--- /dev/null
+From fe89277c9ceb0d6af0aa665bcf24a41d8b1b79cd Mon Sep 17 00:00:00 2001
+From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
+Date: Mon, 16 Mar 2026 15:16:39 +0800
+Subject: iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
+
+From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
+
+commit fe89277c9ceb0d6af0aa665bcf24a41d8b1b79cd upstream.
+
+During the qi_check_fault process after an IOMMU ITE event, requests at
+odd-numbered positions in the queue are set to QI_ABORT, only satisfying
+single-request submissions. However, qi_submit_sync now supports multiple
+simultaneous submissions, and can't guarantee that the wait_desc will be
+at an odd-numbered position. Therefore, if an item times out, IOMMU can't
+re-initiate the request, resulting in an infinite polling wait.
+
+This modifies the process by setting the status of all requests already
+fetched by IOMMU and recorded as QI_IN_USE status (including wait_desc
+requests) to QI_ABORT, thus enabling multiple requests to be resubmitted.
+
+Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
+Tested-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
+Link: https://lore.kernel.org/r/20260306101516.3885775-1-guanghuifeng@linux.alibaba.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/intel/dmar.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1243,7 +1243,6 @@ static int qi_check_fault(struct intel_i
+ if (fault & DMA_FSTS_ITE) {
+ head = readl(iommu->reg + DMAR_IQH_REG);
+ head = ((head >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
+- head |= 1;
+ tail = readl(iommu->reg + DMAR_IQT_REG);
+ tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
+
+@@ -1252,7 +1251,7 @@ static int qi_check_fault(struct intel_i
+ do {
+ if (qi->desc_status[head] == QI_IN_USE)
+ qi->desc_status[head] = QI_ABORT;
+- head = (head - 2 + QI_LENGTH) % QI_LENGTH;
++ head = (head - 1 + QI_LENGTH) % QI_LENGTH;
+ } while (head != tail);
+
+ if (qi->desc_status[wait_index] == QI_ABORT)
--- /dev/null
+From 5e3486e64094c28a526543f1e8aa0d5964b7f02d Mon Sep 17 00:00:00 2001
+From: Luke Wang <ziniu.wang_1@nxp.com>
+Date: Wed, 11 Mar 2026 17:50:06 +0800
+Subject: mmc: sdhci: fix timing selection for 1-bit bus width
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+commit 5e3486e64094c28a526543f1e8aa0d5964b7f02d upstream.
+
+When 1-bit bus width is used with HS200/HS400 capabilities set,
+mmc_select_hs200() returns 0 without actually switching. This
+causes mmc_select_timing() to skip mmc_select_hs(), leaving eMMC
+in legacy mode (26MHz) instead of High Speed SDR (52MHz).
+
+Per JEDEC eMMC spec section 5.3.2, 1-bit mode supports High Speed
+SDR. Drop incompatible HS200/HS400/UHS/DDR caps early so timing
+selection falls through to mmc_select_hs() correctly.
+
+Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure")
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -4444,8 +4444,15 @@ int sdhci_setup_host(struct sdhci_host *
+ * their platform code before calling sdhci_add_host(), and we
+ * won't assume 8-bit width for hosts without that CAP.
+ */
+- if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
++ if (host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA) {
++ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
++ if (host->quirks2 & SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400)
++ host->caps1 &= ~SDHCI_SUPPORT_HS400;
++ mmc->caps2 &= ~(MMC_CAP2_HS200 | MMC_CAP2_HS400 | MMC_CAP2_HS400_ES);
++ mmc->caps &= ~(MMC_CAP_DDR | MMC_CAP_UHS);
++ } else {
+ mmc->caps |= MMC_CAP_4_BIT_DATA;
++ }
+
+ if (host->quirks2 & SDHCI_QUIRK2_HOST_NO_CMD23)
+ mmc->caps &= ~MMC_CAP_CMD23;
--- /dev/null
+From 2b76e0cc7803e5ab561c875edaba7f6bbd87fbb0 Mon Sep 17 00:00:00 2001
+From: Matthew Schwartz <matthew.schwartz@linux.dev>
+Date: Mon, 2 Mar 2026 13:07:17 -0800
+Subject: mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
+
+From: Matthew Schwartz <matthew.schwartz@linux.dev>
+
+commit 2b76e0cc7803e5ab561c875edaba7f6bbd87fbb0 upstream.
+
+The GL9750 SD host controller has intermittent data corruption during
+DMA write operations. The GM_BURST register's R_OSRC_Lmt field
+(bits 17:16), which limits outstanding DMA read requests from system
+memory, is not being cleared during initialization. The Windows driver
+sets R_OSRC_Lmt to zero, limiting requests to the smallest unit.
+
+Clear R_OSRC_Lmt to match the Windows driver behavior. This eliminates
+write corruption verified with f3write/f3read tests while maintaining
+DMA performance.
+
+Cc: stable@vger.kernel.org
+Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support")
+Closes: https://lore.kernel.org/linux-mmc/33d12807-5c72-41ce-8679-57aa11831fad@linux.dev/
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
+Reviewed-by: Ben Chuang <ben.chuang@genesyslogic.com.tw>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-gli.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pci-gli.c
++++ b/drivers/mmc/host/sdhci-pci-gli.c
+@@ -59,6 +59,9 @@
+ #define GLI_9750_MISC_RX_INV_VALUE GLI_9750_MISC_RX_INV_OFF
+ #define GLI_9750_MISC_TX1_DLY_VALUE 0x5
+
++#define SDHCI_GLI_9750_GM_BURST_SIZE 0x510
++#define SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT GENMASK(17, 16)
++
+ #define SDHCI_GLI_9750_TUNING_CONTROL 0x540
+ #define SDHCI_GLI_9750_TUNING_CONTROL_EN BIT(4)
+ #define GLI_9750_TUNING_CONTROL_EN_ON 0x1
+@@ -152,10 +155,16 @@ static void gli_set_9750(struct sdhci_ho
+ u32 misc_value;
+ u32 parameter_value;
+ u32 control_value;
++ u32 burst_value;
+ u16 ctrl2;
+
+ gl9750_wt_on(host);
+
++ /* clear R_OSRC_Lmt to avoid DMA write corruption */
++ burst_value = sdhci_readl(host, SDHCI_GLI_9750_GM_BURST_SIZE);
++ burst_value &= ~SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT;
++ sdhci_writel(host, burst_value, SDHCI_GLI_9750_GM_BURST_SIZE);
++
+ driving_value = sdhci_readl(host, SDHCI_GLI_9750_DRIVING);
+ pll_value = sdhci_readl(host, SDHCI_GLI_9750_PLL);
+ sw_ctrl_value = sdhci_readl(host, SDHCI_GLI_9750_SW_CTRL);
--- /dev/null
+From 0410e1a4c545c769c59c6eda897ad5d574d0c865 Mon Sep 17 00:00:00 2001
+From: Chen Ni <nichen@iscas.ac.cn>
+Date: Mon, 9 Feb 2026 15:56:18 +0800
+Subject: mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+commit 0410e1a4c545c769c59c6eda897ad5d574d0c865 upstream.
+
+Fix wrong variable used for error checking after dma_alloc_coherent()
+call. The function checks cdns_ctrl->dma_cdma_desc instead of
+cdns_ctrl->cdma_desc, which could lead to incorrect error handling.
+
+Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/cadence-nand-controller.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/cadence-nand-controller.c
++++ b/drivers/mtd/nand/raw/cadence-nand-controller.c
+@@ -2840,7 +2840,7 @@ static int cadence_nand_init(struct cdns
+ sizeof(*cdns_ctrl->cdma_desc),
+ &cdns_ctrl->dma_cdma_desc,
+ GFP_KERNEL);
+- if (!cdns_ctrl->dma_cdma_desc)
++ if (!cdns_ctrl->cdma_desc)
+ return -ENOMEM;
+
+ cdns_ctrl->buf_size = SZ_16K;
net-macb-fix-use-after-free-access-to-ptp-clock.patch
bluetooth-l2cap-fix-type-confusion-in-l2cap_ecred_reconf_rsp.patch
bluetooth-l2cap-validate-l2cap_info_rsp-payload-length-before-access.patch
+mmc-sdhci-pci-gli-fix-gl9750-dma-write-corruption.patch
+mmc-sdhci-fix-timing-selection-for-1-bit-bus-width.patch
+mtd-rawnand-cadence-fix-error-check-for-dma_alloc_coherent-in-cadence_nand_init.patch
+iommu-vt-d-fix-intel-iommu-iotlb-sync-hardlockup-and-retry.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
