--- /dev/null
+From 256420042f01ed27db787f85895b4af6cedc88b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 00:34:11 +0200
+Subject: cifs: fix negotiate context parsing
+
+From: David Disseldorp <ddiss@suse.de>
+
+[ Upstream commit 5105a7ffce19160e7062aee67fb6b3b8a1b56d78 ]
+
+smb311_decode_neg_context() doesn't properly check against SMB packet
+boundaries prior to accessing individual negotiate context entries. This
+is due to the length check omitting the eight byte smb2_neg_context
+header, as well as incorrect decrementing of len_of_ctxts.
+
+Fixes: 5100d8a3fe03 ("SMB311: Improve checking of negotiate security contexts")
+Reported-by: Volker Lendecke <vl@samba.org>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 41 +++++++++++++++++++++++++++++++----------
+ 1 file changed, 31 insertions(+), 10 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index b37379b62cc77..ab59faf8a06a7 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -588,11 +588,15 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,
+
+ }
+
++/* If invalid preauth context warn but use what we requested, SHA-512 */
+ static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
+ {
+ unsigned int len = le16_to_cpu(ctxt->DataLength);
+
+- /* If invalid preauth context warn but use what we requested, SHA-512 */
++ /*
++ * Caller checked that DataLength remains within SMB boundary. We still
++ * need to confirm that one HashAlgorithms member is accounted for.
++ */
+ if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
+ pr_warn_once("server sent bad preauth context\n");
+ return;
+@@ -611,7 +615,11 @@ static void decode_compress_ctx(struct TCP_Server_Info *server,
+ {
+ unsigned int len = le16_to_cpu(ctxt->DataLength);
+
+- /* sizeof compress context is a one element compression capbility struct */
++ /*
++ * Caller checked that DataLength remains within SMB boundary. We still
++ * need to confirm that one CompressionAlgorithms member is accounted
++ * for.
++ */
+ if (len < 10) {
+ pr_warn_once("server sent bad compression cntxt\n");
+ return;
+@@ -633,6 +641,11 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server,
+ unsigned int len = le16_to_cpu(ctxt->DataLength);
+
+ cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len);
++ /*
++ * Caller checked that DataLength remains within SMB boundary. We still
++ * need to confirm that one Cipher flexible array member is accounted
++ * for.
++ */
+ if (len < MIN_ENCRYPT_CTXT_DATA_LEN) {
+ pr_warn_once("server sent bad crypto ctxt len\n");
+ return -EINVAL;
+@@ -679,6 +692,11 @@ static void decode_signing_ctx(struct TCP_Server_Info *server,
+ {
+ unsigned int len = le16_to_cpu(pctxt->DataLength);
+
++ /*
++ * Caller checked that DataLength remains within SMB boundary. We still
++ * need to confirm that one SigningAlgorithms flexible array member is
++ * accounted for.
++ */
+ if ((len < 4) || (len > 16)) {
+ pr_warn_once("server sent bad signing negcontext\n");
+ return;
+@@ -720,14 +738,19 @@ static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
+ for (i = 0; i < ctxt_cnt; i++) {
+ int clen;
+ /* check that offset is not beyond end of SMB */
+- if (len_of_ctxts == 0)
+- break;
+-
+ if (len_of_ctxts < sizeof(struct smb2_neg_context))
+ break;
+
+ pctx = (struct smb2_neg_context *)(offset + (char *)rsp);
+- clen = le16_to_cpu(pctx->DataLength);
++ clen = sizeof(struct smb2_neg_context)
++ + le16_to_cpu(pctx->DataLength);
++ /*
++ * 2.2.4 SMB2 NEGOTIATE Response
++ * Subsequent negotiate contexts MUST appear at the first 8-byte
++ * aligned offset following the previous negotiate context.
++ */
++ if (i + 1 != ctxt_cnt)
++ clen = ALIGN(clen, 8);
+ if (clen > len_of_ctxts)
+ break;
+
+@@ -748,12 +771,10 @@ static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
+ else
+ cifs_server_dbg(VFS, "unknown negcontext of type %d ignored\n",
+ le16_to_cpu(pctx->ContextType));
+-
+ if (rc)
+ break;
+- /* offsets must be 8 byte aligned */
+- clen = ALIGN(clen, 8);
+- offset += clen + sizeof(struct smb2_neg_context);
++
++ offset += clen;
+ len_of_ctxts -= clen;
+ }
+ return rc;
+--
+2.39.2
+
--- /dev/null
+From 0604dd355f159234568a53256d54b4cfd376472a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 19:52:37 +0530
+Subject: i2c: mchp-pci1xxxx: Update Timing registers
+
+From: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+
+[ Upstream commit aa874cdfec07d4dd9c6f0c356d65c609ba31a26f ]
+
+Update I2C timing registers based on latest hardware design.
+This fix does not break functionality of chips with older design and
+existing users will not be affected.
+
+Fixes: 361693697249 ("i2c: microchip: pci1xxxx: Add driver for I2C host controller in multifunction endpoint of pci1xxxx switch")
+Signed-off-by: Tharun Kumar P <tharunkumar.pasumarthi@microchip.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mchp-pci1xxxx.c | 60 +++++++++++++-------------
+ 1 file changed, 30 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
+index 09af759211478..b21ffd6df9276 100644
+--- a/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
++++ b/drivers/i2c/busses/i2c-mchp-pci1xxxx.c
+@@ -48,9 +48,9 @@
+ * SR_HOLD_TIME_XK_TICKS field will indicate the number of ticks of the
+ * baud clock required to program 'Hold Time' at X KHz.
+ */
+-#define SR_HOLD_TIME_100K_TICKS 133
+-#define SR_HOLD_TIME_400K_TICKS 20
+-#define SR_HOLD_TIME_1000K_TICKS 11
++#define SR_HOLD_TIME_100K_TICKS 150
++#define SR_HOLD_TIME_400K_TICKS 20
++#define SR_HOLD_TIME_1000K_TICKS 12
+
+ #define SMB_CORE_COMPLETION_REG_OFF3 (SMBUS_MAST_CORE_ADDR_BASE + 0x23)
+
+@@ -65,17 +65,17 @@
+ * the baud clock required to program 'fair idle delay' at X KHz. Fair idle
+ * delay establishes the MCTP T(IDLE_DELAY) period.
+ */
+-#define FAIR_BUS_IDLE_MIN_100K_TICKS 969
+-#define FAIR_BUS_IDLE_MIN_400K_TICKS 157
+-#define FAIR_BUS_IDLE_MIN_1000K_TICKS 157
++#define FAIR_BUS_IDLE_MIN_100K_TICKS 992
++#define FAIR_BUS_IDLE_MIN_400K_TICKS 500
++#define FAIR_BUS_IDLE_MIN_1000K_TICKS 500
+
+ /*
+ * FAIR_IDLE_DELAY_XK_TICKS field will indicate the number of ticks of the
+ * baud clock required to satisfy the fairness protocol at X KHz.
+ */
+-#define FAIR_IDLE_DELAY_100K_TICKS 1000
+-#define FAIR_IDLE_DELAY_400K_TICKS 500
+-#define FAIR_IDLE_DELAY_1000K_TICKS 500
++#define FAIR_IDLE_DELAY_100K_TICKS 963
++#define FAIR_IDLE_DELAY_400K_TICKS 156
++#define FAIR_IDLE_DELAY_1000K_TICKS 156
+
+ #define SMB_IDLE_SCALING_100K \
+ ((FAIR_IDLE_DELAY_100K_TICKS << 16) | FAIR_BUS_IDLE_MIN_100K_TICKS)
+@@ -105,7 +105,7 @@
+ */
+ #define BUS_CLK_100K_LOW_PERIOD_TICKS 156
+ #define BUS_CLK_400K_LOW_PERIOD_TICKS 41
+-#define BUS_CLK_1000K_LOW_PERIOD_TICKS 15
++#define BUS_CLK_1000K_LOW_PERIOD_TICKS 15
+
+ /*
+ * BUS_CLK_XK_HIGH_PERIOD_TICKS field defines the number of I2C Baud Clock
+@@ -131,7 +131,7 @@
+ */
+ #define CLK_SYNC_100K 4
+ #define CLK_SYNC_400K 4
+-#define CLK_SYNC_1000K 4
++#define CLK_SYNC_1000K 4
+
+ #define SMB_CORE_DATA_TIMING_REG_OFF (SMBUS_MAST_CORE_ADDR_BASE + 0x40)
+
+@@ -142,25 +142,25 @@
+ * determines the SCLK hold time following SDAT driven low during the first
+ * START bit in a transfer.
+ */
+-#define FIRST_START_HOLD_100K_TICKS 22
+-#define FIRST_START_HOLD_400K_TICKS 16
+-#define FIRST_START_HOLD_1000K_TICKS 6
++#define FIRST_START_HOLD_100K_TICKS 23
++#define FIRST_START_HOLD_400K_TICKS 8
++#define FIRST_START_HOLD_1000K_TICKS 12
+
+ /*
+ * STOP_SETUP_XK_TICKS will indicate the number of ticks of the baud clock
+ * required to program 'STOP_SETUP' timer at X KHz. This timer determines the
+ * SDAT setup time from the rising edge of SCLK for a STOP condition.
+ */
+-#define STOP_SETUP_100K_TICKS 157
++#define STOP_SETUP_100K_TICKS 150
+ #define STOP_SETUP_400K_TICKS 20
+-#define STOP_SETUP_1000K_TICKS 12
++#define STOP_SETUP_1000K_TICKS 12
+
+ /*
+ * RESTART_SETUP_XK_TICKS will indicate the number of ticks of the baud clock
+ * required to program 'RESTART_SETUP' timer at X KHz. This timer determines the
+ * SDAT setup time from the rising edge of SCLK for a repeated START condition.
+ */
+-#define RESTART_SETUP_100K_TICKS 157
++#define RESTART_SETUP_100K_TICKS 156
+ #define RESTART_SETUP_400K_TICKS 20
+ #define RESTART_SETUP_1000K_TICKS 12
+
+@@ -169,7 +169,7 @@
+ * required to program 'DATA_HOLD' timer at X KHz. This timer determines the
+ * SDAT hold time following SCLK driven low.
+ */
+-#define DATA_HOLD_100K_TICKS 2
++#define DATA_HOLD_100K_TICKS 12
+ #define DATA_HOLD_400K_TICKS 2
+ #define DATA_HOLD_1000K_TICKS 2
+
+@@ -190,35 +190,35 @@
+ * Bus Idle Minimum time = BUS_IDLE_MIN[7:0] x Baud_Clock_Period x
+ * (BUS_IDLE_MIN_XK_TICKS[7] ? 4,1)
+ */
+-#define BUS_IDLE_MIN_100K_TICKS 167UL
+-#define BUS_IDLE_MIN_400K_TICKS 139UL
+-#define BUS_IDLE_MIN_1000K_TICKS 133UL
++#define BUS_IDLE_MIN_100K_TICKS 36UL
++#define BUS_IDLE_MIN_400K_TICKS 10UL
++#define BUS_IDLE_MIN_1000K_TICKS 4UL
+
+ /*
+ * CTRL_CUM_TIME_OUT_XK_TICKS defines SMBus Controller Cumulative Time-Out.
+ * SMBus Controller Cumulative Time-Out duration =
+ * CTRL_CUM_TIME_OUT_XK_TICKS[7:0] x Baud_Clock_Period x 2048
+ */
+-#define CTRL_CUM_TIME_OUT_100K_TICKS 159
+-#define CTRL_CUM_TIME_OUT_400K_TICKS 159
+-#define CTRL_CUM_TIME_OUT_1000K_TICKS 159
++#define CTRL_CUM_TIME_OUT_100K_TICKS 76
++#define CTRL_CUM_TIME_OUT_400K_TICKS 76
++#define CTRL_CUM_TIME_OUT_1000K_TICKS 76
+
+ /*
+ * TARGET_CUM_TIME_OUT_XK_TICKS defines SMBus Target Cumulative Time-Out duration.
+ * SMBus Target Cumulative Time-Out duration = TARGET_CUM_TIME_OUT_XK_TICKS[7:0] x
+ * Baud_Clock_Period x 4096
+ */
+-#define TARGET_CUM_TIME_OUT_100K_TICKS 199
+-#define TARGET_CUM_TIME_OUT_400K_TICKS 199
+-#define TARGET_CUM_TIME_OUT_1000K_TICKS 199
++#define TARGET_CUM_TIME_OUT_100K_TICKS 95
++#define TARGET_CUM_TIME_OUT_400K_TICKS 95
++#define TARGET_CUM_TIME_OUT_1000K_TICKS 95
+
+ /*
+ * CLOCK_HIGH_TIME_OUT_XK defines Clock High time out period.
+ * Clock High time out period = CLOCK_HIGH_TIME_OUT_XK[7:0] x Baud_Clock_Period x 8
+ */
+-#define CLOCK_HIGH_TIME_OUT_100K_TICKS 204
+-#define CLOCK_HIGH_TIME_OUT_400K_TICKS 204
+-#define CLOCK_HIGH_TIME_OUT_1000K_TICKS 204
++#define CLOCK_HIGH_TIME_OUT_100K_TICKS 97
++#define CLOCK_HIGH_TIME_OUT_400K_TICKS 97
++#define CLOCK_HIGH_TIME_OUT_1000K_TICKS 97
+
+ #define TO_SCALING_100K \
+ ((BUS_IDLE_MIN_100K_TICKS << 24) | (CTRL_CUM_TIME_OUT_100K_TICKS << 16) | \
+--
+2.39.2
+
--- /dev/null
+From 8123ad81397520a57cbca790541d0c0f8c5f2c11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 11:37:37 +0200
+Subject: i2c: ocores: generate stop condition after timeout in polling mode
+
+From: Gregor Herburger <gregor.herburger@tq-group.com>
+
+[ Upstream commit f8160d3b35fc94491bb0cb974dbda310ef96c0e2 ]
+
+In polling mode, no stop condition is generated after a timeout. This
+causes SCL to remain low and thereby block the bus. If this happens
+during a transfer it can cause slaves to misinterpret the subsequent
+transfer and return wrong values.
+
+To solve this, pass the ETIMEDOUT error up from ocores_process_polling()
+instead of setting STATE_ERROR directly. The caller is adjusted to call
+ocores_process_timeout() on error both in polling and in IRQ mode, which
+will set STATE_ERROR and generate a stop condition.
+
+Fixes: 69c8c0c0efa8 ("i2c: ocores: add polling interface")
+Signed-off-by: Gregor Herburger <gregor.herburger@tq-group.com>
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Acked-by: Peter Korsgaard <peter@korsgaard.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Federico Vaga <federico.vaga@cern.ch>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-ocores.c | 35 ++++++++++++++++++---------------
+ 1 file changed, 19 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
+index a0af027db04c1..2e575856c5cd5 100644
+--- a/drivers/i2c/busses/i2c-ocores.c
++++ b/drivers/i2c/busses/i2c-ocores.c
+@@ -342,18 +342,18 @@ static int ocores_poll_wait(struct ocores_i2c *i2c)
+ * ocores_isr(), we just add our polling code around it.
+ *
+ * It can run in atomic context
++ *
++ * Return: 0 on success, -ETIMEDOUT on timeout
+ */
+-static void ocores_process_polling(struct ocores_i2c *i2c)
++static int ocores_process_polling(struct ocores_i2c *i2c)
+ {
+- while (1) {
+- irqreturn_t ret;
+- int err;
++ irqreturn_t ret;
++ int err = 0;
+
++ while (1) {
+ err = ocores_poll_wait(i2c);
+- if (err) {
+- i2c->state = STATE_ERROR;
++ if (err)
+ break; /* timeout */
+- }
+
+ ret = ocores_isr(-1, i2c);
+ if (ret == IRQ_NONE)
+@@ -364,13 +364,15 @@ static void ocores_process_polling(struct ocores_i2c *i2c)
+ break;
+ }
+ }
++
++ return err;
+ }
+
+ static int ocores_xfer_core(struct ocores_i2c *i2c,
+ struct i2c_msg *msgs, int num,
+ bool polling)
+ {
+- int ret;
++ int ret = 0;
+ u8 ctrl;
+
+ ctrl = oc_getreg(i2c, OCI2C_CONTROL);
+@@ -388,15 +390,16 @@ static int ocores_xfer_core(struct ocores_i2c *i2c,
+ oc_setreg(i2c, OCI2C_CMD, OCI2C_CMD_START);
+
+ if (polling) {
+- ocores_process_polling(i2c);
++ ret = ocores_process_polling(i2c);
+ } else {
+- ret = wait_event_timeout(i2c->wait,
+- (i2c->state == STATE_ERROR) ||
+- (i2c->state == STATE_DONE), HZ);
+- if (ret == 0) {
+- ocores_process_timeout(i2c);
+- return -ETIMEDOUT;
+- }
++ if (wait_event_timeout(i2c->wait,
++ (i2c->state == STATE_ERROR) ||
++ (i2c->state == STATE_DONE), HZ) == 0)
++ ret = -ETIMEDOUT;
++ }
++ if (ret) {
++ ocores_process_timeout(i2c);
++ return ret;
+ }
+
+ return (i2c->state == STATE_DONE) ? num : -EIO;
+--
+2.39.2
+
--- /dev/null
+From 6ac67e5b7b75b39b821ce58f639eaecdc8c209f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:55:48 -0700
+Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD
+
+From: Duy Truong <dory@dory.moe>
+
+[ Upstream commit 74391b3e69855e7dd65a9cef36baf5fc1345affd ]
+
+Added a quirk to fix the TeamGroup T-Force Cardea Zero Z330 SSDs reporting
+duplicate NGUIDs.
+
+Signed-off-by: Duy Truong <dory@dory.moe>
+Cc: stable@vger.kernel.org
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 2e3fae6e1fb30..989f31471da69 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3496,6 +3496,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */
+ .driver_data = NVME_QUIRK_BOGUS_NID |
+ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++ { PCI_DEVICE(0x10ec, 0x5763), /* TEAMGROUP T-FORCE CARDEA ZERO Z330 SSD */
++ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
+ .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),
+--
+2.39.2
+
--- /dev/null
+From afd50a43478219fb6ae4c2b7fc50113b526e2c26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 11:29:49 +0200
+Subject: nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN
+
+From: Juraj Pecigos <kernel@juraj.dev>
+
+[ Upstream commit 1231363aec86704a6b0467a12e3ca7bdf890e01d ]
+
+A system with more than one of these SSDs will only have one usable.
+The kernel fails to detect more than one nvme device due to duplicate
+cntlids.
+
+before:
+[ 9.395229] nvme 0000:01:00.0: platform quirk: setting simple suspend
+[ 9.395262] nvme nvme0: pci function 0000:01:00.0
+[ 9.395282] nvme 0000:03:00.0: platform quirk: setting simple suspend
+[ 9.395305] nvme nvme1: pci function 0000:03:00.0
+[ 9.409873] nvme nvme0: Duplicate cntlid 1 with nvme1, subsys nqn.2022-07.com.siliconmotion:nvm-subsystem-sn- , rejecting
+[ 9.409982] nvme nvme0: Removing after probe failure status: -22
+[ 9.427487] nvme nvme1: allocated 64 MiB host memory buffer.
+[ 9.445088] nvme nvme1: 16/0/0 default/read/poll queues
+[ 9.449898] nvme nvme1: Ignoring bogus Namespace Identifiers
+
+after:
+[ 1.161890] nvme 0000:01:00.0: platform quirk: setting simple suspend
+[ 1.162660] nvme nvme0: pci function 0000:01:00.0
+[ 1.162684] nvme 0000:03:00.0: platform quirk: setting simple suspend
+[ 1.162707] nvme nvme1: pci function 0000:03:00.0
+[ 1.191354] nvme nvme0: allocated 64 MiB host memory buffer.
+[ 1.193378] nvme nvme1: allocated 64 MiB host memory buffer.
+[ 1.211044] nvme nvme1: 16/0/0 default/read/poll queues
+[ 1.211080] nvme nvme0: 16/0/0 default/read/poll queues
+[ 1.216145] nvme nvme0: Ignoring bogus Namespace Identifiers
+[ 1.216261] nvme nvme1: Ignoring bogus Namespace Identifiers
+
+Adding the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk to resolves the issue.
+
+Signed-off-by: Juraj Pecigos <kernel@juraj.dev>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: 74391b3e6985 ("nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index ea3f0806783a3..2e3fae6e1fb30 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3494,7 +3494,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ { PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */
+- .driver_data = NVME_QUIRK_BOGUS_NID, },
++ .driver_data = NVME_QUIRK_BOGUS_NID |
++ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
+ .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),
+--
+2.39.2
+
--- /dev/null
+From 65b5ba0e5e7ec50e7be5ec9e8f0dcc70217e3c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 09:44:33 +0530
+Subject: powerpc/papr_scm: Update the NUMA distance table for the target node
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit b277fc793daf258877b4c0744b52f69d6e6ba22e ]
+
+Platform device helper routines won't update the NUMA distance table
+while creating a platform device, even if the device is present on a
+NUMA node that doesn't have memory or CPU. This is especially true for
+pmem devices. If the target node of the pmem device is not online, we
+find the nearest online node to the device and associate the pmem device
+with that online node. To find the nearest online node, we should have
+the numa distance table updated correctly. Update the distance
+information during the device probe.
+
+For a papr scm device on NUMA node 3 distance_lookup_table value for
+distance_ref_points_depth = 2 before and after fix is below:
+
+Before fix:
+ node 3 distance depth 0 - 0
+ node 3 distance depth 1 - 0
+ node 4 distance depth 0 - 4
+ node 4 distance depth 1 - 2
+ node 5 distance depth 0 - 5
+ node 5 distance depth 1 - 1
+
+After fix
+ node 3 distance depth 0 - 3
+ node 3 distance depth 1 - 1
+ node 4 distance depth 0 - 4
+ node 4 distance depth 1 - 2
+ node 5 distance depth 0 - 5
+ node 5 distance depth 1 - 1
+
+Without the fix, the nearest numa node to the pmem device (NUMA node 3)
+will be picked as 4. After the fix, we get the correct numa node which
+is 5.
+
+Fixes: da1115fdbd6e ("powerpc/nvdimm: Pick nearby online node if the device node is not online")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230404041433.1781804-1-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/numa.c | 1 +
+ arch/powerpc/platforms/pseries/papr_scm.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index b44ce71917d75..16cfe56be05bb 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -366,6 +366,7 @@ void update_numa_distance(struct device_node *node)
+ WARN(numa_distance_table[nid][nid] == -1,
+ "NUMA distance details for node %d not provided\n", nid);
+ }
++EXPORT_SYMBOL_GPL(update_numa_distance);
+
+ /*
+ * ibm,numa-lookup-index-table= {N, domainid1, domainid2, ..... domainidN}
+diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
+index 2f8385523a132..1a53e048ceb76 100644
+--- a/arch/powerpc/platforms/pseries/papr_scm.c
++++ b/arch/powerpc/platforms/pseries/papr_scm.c
+@@ -1428,6 +1428,13 @@ static int papr_scm_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ /*
++ * open firmware platform device create won't update the NUMA
++ * distance table. For PAPR SCM devices we use numa_map_to_online_node()
++ * to find the nearest online NUMA node and that requires correct
++ * distance table information.
++ */
++ update_numa_distance(dn);
+
+ p = kzalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
+--
+2.39.2
+
--- /dev/null
+From 598f37968b8bfdb766c16198bfc662a374c5e220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 18:21:21 +0000
+Subject: purgatory: fix disabling debug info
+
+From: Alyssa Ross <hi@alyssa.is>
+
+[ Upstream commit d83806c4c0cccc0d6d3c3581a11983a9c186a138 ]
+
+Since 32ef9e5054ec, -Wa,-gdwarf-2 is no longer used in KBUILD_AFLAGS.
+Instead, it includes -g, the appropriate -gdwarf-* flag, and also the
+-Wa versions of both of those if building with Clang and GNU as. As a
+result, debug info was being generated for the purgatory objects, even
+though the intention was that it not be.
+
+Fixes: 32ef9e5054ec ("Makefile.debug: re-enable debug info for .S files")
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+Cc: stable@vger.kernel.org
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/purgatory/Makefile | 7 +------
+ arch/x86/purgatory/Makefile | 3 +--
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/arch/riscv/purgatory/Makefile b/arch/riscv/purgatory/Makefile
+index d16bf715a586b..5730797a6b402 100644
+--- a/arch/riscv/purgatory/Makefile
++++ b/arch/riscv/purgatory/Makefile
+@@ -84,12 +84,7 @@ CFLAGS_string.o += $(PURGATORY_CFLAGS)
+ CFLAGS_REMOVE_ctype.o += $(PURGATORY_CFLAGS_REMOVE)
+ CFLAGS_ctype.o += $(PURGATORY_CFLAGS)
+
+-AFLAGS_REMOVE_entry.o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_memcpy.o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_memset.o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_strcmp.o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_strlen.o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_strncmp.o += -Wa,-gdwarf-2
++asflags-remove-y += $(foreach x, -g -gdwarf-4 -gdwarf-5, $(x) -Wa,$(x))
+
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 17f09dc263811..82fec66d46d29 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -69,8 +69,7 @@ CFLAGS_sha256.o += $(PURGATORY_CFLAGS)
+ CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE)
+ CFLAGS_string.o += $(PURGATORY_CFLAGS)
+
+-AFLAGS_REMOVE_setup-x86_$(BITS).o += -Wa,-gdwarf-2
+-AFLAGS_REMOVE_entry64.o += -Wa,-gdwarf-2
++asflags-remove-y += $(foreach x, -g -gdwarf-4 -gdwarf-5, $(x) -Wa,$(x))
+
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+--
+2.39.2
+
--- /dev/null
+From 2a28b42819c86b1c46e790a94840fea8e3195e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 22:23:00 +0100
+Subject: RISC-V: add infrastructure to allow different str* implementations
+
+From: Heiko Stuebner <heiko.stuebner@vrull.eu>
+
+[ Upstream commit 56e0790c7f9e59ba6a0f4b59981d1d6fbf43efb0 ]
+
+Depending on supported extensions on specific RISC-V cores,
+optimized str* functions might make sense.
+
+This adds basic infrastructure to allow patching the function calls
+via alternatives later on.
+
+The Linux kernel provides standard implementations for string functions
+but when architectures want to extend them, they need to provide their
+own.
+
+The added generic string functions are done in assembler (taken from
+disassembling the main-kernel functions for now) to allow us to control
+the used registers and extend them with optimized variants.
+
+This doesn't override the compiler's use of builtin replacements. So still
+first of all the compiler will select if a builtin will be better suitable
+i.e. for known strings. For all regular cases we will want to later
+select possible optimized variants and in the worst case fall back to the
+generic implemention added with this change.
+
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Signed-off-by: Heiko Stuebner <heiko.stuebner@vrull.eu>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230113212301.3534711-2-heiko@sntech.de
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Stable-dep-of: d83806c4c0cc ("purgatory: fix disabling debug info")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/string.h | 10 ++++++++
+ arch/riscv/kernel/riscv_ksyms.c | 3 +++
+ arch/riscv/lib/Makefile | 3 +++
+ arch/riscv/lib/strcmp.S | 36 +++++++++++++++++++++++++++++
+ arch/riscv/lib/strlen.S | 28 ++++++++++++++++++++++
+ arch/riscv/lib/strncmp.S | 41 +++++++++++++++++++++++++++++++++
+ arch/riscv/purgatory/Makefile | 13 +++++++++++
+ 7 files changed, 134 insertions(+)
+ create mode 100644 arch/riscv/lib/strcmp.S
+ create mode 100644 arch/riscv/lib/strlen.S
+ create mode 100644 arch/riscv/lib/strncmp.S
+
+diff --git a/arch/riscv/include/asm/string.h b/arch/riscv/include/asm/string.h
+index 9090493665555..a96b1fea24fe4 100644
+--- a/arch/riscv/include/asm/string.h
++++ b/arch/riscv/include/asm/string.h
+@@ -18,6 +18,16 @@ extern asmlinkage void *__memcpy(void *, const void *, size_t);
+ #define __HAVE_ARCH_MEMMOVE
+ extern asmlinkage void *memmove(void *, const void *, size_t);
+ extern asmlinkage void *__memmove(void *, const void *, size_t);
++
++#define __HAVE_ARCH_STRCMP
++extern asmlinkage int strcmp(const char *cs, const char *ct);
++
++#define __HAVE_ARCH_STRLEN
++extern asmlinkage __kernel_size_t strlen(const char *);
++
++#define __HAVE_ARCH_STRNCMP
++extern asmlinkage int strncmp(const char *cs, const char *ct, size_t count);
++
+ /* For those files which don't want to check by kasan. */
+ #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
+ #define memcpy(dst, src, len) __memcpy(dst, src, len)
+diff --git a/arch/riscv/kernel/riscv_ksyms.c b/arch/riscv/kernel/riscv_ksyms.c
+index 5ab1c7e1a6ed5..a72879b4249a5 100644
+--- a/arch/riscv/kernel/riscv_ksyms.c
++++ b/arch/riscv/kernel/riscv_ksyms.c
+@@ -12,6 +12,9 @@
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memmove);
++EXPORT_SYMBOL(strcmp);
++EXPORT_SYMBOL(strlen);
++EXPORT_SYMBOL(strncmp);
+ EXPORT_SYMBOL(__memset);
+ EXPORT_SYMBOL(__memcpy);
+ EXPORT_SYMBOL(__memmove);
+diff --git a/arch/riscv/lib/Makefile b/arch/riscv/lib/Makefile
+index 25d5c9664e57e..6c74b0bedd60d 100644
+--- a/arch/riscv/lib/Makefile
++++ b/arch/riscv/lib/Makefile
+@@ -3,6 +3,9 @@ lib-y += delay.o
+ lib-y += memcpy.o
+ lib-y += memset.o
+ lib-y += memmove.o
++lib-y += strcmp.o
++lib-y += strlen.o
++lib-y += strncmp.o
+ lib-$(CONFIG_MMU) += uaccess.o
+ lib-$(CONFIG_64BIT) += tishift.o
+
+diff --git a/arch/riscv/lib/strcmp.S b/arch/riscv/lib/strcmp.S
+new file mode 100644
+index 0000000000000..8babd712b9587
+--- /dev/null
++++ b/arch/riscv/lib/strcmp.S
+@@ -0,0 +1,36 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#include <linux/linkage.h>
++#include <asm/asm.h>
++#include <asm-generic/export.h>
++
++/* int strcmp(const char *cs, const char *ct) */
++SYM_FUNC_START(strcmp)
++ /*
++ * Returns
++ * a0 - comparison result, value like strcmp
++ *
++ * Parameters
++ * a0 - string1
++ * a1 - string2
++ *
++ * Clobbers
++ * t0, t1
++ */
++1:
++ lbu t0, 0(a0)
++ lbu t1, 0(a1)
++ addi a0, a0, 1
++ addi a1, a1, 1
++ bne t0, t1, 2f
++ bnez t0, 1b
++ li a0, 0
++ ret
++2:
++ /*
++ * strcmp only needs to return (< 0, 0, > 0) values
++ * not necessarily -1, 0, +1
++ */
++ sub a0, t0, t1
++ ret
++SYM_FUNC_END(strcmp)
+diff --git a/arch/riscv/lib/strlen.S b/arch/riscv/lib/strlen.S
+new file mode 100644
+index 0000000000000..0a3b11853efdb
+--- /dev/null
++++ b/arch/riscv/lib/strlen.S
+@@ -0,0 +1,28 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#include <linux/linkage.h>
++#include <asm/asm.h>
++#include <asm-generic/export.h>
++
++/* int strlen(const char *s) */
++SYM_FUNC_START(strlen)
++ /*
++ * Returns
++ * a0 - string length
++ *
++ * Parameters
++ * a0 - String to measure
++ *
++ * Clobbers:
++ * t0, t1
++ */
++ mv t1, a0
++1:
++ lbu t0, 0(t1)
++ beqz t0, 2f
++ addi t1, t1, 1
++ j 1b
++2:
++ sub a0, t1, a0
++ ret
++SYM_FUNC_END(strlen)
+diff --git a/arch/riscv/lib/strncmp.S b/arch/riscv/lib/strncmp.S
+new file mode 100644
+index 0000000000000..1f644d0a93f68
+--- /dev/null
++++ b/arch/riscv/lib/strncmp.S
+@@ -0,0 +1,41 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#include <linux/linkage.h>
++#include <asm/asm.h>
++#include <asm-generic/export.h>
++
++/* int strncmp(const char *cs, const char *ct, size_t count) */
++SYM_FUNC_START(strncmp)
++ /*
++ * Returns
++ * a0 - comparison result, value like strncmp
++ *
++ * Parameters
++ * a0 - string1
++ * a1 - string2
++ * a2 - number of characters to compare
++ *
++ * Clobbers
++ * t0, t1, t2
++ */
++ li t2, 0
++1:
++ beq a2, t2, 2f
++ lbu t0, 0(a0)
++ lbu t1, 0(a1)
++ addi a0, a0, 1
++ addi a1, a1, 1
++ bne t0, t1, 3f
++ addi t2, t2, 1
++ bnez t0, 1b
++2:
++ li a0, 0
++ ret
++3:
++ /*
++ * strncmp only needs to return (< 0, 0, > 0) values
++ * not necessarily -1, 0, +1
++ */
++ sub a0, t0, t1
++ ret
++SYM_FUNC_END(strncmp)
+diff --git a/arch/riscv/purgatory/Makefile b/arch/riscv/purgatory/Makefile
+index dd58e1d993972..d16bf715a586b 100644
+--- a/arch/riscv/purgatory/Makefile
++++ b/arch/riscv/purgatory/Makefile
+@@ -2,6 +2,7 @@
+ OBJECT_FILES_NON_STANDARD := y
+
+ purgatory-y := purgatory.o sha256.o entry.o string.o ctype.o memcpy.o memset.o
++purgatory-y += strcmp.o strlen.o strncmp.o
+
+ targets += $(purgatory-y)
+ PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
+@@ -18,6 +19,15 @@ $(obj)/memcpy.o: $(srctree)/arch/riscv/lib/memcpy.S FORCE
+ $(obj)/memset.o: $(srctree)/arch/riscv/lib/memset.S FORCE
+ $(call if_changed_rule,as_o_S)
+
++$(obj)/strcmp.o: $(srctree)/arch/riscv/lib/strcmp.S FORCE
++ $(call if_changed_rule,as_o_S)
++
++$(obj)/strlen.o: $(srctree)/arch/riscv/lib/strlen.S FORCE
++ $(call if_changed_rule,as_o_S)
++
++$(obj)/strncmp.o: $(srctree)/arch/riscv/lib/strncmp.S FORCE
++ $(call if_changed_rule,as_o_S)
++
+ $(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE
+ $(call if_changed_rule,cc_o_c)
+
+@@ -77,6 +87,9 @@ CFLAGS_ctype.o += $(PURGATORY_CFLAGS)
+ AFLAGS_REMOVE_entry.o += -Wa,-gdwarf-2
+ AFLAGS_REMOVE_memcpy.o += -Wa,-gdwarf-2
+ AFLAGS_REMOVE_memset.o += -Wa,-gdwarf-2
++AFLAGS_REMOVE_strcmp.o += -Wa,-gdwarf-2
++AFLAGS_REMOVE_strlen.o += -Wa,-gdwarf-2
++AFLAGS_REMOVE_strncmp.o += -Wa,-gdwarf-2
+
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+--
+2.39.2
+
--- /dev/null
+From b65d86794ee625fb94a4587dce5e45eedb25c493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 11:06:11 +0200
+Subject: sched/fair: Fix imbalance overflow
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 91dcf1e8068e9a8823e419a7a34ff4341275fb70 ]
+
+When local group is fully busy but its average load is above system load,
+computing the imbalance will overflow and local group is not the best
+target for pulling this load.
+
+Fixes: 0b0695f2b34a ("sched/fair: Rework load_balance()")
+Reported-by: Tingjia Cao <tjcao980311@gmail.com>
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Tingjia Cao <tjcao980311@gmail.com>
+Link: https://lore.kernel.org/lkml/CABcWv9_DAhVBOq2=W=2ypKE9dKM5s2DvoV8-U0+GDwwuKZ89jQ@mail.gmail.com/T/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index e046a2bff207b..661226e38835d 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10123,6 +10123,16 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
+
+ sds->avg_load = (sds->total_load * SCHED_CAPACITY_SCALE) /
+ sds->total_capacity;
++
++ /*
++ * If the local group is more loaded than the average system
++ * load, don't try to pull any tasks.
++ */
++ if (local->avg_load >= sds->avg_load) {
++ env->imbalance = 0;
++ return;
++ }
++
+ }
+
+ /*
+--
+2.39.2
+
mptcp-stricter-state-check-in-mptcp_worker.patch
mptcp-fix-null-pointer-dereference-on-fastopen-early-fallback.patch
selftests-mptcp-userspace-pm-uniform-verify-events.patch
+ubi-fix-deadlock-caused-by-recursively-holding-work_.patch
+i2c-mchp-pci1xxxx-update-timing-registers.patch
+ubi-fix-failure-attaching-when-vid_hdr-offset-equals.patch
+powerpc-papr_scm-update-the-numa-distance-table-for-.patch
+sched-fair-fix-imbalance-overflow.patch
+x86-rtc-remove-__init-for-runtime-functions.patch
+i2c-ocores-generate-stop-condition-after-timeout-in-.patch
+cifs-fix-negotiate-context-parsing.patch
+risc-v-add-infrastructure-to-allow-different-str-imp.patch
+purgatory-fix-disabling-debug-info.patch
+nvme-pci-mark-lexar-nm760-as-ignore_dev_subnqn.patch
+nvme-pci-add-nvme_quirk_bogus_nid-for-t-force-z330-s.patch
--- /dev/null
+From f52a9f7f5f706d7627379661b438cfff8c39d805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 09:41:41 +0800
+Subject: ubi: Fix deadlock caused by recursively holding work_sem
+
+From: ZhaoLong Wang <wangzhaolong1@huawei.com>
+
+[ Upstream commit f773f0a331d6c41733b17bebbc1b6cae12e016f5 ]
+
+During the processing of the bgt, if the sync_erase() return -EBUSY
+or some other error code in __erase_worker(),schedule_erase() called
+again lead to the down_read(ubi->work_sem) hold twice and may get
+block by down_write(ubi->work_sem) in ubi_update_fastmap(),
+which cause deadlock.
+
+ ubi bgt other task
+ do_work
+ down_read(&ubi->work_sem) ubi_update_fastmap
+ erase_worker # Blocked by down_read
+ __erase_worker down_write(&ubi->work_sem)
+ schedule_erase
+ schedule_ubi_work
+ down_read(&ubi->work_sem)
+
+Fix this by changing input parameter @nested of the schedule_erase() to
+'true' to avoid recursively acquiring the down_read(&ubi->work_sem).
+
+Also, fix the incorrect comment about @nested parameter of the
+schedule_erase() because when down_write(ubi->work_sem) is held, the
+@nested is also need be true.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217093
+Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()")
+Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/wl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 9e14319225c97..6049ab9e46479 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -575,7 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ * @vol_id: the volume ID that last used this PEB
+ * @lnum: the last used logical eraseblock number for the PEB
+ * @torture: if the physical eraseblock has to be tortured
+- * @nested: denotes whether the work_sem is already held in read mode
++ * @nested: denotes whether the work_sem is already held
+ *
+ * This function returns zero in case of success and a %-ENOMEM in case of
+ * failure.
+@@ -1131,7 +1131,7 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
+ int err1;
+
+ /* Re-schedule the LEB for erasure */
+- err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false);
++ err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true);
+ if (err1) {
+ spin_lock(&ubi->wl_lock);
+ wl_entry_destroy(ubi, e);
+--
+2.39.2
+
--- /dev/null
+From 47a458cd4f38afc942f00ecca7d2e0d8f2de0e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 09:33:08 +0800
+Subject: ubi: Fix failure attaching when vid_hdr offset equals to (sub)page
+ size
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 ]
+
+Following process will make ubi attaching failed since commit
+1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"):
+
+ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB
+modprobe nandsim id_bytes=$ID
+flash_eraseall /dev/mtd0
+modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page)
+(dmesg):
+ ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large.
+ UBI error: cannot attach mtd0
+ UBI error: cannot initialize UBI, error -22
+
+Rework original solution, the key point is making sure
+'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize',
+so we should check vid_hdr_shift rather not vid_hdr_offset.
+Then, ubi still support (sub)page aligined VID header offset.
+
+Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Tested-by: Nicolas Schichan <nschichan@freebox.fr>
+Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> # v5.10, v4.19
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index 7f65af1697519..1662c12e24ada 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -664,12 +664,6 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+ ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
+ ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
+
+- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
+- ubi->vid_hdr_alsize)) {
+- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
+- return -EINVAL;
+- }
+-
+ dbg_gen("min_io_size %d", ubi->min_io_size);
+ dbg_gen("max_write_size %d", ubi->max_write_size);
+ dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
+@@ -687,6 +681,21 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+ ubi->vid_hdr_aloffset;
+ }
+
++ /*
++ * Memory allocation for VID header is ubi->vid_hdr_alsize
++ * which is described in comments in io.c.
++ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds
++ * ubi->vid_hdr_alsize, so that all vid header operations
++ * won't access memory out of bounds.
++ */
++ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) {
++ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)"
++ " + VID header size(%zu) > VID header aligned size(%d).",
++ ubi->vid_hdr_offset, ubi->vid_hdr_shift,
++ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize);
++ return -EINVAL;
++ }
++
+ /* Similar for the data offset */
+ ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;
+ ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);
+--
+2.39.2
+
--- /dev/null
+From 292348bc97d0516207478cff60d63c295d3694f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 08:26:52 +0200
+Subject: x86/rtc: Remove __init for runtime functions
+
+From: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
+
+[ Upstream commit 775d3c514c5b2763a50ab7839026d7561795924d ]
+
+set_rtc_noop(), get_rtc_noop() are after booting, therefore their __init
+annotation is wrong.
+
+A crash was observed on an x86 platform where CMOS RTC is unused and
+disabled via device tree. set_rtc_noop() was invoked from ntp:
+sync_hw_clock(), although CONFIG_RTC_SYSTOHC=n, however sync_cmos_clock()
+doesn't honour that.
+
+ Workqueue: events_power_efficient sync_hw_clock
+ RIP: 0010:set_rtc_noop
+ Call Trace:
+ update_persistent_clock64
+ sync_hw_clock
+
+Fix this by dropping the __init annotation from set/get_rtc_noop().
+
+Fixes: c311ed6183f4 ("x86/init: Allow DT configured systems to disable RTC at boot time")
+Signed-off-by: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/59f7ceb1-446b-1d3d-0bc8-1f0ee94b1e18@nokia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/x86_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
+index ef80d361b4632..10622cf2b30f4 100644
+--- a/arch/x86/kernel/x86_init.c
++++ b/arch/x86/kernel/x86_init.c
+@@ -33,8 +33,8 @@ static int __init iommu_init_noop(void) { return 0; }
+ static void iommu_shutdown_noop(void) { }
+ bool __init bool_x86_init_noop(void) { return false; }
+ void x86_op_int_noop(int cpu) { }
+-static __init int set_rtc_noop(const struct timespec64 *now) { return -EINVAL; }
+-static __init void get_rtc_noop(struct timespec64 *now) { }
++static int set_rtc_noop(const struct timespec64 *now) { return -EINVAL; }
++static void get_rtc_noop(struct timespec64 *now) { }
+
+ static __initconst const struct of_device_id of_cmos_match[] = {
+ { .compatible = "motorola,mc146818" },
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
