--- /dev/null
+From 1c61990d3762a020817daa353da0a0af6794140b Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@gmail.com>
+Date: Fri, 14 Jun 2024 16:32:38 +0200
+Subject: kasan: fix bad call to unpoison_slab_object
+
+From: Andrey Konovalov <andreyknvl@gmail.com>
+
+commit 1c61990d3762a020817daa353da0a0af6794140b upstream.
+
+Commit 29d7355a9d05 ("kasan: save alloc stack traces for mempool") messed
+up one of the calls to unpoison_slab_object: the last two arguments are
+supposed to be GFP flags and whether to init the object memory.
+
+Fix the call.
+
+Without this fix, __kasan_mempool_unpoison_object provides the object's
+size as GFP flags to unpoison_slab_object, which can cause LOCKDEP reports
+(and probably other issues).
+
+Link: https://lkml.kernel.org/r/20240614143238.60323-1-andrey.konovalov@linux.dev
+Fixes: 29d7355a9d05 ("kasan: save alloc stack traces for mempool")
+Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
+Reported-by: Brad Spengler <spender@grsecurity.net>
+Acked-by: Marco Elver <elver@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/kasan/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/kasan/common.c
++++ b/mm/kasan/common.c
+@@ -532,7 +532,7 @@ void __kasan_mempool_unpoison_object(voi
+ return;
+
+ /* Unpoison the object and save alloc info for non-kmalloc() allocations. */
+- unpoison_slab_object(slab->slab_cache, ptr, size, flags);
++ unpoison_slab_object(slab->slab_cache, ptr, flags, false);
+
+ /* Poison the redzone and save alloc info for kmalloc() allocations. */
+ if (is_kmalloc_cache(slab->slab_cache))
--- /dev/null
+From 8c61291fd8500e3b35c7ec0c781b273d8cc96cde Mon Sep 17 00:00:00 2001
+From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
+Date: Fri, 7 Jun 2024 10:31:16 +0800
+Subject: mm: fix incorrect vbq reference in purge_fragmented_block
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
+
+commit 8c61291fd8500e3b35c7ec0c781b273d8cc96cde upstream.
+
+xa_for_each() in _vm_unmap_aliases() loops through all vbs. However,
+since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks
+xarray") the vb from xarray may not be on the corresponding CPU
+vmap_block_queue. Consequently, purge_fragmented_block() might use the
+wrong vbq->lock to protect the free list, leading to vbq->free breakage.
+
+Incorrect lock protection can exhaust all vmalloc space as follows:
+CPU0 CPU1
++--------------------------------------------+
+| +--------------------+ +-----+ |
++--> | |---->| |------+
+ | CPU1:vbq free_list | | vb1 |
++--- | |<----| |<-----+
+| +--------------------+ +-----+ |
++--------------------------------------------+
+
+_vm_unmap_aliases() vb_alloc()
+ new_vmap_block()
+xa_for_each(&vbq->vmap_blocks, idx, vb)
+--> vb in CPU1:vbq->freelist
+
+purge_fragmented_block(vb)
+spin_lock(&vbq->lock) spin_lock(&vbq->lock)
+--> use CPU0:vbq->lock --> use CPU1:vbq->lock
+
+list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free)
+ __list_del(vb->prev, vb->next)
+ next->prev = prev
+ +--------------------+
+ | |
+ | CPU1:vbq free_list |
++---| |<--+
+| +--------------------+ |
++----------------------------+
+ __list_add(new, head->prev, head)
++--------------------------------------------+
+| +--------------------+ +-----+ |
++--> | |---->| |------+
+ | CPU1:vbq free_list | | vb2 |
++--- | |<----| |<-----+
+| +--------------------+ +-----+ |
++--------------------------------------------+
+
+ prev->next = next
++--------------------------------------------+
+|----------------------------+ |
+| +--------------------+ | +-----+ |
++--> | |--+ | |------+
+ | CPU1:vbq free_list | | vb2 |
++--- | |<----| |<-----+
+| +--------------------+ +-----+ |
++--------------------------------------------+
+Here’s a list breakdown. All vbs, which were to be added to
+‘prev’, cannot be used by list_for_each_entry_rcu(vb, &vbq->free,
+free_list) in vb_alloc(). Thus, vmalloc space is exhausted.
+
+This issue affects both erofs and f2fs, the stacktrace is as follows:
+erofs:
+[<ffffffd4ffb93ad4>] __switch_to+0x174
+[<ffffffd4ffb942f0>] __schedule+0x624
+[<ffffffd4ffb946f4>] schedule+0x7c
+[<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24
+[<ffffffd4ffb962ec>] __mutex_lock+0x374
+[<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14
+[<ffffffd4ffb95954>] mutex_lock+0x24
+[<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44
+[<ffffffd4fef25908>] alloc_vmap_area+0x2e0
+[<ffffffd4fef24ea0>] vm_map_ram+0x1b0
+[<ffffffd4ff1b46f4>] z_erofs_lz4_decompress+0x278
+[<ffffffd4ff1b8ac4>] z_erofs_decompress_queue+0x650
+[<ffffffd4ff1b8328>] z_erofs_runqueue+0x7f4
+[<ffffffd4ff1b66a8>] z_erofs_read_folio+0x104
+[<ffffffd4feeb6fec>] filemap_read_folio+0x6c
+[<ffffffd4feeb68c4>] filemap_fault+0x300
+[<ffffffd4fef0ecac>] __do_fault+0xc8
+[<ffffffd4fef0c908>] handle_mm_fault+0xb38
+[<ffffffd4ffb9f008>] do_page_fault+0x288
+[<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40
+[<ffffffd4fec39c78>] do_mem_abort+0x58
+[<ffffffd4ffb8c3e4>] el0_ia+0x70
+[<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0
+[<ffffffd4fec11588>] ret_to_user[jt]+0x0
+
+f2fs:
+[<ffffffd4ffb93ad4>] __switch_to+0x174
+[<ffffffd4ffb942f0>] __schedule+0x624
+[<ffffffd4ffb946f4>] schedule+0x7c
+[<ffffffd4ffb947cc>] schedule_preempt_disabled+0x24
+[<ffffffd4ffb962ec>] __mutex_lock+0x374
+[<ffffffd4ffb95998>] __mutex_lock_slowpath+0x14
+[<ffffffd4ffb95954>] mutex_lock+0x24
+[<ffffffd4fef2900c>] reclaim_and_purge_vmap_areas+0x44
+[<ffffffd4fef25908>] alloc_vmap_area+0x2e0
+[<ffffffd4fef24ea0>] vm_map_ram+0x1b0
+[<ffffffd4ff1a3b60>] f2fs_prepare_decomp_mem+0x144
+[<ffffffd4ff1a6c24>] f2fs_alloc_dic+0x264
+[<ffffffd4ff175468>] f2fs_read_multi_pages+0x428
+[<ffffffd4ff17b46c>] f2fs_mpage_readpages+0x314
+[<ffffffd4ff1785c4>] f2fs_readahead+0x50
+[<ffffffd4feec3384>] read_pages+0x80
+[<ffffffd4feec32c0>] page_cache_ra_unbounded+0x1a0
+[<ffffffd4feec39e8>] page_cache_ra_order+0x274
+[<ffffffd4feeb6cec>] do_sync_mmap_readahead+0x11c
+[<ffffffd4feeb6764>] filemap_fault+0x1a0
+[<ffffffd4ff1423bc>] f2fs_filemap_fault+0x28
+[<ffffffd4fef0ecac>] __do_fault+0xc8
+[<ffffffd4fef0c908>] handle_mm_fault+0xb38
+[<ffffffd4ffb9f008>] do_page_fault+0x288
+[<ffffffd4ffb9ed64>] do_translation_fault[jt]+0x40
+[<ffffffd4fec39c78>] do_mem_abort+0x58
+[<ffffffd4ffb8c3e4>] el0_ia+0x70
+[<ffffffd4ffb8c260>] el0t_64_sync_handler[jt]+0xb0
+[<ffffffd4fec11588>] ret_to_user[jt]+0x0
+
+To fix this, introducee cpu within vmap_block to record which this vb
+belongs to.
+
+Link: https://lkml.kernel.org/r/20240614021352.1822225-1-zhaoyang.huang@unisoc.com
+Link: https://lkml.kernel.org/r/20240607023116.1720640-1-zhaoyang.huang@unisoc.com
+Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks")
+Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
+Suggested-by: Hailong.Liu <hailong.liu@oppo.com>
+Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Lorenzo Stoakes <lstoakes@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/vmalloc.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2474,6 +2474,7 @@ struct vmap_block {
+ struct list_head free_list;
+ struct rcu_head rcu_head;
+ struct list_head purge;
++ unsigned int cpu;
+ };
+
+ /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */
+@@ -2601,8 +2602,15 @@ static void *new_vmap_block(unsigned int
+ free_vmap_area(va);
+ return ERR_PTR(err);
+ }
+-
+- vbq = raw_cpu_ptr(&vmap_block_queue);
++ /*
++ * list_add_tail_rcu could happened in another core
++ * rather than vb->cpu due to task migration, which
++ * is safe as list_add_tail_rcu will ensure the list's
++ * integrity together with list_for_each_rcu from read
++ * side.
++ */
++ vb->cpu = raw_smp_processor_id();
++ vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu);
+ spin_lock(&vbq->lock);
+ list_add_tail_rcu(&vb->free_list, &vbq->free);
+ spin_unlock(&vbq->lock);
+@@ -2630,9 +2638,10 @@ static void free_vmap_block(struct vmap_
+ }
+
+ static bool purge_fragmented_block(struct vmap_block *vb,
+- struct vmap_block_queue *vbq, struct list_head *purge_list,
+- bool force_purge)
++ struct list_head *purge_list, bool force_purge)
+ {
++ struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu);
++
+ if (vb->free + vb->dirty != VMAP_BBMAP_BITS ||
+ vb->dirty == VMAP_BBMAP_BITS)
+ return false;
+@@ -2680,7 +2689,7 @@ static void purge_fragmented_blocks(int
+ continue;
+
+ spin_lock(&vb->lock);
+- purge_fragmented_block(vb, vbq, &purge, true);
++ purge_fragmented_block(vb, &purge, true);
+ spin_unlock(&vb->lock);
+ }
+ rcu_read_unlock();
+@@ -2817,7 +2826,7 @@ static void _vm_unmap_aliases(unsigned l
+ * not purgeable, check whether there is dirty
+ * space to be flushed.
+ */
+- if (!purge_fragmented_block(vb, vbq, &purge_list, false) &&
++ if (!purge_fragmented_block(vb, &purge_list, false) &&
+ vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) {
+ unsigned long va_start = vb->va->va_start;
+ unsigned long s, e;
--- /dev/null
+From ab1ffc86cb5bec1c92387b9811d9036512f8f4eb Mon Sep 17 00:00:00 2001
+From: Andrew Bresticker <abrestic@rivosinc.com>
+Date: Tue, 11 Jun 2024 08:32:16 -0700
+Subject: mm/memory: don't require head page for do_set_pmd()
+
+From: Andrew Bresticker <abrestic@rivosinc.com>
+
+commit ab1ffc86cb5bec1c92387b9811d9036512f8f4eb upstream.
+
+The requirement that the head page be passed to do_set_pmd() was added in
+commit ef37b2ea08ac ("mm/memory: page_add_file_rmap() ->
+folio_add_file_rmap_[pte|pmd]()") and prevents pmd-mapping in the
+finish_fault() and filemap_map_pages() paths if the page to be inserted is
+anything but the head page for an otherwise suitable vma and pmd-sized
+page.
+
+Matthew said:
+
+: We're going to stop using PMDs to map large folios unless the fault is
+: within the first 4KiB of the PMD. No idea how many workloads that
+: affects, but it only needs to be backported as far as v6.8, so we may
+: as well backport it.
+
+Link: https://lkml.kernel.org/r/20240611153216.2794513-1-abrestic@rivosinc.com
+Fixes: ef37b2ea08ac ("mm/memory: page_add_file_rmap() -> folio_add_file_rmap_[pte|pmd]()")
+Signed-off-by: Andrew Bresticker <abrestic@rivosinc.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4583,8 +4583,9 @@ vm_fault_t do_set_pmd(struct vm_fault *v
+ if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER))
+ return ret;
+
+- if (page != &folio->page || folio_order(folio) != HPAGE_PMD_ORDER)
++ if (folio_order(folio) != HPAGE_PMD_ORDER)
+ return ret;
++ page = &folio->page;
+
+ /*
+ * Just backoff if any subpage of a THP is corrupted otherwise
--- /dev/null
+From d77dc388cd61dfdafe30b98025fa827498378199 Mon Sep 17 00:00:00 2001
+From: Kamal Dasu <kamal.dasu@broadcom.com>
+Date: Mon, 3 Jun 2024 18:08:34 -0400
+Subject: mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
+
+From: Kamal Dasu <kamal.dasu@broadcom.com>
+
+commit d77dc388cd61dfdafe30b98025fa827498378199 upstream.
+
+When erase/trim/discard completion was converted to mmc_poll_for_busy(),
+optional support to poll with the host_ops->card_busy() callback was also
+added.
+
+The common sdhci's ->card_busy() turns out not to be working as expected
+for the sdhci-brcmstb variant, as it keeps returning busy beyond the card's
+busy period. In particular, this leads to the below splat for
+mmc_do_erase() when running a discard (BLKSECDISCARD) operation during
+mkfs.f2fs:
+
+ Info: [/dev/mmcblk1p9] Discarding device
+ [ 39.597258] sysrq: Show Blocked State
+ [ 39.601183] task:mkfs.f2fs state:D stack:0 pid:1561 tgid:1561 ppid:1542 flags:0x0000000d
+ [ 39.610609] Call trace:
+ [ 39.613098] __switch_to+0xd8/0xf4
+ [ 39.616582] __schedule+0x440/0x4f4
+ [ 39.620137] schedule+0x2c/0x48
+ [ 39.623341] schedule_hrtimeout_range_clock+0xe0/0x114
+ [ 39.628562] schedule_hrtimeout_range+0x10/0x18
+ [ 39.633169] usleep_range_state+0x5c/0x90
+ [ 39.637253] __mmc_poll_for_busy+0xec/0x128
+ [ 39.641514] mmc_poll_for_busy+0x48/0x70
+ [ 39.645511] mmc_do_erase+0x1ec/0x210
+ [ 39.649237] mmc_erase+0x1b4/0x1d4
+ [ 39.652701] mmc_blk_mq_issue_rq+0x35c/0x6ac
+ [ 39.657037] mmc_mq_queue_rq+0x18c/0x214
+ [ 39.661022] blk_mq_dispatch_rq_list+0x3a8/0x528
+ [ 39.665722] __blk_mq_sched_dispatch_requests+0x3a0/0x4ac
+ [ 39.671198] blk_mq_sched_dispatch_requests+0x28/0x5c
+ [ 39.676322] blk_mq_run_hw_queue+0x11c/0x12c
+ [ 39.680668] blk_mq_flush_plug_list+0x200/0x33c
+ [ 39.685278] blk_add_rq_to_plug+0x68/0xd8
+ [ 39.689365] blk_mq_submit_bio+0x3a4/0x458
+ [ 39.693539] __submit_bio+0x1c/0x80
+ [ 39.697096] submit_bio_noacct_nocheck+0x94/0x174
+ [ 39.701875] submit_bio_noacct+0x1b0/0x22c
+ [ 39.706042] submit_bio+0xac/0xe8
+ [ 39.709424] blk_next_bio+0x4c/0x5c
+ [ 39.712973] blkdev_issue_secure_erase+0x118/0x170
+ [ 39.717835] blkdev_common_ioctl+0x374/0x728
+ [ 39.722175] blkdev_ioctl+0x8c/0x2b0
+ [ 39.725816] vfs_ioctl+0x24/0x40
+ [ 39.729117] __arm64_sys_ioctl+0x5c/0x8c
+ [ 39.733114] invoke_syscall+0x68/0xec
+ [ 39.736839] el0_svc_common.constprop.0+0x70/0xd8
+ [ 39.741609] do_el0_svc+0x18/0x20
+ [ 39.744981] el0_svc+0x68/0x94
+ [ 39.748107] el0t_64_sync_handler+0x88/0x124
+ [ 39.752455] el0t_64_sync+0x168/0x16c
+
+To fix the problem let's override the host_ops->card_busy() callback by
+setting it to NULL, which forces the mmc core to poll with a CMD13 and
+checking the R1_STATUS in the mmc_busy_cb() function.
+
+Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Fixes: 0d84c3e6a5b2 ("mmc: core: Convert to mmc_poll_for_busy() for erase/trim/discard")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240603220834.21989-2-kamal.dasu@broadcom.com
+[Ulf: Clarified the commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -24,6 +24,7 @@
+ #define BRCMSTB_MATCH_FLAGS_NO_64BIT BIT(0)
+ #define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT BIT(1)
+ #define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE BIT(2)
++#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY BIT(4)
+
+ #define BRCMSTB_PRIV_FLAGS_HAS_CQE BIT(0)
+ #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK BIT(1)
+@@ -384,6 +385,9 @@ static int sdhci_brcmstb_probe(struct pl
+ if (match_priv->flags & BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT)
+ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+
++ if (!(match_priv->flags & BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY))
++ host->mmc_host_ops.card_busy = NULL;
++
+ /* Change the base clock frequency if the DT property exists */
+ if (device_property_read_u32(&pdev->dev, "clock-frequency",
+ &priv->base_freq_hz) != 0)
--- /dev/null
+From fbd64f902b93fe9658b855b9892ae59ef6ea22b9 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 14 Jun 2024 11:00:49 +0300
+Subject: mmc: sdhci: Do not invert write-protect twice
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit fbd64f902b93fe9658b855b9892ae59ef6ea22b9 upstream.
+
+mmc_of_parse() reads device property "wp-inverted" and sets
+MMC_CAP2_RO_ACTIVE_HIGH if it is true. MMC_CAP2_RO_ACTIVE_HIGH is used
+to invert a write-protect (AKA read-only) GPIO value.
+
+sdhci_get_property() also reads "wp-inverted" and sets
+SDHCI_QUIRK_INVERTED_WRITE_PROTECT which is used to invert the
+write-protect value as well but also acts upon a value read out from the
+SDHCI_PRESENT_STATE register.
+
+Many drivers call both mmc_of_parse() and sdhci_get_property(),
+so that both MMC_CAP2_RO_ACTIVE_HIGH and
+SDHCI_QUIRK_INVERTED_WRITE_PROTECT will be set if the controller has
+device property "wp-inverted".
+
+Amend the logic in sdhci_check_ro() to allow for that possibility,
+so that the write-protect value is not inverted twice.
+
+Also do not invert the value if it is a negative error value. Note that
+callers treat an error the same as not-write-protected, so the result is
+functionally the same in that case.
+
+Also do not invert the value if sdhci host operation ->get_ro() is used.
+None of the users of that callback set SDHCI_QUIRK_INVERTED_WRITE_PROTECT
+directly or indirectly, but two do call mmc_gpio_get_ro(), so leave it to
+them to deal with that if they ever set SDHCI_QUIRK_INVERTED_WRITE_PROTECT
+in the future.
+
+Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240614080051.4005-2-adrian.hunter@intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2515,26 +2515,34 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio);
+
+ static int sdhci_check_ro(struct sdhci_host *host)
+ {
++ bool allow_invert = false;
+ unsigned long flags;
+ int is_readonly;
+
+ spin_lock_irqsave(&host->lock, flags);
+
+- if (host->flags & SDHCI_DEVICE_DEAD)
++ if (host->flags & SDHCI_DEVICE_DEAD) {
+ is_readonly = 0;
+- else if (host->ops->get_ro)
++ } else if (host->ops->get_ro) {
+ is_readonly = host->ops->get_ro(host);
+- else if (mmc_can_gpio_ro(host->mmc))
++ } else if (mmc_can_gpio_ro(host->mmc)) {
+ is_readonly = mmc_gpio_get_ro(host->mmc);
+- else
++ /* Do not invert twice */
++ allow_invert = !(host->mmc->caps2 & MMC_CAP2_RO_ACTIVE_HIGH);
++ } else {
+ is_readonly = !(sdhci_readl(host, SDHCI_PRESENT_STATE)
+ & SDHCI_WRITE_PROTECT);
++ allow_invert = true;
++ }
+
+ spin_unlock_irqrestore(&host->lock, flags);
+
+- /* This quirk needs to be replaced by a callback-function later */
+- return host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT ?
+- !is_readonly : is_readonly;
++ if (is_readonly >= 0 &&
++ allow_invert &&
++ (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT))
++ is_readonly = !is_readonly;
++
++ return is_readonly;
+ }
+
+ #define SAMPLE_COUNT 5
--- /dev/null
+From ab069ce125965a5e282f7b53b86aee76ab32975c Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 14 Jun 2024 11:00:50 +0300
+Subject: mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit ab069ce125965a5e282f7b53b86aee76ab32975c upstream.
+
+sdhci_check_ro() can call mmc_gpio_get_ro() while holding the sdhci
+host->lock spinlock. That would be a problem if the GPIO access done by
+mmc_gpio_get_ro() needed to sleep.
+
+However, host->lock is not needed anyway. The mmc core ensures that host
+operations do not race with each other, and asynchronous callbacks like the
+interrupt handler, software timeouts, completion work etc, cannot affect
+sdhci_check_ro().
+
+So remove the locking.
+
+Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240614080051.4005-3-adrian.hunter@intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2516,11 +2516,8 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio);
+ static int sdhci_check_ro(struct sdhci_host *host)
+ {
+ bool allow_invert = false;
+- unsigned long flags;
+ int is_readonly;
+
+- spin_lock_irqsave(&host->lock, flags);
+-
+ if (host->flags & SDHCI_DEVICE_DEAD) {
+ is_readonly = 0;
+ } else if (host->ops->get_ro) {
+@@ -2535,8 +2532,6 @@ static int sdhci_check_ro(struct sdhci_h
+ allow_invert = true;
+ }
+
+- spin_unlock_irqrestore(&host->lock, flags);
+-
+ if (is_readonly >= 0 &&
+ allow_invert &&
+ (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT))
--- /dev/null
+From ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Mon, 27 May 2024 16:24:41 +0300
+Subject: mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d upstream.
+
+jmicron_pmos() and sdhci_pci_probe() use pci_{read,write}_config_byte()
+that return PCIBIOS_* codes. The return code is then returned as is by
+jmicron_probe() and sdhci_pci_probe(). Similarly, the return code is
+also returned as is from jmicron_resume(). Both probe and resume
+functions should return normal errnos.
+
+Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal
+errno before returning them the fix these issues.
+
+Fixes: 7582041ff3d4 ("mmc: sdhci-pci: fix simple_return.cocci warnings")
+Fixes: 45211e215984 ("sdhci: toggle JMicron PMOS setting")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240527132443.14038-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1326,7 +1326,7 @@ static int jmicron_pmos(struct sdhci_pci
+
+ ret = pci_read_config_byte(chip->pdev, 0xAE, &scratch);
+ if (ret)
+- return ret;
++ goto fail;
+
+ /*
+ * Turn PMOS on [bit 0], set over current detection to 2.4 V
+@@ -1337,7 +1337,10 @@ static int jmicron_pmos(struct sdhci_pci
+ else
+ scratch &= ~0x47;
+
+- return pci_write_config_byte(chip->pdev, 0xAE, scratch);
++ ret = pci_write_config_byte(chip->pdev, 0xAE, scratch);
++
++fail:
++ return pcibios_err_to_errno(ret);
+ }
+
+ static int jmicron_probe(struct sdhci_pci_chip *chip)
+@@ -2202,7 +2205,7 @@ static int sdhci_pci_probe(struct pci_de
+
+ ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &slots);
+ if (ret)
+- return ret;
++ return pcibios_err_to_errno(ret);
+
+ slots = PCI_SLOT_INFO_SLOTS(slots) + 1;
+ dev_dbg(&pdev->dev, "found %d slot(s)\n", slots);
+@@ -2211,7 +2214,7 @@ static int sdhci_pci_probe(struct pci_de
+
+ ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &first_bar);
+ if (ret)
+- return ret;
++ return pcibios_err_to_errno(ret);
+
+ first_bar &= PCI_SLOT_INFO_FIRST_BAR_MASK;
+
--- /dev/null
+From a91bf3b3beadbb4f8b3bbc7969fb2ae1615e25c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Mon, 27 May 2024 16:24:42 +0300
+Subject: mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit a91bf3b3beadbb4f8b3bbc7969fb2ae1615e25c8 upstream.
+
+sdhci_pci_o2_probe() uses pci_read_config_{byte,dword}() that return
+PCIBIOS_* codes. The return code is then returned as is but as
+sdhci_pci_o2_probe() is probe function chain, it should return normal
+errnos.
+
+Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal
+errno before returning them. Add a label for read failure so that the
+conversion can be done in one place rather than on all of the return
+statements.
+
+Fixes: 3d757ddbd68c ("mmc: sdhci-pci-o2micro: add Bayhub new chip GG8 support for UHS-I")
+Fixes: d599005afde8 ("mmc: sdhci-pci-o2micro: Add missing checks in sdhci_pci_o2_probe")
+Fixes: 706adf6bc31c ("mmc: sdhci-pci-o2micro: Add SeaBird SeaEagle SD3 support")
+Fixes: 01acf6917aed ("mmc: sdhci-pci: add support of O2Micro/BayHubTech SD hosts")
+Fixes: 26daa1ed40c6 ("mmc: sdhci: Disable ADMA on some O2Micro SD/MMC parts.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240527132443.14038-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-o2micro.c | 41 ++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 19 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -823,7 +823,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch &= 0x7f;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+
+@@ -834,7 +834,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_CLKREQ, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x20;
+ pci_write_config_byte(chip->pdev, O2_SD_CLKREQ, scratch);
+
+@@ -843,7 +843,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ */
+ ret = pci_read_config_byte(chip->pdev, O2_SD_CAPS, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x01;
+ pci_write_config_byte(chip->pdev, O2_SD_CAPS, scratch);
+ pci_write_config_byte(chip->pdev, O2_SD_CAPS, 0x73);
+@@ -856,7 +856,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_INF_MOD, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x08;
+ pci_write_config_byte(chip->pdev, O2_SD_INF_MOD, scratch);
+
+@@ -864,7 +864,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x80;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+@@ -875,7 +875,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ scratch &= 0x7f;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+@@ -886,7 +886,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ O2_SD_FUNC_REG0,
+ &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch_32 = ((scratch_32 & 0xFF000000) >> 24);
+
+ /* Check Whether subId is 0x11 or 0x12 */
+@@ -898,7 +898,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ O2_SD_FUNC_REG4,
+ &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ /* Enable Base Clk setting change */
+ scratch_32 |= O2_SD_FREG4_ENABLE_CLK_SET;
+@@ -921,7 +921,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_dword(chip->pdev,
+ O2_SD_CLK_SETTING, &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ scratch_32 &= ~(0xFF00);
+ scratch_32 |= 0x07E0C800;
+@@ -931,14 +931,14 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_dword(chip->pdev,
+ O2_SD_CLKREQ, &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch_32 |= 0x3;
+ pci_write_config_dword(chip->pdev, O2_SD_CLKREQ, scratch_32);
+
+ ret = pci_read_config_dword(chip->pdev,
+ O2_SD_PLL_SETTING, &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ scratch_32 &= ~(0x1F3F070E);
+ scratch_32 |= 0x18270106;
+@@ -949,7 +949,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_dword(chip->pdev,
+ O2_SD_CAP_REG2, &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch_32 &= ~(0xE0);
+ pci_write_config_dword(chip->pdev,
+ O2_SD_CAP_REG2, scratch_32);
+@@ -961,7 +961,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x80;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+@@ -971,7 +971,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ scratch &= 0x7f;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+@@ -979,7 +979,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_dword(chip->pdev,
+ O2_SD_PLL_SETTING, &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+
+ if ((scratch_32 & 0xff000000) == 0x01000000) {
+ scratch_32 &= 0x0000FFFF;
+@@ -998,7 +998,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ O2_SD_FUNC_REG4,
+ &scratch_32);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch_32 |= (1 << 22);
+ pci_write_config_dword(chip->pdev,
+ O2_SD_FUNC_REG4, scratch_32);
+@@ -1017,7 +1017,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ ret = pci_read_config_byte(chip->pdev,
+ O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x80;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+@@ -1028,7 +1028,7 @@ static int sdhci_pci_o2_probe(struct sdh
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch &= 0x7f;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+
+@@ -1057,13 +1057,16 @@ static int sdhci_pci_o2_probe(struct sdh
+ /* Lock WP */
+ ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch);
+ if (ret)
+- return ret;
++ goto read_fail;
+ scratch |= 0x80;
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ }
+
+ return 0;
++
++read_fail:
++ return pcibios_err_to_errno(ret);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From 54e7d59841dab977f6cb1183d658b1b82c9f4e94 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Tue, 18 Jun 2024 18:56:47 +1200
+Subject: nfs: drop the incorrect assertion in nfs_swap_rw()
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 54e7d59841dab977f6cb1183d658b1b82c9f4e94 upstream.
+
+Since commit 2282679fb20b ("mm: submit multipage write for SWP_FS_OPS
+swap-space"), we can plug multiple pages then unplug them all together.
+That means iov_iter_count(iter) could be way bigger than PAGE_SIZE, it
+actually equals the size of iov_iter_npages(iter, INT_MAX).
+
+Note this issue has nothing to do with large folios as we don't support
+THP_SWPOUT to non-block devices.
+
+[v-songbaohua@oppo.com: figure out the cause and correct the commit message]
+Link: https://lkml.kernel.org/r/20240618065647.21791-1-21cnbao@gmail.com
+Fixes: 2282679fb20b ("mm: submit multipage write for SWP_FS_OPS swap-space")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Barry Song <v-songbaohua@oppo.com>
+Closes: https://lore.kernel.org/linux-mm/20240617053201.GA16852@lst.de/
+Reviewed-by: Martin Wege <martin.l.wege@gmail.com>
+Cc: NeilBrown <neilb@suse.de>
+Cc: Anna Schumaker <anna@kernel.org>
+Cc: Steve French <sfrench@samba.org>
+Cc: Trond Myklebust <trondmy@kernel.org>
+Cc: Chuanhua Han <hanchuanhua@oppo.com>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: Chris Li <chrisl@kernel.org>
+Cc: "Huang, Ying" <ying.huang@intel.com>
+Cc: Jeff Layton <jlayton@kernel.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/direct.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -141,8 +141,6 @@ int nfs_swap_rw(struct kiocb *iocb, stru
+ {
+ ssize_t ret;
+
+- VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE);
+-
+ if (iov_iter_rw(iter) == READ)
+ ret = nfs_file_direct_read(iocb, iter, true);
+ else
--- /dev/null
+From be346c1a6eeb49d8fda827d2a9522124c2f72f36 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Fri, 14 Jun 2024 16:52:43 +0200
+Subject: ocfs2: fix DIO failure due to insufficient transaction credits
+
+From: Jan Kara <jack@suse.cz>
+
+commit be346c1a6eeb49d8fda827d2a9522124c2f72f36 upstream.
+
+The code in ocfs2_dio_end_io_write() estimates number of necessary
+transaction credits using ocfs2_calc_extend_credits(). This however does
+not take into account that the IO could be arbitrarily large and can
+contain arbitrary number of extents.
+
+Extent tree manipulations do often extend the current transaction but not
+in all of the cases. For example if we have only single block extents in
+the tree, ocfs2_mark_extent_written() will end up calling
+ocfs2_replace_extent_rec() all the time and we will never extend the
+current transaction and eventually exhaust all the transaction credits if
+the IO contains many single block extents. Once that happens a
+WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in
+jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to
+this error. This was actually triggered by one of our customers on a
+heavily fragmented OCFS2 filesystem.
+
+To fix the issue make sure the transaction always has enough credits for
+one extent insert before each call of ocfs2_mark_extent_written().
+
+Heming Zhao said:
+
+------
+PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error"
+
+PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA"
+ #0 machine_kexec at ffffffff8c069932
+ #1 __crash_kexec at ffffffff8c1338fa
+ #2 panic at ffffffff8c1d69b9
+ #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]
+ #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]
+ #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]
+ #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]
+ #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]
+ #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]
+ #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]
+#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]
+#11 dio_complete at ffffffff8c2b9fa7
+#12 do_blockdev_direct_IO at ffffffff8c2bc09f
+#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]
+#14 generic_file_direct_write at ffffffff8c1dcf14
+#15 __generic_file_write_iter at ffffffff8c1dd07b
+#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]
+#17 aio_write at ffffffff8c2cc72e
+#18 kmem_cache_alloc at ffffffff8c248dde
+#19 do_io_submit at ffffffff8c2ccada
+#20 do_syscall_64 at ffffffff8c004984
+#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba
+
+Link: https://lkml.kernel.org/r/20240617095543.6971-1-jack@suse.cz
+Link: https://lkml.kernel.org/r/20240614145243.8837-1-jack@suse.cz
+Fixes: c15471f79506 ("ocfs2: fix sparse file & data ordering issue in direct io")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Heming Zhao <heming.zhao@suse.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ocfs2/aops.c | 5 +++++
+ fs/ocfs2/journal.c | 17 +++++++++++++++++
+ fs/ocfs2/journal.h | 2 ++
+ fs/ocfs2/ocfs2_trace.h | 2 ++
+ 4 files changed, 26 insertions(+)
+
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2368,6 +2368,11 @@ static int ocfs2_dio_end_io_write(struct
+ }
+
+ list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) {
++ ret = ocfs2_assure_trans_credits(handle, credits);
++ if (ret < 0) {
++ mlog_errno(ret);
++ break;
++ }
+ ret = ocfs2_mark_extent_written(inode, &et, handle,
+ ue->ue_cpos, 1,
+ ue->ue_phys,
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -446,6 +446,23 @@ bail:
+ }
+
+ /*
++ * Make sure handle has at least 'nblocks' credits available. If it does not
++ * have that many credits available, we will try to extend the handle to have
++ * enough credits. If that fails, we will restart transaction to have enough
++ * credits. Similar notes regarding data consistency and locking implications
++ * as for ocfs2_extend_trans() apply here.
++ */
++int ocfs2_assure_trans_credits(handle_t *handle, int nblocks)
++{
++ int old_nblks = jbd2_handle_buffer_credits(handle);
++
++ trace_ocfs2_assure_trans_credits(old_nblks);
++ if (old_nblks >= nblocks)
++ return 0;
++ return ocfs2_extend_trans(handle, nblocks - old_nblks);
++}
++
++/*
+ * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA.
+ * If that fails, restart the transaction & regain write access for the
+ * buffer head which is used for metadata modifications.
+--- a/fs/ocfs2/journal.h
++++ b/fs/ocfs2/journal.h
+@@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(struct
+ int ocfs2_commit_trans(struct ocfs2_super *osb,
+ handle_t *handle);
+ int ocfs2_extend_trans(handle_t *handle, int nblocks);
++int ocfs2_assure_trans_credits(handle_t *handle,
++ int nblocks);
+ int ocfs2_allocate_extend_trans(handle_t *handle,
+ int thresh);
+
+--- a/fs/ocfs2/ocfs2_trace.h
++++ b/fs/ocfs2/ocfs2_trace.h
+@@ -2577,6 +2577,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commit
+
+ DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans);
+
++DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits);
++
+ DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart);
+
+ DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans);
--- /dev/null
+From 8da86499d4cd125a9561f9cd1de7fba99b0aecbf Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 29 May 2024 18:29:52 +0200
+Subject: pinctrl: qcom: spmi-gpio: drop broken pm8008 support
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 8da86499d4cd125a9561f9cd1de7fba99b0aecbf upstream.
+
+The SPMI GPIO driver assumes that the parent device is an SPMI device
+and accesses random data when backcasting the parent struct device
+pointer for non-SPMI devices.
+
+Fortunately this does not seem to cause any issues currently when the
+parent device is an I2C client like the PM8008, but this could change if
+the structures are reorganised (e.g. using structure randomisation).
+
+Notably the interrupt implementation is also broken for non-SPMI devices.
+
+Also note that the two GPIO pins on PM8008 are used for interrupts and
+reset so their practical use should be limited.
+
+Drop the broken GPIO support for PM8008 for now.
+
+Fixes: ea119e5a482a ("pinctrl: qcom-pmic-gpio: Add support for pm8008")
+Cc: stable@vger.kernel.org # 5.13
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20240529162958.18081-9-johan+linaro@kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -1206,7 +1206,6 @@ static const struct of_device_id pmic_gp
+ { .compatible = "qcom,pm7325-gpio", .data = (void *) 10 },
+ { .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8},
+ { .compatible = "qcom,pm8005-gpio", .data = (void *) 4 },
+- { .compatible = "qcom,pm8008-gpio", .data = (void *) 2 },
+ { .compatible = "qcom,pm8019-gpio", .data = (void *) 6 },
+ /* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */
+ { .compatible = "qcom,pm8150-gpio", .data = (void *) 10 },
--- /dev/null
+From 6e5aee08bd2517397c9572243a816664f2ead547 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Date: Thu, 13 Jun 2024 10:17:09 +0200
+Subject: Revert "MIPS: pci: lantiq: restore reset gpio polarity"
+
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+
+commit 6e5aee08bd2517397c9572243a816664f2ead547 upstream.
+
+This reverts commit 277a0363120276645ae598d8d5fea7265e076ae9.
+
+While fixing old boards with broken DTs, this change will break
+newer ones with correct gpio polarity annotation.
+
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/pci/pci-lantiq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/pci/pci-lantiq.c
++++ b/arch/mips/pci/pci-lantiq.c
+@@ -124,14 +124,14 @@ static int ltq_pci_startup(struct platfo
+ clk_disable(clk_external);
+
+ /* setup reset gpio used by pci */
+- reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_ASIS);
++ reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
++ GPIOD_OUT_LOW);
+ error = PTR_ERR_OR_ZERO(reset_gpio);
+ if (error) {
+ dev_err(&pdev->dev, "failed to request gpio: %d\n", error);
+ return error;
+ }
+ gpiod_set_consumer_name(reset_gpio, "pci_reset");
+- gpiod_direction_output(reset_gpio, 1);
+
+ /* enable auto-switching between PCI and EBU */
+ ltq_pci_w32(0xa, PCI_CR_CLK_CTRL);
+@@ -194,10 +194,10 @@ static int ltq_pci_startup(struct platfo
+
+ /* toggle reset pin */
+ if (reset_gpio) {
+- gpiod_set_value_cansleep(reset_gpio, 0);
++ gpiod_set_value_cansleep(reset_gpio, 1);
+ wmb();
+ mdelay(1);
+- gpiod_set_value_cansleep(reset_gpio, 1);
++ gpiod_set_value_cansleep(reset_gpio, 0);
+ }
+ return 0;
+ }
--- /dev/null
+From 84bb8d8bbd8384081c3fc5c4f20b223524af529d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 6 Jun 2024 20:17:20 +0200
+Subject: Revert "mmc: moxart-mmc: Use sg_miter for PIO"
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 84bb8d8bbd8384081c3fc5c4f20b223524af529d upstream.
+
+This reverts commit 3ee0e7c3e67cab83ffbbe7707b43df8d41c9fe47.
+
+The patch is not working for unknown reasons and I would
+need access to the hardware to fix the bug.
+
+This shouldn't matter anyway: the Moxa Art is not expected
+to use highmem, and sg_miter() is only necessary to have
+to properly deal with highmem.
+
+Reported-by: Sergei Antonov <saproj@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Fixes: 3ee0e7c3e67c ("mmc: moxart-mmc: Use sg_miter for PIO")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240606-mmc-moxart-revert-v1-1-a01c2f40de9c@linaro.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/moxart-mmc.c | 78 +++++++++++++++++++----------------
+ 1 file changed, 43 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 9a5f75163aca..8ede4ce93271 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -131,10 +131,12 @@ struct moxart_host {
+ struct dma_async_tx_descriptor *tx_desc;
+ struct mmc_host *mmc;
+ struct mmc_request *mrq;
++ struct scatterlist *cur_sg;
+ struct completion dma_complete;
+ struct completion pio_complete;
+
+- struct sg_mapping_iter sg_miter;
++ u32 num_sg;
++ u32 data_remain;
+ u32 data_len;
+ u32 fifo_width;
+ u32 timeout;
+@@ -146,6 +148,35 @@ struct moxart_host {
+ bool is_removed;
+ };
+
++static inline void moxart_init_sg(struct moxart_host *host,
++ struct mmc_data *data)
++{
++ host->cur_sg = data->sg;
++ host->num_sg = data->sg_len;
++ host->data_remain = host->cur_sg->length;
++
++ if (host->data_remain > host->data_len)
++ host->data_remain = host->data_len;
++}
++
++static inline int moxart_next_sg(struct moxart_host *host)
++{
++ int remain;
++ struct mmc_data *data = host->mrq->cmd->data;
++
++ host->cur_sg++;
++ host->num_sg--;
++
++ if (host->num_sg > 0) {
++ host->data_remain = host->cur_sg->length;
++ remain = host->data_len - data->bytes_xfered;
++ if (remain > 0 && remain < host->data_remain)
++ host->data_remain = remain;
++ }
++
++ return host->num_sg;
++}
++
+ static int moxart_wait_for_status(struct moxart_host *host,
+ u32 mask, u32 *status)
+ {
+@@ -278,29 +309,14 @@ static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host)
+
+ static void moxart_transfer_pio(struct moxart_host *host)
+ {
+- struct sg_mapping_iter *sgm = &host->sg_miter;
+ struct mmc_data *data = host->mrq->cmd->data;
+ u32 *sgp, len = 0, remain, status;
+
+ if (host->data_len == data->bytes_xfered)
+ return;
+
+- /*
+- * By updating sgm->consumes this will get a proper pointer into the
+- * buffer at any time.
+- */
+- if (!sg_miter_next(sgm)) {
+- /* This shold not happen */
+- dev_err(mmc_dev(host->mmc), "ran out of scatterlist prematurely\n");
+- data->error = -EINVAL;
+- complete(&host->pio_complete);
+- return;
+- }
+- sgp = sgm->addr;
+- remain = sgm->length;
+- if (remain > host->data_len)
+- remain = host->data_len;
+- sgm->consumed = 0;
++ sgp = sg_virt(host->cur_sg);
++ remain = host->data_remain;
+
+ if (data->flags & MMC_DATA_WRITE) {
+ while (remain > 0) {
+@@ -315,7 +331,6 @@ static void moxart_transfer_pio(struct moxart_host *host)
+ sgp++;
+ len += 4;
+ }
+- sgm->consumed += len;
+ remain -= len;
+ }
+
+@@ -332,22 +347,22 @@ static void moxart_transfer_pio(struct moxart_host *host)
+ sgp++;
+ len += 4;
+ }
+- sgm->consumed += len;
+ remain -= len;
+ }
+ }
+
+- data->bytes_xfered += sgm->consumed;
+- if (host->data_len == data->bytes_xfered) {
++ data->bytes_xfered += host->data_remain - remain;
++ host->data_remain = remain;
++
++ if (host->data_len != data->bytes_xfered)
++ moxart_next_sg(host);
++ else
+ complete(&host->pio_complete);
+- return;
+- }
+ }
+
+ static void moxart_prepare_data(struct moxart_host *host)
+ {
+ struct mmc_data *data = host->mrq->cmd->data;
+- unsigned int flags = SG_MITER_ATOMIC; /* Used from IRQ */
+ u32 datactrl;
+ int blksz_bits;
+
+@@ -358,19 +373,15 @@ static void moxart_prepare_data(struct moxart_host *host)
+ blksz_bits = ffs(data->blksz) - 1;
+ BUG_ON(1 << blksz_bits != data->blksz);
+
++ moxart_init_sg(host, data);
++
+ datactrl = DCR_DATA_EN | (blksz_bits & DCR_BLK_SIZE);
+
+- if (data->flags & MMC_DATA_WRITE) {
+- flags |= SG_MITER_FROM_SG;
++ if (data->flags & MMC_DATA_WRITE)
+ datactrl |= DCR_DATA_WRITE;
+- } else {
+- flags |= SG_MITER_TO_SG;
+- }
+
+ if (moxart_use_dma(host))
+ datactrl |= DCR_DMA_EN;
+- else
+- sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+
+ writel(DCR_DATA_FIFO_RESET, host->base + REG_DATA_CONTROL);
+ writel(MASK_DATA | FIFO_URUN | FIFO_ORUN, host->base + REG_CLEAR);
+@@ -443,9 +454,6 @@ static void moxart_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ }
+
+ request_done:
+- if (!moxart_use_dma(host))
+- sg_miter_stop(&host->sg_miter);
+-
+ spin_unlock_irqrestore(&host->lock, flags);
+ mmc_request_done(host->mmc, mrq);
+ }
+--
+2.45.2
+
randomize_kstack-remove-non-functional-per-arch-entr.patch
x86-stop-playing-stack-games-in-profile_pc.patch
parisc-use-generic-sys_fanotify_mark-implementation.patch
+revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch
+pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch
+ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch
+nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch
+kasan-fix-bad-call-to-unpoison_slab_object.patch
+mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch
+mm-memory-don-t-require-head-page-for-do_set_pmd.patch
+revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch
+mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch
+mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch
+mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch
+mmc-sdhci-do-not-invert-write-protect-twice.patch
+mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
