--- /dev/null
+From 0c21a18d5d6c6a73d098fb9b4701572370942df9 Mon Sep 17 00:00:00 2001
+From: Sunil V L <sunilvl@ventanamicro.com>
+Date: Mon, 16 Oct 2023 22:39:39 +0530
+Subject: ACPI: irq: Fix incorrect return value in acpi_register_gsi()
+
+From: Sunil V L <sunilvl@ventanamicro.com>
+
+commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream.
+
+acpi_register_gsi() should return a negative value in case of failure.
+
+Currently, it returns the return value from irq_create_fwspec_mapping().
+However, irq_create_fwspec_mapping() returns 0 for failure. Fix the
+issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero.
+
+Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping")
+Cc: 4.11+ <stable@vger.kernel.org> # 4.11+
+Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+[ rjw: Rename a new local variable ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/irq.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/irq.c
++++ b/drivers/acpi/irq.c
+@@ -52,6 +52,7 @@ int acpi_register_gsi(struct device *dev
+ int polarity)
+ {
+ struct irq_fwspec fwspec;
++ unsigned int irq;
+
+ if (WARN_ON(!acpi_gsi_domain_id)) {
+ pr_warn("GSI: No registered irqchip, giving up\n");
+@@ -63,7 +64,11 @@ int acpi_register_gsi(struct device *dev
+ fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity);
+ fwspec.param_count = 2;
+
+- return irq_create_fwspec_mapping(&fwspec);
++ irq = irq_create_fwspec_mapping(&fwspec);
++ if (!irq)
++ return -EINVAL;
++
++ return irq;
+ }
+ EXPORT_SYMBOL_GPL(acpi_register_gsi);
+
--- /dev/null
+From 84ee19bffc9306128cd0f1c650e89767079efeff Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Wed, 27 Sep 2023 10:15:00 +0300
+Subject: mmc: core: Capture correct oemid-bits for eMMC cards
+
+From: Avri Altman <avri.altman@wdc.com>
+
+commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream.
+
+The OEMID is an 8-bit binary number rather than 16-bit as the current code
+parses for. The OEMID occupies bits [111:104] in the CID register, see the
+eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from
+the legacy MMC specs (v3.31 and before).
+
+Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This
+means we ignore the impact on some of those old MMC cards that may be out
+there, but on the other hand this shouldn't be a problem as the OEMID seems
+not be an important feature for these cards.
+
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -96,7 +96,7 @@ static int mmc_decode_cid(struct mmc_car
+ case 3: /* MMC v3.1 - v3.3 */
+ case 4: /* MMC v4 */
+ card->cid.manfid = UNSTUFF_BITS(resp, 120, 8);
+- card->cid.oemid = UNSTUFF_BITS(resp, 104, 16);
++ card->cid.oemid = UNSTUFF_BITS(resp, 104, 8);
+ card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8);
+ card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8);
+ card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8);
--- /dev/null
+From 32a9cdb8869dc111a0c96cf8e1762be9684af15b Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Wed, 30 Aug 2023 17:39:22 +0800
+Subject: mmc: core: sdio: hold retuning if sdio in 1-bit mode
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream.
+
+tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode,
+need to hold retuning.
+
+Find this issue when use manual tuning method on imx93. When system
+resume back, SDIO WIFI try to switch back to 4 bit mode, first will
+trigger retuning, and all tuning command failed.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/sdio.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -1073,8 +1073,14 @@ static int mmc_sdio_resume(struct mmc_ho
+ }
+ err = mmc_sdio_reinit_card(host);
+ } else if (mmc_card_wake_sdio_irq(host)) {
+- /* We may have switched to 1-bit mode during suspend */
++ /*
++ * We may have switched to 1-bit mode during suspend,
++ * need to hold retuning, because tuning only supprt
++ * 4-bit mode or 8 bit mode.
++ */
++ mmc_retune_hold_now(host);
+ err = sdio_enable_4bit_bus(host->card);
++ mmc_retune_release(host);
+ }
+
+ if (err)
--- /dev/null
+From c7bb120c1c66672b657e95d0942c989b8275aeb3 Mon Sep 17 00:00:00 2001
+From: Pablo Sun <pablo.sun@mediatek.com>
+Date: Fri, 22 Sep 2023 17:53:48 +0800
+Subject: mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw
+
+From: Pablo Sun <pablo.sun@mediatek.com>
+
+commit c7bb120c1c66672b657e95d0942c989b8275aeb3 upstream.
+
+Use atomic readl_poll_timeout_atomic, because msdc_reset_hw
+may be invoked in IRQ handler in the following context:
+
+ msdc_irq() -> msdc_cmd_done() -> msdc_reset_hw()
+
+The following kernel BUG stack trace can be observed on
+Genio 1200 EVK after initializing MSDC1 hardware during kernel boot:
+
+[ 1.187441] BUG: scheduling while atomic: swapper/0/0/0x00010002
+[ 1.189157] Modules linked in:
+[ 1.204633] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.15.42-mtk+modified #1
+[ 1.205713] Hardware name: MediaTek Genio 1200 EVK-P1V2-EMMC (DT)
+[ 1.206484] Call trace:
+[ 1.206796] dump_backtrace+0x0/0x1ac
+[ 1.207266] show_stack+0x24/0x30
+[ 1.207692] dump_stack_lvl+0x68/0x84
+[ 1.208162] dump_stack+0x1c/0x38
+[ 1.208587] __schedule_bug+0x68/0x80
+[ 1.209056] __schedule+0x6ec/0x7c0
+[ 1.209502] schedule+0x7c/0x110
+[ 1.209915] schedule_hrtimeout_range_clock+0xc4/0x1f0
+[ 1.210569] schedule_hrtimeout_range+0x20/0x30
+[ 1.211148] usleep_range_state+0x84/0xc0
+[ 1.211661] msdc_reset_hw+0xc8/0x1b0
+[ 1.212134] msdc_cmd_done.isra.0+0x4ac/0x5f0
+[ 1.212693] msdc_irq+0x104/0x2d4
+[ 1.213121] __handle_irq_event_percpu+0x68/0x280
+[ 1.213725] handle_irq_event+0x70/0x15c
+[ 1.214230] handle_fasteoi_irq+0xb0/0x1a4
+[ 1.214755] handle_domain_irq+0x6c/0x9c
+[ 1.215260] gic_handle_irq+0xc4/0x180
+[ 1.215741] call_on_irq_stack+0x2c/0x54
+[ 1.216245] do_interrupt_handler+0x5c/0x70
+[ 1.216782] el1_interrupt+0x30/0x80
+[ 1.217242] el1h_64_irq_handler+0x1c/0x2c
+[ 1.217769] el1h_64_irq+0x78/0x7c
+[ 1.218206] cpuidle_enter_state+0xc8/0x600
+[ 1.218744] cpuidle_enter+0x44/0x5c
+[ 1.219205] do_idle+0x224/0x2d0
+[ 1.219624] cpu_startup_entry+0x30/0x80
+[ 1.220129] rest_init+0x108/0x134
+[ 1.220568] arch_call_rest_init+0x1c/0x28
+[ 1.221094] start_kernel+0x6c0/0x700
+[ 1.221564] __primary_switched+0xc0/0xc8
+
+Fixes: ffaea6ebfe9c ("mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling")
+Signed-off-by: Pablo Sun <pablo.sun@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioachino.delregno@collabora.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230922095348.22182-1-pablo.sun@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/mtk-sd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -628,11 +628,11 @@ static void msdc_reset_hw(struct msdc_ho
+ u32 val;
+
+ sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_RST);
+- readl_poll_timeout(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0);
++ readl_poll_timeout_atomic(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0);
+
+ sdr_set_bits(host->base + MSDC_FIFOCS, MSDC_FIFOCS_CLR);
+- readl_poll_timeout(host->base + MSDC_FIFOCS, val,
+- !(val & MSDC_FIFOCS_CLR), 0, 0);
++ readl_poll_timeout_atomic(host->base + MSDC_FIFOCS, val,
++ !(val & MSDC_FIFOCS_CLR), 0, 0);
+
+ val = readl(host->base + MSDC_INT);
+ writel(val, host->base + MSDC_INT);
--- /dev/null
+From 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 30 Aug 2023 17:00:34 +0200
+Subject: mtd: physmap-core: Restore map_rom fallback
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream.
+
+When the exact mapping type driver was not available, the old
+physmap_of_core driver fell back to mapping the region as ROM.
+Unfortunately this feature was lost when the DT and pdata cases were
+merged. Revive this useful feature.
+
+Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/maps/physmap-core.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/mtd/maps/physmap-core.c
++++ b/drivers/mtd/maps/physmap-core.c
+@@ -556,6 +556,17 @@ static int physmap_flash_probe(struct pl
+ if (info->probe_type) {
+ info->mtds[i] = do_map_probe(info->probe_type,
+ &info->maps[i]);
++
++ /* Fall back to mapping region as ROM */
++ if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) &&
++ strcmp(info->probe_type, "map_rom")) {
++ dev_warn(&dev->dev,
++ "map_probe() failed for type %s\n",
++ info->probe_type);
++
++ info->mtds[i] = do_map_probe("map_rom",
++ &info->maps[i]);
++ }
+ } else {
+ int j;
+
--- /dev/null
+From 3a4a893dbb19e229db3b753f0462520b561dee98 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:20 +0200
+Subject: mtd: rawnand: arasan: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: Michal Simek <michal.simek@amd.com>
+Cc: stable@vger.kernel.org
+Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/arasan-nand-controller.c
++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c
+@@ -515,6 +515,7 @@ static int anfc_write_page_hw_ecc(struct
+ struct mtd_info *mtd = nand_to_mtd(chip);
+ unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0);
+ dma_addr_t dma_addr;
++ u8 status;
+ int ret;
+ struct anfc_op nfc_op = {
+ .pkt_reg =
+@@ -561,10 +562,21 @@ static int anfc_write_page_hw_ecc(struct
+ }
+
+ /* Spare data is not protected */
+- if (oob_required)
++ if (oob_required) {
+ ret = nand_write_oob_std(chip, page);
++ if (ret)
++ return ret;
++ }
++
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
+
+- return ret;
++ return 0;
+ }
+
+ static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,
--- /dev/null
+From 3e01d5254698ea3d18e09d96b974c762328352cd Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:19 +0200
+Subject: mtd: rawnand: marvell: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: stable@vger.kernel.org
+Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
+Reported-by: Aviram Dali <aviramd@marvell.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Ravi Chandra Minnikanti <rminnikanti@marvell.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -1148,6 +1148,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
+ .ndcb[2] = NDCB2_ADDR5_PAGE(page),
+ };
+ unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0);
++ u8 status;
+ int ret;
+
+ /* NFCv2 needs more information about the operation being executed */
+@@ -1181,7 +1182,18 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
+
+ ret = marvell_nfc_wait_op(chip,
+ PSEC_TO_MSEC(sdr->tPROG_max));
+- return ret;
++ if (ret)
++ return ret;
++
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
++
++ return 0;
+ }
+
+ static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip,
+@@ -1610,6 +1622,7 @@ static int marvell_nfc_hw_ecc_bch_write_
+ int data_len = lt->data_bytes;
+ int spare_len = lt->spare_bytes;
+ int chunk, ret;
++ u8 status;
+
+ marvell_nfc_select_target(chip, chip->cur_cs);
+
+@@ -1646,6 +1659,14 @@ static int marvell_nfc_hw_ecc_bch_write_
+ if (ret)
+ return ret;
+
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ return ret;
++
++ if (status & NAND_STATUS_FAIL)
++ return -EIO;
++
+ return 0;
+ }
+
--- /dev/null
+From 9777cc13fd2c3212618904636354be60835e10bb Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 17 Jul 2023 21:42:21 +0200
+Subject: mtd: rawnand: pl353: Ensure program page operations are successful
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 9777cc13fd2c3212618904636354be60835e10bb upstream.
+
+The NAND core complies with the ONFI specification, which itself
+mentions that after any program or erase operation, a status check
+should be performed to see whether the operation was finished *and*
+successful.
+
+The NAND core offers helpers to finish a page write (sending the
+"PAGE PROG" command, waiting for the NAND chip to be ready again, and
+checking the operation status). But in some cases, advanced controller
+drivers might want to optimize this and craft their own page write
+helper to leverage additional hardware capabilities, thus not always
+using the core facilities.
+
+Some drivers, like this one, do not use the core helper to finish a page
+write because the final cycles are automatically managed by the
+hardware. In this case, the additional care must be taken to manually
+perform the final status check.
+
+Let's read the NAND chip status at the end of the page write helper and
+return -EIO upon error.
+
+Cc: Michal Simek <michal.simek@amd.com>
+Cc: stable@vger.kernel.org
+Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-3-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c
++++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c
+@@ -513,6 +513,7 @@ static int pl35x_nand_write_page_hwecc(s
+ u32 addr1 = 0, addr2 = 0, row;
+ u32 cmd_addr;
+ int i, ret;
++ u8 status;
+
+ ret = pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_APB);
+ if (ret)
+@@ -565,6 +566,14 @@ static int pl35x_nand_write_page_hwecc(s
+ if (ret)
+ goto disable_ecc_engine;
+
++ /* Check write status on the chip side */
++ ret = nand_status_op(chip, &status);
++ if (ret)
++ goto disable_ecc_engine;
++
++ if (status & NAND_STATUS_FAIL)
++ ret = -EIO;
++
+ disable_ecc_engine:
+ pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_BYPASS);
+
--- /dev/null
+From 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd Mon Sep 17 00:00:00 2001
+From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+Date: Wed, 13 Sep 2023 12:37:02 +0530
+Subject: mtd: rawnand: qcom: Unmap the right resource upon probe failure
+
+From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+
+commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream.
+
+We currently provide the physical address of the DMA region
+rather than the output of dma_map_resource() which is obviously wrong.
+
+Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()")
+Cc: stable@vger.kernel.org
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -3093,7 +3093,7 @@ err_nandc_alloc:
+ err_aon_clk:
+ clk_disable_unprepare(nandc->core_clk);
+ err_core_clk:
+- dma_unmap_resource(dev, res->start, resource_size(res),
++ dma_unmap_resource(dev, nandc->base_dma, resource_size(res),
+ DMA_BIDIRECTIONAL, 0);
+ return ret;
+ }
--- /dev/null
+From 9836a987860e33943945d4b257729a4f94eae576 Mon Sep 17 00:00:00 2001
+From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+Date: Tue, 5 Sep 2023 17:56:37 +0300
+Subject: mtd: spinand: micron: correct bitmask for ecc status
+
+From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+
+commit 9836a987860e33943945d4b257729a4f94eae576 upstream.
+
+Valid bitmask is 0x70 in the status register.
+
+Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD")
+Signed-off-by: Martin Kurbanov <mmkurbanov@sberdevices.ru>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/spi/micron.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/spi/micron.c
++++ b/drivers/mtd/nand/spi/micron.c
+@@ -12,7 +12,7 @@
+
+ #define SPINAND_MFR_MICRON 0x2c
+
+-#define MICRON_STATUS_ECC_MASK GENMASK(7, 4)
++#define MICRON_STATUS_ECC_MASK GENMASK(6, 4)
+ #define MICRON_STATUS_ECC_NO_BITFLIPS (0 << 4)
+ #define MICRON_STATUS_ECC_1TO3_BITFLIPS (1 << 4)
+ #define MICRON_STATUS_ECC_4TO6_BITFLIPS (3 << 4)
--- /dev/null
+From 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Mon, 9 Oct 2023 10:59:01 -0400
+Subject: NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+commit 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 upstream.
+
+This patches fixes commit 51d674a5e488 "NFSv4.1: use
+EXCHGID4_FLAG_USE_PNFS_DS for DS server", purpose of that
+commit was to mark EXCHANGE_ID to the DS with the appropriate
+flag.
+
+However, connection to MDS can return both EXCHGID4_FLAG_USE_PNFS_DS
+and EXCHGID4_FLAG_USE_PNFS_MDS set but previous patch would only
+remember the USE_PNFS_DS and for the 2nd EXCHANGE_ID send that
+to the MDS.
+
+Instead, just mark the pnfs path exclusively.
+
+Fixes: 51d674a5e488 ("NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8794,8 +8794,6 @@ static int _nfs4_proc_exchange_id(struct
+ /* Save the EXCHANGE_ID verifier session trunk tests */
+ memcpy(clp->cl_confirm.data, argp->verifier.data,
+ sizeof(clp->cl_confirm.data));
+- if (resp->flags & EXCHGID4_FLAG_USE_PNFS_DS)
+- set_bit(NFS_CS_DS, &clp->cl_flags);
+ out:
+ trace_nfs4_exchange_id(clp, status);
+ rpc_put_task(task);
--- /dev/null
+From 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Thu, 12 Oct 2023 11:13:51 -0700
+Subject: nvme-pci: add BOGUS_NID for Intel 0a54 device
+
+From: Keith Busch <kbusch@kernel.org>
+
+commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream.
+
+These ones claim cmic and nmic capable, so need special consideration to ignore
+their duplicate identifiers.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981
+Reported-by: welsh@cassens.com
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3307,7 +3307,8 @@ static const struct pci_device_id nvme_i
+ { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */
+ .driver_data = NVME_QUIRK_STRIPE_SIZE |
+ NVME_QUIRK_DEALLOCATE_ZEROES |
+- NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++ NVME_QUIRK_IGNORE_DEV_SUBNQN |
++ NVME_QUIRK_BOGUS_NID, },
+ { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */
+ .driver_data = NVME_QUIRK_STRIPE_SIZE |
+ NVME_QUIRK_DEALLOCATE_ZEROES, },
--- /dev/null
+From 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 Mon Sep 17 00:00:00 2001
+From: Maurizio Lombardi <mlombard@redhat.com>
+Date: Mon, 31 Jul 2023 12:37:58 +0200
+Subject: nvme-rdma: do not try to stop unallocated queues
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream.
+
+Trying to stop a queue which hasn't been allocated will result
+in a warning due to calling mutex_lock() against an uninitialized mutex.
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+ WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579
+
+ Call trace:
+ RIP: 0010:__mutex_lock+0x1173/0x14a0
+ nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma]
+ nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma]
+ nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma]
+ nvme_do_delete_ctrl+0x149/0x158 [nvme_core]
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/rdma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -645,6 +645,9 @@ static void __nvme_rdma_stop_queue(struc
+
+ static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
+ {
++ if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
++ return;
++
+ mutex_lock(&queue->queue_lock);
+ if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
+ __nvme_rdma_stop_queue(queue);
--- /dev/null
+From f63955721a8020e979b99cc417dcb6da3106aa24 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sun, 8 Oct 2023 14:20:19 -0400
+Subject: pNFS: Fix a hang in nfs4_evict_inode()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream.
+
+We are not allowed to call pnfs_mark_matching_lsegs_return() without
+also holding a reference to the layout header, since doing so could lead
+to the reference count going to zero when we call
+pnfs_layout_remove_lseg(). This again can lead to a hang when we get to
+nfs4_evict_inode() and are unable to clear the layout pointer.
+
+pnfs_layout_return_unused_byserver() is guilty of this behaviour, and
+has been seen to trigger the refcount warning prior to a hang.
+
+Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2629,31 +2629,44 @@ pnfs_should_return_unused_layout(struct
+ return mode == 0;
+ }
+
+-static int
+-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data)
++static int pnfs_layout_return_unused_byserver(struct nfs_server *server,
++ void *data)
+ {
+ const struct pnfs_layout_range *range = data;
++ const struct cred *cred;
+ struct pnfs_layout_hdr *lo;
+ struct inode *inode;
++ nfs4_stateid stateid;
++ enum pnfs_iomode iomode;
++
+ restart:
+ rcu_read_lock();
+ list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) {
+- if (!pnfs_layout_can_be_returned(lo) ||
++ inode = lo->plh_inode;
++ if (!inode || !pnfs_layout_can_be_returned(lo) ||
+ test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
+ continue;
+- inode = lo->plh_inode;
+ spin_lock(&inode->i_lock);
+- if (!pnfs_should_return_unused_layout(lo, range)) {
++ if (!lo->plh_inode ||
++ !pnfs_should_return_unused_layout(lo, range)) {
+ spin_unlock(&inode->i_lock);
+ continue;
+ }
++ pnfs_get_layout_hdr(lo);
++ pnfs_set_plh_return_info(lo, range->iomode, 0);
++ if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
++ range, 0) != 0 ||
++ !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) {
++ spin_unlock(&inode->i_lock);
++ rcu_read_unlock();
++ pnfs_put_layout_hdr(lo);
++ cond_resched();
++ goto restart;
++ }
+ spin_unlock(&inode->i_lock);
+- inode = pnfs_grab_inode_layout_hdr(lo);
+- if (!inode)
+- continue;
+ rcu_read_unlock();
+- pnfs_mark_layout_for_return(inode, range);
+- iput(inode);
++ pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false);
++ pnfs_put_layout_hdr(lo);
+ cond_resched();
+ goto restart;
+ }
--- /dev/null
+From 62140a1e4dec4594d5d1e1d353747bf2ef434e8b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 17 Oct 2023 17:18:06 +0300
+Subject: Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream.
+
+The commit breaks MMC enumeration on the Intel Merrifield
+plaform.
+
+Before:
+[ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA
+[ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
+[ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA
+[ 36.706399] mmc0: new DDR MMC card at address 0001
+[ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001
+[ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB
+[ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
+
+After:
+[ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
+[ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA
+[ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA
+[ 36.720627] mmc1: new DDR MMC card at address 0001
+[ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001
+[ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB
+[ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
+
+This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/core.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -1007,20 +1007,17 @@ static int add_setting(struct pinctrl *p
+
+ static struct pinctrl *find_pinctrl(struct device *dev)
+ {
+- struct pinctrl *entry, *p = NULL;
++ struct pinctrl *p;
+
+ mutex_lock(&pinctrl_list_mutex);
+-
+- list_for_each_entry(entry, &pinctrl_list, node) {
+- if (entry->dev == dev) {
+- p = entry;
+- kref_get(&p->users);
+- break;
++ list_for_each_entry(p, &pinctrl_list, node)
++ if (p->dev == dev) {
++ mutex_unlock(&pinctrl_list_mutex);
++ return p;
+ }
+- }
+
+ mutex_unlock(&pinctrl_list_mutex);
+- return p;
++ return NULL;
+ }
+
+ static void pinctrl_free(struct pinctrl *p, bool inlist);
+@@ -1129,6 +1126,7 @@ struct pinctrl *pinctrl_get(struct devic
+ p = find_pinctrl(dev);
+ if (p) {
+ dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
++ kref_get(&p->users);
+ return p;
+ }
+
net-introduce-a-function-to-check-if-a-netdev-name-i.patch
net-move-from-strlcpy-with-unused-retval-to-strscpy.patch
net-fix-ifname-in-netlink-ntf-during-netns-move.patch
+mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch
+mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch
+mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch
+mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch
+mtd-spinand-micron-correct-bitmask-for-ecc-status.patch
+mtd-physmap-core-restore-map_rom-fallback.patch
+mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch
+mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch
+mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch
+revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch
+pnfs-fix-a-hang-in-nfs4_evict_inode.patch
+nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch
+acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch
+nvme-pci-add-bogus_nid-for-intel-0a54-device.patch
+nvme-rdma-do-not-try-to-stop-unallocated-queues.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
