+++ /dev/null
-From stable+bounces-225857-greg=kroah.com@vger.kernel.org Tue Mar 17 12:54:12 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 Mar 2026 07:49:49 -0400
-Subject: mmc: core: Avoid bitfield RMW for claim/retune flags
-To: stable@vger.kernel.org
-Cc: Penghe Geng <pgeng@nvidia.com>, Adrian Hunter <adrian.hunter@intel.com>, Ulf Hansson <ulf.hansson@linaro.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260317114949.126875-4-sashal@kernel.org>
-
-From: Penghe Geng <pgeng@nvidia.com>
-
-[ Upstream commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 ]
-
-Move claimed and retune control flags out of the bitfield word to
-avoid unrelated RMW side effects in asynchronous contexts.
-
-The host->claimed bit shared a word with retune flags. Writes to claimed
-in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite
-other bits when concurrent updates happen in other contexts, triggering
-spurious WARN_ON(!host->claimed). Convert claimed, can_retune,
-retune_now and retune_paused to bool to remove shared-word coupling.
-
-Fixes: 6c0cedd1ef952 ("mmc: core: Introduce host claiming by context")
-Fixes: 1e8e55b67030c ("mmc: block: Add CQE support")
-Cc: stable@vger.kernel.org
-Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Penghe Geng <pgeng@nvidia.com>
-Acked-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/mmc/host.h | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -400,14 +400,12 @@ struct mmc_host {
-
- struct mmc_ios ios; /* current io bus settings */
-
-+ bool claimed; /* host exclusively claimed */
-+
- /* group bitfields together to minimize padding */
- unsigned int use_spi_crc:1;
-- unsigned int claimed:1; /* host exclusively claimed */
- unsigned int doing_init_tune:1; /* initial tuning in progress */
-- unsigned int can_retune:1; /* re-tuning can be used */
- unsigned int doing_retune:1; /* re-tuning in progress */
-- unsigned int retune_now:1; /* do re-tuning at next req */
-- unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
- unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
- unsigned int can_dma_map_merge:1; /* merging can be used */
- unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
-@@ -415,6 +413,9 @@ struct mmc_host {
- int rescan_disable; /* disable card detection */
- int rescan_entered; /* used with nonremovable devices */
-
-+ bool can_retune; /* re-tuning can be used */
-+ bool retune_now; /* do re-tuning at next req */
-+ bool retune_paused; /* re-tuning is temporarily disabled */
- int need_retune; /* re-tuning is needed */
- int hold_retune; /* hold off re-tuning */
- unsigned int retune_period; /* re-tuning period in secs */
+++ /dev/null
-From stable+bounces-225854-greg=kroah.com@vger.kernel.org Tue Mar 17 12:54:00 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 Mar 2026 07:49:46 -0400
-Subject: mmc: core: Drop redundant member in struct mmc host
-To: stable@vger.kernel.org
-Cc: Ulf Hansson <ulf.hansson@linaro.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260317114949.126875-1-sashal@kernel.org>
-
-From: Ulf Hansson <ulf.hansson@linaro.org>
-
-[ Upstream commit 951f6ccfcbb7e4a18bf5fef1fb373d21e5831957 ]
-
-The Kconfig option to use the blk-mq support was removed in commit
-1bec43a3b181 ("mmc: core: Remove option not to use blk-mq"), but forgot to
-remove the use_blk_mq member in the struct mmc_host, let's fix it.
-
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Link: https://lore.kernel.org/r/20210202101924.69970-1-ulf.hansson@linaro.org
-Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/linux/mmc/host.h | 1 -
- 1 file changed, 1 deletion(-)
-
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -409,7 +409,6 @@ struct mmc_host {
- unsigned int doing_retune:1; /* re-tuning in progress */
- unsigned int retune_now:1; /* do re-tuning at next req */
- unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
-- unsigned int use_blk_mq:1; /* use blk-mq */
- unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
- unsigned int can_dma_map_merge:1; /* merging can be used */
- unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
+++ /dev/null
-From stable+bounces-225856-greg=kroah.com@vger.kernel.org Tue Mar 17 12:49:59 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 Mar 2026 07:49:48 -0400
-Subject: mmc: core: Drop reference counting of the bus_ops
-To: stable@vger.kernel.org
-Cc: Ulf Hansson <ulf.hansson@linaro.org>, Pierre Ossman <pierre@ossman.eu>, Russell King <linux@armlinux.org.uk>, Adrian Hunter <adrian.hunter@intel.com>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260317114949.126875-3-sashal@kernel.org>
-
-From: Ulf Hansson <ulf.hansson@linaro.org>
-
-[ Upstream commit e9ce2ce17da626d930812199568bd426b2832f57 ]
-
-When the mmc_rescan work is enabled for execution (host->rescan_disable),
-it's the only instance per mmc host that is allowed to set/clear the
-host->bus_ops pointer.
-
-Besides the mmc_rescan work, there are a couple of scenarios when the
-host->bus_ops pointer may be accessed. Typically, those can be described as
-as below:
-
-*)
-Upper mmc driver layers (like the mmc block device driver or an SDIO
-functional driver) needs to execute a host->bus_ops callback. This can be
-considered as safe without having to use some special locking mechanism,
-because they operate on top of the struct mmc_card. As long as there is a
-card to operate upon, the mmc core guarantees that there is a host->bus_ops
-assigned as well. Note that, upper layer mmc drivers are of course
-responsible to clean up from themselves from their ->remove() callbacks,
-otherwise things would fall apart anyways.
-
-**)
-Via the mmc host instance, we may need to force a removal of an inserted
-mmc card. This happens when a mmc host driver gets unbind, for example. In
-this case, we protect the host->bus_ops pointer from concurrent accesses,
-by disabling the mmc_rescan work upfront (host->rescan_disable). See
-mmc_stop_host() for example.
-
-This said, it seems like the reference counting of the host->bus_ops
-pointer at some point have become superfluous. As this is an old mechanism
-of the mmc core, it a bit difficult to digest the history of when that
-could have happened. However, let's drop the reference counting to avoid
-unnecessary code-paths and lockings.
-
-Cc: Pierre Ossman <pierre@ossman.eu>
-Cc: Russell King <linux@armlinux.org.uk>
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Link: https://lore.kernel.org/r/20210212131610.236843-1-ulf.hansson@linaro.org
-Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/core/core.c | 89 ++---------------------------------------------
- include/linux/mmc/host.h | 2 -
- 2 files changed, 4 insertions(+), 87 deletions(-)
-
---- a/drivers/mmc/core/core.c
-+++ b/drivers/mmc/core/core.c
-@@ -1389,62 +1389,12 @@ void mmc_power_cycle(struct mmc_host *ho
- }
-
- /*
-- * Cleanup when the last reference to the bus operator is dropped.
-- */
--static void __mmc_release_bus(struct mmc_host *host)
--{
-- WARN_ON(!host->bus_dead);
--
-- host->bus_ops = NULL;
--}
--
--/*
-- * Increase reference count of bus operator
-- */
--static inline void mmc_bus_get(struct mmc_host *host)
--{
-- unsigned long flags;
--
-- spin_lock_irqsave(&host->lock, flags);
-- host->bus_refs++;
-- spin_unlock_irqrestore(&host->lock, flags);
--}
--
--/*
-- * Decrease reference count of bus operator and free it if
-- * it is the last reference.
-- */
--static inline void mmc_bus_put(struct mmc_host *host)
--{
-- unsigned long flags;
--
-- spin_lock_irqsave(&host->lock, flags);
-- host->bus_refs--;
-- if ((host->bus_refs == 0) && host->bus_ops)
-- __mmc_release_bus(host);
-- spin_unlock_irqrestore(&host->lock, flags);
--}
--
--/*
- * Assign a mmc bus handler to a host. Only one bus handler may control a
- * host at any given time.
- */
- void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops)
- {
-- unsigned long flags;
--
-- WARN_ON(!host->claimed);
--
-- spin_lock_irqsave(&host->lock, flags);
--
-- WARN_ON(host->bus_ops);
-- WARN_ON(host->bus_refs);
--
- host->bus_ops = ops;
-- host->bus_refs = 1;
-- host->bus_dead = 0;
--
-- spin_unlock_irqrestore(&host->lock, flags);
- }
-
- /*
-@@ -1452,18 +1402,7 @@ void mmc_attach_bus(struct mmc_host *hos
- */
- void mmc_detach_bus(struct mmc_host *host)
- {
-- unsigned long flags;
--
-- WARN_ON(!host->claimed);
-- WARN_ON(!host->bus_ops);
--
-- spin_lock_irqsave(&host->lock, flags);
--
-- host->bus_dead = 1;
--
-- spin_unlock_irqrestore(&host->lock, flags);
--
-- mmc_bus_put(host);
-+ host->bus_ops = NULL;
- }
-
- void _mmc_detect_change(struct mmc_host *host, unsigned long delay, bool cd_irq)
-@@ -2260,32 +2199,15 @@ void mmc_rescan(struct work_struct *work
- host->trigger_card_event = false;
- }
-
-- mmc_bus_get(host);
--
- /* Verify a registered card to be functional, else remove it. */
-- if (host->bus_ops && !host->bus_dead)
-+ if (host->bus_ops)
- host->bus_ops->detect(host);
-
- host->detect_change = 0;
-
-- /*
-- * Let mmc_bus_put() free the bus/bus_ops if we've found that
-- * the card is no longer present.
-- */
-- mmc_bus_put(host);
-- mmc_bus_get(host);
--
- /* if there still is a card present, stop here */
-- if (host->bus_ops != NULL) {
-- mmc_bus_put(host);
-+ if (host->bus_ops != NULL)
- goto out;
-- }
--
-- /*
-- * Only we can add a new handler, so it's safe to
-- * release the lock here.
-- */
-- mmc_bus_put(host);
-
- mmc_claim_host(host);
- if (mmc_card_is_removable(host) && host->ops->get_cd &&
-@@ -2356,18 +2278,15 @@ void mmc_stop_host(struct mmc_host *host
- /* clear pm flags now and let card drivers set them as needed */
- host->pm_flags = 0;
-
-- mmc_bus_get(host);
-- if (host->bus_ops && !host->bus_dead) {
-+ if (host->bus_ops) {
- /* Calling bus_ops->remove() with a claimed host can deadlock */
- host->bus_ops->remove(host);
- mmc_claim_host(host);
- mmc_detach_bus(host);
- mmc_power_off(host);
- mmc_release_host(host);
-- mmc_bus_put(host);
- return;
- }
-- mmc_bus_put(host);
-
- mmc_claim_host(host);
- mmc_power_off(host);
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -403,7 +403,6 @@ struct mmc_host {
- /* group bitfields together to minimize padding */
- unsigned int use_spi_crc:1;
- unsigned int claimed:1; /* host exclusively claimed */
-- unsigned int bus_dead:1; /* bus has been released */
- unsigned int doing_init_tune:1; /* initial tuning in progress */
- unsigned int can_retune:1; /* re-tuning can be used */
- unsigned int doing_retune:1; /* re-tuning in progress */
-@@ -435,7 +434,6 @@ struct mmc_host {
- struct mmc_slot slot;
-
- const struct mmc_bus_ops *bus_ops; /* current bus driver */
-- unsigned int bus_refs; /* reference counter */
-
- unsigned int sdio_irqs;
- struct task_struct *sdio_irq_thread;
+++ /dev/null
-From stable+bounces-225855-greg=kroah.com@vger.kernel.org Tue Mar 17 12:49:58 2026
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 17 Mar 2026 07:49:47 -0400
-Subject: mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
-To: stable@vger.kernel.org
-Cc: Ulf Hansson <ulf.hansson@linaro.org>, Adrian Hunter <adrian.hunter@intel.com>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20260317114949.126875-2-sashal@kernel.org>
-
-From: Ulf Hansson <ulf.hansson@linaro.org>
-
-[ Upstream commit fefdd3c91e0a7b3cbb3f25925d93a57c45cb0f31 ]
-
-The mmc_hw|sw_reset() APIs are designed to be called solely from upper
-layers, which means drivers that operates on top of the struct mmc_card,
-like the mmc block device driver and an SDIO functional driver.
-
-Additionally, as long as the struct mmc_host has a valid pointer to a
-struct mmc_card, the corresponding host->bus_ops pointer stays valid and
-assigned.
-
-For these reasons, let's drop the superfluous reference counting and the
-redundant validations in mmc_hw|sw_reset().
-
-Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Link: https://lore.kernel.org/r/20210212131532.236775-1-ulf.hansson@linaro.org
-Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/mmc/core/block.c | 2 +-
- drivers/mmc/core/core.c | 21 +--------------------
- 2 files changed, 2 insertions(+), 21 deletions(-)
-
---- a/drivers/mmc/core/block.c
-+++ b/drivers/mmc/core/block.c
-@@ -987,7 +987,7 @@ static int mmc_blk_reset(struct mmc_blk_
- md->reset_done |= type;
- err = mmc_hw_reset(host);
- /* Ensure we switch back to the correct partition */
-- if (err != -EOPNOTSUPP) {
-+ if (err) {
- struct mmc_blk_data *main_md =
- dev_get_drvdata(&host->card->dev);
- int part_err;
---- a/drivers/mmc/core/core.c
-+++ b/drivers/mmc/core/core.c
-@@ -2096,18 +2096,7 @@ int mmc_hw_reset(struct mmc_host *host)
- {
- int ret;
-
-- if (!host->card)
-- return -EINVAL;
--
-- mmc_bus_get(host);
-- if (!host->bus_ops || host->bus_dead || !host->bus_ops->hw_reset) {
-- mmc_bus_put(host);
-- return -EOPNOTSUPP;
-- }
--
- ret = host->bus_ops->hw_reset(host);
-- mmc_bus_put(host);
--
- if (ret < 0)
- pr_warn("%s: tried to HW reset card, got error %d\n",
- mmc_hostname(host), ret);
-@@ -2120,18 +2109,10 @@ int mmc_sw_reset(struct mmc_host *host)
- {
- int ret;
-
-- if (!host->card)
-- return -EINVAL;
--
-- mmc_bus_get(host);
-- if (!host->bus_ops || host->bus_dead || !host->bus_ops->sw_reset) {
-- mmc_bus_put(host);
-+ if (!host->bus_ops->sw_reset)
- return -EOPNOTSUPP;
-- }
-
- ret = host->bus_ops->sw_reset(host);
-- mmc_bus_put(host);
--
- if (ret)
- pr_warn("%s: tried to SW reset card, got error %d\n",
- mmc_hostname(host), ret);
ext4-fix-iloc.bh-leak-in-ext4_fc_replay_inode-error-paths.patch
ext4-publish-jinode-after-initialization.patch
bluetooth-l2cap-fix-accepting-multiple-l2cap_ecred_conn_req.patch
-mmc-core-drop-redundant-member-in-struct-mmc-host.patch
-mmc-core-drop-superfluous-validations-in-mmc_hw-sw_reset.patch
-mmc-core-drop-reference-counting-of-the-bus_ops.patch
-mmc-core-avoid-bitfield-rmw-for-claim-retune-flags.patch
revert-nvme-nvme-fc-ensure-ioerr_work-is-cancelled-in-nvme_fc_delete_ctrl.patch
nvme-nvme-fc-ensure-ioerr_work-is-cancelled-in-nvme_fc_delete_ctrl.patch
device-property-add-fwnode_is_ancestor_of-and-fwnode_get_next_parent_dev.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
