--- /dev/null
+From d5921c460e543228d100daf67dac7a03dfaaa40a Mon Sep 17 00:00:00 2001
+From: Hanjun Guo <guohanjun@huawei.com>
+Date: Tue, 10 Oct 2023 16:21:23 +0800
+Subject: ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init()
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+commit d5921c460e543228d100daf67dac7a03dfaaa40a upstream.
+
+acpi_agdi_init() in acpi_arm_init() will register a SDEI event, so
+it needs the SDEI subsystem to be initialized (which is done in
+acpi_ghes_init()) before the AGDI driver probing.
+
+In commit fcea0ccf4fd7 ("ACPI: bus: Consolidate all arm specific
+initialisation into acpi_arm_init()"), the acpi_agdi_init() was
+called before acpi_ghes_init() and it causes following failure:
+
+| [ 0.515864] sdei: Failed to create event 1073741825: -5
+| [ 0.515866] agdi agdi.0: Failed to register for SDEI event 1073741825
+| [ 0.515867] agdi: probe of agdi.0 failed with error -5
+| ...
+| [ 0.516022] sdei: SDEIv1.0 (0x0) detected in firmware.
+
+Fix it by moving acpi_arm_init() to the place of after
+acpi_ghes_init().
+
+Fixes: fcea0ccf4fd7 ("ACPI: bus: Consolidate all arm specific initialisation into acpi_arm_init()")
+Reported-by: D Scott Phillips <scott@os.amperecomputing.com>
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: D Scott Phillips <scott@os.amperecomputing.com>
+Cc: 6.5+ <stable@vger.kernel.org> # 6.5+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1387,10 +1387,10 @@ static int __init acpi_init(void)
+ acpi_init_ffh();
+
+ pci_mmcfg_late_init();
+- acpi_arm_init();
+ acpi_viot_early_init();
+ acpi_hest_init();
+ acpi_ghes_init();
++ acpi_arm_init();
+ acpi_scan_init();
+ acpi_ec_init();
+ acpi_debugfs_init();
--- /dev/null
+From 0c21a18d5d6c6a73d098fb9b4701572370942df9 Mon Sep 17 00:00:00 2001
+From: Sunil V L <sunilvl@ventanamicro.com>
+Date: Mon, 16 Oct 2023 22:39:39 +0530
+Subject: ACPI: irq: Fix incorrect return value in acpi_register_gsi()
+
+From: Sunil V L <sunilvl@ventanamicro.com>
+
+commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream.
+
+acpi_register_gsi() should return a negative value in case of failure.
+
+Currently, it returns the return value from irq_create_fwspec_mapping().
+However, irq_create_fwspec_mapping() returns 0 for failure. Fix the
+issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero.
+
+Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping")
+Cc: 4.11+ <stable@vger.kernel.org> # 4.11+
+Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+[ rjw: Rename a new local variable ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/irq.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/irq.c
++++ b/drivers/acpi/irq.c
+@@ -57,6 +57,7 @@ int acpi_register_gsi(struct device *dev
+ int polarity)
+ {
+ struct irq_fwspec fwspec;
++ unsigned int irq;
+
+ fwspec.fwnode = acpi_get_gsi_domain_id(gsi);
+ if (WARN_ON(!fwspec.fwnode)) {
+@@ -68,7 +69,11 @@ int acpi_register_gsi(struct device *dev
+ fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity);
+ fwspec.param_count = 2;
+
+- return irq_create_fwspec_mapping(&fwspec);
++ irq = irq_create_fwspec_mapping(&fwspec);
++ if (!irq)
++ return -EINVAL;
++
++ return irq;
+ }
+ EXPORT_SYMBOL_GPL(acpi_register_gsi);
+
--- /dev/null
+From 1bbac8d6af085408885675c1e29b2581250be124 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 25 Aug 2023 15:55:02 +0200
+Subject: dt-bindings: mmc: sdhci-msm: correct minimum number of clocks
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 1bbac8d6af085408885675c1e29b2581250be124 upstream.
+
+In the TXT binding before conversion, the "xo" clock was listed as
+optional. Conversion kept it optional in "clock-names", but not in
+"clocks". This fixes dbts_check warnings like:
+
+ qcom-sdx65-mtp.dtb: mmc@8804000: clocks: [[13, 59], [13, 58]] is too short
+
+Cc: <stable@vger.kernel.org>
+Fixes: a45537723f4b ("dt-bindings: mmc: sdhci-msm: Convert bindings to yaml")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20230825135503.282135-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/mmc/sdhci-msm.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/mmc/sdhci-msm.yaml
++++ b/Documentation/devicetree/bindings/mmc/sdhci-msm.yaml
+@@ -69,7 +69,7 @@ properties:
+ maxItems: 4
+
+ clocks:
+- minItems: 3
++ minItems: 2
+ items:
+ - description: Main peripheral bus clock, PCLK/HCLK - AHB Bus clock
+ - description: SDC MMC clock, MCLK
--- /dev/null
+From 97ac489775f26acfd46a8a60c2f84ce7cc79fa4b Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Wed, 18 Oct 2023 12:59:56 +0300
+Subject: fanotify: limit reporting of event with non-decodeable file handles
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 97ac489775f26acfd46a8a60c2f84ce7cc79fa4b upstream.
+
+Commit a95aef69a740 ("fanotify: support reporting non-decodeable file
+handles") merged in v6.5-rc1, added the ability to use an fanotify group
+with FAN_REPORT_FID mode to watch filesystems that do not support nfs
+export, but do know how to encode non-decodeable file handles, with the
+newly introduced AT_HANDLE_FID flag.
+
+At the time that this commit was merged, there were no filesystems
+in-tree with those traits.
+
+Commit 16aac5ad1fa9 ("ovl: support encoding non-decodable file handles"),
+merged in v6.6-rc1, added this trait to overlayfs, thus allowing fanotify
+watching of overlayfs with FAN_REPORT_FID mode.
+
+In retrospect, allowing an fanotify filesystem/mount mark on such
+filesystem in FAN_REPORT_FID mode will result in getting events with
+file handles, without the ability to resolve the filesystem objects from
+those file handles (i.e. no open_by_handle_at() support).
+
+For v6.6, the safer option would be to allow this mode for inode marks
+only, where the caller has the opportunity to use name_to_handle_at() at
+the time of setting the mark. In the future we can revise this decision.
+
+Fixes: a95aef69a740 ("fanotify: support reporting non-decodeable file handles")
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20231018100000.2453965-2-amir73il@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index f69c451018e3..62fe0b679e58 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -1585,16 +1585,25 @@ static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid)
+ }
+
+ /* Check if filesystem can encode a unique fid */
+-static int fanotify_test_fid(struct dentry *dentry)
++static int fanotify_test_fid(struct dentry *dentry, unsigned int flags)
+ {
++ unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS;
++ const struct export_operations *nop = dentry->d_sb->s_export_op;
++
++ /*
++ * We need to make sure that the filesystem supports encoding of
++ * file handles so user can use name_to_handle_at() to compare fids
++ * reported with events to the file handle of watched objects.
++ */
++ if (!nop)
++ return -EOPNOTSUPP;
++
+ /*
+- * We need to make sure that the file system supports at least
+- * encoding a file handle so user can use name_to_handle_at() to
+- * compare fid returned with event to the file handle of watched
+- * objects. However, even the relaxed AT_HANDLE_FID flag requires
+- * at least empty export_operations for ecoding unique file ids.
++ * For sb/mount mark, we also need to make sure that the filesystem
++ * supports decoding file handles, so user has a way to map back the
++ * reported fids to filesystem objects.
+ */
+- if (!dentry->d_sb->s_export_op)
++ if (mark_type != FAN_MARK_INODE && !nop->fh_to_dentry)
+ return -EOPNOTSUPP;
+
+ return 0;
+@@ -1812,7 +1821,7 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
+ if (ret)
+ goto path_put_and_out;
+
+- ret = fanotify_test_fid(path.dentry);
++ ret = fanotify_test_fid(path.dentry, flags);
+ if (ret)
+ goto path_put_and_out;
+
+--
+2.42.0
+
--- /dev/null
+From 84ee19bffc9306128cd0f1c650e89767079efeff Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Wed, 27 Sep 2023 10:15:00 +0300
+Subject: mmc: core: Capture correct oemid-bits for eMMC cards
+
+From: Avri Altman <avri.altman@wdc.com>
+
+commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream.
+
+The OEMID is an 8-bit binary number rather than 16-bit as the current code
+parses for. The OEMID occupies bits [111:104] in the CID register, see the
+eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from
+the legacy MMC specs (v3.31 and before).
+
+Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This
+means we ignore the impact on some of those old MMC cards that may be out
+there, but on the other hand this shouldn't be a problem as the OEMID seems
+not be an important feature for these cards.
+
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -104,7 +104,7 @@ static int mmc_decode_cid(struct mmc_car
+ case 3: /* MMC v3.1 - v3.3 */
+ case 4: /* MMC v4 */
+ card->cid.manfid = UNSTUFF_BITS(resp, 120, 8);
+- card->cid.oemid = UNSTUFF_BITS(resp, 104, 16);
++ card->cid.oemid = UNSTUFF_BITS(resp, 104, 8);
+ card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8);
+ card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8);
+ card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8);
--- /dev/null
+From f19c5a73e6f78d69efce66cfdce31148c76a61a6 Mon Sep 17 00:00:00 2001
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Wed, 13 Sep 2023 13:29:21 +0200
+Subject: mmc: core: Fix error propagation for some ioctl commands
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+commit f19c5a73e6f78d69efce66cfdce31148c76a61a6 upstream.
+
+Userspace has currently no way of checking the internal R1 response error
+bits for some commands. This is a problem for some commands, like RPMB for
+example. Typically, we may detect that the busy completion has successfully
+ended, while in fact the card did not complete the requested operation.
+
+To fix the problem, let's always poll with CMD13 for these commands and
+during the polling, let's also aggregate the R1 response bits. Before
+completing the ioctl request, let's propagate the R1 response bits too.
+
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Co-developed-by: Christian Loehle <christian.loehle@arm.com>
+Signed-off-by: Christian Loehle <christian.loehle@arm.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230913112921.553019-1-ulf.hansson@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -179,6 +179,7 @@ static void mmc_blk_rw_rq_prep(struct mm
+ struct mmc_queue *mq);
+ static void mmc_blk_hsq_req_done(struct mmc_request *mrq);
+ static int mmc_spi_err_check(struct mmc_card *card);
++static int mmc_blk_busy_cb(void *cb_data, bool *busy);
+
+ static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
+ {
+@@ -470,7 +471,7 @@ static int __mmc_blk_ioctl_cmd(struct mm
+ struct mmc_data data = {};
+ struct mmc_request mrq = {};
+ struct scatterlist sg;
+- bool r1b_resp, use_r1b_resp = false;
++ bool r1b_resp;
+ unsigned int busy_timeout_ms;
+ int err;
+ unsigned int target_part;
+@@ -551,8 +552,7 @@ static int __mmc_blk_ioctl_cmd(struct mm
+ busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS;
+ r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B;
+ if (r1b_resp)
+- use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd,
+- busy_timeout_ms);
++ mmc_prepare_busy_cmd(card->host, &cmd, busy_timeout_ms);
+
+ mmc_wait_for_req(card->host, &mrq);
+ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
+@@ -605,19 +605,28 @@ static int __mmc_blk_ioctl_cmd(struct mm
+ if (idata->ic.postsleep_min_us)
+ usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
+
+- /* No need to poll when using HW busy detection. */
+- if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp)
+- return 0;
+-
+ if (mmc_host_is_spi(card->host)) {
+ if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY)
+ return mmc_spi_err_check(card);
+ return err;
+ }
+- /* Ensure RPMB/R1B command has completed by polling with CMD13. */
+- if (idata->rpmb || r1b_resp)
+- err = mmc_poll_for_busy(card, busy_timeout_ms, false,
+- MMC_BUSY_IO);
++
++ /*
++ * Ensure RPMB, writes and R1B responses are completed by polling with
++ * CMD13. Note that, usually we don't need to poll when using HW busy
++ * detection, but here it's needed since some commands may indicate the
++ * error through the R1 status bits.
++ */
++ if (idata->rpmb || idata->ic.write_flag || r1b_resp) {
++ struct mmc_blk_busy_data cb_data = {
++ .card = card,
++ };
++
++ err = __mmc_poll_for_busy(card->host, 0, busy_timeout_ms,
++ &mmc_blk_busy_cb, &cb_data);
++
++ idata->ic.response[0] = cb_data.status;
++ }
+
+ return err;
+ }
--- /dev/null
+From 32a9cdb8869dc111a0c96cf8e1762be9684af15b Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Wed, 30 Aug 2023 17:39:22 +0800
+Subject: mmc: core: sdio: hold retuning if sdio in 1-bit mode
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream.
+
+tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode,
+need to hold retuning.
+
+Find this issue when use manual tuning method on imx93. When system
+resume back, SDIO WIFI try to switch back to 4 bit mode, first will
+trigger retuning, and all tuning command failed.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/sdio.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -1089,8 +1089,14 @@ static int mmc_sdio_resume(struct mmc_ho
+ }
+ err = mmc_sdio_reinit_card(host);
+ } else if (mmc_card_wake_sdio_irq(host)) {
+- /* We may have switched to 1-bit mode during suspend */
++ /*
++ * We may have switched to 1-bit mode during suspend,
++ * need to hold retuning, because tuning only supprt
++ * 4-bit mode or 8 bit mode.
++ */
++ mmc_retune_hold_now(host);
+ err = sdio_enable_4bit_bus(host->card);
++ mmc_retune_release(host);
+ }
+
+ if (err)
--- /dev/null
+From c7bb120c1c66672b657e95d0942c989b8275aeb3 Mon Sep 17 00:00:00 2001
+From: Pablo Sun <pablo.sun@mediatek.com>
+Date: Fri, 22 Sep 2023 17:53:48 +0800
+Subject: mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw
+
+From: Pablo Sun <pablo.sun@mediatek.com>
+
+commit c7bb120c1c66672b657e95d0942c989b8275aeb3 upstream.
+
+Use atomic readl_poll_timeout_atomic, because msdc_reset_hw
+may be invoked in IRQ handler in the following context:
+
+ msdc_irq() -> msdc_cmd_done() -> msdc_reset_hw()
+
+The following kernel BUG stack trace can be observed on
+Genio 1200 EVK after initializing MSDC1 hardware during kernel boot:
+
+[ 1.187441] BUG: scheduling while atomic: swapper/0/0/0x00010002
+[ 1.189157] Modules linked in:
+[ 1.204633] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.15.42-mtk+modified #1
+[ 1.205713] Hardware name: MediaTek Genio 1200 EVK-P1V2-EMMC (DT)
+[ 1.206484] Call trace:
+[ 1.206796] dump_backtrace+0x0/0x1ac
+[ 1.207266] show_stack+0x24/0x30
+[ 1.207692] dump_stack_lvl+0x68/0x84
+[ 1.208162] dump_stack+0x1c/0x38
+[ 1.208587] __schedule_bug+0x68/0x80
+[ 1.209056] __schedule+0x6ec/0x7c0
+[ 1.209502] schedule+0x7c/0x110
+[ 1.209915] schedule_hrtimeout_range_clock+0xc4/0x1f0
+[ 1.210569] schedule_hrtimeout_range+0x20/0x30
+[ 1.211148] usleep_range_state+0x84/0xc0
+[ 1.211661] msdc_reset_hw+0xc8/0x1b0
+[ 1.212134] msdc_cmd_done.isra.0+0x4ac/0x5f0
+[ 1.212693] msdc_irq+0x104/0x2d4
+[ 1.213121] __handle_irq_event_percpu+0x68/0x280
+[ 1.213725] handle_irq_event+0x70/0x15c
+[ 1.214230] handle_fasteoi_irq+0xb0/0x1a4
+[ 1.214755] handle_domain_irq+0x6c/0x9c
+[ 1.215260] gic_handle_irq+0xc4/0x180
+[ 1.215741] call_on_irq_stack+0x2c/0x54
+[ 1.216245] do_interrupt_handler+0x5c/0x70
+[ 1.216782] el1_interrupt+0x30/0x80
+[ 1.217242] el1h_64_irq_handler+0x1c/0x2c
+[ 1.217769] el1h_64_irq+0x78/0x7c
+[ 1.218206] cpuidle_enter_state+0xc8/0x600
+[ 1.218744] cpuidle_enter+0x44/0x5c
+[ 1.219205] do_idle+0x224/0x2d0
+[ 1.219624] cpu_startup_entry+0x30/0x80
+[ 1.220129] rest_init+0x108/0x134
+[ 1.220568] arch_call_rest_init+0x1c/0x28
+[ 1.221094] start_kernel+0x6c0/0x700
+[ 1.221564] __primary_switched+0xc0/0xc8
+
+Fixes: ffaea6ebfe9c ("mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling")
+Signed-off-by: Pablo Sun <pablo.sun@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioachino.delregno@collabora.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230922095348.22182-1-pablo.sun@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/mtk-sd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -671,11 +671,11 @@ static void msdc_reset_hw(struct msdc_ho
+ u32 val;
+
+ sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_RST);
+- readl_poll_timeout(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0);
++ readl_poll_timeout_atomic(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0);
+
+ sdr_set_bits(host->base + MSDC_FIFOCS, MSDC_FIFOCS_CLR);
+- readl_poll_timeout(host->base + MSDC_FIFOCS, val,
+- !(val & MSDC_FIFOCS_CLR), 0, 0);
++ readl_poll_timeout_atomic(host->base + MSDC_FIFOCS, val,
++ !(val & MSDC_FIFOCS_CLR), 0, 0);
+
+ val = readl(host->base + MSDC_INT);
+ writel(val, host->base + MSDC_INT);
--- /dev/null
+From 1202d617e3d04c8d27a14ef30784a698c48170b3 Mon Sep 17 00:00:00 2001
+From: Sven van Ashbrook <svenva@chromium.org>
+Date: Thu, 31 Aug 2023 16:00:56 +0000
+Subject: mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend
+
+From: Sven van Ashbrook <svenva@chromium.org>
+
+commit 1202d617e3d04c8d27a14ef30784a698c48170b3 upstream.
+
+To improve the r/w performance of GL9763E, the current driver inhibits LPM
+negotiation while the device is active.
+
+This prevents a large number of SoCs from suspending, notably x86 systems
+which commonly use S0ix as the suspend mechanism - for example, Intel
+Alder Lake and Raptor Lake processors.
+
+Failure description:
+1. Userspace initiates s2idle suspend (e.g. via writing to
+ /sys/power/state)
+2. This switches the runtime_pm device state to active, which disables
+ LPM negotiation, then calls the "regular" suspend callback
+3. With LPM negotiation disabled, the bus cannot enter low-power state
+4. On a large number of SoCs, if the bus not in a low-power state, S0ix
+ cannot be entered, which in turn prevents the SoC from entering
+ suspend.
+
+Fix by re-enabling LPM negotiation in the device's suspend callback.
+
+Suggested-by: Stanislaw Kardach <skardach@google.com>
+Fixes: f9e5b33934ce ("mmc: host: Improve I/O read/write performance for GL9763E")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sven van Ashbrook <svenva@chromium.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230831160055.v3.1.I7ed1ca09797be2dd76ca914c57d88b32d24dac88@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-gli.c | 104 ++++++++++++++++++++++++---------------
+ 1 file changed, 66 insertions(+), 38 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pci-gli.c
++++ b/drivers/mmc/host/sdhci-pci-gli.c
+@@ -1144,42 +1144,6 @@ static u32 sdhci_gl9750_readl(struct sdh
+ return value;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+-static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip)
+-{
+- struct sdhci_pci_slot *slot = chip->slots[0];
+-
+- pci_free_irq_vectors(slot->chip->pdev);
+- gli_pcie_enable_msi(slot);
+-
+- return sdhci_pci_resume_host(chip);
+-}
+-
+-static int sdhci_cqhci_gli_resume(struct sdhci_pci_chip *chip)
+-{
+- struct sdhci_pci_slot *slot = chip->slots[0];
+- int ret;
+-
+- ret = sdhci_pci_gli_resume(chip);
+- if (ret)
+- return ret;
+-
+- return cqhci_resume(slot->host->mmc);
+-}
+-
+-static int sdhci_cqhci_gli_suspend(struct sdhci_pci_chip *chip)
+-{
+- struct sdhci_pci_slot *slot = chip->slots[0];
+- int ret;
+-
+- ret = cqhci_suspend(slot->host->mmc);
+- if (ret)
+- return ret;
+-
+- return sdhci_suspend_host(slot->host);
+-}
+-#endif
+-
+ static void gl9763e_hs400_enhanced_strobe(struct mmc_host *mmc,
+ struct mmc_ios *ios)
+ {
+@@ -1420,6 +1384,70 @@ static int gl9763e_runtime_resume(struct
+ }
+ #endif
+
++#ifdef CONFIG_PM_SLEEP
++static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++
++ pci_free_irq_vectors(slot->chip->pdev);
++ gli_pcie_enable_msi(slot);
++
++ return sdhci_pci_resume_host(chip);
++}
++
++static int gl9763e_resume(struct sdhci_pci_chip *chip)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++ int ret;
++
++ ret = sdhci_pci_gli_resume(chip);
++ if (ret)
++ return ret;
++
++ ret = cqhci_resume(slot->host->mmc);
++ if (ret)
++ return ret;
++
++ /*
++ * Disable LPM negotiation to bring device back in sync
++ * with its runtime_pm state.
++ */
++ gl9763e_set_low_power_negotiation(slot, false);
++
++ return 0;
++}
++
++static int gl9763e_suspend(struct sdhci_pci_chip *chip)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++ int ret;
++
++ /*
++ * Certain SoCs can suspend only with the bus in low-
++ * power state, notably x86 SoCs when using S0ix.
++ * Re-enable LPM negotiation to allow entering L1 state
++ * and entering system suspend.
++ */
++ gl9763e_set_low_power_negotiation(slot, true);
++
++ ret = cqhci_suspend(slot->host->mmc);
++ if (ret)
++ goto err_suspend;
++
++ ret = sdhci_suspend_host(slot->host);
++ if (ret)
++ goto err_suspend_host;
++
++ return 0;
++
++err_suspend_host:
++ cqhci_resume(slot->host->mmc);
++err_suspend:
++ gl9763e_set_low_power_negotiation(slot, false);
++ return ret;
++}
++#endif
++
+ static int gli_probe_slot_gl9763e(struct sdhci_pci_slot *slot)
+ {
+ struct pci_dev *pdev = slot->chip->pdev;
+@@ -1527,8 +1555,8 @@ const struct sdhci_pci_fixes sdhci_gl976
+ .probe_slot = gli_probe_slot_gl9763e,
+ .ops = &sdhci_gl9763e_ops,
+ #ifdef CONFIG_PM_SLEEP
+- .resume = sdhci_cqhci_gli_resume,
+- .suspend = sdhci_cqhci_gli_suspend,
++ .resume = gl9763e_resume,
++ .suspend = gl9763e_suspend,
+ #endif
+ #ifdef CONFIG_PM
+ .runtime_suspend = gl9763e_runtime_suspend,
--- /dev/null
+From 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 30 Aug 2023 17:00:34 +0200
+Subject: mtd: physmap-core: Restore map_rom fallback
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream.
+
+When the exact mapping type driver was not available, the old
+physmap_of_core driver fell back to mapping the region as ROM.
+Unfortunately this feature was lost when the DT and pdata cases were
+merged. Revive this useful feature.
+
+Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/maps/physmap-core.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/mtd/maps/physmap-core.c
++++ b/drivers/mtd/maps/physmap-core.c
+@@ -552,6 +552,17 @@ static int physmap_flash_probe(struct pl
+ if (info->probe_type) {
+ info->mtds[i] = do_map_probe(info->probe_type,
+ &info->maps[i]);
++
++ /* Fall back to mapping region as ROM */
++ if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) &&
++ strcmp(info->probe_type, "map_rom")) {
++ dev_warn(&dev->dev,
++ "map_probe() failed for type %s\n",
++ info->probe_type);
++
++ info->mtds[i] = do_map_probe("map_rom",
++ &info->maps[i]);
++ }
+ } else {
+ int j;
+
--- /dev/null
+From 3a4a893dbb19e229db3b753f0462520b561dee98 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:20 +0200
+Subject: mtd: rawnand: arasan: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: Michal Simek <michal.simek@amd.com>
+Cc: stable@vger.kernel.org
+Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/arasan-nand-controller.c
++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c
+@@ -515,6 +515,7 @@ static int anfc_write_page_hw_ecc(struct
+ struct mtd_info *mtd = nand_to_mtd(chip);
+ unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0);
+ dma_addr_t dma_addr;
++ u8 status;
+ int ret;
+ struct anfc_op nfc_op = {
+ .pkt_reg =
+@@ -561,10 +562,21 @@ static int anfc_write_page_hw_ecc(struct
+ }
+
+ /* Spare data is not protected */
+- if (oob_required)
++ if (oob_required) {
+ ret = nand_write_oob_std(chip, page);
++ if (ret)
++ return ret;
++ }
++
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
+
+- return ret;
++ return 0;
+ }
+
+ static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,
--- /dev/null
+From f6ca3fb6978f94d95ee79f95085fc22e71ca17cc Mon Sep 17 00:00:00 2001
+From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+Date: Fri, 22 Sep 2023 16:17:16 +0200
+Subject: mtd: rawnand: Ensure the nand chip supports cached reads
+
+From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+
+commit f6ca3fb6978f94d95ee79f95085fc22e71ca17cc upstream.
+
+Both the JEDEC and ONFI specification say that read cache sequential
+support is an optional command. This means that we not only need to
+check whether the individual controller supports the command, we also
+need to check the parameter pages for both ONFI and JEDEC NAND flashes
+before enabling sequential cache reads.
+
+This fixes support for NAND flashes which don't support enabling cache
+reads, i.e. Samsung K9F4G08U0F or Toshiba TC58NVG0S3HTA00.
+
+Sequential cache reads are now only available for ONFI and JEDEC
+devices, if individual vendors implement this, it needs to be enabled
+per vendor.
+
+Tested on i.MX6Q with a Samsung NAND flash chip that doesn't support
+sequential reads.
+
+Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads")
+Cc: stable@vger.kernel.org
+Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230922141717.35977-1-r.czerwinski@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/nand_base.c | 3 +++
+ drivers/mtd/nand/raw/nand_jedec.c | 3 +++
+ drivers/mtd/nand/raw/nand_onfi.c | 3 +++
+ include/linux/mtd/jedec.h | 3 +++
+ include/linux/mtd/onfi.h | 1 +
+ include/linux/mtd/rawnand.h | 2 ++
+ 6 files changed, 15 insertions(+)
+
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -5109,6 +5109,9 @@ static void rawnand_check_cont_read_supp
+ {
+ struct mtd_info *mtd = nand_to_mtd(chip);
+
++ if (!chip->parameters.supports_read_cache)
++ return;
++
+ if (chip->read_retries)
+ return;
+
+--- a/drivers/mtd/nand/raw/nand_jedec.c
++++ b/drivers/mtd/nand/raw/nand_jedec.c
+@@ -94,6 +94,9 @@ int nand_jedec_detect(struct nand_chip *
+ goto free_jedec_param_page;
+ }
+
++ if (p->opt_cmd[0] & JEDEC_OPT_CMD_READ_CACHE)
++ chip->parameters.supports_read_cache = true;
++
+ memorg->pagesize = le32_to_cpu(p->byte_per_page);
+ mtd->writesize = memorg->pagesize;
+
+--- a/drivers/mtd/nand/raw/nand_onfi.c
++++ b/drivers/mtd/nand/raw/nand_onfi.c
+@@ -303,6 +303,9 @@ int nand_onfi_detect(struct nand_chip *c
+ ONFI_FEATURE_ADDR_TIMING_MODE, 1);
+ }
+
++ if (le16_to_cpu(p->opt_cmd) & ONFI_OPT_CMD_READ_CACHE)
++ chip->parameters.supports_read_cache = true;
++
+ onfi = kzalloc(sizeof(*onfi), GFP_KERNEL);
+ if (!onfi) {
+ ret = -ENOMEM;
+--- a/include/linux/mtd/jedec.h
++++ b/include/linux/mtd/jedec.h
+@@ -21,6 +21,9 @@ struct jedec_ecc_info {
+ /* JEDEC features */
+ #define JEDEC_FEATURE_16_BIT_BUS (1 << 0)
+
++/* JEDEC Optional Commands */
++#define JEDEC_OPT_CMD_READ_CACHE BIT(1)
++
+ struct nand_jedec_params {
+ /* rev info and features block */
+ /* 'J' 'E' 'S' 'D' */
+--- a/include/linux/mtd/onfi.h
++++ b/include/linux/mtd/onfi.h
+@@ -55,6 +55,7 @@
+ #define ONFI_SUBFEATURE_PARAM_LEN 4
+
+ /* ONFI optional commands SET/GET FEATURES supported? */
++#define ONFI_OPT_CMD_READ_CACHE BIT(1)
+ #define ONFI_OPT_CMD_SET_GET_FEATURES BIT(2)
+
+ struct nand_onfi_params {
+--- a/include/linux/mtd/rawnand.h
++++ b/include/linux/mtd/rawnand.h
+@@ -225,6 +225,7 @@ struct gpio_desc;
+ * struct nand_parameters - NAND generic parameters from the parameter page
+ * @model: Model name
+ * @supports_set_get_features: The NAND chip supports setting/getting features
++ * @supports_read_cache: The NAND chip supports read cache operations
+ * @set_feature_list: Bitmap of features that can be set
+ * @get_feature_list: Bitmap of features that can be get
+ * @onfi: ONFI specific parameters
+@@ -233,6 +234,7 @@ struct nand_parameters {
+ /* Generic parameters */
+ const char *model;
+ bool supports_set_get_features;
++ bool supports_read_cache;
+ DECLARE_BITMAP(set_feature_list, ONFI_FEATURE_NUMBER);
+ DECLARE_BITMAP(get_feature_list, ONFI_FEATURE_NUMBER);
+
--- /dev/null
+From 3e01d5254698ea3d18e09d96b974c762328352cd Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:19 +0200
+Subject: mtd: rawnand: marvell: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: stable@vger.kernel.org
+Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
+Reported-by: Aviram Dali <aviramd@marvell.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Ravi Chandra Minnikanti <rminnikanti@marvell.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -1162,6 +1162,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
+ .ndcb[2] = NDCB2_ADDR5_PAGE(page),
+ };
+ unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0);
++ u8 status;
+ int ret;
+
+ /* NFCv2 needs more information about the operation being executed */
+@@ -1195,7 +1196,18 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
+
+ ret = marvell_nfc_wait_op(chip,
+ PSEC_TO_MSEC(sdr->tPROG_max));
+- return ret;
++ if (ret)
++ return ret;
++
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
++
++ return 0;
+ }
+
+ static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip,
+@@ -1624,6 +1636,7 @@ static int marvell_nfc_hw_ecc_bch_write_
+ int data_len = lt->data_bytes;
+ int spare_len = lt->spare_bytes;
+ int chunk, ret;
++ u8 status;
+
+ marvell_nfc_select_target(chip, chip->cur_cs);
+
+@@ -1660,6 +1673,14 @@ static int marvell_nfc_hw_ecc_bch_write_
+ if (ret)
+ return ret;
+
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
++
+ return 0;
+ }
+
--- /dev/null
+From 9777cc13fd2c3212618904636354be60835e10bb Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:21 +0200
+Subject: mtd: rawnand: pl353: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 9777cc13fd2c3212618904636354be60835e10bb upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: Michal Simek <michal.simek@amd.com>
+Cc: stable@vger.kernel.org
+Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-3-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c
++++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c
+@@ -513,6 +513,7 @@ static int pl35x_nand_write_page_hwecc(s
+ u32 addr1 = 0, addr2 = 0, row;
+ u32 cmd_addr;
+ int i, ret;
++ u8 status;
+
+ ret = pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_APB);
+ if (ret)
+@@ -565,6 +566,14 @@ static int pl35x_nand_write_page_hwecc(s
+ if (ret)
+ goto disable_ecc_engine;
+
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ goto disable_ecc_engine;
++
++ if (status & NAND_STATUS_FAIL)
++ ret = -EIO;
++
+ disable_ecc_engine:
+ pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_BYPASS);
+
--- /dev/null
+From 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd Mon Sep 17 00:00:00 2001
+From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+Date: Wed, 13 Sep 2023 12:37:02 +0530
+Subject: mtd: rawnand: qcom: Unmap the right resource upon probe failure
+
+From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+
+commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream.
+
+We currently provide the physical address of the DMA region
+rather than the output of dma_map_resource() which is obviously wrong.
+
+Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()")
+Cc: stable@vger.kernel.org
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -3309,7 +3309,7 @@ err_nandc_alloc:
+ err_aon_clk:
+ clk_disable_unprepare(nandc->core_clk);
+ err_core_clk:
+- dma_unmap_resource(dev, res->start, resource_size(res),
++ dma_unmap_resource(dev, nandc->base_dma, resource_size(res),
+ DMA_BIDIRECTIONAL, 0);
+ return ret;
+ }
--- /dev/null
+From 9836a987860e33943945d4b257729a4f94eae576 Mon Sep 17 00:00:00 2001
+From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+Date: Tue, 5 Sep 2023 17:56:37 +0300
+Subject: mtd: spinand: micron: correct bitmask for ecc status
+
+From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+
+commit 9836a987860e33943945d4b257729a4f94eae576 upstream.
+
+Valid bitmask is 0x70 in the status register.
+
+Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD")
+Signed-off-by: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/spi/micron.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/micron.c
++++ b/drivers/mtd/nand/spi/micron.c
+@@ -12,7 +12,7 @@
+
+ #define SPINAND_MFR_MICRON 0x2c
+
+-#define MICRON_STATUS_ECC_MASK GENMASK(7, 4)
++#define MICRON_STATUS_ECC_MASK GENMASK(6, 4)
+ #define MICRON_STATUS_ECC_NO_BITFLIPS (0 << 4)
+ #define MICRON_STATUS_ECC_1TO3_BITFLIPS (1 << 4)
+ #define MICRON_STATUS_ECC_4TO6_BITFLIPS (3 << 4)
--- /dev/null
+From 6a6d4644ce935ddec4f76223ac0ca68da56bd2d3 Mon Sep 17 00:00:00 2001
+From: Scott Mayhew <smayhew@redhat.com>
+Date: Wed, 11 Oct 2023 10:43:26 -0400
+Subject: NFS: Fix potential oops in nfs_inode_remove_request()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+commit 6a6d4644ce935ddec4f76223ac0ca68da56bd2d3 upstream.
+
+Once a folio's private data has been cleared, it's possible for another
+process to clear the folio->mapping (e.g. via invalidate_complete_folio2
+or evict_mapping_folio), so it wouldn't be safe to call
+nfs_page_to_inode() after that.
+
+Fixes: 0c493b5cf16e ("NFS: Convert buffered writes to use folios")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Tested-by: Benjamin Coddington <bcodding@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/write.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 7720b5e43014..9d82d50ce0b1 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -788,6 +788,8 @@ static void nfs_inode_add_request(struct nfs_page *req)
+ */
+ static void nfs_inode_remove_request(struct nfs_page *req)
+ {
++ struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req));
++
+ if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) {
+ struct folio *folio = nfs_page_to_folio(req->wb_head);
+ struct address_space *mapping = folio_file_mapping(folio);
+@@ -802,7 +804,7 @@ static void nfs_inode_remove_request(struct nfs_page *req)
+ }
+
+ if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) {
+- atomic_long_dec(&NFS_I(nfs_page_to_inode(req))->nrequests);
++ atomic_long_dec(&nfsi->nrequests);
+ nfs_release_request(req);
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From f588d72bd95f748849685412b1f0c7959ca228cf Mon Sep 17 00:00:00 2001
+From: Dai Ngo <dai.ngo@oracle.com>
+Date: Mon, 18 Sep 2023 23:30:20 -0700
+Subject: nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+commit f588d72bd95f748849685412b1f0c7959ca228cf upstream.
+
+The Linux NFS server strips the SUID and SGID from the file mode
+on ALLOCATE op.
+
+Modify _nfs42_proc_fallocate to add NFS_INO_REVAL_FORCED to
+nfs_set_cache_invalid's argument to force update of the file
+mode suid/sgid bit.
+
+Suggested-by: Trond Myklebust <trondmy@hammerspace.com>
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Tested-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs42proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -81,7 +81,8 @@ static int _nfs42_proc_fallocate(struct
+ if (status == 0) {
+ if (nfs_should_remove_suid(inode)) {
+ spin_lock(&inode->i_lock);
+- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE);
++ nfs_set_cache_invalid(inode,
++ NFS_INO_REVAL_FORCED | NFS_INO_INVALID_MODE);
+ spin_unlock(&inode->i_lock);
+ }
+ status = nfs_post_op_update_inode_force_wcc(inode,
--- /dev/null
+From 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Mon, 9 Oct 2023 10:59:01 -0400
+Subject: NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+commit 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 upstream.
+
+This patches fixes commit 51d674a5e488 "NFSv4.1: use
+EXCHGID4_FLAG_USE_PNFS_DS for DS server", purpose of that
+commit was to mark EXCHANGE_ID to the DS with the appropriate
+flag.
+
+However, connection to MDS can return both EXCHGID4_FLAG_USE_PNFS_DS
+and EXCHGID4_FLAG_USE_PNFS_MDS set but previous patch would only
+remember the USE_PNFS_DS and for the 2nd EXCHANGE_ID send that
+to the MDS.
+
+Instead, just mark the pnfs path exclusively.
+
+Fixes: 51d674a5e488 ("NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8870,8 +8870,6 @@ static int _nfs4_proc_exchange_id(struct
+ /* Save the EXCHANGE_ID verifier session trunk tests */
+ memcpy(clp->cl_confirm.data, argp->verifier.data,
+ sizeof(clp->cl_confirm.data));
+- if (resp->flags & EXCHGID4_FLAG_USE_PNFS_DS)
+- set_bit(NFS_CS_DS, &clp->cl_flags);
+ out:
+ trace_nfs4_exchange_id(clp, status);
+ rpc_put_task(task);
--- /dev/null
+From 4ae55a7dce04989f289d5c5c8c8e5c37adc36c71 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Mon, 4 Sep 2023 17:26:38 +0200
+Subject: nvme-auth: use chap->s2 to indicate bidirectional authentication
+
+From: Martin Wilck <mwilck@suse.com>
+
+commit 4ae55a7dce04989f289d5c5c8c8e5c37adc36c71 upstream.
+
+Commit 546dea18c999 ("nvme-auth: check chap ctrl_key once constructed")
+replaced the condition "if (ctrl->ctrl_key)" (indicating bidirectional
+auth) by "if (chap->ctrl_key)", because ctrl->ctrl_key is a resource shared
+with sysfs. But chap->ctrl_key is set in
+nvme_auth_process_dhchap_challenge() depending on the DHVLEN in the
+DH-HMAC-CHAP Challenge message received from the controller, and will thus
+be non-NULL for every DH-HMAC-CHAP exchange, even if unidirectional auth
+was requested. This will lead to a protocol violation by sending a Success2
+message in the unidirectional case (per NVMe base spec 2.0, the
+authentication transaction ends after the Success1 message for
+unidirectional auth). Use chap->s2 instead, which is non-zero if and only
+if the host requested bi-directional authentication from the controller.
+
+Fixes: 546dea18c999 ("nvme-auth: check chap ctrl_key once constructed")
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/auth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index daf5d144a8ea..064592a5d546 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -341,7 +341,7 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl,
+ struct nvmf_auth_dhchap_success1_data *data = chap->buf;
+ size_t size = sizeof(*data);
+
+- if (chap->ctrl_key)
++ if (chap->s2)
+ size += chap->hash_len;
+
+ if (size > CHAP_BUF_SIZE) {
+@@ -825,7 +825,7 @@ static void nvme_queue_auth_work(struct work_struct *work)
+ goto fail2;
+ }
+
+- if (chap->ctrl_key) {
++ if (chap->s2) {
+ /* DH-HMAC-CHAP Step 5: send success2 */
+ dev_dbg(ctrl->device, "%s: qid %d send success2\n",
+ __func__, chap->qid);
+--
+2.42.0
+
--- /dev/null
+From 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Thu, 12 Oct 2023 11:13:51 -0700
+Subject: nvme-pci: add BOGUS_NID for Intel 0a54 device
+
+From: Keith Busch <kbusch@kernel.org>
+
+commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream.
+
+These ones claim cmic and nmic capable, so need special consideration to ignore
+their duplicate identifiers.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981
+Reported-by: welsh@cassens.com
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3329,7 +3329,8 @@ static const struct pci_device_id nvme_i
+ { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */
+ .driver_data = NVME_QUIRK_STRIPE_SIZE |
+ NVME_QUIRK_DEALLOCATE_ZEROES |
+- NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++ NVME_QUIRK_IGNORE_DEV_SUBNQN |
++ NVME_QUIRK_BOGUS_NID, },
+ { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */
+ .driver_data = NVME_QUIRK_STRIPE_SIZE |
+ NVME_QUIRK_DEALLOCATE_ZEROES, },
--- /dev/null
+From 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 Mon Sep 17 00:00:00 2001
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Mon, 31 Jul 2023 12:37:58 +0200
+Subject: nvme-rdma: do not try to stop unallocated queues
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream.
+
+Trying to stop a queue which hasn't been allocated will result
+in a warning due to calling mutex_lock() against an uninitialized mutex.
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+ WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579
+
+ Call trace:
+ RIP: 0010:__mutex_lock+0x1173/0x14a0
+ nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma]
+ nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma]
+ nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma]
+ nvme_do_delete_ctrl+0x149/0x158 [nvme_core]
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -638,6 +638,9 @@ static void __nvme_rdma_stop_queue(struc
+
+ static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
+ {
++ if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
++ return;
++
+ mutex_lock(&queue->queue_lock);
+ if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
+ __nvme_rdma_stop_queue(queue);
--- /dev/null
+From 2b32c76e2b0154b98b9322ae7546b8156cd703e6 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Mon, 16 Oct 2023 13:12:47 -0700
+Subject: nvme: sanitize metadata bounce buffer for reads
+
+From: Keith Busch <kbusch@kernel.org>
+
+commit 2b32c76e2b0154b98b9322ae7546b8156cd703e6 upstream.
+
+User can request more metadata bytes than the device will write. Ensure
+kernel buffer is initialized so we're not leaking unsanitized memory on
+the copy-out.
+
+Fixes: 0b7f1f26f95a51a ("nvme: use the block layer for userspace passthrough metadata")
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/ioctl.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@ -108,9 +108,13 @@ static void *nvme_add_user_metadata(stru
+ if (!buf)
+ goto out;
+
+- ret = -EFAULT;
+- if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))
+- goto out_free_meta;
++ if (req_op(req) == REQ_OP_DRV_OUT) {
++ ret = -EFAULT;
++ if (copy_from_user(buf, ubuf, len))
++ goto out_free_meta;
++ } else {
++ memset(buf, 0, len);
++ }
+
+ bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);
+ if (IS_ERR(bip)) {
--- /dev/null
+From f965b281fd872b2e18bd82dd97730db9834d0750 Mon Sep 17 00:00:00 2001
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Tue, 17 Oct 2023 10:28:45 +0200
+Subject: nvmet-auth: complete a request only after freeing the dhchap pointers
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+commit f965b281fd872b2e18bd82dd97730db9834d0750 upstream.
+
+It may happen that the work to destroy a queue
+(for example nvmet_tcp_release_queue_work()) is started while
+an auth-send or auth-receive command is still completing.
+
+nvmet_sq_destroy() will block, waiting for all the references
+to the sq to be dropped, the last reference is then
+dropped when nvmet_req_complete() is called.
+
+When this happens, both nvmet_sq_destroy() and
+nvmet_execute_auth_send()/_receive() will free the dhchap pointers by
+calling nvmet_auth_sq_free().
+Since there isn't any lock, the two threads may race against each other,
+causing double frees and memory corruptions, as reported by KASAN.
+
+Reproduced by stress blktests nvme/041 nvme/042 nvme/043
+
+ nvme nvme2: qid 0: authenticated with hash hmac(sha512) dhgroup ffdhe4096
+ ==================================================================
+ BUG: KASAN: double-free in kfree+0xec/0x4b0
+
+ Call Trace:
+ <TASK>
+ kfree+0xec/0x4b0
+ nvmet_auth_sq_free+0xe1/0x160 [nvmet]
+ nvmet_execute_auth_send+0x482/0x16d0 [nvmet]
+ process_one_work+0x8e5/0x1510
+
+ Allocated by task 191846:
+ __kasan_kmalloc+0x81/0xa0
+ nvmet_auth_ctrl_sesskey+0xf6/0x380 [nvmet]
+ nvmet_auth_reply+0x119/0x990 [nvmet]
+
+ Freed by task 143270:
+ kfree+0xec/0x4b0
+ nvmet_auth_sq_free+0xe1/0x160 [nvmet]
+ process_one_work+0x8e5/0x1510
+
+Fix this bug by calling nvmet_req_complete() only after freeing the
+pointers, so we will prevent the race by holding the sq reference.
+
+V2: remove redundant code
+
+Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/fabrics-cmd-auth.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvme/target/fabrics-cmd-auth.c
++++ b/drivers/nvme/target/fabrics-cmd-auth.c
+@@ -333,19 +333,21 @@ done:
+ __func__, ctrl->cntlid, req->sq->qid,
+ status, req->error_loc);
+ req->cqe->result.u64 = 0;
+- nvmet_req_complete(req, status);
+ if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
+ req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
+ unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
+
+ mod_delayed_work(system_wq, &req->sq->auth_expired_work,
+ auth_expire_secs * HZ);
+- return;
++ goto complete;
+ }
+ /* Final states, clear up variables */
+ nvmet_auth_sq_free(req->sq);
+ if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)
+ nvmet_ctrl_fatal_error(ctrl);
++
++complete:
++ nvmet_req_complete(req, status);
+ }
+
+ static int nvmet_auth_challenge(struct nvmet_req *req, void *d, int al)
+@@ -514,11 +516,12 @@ void nvmet_execute_auth_receive(struct n
+ kfree(d);
+ done:
+ req->cqe->result.u64 = 0;
+- nvmet_req_complete(req, status);
++
+ if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)
+ nvmet_auth_sq_free(req->sq);
+ else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
+ nvmet_auth_sq_free(req->sq);
+ nvmet_ctrl_fatal_error(ctrl);
+ }
++ nvmet_req_complete(req, status);
+ }
--- /dev/null
+From 7a48b58eb5ff3798f0480d2da16bf27df9654fc7 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 28 Sep 2023 10:16:05 +0300
+Subject: perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 7a48b58eb5ff3798f0480d2da16bf27df9654fc7 upstream.
+
+Stop calling addr_location__exit() when addr_location__init() was not
+called.
+
+Fixes: 0dd5041c9a0e ("perf addr_location: Add init/exit/copy functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20230928071605.17624-1-adrian.hunter@intel.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/dlfilter.c | 34 ++++++++++++++++------------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+--- a/tools/perf/util/dlfilter.c
++++ b/tools/perf/util/dlfilter.c
+@@ -280,13 +280,21 @@ static struct perf_event_attr *dlfilter_
+ return &d->evsel->core.attr;
+ }
+
++static __s32 code_read(__u64 ip, struct map *map, struct machine *machine, void *buf, __u32 len)
++{
++ u64 offset = map__map_ip(map, ip);
++
++ if (ip + len >= map__end(map))
++ len = map__end(map) - ip;
++
++ return dso__data_read_offset(map__dso(map), machine, offset, buf, len);
++}
++
+ static __s32 dlfilter__object_code(void *ctx, __u64 ip, void *buf, __u32 len)
+ {
+ struct dlfilter *d = (struct dlfilter *)ctx;
+ struct addr_location *al;
+ struct addr_location a;
+- struct map *map;
+- u64 offset;
+ __s32 ret;
+
+ if (!d->ctx_valid)
+@@ -296,27 +304,17 @@ static __s32 dlfilter__object_code(void
+ if (!al)
+ return -1;
+
+- map = al->map;
+-
+- if (map && ip >= map__start(map) && ip < map__end(map) &&
++ if (al->map && ip >= map__start(al->map) && ip < map__end(al->map) &&
+ machine__kernel_ip(d->machine, ip) == machine__kernel_ip(d->machine, d->sample->ip))
+- goto have_map;
++ return code_read(ip, al->map, d->machine, buf, len);
+
+ addr_location__init(&a);
++
+ thread__find_map_fb(al->thread, d->sample->cpumode, ip, &a);
+- if (!a.map) {
+- ret = -1;
+- goto out;
+- }
+-
+- map = a.map;
+-have_map:
+- offset = map__map_ip(map, ip);
+- if (ip + len >= map__end(map))
+- len = map__end(map) - ip;
+- ret = dso__data_read_offset(map__dso(map), d->machine, offset, buf, len);
+-out:
++ ret = a.map ? code_read(ip, a.map, d->machine, buf, len) : -1;
++
+ addr_location__exit(&a);
++
+ return ret;
+ }
+
--- /dev/null
+From c8befdc411e5fd1bf95a13e8744c8ca79b412bee Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 13 Oct 2023 16:57:05 +0200
+Subject: pinctrl: qcom: lpass-lpi: fix concurrent register updates
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit c8befdc411e5fd1bf95a13e8744c8ca79b412bee upstream.
+
+The Qualcomm LPASS LPI pin controller driver uses one lock for guarding
+Read-Modify-Write code for slew rate registers. However the pin
+configuration and muxing registers have exactly the same RMW code but
+are not protected.
+
+Pin controller framework does not provide locking here, thus it is
+possible to trigger simultaneous change of pin configuration registers
+resulting in non-atomic changes.
+
+Protect from concurrent access by re-using the same lock used to cover
+the slew rate register. Using the same lock instead of adding second
+one will make more sense, once we add support for newer Qualcomm SoC,
+where slew rate is configured in the same register as pin
+configuration/muxing.
+
+Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20231013145705.219954-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+@@ -31,7 +31,8 @@ struct lpi_pinctrl {
+ char __iomem *tlmm_base;
+ char __iomem *slew_base;
+ struct clk_bulk_data clks[MAX_LPI_NUM_CLKS];
+- struct mutex slew_access_lock;
++ /* Protects from concurrent register updates */
++ struct mutex lock;
+ DECLARE_BITMAP(ever_gpio, MAX_NR_GPIO);
+ const struct lpi_pinctrl_variant_data *data;
+ };
+@@ -102,6 +103,7 @@ static int lpi_gpio_set_mux(struct pinct
+ if (WARN_ON(i == g->nfuncs))
+ return -EINVAL;
+
++ mutex_lock(&pctrl->lock);
+ val = lpi_gpio_read(pctrl, pin, LPI_GPIO_CFG_REG);
+
+ /*
+@@ -127,6 +129,7 @@ static int lpi_gpio_set_mux(struct pinct
+
+ u32p_replace_bits(&val, i, LPI_GPIO_FUNCTION_MASK);
+ lpi_gpio_write(pctrl, pin, LPI_GPIO_CFG_REG, val);
++ mutex_unlock(&pctrl->lock);
+
+ return 0;
+ }
+@@ -232,14 +235,14 @@ static int lpi_config_set(struct pinctrl
+ if (slew_offset == LPI_NO_SLEW)
+ break;
+
+- mutex_lock(&pctrl->slew_access_lock);
++ mutex_lock(&pctrl->lock);
+
+ sval = ioread32(pctrl->slew_base + LPI_SLEW_RATE_CTL_REG);
+ sval &= ~(LPI_SLEW_RATE_MASK << slew_offset);
+ sval |= arg << slew_offset;
+ iowrite32(sval, pctrl->slew_base + LPI_SLEW_RATE_CTL_REG);
+
+- mutex_unlock(&pctrl->slew_access_lock);
++ mutex_unlock(&pctrl->lock);
+ break;
+ default:
+ return -EINVAL;
+@@ -255,6 +258,7 @@ static int lpi_config_set(struct pinctrl
+ lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val);
+ }
+
++ mutex_lock(&pctrl->lock);
+ val = lpi_gpio_read(pctrl, group, LPI_GPIO_CFG_REG);
+
+ u32p_replace_bits(&val, pullup, LPI_GPIO_PULL_MASK);
+@@ -263,6 +267,7 @@ static int lpi_config_set(struct pinctrl
+ u32p_replace_bits(&val, output_enabled, LPI_GPIO_OE_MASK);
+
+ lpi_gpio_write(pctrl, group, LPI_GPIO_CFG_REG, val);
++ mutex_unlock(&pctrl->lock);
+
+ return 0;
+ }
+@@ -464,7 +469,7 @@ int lpi_pinctrl_probe(struct platform_de
+ pctrl->chip.label = dev_name(dev);
+ pctrl->chip.can_sleep = false;
+
+- mutex_init(&pctrl->slew_access_lock);
++ mutex_init(&pctrl->lock);
+
+ pctrl->ctrl = devm_pinctrl_register(dev, &pctrl->desc, pctrl);
+ if (IS_ERR(pctrl->ctrl)) {
+@@ -486,7 +491,7 @@ int lpi_pinctrl_probe(struct platform_de
+ return 0;
+
+ err_pinctrl:
+- mutex_destroy(&pctrl->slew_access_lock);
++ mutex_destroy(&pctrl->lock);
+ clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
+
+ return ret;
+@@ -498,7 +503,7 @@ int lpi_pinctrl_remove(struct platform_d
+ struct lpi_pinctrl *pctrl = platform_get_drvdata(pdev);
+ int i;
+
+- mutex_destroy(&pctrl->slew_access_lock);
++ mutex_destroy(&pctrl->lock);
+ clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks);
+
+ for (i = 0; i < pctrl->data->npins; i++)
--- /dev/null
+From f63955721a8020e979b99cc417dcb6da3106aa24 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sun, 8 Oct 2023 14:20:19 -0400
+Subject: pNFS: Fix a hang in nfs4_evict_inode()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream.
+
+We are not allowed to call pnfs_mark_matching_lsegs_return() without
+also holding a reference to the layout header, since doing so could lead
+to the reference count going to zero when we call
+pnfs_layout_remove_lseg(). This again can lead to a hang when we get to
+nfs4_evict_inode() and are unable to clear the layout pointer.
+
+pnfs_layout_return_unused_byserver() is guilty of this behaviour, and
+has been seen to trigger the refcount warning prior to a hang.
+
+Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2634,31 +2634,44 @@ pnfs_should_return_unused_layout(struct
+ return mode == 0;
+ }
+
+-static int
+-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data)
++static int pnfs_layout_return_unused_byserver(struct nfs_server *server,
++ void *data)
+ {
+ const struct pnfs_layout_range *range = data;
++ const struct cred *cred;
+ struct pnfs_layout_hdr *lo;
+ struct inode *inode;
++ nfs4_stateid stateid;
++ enum pnfs_iomode iomode;
++
+ restart:
+ rcu_read_lock();
+ list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) {
+- if (!pnfs_layout_can_be_returned(lo) ||
++ inode = lo->plh_inode;
++ if (!inode || !pnfs_layout_can_be_returned(lo) ||
+ test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
+ continue;
+- inode = lo->plh_inode;
+ spin_lock(&inode->i_lock);
+- if (!pnfs_should_return_unused_layout(lo, range)) {
++ if (!lo->plh_inode ||
++ !pnfs_should_return_unused_layout(lo, range)) {
+ spin_unlock(&inode->i_lock);
+ continue;
+ }
++ pnfs_get_layout_hdr(lo);
++ pnfs_set_plh_return_info(lo, range->iomode, 0);
++ if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
++ range, 0) != 0 ||
++ !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) {
++ spin_unlock(&inode->i_lock);
++ rcu_read_unlock();
++ pnfs_put_layout_hdr(lo);
++ cond_resched();
++ goto restart;
++ }
+ spin_unlock(&inode->i_lock);
+- inode = pnfs_grab_inode_layout_hdr(lo);
+- if (!inode)
+- continue;
+ rcu_read_unlock();
+- pnfs_mark_layout_for_return(inode, range);
+- iput(inode);
++ pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false);
++ pnfs_put_layout_hdr(lo);
+ cond_resched();
+ goto restart;
+ }
--- /dev/null
+From e1c6cfbb3bd1377e2ddcbe06cf8fb1ec323ea7d3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sun, 8 Oct 2023 14:28:46 -0400
+Subject: pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit e1c6cfbb3bd1377e2ddcbe06cf8fb1ec323ea7d3 upstream.
+
+Ensure that we check the layout pointer and validity after dereferencing
+it in ff_layout_mirror_prepare_stats.
+
+Fixes: 08e2e5bc6c9a ("pNFS/flexfiles: Clean up layoutstats")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -2520,9 +2520,9 @@ ff_layout_mirror_prepare_stats(struct pn
+ return i;
+ }
+
+-static int
+-ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args)
++static int ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args)
+ {
++ struct pnfs_layout_hdr *lo;
+ struct nfs4_flexfile_layout *ff_layout;
+ const int dev_count = PNFS_LAYOUTSTATS_MAXDEV;
+
+@@ -2533,11 +2533,14 @@ ff_layout_prepare_layoutstats(struct nfs
+ return -ENOMEM;
+
+ spin_lock(&args->inode->i_lock);
+- ff_layout = FF_LAYOUT_FROM_HDR(NFS_I(args->inode)->layout);
+- args->num_dev = ff_layout_mirror_prepare_stats(&ff_layout->generic_hdr,
+- &args->devinfo[0],
+- dev_count,
+- NFS4_FF_OP_LAYOUTSTATS);
++ lo = NFS_I(args->inode)->layout;
++ if (lo && pnfs_layout_is_valid(lo)) {
++ ff_layout = FF_LAYOUT_FROM_HDR(lo);
++ args->num_dev = ff_layout_mirror_prepare_stats(
++ &ff_layout->generic_hdr, &args->devinfo[0], dev_count,
++ NFS4_FF_OP_LAYOUTSTATS);
++ } else
++ args->num_dev = 0;
+ spin_unlock(&args->inode->i_lock);
+ if (!args->num_dev) {
+ kfree(args->devinfo);
--- /dev/null
+From 610b5d219d1ccac8064556310cc0e62e3c202389 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Date: Tue, 17 Oct 2023 14:13:53 +0200
+Subject: Revert "accel/ivpu: Use cached buffers for FW loading"
+
+From: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+
+commit 610b5d219d1ccac8064556310cc0e62e3c202389 upstream.
+
+This reverts commit 645d694559cab36fe6a57c717efcfa27d9321396.
+
+The commit cause issues with memory access from the device side.
+Switch back to write-combined memory mappings until the issues
+will be properly addressed.
+
+Add extra wmb() needed when boot_params->save_restore_ret_address() is
+modified.
+
+Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
+Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231017121353.532466-1-stanislaw.gruszka@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_fw.c | 9 ++++-----
+ drivers/accel/ivpu/ivpu_gem.h | 5 -----
+ 2 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/accel/ivpu/ivpu_fw.c
++++ b/drivers/accel/ivpu/ivpu_fw.c
+@@ -195,8 +195,7 @@ static int ivpu_fw_mem_init(struct ivpu_
+ if (ret)
+ return ret;
+
+- fw->mem = ivpu_bo_alloc_internal(vdev, fw->runtime_addr, fw->runtime_size,
+- DRM_IVPU_BO_CACHED | DRM_IVPU_BO_NOSNOOP);
++ fw->mem = ivpu_bo_alloc_internal(vdev, fw->runtime_addr, fw->runtime_size, DRM_IVPU_BO_WC);
+ if (!fw->mem) {
+ ivpu_err(vdev, "Failed to allocate firmware runtime memory\n");
+ return -ENOMEM;
+@@ -273,7 +272,7 @@ int ivpu_fw_load(struct ivpu_device *vde
+ memset(start, 0, size);
+ }
+
+- clflush_cache_range(fw->mem->kvaddr, fw->mem->base.size);
++ wmb(); /* Flush WC buffers after writing fw->mem */
+
+ return 0;
+ }
+@@ -375,7 +374,7 @@ void ivpu_fw_boot_params_setup(struct iv
+ if (!ivpu_fw_is_cold_boot(vdev)) {
+ boot_params->save_restore_ret_address = 0;
+ vdev->pm->is_warmboot = true;
+- clflush_cache_range(vdev->fw->mem->kvaddr, SZ_4K);
++ wmb(); /* Flush WC buffers after writing save_restore_ret_address */
+ return;
+ }
+
+@@ -430,7 +429,7 @@ void ivpu_fw_boot_params_setup(struct iv
+ boot_params->punit_telemetry_sram_size = ivpu_hw_reg_telemetry_size_get(vdev);
+ boot_params->vpu_telemetry_enable = ivpu_hw_reg_telemetry_enable_get(vdev);
+
+- clflush_cache_range(vdev->fw->mem->kvaddr, SZ_4K);
++ wmb(); /* Flush WC buffers after writing bootparams */
+
+ ivpu_fw_boot_params_print(vdev, boot_params);
+ }
+--- a/drivers/accel/ivpu/ivpu_gem.h
++++ b/drivers/accel/ivpu/ivpu_gem.h
+@@ -8,8 +8,6 @@
+ #include <drm/drm_gem.h>
+ #include <drm/drm_mm.h>
+
+-#define DRM_IVPU_BO_NOSNOOP 0x10000000
+-
+ struct dma_buf;
+ struct ivpu_bo_ops;
+ struct ivpu_file_priv;
+@@ -85,9 +83,6 @@ static inline u32 ivpu_bo_cache_mode(str
+
+ static inline bool ivpu_bo_is_snooped(struct ivpu_bo *bo)
+ {
+- if (bo->flags & DRM_IVPU_BO_NOSNOOP)
+- return false;
+-
+ return ivpu_bo_cache_mode(bo) == DRM_IVPU_BO_CACHED;
+ }
+
--- /dev/null
+From 62140a1e4dec4594d5d1e1d353747bf2ef434e8b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 17 Oct 2023 17:18:06 +0300
+Subject: Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream.
+
+The commit breaks MMC enumeration on the Intel Merrifield
+plaform.
+
+Before:
+[ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA
+[ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
+[ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA
+[ 36.706399] mmc0: new DDR MMC card at address 0001
+[ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001
+[ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB
+[ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
+
+After:
+[ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
+[ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA
+[ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA
+[ 36.720627] mmc1: new DDR MMC card at address 0001
+[ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001
+[ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB
+[ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
+
+This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/core.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1012,20 +1012,17 @@ static int add_setting(struct pinctrl *p
+
+ static struct pinctrl *find_pinctrl(struct device *dev)
+ {
+- struct pinctrl *entry, *p = NULL;
++ struct pinctrl *p;
+
+ mutex_lock(&pinctrl_list_mutex);
+-
+- list_for_each_entry(entry, &pinctrl_list, node) {
+- if (entry->dev == dev) {
+- p = entry;
+- kref_get(&p->users);
+- break;
++ list_for_each_entry(p, &pinctrl_list, node)
++ if (p->dev == dev) {
++ mutex_unlock(&pinctrl_list_mutex);
++ return p;
+ }
+- }
+
+ mutex_unlock(&pinctrl_list_mutex);
+- return p;
++ return NULL;
+ }
+
+ static void pinctrl_free(struct pinctrl *p, bool inlist);
+@@ -1133,6 +1130,7 @@ struct pinctrl *pinctrl_get(struct devic
+ p = find_pinctrl(dev);
+ if (p) {
+ dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
++ kref_get(&p->users);
+ return p;
+ }
+
tcp_bpf-properly-release-resources-on-error-paths.patch
net-store-netdevs-in-an-xarray.patch
net-move-altnames-together-with-the-netdevice.patch
+mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch
+mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch
+mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch
+mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch
+mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch
+mtd-spinand-micron-correct-bitmask-for-ecc-status.patch
+mtd-physmap-core-restore-map_rom-fallback.patch
+dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch
+mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch
+mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch
+mmc-core-fix-error-propagation-for-some-ioctl-commands.patch
+mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch
+mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch
+pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch
+revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch
+pnfs-fix-a-hang-in-nfs4_evict_inode.patch
+pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch
+nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch
+acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch
+acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch
+perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch
+revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch
+fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch
+nfs-fix-potential-oops-in-nfs_inode_remove_request.patch
+nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch
+nvme-sanitize-metadata-bounce-buffer-for-reads.patch
+nvme-pci-add-bogus_nid-for-intel-0a54-device.patch
+nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch
+nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch
+nvme-rdma-do-not-try-to-stop-unallocated-queues.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
