From: Greg Kroah-Hartman Date: Sat, 21 Oct 2023 09:18:37 +0000 (+0200) Subject: 6.5-stable patches X-Git-Tag: v4.14.328~61 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=330b34ea2f557226e9407f4980f0a1e519085e50;p=thirdparty%2Fkernel%2Fstable-queue.git 6.5-stable patches added patches: acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch mmc-core-fix-error-propagation-for-some-ioctl-commands.patch mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch mtd-physmap-core-restore-map_rom-fallback.patch mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch mtd-spinand-micron-correct-bitmask-for-ecc-status.patch nfs-fix-potential-oops-in-nfs_inode_remove_request.patch nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch nvme-pci-add-bogus_nid-for-intel-0a54-device.patch nvme-rdma-do-not-try-to-stop-unallocated-queues.patch nvme-sanitize-metadata-bounce-buffer-for-reads.patch nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch pnfs-fix-a-hang-in-nfs4_evict_inode.patch pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch --- diff --git a/queue-6.5/acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch b/queue-6.5/acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch new file mode 100644 index 00000000000..a7972548db9 --- /dev/null +++ b/queue-6.5/acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch @@ -0,0 +1,52 @@ +From d5921c460e543228d100daf67dac7a03dfaaa40a Mon Sep 17 00:00:00 2001 +From: Hanjun Guo +Date: Tue, 10 Oct 2023 16:21:23 +0800 +Subject: ACPI: bus: Move acpi_arm_init() to the place of after acpi_ghes_init() + +From: Hanjun Guo + +commit d5921c460e543228d100daf67dac7a03dfaaa40a upstream. + +acpi_agdi_init() in acpi_arm_init() will register a SDEI event, so +it needs the SDEI subsystem to be initialized (which is done in +acpi_ghes_init()) before the AGDI driver probing. + +In commit fcea0ccf4fd7 ("ACPI: bus: Consolidate all arm specific +initialisation into acpi_arm_init()"), the acpi_agdi_init() was +called before acpi_ghes_init() and it causes following failure: + +| [ 0.515864] sdei: Failed to create event 1073741825: -5 +| [ 0.515866] agdi agdi.0: Failed to register for SDEI event 1073741825 +| [ 0.515867] agdi: probe of agdi.0 failed with error -5 +| ... +| [ 0.516022] sdei: SDEIv1.0 (0x0) detected in firmware. + +Fix it by moving acpi_arm_init() to the place of after +acpi_ghes_init(). + +Fixes: fcea0ccf4fd7 ("ACPI: bus: Consolidate all arm specific initialisation into acpi_arm_init()") +Reported-by: D Scott Phillips +Signed-off-by: Hanjun Guo +Reviewed-by: Sudeep Holla +Tested-by: D Scott Phillips +Cc: 6.5+ # 6.5+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1387,10 +1387,10 @@ static int __init acpi_init(void) + acpi_init_ffh(); + + pci_mmcfg_late_init(); +- acpi_arm_init(); + acpi_viot_early_init(); + acpi_hest_init(); + acpi_ghes_init(); ++ acpi_arm_init(); + acpi_scan_init(); + acpi_ec_init(); + acpi_debugfs_init(); diff --git a/queue-6.5/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch b/queue-6.5/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch new file mode 100644 index 00000000000..ab01dcc3e15 --- /dev/null +++ b/queue-6.5/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch @@ -0,0 +1,48 @@ +From 0c21a18d5d6c6a73d098fb9b4701572370942df9 Mon Sep 17 00:00:00 2001 +From: Sunil V L +Date: Mon, 16 Oct 2023 22:39:39 +0530 +Subject: ACPI: irq: Fix incorrect return value in acpi_register_gsi() + +From: Sunil V L + +commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream. + +acpi_register_gsi() should return a negative value in case of failure. + +Currently, it returns the return value from irq_create_fwspec_mapping(). +However, irq_create_fwspec_mapping() returns 0 for failure. Fix the +issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero. + +Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping") +Cc: 4.11+ # 4.11+ +Signed-off-by: Sunil V L +[ rjw: Rename a new local variable ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/irq.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/irq.c ++++ b/drivers/acpi/irq.c +@@ -57,6 +57,7 @@ int acpi_register_gsi(struct device *dev + int polarity) + { + struct irq_fwspec fwspec; ++ unsigned int irq; + + fwspec.fwnode = acpi_get_gsi_domain_id(gsi); + if (WARN_ON(!fwspec.fwnode)) { +@@ -68,7 +69,11 @@ int acpi_register_gsi(struct device *dev + fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity); + fwspec.param_count = 2; + +- return irq_create_fwspec_mapping(&fwspec); ++ irq = irq_create_fwspec_mapping(&fwspec); ++ if (!irq) ++ return -EINVAL; ++ ++ return irq; + } + EXPORT_SYMBOL_GPL(acpi_register_gsi); + diff --git a/queue-6.5/dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch b/queue-6.5/dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch new file mode 100644 index 00000000000..873599e66c7 --- /dev/null +++ b/queue-6.5/dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch @@ -0,0 +1,37 @@ +From 1bbac8d6af085408885675c1e29b2581250be124 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 25 Aug 2023 15:55:02 +0200 +Subject: dt-bindings: mmc: sdhci-msm: correct minimum number of clocks + +From: Krzysztof Kozlowski + +commit 1bbac8d6af085408885675c1e29b2581250be124 upstream. + +In the TXT binding before conversion, the "xo" clock was listed as +optional. Conversion kept it optional in "clock-names", but not in +"clocks". This fixes dbts_check warnings like: + + qcom-sdx65-mtp.dtb: mmc@8804000: clocks: [[13, 59], [13, 58]] is too short + +Cc: +Fixes: a45537723f4b ("dt-bindings: mmc: sdhci-msm: Convert bindings to yaml") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Conor Dooley +Link: https://lore.kernel.org/r/20230825135503.282135-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/mmc/sdhci-msm.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/mmc/sdhci-msm.yaml ++++ b/Documentation/devicetree/bindings/mmc/sdhci-msm.yaml +@@ -69,7 +69,7 @@ properties: + maxItems: 4 + + clocks: +- minItems: 3 ++ minItems: 2 + items: + - description: Main peripheral bus clock, PCLK/HCLK - AHB Bus clock + - description: SDC MMC clock, MCLK diff --git a/queue-6.5/fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch b/queue-6.5/fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch new file mode 100644 index 00000000000..b754a376301 --- /dev/null +++ b/queue-6.5/fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch @@ -0,0 +1,89 @@ +From 97ac489775f26acfd46a8a60c2f84ce7cc79fa4b Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Wed, 18 Oct 2023 12:59:56 +0300 +Subject: fanotify: limit reporting of event with non-decodeable file handles + +From: Amir Goldstein + +commit 97ac489775f26acfd46a8a60c2f84ce7cc79fa4b upstream. + +Commit a95aef69a740 ("fanotify: support reporting non-decodeable file +handles") merged in v6.5-rc1, added the ability to use an fanotify group +with FAN_REPORT_FID mode to watch filesystems that do not support nfs +export, but do know how to encode non-decodeable file handles, with the +newly introduced AT_HANDLE_FID flag. + +At the time that this commit was merged, there were no filesystems +in-tree with those traits. + +Commit 16aac5ad1fa9 ("ovl: support encoding non-decodable file handles"), +merged in v6.6-rc1, added this trait to overlayfs, thus allowing fanotify +watching of overlayfs with FAN_REPORT_FID mode. + +In retrospect, allowing an fanotify filesystem/mount mark on such +filesystem in FAN_REPORT_FID mode will result in getting events with +file handles, without the ability to resolve the filesystem objects from +those file handles (i.e. no open_by_handle_at() support). + +For v6.6, the safer option would be to allow this mode for inode marks +only, where the caller has the opportunity to use name_to_handle_at() at +the time of setting the mark. In the future we can revise this decision. + +Fixes: a95aef69a740 ("fanotify: support reporting non-decodeable file handles") +Signed-off-by: Amir Goldstein +Signed-off-by: Jan Kara +Message-Id: <20231018100000.2453965-2-amir73il@gmail.com> +Signed-off-by: Greg Kroah-Hartman +--- + fs/notify/fanotify/fanotify_user.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index f69c451018e3..62fe0b679e58 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1585,16 +1585,25 @@ static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid) + } + + /* Check if filesystem can encode a unique fid */ +-static int fanotify_test_fid(struct dentry *dentry) ++static int fanotify_test_fid(struct dentry *dentry, unsigned int flags) + { ++ unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; ++ const struct export_operations *nop = dentry->d_sb->s_export_op; ++ ++ /* ++ * We need to make sure that the filesystem supports encoding of ++ * file handles so user can use name_to_handle_at() to compare fids ++ * reported with events to the file handle of watched objects. ++ */ ++ if (!nop) ++ return -EOPNOTSUPP; ++ + /* +- * We need to make sure that the file system supports at least +- * encoding a file handle so user can use name_to_handle_at() to +- * compare fid returned with event to the file handle of watched +- * objects. However, even the relaxed AT_HANDLE_FID flag requires +- * at least empty export_operations for ecoding unique file ids. ++ * For sb/mount mark, we also need to make sure that the filesystem ++ * supports decoding file handles, so user has a way to map back the ++ * reported fids to filesystem objects. + */ +- if (!dentry->d_sb->s_export_op) ++ if (mark_type != FAN_MARK_INODE && !nop->fh_to_dentry) + return -EOPNOTSUPP; + + return 0; +@@ -1812,7 +1821,7 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, + if (ret) + goto path_put_and_out; + +- ret = fanotify_test_fid(path.dentry); ++ ret = fanotify_test_fid(path.dentry, flags); + if (ret) + goto path_put_and_out; + +-- +2.42.0 + diff --git a/queue-6.5/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch b/queue-6.5/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch new file mode 100644 index 00000000000..dae503260ad --- /dev/null +++ b/queue-6.5/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch @@ -0,0 +1,39 @@ +From 84ee19bffc9306128cd0f1c650e89767079efeff Mon Sep 17 00:00:00 2001 +From: Avri Altman +Date: Wed, 27 Sep 2023 10:15:00 +0300 +Subject: mmc: core: Capture correct oemid-bits for eMMC cards + +From: Avri Altman + +commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream. + +The OEMID is an 8-bit binary number rather than 16-bit as the current code +parses for. The OEMID occupies bits [111:104] in the CID register, see the +eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from +the legacy MMC specs (v3.31 and before). + +Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This +means we ignore the impact on some of those old MMC cards that may be out +there, but on the other hand this shouldn't be a problem as the OEMID seems +not be an important feature for these cards. + +Signed-off-by: Avri Altman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -104,7 +104,7 @@ static int mmc_decode_cid(struct mmc_car + case 3: /* MMC v3.1 - v3.3 */ + case 4: /* MMC v4 */ + card->cid.manfid = UNSTUFF_BITS(resp, 120, 8); +- card->cid.oemid = UNSTUFF_BITS(resp, 104, 16); ++ card->cid.oemid = UNSTUFF_BITS(resp, 104, 8); + card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8); + card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8); + card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8); diff --git a/queue-6.5/mmc-core-fix-error-propagation-for-some-ioctl-commands.patch b/queue-6.5/mmc-core-fix-error-propagation-for-some-ioctl-commands.patch new file mode 100644 index 00000000000..259929239a7 --- /dev/null +++ b/queue-6.5/mmc-core-fix-error-propagation-for-some-ioctl-commands.patch @@ -0,0 +1,95 @@ +From f19c5a73e6f78d69efce66cfdce31148c76a61a6 Mon Sep 17 00:00:00 2001 +From: Ulf Hansson +Date: Wed, 13 Sep 2023 13:29:21 +0200 +Subject: mmc: core: Fix error propagation for some ioctl commands + +From: Ulf Hansson + +commit f19c5a73e6f78d69efce66cfdce31148c76a61a6 upstream. + +Userspace has currently no way of checking the internal R1 response error +bits for some commands. This is a problem for some commands, like RPMB for +example. Typically, we may detect that the busy completion has successfully +ended, while in fact the card did not complete the requested operation. + +To fix the problem, let's always poll with CMD13 for these commands and +during the polling, let's also aggregate the R1 response bits. Before +completing the ioctl request, let's propagate the R1 response bits too. + +Reviewed-by: Avri Altman +Co-developed-by: Christian Loehle +Signed-off-by: Christian Loehle +Signed-off-by: Ulf Hansson +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230913112921.553019-1-ulf.hansson@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/block.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -179,6 +179,7 @@ static void mmc_blk_rw_rq_prep(struct mm + struct mmc_queue *mq); + static void mmc_blk_hsq_req_done(struct mmc_request *mrq); + static int mmc_spi_err_check(struct mmc_card *card); ++static int mmc_blk_busy_cb(void *cb_data, bool *busy); + + static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk) + { +@@ -470,7 +471,7 @@ static int __mmc_blk_ioctl_cmd(struct mm + struct mmc_data data = {}; + struct mmc_request mrq = {}; + struct scatterlist sg; +- bool r1b_resp, use_r1b_resp = false; ++ bool r1b_resp; + unsigned int busy_timeout_ms; + int err; + unsigned int target_part; +@@ -551,8 +552,7 @@ static int __mmc_blk_ioctl_cmd(struct mm + busy_timeout_ms = idata->ic.cmd_timeout_ms ? : MMC_BLK_TIMEOUT_MS; + r1b_resp = (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B; + if (r1b_resp) +- use_r1b_resp = mmc_prepare_busy_cmd(card->host, &cmd, +- busy_timeout_ms); ++ mmc_prepare_busy_cmd(card->host, &cmd, busy_timeout_ms); + + mmc_wait_for_req(card->host, &mrq); + memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp)); +@@ -605,19 +605,28 @@ static int __mmc_blk_ioctl_cmd(struct mm + if (idata->ic.postsleep_min_us) + usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); + +- /* No need to poll when using HW busy detection. */ +- if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) && use_r1b_resp) +- return 0; +- + if (mmc_host_is_spi(card->host)) { + if (idata->ic.write_flag || r1b_resp || cmd.flags & MMC_RSP_SPI_BUSY) + return mmc_spi_err_check(card); + return err; + } +- /* Ensure RPMB/R1B command has completed by polling with CMD13. */ +- if (idata->rpmb || r1b_resp) +- err = mmc_poll_for_busy(card, busy_timeout_ms, false, +- MMC_BUSY_IO); ++ ++ /* ++ * Ensure RPMB, writes and R1B responses are completed by polling with ++ * CMD13. Note that, usually we don't need to poll when using HW busy ++ * detection, but here it's needed since some commands may indicate the ++ * error through the R1 status bits. ++ */ ++ if (idata->rpmb || idata->ic.write_flag || r1b_resp) { ++ struct mmc_blk_busy_data cb_data = { ++ .card = card, ++ }; ++ ++ err = __mmc_poll_for_busy(card->host, 0, busy_timeout_ms, ++ &mmc_blk_busy_cb, &cb_data); ++ ++ idata->ic.response[0] = cb_data.status; ++ } + + return err; + } diff --git a/queue-6.5/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch b/queue-6.5/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch new file mode 100644 index 00000000000..3c88a7b3448 --- /dev/null +++ b/queue-6.5/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch @@ -0,0 +1,45 @@ +From 32a9cdb8869dc111a0c96cf8e1762be9684af15b Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Wed, 30 Aug 2023 17:39:22 +0800 +Subject: mmc: core: sdio: hold retuning if sdio in 1-bit mode + +From: Haibo Chen + +commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream. + +tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode, +need to hold retuning. + +Find this issue when use manual tuning method on imx93. When system +resume back, SDIO WIFI try to switch back to 4 bit mode, first will +trigger retuning, and all tuning command failed. + +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/sdio.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -1089,8 +1089,14 @@ static int mmc_sdio_resume(struct mmc_ho + } + err = mmc_sdio_reinit_card(host); + } else if (mmc_card_wake_sdio_irq(host)) { +- /* We may have switched to 1-bit mode during suspend */ ++ /* ++ * We may have switched to 1-bit mode during suspend, ++ * need to hold retuning, because tuning only supprt ++ * 4-bit mode or 8 bit mode. ++ */ ++ mmc_retune_hold_now(host); + err = sdio_enable_4bit_bus(host->card); ++ mmc_retune_release(host); + } + + if (err) diff --git a/queue-6.5/mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch b/queue-6.5/mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch new file mode 100644 index 00000000000..51ac0ffcf57 --- /dev/null +++ b/queue-6.5/mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch @@ -0,0 +1,83 @@ +From c7bb120c1c66672b657e95d0942c989b8275aeb3 Mon Sep 17 00:00:00 2001 +From: Pablo Sun +Date: Fri, 22 Sep 2023 17:53:48 +0800 +Subject: mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw + +From: Pablo Sun + +commit c7bb120c1c66672b657e95d0942c989b8275aeb3 upstream. + +Use atomic readl_poll_timeout_atomic, because msdc_reset_hw +may be invoked in IRQ handler in the following context: + + msdc_irq() -> msdc_cmd_done() -> msdc_reset_hw() + +The following kernel BUG stack trace can be observed on +Genio 1200 EVK after initializing MSDC1 hardware during kernel boot: + +[ 1.187441] BUG: scheduling while atomic: swapper/0/0/0x00010002 +[ 1.189157] Modules linked in: +[ 1.204633] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.15.42-mtk+modified #1 +[ 1.205713] Hardware name: MediaTek Genio 1200 EVK-P1V2-EMMC (DT) +[ 1.206484] Call trace: +[ 1.206796] dump_backtrace+0x0/0x1ac +[ 1.207266] show_stack+0x24/0x30 +[ 1.207692] dump_stack_lvl+0x68/0x84 +[ 1.208162] dump_stack+0x1c/0x38 +[ 1.208587] __schedule_bug+0x68/0x80 +[ 1.209056] __schedule+0x6ec/0x7c0 +[ 1.209502] schedule+0x7c/0x110 +[ 1.209915] schedule_hrtimeout_range_clock+0xc4/0x1f0 +[ 1.210569] schedule_hrtimeout_range+0x20/0x30 +[ 1.211148] usleep_range_state+0x84/0xc0 +[ 1.211661] msdc_reset_hw+0xc8/0x1b0 +[ 1.212134] msdc_cmd_done.isra.0+0x4ac/0x5f0 +[ 1.212693] msdc_irq+0x104/0x2d4 +[ 1.213121] __handle_irq_event_percpu+0x68/0x280 +[ 1.213725] handle_irq_event+0x70/0x15c +[ 1.214230] handle_fasteoi_irq+0xb0/0x1a4 +[ 1.214755] handle_domain_irq+0x6c/0x9c +[ 1.215260] gic_handle_irq+0xc4/0x180 +[ 1.215741] call_on_irq_stack+0x2c/0x54 +[ 1.216245] do_interrupt_handler+0x5c/0x70 +[ 1.216782] el1_interrupt+0x30/0x80 +[ 1.217242] el1h_64_irq_handler+0x1c/0x2c +[ 1.217769] el1h_64_irq+0x78/0x7c +[ 1.218206] cpuidle_enter_state+0xc8/0x600 +[ 1.218744] cpuidle_enter+0x44/0x5c +[ 1.219205] do_idle+0x224/0x2d0 +[ 1.219624] cpu_startup_entry+0x30/0x80 +[ 1.220129] rest_init+0x108/0x134 +[ 1.220568] arch_call_rest_init+0x1c/0x28 +[ 1.221094] start_kernel+0x6c0/0x700 +[ 1.221564] __primary_switched+0xc0/0xc8 + +Fixes: ffaea6ebfe9c ("mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling") +Signed-off-by: Pablo Sun +Reviewed-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230922095348.22182-1-pablo.sun@mediatek.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/mtk-sd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -671,11 +671,11 @@ static void msdc_reset_hw(struct msdc_ho + u32 val; + + sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_RST); +- readl_poll_timeout(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0); ++ readl_poll_timeout_atomic(host->base + MSDC_CFG, val, !(val & MSDC_CFG_RST), 0, 0); + + sdr_set_bits(host->base + MSDC_FIFOCS, MSDC_FIFOCS_CLR); +- readl_poll_timeout(host->base + MSDC_FIFOCS, val, +- !(val & MSDC_FIFOCS_CLR), 0, 0); ++ readl_poll_timeout_atomic(host->base + MSDC_FIFOCS, val, ++ !(val & MSDC_FIFOCS_CLR), 0, 0); + + val = readl(host->base + MSDC_INT); + writel(val, host->base + MSDC_INT); diff --git a/queue-6.5/mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch b/queue-6.5/mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch new file mode 100644 index 00000000000..45213f73e5a --- /dev/null +++ b/queue-6.5/mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch @@ -0,0 +1,167 @@ +From 1202d617e3d04c8d27a14ef30784a698c48170b3 Mon Sep 17 00:00:00 2001 +From: Sven van Ashbrook +Date: Thu, 31 Aug 2023 16:00:56 +0000 +Subject: mmc: sdhci-pci-gli: fix LPM negotiation so x86/S0ix SoCs can suspend + +From: Sven van Ashbrook + +commit 1202d617e3d04c8d27a14ef30784a698c48170b3 upstream. + +To improve the r/w performance of GL9763E, the current driver inhibits LPM +negotiation while the device is active. + +This prevents a large number of SoCs from suspending, notably x86 systems +which commonly use S0ix as the suspend mechanism - for example, Intel +Alder Lake and Raptor Lake processors. + +Failure description: +1. Userspace initiates s2idle suspend (e.g. via writing to + /sys/power/state) +2. This switches the runtime_pm device state to active, which disables + LPM negotiation, then calls the "regular" suspend callback +3. With LPM negotiation disabled, the bus cannot enter low-power state +4. On a large number of SoCs, if the bus not in a low-power state, S0ix + cannot be entered, which in turn prevents the SoC from entering + suspend. + +Fix by re-enabling LPM negotiation in the device's suspend callback. + +Suggested-by: Stanislaw Kardach +Fixes: f9e5b33934ce ("mmc: host: Improve I/O read/write performance for GL9763E") +Cc: stable@vger.kernel.org +Signed-off-by: Sven van Ashbrook +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20230831160055.v3.1.I7ed1ca09797be2dd76ca914c57d88b32d24dac88@changeid +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-gli.c | 104 ++++++++++++++++++++++++--------------- + 1 file changed, 66 insertions(+), 38 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -1144,42 +1144,6 @@ static u32 sdhci_gl9750_readl(struct sdh + return value; + } + +-#ifdef CONFIG_PM_SLEEP +-static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip) +-{ +- struct sdhci_pci_slot *slot = chip->slots[0]; +- +- pci_free_irq_vectors(slot->chip->pdev); +- gli_pcie_enable_msi(slot); +- +- return sdhci_pci_resume_host(chip); +-} +- +-static int sdhci_cqhci_gli_resume(struct sdhci_pci_chip *chip) +-{ +- struct sdhci_pci_slot *slot = chip->slots[0]; +- int ret; +- +- ret = sdhci_pci_gli_resume(chip); +- if (ret) +- return ret; +- +- return cqhci_resume(slot->host->mmc); +-} +- +-static int sdhci_cqhci_gli_suspend(struct sdhci_pci_chip *chip) +-{ +- struct sdhci_pci_slot *slot = chip->slots[0]; +- int ret; +- +- ret = cqhci_suspend(slot->host->mmc); +- if (ret) +- return ret; +- +- return sdhci_suspend_host(slot->host); +-} +-#endif +- + static void gl9763e_hs400_enhanced_strobe(struct mmc_host *mmc, + struct mmc_ios *ios) + { +@@ -1420,6 +1384,70 @@ static int gl9763e_runtime_resume(struct + } + #endif + ++#ifdef CONFIG_PM_SLEEP ++static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip) ++{ ++ struct sdhci_pci_slot *slot = chip->slots[0]; ++ ++ pci_free_irq_vectors(slot->chip->pdev); ++ gli_pcie_enable_msi(slot); ++ ++ return sdhci_pci_resume_host(chip); ++} ++ ++static int gl9763e_resume(struct sdhci_pci_chip *chip) ++{ ++ struct sdhci_pci_slot *slot = chip->slots[0]; ++ int ret; ++ ++ ret = sdhci_pci_gli_resume(chip); ++ if (ret) ++ return ret; ++ ++ ret = cqhci_resume(slot->host->mmc); ++ if (ret) ++ return ret; ++ ++ /* ++ * Disable LPM negotiation to bring device back in sync ++ * with its runtime_pm state. ++ */ ++ gl9763e_set_low_power_negotiation(slot, false); ++ ++ return 0; ++} ++ ++static int gl9763e_suspend(struct sdhci_pci_chip *chip) ++{ ++ struct sdhci_pci_slot *slot = chip->slots[0]; ++ int ret; ++ ++ /* ++ * Certain SoCs can suspend only with the bus in low- ++ * power state, notably x86 SoCs when using S0ix. ++ * Re-enable LPM negotiation to allow entering L1 state ++ * and entering system suspend. ++ */ ++ gl9763e_set_low_power_negotiation(slot, true); ++ ++ ret = cqhci_suspend(slot->host->mmc); ++ if (ret) ++ goto err_suspend; ++ ++ ret = sdhci_suspend_host(slot->host); ++ if (ret) ++ goto err_suspend_host; ++ ++ return 0; ++ ++err_suspend_host: ++ cqhci_resume(slot->host->mmc); ++err_suspend: ++ gl9763e_set_low_power_negotiation(slot, false); ++ return ret; ++} ++#endif ++ + static int gli_probe_slot_gl9763e(struct sdhci_pci_slot *slot) + { + struct pci_dev *pdev = slot->chip->pdev; +@@ -1527,8 +1555,8 @@ const struct sdhci_pci_fixes sdhci_gl976 + .probe_slot = gli_probe_slot_gl9763e, + .ops = &sdhci_gl9763e_ops, + #ifdef CONFIG_PM_SLEEP +- .resume = sdhci_cqhci_gli_resume, +- .suspend = sdhci_cqhci_gli_suspend, ++ .resume = gl9763e_resume, ++ .suspend = gl9763e_suspend, + #endif + #ifdef CONFIG_PM + .runtime_suspend = gl9763e_runtime_suspend, diff --git a/queue-6.5/mtd-physmap-core-restore-map_rom-fallback.patch b/queue-6.5/mtd-physmap-core-restore-map_rom-fallback.patch new file mode 100644 index 00000000000..21b46206eb8 --- /dev/null +++ b/queue-6.5/mtd-physmap-core-restore-map_rom-fallback.patch @@ -0,0 +1,43 @@ +From 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 30 Aug 2023 17:00:34 +0200 +Subject: mtd: physmap-core: Restore map_rom fallback + +From: Geert Uytterhoeven + +commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream. + +When the exact mapping type driver was not available, the old +physmap_of_core driver fell back to mapping the region as ROM. +Unfortunately this feature was lost when the DT and pdata cases were +merged. Revive this useful feature. + +Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/maps/physmap-core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/mtd/maps/physmap-core.c ++++ b/drivers/mtd/maps/physmap-core.c +@@ -552,6 +552,17 @@ static int physmap_flash_probe(struct pl + if (info->probe_type) { + info->mtds[i] = do_map_probe(info->probe_type, + &info->maps[i]); ++ ++ /* Fall back to mapping region as ROM */ ++ if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) && ++ strcmp(info->probe_type, "map_rom")) { ++ dev_warn(&dev->dev, ++ "map_probe() failed for type %s\n", ++ info->probe_type); ++ ++ info->mtds[i] = do_map_probe("map_rom", ++ &info->maps[i]); ++ } + } else { + int j; + diff --git a/queue-6.5/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch b/queue-6.5/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch new file mode 100644 index 00000000000..e73d0b409fd --- /dev/null +++ b/queue-6.5/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch @@ -0,0 +1,74 @@ +From 3a4a893dbb19e229db3b753f0462520b561dee98 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Mon, 17 Jul 2023 21:42:20 +0200 +Subject: mtd: rawnand: arasan: Ensure program page operations are successful + +From: Miquel Raynal + +commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream. + +The NAND core complies with the ONFI specification, which itself +mentions that after any program or erase operation, a status check +should be performed to see whether the operation was finished *and* +successful. + +The NAND core offers helpers to finish a page write (sending the +"PAGE PROG" command, waiting for the NAND chip to be ready again, and +checking the operation status). But in some cases, advanced controller +drivers might want to optimize this and craft their own page write +helper to leverage additional hardware capabilities, thus not always +using the core facilities. + +Some drivers, like this one, do not use the core helper to finish a page +write because the final cycles are automatically managed by the +hardware. In this case, the additional care must be taken to manually +perform the final status check. + +Let's read the NAND chip status at the end of the page write helper and +return -EIO upon error. + +Cc: Michal Simek +Cc: stable@vger.kernel.org +Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine") +Signed-off-by: Miquel Raynal +Acked-by: Michal Simek +Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -515,6 +515,7 @@ static int anfc_write_page_hw_ecc(struct + struct mtd_info *mtd = nand_to_mtd(chip); + unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0); + dma_addr_t dma_addr; ++ u8 status; + int ret; + struct anfc_op nfc_op = { + .pkt_reg = +@@ -561,10 +562,21 @@ static int anfc_write_page_hw_ecc(struct + } + + /* Spare data is not protected */ +- if (oob_required) ++ if (oob_required) { + ret = nand_write_oob_std(chip, page); ++ if (ret) ++ return ret; ++ } ++ ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; + +- return ret; ++ return 0; + } + + static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, diff --git a/queue-6.5/mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch b/queue-6.5/mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch new file mode 100644 index 00000000000..8b472472ba7 --- /dev/null +++ b/queue-6.5/mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch @@ -0,0 +1,116 @@ +From f6ca3fb6978f94d95ee79f95085fc22e71ca17cc Mon Sep 17 00:00:00 2001 +From: Rouven Czerwinski +Date: Fri, 22 Sep 2023 16:17:16 +0200 +Subject: mtd: rawnand: Ensure the nand chip supports cached reads + +From: Rouven Czerwinski + +commit f6ca3fb6978f94d95ee79f95085fc22e71ca17cc upstream. + +Both the JEDEC and ONFI specification say that read cache sequential +support is an optional command. This means that we not only need to +check whether the individual controller supports the command, we also +need to check the parameter pages for both ONFI and JEDEC NAND flashes +before enabling sequential cache reads. + +This fixes support for NAND flashes which don't support enabling cache +reads, i.e. Samsung K9F4G08U0F or Toshiba TC58NVG0S3HTA00. + +Sequential cache reads are now only available for ONFI and JEDEC +devices, if individual vendors implement this, it needs to be enabled +per vendor. + +Tested on i.MX6Q with a Samsung NAND flash chip that doesn't support +sequential reads. + +Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") +Cc: stable@vger.kernel.org +Signed-off-by: Rouven Czerwinski +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230922141717.35977-1-r.czerwinski@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/nand_base.c | 3 +++ + drivers/mtd/nand/raw/nand_jedec.c | 3 +++ + drivers/mtd/nand/raw/nand_onfi.c | 3 +++ + include/linux/mtd/jedec.h | 3 +++ + include/linux/mtd/onfi.h | 1 + + include/linux/mtd/rawnand.h | 2 ++ + 6 files changed, 15 insertions(+) + +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -5109,6 +5109,9 @@ static void rawnand_check_cont_read_supp + { + struct mtd_info *mtd = nand_to_mtd(chip); + ++ if (!chip->parameters.supports_read_cache) ++ return; ++ + if (chip->read_retries) + return; + +--- a/drivers/mtd/nand/raw/nand_jedec.c ++++ b/drivers/mtd/nand/raw/nand_jedec.c +@@ -94,6 +94,9 @@ int nand_jedec_detect(struct nand_chip * + goto free_jedec_param_page; + } + ++ if (p->opt_cmd[0] & JEDEC_OPT_CMD_READ_CACHE) ++ chip->parameters.supports_read_cache = true; ++ + memorg->pagesize = le32_to_cpu(p->byte_per_page); + mtd->writesize = memorg->pagesize; + +--- a/drivers/mtd/nand/raw/nand_onfi.c ++++ b/drivers/mtd/nand/raw/nand_onfi.c +@@ -303,6 +303,9 @@ int nand_onfi_detect(struct nand_chip *c + ONFI_FEATURE_ADDR_TIMING_MODE, 1); + } + ++ if (le16_to_cpu(p->opt_cmd) & ONFI_OPT_CMD_READ_CACHE) ++ chip->parameters.supports_read_cache = true; ++ + onfi = kzalloc(sizeof(*onfi), GFP_KERNEL); + if (!onfi) { + ret = -ENOMEM; +--- a/include/linux/mtd/jedec.h ++++ b/include/linux/mtd/jedec.h +@@ -21,6 +21,9 @@ struct jedec_ecc_info { + /* JEDEC features */ + #define JEDEC_FEATURE_16_BIT_BUS (1 << 0) + ++/* JEDEC Optional Commands */ ++#define JEDEC_OPT_CMD_READ_CACHE BIT(1) ++ + struct nand_jedec_params { + /* rev info and features block */ + /* 'J' 'E' 'S' 'D' */ +--- a/include/linux/mtd/onfi.h ++++ b/include/linux/mtd/onfi.h +@@ -55,6 +55,7 @@ + #define ONFI_SUBFEATURE_PARAM_LEN 4 + + /* ONFI optional commands SET/GET FEATURES supported? */ ++#define ONFI_OPT_CMD_READ_CACHE BIT(1) + #define ONFI_OPT_CMD_SET_GET_FEATURES BIT(2) + + struct nand_onfi_params { +--- a/include/linux/mtd/rawnand.h ++++ b/include/linux/mtd/rawnand.h +@@ -225,6 +225,7 @@ struct gpio_desc; + * struct nand_parameters - NAND generic parameters from the parameter page + * @model: Model name + * @supports_set_get_features: The NAND chip supports setting/getting features ++ * @supports_read_cache: The NAND chip supports read cache operations + * @set_feature_list: Bitmap of features that can be set + * @get_feature_list: Bitmap of features that can be get + * @onfi: ONFI specific parameters +@@ -233,6 +234,7 @@ struct nand_parameters { + /* Generic parameters */ + const char *model; + bool supports_set_get_features; ++ bool supports_read_cache; + DECLARE_BITMAP(set_feature_list, ONFI_FEATURE_NUMBER); + DECLARE_BITMAP(get_feature_list, ONFI_FEATURE_NUMBER); + diff --git a/queue-6.5/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch b/queue-6.5/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch new file mode 100644 index 00000000000..a5b6bf5e08d --- /dev/null +++ b/queue-6.5/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch @@ -0,0 +1,93 @@ +From 3e01d5254698ea3d18e09d96b974c762328352cd Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Mon, 17 Jul 2023 21:42:19 +0200 +Subject: mtd: rawnand: marvell: Ensure program page operations are successful + +From: Miquel Raynal + +commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream. + +The NAND core complies with the ONFI specification, which itself +mentions that after any program or erase operation, a status check +should be performed to see whether the operation was finished *and* +successful. + +The NAND core offers helpers to finish a page write (sending the +"PAGE PROG" command, waiting for the NAND chip to be ready again, and +checking the operation status). But in some cases, advanced controller +drivers might want to optimize this and craft their own page write +helper to leverage additional hardware capabilities, thus not always +using the core facilities. + +Some drivers, like this one, do not use the core helper to finish a page +write because the final cycles are automatically managed by the +hardware. In this case, the additional care must be taken to manually +perform the final status check. + +Let's read the NAND chip status at the end of the page write helper and +return -EIO upon error. + +Cc: stable@vger.kernel.org +Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver") +Reported-by: Aviram Dali +Signed-off-by: Miquel Raynal +Tested-by: Ravi Chandra Minnikanti +Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -1162,6 +1162,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri + .ndcb[2] = NDCB2_ADDR5_PAGE(page), + }; + unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0); ++ u8 status; + int ret; + + /* NFCv2 needs more information about the operation being executed */ +@@ -1195,7 +1196,18 @@ static int marvell_nfc_hw_ecc_hmg_do_wri + + ret = marvell_nfc_wait_op(chip, + PSEC_TO_MSEC(sdr->tPROG_max)); +- return ret; ++ if (ret) ++ return ret; ++ ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; ++ ++ return 0; + } + + static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip, +@@ -1624,6 +1636,7 @@ static int marvell_nfc_hw_ecc_bch_write_ + int data_len = lt->data_bytes; + int spare_len = lt->spare_bytes; + int chunk, ret; ++ u8 status; + + marvell_nfc_select_target(chip, chip->cur_cs); + +@@ -1660,6 +1673,14 @@ static int marvell_nfc_hw_ecc_bch_write_ + if (ret) + return ret; + ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; ++ + return 0; + } + diff --git a/queue-6.5/mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch b/queue-6.5/mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch new file mode 100644 index 00000000000..5931bf74c21 --- /dev/null +++ b/queue-6.5/mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch @@ -0,0 +1,65 @@ +From 9777cc13fd2c3212618904636354be60835e10bb Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Mon, 17 Jul 2023 21:42:21 +0200 +Subject: mtd: rawnand: pl353: Ensure program page operations are successful + +From: Miquel Raynal + +commit 9777cc13fd2c3212618904636354be60835e10bb upstream. + +The NAND core complies with the ONFI specification, which itself +mentions that after any program or erase operation, a status check +should be performed to see whether the operation was finished *and* +successful. + +The NAND core offers helpers to finish a page write (sending the +"PAGE PROG" command, waiting for the NAND chip to be ready again, and +checking the operation status). But in some cases, advanced controller +drivers might want to optimize this and craft their own page write +helper to leverage additional hardware capabilities, thus not always +using the core facilities. + +Some drivers, like this one, do not use the core helper to finish a page +write because the final cycles are automatically managed by the +hardware. In this case, the additional care must be taken to manually +perform the final status check. + +Let's read the NAND chip status at the end of the page write helper and +return -EIO upon error. + +Cc: Michal Simek +Cc: stable@vger.kernel.org +Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller") +Signed-off-by: Miquel Raynal +Tested-by: Michal Simek +Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-3-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/pl35x-nand-controller.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c ++++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c +@@ -513,6 +513,7 @@ static int pl35x_nand_write_page_hwecc(s + u32 addr1 = 0, addr2 = 0, row; + u32 cmd_addr; + int i, ret; ++ u8 status; + + ret = pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_APB); + if (ret) +@@ -565,6 +566,14 @@ static int pl35x_nand_write_page_hwecc(s + if (ret) + goto disable_ecc_engine; + ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ goto disable_ecc_engine; ++ ++ if (status & NAND_STATUS_FAIL) ++ ret = -EIO; ++ + disable_ecc_engine: + pl35x_smc_set_ecc_mode(nfc, chip, PL35X_SMC_ECC_CFG_MODE_BYPASS); + diff --git a/queue-6.5/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch b/queue-6.5/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch new file mode 100644 index 00000000000..57c99e0487c --- /dev/null +++ b/queue-6.5/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch @@ -0,0 +1,34 @@ +From 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd Mon Sep 17 00:00:00 2001 +From: Bibek Kumar Patro +Date: Wed, 13 Sep 2023 12:37:02 +0530 +Subject: mtd: rawnand: qcom: Unmap the right resource upon probe failure + +From: Bibek Kumar Patro + +commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream. + +We currently provide the physical address of the DMA region +rather than the output of dma_map_resource() which is obviously wrong. + +Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()") +Cc: stable@vger.kernel.org +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Bibek Kumar Patro +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/qcom_nandc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -3309,7 +3309,7 @@ err_nandc_alloc: + err_aon_clk: + clk_disable_unprepare(nandc->core_clk); + err_core_clk: +- dma_unmap_resource(dev, res->start, resource_size(res), ++ dma_unmap_resource(dev, nandc->base_dma, resource_size(res), + DMA_BIDIRECTIONAL, 0); + return ret; + } diff --git a/queue-6.5/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch b/queue-6.5/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch new file mode 100644 index 00000000000..a8db5a1e10b --- /dev/null +++ b/queue-6.5/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch @@ -0,0 +1,32 @@ +From 9836a987860e33943945d4b257729a4f94eae576 Mon Sep 17 00:00:00 2001 +From: Martin Kurbanov +Date: Tue, 5 Sep 2023 17:56:37 +0300 +Subject: mtd: spinand: micron: correct bitmask for ecc status + +From: Martin Kurbanov + +commit 9836a987860e33943945d4b257729a4f94eae576 upstream. + +Valid bitmask is 0x70 in the status register. + +Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD") +Signed-off-by: Martin Kurbanov +Reviewed-by: Frieder Schrempf +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/spi/micron.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/spi/micron.c ++++ b/drivers/mtd/nand/spi/micron.c +@@ -12,7 +12,7 @@ + + #define SPINAND_MFR_MICRON 0x2c + +-#define MICRON_STATUS_ECC_MASK GENMASK(7, 4) ++#define MICRON_STATUS_ECC_MASK GENMASK(6, 4) + #define MICRON_STATUS_ECC_NO_BITFLIPS (0 << 4) + #define MICRON_STATUS_ECC_1TO3_BITFLIPS (1 << 4) + #define MICRON_STATUS_ECC_4TO6_BITFLIPS (3 << 4) diff --git a/queue-6.5/nfs-fix-potential-oops-in-nfs_inode_remove_request.patch b/queue-6.5/nfs-fix-potential-oops-in-nfs_inode_remove_request.patch new file mode 100644 index 00000000000..52cfcaf2498 --- /dev/null +++ b/queue-6.5/nfs-fix-potential-oops-in-nfs_inode_remove_request.patch @@ -0,0 +1,50 @@ +From 6a6d4644ce935ddec4f76223ac0ca68da56bd2d3 Mon Sep 17 00:00:00 2001 +From: Scott Mayhew +Date: Wed, 11 Oct 2023 10:43:26 -0400 +Subject: NFS: Fix potential oops in nfs_inode_remove_request() + +From: Scott Mayhew + +commit 6a6d4644ce935ddec4f76223ac0ca68da56bd2d3 upstream. + +Once a folio's private data has been cleared, it's possible for another +process to clear the folio->mapping (e.g. via invalidate_complete_folio2 +or evict_mapping_folio), so it wouldn't be safe to call +nfs_page_to_inode() after that. + +Fixes: 0c493b5cf16e ("NFS: Convert buffered writes to use folios") +Signed-off-by: Scott Mayhew +Reviewed-by: Benjamin Coddington +Tested-by: Benjamin Coddington +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/write.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 7720b5e43014..9d82d50ce0b1 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -788,6 +788,8 @@ static void nfs_inode_add_request(struct nfs_page *req) + */ + static void nfs_inode_remove_request(struct nfs_page *req) + { ++ struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req)); ++ + if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) { + struct folio *folio = nfs_page_to_folio(req->wb_head); + struct address_space *mapping = folio_file_mapping(folio); +@@ -802,7 +804,7 @@ static void nfs_inode_remove_request(struct nfs_page *req) + } + + if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) { +- atomic_long_dec(&NFS_I(nfs_page_to_inode(req))->nrequests); ++ atomic_long_dec(&nfsi->nrequests); + nfs_release_request(req); + } + } +-- +2.42.0 + diff --git a/queue-6.5/nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch b/queue-6.5/nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch new file mode 100644 index 00000000000..ec7972974c5 --- /dev/null +++ b/queue-6.5/nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch @@ -0,0 +1,38 @@ +From f588d72bd95f748849685412b1f0c7959ca228cf Mon Sep 17 00:00:00 2001 +From: Dai Ngo +Date: Mon, 18 Sep 2023 23:30:20 -0700 +Subject: nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op + +From: Dai Ngo + +commit f588d72bd95f748849685412b1f0c7959ca228cf upstream. + +The Linux NFS server strips the SUID and SGID from the file mode +on ALLOCATE op. + +Modify _nfs42_proc_fallocate to add NFS_INO_REVAL_FORCED to +nfs_set_cache_invalid's argument to force update of the file +mode suid/sgid bit. + +Suggested-by: Trond Myklebust +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Tested-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs42proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -81,7 +81,8 @@ static int _nfs42_proc_fallocate(struct + if (status == 0) { + if (nfs_should_remove_suid(inode)) { + spin_lock(&inode->i_lock); +- nfs_set_cache_invalid(inode, NFS_INO_INVALID_MODE); ++ nfs_set_cache_invalid(inode, ++ NFS_INO_REVAL_FORCED | NFS_INO_INVALID_MODE); + spin_unlock(&inode->i_lock); + } + status = nfs_post_op_update_inode_force_wcc(inode, diff --git a/queue-6.5/nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch b/queue-6.5/nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch new file mode 100644 index 00000000000..2a8308253d6 --- /dev/null +++ b/queue-6.5/nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch @@ -0,0 +1,40 @@ +From 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 Mon Sep 17 00:00:00 2001 +From: Olga Kornievskaia +Date: Mon, 9 Oct 2023 10:59:01 -0400 +Subject: NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server + +From: Olga Kornievskaia + +commit 379e4adfddd6a2f95a4f2029b8ddcbacf92b21f9 upstream. + +This patches fixes commit 51d674a5e488 "NFSv4.1: use +EXCHGID4_FLAG_USE_PNFS_DS for DS server", purpose of that +commit was to mark EXCHANGE_ID to the DS with the appropriate +flag. + +However, connection to MDS can return both EXCHGID4_FLAG_USE_PNFS_DS +and EXCHGID4_FLAG_USE_PNFS_MDS set but previous patch would only +remember the USE_PNFS_DS and for the 2nd EXCHANGE_ID send that +to the MDS. + +Instead, just mark the pnfs path exclusively. + +Fixes: 51d674a5e488 ("NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8870,8 +8870,6 @@ static int _nfs4_proc_exchange_id(struct + /* Save the EXCHANGE_ID verifier session trunk tests */ + memcpy(clp->cl_confirm.data, argp->verifier.data, + sizeof(clp->cl_confirm.data)); +- if (resp->flags & EXCHGID4_FLAG_USE_PNFS_DS) +- set_bit(NFS_CS_DS, &clp->cl_flags); + out: + trace_nfs4_exchange_id(clp, status); + rpc_put_task(task); diff --git a/queue-6.5/nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch b/queue-6.5/nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch new file mode 100644 index 00000000000..dff57ec1673 --- /dev/null +++ b/queue-6.5/nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch @@ -0,0 +1,59 @@ +From 4ae55a7dce04989f289d5c5c8c8e5c37adc36c71 Mon Sep 17 00:00:00 2001 +From: Martin Wilck +Date: Mon, 4 Sep 2023 17:26:38 +0200 +Subject: nvme-auth: use chap->s2 to indicate bidirectional authentication + +From: Martin Wilck + +commit 4ae55a7dce04989f289d5c5c8c8e5c37adc36c71 upstream. + +Commit 546dea18c999 ("nvme-auth: check chap ctrl_key once constructed") +replaced the condition "if (ctrl->ctrl_key)" (indicating bidirectional +auth) by "if (chap->ctrl_key)", because ctrl->ctrl_key is a resource shared +with sysfs. But chap->ctrl_key is set in +nvme_auth_process_dhchap_challenge() depending on the DHVLEN in the +DH-HMAC-CHAP Challenge message received from the controller, and will thus +be non-NULL for every DH-HMAC-CHAP exchange, even if unidirectional auth +was requested. This will lead to a protocol violation by sending a Success2 +message in the unidirectional case (per NVMe base spec 2.0, the +authentication transaction ends after the Success1 message for +unidirectional auth). Use chap->s2 instead, which is non-zero if and only +if the host requested bi-directional authentication from the controller. + +Fixes: 546dea18c999 ("nvme-auth: check chap ctrl_key once constructed") +Signed-off-by: Martin Wilck +Reviewed-by: Daniel Wagner +Reviewed-by: Sagi Grimberg +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/auth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c +index daf5d144a8ea..064592a5d546 100644 +--- a/drivers/nvme/host/auth.c ++++ b/drivers/nvme/host/auth.c +@@ -341,7 +341,7 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl, + struct nvmf_auth_dhchap_success1_data *data = chap->buf; + size_t size = sizeof(*data); + +- if (chap->ctrl_key) ++ if (chap->s2) + size += chap->hash_len; + + if (size > CHAP_BUF_SIZE) { +@@ -825,7 +825,7 @@ static void nvme_queue_auth_work(struct work_struct *work) + goto fail2; + } + +- if (chap->ctrl_key) { ++ if (chap->s2) { + /* DH-HMAC-CHAP Step 5: send success2 */ + dev_dbg(ctrl->device, "%s: qid %d send success2\n", + __func__, chap->qid); +-- +2.42.0 + diff --git a/queue-6.5/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch b/queue-6.5/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch new file mode 100644 index 00000000000..ac4980a9835 --- /dev/null +++ b/queue-6.5/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch @@ -0,0 +1,32 @@ +From 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Thu, 12 Oct 2023 11:13:51 -0700 +Subject: nvme-pci: add BOGUS_NID for Intel 0a54 device + +From: Keith Busch + +commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream. + +These ones claim cmic and nmic capable, so need special consideration to ignore +their duplicate identifiers. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981 +Reported-by: welsh@cassens.com +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3329,7 +3329,8 @@ static const struct pci_device_id nvme_i + { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */ + .driver_data = NVME_QUIRK_STRIPE_SIZE | + NVME_QUIRK_DEALLOCATE_ZEROES | +- NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ NVME_QUIRK_IGNORE_DEV_SUBNQN | ++ NVME_QUIRK_BOGUS_NID, }, + { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */ + .driver_data = NVME_QUIRK_STRIPE_SIZE | + NVME_QUIRK_DEALLOCATE_ZEROES, }, diff --git a/queue-6.5/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch b/queue-6.5/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch new file mode 100644 index 00000000000..e52371e1eed --- /dev/null +++ b/queue-6.5/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch @@ -0,0 +1,43 @@ +From 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 Mon Sep 17 00:00:00 2001 +From: Maurizio Lombardi +Date: Mon, 31 Jul 2023 12:37:58 +0200 +Subject: nvme-rdma: do not try to stop unallocated queues + +From: Maurizio Lombardi + +commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream. + +Trying to stop a queue which hasn't been allocated will result +in a warning due to calling mutex_lock() against an uninitialized mutex. + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579 + + Call trace: + RIP: 0010:__mutex_lock+0x1173/0x14a0 + nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma] + nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma] + nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma] + nvme_do_delete_ctrl+0x149/0x158 [nvme_core] + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Tested-by: Yi Zhang +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -638,6 +638,9 @@ static void __nvme_rdma_stop_queue(struc + + static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue) + { ++ if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) ++ return; ++ + mutex_lock(&queue->queue_lock); + if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags)) + __nvme_rdma_stop_queue(queue); diff --git a/queue-6.5/nvme-sanitize-metadata-bounce-buffer-for-reads.patch b/queue-6.5/nvme-sanitize-metadata-bounce-buffer-for-reads.patch new file mode 100644 index 00000000000..5ced189bb05 --- /dev/null +++ b/queue-6.5/nvme-sanitize-metadata-bounce-buffer-for-reads.patch @@ -0,0 +1,43 @@ +From 2b32c76e2b0154b98b9322ae7546b8156cd703e6 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Mon, 16 Oct 2023 13:12:47 -0700 +Subject: nvme: sanitize metadata bounce buffer for reads + +From: Keith Busch + +commit 2b32c76e2b0154b98b9322ae7546b8156cd703e6 upstream. + +User can request more metadata bytes than the device will write. Ensure +kernel buffer is initialized so we're not leaking unsanitized memory on +the copy-out. + +Fixes: 0b7f1f26f95a51a ("nvme: use the block layer for userspace passthrough metadata") +Reviewed-by: Jens Axboe +Reviewed-by: Christoph Hellwig +Reviewed-by: Kanchan Joshi +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/ioctl.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -108,9 +108,13 @@ static void *nvme_add_user_metadata(stru + if (!buf) + goto out; + +- ret = -EFAULT; +- if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len)) +- goto out_free_meta; ++ if (req_op(req) == REQ_OP_DRV_OUT) { ++ ret = -EFAULT; ++ if (copy_from_user(buf, ubuf, len)) ++ goto out_free_meta; ++ } else { ++ memset(buf, 0, len); ++ } + + bip = bio_integrity_alloc(bio, GFP_KERNEL, 1); + if (IS_ERR(bip)) { diff --git a/queue-6.5/nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch b/queue-6.5/nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch new file mode 100644 index 00000000000..d6b53eaa8c2 --- /dev/null +++ b/queue-6.5/nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch @@ -0,0 +1,100 @@ +From f965b281fd872b2e18bd82dd97730db9834d0750 Mon Sep 17 00:00:00 2001 +From: Maurizio Lombardi +Date: Tue, 17 Oct 2023 10:28:45 +0200 +Subject: nvmet-auth: complete a request only after freeing the dhchap pointers + +From: Maurizio Lombardi + +commit f965b281fd872b2e18bd82dd97730db9834d0750 upstream. + +It may happen that the work to destroy a queue +(for example nvmet_tcp_release_queue_work()) is started while +an auth-send or auth-receive command is still completing. + +nvmet_sq_destroy() will block, waiting for all the references +to the sq to be dropped, the last reference is then +dropped when nvmet_req_complete() is called. + +When this happens, both nvmet_sq_destroy() and +nvmet_execute_auth_send()/_receive() will free the dhchap pointers by +calling nvmet_auth_sq_free(). +Since there isn't any lock, the two threads may race against each other, +causing double frees and memory corruptions, as reported by KASAN. + +Reproduced by stress blktests nvme/041 nvme/042 nvme/043 + + nvme nvme2: qid 0: authenticated with hash hmac(sha512) dhgroup ffdhe4096 + ================================================================== + BUG: KASAN: double-free in kfree+0xec/0x4b0 + + Call Trace: + + kfree+0xec/0x4b0 + nvmet_auth_sq_free+0xe1/0x160 [nvmet] + nvmet_execute_auth_send+0x482/0x16d0 [nvmet] + process_one_work+0x8e5/0x1510 + + Allocated by task 191846: + __kasan_kmalloc+0x81/0xa0 + nvmet_auth_ctrl_sesskey+0xf6/0x380 [nvmet] + nvmet_auth_reply+0x119/0x990 [nvmet] + + Freed by task 143270: + kfree+0xec/0x4b0 + nvmet_auth_sq_free+0xe1/0x160 [nvmet] + process_one_work+0x8e5/0x1510 + +Fix this bug by calling nvmet_req_complete() only after freeing the +pointers, so we will prevent the race by holding the sq reference. + +V2: remove redundant code + +Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") +Signed-off-by: Maurizio Lombardi +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/fabrics-cmd-auth.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/nvme/target/fabrics-cmd-auth.c ++++ b/drivers/nvme/target/fabrics-cmd-auth.c +@@ -333,19 +333,21 @@ done: + __func__, ctrl->cntlid, req->sq->qid, + status, req->error_loc); + req->cqe->result.u64 = 0; +- nvmet_req_complete(req, status); + if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 && + req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) { + unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120; + + mod_delayed_work(system_wq, &req->sq->auth_expired_work, + auth_expire_secs * HZ); +- return; ++ goto complete; + } + /* Final states, clear up variables */ + nvmet_auth_sq_free(req->sq); + if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) + nvmet_ctrl_fatal_error(ctrl); ++ ++complete: ++ nvmet_req_complete(req, status); + } + + static int nvmet_auth_challenge(struct nvmet_req *req, void *d, int al) +@@ -514,11 +516,12 @@ void nvmet_execute_auth_receive(struct n + kfree(d); + done: + req->cqe->result.u64 = 0; +- nvmet_req_complete(req, status); ++ + if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2) + nvmet_auth_sq_free(req->sq); + else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) { + nvmet_auth_sq_free(req->sq); + nvmet_ctrl_fatal_error(ctrl); + } ++ nvmet_req_complete(req, status); + } diff --git a/queue-6.5/perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch b/queue-6.5/perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch new file mode 100644 index 00000000000..f9644d60694 --- /dev/null +++ b/queue-6.5/perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch @@ -0,0 +1,83 @@ +From 7a48b58eb5ff3798f0480d2da16bf27df9654fc7 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 28 Sep 2023 10:16:05 +0300 +Subject: perf dlfilter: Fix use of addr_location__exit() in dlfilter__object_code() + +From: Adrian Hunter + +commit 7a48b58eb5ff3798f0480d2da16bf27df9654fc7 upstream. + +Stop calling addr_location__exit() when addr_location__init() was not +called. + +Fixes: 0dd5041c9a0e ("perf addr_location: Add init/exit/copy functions") +Cc: stable@vger.kernel.org +Signed-off-by: Adrian Hunter +Acked-by: Namhyung Kim +Link: https://lore.kernel.org/r/20230928071605.17624-1-adrian.hunter@intel.com +Signed-off-by: Namhyung Kim +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/dlfilter.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +--- a/tools/perf/util/dlfilter.c ++++ b/tools/perf/util/dlfilter.c +@@ -280,13 +280,21 @@ static struct perf_event_attr *dlfilter_ + return &d->evsel->core.attr; + } + ++static __s32 code_read(__u64 ip, struct map *map, struct machine *machine, void *buf, __u32 len) ++{ ++ u64 offset = map__map_ip(map, ip); ++ ++ if (ip + len >= map__end(map)) ++ len = map__end(map) - ip; ++ ++ return dso__data_read_offset(map__dso(map), machine, offset, buf, len); ++} ++ + static __s32 dlfilter__object_code(void *ctx, __u64 ip, void *buf, __u32 len) + { + struct dlfilter *d = (struct dlfilter *)ctx; + struct addr_location *al; + struct addr_location a; +- struct map *map; +- u64 offset; + __s32 ret; + + if (!d->ctx_valid) +@@ -296,27 +304,17 @@ static __s32 dlfilter__object_code(void + if (!al) + return -1; + +- map = al->map; +- +- if (map && ip >= map__start(map) && ip < map__end(map) && ++ if (al->map && ip >= map__start(al->map) && ip < map__end(al->map) && + machine__kernel_ip(d->machine, ip) == machine__kernel_ip(d->machine, d->sample->ip)) +- goto have_map; ++ return code_read(ip, al->map, d->machine, buf, len); + + addr_location__init(&a); ++ + thread__find_map_fb(al->thread, d->sample->cpumode, ip, &a); +- if (!a.map) { +- ret = -1; +- goto out; +- } +- +- map = a.map; +-have_map: +- offset = map__map_ip(map, ip); +- if (ip + len >= map__end(map)) +- len = map__end(map) - ip; +- ret = dso__data_read_offset(map__dso(map), d->machine, offset, buf, len); +-out: ++ ret = a.map ? code_read(ip, a.map, d->machine, buf, len) : -1; ++ + addr_location__exit(&a); ++ + return ret; + } + diff --git a/queue-6.5/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch b/queue-6.5/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch new file mode 100644 index 00000000000..1629112b9f5 --- /dev/null +++ b/queue-6.5/pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch @@ -0,0 +1,123 @@ +From c8befdc411e5fd1bf95a13e8744c8ca79b412bee Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 13 Oct 2023 16:57:05 +0200 +Subject: pinctrl: qcom: lpass-lpi: fix concurrent register updates + +From: Krzysztof Kozlowski + +commit c8befdc411e5fd1bf95a13e8744c8ca79b412bee upstream. + +The Qualcomm LPASS LPI pin controller driver uses one lock for guarding +Read-Modify-Write code for slew rate registers. However the pin +configuration and muxing registers have exactly the same RMW code but +are not protected. + +Pin controller framework does not provide locking here, thus it is +possible to trigger simultaneous change of pin configuration registers +resulting in non-atomic changes. + +Protect from concurrent access by re-using the same lock used to cover +the slew rate register. Using the same lock instead of adding second +one will make more sense, once we add support for newer Qualcomm SoC, +where slew rate is configured in the same register as pin +configuration/muxing. + +Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") +Cc: stable@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231013145705.219954-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -31,7 +31,8 @@ struct lpi_pinctrl { + char __iomem *tlmm_base; + char __iomem *slew_base; + struct clk_bulk_data clks[MAX_LPI_NUM_CLKS]; +- struct mutex slew_access_lock; ++ /* Protects from concurrent register updates */ ++ struct mutex lock; + DECLARE_BITMAP(ever_gpio, MAX_NR_GPIO); + const struct lpi_pinctrl_variant_data *data; + }; +@@ -102,6 +103,7 @@ static int lpi_gpio_set_mux(struct pinct + if (WARN_ON(i == g->nfuncs)) + return -EINVAL; + ++ mutex_lock(&pctrl->lock); + val = lpi_gpio_read(pctrl, pin, LPI_GPIO_CFG_REG); + + /* +@@ -127,6 +129,7 @@ static int lpi_gpio_set_mux(struct pinct + + u32p_replace_bits(&val, i, LPI_GPIO_FUNCTION_MASK); + lpi_gpio_write(pctrl, pin, LPI_GPIO_CFG_REG, val); ++ mutex_unlock(&pctrl->lock); + + return 0; + } +@@ -232,14 +235,14 @@ static int lpi_config_set(struct pinctrl + if (slew_offset == LPI_NO_SLEW) + break; + +- mutex_lock(&pctrl->slew_access_lock); ++ mutex_lock(&pctrl->lock); + + sval = ioread32(pctrl->slew_base + LPI_SLEW_RATE_CTL_REG); + sval &= ~(LPI_SLEW_RATE_MASK << slew_offset); + sval |= arg << slew_offset; + iowrite32(sval, pctrl->slew_base + LPI_SLEW_RATE_CTL_REG); + +- mutex_unlock(&pctrl->slew_access_lock); ++ mutex_unlock(&pctrl->lock); + break; + default: + return -EINVAL; +@@ -255,6 +258,7 @@ static int lpi_config_set(struct pinctrl + lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val); + } + ++ mutex_lock(&pctrl->lock); + val = lpi_gpio_read(pctrl, group, LPI_GPIO_CFG_REG); + + u32p_replace_bits(&val, pullup, LPI_GPIO_PULL_MASK); +@@ -263,6 +267,7 @@ static int lpi_config_set(struct pinctrl + u32p_replace_bits(&val, output_enabled, LPI_GPIO_OE_MASK); + + lpi_gpio_write(pctrl, group, LPI_GPIO_CFG_REG, val); ++ mutex_unlock(&pctrl->lock); + + return 0; + } +@@ -464,7 +469,7 @@ int lpi_pinctrl_probe(struct platform_de + pctrl->chip.label = dev_name(dev); + pctrl->chip.can_sleep = false; + +- mutex_init(&pctrl->slew_access_lock); ++ mutex_init(&pctrl->lock); + + pctrl->ctrl = devm_pinctrl_register(dev, &pctrl->desc, pctrl); + if (IS_ERR(pctrl->ctrl)) { +@@ -486,7 +491,7 @@ int lpi_pinctrl_probe(struct platform_de + return 0; + + err_pinctrl: +- mutex_destroy(&pctrl->slew_access_lock); ++ mutex_destroy(&pctrl->lock); + clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks); + + return ret; +@@ -498,7 +503,7 @@ int lpi_pinctrl_remove(struct platform_d + struct lpi_pinctrl *pctrl = platform_get_drvdata(pdev); + int i; + +- mutex_destroy(&pctrl->slew_access_lock); ++ mutex_destroy(&pctrl->lock); + clk_bulk_disable_unprepare(MAX_LPI_NUM_CLKS, pctrl->clks); + + for (i = 0; i < pctrl->data->npins; i++) diff --git a/queue-6.5/pnfs-fix-a-hang-in-nfs4_evict_inode.patch b/queue-6.5/pnfs-fix-a-hang-in-nfs4_evict_inode.patch new file mode 100644 index 00000000000..da010031806 --- /dev/null +++ b/queue-6.5/pnfs-fix-a-hang-in-nfs4_evict_inode.patch @@ -0,0 +1,84 @@ +From f63955721a8020e979b99cc417dcb6da3106aa24 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sun, 8 Oct 2023 14:20:19 -0400 +Subject: pNFS: Fix a hang in nfs4_evict_inode() + +From: Trond Myklebust + +commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream. + +We are not allowed to call pnfs_mark_matching_lsegs_return() without +also holding a reference to the layout header, since doing so could lead +to the reference count going to zero when we call +pnfs_layout_remove_lseg(). This again can lead to a hang when we get to +nfs4_evict_inode() and are unable to clear the layout pointer. + +pnfs_layout_return_unused_byserver() is guilty of this behaviour, and +has been seen to trigger the refcount warning prior to a hang. + +Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2634,31 +2634,44 @@ pnfs_should_return_unused_layout(struct + return mode == 0; + } + +-static int +-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data) ++static int pnfs_layout_return_unused_byserver(struct nfs_server *server, ++ void *data) + { + const struct pnfs_layout_range *range = data; ++ const struct cred *cred; + struct pnfs_layout_hdr *lo; + struct inode *inode; ++ nfs4_stateid stateid; ++ enum pnfs_iomode iomode; ++ + restart: + rcu_read_lock(); + list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) { +- if (!pnfs_layout_can_be_returned(lo) || ++ inode = lo->plh_inode; ++ if (!inode || !pnfs_layout_can_be_returned(lo) || + test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) + continue; +- inode = lo->plh_inode; + spin_lock(&inode->i_lock); +- if (!pnfs_should_return_unused_layout(lo, range)) { ++ if (!lo->plh_inode || ++ !pnfs_should_return_unused_layout(lo, range)) { + spin_unlock(&inode->i_lock); + continue; + } ++ pnfs_get_layout_hdr(lo); ++ pnfs_set_plh_return_info(lo, range->iomode, 0); ++ if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, ++ range, 0) != 0 || ++ !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) { ++ spin_unlock(&inode->i_lock); ++ rcu_read_unlock(); ++ pnfs_put_layout_hdr(lo); ++ cond_resched(); ++ goto restart; ++ } + spin_unlock(&inode->i_lock); +- inode = pnfs_grab_inode_layout_hdr(lo); +- if (!inode) +- continue; + rcu_read_unlock(); +- pnfs_mark_layout_for_return(inode, range); +- iput(inode); ++ pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false); ++ pnfs_put_layout_hdr(lo); + cond_resched(); + goto restart; + } diff --git a/queue-6.5/pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch b/queue-6.5/pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch new file mode 100644 index 00000000000..b79966876c4 --- /dev/null +++ b/queue-6.5/pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch @@ -0,0 +1,54 @@ +From e1c6cfbb3bd1377e2ddcbe06cf8fb1ec323ea7d3 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sun, 8 Oct 2023 14:28:46 -0400 +Subject: pNFS/flexfiles: Check the layout validity in ff_layout_mirror_prepare_stats + +From: Trond Myklebust + +commit e1c6cfbb3bd1377e2ddcbe06cf8fb1ec323ea7d3 upstream. + +Ensure that we check the layout pointer and validity after dereferencing +it in ff_layout_mirror_prepare_stats. + +Fixes: 08e2e5bc6c9a ("pNFS/flexfiles: Clean up layoutstats") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -2520,9 +2520,9 @@ ff_layout_mirror_prepare_stats(struct pn + return i; + } + +-static int +-ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args) ++static int ff_layout_prepare_layoutstats(struct nfs42_layoutstat_args *args) + { ++ struct pnfs_layout_hdr *lo; + struct nfs4_flexfile_layout *ff_layout; + const int dev_count = PNFS_LAYOUTSTATS_MAXDEV; + +@@ -2533,11 +2533,14 @@ ff_layout_prepare_layoutstats(struct nfs + return -ENOMEM; + + spin_lock(&args->inode->i_lock); +- ff_layout = FF_LAYOUT_FROM_HDR(NFS_I(args->inode)->layout); +- args->num_dev = ff_layout_mirror_prepare_stats(&ff_layout->generic_hdr, +- &args->devinfo[0], +- dev_count, +- NFS4_FF_OP_LAYOUTSTATS); ++ lo = NFS_I(args->inode)->layout; ++ if (lo && pnfs_layout_is_valid(lo)) { ++ ff_layout = FF_LAYOUT_FROM_HDR(lo); ++ args->num_dev = ff_layout_mirror_prepare_stats( ++ &ff_layout->generic_hdr, &args->devinfo[0], dev_count, ++ NFS4_FF_OP_LAYOUTSTATS); ++ } else ++ args->num_dev = 0; + spin_unlock(&args->inode->i_lock); + if (!args->num_dev) { + kfree(args->devinfo); diff --git a/queue-6.5/revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch b/queue-6.5/revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch new file mode 100644 index 00000000000..3249cb56c23 --- /dev/null +++ b/queue-6.5/revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch @@ -0,0 +1,87 @@ +From 610b5d219d1ccac8064556310cc0e62e3c202389 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 17 Oct 2023 14:13:53 +0200 +Subject: Revert "accel/ivpu: Use cached buffers for FW loading" + +From: Stanislaw Gruszka + +commit 610b5d219d1ccac8064556310cc0e62e3c202389 upstream. + +This reverts commit 645d694559cab36fe6a57c717efcfa27d9321396. + +The commit cause issues with memory access from the device side. +Switch back to write-combined memory mappings until the issues +will be properly addressed. + +Add extra wmb() needed when boot_params->save_restore_ret_address() is +modified. + +Reviewed-by: Karol Wachowski +Signed-off-by: Stanislaw Gruszka +Link: https://patchwork.freedesktop.org/patch/msgid/20231017121353.532466-1-stanislaw.gruszka@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accel/ivpu/ivpu_fw.c | 9 ++++----- + drivers/accel/ivpu/ivpu_gem.h | 5 ----- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/drivers/accel/ivpu/ivpu_fw.c ++++ b/drivers/accel/ivpu/ivpu_fw.c +@@ -195,8 +195,7 @@ static int ivpu_fw_mem_init(struct ivpu_ + if (ret) + return ret; + +- fw->mem = ivpu_bo_alloc_internal(vdev, fw->runtime_addr, fw->runtime_size, +- DRM_IVPU_BO_CACHED | DRM_IVPU_BO_NOSNOOP); ++ fw->mem = ivpu_bo_alloc_internal(vdev, fw->runtime_addr, fw->runtime_size, DRM_IVPU_BO_WC); + if (!fw->mem) { + ivpu_err(vdev, "Failed to allocate firmware runtime memory\n"); + return -ENOMEM; +@@ -273,7 +272,7 @@ int ivpu_fw_load(struct ivpu_device *vde + memset(start, 0, size); + } + +- clflush_cache_range(fw->mem->kvaddr, fw->mem->base.size); ++ wmb(); /* Flush WC buffers after writing fw->mem */ + + return 0; + } +@@ -375,7 +374,7 @@ void ivpu_fw_boot_params_setup(struct iv + if (!ivpu_fw_is_cold_boot(vdev)) { + boot_params->save_restore_ret_address = 0; + vdev->pm->is_warmboot = true; +- clflush_cache_range(vdev->fw->mem->kvaddr, SZ_4K); ++ wmb(); /* Flush WC buffers after writing save_restore_ret_address */ + return; + } + +@@ -430,7 +429,7 @@ void ivpu_fw_boot_params_setup(struct iv + boot_params->punit_telemetry_sram_size = ivpu_hw_reg_telemetry_size_get(vdev); + boot_params->vpu_telemetry_enable = ivpu_hw_reg_telemetry_enable_get(vdev); + +- clflush_cache_range(vdev->fw->mem->kvaddr, SZ_4K); ++ wmb(); /* Flush WC buffers after writing bootparams */ + + ivpu_fw_boot_params_print(vdev, boot_params); + } +--- a/drivers/accel/ivpu/ivpu_gem.h ++++ b/drivers/accel/ivpu/ivpu_gem.h +@@ -8,8 +8,6 @@ + #include + #include + +-#define DRM_IVPU_BO_NOSNOOP 0x10000000 +- + struct dma_buf; + struct ivpu_bo_ops; + struct ivpu_file_priv; +@@ -85,9 +83,6 @@ static inline u32 ivpu_bo_cache_mode(str + + static inline bool ivpu_bo_is_snooped(struct ivpu_bo *bo) + { +- if (bo->flags & DRM_IVPU_BO_NOSNOOP) +- return false; +- + return ivpu_bo_cache_mode(bo) == DRM_IVPU_BO_CACHED; + } + diff --git a/queue-6.5/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch b/queue-6.5/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch new file mode 100644 index 00000000000..ae890810517 --- /dev/null +++ b/queue-6.5/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch @@ -0,0 +1,77 @@ +From 62140a1e4dec4594d5d1e1d353747bf2ef434e8b Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 17 Oct 2023 17:18:06 +0300 +Subject: Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" + +From: Andy Shevchenko + +commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream. + +The commit breaks MMC enumeration on the Intel Merrifield +plaform. + +Before: +[ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA +[ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA +[ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA +[ 36.706399] mmc0: new DDR MMC card at address 0001 +[ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001 +[ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB +[ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 + +After: +[ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA +[ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA +[ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA +[ 36.720627] mmc1: new DDR MMC card at address 0001 +[ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001 +[ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB +[ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 + +This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/core.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1012,20 +1012,17 @@ static int add_setting(struct pinctrl *p + + static struct pinctrl *find_pinctrl(struct device *dev) + { +- struct pinctrl *entry, *p = NULL; ++ struct pinctrl *p; + + mutex_lock(&pinctrl_list_mutex); +- +- list_for_each_entry(entry, &pinctrl_list, node) { +- if (entry->dev == dev) { +- p = entry; +- kref_get(&p->users); +- break; ++ list_for_each_entry(p, &pinctrl_list, node) ++ if (p->dev == dev) { ++ mutex_unlock(&pinctrl_list_mutex); ++ return p; + } +- } + + mutex_unlock(&pinctrl_list_mutex); +- return p; ++ return NULL; + } + + static void pinctrl_free(struct pinctrl *p, bool inlist); +@@ -1133,6 +1130,7 @@ struct pinctrl *pinctrl_get(struct devic + p = find_pinctrl(dev); + if (p) { + dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n"); ++ kref_get(&p->users); + return p; + } + diff --git a/queue-6.5/series b/queue-6.5/series index e0f11f02bce..b66897428af 100644 --- a/queue-6.5/series +++ b/queue-6.5/series @@ -165,3 +165,33 @@ netfilter-nf_tables-revert-do-not-remove-elements-if.patch tcp_bpf-properly-release-resources-on-error-paths.patch net-store-netdevs-in-an-xarray.patch net-move-altnames-together-with-the-netdevice.patch +mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch +mtd-rawnand-pl353-ensure-program-page-operations-are-successful.patch +mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch +mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch +mtd-rawnand-ensure-the-nand-chip-supports-cached-reads.patch +mtd-spinand-micron-correct-bitmask-for-ecc-status.patch +mtd-physmap-core-restore-map_rom-fallback.patch +dt-bindings-mmc-sdhci-msm-correct-minimum-number-of-clocks.patch +mmc-sdhci-pci-gli-fix-lpm-negotiation-so-x86-s0ix-socs-can-suspend.patch +mmc-mtk-sd-use-readl_poll_timeout_atomic-in-msdc_reset_hw.patch +mmc-core-fix-error-propagation-for-some-ioctl-commands.patch +mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch +mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch +pinctrl-qcom-lpass-lpi-fix-concurrent-register-updates.patch +revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch +pnfs-fix-a-hang-in-nfs4_evict_inode.patch +pnfs-flexfiles-check-the-layout-validity-in-ff_layout_mirror_prepare_stats.patch +nfsv4.1-fixup-use-exchgid4_flag_use_pnfs_ds-for-ds-server.patch +acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch +acpi-bus-move-acpi_arm_init-to-the-place-of-after-acpi_ghes_init.patch +perf-dlfilter-fix-use-of-addr_location__exit-in-dlfilter__object_code.patch +revert-accel-ivpu-use-cached-buffers-for-fw-loading.patch +fanotify-limit-reporting-of-event-with-non-decodeable-file-handles.patch +nfs-fix-potential-oops-in-nfs_inode_remove_request.patch +nfs42-client-needs-to-strip-file-mode-s-suid-sgid-bit-after-allocate-op.patch +nvme-sanitize-metadata-bounce-buffer-for-reads.patch +nvme-pci-add-bogus_nid-for-intel-0a54-device.patch +nvme-auth-use-chap-s2-to-indicate-bidirectional-authentication.patch +nvmet-auth-complete-a-request-only-after-freeing-the-dhchap-pointers.patch +nvme-rdma-do-not-try-to-stop-unallocated-queues.patch