The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is ignored (apart
from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return
void. In the first step of this quest all drivers are converted to
.remove_new(), which already returns void. Eventually after all drivers
are converted, .remove_new() will be renamed to .remove().

Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tpd12s015: section mismatch in reference: tpd_driver+0x4 (section: .data) -> tpd_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410: section mismatch in reference: tfp410_driver+0x4 (section: .data) -> tfp410_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01: section mismatch in reference: sharp_ls_driver+0x4 (section: .data) -> sharp_ls_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/encoder-tfp410: section mismatch in reference: tfp410_driver+0x4 (section: .data) -> tfp410_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-hdmi: section mismatch in reference: hdmi_connector_driver+0x4 (section: .data) -> hdmic_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-dvi: section mismatch in reference: dvi_connector_driver+0x4 (section: .data) -> dvic_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm: section mismatch in reference: dsicm_driver+0x4 (section: .data) -> dsicm_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/panel-dpi: section mismatch in reference: panel_dpi_driver+0x4 (section: .data) -> panel_dpi_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the memory savings of putting the remove function
in .exit isn't that relevant any more. It only matters for built-in
drivers and typically saves a few 100k.

The downside is that the driver cannot be unbound at runtime which is
ancient and also slightly complicates testing. Also it requires to mark
the driver struct with __refdata which is needed to suppress a (W=1)
modpost warning:

	WARNING: modpost: drivers/video/fbdev/omap2/omapfb/displays/connector-analog-tv: section mismatch in reference: tvc_connector_driver+0x4 (section: .data) -> tvc_remove (section: .exit.text)

To simplify matters, move the remove callback to .text and drop
.suppress_bind_attrs = true.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

On today's platforms the benefit of platform_driver_probe() isn't that
relevant any more. It allows to drop some code after booting (or module
loading) for .probe() and discard the .remove() function completely if
the driver is built-in. This typically saves a few 100k.

The downside of platform_driver_probe() is that the driver cannot be
bound and unbound at runtime which is ancient and also slightly
complicates testing. There are also thoughts to deprecate
platform_driver_probe() because it adds some complexity in the driver
core for little gain. Also many drivers don't use it correctly. This
driver for example misses to mark the driver struct with __refdata which
is needed to suppress a (W=1) modpost warning:

	WARNING: modpost: drivers/video/fbdev/atmel_lcdfb: section mismatch in reference: atmel_lcdfb_driver+0x4 (section: .data) -> atmel_lcdfb_remove (section: .exit.text)

[folded in patch by Nathan Chancellor]
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a55 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>

The init_imstt() function calls framebuffer_release() on error and then
the probe() function calls it again.  It should only be done in probe.

Fixes: 518ecb6a ("fbdev: imsttfb: Fix error path of imsttfb_probe()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>

viafbdev.c utilizes memdup_user() to copy an array from userspace.

There is a new wrapper, specifically designed for copying arrays. Use
this one instead.
Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Helge Deller <deller@gmx.de>

OMAP2_VRFB is a bool, so the vrfb driver can never be compiled as a
module. With that __exit_p(vrfb_remove) always evaluates to NULL and
vrfb_remove() is unused.

If the driver was compilable as a module, it would fail to build because
the type of vrfb_remove() isn't compatible with struct
platform_driver::remove(). (The former returns void, the latter int.)

Fixes: aa1e49a3 ("OMAPDSS: VRFB: add omap_vrfb_supported()")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>

Turn a strcpy()+strncat()+'\0' into an equivalent snprintf().
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Helge Deller <deller@gmx.de>

Our library has memparse() for parsing numbers with respective suffixes
suitable for memory sizes. Use it instead of custom implementation.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>

There is no point in shadowing the error codes from platform_get_irq().
Refactor omapfb_do_probe() accordingly.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>

Pull media updates from Mauro Carvalho Chehab:

 - the old V4L2 core videobuf kAPI was finally removed. All media
   drivers should now be using VB2 kAPI

 - new automotive driver: mgb4

 - new platform video driver: npcm-video

 - new sensor driver: mt9m114

 - new TI driver used in conjunction with Cadence CSI2RX IP to bridge
   TI-specific parts

 - ir-rx51 was removed and the N900 DT binding was moved to the
   pwm-ir-tx generic driver

 - drop atomisp-specific ov5693, using the upstream driver instead

 - the camss driver has gained RDI3 support for VFE 17x

 - the atomisp driver now detects ISP2400 or ISP2401 at run time. No
   need to set it up at build time anymore

 - lots of driver fixes, cleanups and improvements

* tag 'media/v6.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (377 commits)
  media: nuvoton: VIDEO_NPCM_VCD_ECE should depend on ARCH_NPCM
  media: venus: Fix firmware path for resources
  media: venus: hfi_cmds: Replace one-element array with flex-array member and use __counted_by
  media: venus: hfi_parser: Add check to keep the number of codecs within range
  media: venus: hfi: add checks to handle capabilities from firmware
  media: venus: hfi: fix the check to handle session buffer requirement
  media: venus: hfi: add checks to perform sanity on queue pointers
  media: platform: cadence: select MIPI_DPHY dependency
  media: MAINTAINERS: Fix path for J721E CSI2RX bindings
  media: cec: meson: always include meson sub-directory in Makefile
  media: videobuf2: Fix IS_ERR checking in vb2_dc_put_userptr()
  media: platform: mtk-mdp3: fix uninitialized variable in mdp_path_config()
  media: mediatek: vcodec: using encoder device to alloc/free encoder memory
  media: imx-jpeg: notify source chagne event when the first picture parsed
  media: cx231xx: Use EP5_BUF_SIZE macro
  media: siano: Drop unnecessary error check for debugfs_create_dir/file()
  media: mediatek: vcodec: Handle invalid encoder vsi
  media: aspeed: Drop unnecessary error check for debugfs_create_file()
  Documentation: media: buffer.rst: fix V4L2_BUF_FLAG_PREPARED
  Documentation: media: gen-errors.rst: fix confusing ENOTTY description
  ...

Pull RTC updates from Alexandre Belloni:
 "There is a new driver for the RTC of the Mstar SSD202D SoC. The
  rtc7301 driver gains support for byte addresses to support the
  USRobotics USR8200. Then we have many non user visible changes and
  typo fixes.

  Summary:

  Subsytem:
   - convert platform drivers to remove_new
   - prevent modpost warnings for unremovable platform drivers

  New driver:
   - Mstar SSD202D

  Drivers:
   - brcmstb-waketimer: support level alarm_irq
   - ep93xx: add DT support
   - rtc7301: support byte-addressed IO"

* tag 'rtc-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (28 commits)
  dt-bindings: rtc: Add Mstar SSD202D RTC
  rtc: Add support for the SSD202D RTC
  rtc: at91rm9200: annotate at91_rtc_remove with __exit again
  dt-bindings: rtc: microcrystal,rv3032: Document wakeup-source property
  dt-bindings: rtc: pcf8523: Convert to YAML
  dt-bindings: rtc: mcp795: move to trivial-rtc
  rtc: ep93xx: add DT support for Cirrus EP93xx
  dt-bindings: rtc: Add Cirrus EP93xx
  dt-bindings: rtc: pcf2123: convert to YAML
  rtc: efi: fixed typo in efi_procfs()
  rtc: omap: Use device_get_match_data()
  rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
  rtc: rtc7301: Support byte-addressed IO
  rtc: rtc7301: Rewrite bindings in schema
  rtc: sh: Convert to platform remove callback returning void
  rtc: pxa: Convert to platform remove callback returning void
  rtc: mv: Convert to platform remove callback returning void
  rtc: imxdi: Convert to platform remove callback returning void
  rtc: at91rm9200: Convert to platform remove callback returning void
  rtc: pcap: Drop no-op remove function
  ...

Pull mailbox updates from Jassi Brar:

 - imx: add support for TX Doorbell v2

 - mtk: implement runtime PM

 - zynqmp: add destination mailbox compatible

 - qcom:
    - add another clock provider for IPQ
    - add SM8650 compatible

 - misc: use preferred device_get_match_data()

* tag 'mailbox-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  dt-bindings: mailbox: qcom-ipcc: document the SM8650 Inter-Processor Communication Controller
  mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend
  mailbox: Use device_get_match_data()
  dt-bindings: zynqmp: add destination mailbox compatible
  dt-bindings: mailbox: qcom: add one more clock provider for IPQ mailbox
  mailbox: imx: support channel type tx doorbell v2
  dt-bindings: mailbox: fsl,mu: add new tx doorbell channel

Pull virtio updates from Michael Tsirkin:
 "vhost,virtio,vdpa: features, fixes, cleanups.

  vdpa/mlx5:
   - VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK
   - new maintainer

  vdpa:
   - support for vq descriptor mappings
   - decouple reset of iotlb mapping from device reset

  and fixes, cleanups all over the place"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (34 commits)
  vdpa_sim: implement .reset_map support
  vdpa/mlx5: implement .reset_map driver op
  vhost-vdpa: clean iotlb map during reset for older userspace
  vdpa: introduce .compat_reset operation callback
  vhost-vdpa: introduce IOTLB_PERSIST backend feature bit
  vhost-vdpa: reset vendor specific mapping to initial state in .release
  vdpa: introduce .reset_map operation callback
  virtio_pci: add check for common cfg size
  virtio-blk: fix implicit overflow on virtio_max_dma_size
  virtio_pci: add build offset check for the new common cfg items
  virtio: add definition of VIRTIO_F_NOTIF_CONFIG_DATA feature bit
  vduse: make vduse_class constant
  vhost-scsi: Spelling s/preceeding/preceding/g
  virtio: kdoc for struct virtio_pci_modern_device
  vdpa: Update sysfs ABI documentation
  MAINTAINERS: Add myself as mlx5_vdpa driver
  virtio-balloon: correct the comment of virtballoon_migratepage()
  mlx5_vdpa: offer VHOST_BACKEND_F_ENABLE_AFTER_DRIVER_OK
  vdpa/mlx5: Update cvq iotlb mapping on ASID change
  vdpa/mlx5: Make iotlb helper functions more generic
  ...

Merge tag 'firewire-updates-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire update from Takashi Sakamoto:
 "A slight change for flexible length of array in core function.

  Kees Cook provides a patch to annotate the array embedded in fw_node
  structure referring to structure member for the length of array. The
  annotation would be defined by future extension of C compilers, and
  used for access bound-check at run-time enabled by UBSAN and
  FORTIFY_SOURCE"

* tag 'firewire-updates-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: Annotate struct fw_node with __counted_by

Pull i2c updates from Wolfram Sang:
 "I2C has largely driver updates for 6.7, i.e. feature additions (like
  adding transfers while in atomic mode), using new helpers (like
  devm_clk_get_enabled), new IDs, documentation fixes and additions...
  you name it.

  The core got a memleak fix and better support for nested muxes"

* tag 'i2c-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (53 commits)
  i2c: s3c2410: make i2c_s3c_irq_nextbyte() void
  i2c: qcom-geni: add ACPI device id for sc8180x
  Documentation: i2c: add fault code for not supporting 10 bit addresses
  i2c: sun6i-p2wi: Prevent potential division by zero
  i2c: mux: demux-pinctrl: Convert to use sysfs_emit_at() API
  i2c: i801: Use new helper acpi_use_parent_companion
  ACPI: Add helper acpi_use_parent_companion
  MAINTAINERS: add YAML file for i2c-demux-pinctrl
  i2c: core: fix lockdep warning for sparsely nested adapter chain
  i2c: axxia: eliminate kernel-doc warnings
  dt-bindings: i2c: i2c-demux-pinctrl: Convert to json-schema
  i2c: stm32f7: Use devm_clk_get_enabled()
  i2c: stm32f4: Use devm_clk_get_enabled()
  i2c: stm32f7: add description of atomic in struct stm32f7_i2c_dev
  i2c: fix memleak in i2c_new_client_device()
  i2c: exynos5: Calculate t_scl_l, t_scl_h according to i2c spec
  i2c: i801: Simplify class-based client device instantiation
  i2c: exynos5: add support for atomic transfers
  i2c: at91-core: Use devm_clk_get_enabled()
  eeprom: at24: add ST M24C64-D Additional Write lockable page support
  ...

Pull UBI and UBIFS updates from Richard Weinberger:

 - UBI Fastmap improvements

 - Minor issues found by static analysis bots in both UBI and UBIFS

 - Fix for wrong dentry length UBIFS in fscrypt mode

* tag 'ubifs-for-linus-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted
  ubi: block: Fix use-after-free in ubiblock_cleanup
  ubifs: fix possible dereference after free
  ubi: fastmap: Add control in 'UBI_IOCATT' ioctl to reserve PEBs for filling pools
  ubi: fastmap: Add module parameter to control reserving filling pool PEBs
  ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
  ubi: fastmap: Get wl PEB even ec beyonds the 'max' if free PEBs are run out
  ubi: fastmap: may_reserve_for_fm: Don't reserve PEB if fm_anchor exists
  ubi: fastmap: Remove unneeded break condition while filling pools
  ubi: fastmap: Wait until there are enough free PEBs before filling pools
  ubi: fastmap: Use free pebs reserved for bad block handling
  ubi: Replace erase_block() with sync_erase()
  ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
  ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
  ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
  ubifs: Fix missing error code err
  ubifs: Fix memory leak of bud->log_hash
  ubifs: Fix some kernel-doc comments

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
(for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

As found with Coccinelle[1], add __counted_by for struct fw_node.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: linux1394-devel@lists.sourceforge.net
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20230922175334.work.335-kees@kernel.orgSigned-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

Pull i3c updates from Alexandre Belloni:
 "There are now more fixes because as stated in my previous pull
  request, people now have access to actual hardware.

  Core:

   - handle IBI in the proper order

  Drivers:

   - cdns: fix status register access

   - mipi-i3c-hci: many fixes now that the driver has been actually
     tested

   - svc: many IBI fixes, correct compatible string, fix hot join corner
     cases"

* tag 'i3c/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (29 commits)
  i3c: master: handle IBIs in order they came
  i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
  i3c: master: svc: fix compatibility string mismatch with binding doc
  i3c: master: svc: fix random hot join failure since timeout error
  i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen
  i3c: master: svc: fix check wrong status register in irq handler
  i3c: master: svc: fix ibi may not return mandatory data byte
  i3c: master: svc: fix wrong data return when IBI happen during start frame
  i3c: master: svc: fix race condition in ibi work thread
  i3c: Fix typo "Provisional ID" to "Provisioned ID"
  i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
  i3c: mipi-i3c-hci: Resume controller after aborted transfer
  i3c: mipi-i3c-hci: Resume controller explicitly
  i3c: mipi-i3c-hci: Fix missing xfer->completion in hci_cmd_v1_daa()
  i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
  i3c: mipi-i3c-hci: Set number of SW enabled Ring Bundles earlier
  i3c: mipi-i3c-hci: Fix race between bus cleanup and interrupt
  i3c: mipi-i3c-hci: Set ring start request together with enable
  i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
  i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
  ...

Pull CXL (Compute Express Link) updates from Dan Williams:
 "The main new functionality this time is work to allow Linux to
  natively handle CXL link protocol errors signalled via PCIe AER for
  current generation CXL platforms. This required some enlightenment of
  the PCIe AER core to workaround the fact that current generation RCH
  (Restricted CXL Host) platforms physically hide topology details and
  registers via a mechanism called RCRB (Root Complex Register Block).

  The next major highlight is reworks to address bugs in parsing region
  configurations for next generation VH (Virtual Host) topologies. The
  old broken algorithm is replaced with a simpler one that significantly
  increases the number of region configurations supported by Linux. This
  is again relevant for error handling so that forward and reverse
  address translation of memory errors can be carried out by Linux for
  memory regions instantiated by platform firmware.

  As for other cross-tree work, the ACPI table parsing code has been
  refactored for reuse parsing the "CDAT" structure which is an
  ACPI-like data structure that is reported by CXL devices. That work is
  in preparation for v6.8 support for CXL QoS. Think of this as dynamic
  generation of NUMA node topology information generated by Linux rather
  than platform firmware.

  Lastly, a number of internal object lifetime issues have been resolved
  along with misc. fixes and feature updates (decoders_committed sysfs
  ABI).

  Summary:

   - Add support for RCH (Restricted CXL Host) Error recovery

   - Fix several region assembly bugs

   - Fix mem-device lifetime issues relative to the sanitize command and
     RCH topology.

   - Refactor ACPI table parsing for CDAT parsing re-use in preparation
     for CXL QOS support"

* tag 'cxl-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (50 commits)
  lib/fw_table: Remove acpi_parse_entries_array() export
  cxl/pci: Change CXL AER support check to use native AER
  cxl/hdm: Remove broken error path
  cxl/hdm: Fix && vs || bug
  acpi: Move common tables helper functions to common lib
  cxl: Add support for reading CXL switch CDAT table
  cxl: Add checksum verification to CDAT from CXL
  cxl: Export QTG ids from CFMWS to sysfs as qos_class attribute
  cxl: Add decoders_committed sysfs attribute to cxl_port
  cxl: Add cxl_decoders_committed() helper
  cxl/core/regs: Rework cxl_map_pmu_regs() to use map->dev for devm
  cxl/core/regs: Rename phys_addr in cxl_map_component_regs()
  PCI/AER: Unmask RCEC internal errors to enable RCH downstream port error handling
  PCI/AER: Forward RCH downstream port-detected errors to the CXL.mem dev handler
  cxl/pci: Disable root port interrupts in RCH mode
  cxl/pci: Add RCH downstream port error logging
  cxl/pci: Map RCH downstream AER registers for logging protocol errors
  cxl/pci: Update CXL error logging to use RAS register address
  PCI/AER: Refactor cper_print_aer() for use by CXL driver module
  cxl/pci: Add RCH downstream port AER register discovery
  ...

Pull unified attestation reporting from Dan Williams:
 "In an ideal world there would be a cross-vendor standard attestation
  report format for confidential guests along with a common device
  definition to act as the transport.

  In the real world the situation ended up with multiple platform
  vendors inventing their own attestation report formats with the
  SEV-SNP implementation being a first mover to define a custom
  sev-guest character device and corresponding ioctl(). Later, this
  configfs-tsm proposal intercepted an attempt to add a tdx-guest
  character device and a corresponding new ioctl(). It also anticipated
  ARM and RISC-V showing up with more chardevs and more ioctls().

  The proposal takes for granted that Linux tolerates the vendor report
  format differentiation until a standard arrives. From talking with
  folks involved, it sounds like that standardization work is unlikely
  to resolve anytime soon. It also takes the position that kernfs ABIs
  are easier to maintain than ioctl(). The result is a shared configfs
  mechanism to return per-vendor report-blobs with the option to later
  support a standard when that arrives.

  Part of the goal here also is to get the community into the
  "uncomfortable, but beneficial to the long term maintainability of the
  kernel" state of talking to each other about their differentiation and
  opportunities to collaborate. Think of this like the device-driver
  equivalent of the common memory-management infrastructure for
  confidential-computing being built up in KVM.

  As for establishing an "upstream path for cross-vendor
  confidential-computing device driver infrastructure" this is something
  I want to discuss at Plumbers. At present, the multiple vendor
  proposals for assigning devices to confidential computing VMs likely
  needs a new dedicated repository and maintainer team, but that is a
  discussion for v6.8.

  For now, Greg and Thomas have acked this approach and this is passing
  is AMD, Intel, and Google tests.

  Summary:

   - Introduce configfs-tsm as a shared ABI for confidential computing
     attestation reports

   - Convert sev-guest to additionally support configfs-tsm alongside
     its vendor specific ioctl()

   - Added signed attestation report retrieval to the tdx-guest driver
     forgoing a new vendor specific ioctl()

   - Misc cleanups and a new __free() annotation for kvfree()"

* tag 'tsm-for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux:
  virt: tdx-guest: Add Quote generation support using TSM_REPORTS
  virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT
  mm/slab: Add __free() support for kvfree
  virt: sevguest: Prep for kernel internal get_ext_report()
  configfs-tsm: Introduce a shared ABI for attestation reports
  virt: coco: Add a coco/Makefile and coco/Kconfig
  virt: sevguest: Fix passing a stack buffer as a scatterlist target

Pull mtd updates from Miquel Raynal:
 "The main set of changes is related to Uwe's work converting platform
  remove callbacks to return void. Comes next (in number of changes)
  Kees' additional structures annotations to improve the sanitizers. The
  usual amount of cleanups apply.

  About the more substancial contribution, one main function of the
  partitions core could return an error which was not checked, this is
  now fixed. On the bindings side, fixed partitions can now have a
  compression property. Finally, an erroneous situation is now always
  avoided in the MAP RAM driver.

  CFI:

   - A several years old byte swap has been fixed.

  NAND:

   - The subsystem has, as usual, seen a bit of cleanup being done this
     cycle, typically return values of platform_get_irq() and
     devm_kasprintf(). There is also a better ECC check in the Arasan
     driver. This comes with smaller misc changes.

   - In the SPI-NAND world there is now support for Foresee F35SQA002G,
     Winbond W25N and XTX XT26 chips.

  SPI NOR:

   - For SPI NOR we cleaned the flash info entries in order to have them
     slimmer and self explanatory. In order to make the entries as slim
     as possible, we introduced sane default values so that the actual
     flash entries don't need to specify them. We now use a flexible
     macro to specify the flash ID instead of the previous INFOx()
     macros that had hardcoded ID lengths.

     Instead of:

         { "w25q512nwm", INFO(0xef8020, 0, 64 * 1024, 0)
                 OTP_INFO(256, 3, 0x1000, 0x1000) },

     We now use:

         .id = SNOR_ID(0xef, 0x80, 0x20),
         .name = "w25q512nwm",
         .otp = SNOR_OTP(256, 3, 0x1000, 0x1000),

   - We also removed some flash entries: the very old Catalyst SPI
     EEPROMs that were introduced once with the SPI-NOR subsystem, and a
     Fujitsu MRAM. Both should use the at25 EEPROM driver. The latter
     even has device tree bindings for the at25 driver.

   - We made sure that the conversion didn't introduce any unwanted
     changes by comparing the .rodata segment before and after the
     conversion. The patches landed in linux-next immediately after
     v6.6-rc2, we haven't seen any regressions yet.

   - Apart of the autumn cleaning we introduced a new flash entry,
     at25ff321a, and added block protection support for mt25qu512a"

* tag 'mtd/for-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (91 commits)
  mtd: cfi_cmdset_0001: Byte swap OTP info
  mtd: rawnand: meson: check return value of devm_kasprintf()
  mtd: rawnand: intel: check return value of devm_kasprintf()
  mtd: rawnand: sh_flctl: Convert to module_platform_driver()
  mtd: spi-nor: micron-st: use SFDP table for mt25qu512a
  mtd: spi-nor: micron-st: enable lock/unlock for mt25qu512a
  mtd: rawnand: Remove unused of_gpio.h inclusion
  mtd: spinand: Add support for XTX XT26xxxDxxxxx
  mtd: spinand: winbond: add support for serial NAND flash
  mtd: rawnand: cadence: Annotate struct cdns_nand_chip with __counted_by
  mtd: rawnand: Annotate struct mtk_nfc_nand_chip with __counted_by
  mtd: spinand: add support for FORESEE F35SQA002G
  mtd: rawnand: rockchip: Use struct_size()
  mtd: rawnand: arasan: Include ECC syndrome along with in-band data while checking for ECC failure
  mtd: Use device_get_match_data()
  mtd: spi-nor: nxp-spifi: Convert to platform remove callback returning void
  mtd: spi-nor: hisi-sfc: Convert to platform remove callback returning void
  mtd: maps: sun_uflash: Convert to platform remove callback returning void
  mtd: maps: sa1100-flash: Convert to platform remove callback returning void
  mtd: maps: pxa2xx-flash: Convert to platform remove callback returning void
  ...

Pull drm nouveau GSP support from Dave Airlie:
 "This adds the initial support for the NVIDIA GSP firmware to nouveau.

  This firmware is a new direction for Turing+ GPUs, and is only enabled
  by default on Ada generation. Other generations need to use
  nouveau.config=NvGspRm=1

  The GSP firmware takes nearly all the GPU init and power management
  tasks onto a risc-v CPU on the GPU.

  This series is mostly the work from Ben Skeggs, and Dave added some
  patches to rebase it to the latest firmware release which is where we
  will stay for as long as possible as the firmwares have no ABI
  stability"

* tag 'topic/nvidia-gsp-2023-11-03' of git://anongit.freedesktop.org/drm/drm: (49 commits)
  nouveau/gsp: add some basic registry entries.
  nouveau/gsp: fix message signature.
  nouveau/gsp: move to 535.113.01
  nouveau/disp: fix post-gsp build on 32-bit arm.
  nouveau: fix r535 build on 32-bit arm.
  drm/nouveau/ofa/r535: initial support
  drm/nouveau/nvjpg/r535: initial support
  drm/nouveau/nvenc/r535: initial support
  drm/nouveau/nvdec/r535: initial support
  drm/nouveau/gr/r535: initial support
  drm/nouveau/ce/r535: initial support
  drm/nouveau/fifo/r535: initial support
  drm/nouveau/disp/r535: initial support
  drm/nouveau/mmu/r535: initial support
  drm/nouveau/gsp/r535: add interrupt handling
  drm/nouveau/gsp/r535: add support for rm alloc
  drm/nouveau/gsp/r535: add support for rm control
  drm/nouveau/gsp/r535: add support for booting GSP-RM
  drm/nouveau/nvkm: support loading fws into sg_table
  drm/nouveau/kms/tu102-: disable vbios parsing when running on RM
  ...

Pull f2fs updates from Jaegeuk Kim:
 "In this cycle, we introduce a bigger page size support by changing the
  internal f2fs's block size aligned to the page size. We also continue
  to improve zoned block device support regarding the power off
  recovery. As usual, there are some bug fixes regarding the error
  handling routines in compression and ioctl.

  Enhancements:
   - Support Block Size == Page Size
   - let f2fs_precache_extents() traverses in file range
   - stop iterating f2fs_map_block if hole exists
   - preload extent_cache for POSIX_FADV_WILLNEED
   - compress: fix to avoid fragment w/ OPU during f2fs_ioc_compress_file()

  Bug fixes:
   - do not return EFSCORRUPTED, but try to run online repair
   - finish previous checkpoints before returning from remount
   - fix error handling of __get_node_page and __f2fs_build_free_nids
   - clean up zones when not successfully unmounted
   - fix to initialize map.m_pblk in f2fs_precache_extents()
   - fix to drop meta_inode's page cache in f2fs_put_super()
   - set the default compress_level on ioctl
   - fix to avoid use-after-free on dic
   - fix to avoid redundant compress extension
   - do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on
   - fix deadloop in f2fs_write_cache_pages()"

* tag 'f2fs-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs:
  f2fs: finish previous checkpoints before returning from remount
  f2fs: fix error handling of __get_node_page
  f2fs: do not return EFSCORRUPTED, but try to run online repair
  f2fs: fix error path of __f2fs_build_free_nids
  f2fs: Clean up errors in segment.h
  f2fs: clean up zones when not successfully unmounted
  f2fs: let f2fs_precache_extents() traverses in file range
  f2fs: avoid format-overflow warning
  f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
  f2fs: Support Block Size == Page Size
  f2fs: stop iterating f2fs_map_block if hole exists
  f2fs: preload extent_cache for POSIX_FADV_WILLNEED
  f2fs: set the default compress_level on ioctl
  f2fs: compress: fix to avoid fragment w/ OPU during f2fs_ioc_compress_file()
  f2fs: fix to drop meta_inode's page cache in f2fs_put_super()
  f2fs: split initial and dynamic conditions for extent_cache
  f2fs: compress: fix to avoid redundant compress extension
  f2fs: compress: do sanity check on cluster when CONFIG_F2FS_CHECK_FS is on
  f2fs: compress: fix to avoid use-after-free on dic
  f2fs: compress: fix deadloop in f2fs_write_cache_pages()

Pull 9p updates from Dominique Martinet:
 A bunch of small fixes:

   - three W=1 warning fixes: the NULL -> "" replacement isn't trivial
     but is serialized identically by the protocol layer and has been
     tested

   - one syzbot/KCSAN datarace annotation where we don't care about
     users messing with the fd they passed to mount -t 9p

   - removing a declaration without implementation

   - yet another race fix for trans_fd around connection close: the
     'err' field is also used in potentially racy calls and this isn't
     complete, but it's better than what we had

   - and finally a theorical memory leak fix on serialization failure"

* tag '9p-for-6.7-rc1' of https://github.com/martinetd/linux:
  9p/net: fix possible memory leak in p9_check_errors()
  9p/fs: add MODULE_DESCRIPTION
  9p/net: xen: fix false positive printf format overflow warning
  9p: v9fs_listxattr: fix %s null argument warning
  9p/trans_fd: Annotate data-racy writes to file::f_flags
  fs/9p: Remove unused function declaration v9fs_inode2stat()
  9p/trans_fd: avoid sending req to a cancelled conn

Pull smb client updates from Steve French:

 - use after free fixes and deadlock fix

 - symlink timestamp fix

 - hashing perf improvement

 - multichannel fixes

 - minor debugging improvements

 - fix creating fifos when using "sfu" mounts

 - NTLMSSP authentication improvement

 - minor fixes to include some missing create flags and structures from
   recently updated protocol documentation

* tag '6.7-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: force interface update before a fresh session setup
  cifs: do not reset chan_max if multichannel is not supported at mount
  cifs: reconnect helper should set reconnect for the right channel
  smb: client: fix use-after-free in smb2_query_info_compound()
  smb: client: remove extra @chan_count check in __cifs_put_smb_ses()
  cifs: add xid to query server interface call
  cifs: print server capabilities in DebugData
  smb: use crypto_shash_digest() in symlink_hash()
  smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  smb: client: fix potential deadlock when releasing mids
  smb3: fix creating FIFOs when mounting with "sfu" mount option
  Add definition for new smb3.1.1 command type
  SMB3: clarify some of the unused CreateOption flags
  cifs: Add client version details to NTLM authenticate message
  smb3: fix touch -h of symlink

Pull EFI update from Ard Biesheuvel:
 "This is the only remaining EFI change, as everything else was taken
  via -tip this cycle:

   - implement uid/gid mount options for efivarfs"

* tag 'efi-next-for-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efivarfs: Add uid/gid mount options