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
-Link: https://lore.kernel.org/r/20230711063414.3311-1-jiawenwu@trustnetic.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c b/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c
-index ebc46f3be0569..fc37af2e71ffc 100644
---- a/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c
-+++ b/drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c
-@@ -196,9 +196,6 @@ static int txgbe_calc_eeprom_checksum(struct wx *wx, u16 *checksum)
- 	if (eeprom_ptrs)
- 		kvfree(eeprom_ptrs);
- 
--	if (*checksum > TXGBE_EEPROM_SUM)
--		return -EINVAL;
--
- 	*checksum = TXGBE_EEPROM_SUM - *checksum;
- 
- 	return 0;
--- 
-2.39.2
-
diff --git a/queue-6.4/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch b/queue-6.4/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
deleted file mode 100644
index 70c14f43322..00000000000
--- a/queue-6.4/netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 9904cc769d6876b45e8f23b7ac006d00e56bb023 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 11:52:26 +0300
-Subject: netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 ]
-
-The simple_write_to_buffer() function is designed to handle partial
-writes.  It returns negatives on error, otherwise it returns the number
-of bytes that were able to be copied.  This code doesn't check the
-return properly.  We only know that the first byte is written, the rest
-of the buffer might be uninitialized.
-
-There is no need to use the simple_write_to_buffer() function.
-Partial writes are prohibited by the "if (*ppos != 0)" check at the
-start of the function.  Just use memdup_user() and copy the whole
-buffer.
-
-Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
-Reviewed-by: Ido Schimmel <idosch@nvidia.com>
-Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/netdevsim/dev.c | 9 +++------
- 1 file changed, 3 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
-index 6045bece2654d..b4d3b9cde8bd6 100644
---- a/drivers/net/netdevsim/dev.c
-+++ b/drivers/net/netdevsim/dev.c
-@@ -184,13 +184,10 @@ static ssize_t nsim_dev_trap_fa_cookie_write(struct file *file,
- 	cookie_len = (count - 1) / 2;
- 	if ((count - 1) % 2)
- 		return -EINVAL;
--	buf = kmalloc(count, GFP_KERNEL | __GFP_NOWARN);
--	if (!buf)
--		return -ENOMEM;
- 
--	ret = simple_write_to_buffer(buf, count, ppos, data, count);
--	if (ret < 0)
--		goto free_buf;
-+	buf = memdup_user(data, count);
-+	if (IS_ERR(buf))
-+		return PTR_ERR(buf);
- 
- 	fa_cookie = kmalloc(sizeof(*fa_cookie) + cookie_len,
- 			    GFP_KERNEL | __GFP_NOWARN);
--- 
-2.39.2
-
diff --git a/queue-6.4/netfilter-conntrack-don-t-fold-port-numbers-into-add.patch b/queue-6.4/netfilter-conntrack-don-t-fold-port-numbers-into-add.patch
deleted file mode 100644
index 263f24f07ed..00000000000
--- a/queue-6.4/netfilter-conntrack-don-t-fold-port-numbers-into-add.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From a0f10b653153e7204eca71f671829ee8f377403a Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 4 Jul 2023 12:25:23 +0200
-Subject: netfilter: conntrack: don't fold port numbers into addresses before
- hashing
-
-From: Florian Westphal <fw@strlen.de>
-
-[ Upstream commit eaf9e7192ec9af2fbf1b6eb2299dd0feca6c5f7e ]
-
-Originally this used jhash2() over tuple and folded the zone id,
-the pernet hash value, destination port and l4 protocol number into the
-32bit seed value.
-
-When the switch to siphash was done, I used an on-stack temporary
-buffer to build a suitable key to be hashed via siphash().
-
-But this showed up as performance regression, so I got rid of
-the temporary copy and collected to-be-hashed data in 4 u64 variables.
-
-This makes it easy to build tuples that produce the same hash, which isn't
-desirable even though chain lengths are limited.
-
-Switch back to plain siphash, but just like with jhash2(), take advantage
-of the fact that most of to-be-hashed data is already in a suitable order.
-
-Use an empty struct as annotation in 'struct nf_conntrack_tuple' to mark
-last member that can be used as hash input.
-
-The only remaining data that isn't present in the tuple structure are the
-zone identifier and the pernet hash: fold those into the key.
-
-Fixes: d2c806abcf0b ("netfilter: conntrack: use siphash_4u64")
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/netfilter/nf_conntrack_tuple.h |  3 +++
- net/netfilter/nf_conntrack_core.c          | 20 +++++++-------------
- 2 files changed, 10 insertions(+), 13 deletions(-)
-
-diff --git a/include/net/netfilter/nf_conntrack_tuple.h b/include/net/netfilter/nf_conntrack_tuple.h
-index 9334371c94e2b..f7dd950ff2509 100644
---- a/include/net/netfilter/nf_conntrack_tuple.h
-+++ b/include/net/netfilter/nf_conntrack_tuple.h
-@@ -67,6 +67,9 @@ struct nf_conntrack_tuple {
- 		/* The protocol. */
- 		u_int8_t protonum;
- 
-+		/* The direction must be ignored for the tuplehash */
-+		struct { } __nfct_hash_offsetend;
-+
- 		/* The direction (for tuplehash) */
- 		u_int8_t dir;
- 	} dst;
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index d119f1d4c2fc8..992393102d5f5 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -211,24 +211,18 @@ static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple,
- 			      unsigned int zoneid,
- 			      const struct net *net)
- {
--	u64 a, b, c, d;
-+	siphash_key_t key;
- 
- 	get_random_once(&nf_conntrack_hash_rnd, sizeof(nf_conntrack_hash_rnd));
- 
--	/* The direction must be ignored, handle usable tuplehash members manually */
--	a = (u64)tuple->src.u3.all[0] << 32 | tuple->src.u3.all[3];
--	b = (u64)tuple->dst.u3.all[0] << 32 | tuple->dst.u3.all[3];
-+	key = nf_conntrack_hash_rnd;
- 
--	c = (__force u64)tuple->src.u.all << 32 | (__force u64)tuple->dst.u.all << 16;
--	c |= tuple->dst.protonum;
-+	key.key[0] ^= zoneid;
-+	key.key[1] ^= net_hash_mix(net);
- 
--	d = (u64)zoneid << 32 | net_hash_mix(net);
--
--	/* IPv4: u3.all[1,2,3] == 0 */
--	c ^= (u64)tuple->src.u3.all[1] << 32 | tuple->src.u3.all[2];
--	d += (u64)tuple->dst.u3.all[1] << 32 | tuple->dst.u3.all[2];
--
--	return (u32)siphash_4u64(a, b, c, d, &nf_conntrack_hash_rnd);
-+	return siphash((void *)tuple,
-+			offsetofend(struct nf_conntrack_tuple, dst.__nfct_hash_offsetend),
-+			&key);
- }
- 
- static u32 scale_hash(u32 hash)
--- 
-2.39.2
-
diff --git a/queue-6.4/netfilter-nf_tables-report-use-refcount-overflow.patch b/queue-6.4/netfilter-nf_tables-report-use-refcount-overflow.patch
deleted file mode 100644
index 94bf990a231..00000000000
--- a/queue-6.4/netfilter-nf_tables-report-use-refcount-overflow.patch
+++ /dev/null
@@ -1,752 +0,0 @@
-From 6020f819a7c3532db9f038c037830fd7e15d9058 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 16:24:27 +0200
-Subject: netfilter: nf_tables: report use refcount overflow
-
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-
-[ Upstream commit 1689f25924ada8fe14a4a82c38925d04994c7142 ]
-
-Overflow use refcount checks are not complete.
-
-Add helper function to deal with object reference counter tracking.
-Report -EMFILE in case UINT_MAX is reached.
-
-nft_use_dec() splats in case that reference counter underflows,
-which should not ever happen.
-
-Add nft_use_inc_restore() and nft_use_dec_restore() which are used
-to restore reference counter from error and abort paths.
-
-Use u32 in nft_flowtable and nft_object since helper functions cannot
-work on bitfields.
-
-Remove the few early incomplete checks now that the helper functions
-are in place and used to check for refcount overflow.
-
-Fixes: 96518518cc41 ("netfilter: add nftables")
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/net/netfilter/nf_tables.h |  31 +++++-
- net/netfilter/nf_tables_api.c     | 163 ++++++++++++++++++------------
- net/netfilter/nft_flow_offload.c  |   6 +-
- net/netfilter/nft_immediate.c     |   8 +-
- net/netfilter/nft_objref.c        |   8 +-
- 5 files changed, 141 insertions(+), 75 deletions(-)
-
-diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
-index ee47d7143d99f..1b0beb8f08aee 100644
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -1211,6 +1211,29 @@ int __nft_release_basechain(struct nft_ctx *ctx);
- 
- unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
- 
-+static inline bool nft_use_inc(u32 *use)
-+{
-+	if (*use == UINT_MAX)
-+		return false;
-+
-+	(*use)++;
-+
-+	return true;
-+}
-+
-+static inline void nft_use_dec(u32 *use)
-+{
-+	WARN_ON_ONCE((*use)-- == 0);
-+}
-+
-+/* For error and abort path: restore use counter to previous state. */
-+static inline void nft_use_inc_restore(u32 *use)
-+{
-+	WARN_ON_ONCE(!nft_use_inc(use));
-+}
-+
-+#define nft_use_dec_restore	nft_use_dec
-+
- /**
-  *	struct nft_table - nf_tables table
-  *
-@@ -1296,8 +1319,8 @@ struct nft_object {
- 	struct list_head		list;
- 	struct rhlist_head		rhlhead;
- 	struct nft_object_hash_key	key;
--	u32				genmask:2,
--					use:30;
-+	u32				genmask:2;
-+	u32				use;
- 	u64				handle;
- 	u16				udlen;
- 	u8				*udata;
-@@ -1399,8 +1422,8 @@ struct nft_flowtable {
- 	char				*name;
- 	int				hooknum;
- 	int				ops_len;
--	u32				genmask:2,
--					use:30;
-+	u32				genmask:2;
-+	u32				use;
- 	u64				handle;
- 	/* runtime data below here */
- 	struct list_head		hook_list ____cacheline_aligned;
-diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
-index 79719e8cda799..18546f9b2a63a 100644
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -253,8 +253,10 @@ int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain)
- 	if (chain->bound)
- 		return -EBUSY;
- 
-+	if (!nft_use_inc(&chain->use))
-+		return -EMFILE;
-+
- 	chain->bound = true;
--	chain->use++;
- 	nft_chain_trans_bind(ctx, chain);
- 
- 	return 0;
-@@ -437,7 +439,7 @@ static int nft_delchain(struct nft_ctx *ctx)
- 	if (IS_ERR(trans))
- 		return PTR_ERR(trans);
- 
--	ctx->table->use--;
-+	nft_use_dec(&ctx->table->use);
- 	nft_deactivate_next(ctx->net, ctx->chain);
- 
- 	return 0;
-@@ -476,7 +478,7 @@ nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
- 	/* You cannot delete the same rule twice */
- 	if (nft_is_active_next(ctx->net, rule)) {
- 		nft_deactivate_next(ctx->net, rule);
--		ctx->chain->use--;
-+		nft_use_dec(&ctx->chain->use);
- 		return 0;
- 	}
- 	return -ENOENT;
-@@ -643,7 +645,7 @@ static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
- 		nft_map_deactivate(ctx, set);
- 
- 	nft_deactivate_next(ctx->net, set);
--	ctx->table->use--;
-+	nft_use_dec(&ctx->table->use);
- 
- 	return err;
- }
-@@ -675,7 +677,7 @@ static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
- 		return err;
- 
- 	nft_deactivate_next(ctx->net, obj);
--	ctx->table->use--;
-+	nft_use_dec(&ctx->table->use);
- 
- 	return err;
- }
-@@ -710,7 +712,7 @@ static int nft_delflowtable(struct nft_ctx *ctx,
- 		return err;
- 
- 	nft_deactivate_next(ctx->net, flowtable);
--	ctx->table->use--;
-+	nft_use_dec(&ctx->table->use);
- 
- 	return err;
- }
-@@ -2395,9 +2397,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
- 	struct nft_chain *chain;
- 	int err;
- 
--	if (table->use == UINT_MAX)
--		return -EOVERFLOW;
--
- 	if (nla[NFTA_CHAIN_HOOK]) {
- 		struct nft_stats __percpu *stats = NULL;
- 		struct nft_chain_hook hook = {};
-@@ -2493,6 +2492,11 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
- 	if (err < 0)
- 		goto err_destroy_chain;
- 
-+	if (!nft_use_inc(&table->use)) {
-+		err = -EMFILE;
-+		goto err_use;
-+	}
-+
- 	trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
- 	if (IS_ERR(trans)) {
- 		err = PTR_ERR(trans);
-@@ -2509,10 +2513,11 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
- 		goto err_unregister_hook;
- 	}
- 
--	table->use++;
--
- 	return 0;
-+
- err_unregister_hook:
-+	nft_use_dec_restore(&table->use);
-+err_use:
- 	nf_tables_unregister_hook(net, table, chain);
- err_destroy_chain:
- 	nf_tables_chain_destroy(ctx);
-@@ -3841,9 +3846,6 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
- 			return -EINVAL;
- 		handle = nf_tables_alloc_handle(table);
- 
--		if (chain->use == UINT_MAX)
--			return -EOVERFLOW;
--
- 		if (nla[NFTA_RULE_POSITION]) {
- 			pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
- 			old_rule = __nft_rule_lookup(chain, pos_handle);
-@@ -3937,6 +3939,11 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
- 		}
- 	}
- 
-+	if (!nft_use_inc(&chain->use)) {
-+		err = -EMFILE;
-+		goto err_release_rule;
-+	}
-+
- 	if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
- 		err = nft_delrule(&ctx, old_rule);
- 		if (err < 0)
-@@ -3968,7 +3975,6 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
- 		}
- 	}
- 	kvfree(expr_info);
--	chain->use++;
- 
- 	if (flow)
- 		nft_trans_flow_rule(trans) = flow;
-@@ -3979,6 +3985,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
- 	return 0;
- 
- err_destroy_flow_rule:
-+	nft_use_dec_restore(&chain->use);
- 	if (flow)
- 		nft_flow_rule_destroy(flow);
- err_release_rule:
-@@ -5015,9 +5022,15 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
- 	alloc_size = sizeof(*set) + size + udlen;
- 	if (alloc_size < size || alloc_size > INT_MAX)
- 		return -ENOMEM;
-+
-+	if (!nft_use_inc(&table->use))
-+		return -EMFILE;
-+
- 	set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT);
--	if (!set)
--		return -ENOMEM;
-+	if (!set) {
-+		err = -ENOMEM;
-+		goto err_alloc;
-+	}
- 
- 	name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT);
- 	if (!name) {
-@@ -5075,7 +5088,7 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
- 		goto err_set_expr_alloc;
- 
- 	list_add_tail_rcu(&set->list, &table->sets);
--	table->use++;
-+
- 	return 0;
- 
- err_set_expr_alloc:
-@@ -5087,6 +5100,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
- 	kfree(set->name);
- err_set_name:
- 	kvfree(set);
-+err_alloc:
-+	nft_use_dec_restore(&table->use);
-+
- 	return err;
- }
- 
-@@ -5225,9 +5241,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
- 	struct nft_set_binding *i;
- 	struct nft_set_iter iter;
- 
--	if (set->use == UINT_MAX)
--		return -EOVERFLOW;
--
- 	if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
- 		return -EBUSY;
- 
-@@ -5255,10 +5268,12 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
- 			return iter.err;
- 	}
- bind:
-+	if (!nft_use_inc(&set->use))
-+		return -EMFILE;
-+
- 	binding->chain = ctx->chain;
- 	list_add_tail_rcu(&binding->list, &set->bindings);
- 	nft_set_trans_bind(ctx, set);
--	set->use++;
- 
- 	return 0;
- }
-@@ -5332,7 +5347,7 @@ void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
- 		nft_clear(ctx->net, set);
- 	}
- 
--	set->use++;
-+	nft_use_inc_restore(&set->use);
- }
- EXPORT_SYMBOL_GPL(nf_tables_activate_set);
- 
-@@ -5348,7 +5363,7 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
- 		else
- 			list_del_rcu(&binding->list);
- 
--		set->use--;
-+		nft_use_dec(&set->use);
- 		break;
- 	case NFT_TRANS_PREPARE:
- 		if (nft_set_is_anonymous(set)) {
-@@ -5357,7 +5372,7 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
- 
- 			nft_deactivate_next(ctx->net, set);
- 		}
--		set->use--;
-+		nft_use_dec(&set->use);
- 		return;
- 	case NFT_TRANS_ABORT:
- 	case NFT_TRANS_RELEASE:
-@@ -5365,7 +5380,7 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
- 		    set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
- 			nft_map_deactivate(ctx, set);
- 
--		set->use--;
-+		nft_use_dec(&set->use);
- 		fallthrough;
- 	default:
- 		nf_tables_unbind_set(ctx, set, binding,
-@@ -6134,7 +6149,7 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
- 		nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
- 
- 	if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
--		(*nft_set_ext_obj(ext))->use--;
-+		nft_use_dec(&(*nft_set_ext_obj(ext))->use);
- 	kfree(elem);
- }
- EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
-@@ -6636,8 +6651,16 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
- 				     set->objtype, genmask);
- 		if (IS_ERR(obj)) {
- 			err = PTR_ERR(obj);
-+			obj = NULL;
- 			goto err_parse_key_end;
- 		}
-+
-+		if (!nft_use_inc(&obj->use)) {
-+			err = -EMFILE;
-+			obj = NULL;
-+			goto err_parse_key_end;
-+		}
-+
- 		err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
- 		if (err < 0)
- 			goto err_parse_key_end;
-@@ -6706,10 +6729,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
- 	if (flags)
- 		*nft_set_ext_flags(ext) = flags;
- 
--	if (obj) {
-+	if (obj)
- 		*nft_set_ext_obj(ext) = obj;
--		obj->use++;
--	}
-+
- 	if (ulen > 0) {
- 		if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) {
- 			err = -EINVAL;
-@@ -6774,12 +6796,13 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
- 	kfree(trans);
- err_elem_free:
- 	nf_tables_set_elem_destroy(ctx, set, elem.priv);
--	if (obj)
--		obj->use--;
- err_parse_data:
- 	if (nla[NFTA_SET_ELEM_DATA] != NULL)
- 		nft_data_release(&elem.data.val, desc.type);
- err_parse_key_end:
-+	if (obj)
-+		nft_use_dec_restore(&obj->use);
-+
- 	nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
- err_parse_key:
- 	nft_data_release(&elem.key.val, NFT_DATA_VALUE);
-@@ -6859,7 +6882,7 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
- 		case NFT_JUMP:
- 		case NFT_GOTO:
- 			chain = data->verdict.chain;
--			chain->use++;
-+			nft_use_inc_restore(&chain->use);
- 			break;
- 		}
- 	}
-@@ -6874,7 +6897,7 @@ static void nft_setelem_data_activate(const struct net *net,
- 	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
- 		nft_data_hold(nft_set_ext_data(ext), set->dtype);
- 	if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
--		(*nft_set_ext_obj(ext))->use++;
-+		nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use);
- }
- 
- static void nft_setelem_data_deactivate(const struct net *net,
-@@ -6886,7 +6909,7 @@ static void nft_setelem_data_deactivate(const struct net *net,
- 	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
- 		nft_data_release(nft_set_ext_data(ext), set->dtype);
- 	if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
--		(*nft_set_ext_obj(ext))->use--;
-+		nft_use_dec(&(*nft_set_ext_obj(ext))->use);
- }
- 
- static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
-@@ -7429,9 +7452,14 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
- 
- 	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
- 
-+	if (!nft_use_inc(&table->use))
-+		return -EMFILE;
-+
- 	type = nft_obj_type_get(net, objtype);
--	if (IS_ERR(type))
--		return PTR_ERR(type);
-+	if (IS_ERR(type)) {
-+		err = PTR_ERR(type);
-+		goto err_type;
-+	}
- 
- 	obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
- 	if (IS_ERR(obj)) {
-@@ -7465,7 +7493,7 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
- 		goto err_obj_ht;
- 
- 	list_add_tail_rcu(&obj->list, &table->objects);
--	table->use++;
-+
- 	return 0;
- err_obj_ht:
- 	/* queued in transaction log */
-@@ -7481,6 +7509,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
- 	kfree(obj);
- err_init:
- 	module_put(type->owner);
-+err_type:
-+	nft_use_dec_restore(&table->use);
-+
- 	return err;
- }
- 
-@@ -7882,7 +7913,7 @@ void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
- 	case NFT_TRANS_PREPARE:
- 	case NFT_TRANS_ABORT:
- 	case NFT_TRANS_RELEASE:
--		flowtable->use--;
-+		nft_use_dec(&flowtable->use);
- 		fallthrough;
- 	default:
- 		return;
-@@ -8236,9 +8267,14 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
- 
- 	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
- 
-+	if (!nft_use_inc(&table->use))
-+		return -EMFILE;
-+
- 	flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT);
--	if (!flowtable)
--		return -ENOMEM;
-+	if (!flowtable) {
-+		err = -ENOMEM;
-+		goto flowtable_alloc;
-+	}
- 
- 	flowtable->table = table;
- 	flowtable->handle = nf_tables_alloc_handle(table);
-@@ -8293,7 +8329,6 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
- 		goto err5;
- 
- 	list_add_tail_rcu(&flowtable->list, &table->flowtables);
--	table->use++;
- 
- 	return 0;
- err5:
-@@ -8310,6 +8345,9 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
- 	kfree(flowtable->name);
- err1:
- 	kfree(flowtable);
-+flowtable_alloc:
-+	nft_use_dec_restore(&table->use);
-+
- 	return err;
- }
- 
-@@ -9680,7 +9718,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
- 				 */
- 				if (nft_set_is_anonymous(nft_trans_set(trans)) &&
- 				    !list_empty(&nft_trans_set(trans)->bindings))
--					trans->ctx.table->use--;
-+					nft_use_dec(&trans->ctx.table->use);
- 			}
- 			nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
- 					     NFT_MSG_NEWSET, GFP_KERNEL);
-@@ -9910,7 +9948,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 					nft_trans_destroy(trans);
- 					break;
- 				}
--				trans->ctx.table->use--;
-+				nft_use_dec_restore(&trans->ctx.table->use);
- 				nft_chain_del(trans->ctx.chain);
- 				nf_tables_unregister_hook(trans->ctx.net,
- 							  trans->ctx.table,
-@@ -9923,7 +9961,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				list_splice(&nft_trans_chain_hooks(trans),
- 					    &nft_trans_basechain(trans)->hook_list);
- 			} else {
--				trans->ctx.table->use++;
-+				nft_use_inc_restore(&trans->ctx.table->use);
- 				nft_clear(trans->ctx.net, trans->ctx.chain);
- 			}
- 			nft_trans_destroy(trans);
-@@ -9933,7 +9971,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				nft_trans_destroy(trans);
- 				break;
- 			}
--			trans->ctx.chain->use--;
-+			nft_use_dec_restore(&trans->ctx.chain->use);
- 			list_del_rcu(&nft_trans_rule(trans)->list);
- 			nft_rule_expr_deactivate(&trans->ctx,
- 						 nft_trans_rule(trans),
-@@ -9943,7 +9981,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 			break;
- 		case NFT_MSG_DELRULE:
- 		case NFT_MSG_DESTROYRULE:
--			trans->ctx.chain->use++;
-+			nft_use_inc_restore(&trans->ctx.chain->use);
- 			nft_clear(trans->ctx.net, nft_trans_rule(trans));
- 			nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
- 			if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
-@@ -9956,7 +9994,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				nft_trans_destroy(trans);
- 				break;
- 			}
--			trans->ctx.table->use--;
-+			nft_use_dec_restore(&trans->ctx.table->use);
- 			if (nft_trans_set_bound(trans)) {
- 				nft_trans_destroy(trans);
- 				break;
-@@ -9965,7 +10003,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 			break;
- 		case NFT_MSG_DELSET:
- 		case NFT_MSG_DESTROYSET:
--			trans->ctx.table->use++;
-+			nft_use_inc_restore(&trans->ctx.table->use);
- 			nft_clear(trans->ctx.net, nft_trans_set(trans));
- 			if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
- 				nft_map_activate(&trans->ctx, nft_trans_set(trans));
-@@ -10009,13 +10047,13 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans));
- 				nft_trans_destroy(trans);
- 			} else {
--				trans->ctx.table->use--;
-+				nft_use_dec_restore(&trans->ctx.table->use);
- 				nft_obj_del(nft_trans_obj(trans));
- 			}
- 			break;
- 		case NFT_MSG_DELOBJ:
- 		case NFT_MSG_DESTROYOBJ:
--			trans->ctx.table->use++;
-+			nft_use_inc_restore(&trans->ctx.table->use);
- 			nft_clear(trans->ctx.net, nft_trans_obj(trans));
- 			nft_trans_destroy(trans);
- 			break;
-@@ -10024,7 +10062,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				nft_unregister_flowtable_net_hooks(net,
- 						&nft_trans_flowtable_hooks(trans));
- 			} else {
--				trans->ctx.table->use--;
-+				nft_use_dec_restore(&trans->ctx.table->use);
- 				list_del_rcu(&nft_trans_flowtable(trans)->list);
- 				nft_unregister_flowtable_net_hooks(net,
- 						&nft_trans_flowtable(trans)->hook_list);
-@@ -10036,7 +10074,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
- 				list_splice(&nft_trans_flowtable_hooks(trans),
- 					    &nft_trans_flowtable(trans)->hook_list);
- 			} else {
--				trans->ctx.table->use++;
-+				nft_use_inc_restore(&trans->ctx.table->use);
- 				nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
- 			}
- 			nft_trans_destroy(trans);
-@@ -10486,8 +10524,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
- 		if (desc->flags & NFT_DATA_DESC_SETELEM &&
- 		    chain->flags & NFT_CHAIN_BINDING)
- 			return -EINVAL;
-+		if (!nft_use_inc(&chain->use))
-+			return -EMFILE;
- 
--		chain->use++;
- 		data->verdict.chain = chain;
- 		break;
- 	}
-@@ -10505,7 +10544,7 @@ static void nft_verdict_uninit(const struct nft_data *data)
- 	case NFT_JUMP:
- 	case NFT_GOTO:
- 		chain = data->verdict.chain;
--		chain->use--;
-+		nft_use_dec(&chain->use);
- 		break;
- 	}
- }
-@@ -10674,11 +10713,11 @@ int __nft_release_basechain(struct nft_ctx *ctx)
- 	nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
- 	list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
- 		list_del(&rule->list);
--		ctx->chain->use--;
-+		nft_use_dec(&ctx->chain->use);
- 		nf_tables_rule_release(ctx, rule);
- 	}
- 	nft_chain_del(ctx->chain);
--	ctx->table->use--;
-+	nft_use_dec(&ctx->table->use);
- 	nf_tables_chain_destroy(ctx);
- 
- 	return 0;
-@@ -10728,18 +10767,18 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
- 		ctx.chain = chain;
- 		list_for_each_entry_safe(rule, nr, &chain->rules, list) {
- 			list_del(&rule->list);
--			chain->use--;
-+			nft_use_dec(&chain->use);
- 			nf_tables_rule_release(&ctx, rule);
- 		}
- 	}
- 	list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
- 		list_del(&flowtable->list);
--		table->use--;
-+		nft_use_dec(&table->use);
- 		nf_tables_flowtable_destroy(flowtable);
- 	}
- 	list_for_each_entry_safe(set, ns, &table->sets, list) {
- 		list_del(&set->list);
--		table->use--;
-+		nft_use_dec(&table->use);
- 		if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
- 			nft_map_deactivate(&ctx, set);
- 
-@@ -10747,13 +10786,13 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
- 	}
- 	list_for_each_entry_safe(obj, ne, &table->objects, list) {
- 		nft_obj_del(obj);
--		table->use--;
-+		nft_use_dec(&table->use);
- 		nft_obj_destroy(&ctx, obj);
- 	}
- 	list_for_each_entry_safe(chain, nc, &table->chains, list) {
- 		ctx.chain = chain;
- 		nft_chain_del(chain);
--		table->use--;
-+		nft_use_dec(&table->use);
- 		nf_tables_chain_destroy(&ctx);
- 	}
- 	nf_tables_table_destroy(&ctx);
-diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
-index e860d8fe0e5e2..03159c6c6c4b6 100644
---- a/net/netfilter/nft_flow_offload.c
-+++ b/net/netfilter/nft_flow_offload.c
-@@ -404,8 +404,10 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx,
- 	if (IS_ERR(flowtable))
- 		return PTR_ERR(flowtable);
- 
-+	if (!nft_use_inc(&flowtable->use))
-+		return -EMFILE;
-+
- 	priv->flowtable = flowtable;
--	flowtable->use++;
- 
- 	return nf_ct_netns_get(ctx->net, ctx->family);
- }
-@@ -424,7 +426,7 @@ static void nft_flow_offload_activate(const struct nft_ctx *ctx,
- {
- 	struct nft_flow_offload *priv = nft_expr_priv(expr);
- 
--	priv->flowtable->use++;
-+	nft_use_inc_restore(&priv->flowtable->use);
- }
- 
- static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
-diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
-index 3d76ebfe8939b..407d7197f75bb 100644
---- a/net/netfilter/nft_immediate.c
-+++ b/net/netfilter/nft_immediate.c
-@@ -159,7 +159,7 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx,
- 			default:
- 				nft_chain_del(chain);
- 				chain->bound = false;
--				chain->table->use--;
-+				nft_use_dec(&chain->table->use);
- 				break;
- 			}
- 			break;
-@@ -198,7 +198,7 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
- 		 * let the transaction records release this chain and its rules.
- 		 */
- 		if (chain->bound) {
--			chain->use--;
-+			nft_use_dec(&chain->use);
- 			break;
- 		}
- 
-@@ -206,9 +206,9 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
- 		chain_ctx = *ctx;
- 		chain_ctx.chain = chain;
- 
--		chain->use--;
-+		nft_use_dec(&chain->use);
- 		list_for_each_entry_safe(rule, n, &chain->rules, list) {
--			chain->use--;
-+			nft_use_dec(&chain->use);
- 			list_del(&rule->list);
- 			nf_tables_rule_destroy(&chain_ctx, rule);
- 		}
-diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
-index a48dd5b5d45b1..509011b1ef597 100644
---- a/net/netfilter/nft_objref.c
-+++ b/net/netfilter/nft_objref.c
-@@ -41,8 +41,10 @@ static int nft_objref_init(const struct nft_ctx *ctx,
- 	if (IS_ERR(obj))
- 		return -ENOENT;
- 
-+	if (!nft_use_inc(&obj->use))
-+		return -EMFILE;
-+
- 	nft_objref_priv(expr) = obj;
--	obj->use++;
- 
- 	return 0;
- }
-@@ -72,7 +74,7 @@ static void nft_objref_deactivate(const struct nft_ctx *ctx,
- 	if (phase == NFT_TRANS_COMMIT)
- 		return;
- 
--	obj->use--;
-+	nft_use_dec(&obj->use);
- }
- 
- static void nft_objref_activate(const struct nft_ctx *ctx,
-@@ -80,7 +82,7 @@ static void nft_objref_activate(const struct nft_ctx *ctx,
- {
- 	struct nft_object *obj = nft_objref_priv(expr);
- 
--	obj->use++;
-+	nft_use_inc_restore(&obj->use);
- }
- 
- static const struct nft_expr_ops nft_objref_ops = {
--- 
-2.39.2
-
diff --git a/queue-6.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch b/queue-6.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
deleted file mode 100644
index e23079bc635..00000000000
--- a/queue-6.4/ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 7e2c2a25a65dd8ef5fe16a5b71182c1181093d7c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:09 +0000
-Subject: NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 ]
-
-A problem about ntb_hw_amd create debugfs failed is triggered with the
-following log given:
-
- [  618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0
- [  618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present!
-
-The reason is that amd_ntb_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_amd can never be created later.
-
- amd_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/amd/ntb_hw_amd.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
-index 04550b1f984c6..730f2103b91d1 100644
---- a/drivers/ntb/hw/amd/ntb_hw_amd.c
-+++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
-@@ -1338,12 +1338,17 @@ static struct pci_driver amd_ntb_pci_driver = {
- 
- static int __init amd_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&amd_ntb_pci_driver);
-+	ret = pci_register_driver(&amd_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(amd_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch b/queue-6.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
deleted file mode 100644
index 4f60eb29f71..00000000000
--- a/queue-6.4/ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 180209186f21d1030d210c3ead622260d62483cb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:01 +0000
-Subject: ntb: idt: Fix error handling in idt_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit c012968259b451dc4db407f2310fe131eaefd800 ]
-
-A problem about ntb_hw_idt create debugfs failed is triggered with the
-following log given:
-
- [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0
- [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present!
-
-The reason is that idt_pci_driver_init() returns pci_register_driver()
-directly without checking its return value, if pci_register_driver()
-failed, it returns without destroy the newly created debugfs, resulting
-the debugfs of ntb_hw_idt can never be created later.
-
- idt_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/idt/ntb_hw_idt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
-index 0ed6f809ff2ee..51799fccf8404 100644
---- a/drivers/ntb/hw/idt/ntb_hw_idt.c
-+++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
-@@ -2891,6 +2891,7 @@ static struct pci_driver idt_pci_driver = {
- 
- static int __init idt_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	/* Create the top DebugFS directory if the FS is initialized */
-@@ -2898,7 +2899,11 @@ static int __init idt_pci_driver_init(void)
- 		dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
- 	/* Register the NTB hardware driver to handle the PCI device */
--	return pci_register_driver(&idt_pci_driver);
-+	ret = pci_register_driver(&idt_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(dbgfs_topdir);
-+
-+	return ret;
- }
- module_init(idt_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch b/queue-6.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
deleted file mode 100644
index 2ef3e24bb70..00000000000
--- a/queue-6.4/ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 7b9f5f4f4ba4a81054b4298375bdf38a3828e4c0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 5 Nov 2022 09:43:22 +0000
-Subject: ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
-
-From: Yuan Can <yuancan@huawei.com>
-
-[ Upstream commit 4c3c796aca02883ad35bb117468938cc4022ca41 ]
-
-A problem about ntb_hw_intel create debugfs failed is triggered with the
-following log given:
-
- [  273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0
- [  273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present!
-
-The reason is that intel_ntb_pci_driver_init() returns
-pci_register_driver() directly without checking its return value, if
-pci_register_driver() failed, it returns without destroy the newly created
-debugfs, resulting the debugfs of ntb_hw_intel can never be created later.
-
- intel_ntb_pci_driver_init()
-   debugfs_create_dir() # create debugfs directory
-   pci_register_driver()
-     driver_register()
-       bus_add_driver()
-         priv = kzalloc(...) # OOM happened
-   # return without destroy debugfs directory
-
-Fix by removing debugfs when pci_register_driver() returns error.
-
-Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
-Signed-off-by: Yuan Can <yuancan@huawei.com>
-Acked-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/hw/intel/ntb_hw_gen1.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-index 84772013812bf..60a4ebc7bf35a 100644
---- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
-+++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
-@@ -2064,12 +2064,17 @@ static struct pci_driver intel_ntb_pci_driver = {
- 
- static int __init intel_ntb_pci_driver_init(void)
- {
-+	int ret;
- 	pr_info("%s %s\n", NTB_DESC, NTB_VER);
- 
- 	if (debugfs_initialized())
- 		debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
- 
--	return pci_register_driver(&intel_ntb_pci_driver);
-+	ret = pci_register_driver(&intel_ntb_pci_driver);
-+	if (ret)
-+		debugfs_remove_recursive(debugfs_dir);
-+
-+	return ret;
- }
- module_init(intel_ntb_pci_driver_init);
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch b/queue-6.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
deleted file mode 100644
index 64acc436822..00000000000
--- a/queue-6.4/ntb-ntb_tool-add-check-for-devm_kcalloc.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 2f49422fef2e45f2bafb822a8c585bf41de7b492 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 22 Nov 2022 11:32:44 +0800
-Subject: NTB: ntb_tool: Add check for devm_kcalloc
-
-From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-
-[ Upstream commit 2790143f09938776a3b4f69685b380bae8fd06c7 ]
-
-As the devm_kcalloc may return NULL pointer,
-it should be better to add check for the return
-value, as same as the others.
-
-Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
-Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
-Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/test/ntb_tool.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
-index 5ee0afa621a95..eeeb4b1c97d2c 100644
---- a/drivers/ntb/test/ntb_tool.c
-+++ b/drivers/ntb/test/ntb_tool.c
-@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
- 		tc->peers[pidx].outmws =
- 			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
- 				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
-+		if (tc->peers[pidx].outmws == NULL)
-+			return -ENOMEM;
- 
- 		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
- 			tc->peers[pidx].outmws[widx].pidx = pidx;
--- 
-2.39.2
-
diff --git a/queue-6.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch b/queue-6.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
deleted file mode 100644
index 403d266e9d0..00000000000
--- a/queue-6.4/ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 1be077967706a5225aa70459dc1f29e59f16d173 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 10 Nov 2022 23:19:17 +0800
-Subject: NTB: ntb_transport: fix possible memory leak while device_register()
- fails
-
-From: Yang Yingliang <yangyingliang@huawei.com>
-
-[ Upstream commit 8623ccbfc55d962e19a3537652803676ad7acb90 ]
-
-If device_register() returns error, the name allocated by
-dev_set_name() need be freed. As comment of device_register()
-says, it should use put_device() to give up the reference in
-the error path. So fix this by calling put_device(), then the
-name can be freed in kobject_cleanup(), and client_dev is freed
-in ntb_transport_client_release().
-
-Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
-Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
-Reviewed-by: Dave Jiang <dave.jiang@intel.com>
-Signed-off-by: Jon Mason <jdmason@kudzu.us>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ntb/ntb_transport.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
-index a9b97ebc71ac5..2abd2235bbcab 100644
---- a/drivers/ntb/ntb_transport.c
-+++ b/drivers/ntb/ntb_transport.c
-@@ -410,7 +410,7 @@ int ntb_transport_register_client_dev(char *device_name)
- 
- 		rc = device_register(dev);
- 		if (rc) {
--			kfree(client_dev);
-+			put_device(dev);
- 			goto err;
- 		}
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch b/queue-6.4/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
deleted file mode 100644
index 42ce8dcb216..00000000000
--- a/queue-6.4/nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 3b568c0eb266f839b2b2d7a1072cb7c86cb4e780 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 23 Jun 2023 18:08:05 +0530
-Subject: nvme: fix the NVME_ID_NS_NVM_STS_MASK definition
-
-From: Ankit Kumar <ankit.kumar@samsung.com>
-
-[ Upstream commit b938e6603660652dc3db66d3c915fbfed3bce21d ]
-
-As per NVMe command set specification 1.0c Storage tag size is 7 bits.
-
-Fixes: 4020aad85c67 ("nvme: add support for enhanced metadata")
-Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
-Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- include/linux/nvme.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/linux/nvme.h b/include/linux/nvme.h
-index 779507ac750b8..2819d6c3a6b5d 100644
---- a/include/linux/nvme.h
-+++ b/include/linux/nvme.h
-@@ -473,7 +473,7 @@ struct nvme_id_ns_nvm {
- };
- 
- enum {
--	NVME_ID_NS_NVM_STS_MASK		= 0x3f,
-+	NVME_ID_NS_NVM_STS_MASK		= 0x7f,
- 	NVME_ID_NS_NVM_GUARD_SHIFT	= 7,
- 	NVME_ID_NS_NVM_GUARD_MASK	= 0x3,
- };
--- 
-2.39.2
-
diff --git a/queue-6.4/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch b/queue-6.4/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
deleted file mode 100644
index 06d3b11e4bc..00000000000
--- a/queue-6.4/nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 65b3c7307116caccad741bb3f16b88a32e5423ac Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 13 Jul 2023 17:26:20 +0800
-Subject: nvme-pci: fix DMA direction of unmapping integrity data
-
-From: Ming Lei <ming.lei@redhat.com>
-
-[ Upstream commit b8f6446b6853768cb99e7c201bddce69ca60c15e ]
-
-DMA direction should be taken in dma_unmap_page() for unmapping integrity
-data.
-
-Fix this DMA direction, and reported in Guangwu's test.
-
-Reported-by: Guangwu Zhang <guazhang@redhat.com>
-Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data")
-Signed-off-by: Ming Lei <ming.lei@redhat.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Keith Busch <kbusch@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/nvme/host/pci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 492f319ebdf37..5b5303f0e2c20 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -968,7 +968,7 @@ static __always_inline void nvme_pci_unmap_rq(struct request *req)
- 	        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
- 
- 		dma_unmap_page(dev->dev, iod->meta_dma,
--			       rq_integrity_vec(req)->bv_len, rq_data_dir(req));
-+			       rq_integrity_vec(req)->bv_len, rq_dma_dir(req));
- 	}
- 
- 	if (blk_rq_nr_phys_segments(req))
--- 
-2.39.2
-
diff --git a/queue-6.4/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch b/queue-6.4/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
deleted file mode 100644
index f118880422a..00000000000
--- a/queue-6.4/octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From a369d12b3781cc00b48dea406925dc0c01d8c53e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 13:59:36 +0530
-Subject: octeontx2-af: Move validation of ptp pointer before its usage
-
-From: Sai Krishna <saikrishnag@marvell.com>
-
-[ Upstream commit 7709fbd4922c197efabda03660d93e48a3e80323 ]
-
-Moved PTP pointer validation before its use to avoid smatch warning.
-Also used kzalloc/kfree instead of devm_kzalloc/devm_kfree.
-
-Fixes: 2ef4e45d99b1 ("octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon")
-Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com>
-Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
-Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../net/ethernet/marvell/octeontx2/af/ptp.c   | 19 +++++++++----------
- .../net/ethernet/marvell/octeontx2/af/rvu.c   |  2 +-
- 2 files changed, 10 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/ptp.c b/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-index 3411e2e47d46b..0ee420a489fc4 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/ptp.c
-@@ -208,7 +208,7 @@ struct ptp *ptp_get(void)
- 	/* Check driver is bound to PTP block */
- 	if (!ptp)
- 		ptp = ERR_PTR(-EPROBE_DEFER);
--	else
-+	else if (!IS_ERR(ptp))
- 		pci_dev_get(ptp->pdev);
- 
- 	return ptp;
-@@ -388,11 +388,10 @@ static int ptp_extts_on(struct ptp *ptp, int on)
- static int ptp_probe(struct pci_dev *pdev,
- 		     const struct pci_device_id *ent)
- {
--	struct device *dev = &pdev->dev;
- 	struct ptp *ptp;
- 	int err;
- 
--	ptp = devm_kzalloc(dev, sizeof(*ptp), GFP_KERNEL);
-+	ptp = kzalloc(sizeof(*ptp), GFP_KERNEL);
- 	if (!ptp) {
- 		err = -ENOMEM;
- 		goto error;
-@@ -428,20 +427,19 @@ static int ptp_probe(struct pci_dev *pdev,
- 	return 0;
- 
- error_free:
--	devm_kfree(dev, ptp);
-+	kfree(ptp);
- 
- error:
- 	/* For `ptp_get()` we need to differentiate between the case
- 	 * when the core has not tried to probe this device and the case when
--	 * the probe failed.  In the later case we pretend that the
--	 * initialization was successful and keep the error in
-+	 * the probe failed.  In the later case we keep the error in
- 	 * `dev->driver_data`.
- 	 */
- 	pci_set_drvdata(pdev, ERR_PTR(err));
- 	if (!first_ptp_block)
- 		first_ptp_block = ERR_PTR(err);
- 
--	return 0;
-+	return err;
- }
- 
- static void ptp_remove(struct pci_dev *pdev)
-@@ -449,16 +447,17 @@ static void ptp_remove(struct pci_dev *pdev)
- 	struct ptp *ptp = pci_get_drvdata(pdev);
- 	u64 clock_cfg;
- 
--	if (cn10k_ptp_errata(ptp) && hrtimer_active(&ptp->hrtimer))
--		hrtimer_cancel(&ptp->hrtimer);
--
- 	if (IS_ERR_OR_NULL(ptp))
- 		return;
- 
-+	if (cn10k_ptp_errata(ptp) && hrtimer_active(&ptp->hrtimer))
-+		hrtimer_cancel(&ptp->hrtimer);
-+
- 	/* Disable PTP clock */
- 	clock_cfg = readq(ptp->reg_base + PTP_CLOCK_CFG);
- 	clock_cfg &= ~PTP_CLOCK_CFG_PTP_EN;
- 	writeq(clock_cfg, ptp->reg_base + PTP_CLOCK_CFG);
-+	kfree(ptp);
- }
- 
- static const struct pci_device_id ptp_id_table[] = {
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-index b26b013216933..73932e2755bca 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
-@@ -3253,7 +3253,7 @@ static int rvu_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 	rvu->ptp = ptp_get();
- 	if (IS_ERR(rvu->ptp)) {
- 		err = PTR_ERR(rvu->ptp);
--		if (err == -EPROBE_DEFER)
-+		if (err)
- 			goto err_release_regions;
- 		rvu->ptp = NULL;
- 	}
--- 
-2.39.2
-
diff --git a/queue-6.4/octeontx2-af-promisc-enable-disable-through-mbox.patch b/queue-6.4/octeontx2-af-promisc-enable-disable-through-mbox.patch
deleted file mode 100644
index 6a94e575127..00000000000
--- a/queue-6.4/octeontx2-af-promisc-enable-disable-through-mbox.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 0ab9b97172a9cb991254a7818274eb8296aacd12 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 09:57:05 +0530
-Subject: octeontx2-af: Promisc enable/disable through mbox
-
-From: Ratheesh Kannoth <rkannoth@marvell.com>
-
-[ Upstream commit af42088bdaf292060b8d8a00d8644ca7b2b3f2d1 ]
-
-In legacy silicon, promiscuous mode is only modified
-through CGX mbox messages. In CN10KB silicon, it is modified
-from CGX mbox and NIX. This breaks legacy application
-behaviour. Fix this by removing call from NIX.
-
-Fixes: d6c9784baf59 ("octeontx2-af: Invoke exact match functions if supported")
-Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
-Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
-Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/af/rvu_nix.c   | 11 ++-------
- .../marvell/octeontx2/af/rvu_npc_hash.c       | 23 +++++++++++++++++--
- 2 files changed, 23 insertions(+), 11 deletions(-)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-index f01d057ad025a..8cdf91a5bf44f 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
-@@ -3815,21 +3815,14 @@ int rvu_mbox_handler_nix_set_rx_mode(struct rvu *rvu, struct nix_rx_mode *req,
- 	}
- 
- 	/* install/uninstall promisc entry */
--	if (promisc) {
-+	if (promisc)
- 		rvu_npc_install_promisc_entry(rvu, pcifunc, nixlf,
- 					      pfvf->rx_chan_base,
- 					      pfvf->rx_chan_cnt);
--
--		if (rvu_npc_exact_has_match_table(rvu))
--			rvu_npc_exact_promisc_enable(rvu, pcifunc);
--	} else {
-+	else
- 		if (!nix_rx_multicast)
- 			rvu_npc_enable_promisc_entry(rvu, pcifunc, nixlf, false);
- 
--		if (rvu_npc_exact_has_match_table(rvu))
--			rvu_npc_exact_promisc_disable(rvu, pcifunc);
--	}
--
- 	return 0;
- }
- 
-diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-index 9f11c1e407373..6fe67f3a7f6f1 100644
---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c
-@@ -1164,8 +1164,10 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i
- {
- 	struct npc_exact_table *table;
- 	u16 *cnt, old_cnt;
-+	bool promisc;
- 
- 	table = rvu->hw->table;
-+	promisc = table->promisc_mode[drop_mcam_idx];
- 
- 	cnt = &table->cnt_cmd_rules[drop_mcam_idx];
- 	old_cnt = *cnt;
-@@ -1177,13 +1179,18 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i
- 
- 	*enable_or_disable_cam = false;
- 
--	/* If all rules are deleted, disable cam */
-+	if (promisc)
-+		goto done;
-+
-+	/* If all rules are deleted and not already in promisc mode;
-+	 * disable cam
-+	 */
- 	if (!*cnt && val < 0) {
- 		*enable_or_disable_cam = true;
- 		goto done;
- 	}
- 
--	/* If rule got added, enable cam */
-+	/* If rule got added and not already in promisc mode; enable cam */
- 	if (!old_cnt && val > 0) {
- 		*enable_or_disable_cam = true;
- 		goto done;
-@@ -1462,6 +1469,12 @@ int rvu_npc_exact_promisc_disable(struct rvu *rvu, u16 pcifunc)
- 	*promisc = false;
- 	mutex_unlock(&table->lock);
- 
-+	/* Enable drop rule */
-+	rvu_npc_enable_mcam_by_entry_index(rvu, drop_mcam_idx, NIX_INTF_RX,
-+					   true);
-+
-+	dev_dbg(rvu->dev, "%s: disabled  promisc mode (cgx=%d lmac=%d)\n",
-+		__func__, cgx_id, lmac_id);
- 	return 0;
- }
- 
-@@ -1503,6 +1516,12 @@ int rvu_npc_exact_promisc_enable(struct rvu *rvu, u16 pcifunc)
- 	*promisc = true;
- 	mutex_unlock(&table->lock);
- 
-+	/*  disable drop rule */
-+	rvu_npc_enable_mcam_by_entry_index(rvu, drop_mcam_idx, NIX_INTF_RX,
-+					   false);
-+
-+	dev_dbg(rvu->dev, "%s: Enabled promisc mode (cgx=%d lmac=%d)\n",
-+		__func__, cgx_id, lmac_id);
- 	return 0;
- }
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/octeontx2-pf-add-additional-check-for-mcam-rules.patch b/queue-6.4/octeontx2-pf-add-additional-check-for-mcam-rules.patch
deleted file mode 100644
index bf71c674b35..00000000000
--- a/queue-6.4/octeontx2-pf-add-additional-check-for-mcam-rules.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From ea03ebec26393aa8d6ce2220cad7c458bcde9935 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 16:00:27 +0530
-Subject: octeontx2-pf: Add additional check for MCAM rules
-
-From: Suman Ghosh <sumang@marvell.com>
-
-[ Upstream commit 8278ee2a2646b9acf747317895e47a640ba933c9 ]
-
-Due to hardware limitation, MCAM drop rule with
-ether_type == 802.1Q and vlan_id == 0 is not supported. Hence rejecting
-such rules.
-
-Fixes: dce677da57c0 ("octeontx2-pf: Add vlan-etype to ntuple filters")
-Signed-off-by: Suman Ghosh <sumang@marvell.com>
-Link: https://lore.kernel.org/r/20230710103027.2244139-1-sumang@marvell.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../ethernet/marvell/octeontx2/nic/otx2_flows.c   |  8 ++++++++
- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c  | 15 +++++++++++++++
- 2 files changed, 23 insertions(+)
-
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-index 10e11262d48a0..2d7713a1a1539 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
-@@ -872,6 +872,14 @@ static int otx2_prepare_flow_request(struct ethtool_rx_flow_spec *fsp,
- 				return -EINVAL;
- 
- 			vlan_etype = be16_to_cpu(fsp->h_ext.vlan_etype);
-+
-+			/* Drop rule with vlan_etype == 802.1Q
-+			 * and vlan_id == 0 is not supported
-+			 */
-+			if (vlan_etype == ETH_P_8021Q && !fsp->m_ext.vlan_tci &&
-+			    fsp->ring_cookie == RX_CLS_FLOW_DISC)
-+				return -EINVAL;
-+
- 			/* Only ETH_P_8021Q and ETH_P_802AD types supported */
- 			if (vlan_etype != ETH_P_8021Q &&
- 			    vlan_etype != ETH_P_8021AD)
-diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-index 8392f63e433fc..293bd3f29b077 100644
---- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
-@@ -604,6 +604,21 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,
- 			return -EOPNOTSUPP;
- 		}
- 
-+		if (!match.mask->vlan_id) {
-+			struct flow_action_entry *act;
-+			int i;
-+
-+			flow_action_for_each(i, act, &rule->action) {
-+				if (act->id == FLOW_ACTION_DROP) {
-+					netdev_err(nic->netdev,
-+						   "vlan tpid 0x%x with vlan_id %d is not supported for DROP rule.\n",
-+						   ntohs(match.key->vlan_tpid),
-+						   match.key->vlan_id);
-+					return -EOPNOTSUPP;
-+				}
-+			}
-+		}
-+
- 		if (match.mask->vlan_id ||
- 		    match.mask->vlan_dei ||
- 		    match.mask->vlan_priority) {
--- 
-2.39.2
-
diff --git a/queue-6.4/openrisc-union-fpcsr-and-oldmask-in-sigcontext-to-un.patch b/queue-6.4/openrisc-union-fpcsr-and-oldmask-in-sigcontext-to-un.patch
deleted file mode 100644
index cdd46db0c18..00000000000
--- a/queue-6.4/openrisc-union-fpcsr-and-oldmask-in-sigcontext-to-un.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 696ca48d335bae7910f2e1abae3078b90a63c6aa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 28 Jun 2023 17:54:40 +0100
-Subject: openrisc: Union fpcsr and oldmask in sigcontext to unbreak userspace
- ABI
-
-From: Stafford Horne <shorne@gmail.com>
-
-[ Upstream commit dceaafd668812115037fc13a1893d068b7b880f5 ]
-
-With commit 27267655c531 ("openrisc: Support floating point user api") I
-added an entry to the struct sigcontext which caused an unwanted change
-to the userspace ABI.
-
-To fix this we use the previously unused oldmask field space for the
-floating point fpcsr state.  We do this with a union to restore the ABI
-back to the pre kernel v6.4 ABI and keep API compatibility.
-
-This does mean if there is some code somewhere that is setting oldmask
-in an OpenRISC specific userspace sighandler it would end up setting the
-floating point register status, but I think it's unlikely as oldmask was
-never functional before.
-
-Fixes: 27267655c531 ("openrisc: Support floating point user api")
-Reported-by: Szabolcs Nagy <nsz@port70.net>
-Closes: https://lore.kernel.org/openrisc/20230626213840.GA1236108@port70.net/
-Signed-off-by: Stafford Horne <shorne@gmail.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/openrisc/include/uapi/asm/sigcontext.h | 6 ++++--
- arch/openrisc/kernel/signal.c               | 4 ++--
- 2 files changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/arch/openrisc/include/uapi/asm/sigcontext.h b/arch/openrisc/include/uapi/asm/sigcontext.h
-index ca585e4af6b8e..e7ffb58ff58fb 100644
---- a/arch/openrisc/include/uapi/asm/sigcontext.h
-+++ b/arch/openrisc/include/uapi/asm/sigcontext.h
-@@ -28,8 +28,10 @@
- 
- struct sigcontext {
- 	struct user_regs_struct regs;  /* needs to be first */
--	struct __or1k_fpu_state fpu;
--	unsigned long oldmask;
-+	union {
-+		unsigned long fpcsr;
-+		unsigned long oldmask;	/* unused */
-+	};
- };
- 
- #endif /* __ASM_OPENRISC_SIGCONTEXT_H */
-diff --git a/arch/openrisc/kernel/signal.c b/arch/openrisc/kernel/signal.c
-index 4664a18f0787d..2e7257a433ff4 100644
---- a/arch/openrisc/kernel/signal.c
-+++ b/arch/openrisc/kernel/signal.c
-@@ -50,7 +50,7 @@ static int restore_sigcontext(struct pt_regs *regs,
- 	err |= __copy_from_user(regs, sc->regs.gpr, 32 * sizeof(unsigned long));
- 	err |= __copy_from_user(&regs->pc, &sc->regs.pc, sizeof(unsigned long));
- 	err |= __copy_from_user(&regs->sr, &sc->regs.sr, sizeof(unsigned long));
--	err |= __copy_from_user(&regs->fpcsr, &sc->fpu.fpcsr, sizeof(unsigned long));
-+	err |= __copy_from_user(&regs->fpcsr, &sc->fpcsr, sizeof(unsigned long));
- 
- 	/* make sure the SM-bit is cleared so user-mode cannot fool us */
- 	regs->sr &= ~SPR_SR_SM;
-@@ -113,7 +113,7 @@ static int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
- 	err |= __copy_to_user(sc->regs.gpr, regs, 32 * sizeof(unsigned long));
- 	err |= __copy_to_user(&sc->regs.pc, &regs->pc, sizeof(unsigned long));
- 	err |= __copy_to_user(&sc->regs.sr, &regs->sr, sizeof(unsigned long));
--	err |= __copy_to_user(&sc->fpu.fpcsr, &regs->fpcsr, sizeof(unsigned long));
-+	err |= __copy_to_user(&sc->fpcsr, &regs->fpcsr, sizeof(unsigned long));
- 
- 	return err;
- }
--- 
-2.39.2
-
diff --git a/queue-6.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch b/queue-6.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
deleted file mode 100644
index 29b7fc1fa7e..00000000000
--- a/queue-6.4/platform-x86-wmi-break-possible-infinite-loop-when-p.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From fe769e2ae656339ebc5ea9b89b775402633f4d2d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 18:11:54 +0300
-Subject: platform/x86: wmi: Break possible infinite loop when parsing GUID
-
-From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-
-[ Upstream commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 ]
-
-The while-loop may break on one of the two conditions, either ID string
-is empty or GUID matches. The second one, may never be reached if the
-parsed string is not correct GUID. In such a case the loop will never
-advance to check the next ID.
-
-Break possible infinite loop by factoring out guid_parse_and_compare()
-helper which may be moved to the generic header for everyone later on
-and preventing from similar mistake in the future.
-
-Interestingly that firstly it appeared when WMI was turned into a bus
-driver, but later when duplicated GUIDs were checked, the while-loop
-has been replaced by for-loop and hence no mistake made again.
-
-Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id")
-Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
-Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com
-Tested-by: Armin Wolf <W_Armin@gmx.de>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/platform/x86/wmi.c | 22 ++++++++++++----------
- 1 file changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
-index d81319a502efc..e1a3bfeeed529 100644
---- a/drivers/platform/x86/wmi.c
-+++ b/drivers/platform/x86/wmi.c
-@@ -136,6 +136,16 @@ static acpi_status find_guid(const char *guid_string, struct wmi_block **out)
- 	return AE_NOT_FOUND;
- }
- 
-+static bool guid_parse_and_compare(const char *string, const guid_t *guid)
-+{
-+	guid_t guid_input;
-+
-+	if (guid_parse(string, &guid_input))
-+		return false;
-+
-+	return guid_equal(&guid_input, guid);
-+}
-+
- static const void *find_guid_context(struct wmi_block *wblock,
- 				     struct wmi_driver *wdriver)
- {
-@@ -146,11 +156,7 @@ static const void *find_guid_context(struct wmi_block *wblock,
- 		return NULL;
- 
- 	while (*id->guid_string) {
--		guid_t guid_input;
--
--		if (guid_parse(id->guid_string, &guid_input))
--			continue;
--		if (guid_equal(&wblock->gblock.guid, &guid_input))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return id->context;
- 		id++;
- 	}
-@@ -827,11 +833,7 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
- 		return 0;
- 
- 	while (*id->guid_string) {
--		guid_t driver_guid;
--
--		if (WARN_ON(guid_parse(id->guid_string, &driver_guid)))
--			continue;
--		if (guid_equal(&driver_guid, &wblock->gblock.guid))
-+		if (guid_parse_and_compare(id->guid_string, &wblock->gblock.guid))
- 			return 1;
- 
- 		id++;
--- 
-2.39.2
-
diff --git a/queue-6.4/riscv-bpf-fix-inconsistent-jit-image-generation.patch b/queue-6.4/riscv-bpf-fix-inconsistent-jit-image-generation.patch
deleted file mode 100644
index 1a0e56b9f64..00000000000
--- a/queue-6.4/riscv-bpf-fix-inconsistent-jit-image-generation.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From 7c62c3b0f47ff2d49c0b22727b5753f5b0e98584 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 09:41:31 +0200
-Subject: riscv, bpf: Fix inconsistent JIT image generation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Björn Töpel <bjorn@rivosinc.com>
-
-[ Upstream commit c56fb2aab23505bb7160d06097c8de100b82b851 ]
-
-In order to generate the prologue and epilogue, the BPF JIT needs to
-know which registers that are clobbered. Therefore, the during
-pre-final passes, the prologue is generated after the body of the
-program body-prologue-epilogue. Then, in the final pass, a proper
-prologue-body-epilogue JITted image is generated.
-
-This scheme has worked most of the time. However, for some large
-programs with many jumps, e.g. the test_kmod.sh BPF selftest with
-hardening enabled (blinding constants), this has shown to be
-incorrect. For the final pass, when the proper prologue-body-epilogue
-is generated, the image has not converged. This will lead to that the
-final image will have incorrect jump offsets. The following is an
-excerpt from an incorrect image:
-
-  | ...
-  |     3b8:       00c50663                beq     a0,a2,3c4 <.text+0x3c4>
-  |     3bc:       0020e317                auipc   t1,0x20e
-  |     3c0:       49630067                jalr    zero,1174(t1) # 20e852 <.text+0x20e852>
-  | ...
-  |  20e84c:       8796                    c.mv    a5,t0
-  |  20e84e:       6422                    c.ldsp  s0,8(sp)    # Epilogue start
-  |  20e850:       6141                    c.addi16sp      sp,16
-  |  20e852:       853e                    c.mv    a0,a5       # Incorrect jump target
-  |  20e854:       8082                    c.jr    ra
-
-The image has shrunk, and the epilogue offset is incorrect in the
-final pass.
-
-Correct the problem by always generating proper prologue-body-epilogue
-outputs, which means that the first pass will only generate the body
-to track what registers that are touched.
-
-Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
-Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Link: https://lore.kernel.org/bpf/20230710074131.19596-1-bjorn@kernel.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h      |  6 +++---
- arch/riscv/net/bpf_jit_core.c | 19 +++++++++++++------
- 2 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index bf9802a63061d..2717f54904287 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -69,7 +69,7 @@ struct rv_jit_context {
- 	struct bpf_prog *prog;
- 	u16 *insns;		/* RV insns */
- 	int ninsns;
--	int body_len;
-+	int prologue_len;
- 	int epilogue_offset;
- 	int *offset;		/* BPF to RV */
- 	int nexentries;
-@@ -216,8 +216,8 @@ static inline int rv_offset(int insn, int off, struct rv_jit_context *ctx)
- 	int from, to;
- 
- 	off++; /* BPF branch is from PC+1, RV is from PC */
--	from = (insn > 0) ? ctx->offset[insn - 1] : 0;
--	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : 0;
-+	from = (insn > 0) ? ctx->offset[insn - 1] : ctx->prologue_len;
-+	to = (insn + off > 0) ? ctx->offset[insn + off - 1] : ctx->prologue_len;
- 	return ninsns_rvoff(to - from);
- }
- 
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 737baf8715da7..7a26a3e1c73cf 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -44,7 +44,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	unsigned int prog_size = 0, extable_size = 0;
- 	bool tmp_blinded = false, extra_pass = false;
- 	struct bpf_prog *tmp, *orig_prog = prog;
--	int pass = 0, prev_ninsns = 0, prologue_len, i;
-+	int pass = 0, prev_ninsns = 0, i;
- 	struct rv_jit_data *jit_data;
- 	struct rv_jit_context *ctx;
- 
-@@ -83,6 +83,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 		prog = orig_prog;
- 		goto out_offset;
- 	}
-+
-+	if (build_body(ctx, extra_pass, NULL)) {
-+		prog = orig_prog;
-+		goto out_offset;
-+	}
-+
- 	for (i = 0; i < prog->len; i++) {
- 		prev_ninsns += 32;
- 		ctx->offset[i] = prev_ninsns;
-@@ -91,12 +97,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
- 		pass++;
- 		ctx->ninsns = 0;
-+
-+		bpf_jit_build_prologue(ctx);
-+		ctx->prologue_len = ctx->ninsns;
-+
- 		if (build_body(ctx, extra_pass, ctx->offset)) {
- 			prog = orig_prog;
- 			goto out_offset;
- 		}
--		ctx->body_len = ctx->ninsns;
--		bpf_jit_build_prologue(ctx);
-+
- 		ctx->epilogue_offset = ctx->ninsns;
- 		bpf_jit_build_epilogue(ctx);
- 
-@@ -162,10 +171,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- 
- 	if (!prog->is_func || extra_pass) {
- 		bpf_jit_binary_lock_ro(jit_data->header);
--		prologue_len = ctx->epilogue_offset - ctx->body_len;
- 		for (i = 0; i < prog->len; i++)
--			ctx->offset[i] = ninsns_rvoff(prologue_len +
--						      ctx->offset[i]);
-+			ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- 		bpf_prog_fill_jited_linfo(prog, ctx->offset);
- out_offset:
- 		kfree(ctx->offset);
--- 
-2.39.2
-
diff --git a/queue-6.4/riscv-mm-fix-truncation-warning-on-rv32.patch b/queue-6.4/riscv-mm-fix-truncation-warning-on-rv32.patch
deleted file mode 100644
index 7075d9bf6bc..00000000000
--- a/queue-6.4/riscv-mm-fix-truncation-warning-on-rv32.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 0711941654500c97465899b2d6b84b346d829f42 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 10 Jul 2023 01:10:36 +0800
-Subject: riscv: mm: fix truncation warning on RV32
-
-From: Jisheng Zhang <jszhang@kernel.org>
-
-[ Upstream commit b690e266dae2f85f4dfea21fa6a05e3500a51054 ]
-
-lkp reports below sparse warning when building for RV32:
-arch/riscv/mm/init.c:1204:48: sparse: warning: cast truncates bits from
-constant value (100000000 becomes 0)
-
-IMO, the reason we didn't see this truncates bug in real world is "0"
-means MEMBLOCK_ALLOC_ACCESSIBLE in memblock and there's no RV32 HW
-with more than 4GB memory.
-
-Fix it anyway to make sparse happy.
-
-Fixes: decf89f86ecd ("riscv: try to allocate crashkern region from 32bit addressible memory")
-Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
-Reported-by: kernel test robot <lkp@intel.com>
-Closes: https://lore.kernel.org/oe-kbuild-all/202306080034.SLiCiOMn-lkp@intel.com/
-Link: https://lore.kernel.org/r/20230709171036.1906-1-jszhang@kernel.org
-Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/mm/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
-index 1306149aad57a..93e7bb9f67fd4 100644
---- a/arch/riscv/mm/init.c
-+++ b/arch/riscv/mm/init.c
-@@ -1346,7 +1346,7 @@ static void __init reserve_crashkernel(void)
- 	 */
- 	crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
- 					       search_start,
--					       min(search_end, (unsigned long) SZ_4G));
-+					       min(search_end, (unsigned long)(SZ_4G - 1)));
- 	if (crash_base == 0) {
- 		/* Try again without restricting region to 32bit addressible memory */
- 		crash_base = memblock_phys_alloc_range(crash_size, PMD_SIZE,
--- 
-2.39.2
-
diff --git a/queue-6.4/s390-ism-do-not-unregister-clients-with-registered-d.patch b/queue-6.4/s390-ism-do-not-unregister-clients-with-registered-d.patch
deleted file mode 100644
index e584f41f927..00000000000
--- a/queue-6.4/s390-ism-do-not-unregister-clients-with-registered-d.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 8c9160ca105b8a4c5e9cc7c58c474696aba788c3 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 12:56:22 +0200
-Subject: s390/ism: Do not unregister clients with registered DMBs
-
-From: Niklas Schnelle <schnelle@linux.ibm.com>
-
-[ Upstream commit 266deeea34ffd28c6b6a63edf2af9b5a07161c24 ]
-
-When ism_unregister_client() is called but the client still has DMBs
-registered it returns -EBUSY and prints an error. This only happens
-after the client has already been unregistered however. This is
-unexpected as the unregister claims to have failed. Furthermore as this
-implies a client bug a WARN() is more appropriate. Thus move the
-deregistration after the check and use WARN().
-
-Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
-Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/s390/net/ism_drv.c | 23 +++++++++++++----------
- 1 file changed, 13 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
-index d65571b3d5cad..6db5cf7e901f9 100644
---- a/drivers/s390/net/ism_drv.c
-+++ b/drivers/s390/net/ism_drv.c
-@@ -96,29 +96,32 @@ int ism_unregister_client(struct ism_client *client)
- 	int rc = 0;
- 
- 	mutex_lock(&ism_dev_list.mutex);
--	mutex_lock(&clients_lock);
--	clients[client->id] = NULL;
--	if (client->id + 1 == max_client)
--		max_client--;
--	mutex_unlock(&clients_lock);
- 	list_for_each_entry(ism, &ism_dev_list.list, list) {
- 		spin_lock_irqsave(&ism->lock, flags);
- 		/* Stop forwarding IRQs and events */
- 		ism->subs[client->id] = NULL;
- 		for (int i = 0; i < ISM_NR_DMBS; ++i) {
- 			if (ism->sba_client_arr[i] == client->id) {
--				pr_err("%s: attempt to unregister client '%s'"
--				       "with registered dmb(s)\n", __func__,
--				       client->name);
-+				WARN(1, "%s: attempt to unregister '%s' with registered dmb(s)\n",
-+				     __func__, client->name);
- 				rc = -EBUSY;
--				goto out;
-+				goto err_reg_dmb;
- 			}
- 		}
- 		spin_unlock_irqrestore(&ism->lock, flags);
- 	}
--out:
- 	mutex_unlock(&ism_dev_list.mutex);
- 
-+	mutex_lock(&clients_lock);
-+	clients[client->id] = NULL;
-+	if (client->id + 1 == max_client)
-+		max_client--;
-+	mutex_unlock(&clients_lock);
-+	return rc;
-+
-+err_reg_dmb:
-+	spin_unlock_irqrestore(&ism->lock, flags);
-+	mutex_unlock(&ism_dev_list.mutex);
- 	return rc;
- }
- EXPORT_SYMBOL_GPL(ism_unregister_client);
--- 
-2.39.2
-
diff --git a/queue-6.4/s390-ism-fix-and-simplify-add-remove-callback-handli.patch b/queue-6.4/s390-ism-fix-and-simplify-add-remove-callback-handli.patch
deleted file mode 100644
index 9c19dccb173..00000000000
--- a/queue-6.4/s390-ism-fix-and-simplify-add-remove-callback-handli.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From 82e901cb9437e020d30429e55f1be39ce1457fc7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 12:56:21 +0200
-Subject: s390/ism: Fix and simplify add()/remove() callback handling
-
-From: Niklas Schnelle <schnelle@linux.ibm.com>
-
-[ Upstream commit 76631ffa2fd2d45bae5ad717eef716b94144e0e7 ]
-
-Previously the clients_lock was protecting the clients array against
-concurrent addition/removal of clients but was also accessed from IRQ
-context. This meant that it had to be a spinlock and that the add() and
-remove() callbacks in which clients need to do allocation and take
-mutexes can't be called under the clients_lock. To work around this these
-callbacks were moved to workqueues. This not only introduced significant
-complexity but is also subtly broken in at least one way.
-
-In ism_dev_init() and ism_dev_exit() clients[i]->tgt_ism is used to
-communicate the added/removed ISM device to the work function. While
-write access to client[i]->tgt_ism is protected by the clients_lock and
-the code waits that there is no pending add/remove work before and after
-setting clients[i]->tgt_ism this is not enough. The problem is that the
-wait happens based on per ISM device counters. Thus a concurrent
-ism_dev_init()/ism_dev_exit() for a different ISM device may overwrite
-a clients[i]->tgt_ism between unlocking the clients_lock and the
-subsequent wait for the work to finnish.
-
-Thankfully with the clients_lock no longer held in IRQ context it can be
-turned into a mutex which can be held during the calls to add()/remove()
-completely removing the need for the workqueues and the associated
-broken housekeeping including the per ISM device counters and the
-clients[i]->tgt_ism.
-
-Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
-Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/s390/net/ism_drv.c | 86 +++++++++++---------------------------
- include/linux/ism.h        |  6 ---
- 2 files changed, 24 insertions(+), 68 deletions(-)
-
-diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
-index 216eb4b386286..d65571b3d5cad 100644
---- a/drivers/s390/net/ism_drv.c
-+++ b/drivers/s390/net/ism_drv.c
-@@ -36,7 +36,7 @@ static const struct smcd_ops ism_ops;
- static struct ism_client *clients[MAX_CLIENTS];	/* use an array rather than */
- 						/* a list for fast mapping  */
- static u8 max_client;
--static DEFINE_SPINLOCK(clients_lock);
-+static DEFINE_MUTEX(clients_lock);
- struct ism_dev_list {
- 	struct list_head list;
- 	struct mutex mutex; /* protects ism device list */
-@@ -59,11 +59,10 @@ static void ism_setup_forwarding(struct ism_client *client, struct ism_dev *ism)
- int ism_register_client(struct ism_client *client)
- {
- 	struct ism_dev *ism;
--	unsigned long flags;
- 	int i, rc = -ENOSPC;
- 
- 	mutex_lock(&ism_dev_list.mutex);
--	spin_lock_irqsave(&clients_lock, flags);
-+	mutex_lock(&clients_lock);
- 	for (i = 0; i < MAX_CLIENTS; ++i) {
- 		if (!clients[i]) {
- 			clients[i] = client;
-@@ -74,7 +73,8 @@ int ism_register_client(struct ism_client *client)
- 			break;
- 		}
- 	}
--	spin_unlock_irqrestore(&clients_lock, flags);
-+	mutex_unlock(&clients_lock);
-+
- 	if (i < MAX_CLIENTS) {
- 		/* initialize with all devices that we got so far */
- 		list_for_each_entry(ism, &ism_dev_list.list, list) {
-@@ -96,11 +96,11 @@ int ism_unregister_client(struct ism_client *client)
- 	int rc = 0;
- 
- 	mutex_lock(&ism_dev_list.mutex);
--	spin_lock_irqsave(&clients_lock, flags);
-+	mutex_lock(&clients_lock);
- 	clients[client->id] = NULL;
- 	if (client->id + 1 == max_client)
- 		max_client--;
--	spin_unlock_irqrestore(&clients_lock, flags);
-+	mutex_unlock(&clients_lock);
- 	list_for_each_entry(ism, &ism_dev_list.list, list) {
- 		spin_lock_irqsave(&ism->lock, flags);
- 		/* Stop forwarding IRQs and events */
-@@ -571,21 +571,9 @@ static u64 ism_get_local_gid(struct ism_dev *ism)
- 	return ism->local_gid;
- }
- 
--static void ism_dev_add_work_func(struct work_struct *work)
--{
--	struct ism_client *client = container_of(work, struct ism_client,
--						 add_work);
--
--	client->add(client->tgt_ism);
--	ism_setup_forwarding(client, client->tgt_ism);
--	atomic_dec(&client->tgt_ism->add_dev_cnt);
--	wake_up(&client->tgt_ism->waitq);
--}
--
- static int ism_dev_init(struct ism_dev *ism)
- {
- 	struct pci_dev *pdev = ism->pdev;
--	unsigned long flags;
- 	int i, ret;
- 
- 	ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI);
-@@ -618,25 +606,16 @@ static int ism_dev_init(struct ism_dev *ism)
- 		/* hardware is V2 capable */
- 		ism_create_system_eid();
- 
--	init_waitqueue_head(&ism->waitq);
--	atomic_set(&ism->free_clients_cnt, 0);
--	atomic_set(&ism->add_dev_cnt, 0);
--
--	wait_event(ism->waitq, !atomic_read(&ism->add_dev_cnt));
--	spin_lock_irqsave(&clients_lock, flags);
--	for (i = 0; i < max_client; ++i)
-+	mutex_lock(&ism_dev_list.mutex);
-+	mutex_lock(&clients_lock);
-+	for (i = 0; i < max_client; ++i) {
- 		if (clients[i]) {
--			INIT_WORK(&clients[i]->add_work,
--				  ism_dev_add_work_func);
--			clients[i]->tgt_ism = ism;
--			atomic_inc(&ism->add_dev_cnt);
--			schedule_work(&clients[i]->add_work);
-+			clients[i]->add(ism);
-+			ism_setup_forwarding(clients[i], ism);
- 		}
--	spin_unlock_irqrestore(&clients_lock, flags);
--
--	wait_event(ism->waitq, !atomic_read(&ism->add_dev_cnt));
-+	}
-+	mutex_unlock(&clients_lock);
- 
--	mutex_lock(&ism_dev_list.mutex);
- 	list_add(&ism->list, &ism_dev_list.list);
- 	mutex_unlock(&ism_dev_list.mutex);
- 
-@@ -711,40 +690,24 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 	return ret;
- }
- 
--static void ism_dev_remove_work_func(struct work_struct *work)
--{
--	struct ism_client *client = container_of(work, struct ism_client,
--						 remove_work);
--	unsigned long flags;
--
--	spin_lock_irqsave(&client->tgt_ism->lock, flags);
--	client->tgt_ism->subs[client->id] = NULL;
--	spin_unlock_irqrestore(&client->tgt_ism->lock, flags);
--	client->remove(client->tgt_ism);
--	atomic_dec(&client->tgt_ism->free_clients_cnt);
--	wake_up(&client->tgt_ism->waitq);
--}
--
--/* Callers must hold ism_dev_list.mutex */
- static void ism_dev_exit(struct ism_dev *ism)
- {
- 	struct pci_dev *pdev = ism->pdev;
- 	unsigned long flags;
- 	int i;
- 
--	wait_event(ism->waitq, !atomic_read(&ism->free_clients_cnt));
--	spin_lock_irqsave(&clients_lock, flags);
-+	spin_lock_irqsave(&ism->lock, flags);
- 	for (i = 0; i < max_client; ++i)
--		if (clients[i]) {
--			INIT_WORK(&clients[i]->remove_work,
--				  ism_dev_remove_work_func);
--			clients[i]->tgt_ism = ism;
--			atomic_inc(&ism->free_clients_cnt);
--			schedule_work(&clients[i]->remove_work);
--		}
--	spin_unlock_irqrestore(&clients_lock, flags);
-+		ism->subs[i] = NULL;
-+	spin_unlock_irqrestore(&ism->lock, flags);
- 
--	wait_event(ism->waitq, !atomic_read(&ism->free_clients_cnt));
-+	mutex_lock(&ism_dev_list.mutex);
-+	mutex_lock(&clients_lock);
-+	for (i = 0; i < max_client; ++i) {
-+		if (clients[i])
-+			clients[i]->remove(ism);
-+	}
-+	mutex_unlock(&clients_lock);
- 
- 	if (SYSTEM_EID.serial_number[0] != '0' ||
- 	    SYSTEM_EID.type[0] != '0')
-@@ -755,15 +718,14 @@ static void ism_dev_exit(struct ism_dev *ism)
- 	kfree(ism->sba_client_arr);
- 	pci_free_irq_vectors(pdev);
- 	list_del_init(&ism->list);
-+	mutex_unlock(&ism_dev_list.mutex);
- }
- 
- static void ism_remove(struct pci_dev *pdev)
- {
- 	struct ism_dev *ism = dev_get_drvdata(&pdev->dev);
- 
--	mutex_lock(&ism_dev_list.mutex);
- 	ism_dev_exit(ism);
--	mutex_unlock(&ism_dev_list.mutex);
- 
- 	pci_release_mem_regions(pdev);
- 	pci_disable_device(pdev);
-diff --git a/include/linux/ism.h b/include/linux/ism.h
-index 5160d47e5ea9e..9a4c204df3da1 100644
---- a/include/linux/ism.h
-+++ b/include/linux/ism.h
-@@ -45,9 +45,6 @@ struct ism_dev {
- 	int ieq_idx;
- 
- 	struct ism_client *subs[MAX_CLIENTS];
--	atomic_t free_clients_cnt;
--	atomic_t add_dev_cnt;
--	wait_queue_head_t waitq;
- };
- 
- struct ism_event {
-@@ -69,9 +66,6 @@ struct ism_client {
- 	 */
- 	void (*handle_irq)(struct ism_dev *dev, unsigned int bit, u16 dmbemask);
- 	/* Private area - don't touch! */
--	struct work_struct remove_work;
--	struct work_struct add_work;
--	struct ism_dev *tgt_ism;
- 	u8 id;
- };
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/s390-ism-fix-locking-for-forwarding-of-irqs-and-even.patch b/queue-6.4/s390-ism-fix-locking-for-forwarding-of-irqs-and-even.patch
deleted file mode 100644
index ac08f139fab..00000000000
--- a/queue-6.4/s390-ism-fix-locking-for-forwarding-of-irqs-and-even.patch
+++ /dev/null
@@ -1,209 +0,0 @@
-From 120b472bc2a8e8531d07e4cbb70b758a9ee6a46c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 7 Jul 2023 12:56:20 +0200
-Subject: s390/ism: Fix locking for forwarding of IRQs and events to clients
-
-From: Niklas Schnelle <schnelle@linux.ibm.com>
-
-[ Upstream commit 6b5c13b591d753c6022fbd12f8c0c0a9a07fc065 ]
-
-The clients array references all registered clients and is protected by
-the clients_lock. Besides its use as general list of clients the clients
-array is accessed in ism_handle_irq() to forward ISM device events to
-clients.
-
-While the clients_lock is taken in the IRQ handler when calling
-handle_event() it is however incorrectly not held during the
-client->handle_irq() call and for the preceding clients[] access leaving
-it unprotected against concurrent client (un-)registration.
-
-Furthermore the accesses to ism->sba_client_arr[] in ism_register_dmb()
-and ism_unregister_dmb() are not protected by any lock. This is
-especially problematic as the client ID from the ism->sba_client_arr[]
-is not checked against NO_CLIENT and neither is the client pointer
-checked.
-
-Instead of expanding the use of the clients_lock further add a separate
-array in struct ism_dev which references clients subscribed to the
-device's events and IRQs. This array is protected by ism->lock which is
-already taken in ism_handle_irq() and can be taken outside the IRQ
-handler when adding/removing subscribers or the accessing
-ism->sba_client_arr[]. This also means that the clients_lock is no
-longer taken in IRQ context.
-
-Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
-Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
-Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/s390/net/ism_drv.c | 44 +++++++++++++++++++++++++++++++-------
- include/linux/ism.h        |  1 +
- 2 files changed, 37 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
-index c2096e4bba319..216eb4b386286 100644
---- a/drivers/s390/net/ism_drv.c
-+++ b/drivers/s390/net/ism_drv.c
-@@ -47,6 +47,15 @@ static struct ism_dev_list ism_dev_list = {
- 	.mutex = __MUTEX_INITIALIZER(ism_dev_list.mutex),
- };
- 
-+static void ism_setup_forwarding(struct ism_client *client, struct ism_dev *ism)
-+{
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&ism->lock, flags);
-+	ism->subs[client->id] = client;
-+	spin_unlock_irqrestore(&ism->lock, flags);
-+}
-+
- int ism_register_client(struct ism_client *client)
- {
- 	struct ism_dev *ism;
-@@ -71,6 +80,7 @@ int ism_register_client(struct ism_client *client)
- 		list_for_each_entry(ism, &ism_dev_list.list, list) {
- 			ism->priv[i] = NULL;
- 			client->add(ism);
-+			ism_setup_forwarding(client, ism);
- 		}
- 	}
- 	mutex_unlock(&ism_dev_list.mutex);
-@@ -92,6 +102,9 @@ int ism_unregister_client(struct ism_client *client)
- 		max_client--;
- 	spin_unlock_irqrestore(&clients_lock, flags);
- 	list_for_each_entry(ism, &ism_dev_list.list, list) {
-+		spin_lock_irqsave(&ism->lock, flags);
-+		/* Stop forwarding IRQs and events */
-+		ism->subs[client->id] = NULL;
- 		for (int i = 0; i < ISM_NR_DMBS; ++i) {
- 			if (ism->sba_client_arr[i] == client->id) {
- 				pr_err("%s: attempt to unregister client '%s'"
-@@ -101,6 +114,7 @@ int ism_unregister_client(struct ism_client *client)
- 				goto out;
- 			}
- 		}
-+		spin_unlock_irqrestore(&ism->lock, flags);
- 	}
- out:
- 	mutex_unlock(&ism_dev_list.mutex);
-@@ -328,6 +342,7 @@ int ism_register_dmb(struct ism_dev *ism, struct ism_dmb *dmb,
- 		     struct ism_client *client)
- {
- 	union ism_reg_dmb cmd;
-+	unsigned long flags;
- 	int ret;
- 
- 	ret = ism_alloc_dmb(ism, dmb);
-@@ -351,7 +366,9 @@ int ism_register_dmb(struct ism_dev *ism, struct ism_dmb *dmb,
- 		goto out;
- 	}
- 	dmb->dmb_tok = cmd.response.dmb_tok;
-+	spin_lock_irqsave(&ism->lock, flags);
- 	ism->sba_client_arr[dmb->sba_idx - ISM_DMB_BIT_OFFSET] = client->id;
-+	spin_unlock_irqrestore(&ism->lock, flags);
- out:
- 	return ret;
- }
-@@ -360,6 +377,7 @@ EXPORT_SYMBOL_GPL(ism_register_dmb);
- int ism_unregister_dmb(struct ism_dev *ism, struct ism_dmb *dmb)
- {
- 	union ism_unreg_dmb cmd;
-+	unsigned long flags;
- 	int ret;
- 
- 	memset(&cmd, 0, sizeof(cmd));
-@@ -368,7 +386,9 @@ int ism_unregister_dmb(struct ism_dev *ism, struct ism_dmb *dmb)
- 
- 	cmd.request.dmb_tok = dmb->dmb_tok;
- 
-+	spin_lock_irqsave(&ism->lock, flags);
- 	ism->sba_client_arr[dmb->sba_idx - ISM_DMB_BIT_OFFSET] = NO_CLIENT;
-+	spin_unlock_irqrestore(&ism->lock, flags);
- 
- 	ret = ism_cmd(ism, &cmd);
- 	if (ret && ret != ISM_ERROR)
-@@ -491,6 +511,7 @@ static u16 ism_get_chid(struct ism_dev *ism)
- static void ism_handle_event(struct ism_dev *ism)
- {
- 	struct ism_event *entry;
-+	struct ism_client *clt;
- 	int i;
- 
- 	while ((ism->ieq_idx + 1) != READ_ONCE(ism->ieq->header.idx)) {
-@@ -499,21 +520,21 @@ static void ism_handle_event(struct ism_dev *ism)
- 
- 		entry = &ism->ieq->entry[ism->ieq_idx];
- 		debug_event(ism_debug_info, 2, entry, sizeof(*entry));
--		spin_lock(&clients_lock);
--		for (i = 0; i < max_client; ++i)
--			if (clients[i])
--				clients[i]->handle_event(ism, entry);
--		spin_unlock(&clients_lock);
-+		for (i = 0; i < max_client; ++i) {
-+			clt = ism->subs[i];
-+			if (clt)
-+				clt->handle_event(ism, entry);
-+		}
- 	}
- }
- 
- static irqreturn_t ism_handle_irq(int irq, void *data)
- {
- 	struct ism_dev *ism = data;
--	struct ism_client *clt;
- 	unsigned long bit, end;
- 	unsigned long *bv;
- 	u16 dmbemask;
-+	u8 client_id;
- 
- 	bv = (void *) &ism->sba->dmb_bits[ISM_DMB_WORD_OFFSET];
- 	end = sizeof(ism->sba->dmb_bits) * BITS_PER_BYTE - ISM_DMB_BIT_OFFSET;
-@@ -530,8 +551,10 @@ static irqreturn_t ism_handle_irq(int irq, void *data)
- 		dmbemask = ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET];
- 		ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
- 		barrier();
--		clt = clients[ism->sba_client_arr[bit]];
--		clt->handle_irq(ism, bit + ISM_DMB_BIT_OFFSET, dmbemask);
-+		client_id = ism->sba_client_arr[bit];
-+		if (unlikely(client_id == NO_CLIENT || !ism->subs[client_id]))
-+			continue;
-+		ism->subs[client_id]->handle_irq(ism, bit + ISM_DMB_BIT_OFFSET, dmbemask);
- 	}
- 
- 	if (ism->sba->e) {
-@@ -554,6 +577,7 @@ static void ism_dev_add_work_func(struct work_struct *work)
- 						 add_work);
- 
- 	client->add(client->tgt_ism);
-+	ism_setup_forwarding(client, client->tgt_ism);
- 	atomic_dec(&client->tgt_ism->add_dev_cnt);
- 	wake_up(&client->tgt_ism->waitq);
- }
-@@ -691,7 +715,11 @@ static void ism_dev_remove_work_func(struct work_struct *work)
- {
- 	struct ism_client *client = container_of(work, struct ism_client,
- 						 remove_work);
-+	unsigned long flags;
- 
-+	spin_lock_irqsave(&client->tgt_ism->lock, flags);
-+	client->tgt_ism->subs[client->id] = NULL;
-+	spin_unlock_irqrestore(&client->tgt_ism->lock, flags);
- 	client->remove(client->tgt_ism);
- 	atomic_dec(&client->tgt_ism->free_clients_cnt);
- 	wake_up(&client->tgt_ism->waitq);
-diff --git a/include/linux/ism.h b/include/linux/ism.h
-index ea2bcdae74012..5160d47e5ea9e 100644
---- a/include/linux/ism.h
-+++ b/include/linux/ism.h
-@@ -44,6 +44,7 @@ struct ism_dev {
- 	u64 local_gid;
- 	int ieq_idx;
- 
-+	struct ism_client *subs[MAX_CLIENTS];
- 	atomic_t free_clients_cnt;
- 	atomic_t add_dev_cnt;
- 	wait_queue_head_t waitq;
--- 
-2.39.2
-
diff --git a/queue-6.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch b/queue-6.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
deleted file mode 100644
index 482d423911b..00000000000
--- a/queue-6.4/scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From ba6f8103f9b47e25147279392d0190719036955e Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 13:58:47 +0300
-Subject: scsi: qla2xxx: Fix error code in qla2x00_start_sp()
-
-From: Dan Carpenter <dan.carpenter@linaro.org>
-
-[ Upstream commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 ]
-
-This should be negative -EAGAIN instead of positive.  The callers treat
-non-zero error codes the same so it doesn't really impact runtime beyond
-some trivial differences to debug output.
-
-Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang")
-Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/scsi/qla2xxx/qla_iocb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
-index b9b3e6f80ea9b..1ed13199f27ce 100644
---- a/drivers/scsi/qla2xxx/qla_iocb.c
-+++ b/drivers/scsi/qla2xxx/qla_iocb.c
-@@ -3892,7 +3892,7 @@ qla2x00_start_sp(srb_t *sp)
- 
- 	pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
- 	if (!pkt) {
--		rval = EAGAIN;
-+		rval = -EAGAIN;
- 		ql_log(ql_log_warn, vha, 0x700c,
- 		    "qla2x00_alloc_iocbs failed.\n");
- 		goto done;
--- 
-2.39.2
-
diff --git a/queue-6.4/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch b/queue-6.4/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
deleted file mode 100644
index 2be6cf551bb..00000000000
--- a/queue-6.4/scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 577164d03134b5cdfa2ba8c54c8c325857472318 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 30 Jun 2023 22:23:48 -0700
-Subject: scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 89f7ef7f2b23b2a7b8ce346c23161916eae5b15c ]
-
-When RESET_CONTROLLER is not set, kconfig complains about missing
-dependencies for RESET_TI_SYSCON, so add the missing dependency just as is
-done above for SCSI_UFS_QCOM.
-
-Silences this kconfig warning:
-
-WARNING: unmet direct dependencies detected for RESET_TI_SYSCON
-  Depends on [n]: RESET_CONTROLLER [=n] && HAS_IOMEM [=y]
-  Selected by [m]:
-  - SCSI_UFS_MEDIATEK [=m] && SCSI_UFSHCD [=y] && SCSI_UFSHCD_PLATFORM [=y] && ARCH_MEDIATEK [=y]
-
-Fixes: de48898d0cb6 ("scsi: ufs-mediatek: Create reset control device_link")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Link: lore.kernel.org/r/202306020859.1wHg9AaT-lkp@intel.com
-Link: https://lore.kernel.org/r/20230701052348.28046-1-rdunlap@infradead.org
-Cc: Stanley Chu <stanley.chu@mediatek.com>
-Cc: Peter Wang <peter.wang@mediatek.com>
-Cc: Paul Gazzillo <paul@pgazz.com>
-Cc: Necip Fazil Yildiran <fazilyildiran@gmail.com>
-Cc: linux-scsi@vger.kernel.org
-Cc: linux-arm-kernel@lists.infradead.org
-Cc: linux-mediatek@lists.infradead.org
-Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
-Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
-Reported-by: kernel test robot <lkp@intel.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/ufs/host/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/ufs/host/Kconfig b/drivers/ufs/host/Kconfig
-index 8793e34335806..f11e98c9e6652 100644
---- a/drivers/ufs/host/Kconfig
-+++ b/drivers/ufs/host/Kconfig
-@@ -72,6 +72,7 @@ config SCSI_UFS_QCOM
- config SCSI_UFS_MEDIATEK
- 	tristate "Mediatek specific hooks to UFS controller platform driver"
- 	depends on SCSI_UFSHCD_PLATFORM && ARCH_MEDIATEK
-+	depends on RESET_CONTROLLER
- 	select PHY_MTK_UFS
- 	select RESET_TI_SYSCON
- 	help
--- 
-2.39.2
-
diff --git a/queue-6.4/series b/queue-6.4/series
index c045e387da9..4210f2bdd17 100644
--- a/queue-6.4/series
+++ b/queue-6.4/series
@@ -798,101 +798,3 @@ wireguard-queueing-use-saner-cpu-selection-wrapping.patch
 wireguard-netlink-send-staged-packets-when-setting-initial-private-key.patch
 tty-serial-fsl_lpuart-add-earlycon-for-imx8ulp-platform.patch
 io_uring-use-io_schedule-in-cqring-wait.patch
-drm-panel-simple-add-connector_type-for-innolux_at04.patch
-drm-bridge-dw_hdmi-fix-connector-access-for-scdc.patch
-drm-bridge-ti-sn65dsi86-fix-auxiliary-bus-lifetime.patch
-swiotlb-always-set-the-number-of-areas-before-alloca.patch
-swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
-drm-panel-simple-add-powertip-ph800480t013-drm_displ.patch
-xen-virtio-fix-null-deref-when-a-bridge-of-pci-root-.patch
-netfilter-nf_tables-report-use-refcount-overflow.patch
-netfilter-conntrack-don-t-fold-port-numbers-into-add.patch
-ice-fix-max_rate-check-while-configuring-tx-rate-lim.patch
-ice-fix-tx-queue-rate-limit-when-tcs-are-configured.patch
-igc-add-condition-for-qbv_config_change_errors-count.patch
-igc-remove-delay-during-tx-ring-configuration.patch
-igc-add-igc_xdp_buff-wrapper-for-xdp_buff-in-driver.patch
-igc-add-xdp-hints-kfuncs-for-rx-hash.patch
-igc-fix-tx-hang-issue-when-qbv-gate-is-closed.patch
-net-mlx5e-fix-double-free-in-mlx5e_destroy_flow_tabl.patch
-net-mlx5e-fix-memory-leak-in-mlx5e_fs_tt_redirect_an.patch
-net-mlx5e-fix-memory-leak-in-mlx5e_ptp_open.patch
-net-mlx5e-rx-fix-flush-and-close-release-flow-of-reg.patch
-net-mlx5-register-a-unique-thermal-zone-per-device.patch
-net-mlx5e-check-for-not_ready-flag-state-after-locki.patch
-net-mlx5e-tc-ct-offload-ct-clear-only-once.patch
-net-mlx5-query-hca_cap_2-only-when-supported.patch
-net-mlx5e-rx-fix-page_pool-page-fragment-tracking-fo.patch
-igc-set-tp-bit-in-supported-and-advertising-fields-o.patch
-igc-include-the-length-type-field-and-vlan-tag-in-qu.patch
-igc-handle-pps-start-time-programming-for-past-time-.patch
-blk-crypto-use-dynamic-lock-class-for-blk_crypto_pro.patch
-scsi-qla2xxx-fix-error-code-in-qla2x00_start_sp.patch
-scsi-ufs-ufs-mediatek-add-dependency-for-reset_contr.patch
-bpf-fix-max-stack-depth-check-for-async-callbacks.patch
-net-mvneta-fix-txq_map-in-case-of-txq_number-1.patch
-net-dsa-felix-make-vsc9959_tas_guard_bands_update-vi.patch
-net-mscc-ocelot-fix-oversize-frame-dropping-for-pree.patch
-net-sched-cls_fw-fix-improper-refcount-update-leads-.patch
-gve-set-default-duplex-configuration-to-full.patch
-drm-fbdev-dma-fix-documented-default-preferred_bpp-v.patch
-octeontx2-af-promisc-enable-disable-through-mbox.patch
-octeontx2-af-move-validation-of-ptp-pointer-before-i.patch
-ionic-remove-warn_on-to-prevent-panic_on_warn.patch
-udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch
-net-bgmac-postpone-turning-irqs-off-to-avoid-soc-han.patch
-net-prevent-skb-corruption-on-frag-list-segmentation.patch
-s390-ism-fix-locking-for-forwarding-of-irqs-and-even.patch
-s390-ism-fix-and-simplify-add-remove-callback-handli.patch
-s390-ism-do-not-unregister-clients-with-registered-d.patch
-icmp6-fix-null-ptr-deref-of-ip6_null_entry-rt6i_idev.patch
-udp6-fix-udp6_ehashfn-typo.patch
-ntb-idt-fix-error-handling-in-idt_pci_driver_init.patch
-ntb-amd-fix-error-handling-in-amd_ntb_pci_driver_ini.patch
-ntb-intel-fix-error-handling-in-intel_ntb_pci_driver.patch
-ntb-ntb_transport-fix-possible-memory-leak-while-dev.patch
-ntb-ntb_tool-add-check-for-devm_kcalloc.patch
-ipv6-addrconf-fix-a-potential-refcount-underflow-for.patch
-hid-hyperv-avoid-struct-memcpy-overrun-warning.patch
-net-dsa-qca8k-add-check-for-skb_copy.patch
-x86-fineibt-poison-endbr-at-0.patch
-platform-x86-wmi-break-possible-infinite-loop-when-p.patch
-net-sched-taprio-replace-tc_taprio_qopt_offload-enab.patch
-igc-rename-qbv_enable-to-taprio_offload_enable.patch
-igc-do-not-enable-taprio-offload-for-invalid-argumen.patch
-igc-handle-already-enabled-taprio-offload-for-baseti.patch
-kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
-fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch
-igc-no-strict-mode-in-pure-launchtime-cbs-offload.patch
-igc-fix-launchtime-before-start-of-cycle.patch
-igc-fix-inserting-of-empty-frame-for-launchtime.patch
-nvme-fix-the-nvme_id_ns_nvm_sts_mask-definition.patch
-openrisc-union-fpcsr-and-oldmask-in-sigcontext-to-un.patch
-riscv-bpf-fix-inconsistent-jit-image-generation.patch
-net-fec-remove-useless-fec_enet_reset_skb.patch
-net-fec-remove-last_bdp-from-fec_enet_txq_xmit_frame.patch
-net-fec-recycle-pages-for-transmitted-xdp-frames.patch
-net-fec-increase-the-size-of-tx-ring-and-update-tx_w.patch
-drm-i915-don-t-preserve-dpll_hw_state-for-slave-crtc.patch
-drm-i915-fix-one-wrong-caching-mode-enum-usage.patch
-net-dsa-removed-unneeded-of_node_put-in-felix_parse_.patch
-octeontx2-pf-add-additional-check-for-mcam-rules.patch
-erofs-avoid-useless-loops-in-z_erofs_pcluster_readmo.patch
-erofs-avoid-infinite-loop-in-z_erofs_do_read_page-wh.patch
-erofs-fix-fsdax-unavailability-for-chunk-based-regul.patch
-wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
-bpf-cpumap-fix-memory-leak-in-cpu_map_update_elem.patch
-xdp-use-trusted-arguments-in-xdp-hints-kfuncs.patch
-net-sched-flower-ensure-both-minimum-and-maximum-por.patch
-riscv-mm-fix-truncation-warning-on-rv32.patch
-drm-nouveau-disp-fix-hdmi-on-gt215.patch
-drm-nouveau-disp-g94-enable-hdmi.patch
-netdevsim-fix-uninitialized-data-in-nsim_dev_trap_fa.patch
-drm-nouveau-acr-abort-loading-acr-if-no-firmware-was.patch
-drm-nouveau-bring-back-blit-subchannel-for-pre-nv50-.patch
-net-sched-make-psched_mtu-rtnl-less-safe.patch
-net-txgbe-fix-eeprom-calculation-error.patch
-wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
-net-sched-sch_qfq-reintroduce-lmax-bound-check-for-m.patch
-net-sched-sch_qfq-account-for-stab-overhead-in-qfq_e.patch
-nvme-pci-fix-dma-direction-of-unmapping-integrity-da.patch
diff --git a/queue-6.4/swiotlb-always-set-the-number-of-areas-before-alloca.patch b/queue-6.4/swiotlb-always-set-the-number-of-areas-before-alloca.patch
deleted file mode 100644
index 642f69160a8..00000000000
--- a/queue-6.4/swiotlb-always-set-the-number-of-areas-before-alloca.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 3e0aead0125493b7ae55fcf63b7b58f4cd13b0aa Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 15:01:03 +0200
-Subject: swiotlb: always set the number of areas before allocating the pool
-
-From: Petr Tesarik <petr.tesarik.ext@huawei.com>
-
-[ Upstream commit aabd12609f91155f26584508b01f548215cc3c0c ]
-
-The number of areas defaults to the number of possible CPUs. However, the
-total number of slots may have to be increased after adjusting the number
-of areas. Consequently, the number of areas must be determined before
-allocating the memory pool. This is even explained with a comment in
-swiotlb_init_remap(), but swiotlb_init_late() adjusts the number of areas
-after slots are already allocated. The areas may end up being smaller than
-IO_TLB_SEGSIZE, which breaks per-area locking.
-
-While fixing swiotlb_init_late(), move all relevant comments before the
-definition of swiotlb_adjust_nareas() and convert them to kernel-doc.
-
-Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock")
-Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
-Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/dma/swiotlb.c | 19 +++++++++++--------
- 1 file changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
-index af2e304c672c4..16f53d8c51bcf 100644
---- a/kernel/dma/swiotlb.c
-+++ b/kernel/dma/swiotlb.c
-@@ -115,9 +115,16 @@ static bool round_up_default_nslabs(void)
- 	return true;
- }
- 
-+/**
-+ * swiotlb_adjust_nareas() - adjust the number of areas and slots
-+ * @nareas:	Desired number of areas. Zero is treated as 1.
-+ *
-+ * Adjust the default number of areas in a memory pool.
-+ * The default size of the memory pool may also change to meet minimum area
-+ * size requirements.
-+ */
- static void swiotlb_adjust_nareas(unsigned int nareas)
- {
--	/* use a single area when non is specified */
- 	if (!nareas)
- 		nareas = 1;
- 	else if (!is_power_of_2(nareas))
-@@ -298,10 +305,6 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 	if (swiotlb_force_disable)
- 		return;
- 
--	/*
--	 * default_nslabs maybe changed when adjust area number.
--	 * So allocate bounce buffer after adjusting area number.
--	 */
- 	if (!default_nareas)
- 		swiotlb_adjust_nareas(num_possible_cpus());
- 
-@@ -363,6 +366,9 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 	if (swiotlb_force_disable)
- 		return 0;
- 
-+	if (!default_nareas)
-+		swiotlb_adjust_nareas(num_possible_cpus());
-+
- retry:
- 	order = get_order(nslabs << IO_TLB_SHIFT);
- 	nslabs = SLABS_PER_PAGE << order;
-@@ -397,9 +403,6 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 			(PAGE_SIZE << order) >> 20);
- 	}
- 
--	if (!default_nareas)
--		swiotlb_adjust_nareas(num_possible_cpus());
--
- 	area_order = get_order(array_size(sizeof(*mem->areas),
- 		default_nareas));
- 	mem->areas = (struct io_tlb_area *)
--- 
-2.39.2
-
diff --git a/queue-6.4/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch b/queue-6.4/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
deleted file mode 100644
index 1b1673f170a..00000000000
--- a/queue-6.4/swiotlb-reduce-the-number-of-areas-to-match-actual-m.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From 0745d7a9e77343a03937e00b50782642061849c2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 26 Jun 2023 15:01:04 +0200
-Subject: swiotlb: reduce the number of areas to match actual memory pool size
-
-From: Petr Tesarik <petr.tesarik.ext@huawei.com>
-
-[ Upstream commit 8ac04063354a01a484d2e55d20ed1958aa0d3392 ]
-
-Although the desired size of the SWIOTLB memory pool is increased in
-swiotlb_adjust_nareas() to match the number of areas, the actual allocation
-may be smaller, which may require reducing the number of areas.
-
-For example, Xen uses swiotlb_init_late(), which in turn uses the page
-allocator. On x86, page size is 4 KiB and MAX_ORDER is 10 (1024 pages),
-resulting in a maximum memory pool size of 4 MiB. This corresponds to 2048
-slots of 2 KiB each. The minimum area size is 128 (IO_TLB_SEGSIZE),
-allowing at most 2048 / 128 = 16 areas.
-
-If num_possible_cpus() is greater than the maximum number of areas, areas
-are smaller than IO_TLB_SEGSIZE and contiguous groups of free slots will
-span multiple areas. When allocating and freeing slots, only one area will
-be properly locked, causing race conditions on the unlocked slots and
-ultimately data corruption, kernel hangs and crashes.
-
-Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock")
-Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
-Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- kernel/dma/swiotlb.c | 27 ++++++++++++++++++++++++---
- 1 file changed, 24 insertions(+), 3 deletions(-)
-
-diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
-index 16f53d8c51bcf..b1bbd6270ba79 100644
---- a/kernel/dma/swiotlb.c
-+++ b/kernel/dma/swiotlb.c
-@@ -138,6 +138,23 @@ static void swiotlb_adjust_nareas(unsigned int nareas)
- 			(default_nslabs << IO_TLB_SHIFT) >> 20);
- }
- 
-+/**
-+ * limit_nareas() - get the maximum number of areas for a given memory pool size
-+ * @nareas:	Desired number of areas.
-+ * @nslots:	Total number of slots in the memory pool.
-+ *
-+ * Limit the number of areas to the maximum possible number of areas in
-+ * a memory pool of the given size.
-+ *
-+ * Return: Maximum possible number of areas.
-+ */
-+static unsigned int limit_nareas(unsigned int nareas, unsigned long nslots)
-+{
-+	if (nslots < nareas * IO_TLB_SEGSIZE)
-+		return nslots / IO_TLB_SEGSIZE;
-+	return nareas;
-+}
-+
- static int __init
- setup_io_tlb_npages(char *str)
- {
-@@ -297,6 +314,7 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- {
- 	struct io_tlb_mem *mem = &io_tlb_default_mem;
- 	unsigned long nslabs;
-+	unsigned int nareas;
- 	size_t alloc_size;
- 	void *tlb;
- 
-@@ -309,10 +327,12 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
- 		swiotlb_adjust_nareas(num_possible_cpus());
- 
- 	nslabs = default_nslabs;
-+	nareas = limit_nareas(default_nareas, nslabs);
- 	while ((tlb = swiotlb_memblock_alloc(nslabs, flags, remap)) == NULL) {
- 		if (nslabs <= IO_TLB_MIN_SLABS)
- 			return;
- 		nslabs = ALIGN(nslabs >> 1, IO_TLB_SEGSIZE);
-+		nareas = limit_nareas(nareas, nslabs);
- 	}
- 
- 	if (default_nslabs != nslabs) {
-@@ -358,6 +378,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- {
- 	struct io_tlb_mem *mem = &io_tlb_default_mem;
- 	unsigned long nslabs = ALIGN(size >> IO_TLB_SHIFT, IO_TLB_SEGSIZE);
-+	unsigned int nareas;
- 	unsigned char *vstart = NULL;
- 	unsigned int order, area_order;
- 	bool retried = false;
-@@ -403,8 +424,8 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 			(PAGE_SIZE << order) >> 20);
- 	}
- 
--	area_order = get_order(array_size(sizeof(*mem->areas),
--		default_nareas));
-+	nareas = limit_nareas(default_nareas, nslabs);
-+	area_order = get_order(array_size(sizeof(*mem->areas), nareas));
- 	mem->areas = (struct io_tlb_area *)
- 		__get_free_pages(GFP_KERNEL | __GFP_ZERO, area_order);
- 	if (!mem->areas)
-@@ -418,7 +439,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask,
- 	set_memory_decrypted((unsigned long)vstart,
- 			     (nslabs << IO_TLB_SHIFT) >> PAGE_SHIFT);
- 	swiotlb_init_io_tlb_mem(mem, virt_to_phys(vstart), nslabs, 0, true,
--				default_nareas);
-+				nareas);
- 
- 	swiotlb_print_info();
- 	return 0;
--- 
-2.39.2
-
diff --git a/queue-6.4/udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch b/queue-6.4/udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch
deleted file mode 100644
index 80cf831a62a..00000000000
--- a/queue-6.4/udp6-add-a-missing-call-into-udp_fail_queue_rcv_skb-.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 8b9f1e208289fa8437d0478c29172a6ebf9f8da2 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 21:39:20 -0700
-Subject: udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint
-
-From: Ivan Babrou <ivan@cloudflare.com>
-
-[ Upstream commit 8139dccd464aaee4a2c351506ff883733c6ca5a3 ]
-
-The tracepoint has existed for 12 years, but it only covered udp
-over the legacy IPv4 protocol. Having it enabled for udp6 removes
-the unnecessary difference in error visibility.
-
-Signed-off-by: Ivan Babrou <ivan@cloudflare.com>
-Fixes: 296f7ea75b45 ("udp: add tracepoints for queueing skb to rcvbuf")
-Acked-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/net-traces.c | 2 ++
- net/ipv6/udp.c        | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/net/core/net-traces.c b/net/core/net-traces.c
-index 805b7385dd8da..6aef976bc1da2 100644
---- a/net/core/net-traces.c
-+++ b/net/core/net-traces.c
-@@ -63,4 +63,6 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(napi_poll);
- EXPORT_TRACEPOINT_SYMBOL_GPL(tcp_send_reset);
- EXPORT_TRACEPOINT_SYMBOL_GPL(tcp_bad_csum);
- 
-+EXPORT_TRACEPOINT_SYMBOL_GPL(udp_fail_queue_rcv_skb);
-+
- EXPORT_TRACEPOINT_SYMBOL_GPL(sk_data_ready);
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index e5a337e6b9705..debb98fb23c0b 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -45,6 +45,7 @@
- #include <net/tcp_states.h>
- #include <net/ip6_checksum.h>
- #include <net/ip6_tunnel.h>
-+#include <trace/events/udp.h>
- #include <net/xfrm.h>
- #include <net/inet_hashtables.h>
- #include <net/inet6_hashtables.h>
-@@ -680,6 +681,7 @@ static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- 		}
- 		UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
- 		kfree_skb_reason(skb, drop_reason);
-+		trace_udp_fail_queue_rcv_skb(rc, sk);
- 		return -1;
- 	}
- 
--- 
-2.39.2
-
diff --git a/queue-6.4/udp6-fix-udp6_ehashfn-typo.patch b/queue-6.4/udp6-fix-udp6_ehashfn-typo.patch
deleted file mode 100644
index ccca51c2c3f..00000000000
--- a/queue-6.4/udp6-fix-udp6_ehashfn-typo.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From d63211de5fb52a2741b61eae43f615679bbddba7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sat, 8 Jul 2023 08:29:58 +0000
-Subject: udp6: fix udp6_ehashfn() typo
-
-From: Eric Dumazet <edumazet@google.com>
-
-[ Upstream commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 ]
-
-Amit Klein reported that udp6_ehash_secret was initialized but never used.
-
-Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once")
-Reported-by: Amit Klein <aksecurity@gmail.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willy Tarreau <w@1wt.eu>
-Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
-Cc: David Ahern <dsahern@kernel.org>
-Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/ipv6/udp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index debb98fb23c0b..d594a0425749b 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -91,7 +91,7 @@ static u32 udp6_ehashfn(const struct net *net,
- 	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
- 
- 	return __inet6_ehashfn(lhash, lport, fhash, fport,
--			       udp_ipv6_hash_secret + net_hash_mix(net));
-+			       udp6_ehash_secret + net_hash_mix(net));
- }
- 
- int udp_v6_get_port(struct sock *sk, unsigned short snum)
--- 
-2.39.2
-
diff --git a/queue-6.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch b/queue-6.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
deleted file mode 100644
index 6967b0fc66a..00000000000
--- a/queue-6.4/wifi-airo-avoid-uninitialized-warning-in-airo_get_ra.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 2685e6ba08190492fa99432286f029afadcb06ef Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Sun, 9 Jul 2023 06:31:54 -0700
-Subject: wifi: airo: avoid uninitialized warning in airo_get_rate()
-
-From: Randy Dunlap <rdunlap@infradead.org>
-
-[ Upstream commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 ]
-
-Quieten a gcc (11.3.0) build error or warning by checking the function
-call status and returning -EBUSY if the function call failed.
-This is similar to what several other wireless drivers do for the
-SIOCGIWRATE ioctl call when there is a locking problem.
-
-drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized]
-
-Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
-Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
-Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
-Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org
-Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/cisco/airo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
-index 7c4cc5f5e1eb4..dbd13f7aa3e6e 100644
---- a/drivers/net/wireless/cisco/airo.c
-+++ b/drivers/net/wireless/cisco/airo.c
-@@ -6157,8 +6157,11 @@ static int airo_get_rate(struct net_device *dev,
- 	struct iw_param *vwrq = &wrqu->bitrate;
- 	struct airo_info *local = dev->ml_priv;
- 	StatusRid status_rid;		/* Card status info */
-+	int ret;
- 
--	readStatusRid(local, &status_rid, 1);
-+	ret = readStatusRid(local, &status_rid, 1);
-+	if (ret)
-+		return -EBUSY;
- 
- 	vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
- 	/* If more than one rate, set auto */
--- 
-2.39.2
-
diff --git a/queue-6.4/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch b/queue-6.4/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
deleted file mode 100644
index 3461fb18da2..00000000000
--- a/queue-6.4/wifi-rtw89-debug-fix-error-code-in-rtw89_debug_priv_.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From cf9f44752b619631f770e4dc300984d1dac80d17 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 6 Jul 2023 10:45:00 +0800
-Subject: wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set()
-
-From: Zhang Shurong <zhang_shurong@foxmail.com>
-
-[ Upstream commit 4f4626cd049576af1276c7568d5b44eb3f7bb1b1 ]
-
-If there is a failure during rtw89_fw_h2c_raw() rtw89_debug_priv_send_h2c
-should return negative error code instead of a positive value count.
-Fix this bug by returning correct error code.
-
-Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
-Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
-Acked-by: Ping-Ke Shih <pkshih@realtek.com>
-Link: https://lore.kernel.org/r/tencent_AD09A61BC4DA92AD1EB0790F5C850E544D07@qq.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/wireless/realtek/rtw89/debug.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c
-index 1e5b7a9987163..858494ddfb12e 100644
---- a/drivers/net/wireless/realtek/rtw89/debug.c
-+++ b/drivers/net/wireless/realtek/rtw89/debug.c
-@@ -2998,17 +2998,18 @@ static ssize_t rtw89_debug_priv_send_h2c_set(struct file *filp,
- 	struct rtw89_debugfs_priv *debugfs_priv = filp->private_data;
- 	struct rtw89_dev *rtwdev = debugfs_priv->rtwdev;
- 	u8 *h2c;
-+	int ret;
- 	u16 h2c_len = count / 2;
- 
- 	h2c = rtw89_hex2bin_user(rtwdev, user_buf, count);
- 	if (IS_ERR(h2c))
- 		return -EFAULT;
- 
--	rtw89_fw_h2c_raw(rtwdev, h2c, h2c_len);
-+	ret = rtw89_fw_h2c_raw(rtwdev, h2c, h2c_len);
- 
- 	kfree(h2c);
- 
--	return count;
-+	return ret ? ret : count;
- }
- 
- static int
--- 
-2.39.2
-
diff --git a/queue-6.4/x86-fineibt-poison-endbr-at-0.patch b/queue-6.4/x86-fineibt-poison-endbr-at-0.patch
deleted file mode 100644
index 40fbeec819e..00000000000
--- a/queue-6.4/x86-fineibt-poison-endbr-at-0.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 79f7f4bdb8ae801346e94933d8c848c76e4ea88b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jun 2023 21:35:48 +0200
-Subject: x86/fineibt: Poison ENDBR at +0
-
-From: Peter Zijlstra <peterz@infradead.org>
-
-[ Upstream commit 04505bbbbb15da950ea0239e328a76a3ad2376e0 ]
-
-Alyssa noticed that when building the kernel with CFI_CLANG+IBT and
-booting on IBT enabled hardware to obtain FineIBT, the indirect
-functions look like:
-
-  __cfi_foo:
-	endbr64
-	subl	$hash, %r10d
-	jz	1f
-	ud2
-	nop
-  1:
-  foo:
-	endbr64
-
-This is because the compiler generates code for kCFI+IBT. In that case
-the caller does the hash check and will jump to +0, so there must be
-an ENDBR there. The compiler doesn't know about FineIBT at all; also
-it is possible to actually use kCFI+IBT when booting with 'cfi=kcfi'
-on IBT enabled hardware.
-
-Having this second ENDBR however makes it possible to elide the CFI
-check. Therefore, we should poison this second ENDBR when switching to
-FineIBT mode.
-
-Fixes: 931ab63664f0 ("x86/ibt: Implement FineIBT")
-Reported-by: "Milburn, Alyssa" <alyssa.milburn@intel.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Reviewed-by: Kees Cook <keescook@chromium.org>
-Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
-Link: https://lore.kernel.org/r/20230615193722.194131053@infradead.org
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/x86/kernel/alternative.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index f615e0cb6d932..4e2c70f88e05b 100644
---- a/arch/x86/kernel/alternative.c
-+++ b/arch/x86/kernel/alternative.c
-@@ -940,6 +940,17 @@ static int cfi_rewrite_preamble(s32 *start, s32 *end)
- 	return 0;
- }
- 
-+static void cfi_rewrite_endbr(s32 *start, s32 *end)
-+{
-+	s32 *s;
-+
-+	for (s = start; s < end; s++) {
-+		void *addr = (void *)s + *s;
-+
-+		poison_endbr(addr+16, false);
-+	}
-+}
-+
- /* .retpoline_sites */
- static int cfi_rand_callers(s32 *start, s32 *end)
- {
-@@ -1034,14 +1045,19 @@ static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
- 		return;
- 
- 	case CFI_FINEIBT:
-+		/* place the FineIBT preamble at func()-16 */
- 		ret = cfi_rewrite_preamble(start_cfi, end_cfi);
- 		if (ret)
- 			goto err;
- 
-+		/* rewrite the callers to target func()-16 */
- 		ret = cfi_rewrite_callers(start_retpoline, end_retpoline);
- 		if (ret)
- 			goto err;
- 
-+		/* now that nobody targets func()+0, remove ENDBR there */
-+		cfi_rewrite_endbr(start_cfi, end_cfi);
-+
- 		if (builtin)
- 			pr_info("Using FineIBT CFI\n");
- 		return;
--- 
-2.39.2
-
diff --git a/queue-6.4/xdp-use-trusted-arguments-in-xdp-hints-kfuncs.patch b/queue-6.4/xdp-use-trusted-arguments-in-xdp-hints-kfuncs.patch
deleted file mode 100644
index 83ad713a5e5..00000000000
--- a/queue-6.4/xdp-use-trusted-arguments-in-xdp-hints-kfuncs.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From ef7d0bc0116eed8b256212c207fd0aaa11f2a936 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 11 Jul 2023 12:59:26 +0200
-Subject: xdp: use trusted arguments in XDP hints kfuncs
-
-From: Larysa Zaremba <larysa.zaremba@intel.com>
-
-[ Upstream commit 2e06c57d66d3f6c26faa5f5b479fb3add34ce85a ]
-
-Currently, verifier does not reject XDP programs that pass NULL pointer to
-hints functions. At the same time, this case is not handled in any driver
-implementation (including veth). For example, changing
-
-bpf_xdp_metadata_rx_timestamp(ctx, &timestamp);
-
-to
-
-bpf_xdp_metadata_rx_timestamp(ctx, NULL);
-
-in xdp_metadata test successfully crashes the system.
-
-Add KF_TRUSTED_ARGS flag to hints kfunc definitions, so driver code
-does not have to worry about getting invalid pointers.
-
-Fixes: 3d76a4d3d4e5 ("bpf: XDP metadata RX kfuncs")
-Reported-by: Stanislav Fomichev <sdf@google.com>
-Closes: https://lore.kernel.org/bpf/ZKWo0BbpLfkZHbyE@google.com/
-Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
-Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
-Acked-by: Stanislav Fomichev <sdf@google.com>
-Link: https://lore.kernel.org/r/20230711105930.29170-1-larysa.zaremba@intel.com
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/xdp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/xdp.c b/net/core/xdp.c
-index 41e5ca8643ec9..8362130bf085d 100644
---- a/net/core/xdp.c
-+++ b/net/core/xdp.c
-@@ -741,7 +741,7 @@ __bpf_kfunc int bpf_xdp_metadata_rx_hash(const struct xdp_md *ctx, u32 *hash,
- __diag_pop();
- 
- BTF_SET8_START(xdp_metadata_kfunc_ids)
--#define XDP_METADATA_KFUNC(_, name) BTF_ID_FLAGS(func, name, 0)
-+#define XDP_METADATA_KFUNC(_, name) BTF_ID_FLAGS(func, name, KF_TRUSTED_ARGS)
- XDP_METADATA_KFUNC_xxx
- #undef XDP_METADATA_KFUNC
- BTF_SET8_END(xdp_metadata_kfunc_ids)
--- 
-2.39.2
-
diff --git a/queue-6.4/xen-virtio-fix-null-deref-when-a-bridge-of-pci-root-.patch b/queue-6.4/xen-virtio-fix-null-deref-when-a-bridge-of-pci-root-.patch
deleted file mode 100644
index d1548ee2677..00000000000
--- a/queue-6.4/xen-virtio-fix-null-deref-when-a-bridge-of-pci-root-.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 2eedacb8d561774f8457305e7eb3c924ce6f9ca9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 21 Jun 2023 15:12:13 +0200
-Subject: xen/virtio: Fix NULL deref when a bridge of PCI root bus has no
- parent
-
-From: Petr Pavlu <petr.pavlu@suse.com>
-
-[ Upstream commit 21a235bce12361e64adfc2ef97e4ae2e51ad63d4 ]
-
-When attempting to run Xen on a QEMU/KVM virtual machine with virtio
-devices (all x86_64), function xen_dt_get_node() crashes on accessing
-bus->bridge->parent->of_node because a bridge of the PCI root bus has no
-parent set:
-
-[    1.694192][    T1] BUG: kernel NULL pointer dereference, address: 0000000000000288
-[    1.695688][    T1] #PF: supervisor read access in kernel mode
-[    1.696297][    T1] #PF: error_code(0x0000) - not-present page
-[    1.696297][    T1] PGD 0 P4D 0
-[    1.696297][    T1] Oops: 0000 [#1] PREEMPT SMP NOPTI
-[    1.696297][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.7-1-default #1 openSUSE Tumbleweed a577eae57964bb7e83477b5a5645a1781df990f0
-[    1.696297][    T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
-[    1.696297][    T1] RIP: e030:xen_virtio_restricted_mem_acc+0xd9/0x1c0
-[    1.696297][    T1] Code: 45 0c 83 e8 c9 a3 ea ff 31 c0 eb d7 48 8b 87 40 ff ff ff 48 89 c2 48 8b 40 10 48 85 c0 75 f4 48 8b 82 10 01 00 00 48 8b 40 40 <48> 83 b8 88 02 00 00 00 0f 84 45 ff ff ff 66 90 31 c0 eb a5 48 89
-[    1.696297][    T1] RSP: e02b:ffffc90040013cc8 EFLAGS: 00010246
-[    1.696297][    T1] RAX: 0000000000000000 RBX: ffff888006c75000 RCX: 0000000000000029
-[    1.696297][    T1] RDX: ffff888005ed1000 RSI: ffffc900400f100c RDI: ffff888005ee30d0
-[    1.696297][    T1] RBP: ffff888006c75010 R08: 0000000000000001 R09: 0000000330000006
-[    1.696297][    T1] R10: ffff888005850028 R11: 0000000000000002 R12: ffffffff830439a0
-[    1.696297][    T1] R13: 0000000000000000 R14: ffff888005657900 R15: ffff888006e3e1e8
-[    1.696297][    T1] FS:  0000000000000000(0000) GS:ffff88804a000000(0000) knlGS:0000000000000000
-[    1.696297][    T1] CS:  e030 DS: 0000 ES: 0000 CR0: 0000000080050033
-[    1.696297][    T1] CR2: 0000000000000288 CR3: 0000000002e36000 CR4: 0000000000050660
-[    1.696297][    T1] Call Trace:
-[    1.696297][    T1]  <TASK>
-[    1.696297][    T1]  virtio_features_ok+0x1b/0xd0
-[    1.696297][    T1]  virtio_dev_probe+0x19c/0x270
-[    1.696297][    T1]  really_probe+0x19b/0x3e0
-[    1.696297][    T1]  __driver_probe_device+0x78/0x160
-[    1.696297][    T1]  driver_probe_device+0x1f/0x90
-[    1.696297][    T1]  __driver_attach+0xd2/0x1c0
-[    1.696297][    T1]  bus_for_each_dev+0x74/0xc0
-[    1.696297][    T1]  bus_add_driver+0x116/0x220
-[    1.696297][    T1]  driver_register+0x59/0x100
-[    1.696297][    T1]  virtio_console_init+0x7f/0x110
-[    1.696297][    T1]  do_one_initcall+0x47/0x220
-[    1.696297][    T1]  kernel_init_freeable+0x328/0x480
-[    1.696297][    T1]  kernel_init+0x1a/0x1c0
-[    1.696297][    T1]  ret_from_fork+0x29/0x50
-[    1.696297][    T1]  </TASK>
-[    1.696297][    T1] Modules linked in:
-[    1.696297][    T1] CR2: 0000000000000288
-[    1.696297][    T1] ---[ end trace 0000000000000000 ]---
-
-The PCI root bus is in this case created from ACPI description via
-acpi_pci_root_add() -> pci_acpi_scan_root() -> acpi_pci_root_create() ->
-pci_create_root_bus() where the last function is called with
-parent=NULL. It indicates that no parent is present and then
-bus->bridge->parent is NULL too.
-
-Fix the problem by checking bus->bridge->parent in xen_dt_get_node() for
-NULL first.
-
-Fixes: ef8ae384b4c9 ("xen/virtio: Handle PCI devices which Host controller is described in DT")
-Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
-Reviewed-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
-Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
-Link: https://lore.kernel.org/r/20230621131214.9398-2-petr.pavlu@suse.com
-Signed-off-by: Juergen Gross <jgross@suse.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/xen/grant-dma-ops.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/xen/grant-dma-ops.c b/drivers/xen/grant-dma-ops.c
-index 9784a77fa3c99..76f6f26265a3b 100644
---- a/drivers/xen/grant-dma-ops.c
-+++ b/drivers/xen/grant-dma-ops.c
-@@ -303,6 +303,8 @@ static struct device_node *xen_dt_get_node(struct device *dev)
- 		while (!pci_is_root_bus(bus))
- 			bus = bus->parent;
- 
-+		if (!bus->bridge->parent)
-+			return NULL;
- 		return of_node_get(bus->bridge->parent->of_node);
- 	}
- 
--- 
-2.39.2
-
-- 
2.47.3