From 27eecc7e6cca16f69d0d649926ca162d131ee478 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 1 Jul 2024 14:40:20 +0200 Subject: [PATCH] 6.9-stable patches added patches: kasan-fix-bad-call-to-unpoison_slab_object.patch mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch mm-memory-don-t-require-head-page-for-do_set_pmd.patch mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch mmc-sdhci-do-not-invert-write-protect-twice.patch mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch --- ...fix-bad-call-to-unpoison_slab_object.patch | 42 ++++ ...-reference-in-purge_fragmented_block.patch | 205 ++++++++++++++++ ...n-t-require-head-page-for-do_set_pmd.patch | 48 ++++ ...eck-r1_status-for-erase-trim-discard.patch | 94 ++++++++ ...ci-do-not-invert-write-protect-twice.patch | 90 ++++++++ ...lock-spinlock-around-mmc_gpio_get_ro.patch | 53 +++++ ...vert-pcibios_-return-codes-to-errnos.patch | 74 ++++++ ...vert-pcibios_-return-codes-to-errnos.patch | 218 ++++++++++++++++++ ...e-incorrect-assertion-in-nfs_swap_rw.patch | 52 +++++ ...-to-insufficient-transaction-credits.patch | 141 +++++++++++ ...spmi-gpio-drop-broken-pm8008-support.patch | 46 ++++ ...i-lantiq-restore-reset-gpio-polarity.patch | 52 +++++ ...-mmc-moxart-mmc-use-sg_miter-for-pio.patch | 188 +++++++++++++++ queue-6.9/series | 13 ++ 14 files changed, 1316 insertions(+) create mode 100644 queue-6.9/kasan-fix-bad-call-to-unpoison_slab_object.patch create mode 100644 queue-6.9/mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch create mode 100644 queue-6.9/mm-memory-don-t-require-head-page-for-do_set_pmd.patch create mode 100644 queue-6.9/mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch create mode 100644 queue-6.9/mmc-sdhci-do-not-invert-write-protect-twice.patch create mode 100644 queue-6.9/mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch create mode 100644 queue-6.9/mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch create mode 100644 queue-6.9/mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch create mode 100644 queue-6.9/nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch create mode 100644 queue-6.9/ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch create mode 100644 queue-6.9/pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch create mode 100644 queue-6.9/revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch create mode 100644 queue-6.9/revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch diff --git a/queue-6.9/kasan-fix-bad-call-to-unpoison_slab_object.patch b/queue-6.9/kasan-fix-bad-call-to-unpoison_slab_object.patch new file mode 100644 index 00000000000..ad3dd4d9c2f --- /dev/null +++ b/queue-6.9/kasan-fix-bad-call-to-unpoison_slab_object.patch @@ -0,0 +1,42 @@ +From 1c61990d3762a020817daa353da0a0af6794140b Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Fri, 14 Jun 2024 16:32:38 +0200 +Subject: kasan: fix bad call to unpoison_slab_object + +From: Andrey Konovalov + +commit 1c61990d3762a020817daa353da0a0af6794140b upstream. + +Commit 29d7355a9d05 ("kasan: save alloc stack traces for mempool") messed +up one of the calls to unpoison_slab_object: the last two arguments are +supposed to be GFP flags and whether to init the object memory. + +Fix the call. + +Without this fix, __kasan_mempool_unpoison_object provides the object's +size as GFP flags to unpoison_slab_object, which can cause LOCKDEP reports +(and probably other issues). + +Link: https://lkml.kernel.org/r/20240614143238.60323-1-andrey.konovalov@linux.dev +Fixes: 29d7355a9d05 ("kasan: save alloc stack traces for mempool") +Signed-off-by: Andrey Konovalov +Reported-by: Brad Spengler +Acked-by: Marco Elver +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/kasan/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/kasan/common.c ++++ b/mm/kasan/common.c +@@ -532,7 +532,7 @@ void __kasan_mempool_unpoison_object(voi + return; + + /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ +- unpoison_slab_object(slab->slab_cache, ptr, size, flags); ++ unpoison_slab_object(slab->slab_cache, ptr, flags, false); + + /* Poison the redzone and save alloc info for kmalloc() allocations. */ + if (is_kmalloc_cache(slab->slab_cache)) diff --git a/queue-6.9/mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch b/queue-6.9/mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch new file mode 100644 index 00000000000..f964282769f --- /dev/null +++ b/queue-6.9/mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch @@ -0,0 +1,205 @@ +From 8c61291fd8500e3b35c7ec0c781b273d8cc96cde Mon Sep 17 00:00:00 2001 +From: Zhaoyang Huang +Date: Fri, 7 Jun 2024 10:31:16 +0800 +Subject: mm: fix incorrect vbq reference in purge_fragmented_block +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhaoyang Huang + +commit 8c61291fd8500e3b35c7ec0c781b273d8cc96cde upstream. + +xa_for_each() in _vm_unmap_aliases() loops through all vbs. However, +since commit 062eacf57ad9 ("mm: vmalloc: remove a global vmap_blocks +xarray") the vb from xarray may not be on the corresponding CPU +vmap_block_queue. Consequently, purge_fragmented_block() might use the +wrong vbq->lock to protect the free list, leading to vbq->free breakage. + +Incorrect lock protection can exhaust all vmalloc space as follows: +CPU0 CPU1 ++--------------------------------------------+ +| +--------------------+ +-----+ | ++--> | |---->| |------+ + | CPU1:vbq free_list | | vb1 | ++--- | |<----| |<-----+ +| +--------------------+ +-----+ | ++--------------------------------------------+ + +_vm_unmap_aliases() vb_alloc() + new_vmap_block() +xa_for_each(&vbq->vmap_blocks, idx, vb) +--> vb in CPU1:vbq->freelist + +purge_fragmented_block(vb) +spin_lock(&vbq->lock) spin_lock(&vbq->lock) +--> use CPU0:vbq->lock --> use CPU1:vbq->lock + +list_del_rcu(&vb->free_list) list_add_tail_rcu(&vb->free_list, &vbq->free) + __list_del(vb->prev, vb->next) + next->prev = prev + +--------------------+ + | | + | CPU1:vbq free_list | ++---| |<--+ +| +--------------------+ | ++----------------------------+ + __list_add(new, head->prev, head) ++--------------------------------------------+ +| +--------------------+ +-----+ | ++--> | |---->| |------+ + | CPU1:vbq free_list | | vb2 | ++--- | |<----| |<-----+ +| +--------------------+ +-----+ | ++--------------------------------------------+ + + prev->next = next ++--------------------------------------------+ +|----------------------------+ | +| +--------------------+ | +-----+ | ++--> | |--+ | |------+ + | CPU1:vbq free_list | | vb2 | ++--- | |<----| |<-----+ +| +--------------------+ +-----+ | ++--------------------------------------------+ +Here’s a list breakdown. All vbs, which were to be added to +‘prev’, cannot be used by list_for_each_entry_rcu(vb, &vbq->free, +free_list) in vb_alloc(). Thus, vmalloc space is exhausted. + +This issue affects both erofs and f2fs, the stacktrace is as follows: +erofs: +[] __switch_to+0x174 +[] __schedule+0x624 +[] schedule+0x7c +[] schedule_preempt_disabled+0x24 +[] __mutex_lock+0x374 +[] __mutex_lock_slowpath+0x14 +[] mutex_lock+0x24 +[] reclaim_and_purge_vmap_areas+0x44 +[] alloc_vmap_area+0x2e0 +[] vm_map_ram+0x1b0 +[] z_erofs_lz4_decompress+0x278 +[] z_erofs_decompress_queue+0x650 +[] z_erofs_runqueue+0x7f4 +[] z_erofs_read_folio+0x104 +[] filemap_read_folio+0x6c +[] filemap_fault+0x300 +[] __do_fault+0xc8 +[] handle_mm_fault+0xb38 +[] do_page_fault+0x288 +[] do_translation_fault[jt]+0x40 +[] do_mem_abort+0x58 +[] el0_ia+0x70 +[] el0t_64_sync_handler[jt]+0xb0 +[] ret_to_user[jt]+0x0 + +f2fs: +[] __switch_to+0x174 +[] __schedule+0x624 +[] schedule+0x7c +[] schedule_preempt_disabled+0x24 +[] __mutex_lock+0x374 +[] __mutex_lock_slowpath+0x14 +[] mutex_lock+0x24 +[] reclaim_and_purge_vmap_areas+0x44 +[] alloc_vmap_area+0x2e0 +[] vm_map_ram+0x1b0 +[] f2fs_prepare_decomp_mem+0x144 +[] f2fs_alloc_dic+0x264 +[] f2fs_read_multi_pages+0x428 +[] f2fs_mpage_readpages+0x314 +[] f2fs_readahead+0x50 +[] read_pages+0x80 +[] page_cache_ra_unbounded+0x1a0 +[] page_cache_ra_order+0x274 +[] do_sync_mmap_readahead+0x11c +[] filemap_fault+0x1a0 +[] f2fs_filemap_fault+0x28 +[] __do_fault+0xc8 +[] handle_mm_fault+0xb38 +[] do_page_fault+0x288 +[] do_translation_fault[jt]+0x40 +[] do_mem_abort+0x58 +[] el0_ia+0x70 +[] el0t_64_sync_handler[jt]+0xb0 +[] ret_to_user[jt]+0x0 + +To fix this, introducee cpu within vmap_block to record which this vb +belongs to. + +Link: https://lkml.kernel.org/r/20240614021352.1822225-1-zhaoyang.huang@unisoc.com +Link: https://lkml.kernel.org/r/20240607023116.1720640-1-zhaoyang.huang@unisoc.com +Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") +Signed-off-by: Zhaoyang Huang +Suggested-by: Hailong.Liu +Reviewed-by: Uladzislau Rezki (Sony) +Cc: Baoquan He +Cc: Christoph Hellwig +Cc: Lorenzo Stoakes +Cc: Thomas Gleixner +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/vmalloc.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -2474,6 +2474,7 @@ struct vmap_block { + struct list_head free_list; + struct rcu_head rcu_head; + struct list_head purge; ++ unsigned int cpu; + }; + + /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ +@@ -2601,8 +2602,15 @@ static void *new_vmap_block(unsigned int + free_vmap_area(va); + return ERR_PTR(err); + } +- +- vbq = raw_cpu_ptr(&vmap_block_queue); ++ /* ++ * list_add_tail_rcu could happened in another core ++ * rather than vb->cpu due to task migration, which ++ * is safe as list_add_tail_rcu will ensure the list's ++ * integrity together with list_for_each_rcu from read ++ * side. ++ */ ++ vb->cpu = raw_smp_processor_id(); ++ vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); + spin_lock(&vbq->lock); + list_add_tail_rcu(&vb->free_list, &vbq->free); + spin_unlock(&vbq->lock); +@@ -2630,9 +2638,10 @@ static void free_vmap_block(struct vmap_ + } + + static bool purge_fragmented_block(struct vmap_block *vb, +- struct vmap_block_queue *vbq, struct list_head *purge_list, +- bool force_purge) ++ struct list_head *purge_list, bool force_purge) + { ++ struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); ++ + if (vb->free + vb->dirty != VMAP_BBMAP_BITS || + vb->dirty == VMAP_BBMAP_BITS) + return false; +@@ -2680,7 +2689,7 @@ static void purge_fragmented_blocks(int + continue; + + spin_lock(&vb->lock); +- purge_fragmented_block(vb, vbq, &purge, true); ++ purge_fragmented_block(vb, &purge, true); + spin_unlock(&vb->lock); + } + rcu_read_unlock(); +@@ -2817,7 +2826,7 @@ static void _vm_unmap_aliases(unsigned l + * not purgeable, check whether there is dirty + * space to be flushed. + */ +- if (!purge_fragmented_block(vb, vbq, &purge_list, false) && ++ if (!purge_fragmented_block(vb, &purge_list, false) && + vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { + unsigned long va_start = vb->va->va_start; + unsigned long s, e; diff --git a/queue-6.9/mm-memory-don-t-require-head-page-for-do_set_pmd.patch b/queue-6.9/mm-memory-don-t-require-head-page-for-do_set_pmd.patch new file mode 100644 index 00000000000..5161e61fd44 --- /dev/null +++ b/queue-6.9/mm-memory-don-t-require-head-page-for-do_set_pmd.patch @@ -0,0 +1,48 @@ +From ab1ffc86cb5bec1c92387b9811d9036512f8f4eb Mon Sep 17 00:00:00 2001 +From: Andrew Bresticker +Date: Tue, 11 Jun 2024 08:32:16 -0700 +Subject: mm/memory: don't require head page for do_set_pmd() + +From: Andrew Bresticker + +commit ab1ffc86cb5bec1c92387b9811d9036512f8f4eb upstream. + +The requirement that the head page be passed to do_set_pmd() was added in +commit ef37b2ea08ac ("mm/memory: page_add_file_rmap() -> +folio_add_file_rmap_[pte|pmd]()") and prevents pmd-mapping in the +finish_fault() and filemap_map_pages() paths if the page to be inserted is +anything but the head page for an otherwise suitable vma and pmd-sized +page. + +Matthew said: + +: We're going to stop using PMDs to map large folios unless the fault is +: within the first 4KiB of the PMD. No idea how many workloads that +: affects, but it only needs to be backported as far as v6.8, so we may +: as well backport it. + +Link: https://lkml.kernel.org/r/20240611153216.2794513-1-abrestic@rivosinc.com +Fixes: ef37b2ea08ac ("mm/memory: page_add_file_rmap() -> folio_add_file_rmap_[pte|pmd]()") +Signed-off-by: Andrew Bresticker +Acked-by: David Hildenbrand +Acked-by: Hugh Dickins +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -4583,8 +4583,9 @@ vm_fault_t do_set_pmd(struct vm_fault *v + if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER)) + return ret; + +- if (page != &folio->page || folio_order(folio) != HPAGE_PMD_ORDER) ++ if (folio_order(folio) != HPAGE_PMD_ORDER) + return ret; ++ page = &folio->page; + + /* + * Just backoff if any subpage of a THP is corrupted otherwise diff --git a/queue-6.9/mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch b/queue-6.9/mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch new file mode 100644 index 00000000000..afa4bfa66bf --- /dev/null +++ b/queue-6.9/mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch @@ -0,0 +1,94 @@ +From d77dc388cd61dfdafe30b98025fa827498378199 Mon Sep 17 00:00:00 2001 +From: Kamal Dasu +Date: Mon, 3 Jun 2024 18:08:34 -0400 +Subject: mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard + +From: Kamal Dasu + +commit d77dc388cd61dfdafe30b98025fa827498378199 upstream. + +When erase/trim/discard completion was converted to mmc_poll_for_busy(), +optional support to poll with the host_ops->card_busy() callback was also +added. + +The common sdhci's ->card_busy() turns out not to be working as expected +for the sdhci-brcmstb variant, as it keeps returning busy beyond the card's +busy period. In particular, this leads to the below splat for +mmc_do_erase() when running a discard (BLKSECDISCARD) operation during +mkfs.f2fs: + + Info: [/dev/mmcblk1p9] Discarding device + [ 39.597258] sysrq: Show Blocked State + [ 39.601183] task:mkfs.f2fs state:D stack:0 pid:1561 tgid:1561 ppid:1542 flags:0x0000000d + [ 39.610609] Call trace: + [ 39.613098] __switch_to+0xd8/0xf4 + [ 39.616582] __schedule+0x440/0x4f4 + [ 39.620137] schedule+0x2c/0x48 + [ 39.623341] schedule_hrtimeout_range_clock+0xe0/0x114 + [ 39.628562] schedule_hrtimeout_range+0x10/0x18 + [ 39.633169] usleep_range_state+0x5c/0x90 + [ 39.637253] __mmc_poll_for_busy+0xec/0x128 + [ 39.641514] mmc_poll_for_busy+0x48/0x70 + [ 39.645511] mmc_do_erase+0x1ec/0x210 + [ 39.649237] mmc_erase+0x1b4/0x1d4 + [ 39.652701] mmc_blk_mq_issue_rq+0x35c/0x6ac + [ 39.657037] mmc_mq_queue_rq+0x18c/0x214 + [ 39.661022] blk_mq_dispatch_rq_list+0x3a8/0x528 + [ 39.665722] __blk_mq_sched_dispatch_requests+0x3a0/0x4ac + [ 39.671198] blk_mq_sched_dispatch_requests+0x28/0x5c + [ 39.676322] blk_mq_run_hw_queue+0x11c/0x12c + [ 39.680668] blk_mq_flush_plug_list+0x200/0x33c + [ 39.685278] blk_add_rq_to_plug+0x68/0xd8 + [ 39.689365] blk_mq_submit_bio+0x3a4/0x458 + [ 39.693539] __submit_bio+0x1c/0x80 + [ 39.697096] submit_bio_noacct_nocheck+0x94/0x174 + [ 39.701875] submit_bio_noacct+0x1b0/0x22c + [ 39.706042] submit_bio+0xac/0xe8 + [ 39.709424] blk_next_bio+0x4c/0x5c + [ 39.712973] blkdev_issue_secure_erase+0x118/0x170 + [ 39.717835] blkdev_common_ioctl+0x374/0x728 + [ 39.722175] blkdev_ioctl+0x8c/0x2b0 + [ 39.725816] vfs_ioctl+0x24/0x40 + [ 39.729117] __arm64_sys_ioctl+0x5c/0x8c + [ 39.733114] invoke_syscall+0x68/0xec + [ 39.736839] el0_svc_common.constprop.0+0x70/0xd8 + [ 39.741609] do_el0_svc+0x18/0x20 + [ 39.744981] el0_svc+0x68/0x94 + [ 39.748107] el0t_64_sync_handler+0x88/0x124 + [ 39.752455] el0t_64_sync+0x168/0x16c + +To fix the problem let's override the host_ops->card_busy() callback by +setting it to NULL, which forces the mmc core to poll with a CMD13 and +checking the R1_STATUS in the mmc_busy_cb() function. + +Signed-off-by: Kamal Dasu +Fixes: 0d84c3e6a5b2 ("mmc: core: Convert to mmc_poll_for_busy() for erase/trim/discard") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240603220834.21989-2-kamal.dasu@broadcom.com +[Ulf: Clarified the commit message] +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-brcmstb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -24,6 +24,7 @@ + #define BRCMSTB_MATCH_FLAGS_NO_64BIT BIT(0) + #define BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT BIT(1) + #define BRCMSTB_MATCH_FLAGS_HAS_CLOCK_GATE BIT(2) ++#define BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY BIT(4) + + #define BRCMSTB_PRIV_FLAGS_HAS_CQE BIT(0) + #define BRCMSTB_PRIV_FLAGS_GATE_CLOCK BIT(1) +@@ -384,6 +385,9 @@ static int sdhci_brcmstb_probe(struct pl + if (match_priv->flags & BRCMSTB_MATCH_FLAGS_BROKEN_TIMEOUT) + host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + ++ if (!(match_priv->flags & BRCMSTB_MATCH_FLAGS_USE_CARD_BUSY)) ++ host->mmc_host_ops.card_busy = NULL; ++ + /* Change the base clock frequency if the DT property exists */ + if (device_property_read_u32(&pdev->dev, "clock-frequency", + &priv->base_freq_hz) != 0) diff --git a/queue-6.9/mmc-sdhci-do-not-invert-write-protect-twice.patch b/queue-6.9/mmc-sdhci-do-not-invert-write-protect-twice.patch new file mode 100644 index 00000000000..334e1cc8cf3 --- /dev/null +++ b/queue-6.9/mmc-sdhci-do-not-invert-write-protect-twice.patch @@ -0,0 +1,90 @@ +From fbd64f902b93fe9658b855b9892ae59ef6ea22b9 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 14 Jun 2024 11:00:49 +0300 +Subject: mmc: sdhci: Do not invert write-protect twice + +From: Adrian Hunter + +commit fbd64f902b93fe9658b855b9892ae59ef6ea22b9 upstream. + +mmc_of_parse() reads device property "wp-inverted" and sets +MMC_CAP2_RO_ACTIVE_HIGH if it is true. MMC_CAP2_RO_ACTIVE_HIGH is used +to invert a write-protect (AKA read-only) GPIO value. + +sdhci_get_property() also reads "wp-inverted" and sets +SDHCI_QUIRK_INVERTED_WRITE_PROTECT which is used to invert the +write-protect value as well but also acts upon a value read out from the +SDHCI_PRESENT_STATE register. + +Many drivers call both mmc_of_parse() and sdhci_get_property(), +so that both MMC_CAP2_RO_ACTIVE_HIGH and +SDHCI_QUIRK_INVERTED_WRITE_PROTECT will be set if the controller has +device property "wp-inverted". + +Amend the logic in sdhci_check_ro() to allow for that possibility, +so that the write-protect value is not inverted twice. + +Also do not invert the value if it is a negative error value. Note that +callers treat an error the same as not-write-protected, so the result is +functionally the same in that case. + +Also do not invert the value if sdhci host operation ->get_ro() is used. +None of the users of that callback set SDHCI_QUIRK_INVERTED_WRITE_PROTECT +directly or indirectly, but two do call mmc_gpio_get_ro(), so leave it to +them to deal with that if they ever set SDHCI_QUIRK_INVERTED_WRITE_PROTECT +in the future. + +Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()") +Signed-off-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240614080051.4005-2-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2515,26 +2515,34 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio); + + static int sdhci_check_ro(struct sdhci_host *host) + { ++ bool allow_invert = false; + unsigned long flags; + int is_readonly; + + spin_lock_irqsave(&host->lock, flags); + +- if (host->flags & SDHCI_DEVICE_DEAD) ++ if (host->flags & SDHCI_DEVICE_DEAD) { + is_readonly = 0; +- else if (host->ops->get_ro) ++ } else if (host->ops->get_ro) { + is_readonly = host->ops->get_ro(host); +- else if (mmc_can_gpio_ro(host->mmc)) ++ } else if (mmc_can_gpio_ro(host->mmc)) { + is_readonly = mmc_gpio_get_ro(host->mmc); +- else ++ /* Do not invert twice */ ++ allow_invert = !(host->mmc->caps2 & MMC_CAP2_RO_ACTIVE_HIGH); ++ } else { + is_readonly = !(sdhci_readl(host, SDHCI_PRESENT_STATE) + & SDHCI_WRITE_PROTECT); ++ allow_invert = true; ++ } + + spin_unlock_irqrestore(&host->lock, flags); + +- /* This quirk needs to be replaced by a callback-function later */ +- return host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT ? +- !is_readonly : is_readonly; ++ if (is_readonly >= 0 && ++ allow_invert && ++ (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT)) ++ is_readonly = !is_readonly; ++ ++ return is_readonly; + } + + #define SAMPLE_COUNT 5 diff --git a/queue-6.9/mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch b/queue-6.9/mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch new file mode 100644 index 00000000000..d134c6818a5 --- /dev/null +++ b/queue-6.9/mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch @@ -0,0 +1,53 @@ +From ab069ce125965a5e282f7b53b86aee76ab32975c Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 14 Jun 2024 11:00:50 +0300 +Subject: mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() + +From: Adrian Hunter + +commit ab069ce125965a5e282f7b53b86aee76ab32975c upstream. + +sdhci_check_ro() can call mmc_gpio_get_ro() while holding the sdhci +host->lock spinlock. That would be a problem if the GPIO access done by +mmc_gpio_get_ro() needed to sleep. + +However, host->lock is not needed anyway. The mmc core ensures that host +operations do not race with each other, and asynchronous callbacks like the +interrupt handler, software timeouts, completion work etc, cannot affect +sdhci_check_ro(). + +So remove the locking. + +Fixes: 6d5cd068ee59 ("mmc: sdhci: use WP GPIO in sdhci_check_ro()") +Signed-off-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240614080051.4005-3-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2516,11 +2516,8 @@ EXPORT_SYMBOL_GPL(sdhci_get_cd_nogpio); + static int sdhci_check_ro(struct sdhci_host *host) + { + bool allow_invert = false; +- unsigned long flags; + int is_readonly; + +- spin_lock_irqsave(&host->lock, flags); +- + if (host->flags & SDHCI_DEVICE_DEAD) { + is_readonly = 0; + } else if (host->ops->get_ro) { +@@ -2535,8 +2532,6 @@ static int sdhci_check_ro(struct sdhci_h + allow_invert = true; + } + +- spin_unlock_irqrestore(&host->lock, flags); +- + if (is_readonly >= 0 && + allow_invert && + (host->quirks & SDHCI_QUIRK_INVERTED_WRITE_PROTECT)) diff --git a/queue-6.9/mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch b/queue-6.9/mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch new file mode 100644 index 00000000000..3fd66cd4baa --- /dev/null +++ b/queue-6.9/mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch @@ -0,0 +1,74 @@ +From ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 27 May 2024 16:24:41 +0300 +Subject: mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit ebc4fc34eae8ddfbef49f2bdaced1bf4167ef80d upstream. + +jmicron_pmos() and sdhci_pci_probe() use pci_{read,write}_config_byte() +that return PCIBIOS_* codes. The return code is then returned as is by +jmicron_probe() and sdhci_pci_probe(). Similarly, the return code is +also returned as is from jmicron_resume(). Both probe and resume +functions should return normal errnos. + +Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal +errno before returning them the fix these issues. + +Fixes: 7582041ff3d4 ("mmc: sdhci-pci: fix simple_return.cocci warnings") +Fixes: 45211e215984 ("sdhci: toggle JMicron PMOS setting") +Cc: stable@vger.kernel.org +Signed-off-by: Ilpo Järvinen +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240527132443.14038-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -1326,7 +1326,7 @@ static int jmicron_pmos(struct sdhci_pci + + ret = pci_read_config_byte(chip->pdev, 0xAE, &scratch); + if (ret) +- return ret; ++ goto fail; + + /* + * Turn PMOS on [bit 0], set over current detection to 2.4 V +@@ -1337,7 +1337,10 @@ static int jmicron_pmos(struct sdhci_pci + else + scratch &= ~0x47; + +- return pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ret = pci_write_config_byte(chip->pdev, 0xAE, scratch); ++ ++fail: ++ return pcibios_err_to_errno(ret); + } + + static int jmicron_probe(struct sdhci_pci_chip *chip) +@@ -2202,7 +2205,7 @@ static int sdhci_pci_probe(struct pci_de + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &slots); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + slots = PCI_SLOT_INFO_SLOTS(slots) + 1; + dev_dbg(&pdev->dev, "found %d slot(s)\n", slots); +@@ -2211,7 +2214,7 @@ static int sdhci_pci_probe(struct pci_de + + ret = pci_read_config_byte(pdev, PCI_SLOT_INFO, &first_bar); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + + first_bar &= PCI_SLOT_INFO_FIRST_BAR_MASK; + diff --git a/queue-6.9/mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch b/queue-6.9/mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch new file mode 100644 index 00000000000..8ee9400278f --- /dev/null +++ b/queue-6.9/mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch @@ -0,0 +1,218 @@ +From a91bf3b3beadbb4f8b3bbc7969fb2ae1615e25c8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 27 May 2024 16:24:42 +0300 +Subject: mmc: sdhci-pci-o2micro: Convert PCIBIOS_* return codes to errnos +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit a91bf3b3beadbb4f8b3bbc7969fb2ae1615e25c8 upstream. + +sdhci_pci_o2_probe() uses pci_read_config_{byte,dword}() that return +PCIBIOS_* codes. The return code is then returned as is but as +sdhci_pci_o2_probe() is probe function chain, it should return normal +errnos. + +Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal +errno before returning them. Add a label for read failure so that the +conversion can be done in one place rather than on all of the return +statements. + +Fixes: 3d757ddbd68c ("mmc: sdhci-pci-o2micro: add Bayhub new chip GG8 support for UHS-I") +Fixes: d599005afde8 ("mmc: sdhci-pci-o2micro: Add missing checks in sdhci_pci_o2_probe") +Fixes: 706adf6bc31c ("mmc: sdhci-pci-o2micro: Add SeaBird SeaEagle SD3 support") +Fixes: 01acf6917aed ("mmc: sdhci-pci: add support of O2Micro/BayHubTech SD hosts") +Fixes: 26daa1ed40c6 ("mmc: sdhci: Disable ADMA on some O2Micro SD/MMC parts.") +Cc: stable@vger.kernel.org +Signed-off-by: Ilpo Järvinen +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240527132443.14038-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-o2micro.c | 41 ++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 19 deletions(-) + +--- a/drivers/mmc/host/sdhci-pci-o2micro.c ++++ b/drivers/mmc/host/sdhci-pci-o2micro.c +@@ -823,7 +823,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -834,7 +834,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_CLKREQ, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x20; + pci_write_config_byte(chip->pdev, O2_SD_CLKREQ, scratch); + +@@ -843,7 +843,7 @@ static int sdhci_pci_o2_probe(struct sdh + */ + ret = pci_read_config_byte(chip->pdev, O2_SD_CAPS, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x01; + pci_write_config_byte(chip->pdev, O2_SD_CAPS, scratch); + pci_write_config_byte(chip->pdev, O2_SD_CAPS, 0x73); +@@ -856,7 +856,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_INF_MOD, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x08; + pci_write_config_byte(chip->pdev, O2_SD_INF_MOD, scratch); + +@@ -864,7 +864,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -875,7 +875,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -886,7 +886,7 @@ static int sdhci_pci_o2_probe(struct sdh + O2_SD_FUNC_REG0, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 = ((scratch_32 & 0xFF000000) >> 24); + + /* Check Whether subId is 0x11 or 0x12 */ +@@ -898,7 +898,7 @@ static int sdhci_pci_o2_probe(struct sdh + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + /* Enable Base Clk setting change */ + scratch_32 |= O2_SD_FREG4_ENABLE_CLK_SET; +@@ -921,7 +921,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLK_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0xFF00); + scratch_32 |= 0x07E0C800; +@@ -931,14 +931,14 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_dword(chip->pdev, + O2_SD_CLKREQ, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= 0x3; + pci_write_config_dword(chip->pdev, O2_SD_CLKREQ, scratch_32); + + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + scratch_32 &= ~(0x1F3F070E); + scratch_32 |= 0x18270106; +@@ -949,7 +949,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_dword(chip->pdev, + O2_SD_CAP_REG2, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 &= ~(0xE0); + pci_write_config_dword(chip->pdev, + O2_SD_CAP_REG2, scratch_32); +@@ -961,7 +961,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -971,7 +971,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); +@@ -979,7 +979,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_dword(chip->pdev, + O2_SD_PLL_SETTING, &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + + if ((scratch_32 & 0xff000000) == 0x01000000) { + scratch_32 &= 0x0000FFFF; +@@ -998,7 +998,7 @@ static int sdhci_pci_o2_probe(struct sdh + O2_SD_FUNC_REG4, + &scratch_32); + if (ret) +- return ret; ++ goto read_fail; + scratch_32 |= (1 << 22); + pci_write_config_dword(chip->pdev, + O2_SD_FUNC_REG4, scratch_32); +@@ -1017,7 +1017,7 @@ static int sdhci_pci_o2_probe(struct sdh + ret = pci_read_config_byte(chip->pdev, + O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; +@@ -1028,7 +1028,7 @@ static int sdhci_pci_o2_probe(struct sdh + /* UnLock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch &= 0x7f; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + +@@ -1057,13 +1057,16 @@ static int sdhci_pci_o2_probe(struct sdh + /* Lock WP */ + ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); + if (ret) +- return ret; ++ goto read_fail; + scratch |= 0x80; + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; + } + + return 0; ++ ++read_fail: ++ return pcibios_err_to_errno(ret); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-6.9/nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch b/queue-6.9/nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch new file mode 100644 index 00000000000..a30f334d461 --- /dev/null +++ b/queue-6.9/nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch @@ -0,0 +1,52 @@ +From 54e7d59841dab977f6cb1183d658b1b82c9f4e94 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Tue, 18 Jun 2024 18:56:47 +1200 +Subject: nfs: drop the incorrect assertion in nfs_swap_rw() + +From: Christoph Hellwig + +commit 54e7d59841dab977f6cb1183d658b1b82c9f4e94 upstream. + +Since commit 2282679fb20b ("mm: submit multipage write for SWP_FS_OPS +swap-space"), we can plug multiple pages then unplug them all together. +That means iov_iter_count(iter) could be way bigger than PAGE_SIZE, it +actually equals the size of iov_iter_npages(iter, INT_MAX). + +Note this issue has nothing to do with large folios as we don't support +THP_SWPOUT to non-block devices. + +[v-songbaohua@oppo.com: figure out the cause and correct the commit message] +Link: https://lkml.kernel.org/r/20240618065647.21791-1-21cnbao@gmail.com +Fixes: 2282679fb20b ("mm: submit multipage write for SWP_FS_OPS swap-space") +Signed-off-by: Christoph Hellwig +Signed-off-by: Barry Song +Closes: https://lore.kernel.org/linux-mm/20240617053201.GA16852@lst.de/ +Reviewed-by: Martin Wege +Cc: NeilBrown +Cc: Anna Schumaker +Cc: Steve French +Cc: Trond Myklebust +Cc: Chuanhua Han +Cc: Ryan Roberts +Cc: Chris Li +Cc: "Huang, Ying" +Cc: Jeff Layton +Cc: Matthew Wilcox +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/direct.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -141,8 +141,6 @@ int nfs_swap_rw(struct kiocb *iocb, stru + { + ssize_t ret; + +- VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); +- + if (iov_iter_rw(iter) == READ) + ret = nfs_file_direct_read(iocb, iter, true); + else diff --git a/queue-6.9/ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch b/queue-6.9/ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch new file mode 100644 index 00000000000..b28144d2d6e --- /dev/null +++ b/queue-6.9/ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch @@ -0,0 +1,141 @@ +From be346c1a6eeb49d8fda827d2a9522124c2f72f36 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Fri, 14 Jun 2024 16:52:43 +0200 +Subject: ocfs2: fix DIO failure due to insufficient transaction credits + +From: Jan Kara + +commit be346c1a6eeb49d8fda827d2a9522124c2f72f36 upstream. + +The code in ocfs2_dio_end_io_write() estimates number of necessary +transaction credits using ocfs2_calc_extend_credits(). This however does +not take into account that the IO could be arbitrarily large and can +contain arbitrary number of extents. + +Extent tree manipulations do often extend the current transaction but not +in all of the cases. For example if we have only single block extents in +the tree, ocfs2_mark_extent_written() will end up calling +ocfs2_replace_extent_rec() all the time and we will never extend the +current transaction and eventually exhaust all the transaction credits if +the IO contains many single block extents. Once that happens a +WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in +jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to +this error. This was actually triggered by one of our customers on a +heavily fragmented OCFS2 filesystem. + +To fix the issue make sure the transaction always has enough credits for +one extent insert before each call of ocfs2_mark_extent_written(). + +Heming Zhao said: + +------ +PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error" + +PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA" + #0 machine_kexec at ffffffff8c069932 + #1 __crash_kexec at ffffffff8c1338fa + #2 panic at ffffffff8c1d69b9 + #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] + #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2] + #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] + #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] + #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] + #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] + #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] +#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] +#11 dio_complete at ffffffff8c2b9fa7 +#12 do_blockdev_direct_IO at ffffffff8c2bc09f +#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] +#14 generic_file_direct_write at ffffffff8c1dcf14 +#15 __generic_file_write_iter at ffffffff8c1dd07b +#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] +#17 aio_write at ffffffff8c2cc72e +#18 kmem_cache_alloc at ffffffff8c248dde +#19 do_io_submit at ffffffff8c2ccada +#20 do_syscall_64 at ffffffff8c004984 +#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba + +Link: https://lkml.kernel.org/r/20240617095543.6971-1-jack@suse.cz +Link: https://lkml.kernel.org/r/20240614145243.8837-1-jack@suse.cz +Fixes: c15471f79506 ("ocfs2: fix sparse file & data ordering issue in direct io") +Signed-off-by: Jan Kara +Reviewed-by: Joseph Qi +Reviewed-by: Heming Zhao +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/aops.c | 5 +++++ + fs/ocfs2/journal.c | 17 +++++++++++++++++ + fs/ocfs2/journal.h | 2 ++ + fs/ocfs2/ocfs2_trace.h | 2 ++ + 4 files changed, 26 insertions(+) + +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2368,6 +2368,11 @@ static int ocfs2_dio_end_io_write(struct + } + + list_for_each_entry(ue, &dwc->dw_zero_list, ue_node) { ++ ret = ocfs2_assure_trans_credits(handle, credits); ++ if (ret < 0) { ++ mlog_errno(ret); ++ break; ++ } + ret = ocfs2_mark_extent_written(inode, &et, handle, + ue->ue_cpos, 1, + ue->ue_phys, +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -446,6 +446,23 @@ bail: + } + + /* ++ * Make sure handle has at least 'nblocks' credits available. If it does not ++ * have that many credits available, we will try to extend the handle to have ++ * enough credits. If that fails, we will restart transaction to have enough ++ * credits. Similar notes regarding data consistency and locking implications ++ * as for ocfs2_extend_trans() apply here. ++ */ ++int ocfs2_assure_trans_credits(handle_t *handle, int nblocks) ++{ ++ int old_nblks = jbd2_handle_buffer_credits(handle); ++ ++ trace_ocfs2_assure_trans_credits(old_nblks); ++ if (old_nblks >= nblocks) ++ return 0; ++ return ocfs2_extend_trans(handle, nblocks - old_nblks); ++} ++ ++/* + * If we have fewer than thresh credits, extend by OCFS2_MAX_TRANS_DATA. + * If that fails, restart the transaction & regain write access for the + * buffer head which is used for metadata modifications. +--- a/fs/ocfs2/journal.h ++++ b/fs/ocfs2/journal.h +@@ -243,6 +243,8 @@ handle_t *ocfs2_start_trans(struct + int ocfs2_commit_trans(struct ocfs2_super *osb, + handle_t *handle); + int ocfs2_extend_trans(handle_t *handle, int nblocks); ++int ocfs2_assure_trans_credits(handle_t *handle, ++ int nblocks); + int ocfs2_allocate_extend_trans(handle_t *handle, + int thresh); + +--- a/fs/ocfs2/ocfs2_trace.h ++++ b/fs/ocfs2/ocfs2_trace.h +@@ -2577,6 +2577,8 @@ DEFINE_OCFS2_ULL_UINT_EVENT(ocfs2_commit + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_extend_trans); + ++DEFINE_OCFS2_INT_EVENT(ocfs2_assure_trans_credits); ++ + DEFINE_OCFS2_INT_EVENT(ocfs2_extend_trans_restart); + + DEFINE_OCFS2_INT_INT_EVENT(ocfs2_allocate_extend_trans); diff --git a/queue-6.9/pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch b/queue-6.9/pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch new file mode 100644 index 00000000000..03723c958d6 --- /dev/null +++ b/queue-6.9/pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch @@ -0,0 +1,46 @@ +From 8da86499d4cd125a9561f9cd1de7fba99b0aecbf Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 May 2024 18:29:52 +0200 +Subject: pinctrl: qcom: spmi-gpio: drop broken pm8008 support + +From: Johan Hovold + +commit 8da86499d4cd125a9561f9cd1de7fba99b0aecbf upstream. + +The SPMI GPIO driver assumes that the parent device is an SPMI device +and accesses random data when backcasting the parent struct device +pointer for non-SPMI devices. + +Fortunately this does not seem to cause any issues currently when the +parent device is an I2C client like the PM8008, but this could change if +the structures are reorganised (e.g. using structure randomisation). + +Notably the interrupt implementation is also broken for non-SPMI devices. + +Also note that the two GPIO pins on PM8008 are used for interrupts and +reset so their practical use should be limited. + +Drop the broken GPIO support for PM8008 for now. + +Fixes: ea119e5a482a ("pinctrl: qcom-pmic-gpio: Add support for pm8008") +Cc: stable@vger.kernel.org # 5.13 +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Stephen Boyd +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20240529162958.18081-9-johan+linaro@kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -1206,7 +1206,6 @@ static const struct of_device_id pmic_gp + { .compatible = "qcom,pm7325-gpio", .data = (void *) 10 }, + { .compatible = "qcom,pm7550ba-gpio", .data = (void *) 8}, + { .compatible = "qcom,pm8005-gpio", .data = (void *) 4 }, +- { .compatible = "qcom,pm8008-gpio", .data = (void *) 2 }, + { .compatible = "qcom,pm8019-gpio", .data = (void *) 6 }, + /* pm8150 has 10 GPIOs with holes on 2, 5, 7 and 8 */ + { .compatible = "qcom,pm8150-gpio", .data = (void *) 10 }, diff --git a/queue-6.9/revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch b/queue-6.9/revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch new file mode 100644 index 00000000000..d32a704b354 --- /dev/null +++ b/queue-6.9/revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch @@ -0,0 +1,52 @@ +From 6e5aee08bd2517397c9572243a816664f2ead547 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Thu, 13 Jun 2024 10:17:09 +0200 +Subject: Revert "MIPS: pci: lantiq: restore reset gpio polarity" + +From: Thomas Bogendoerfer + +commit 6e5aee08bd2517397c9572243a816664f2ead547 upstream. + +This reverts commit 277a0363120276645ae598d8d5fea7265e076ae9. + +While fixing old boards with broken DTs, this change will break +newer ones with correct gpio polarity annotation. + +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/pci/pci-lantiq.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/pci/pci-lantiq.c ++++ b/arch/mips/pci/pci-lantiq.c +@@ -124,14 +124,14 @@ static int ltq_pci_startup(struct platfo + clk_disable(clk_external); + + /* setup reset gpio used by pci */ +- reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_ASIS); ++ reset_gpio = devm_gpiod_get_optional(&pdev->dev, "reset", ++ GPIOD_OUT_LOW); + error = PTR_ERR_OR_ZERO(reset_gpio); + if (error) { + dev_err(&pdev->dev, "failed to request gpio: %d\n", error); + return error; + } + gpiod_set_consumer_name(reset_gpio, "pci_reset"); +- gpiod_direction_output(reset_gpio, 1); + + /* enable auto-switching between PCI and EBU */ + ltq_pci_w32(0xa, PCI_CR_CLK_CTRL); +@@ -194,10 +194,10 @@ static int ltq_pci_startup(struct platfo + + /* toggle reset pin */ + if (reset_gpio) { +- gpiod_set_value_cansleep(reset_gpio, 0); ++ gpiod_set_value_cansleep(reset_gpio, 1); + wmb(); + mdelay(1); +- gpiod_set_value_cansleep(reset_gpio, 1); ++ gpiod_set_value_cansleep(reset_gpio, 0); + } + return 0; + } diff --git a/queue-6.9/revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch b/queue-6.9/revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch new file mode 100644 index 00000000000..0562fd67ce3 --- /dev/null +++ b/queue-6.9/revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch @@ -0,0 +1,188 @@ +From 84bb8d8bbd8384081c3fc5c4f20b223524af529d Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 6 Jun 2024 20:17:20 +0200 +Subject: Revert "mmc: moxart-mmc: Use sg_miter for PIO" + +From: Linus Walleij + +commit 84bb8d8bbd8384081c3fc5c4f20b223524af529d upstream. + +This reverts commit 3ee0e7c3e67cab83ffbbe7707b43df8d41c9fe47. + +The patch is not working for unknown reasons and I would +need access to the hardware to fix the bug. + +This shouldn't matter anyway: the Moxa Art is not expected +to use highmem, and sg_miter() is only necessary to have +to properly deal with highmem. + +Reported-by: Sergei Antonov +Signed-off-by: Linus Walleij +Fixes: 3ee0e7c3e67c ("mmc: moxart-mmc: Use sg_miter for PIO") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240606-mmc-moxart-revert-v1-1-a01c2f40de9c@linaro.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/moxart-mmc.c | 78 +++++++++++++++++++---------------- + 1 file changed, 43 insertions(+), 35 deletions(-) + +diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c +index 9a5f75163aca..8ede4ce93271 100644 +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -131,10 +131,12 @@ struct moxart_host { + struct dma_async_tx_descriptor *tx_desc; + struct mmc_host *mmc; + struct mmc_request *mrq; ++ struct scatterlist *cur_sg; + struct completion dma_complete; + struct completion pio_complete; + +- struct sg_mapping_iter sg_miter; ++ u32 num_sg; ++ u32 data_remain; + u32 data_len; + u32 fifo_width; + u32 timeout; +@@ -146,6 +148,35 @@ struct moxart_host { + bool is_removed; + }; + ++static inline void moxart_init_sg(struct moxart_host *host, ++ struct mmc_data *data) ++{ ++ host->cur_sg = data->sg; ++ host->num_sg = data->sg_len; ++ host->data_remain = host->cur_sg->length; ++ ++ if (host->data_remain > host->data_len) ++ host->data_remain = host->data_len; ++} ++ ++static inline int moxart_next_sg(struct moxart_host *host) ++{ ++ int remain; ++ struct mmc_data *data = host->mrq->cmd->data; ++ ++ host->cur_sg++; ++ host->num_sg--; ++ ++ if (host->num_sg > 0) { ++ host->data_remain = host->cur_sg->length; ++ remain = host->data_len - data->bytes_xfered; ++ if (remain > 0 && remain < host->data_remain) ++ host->data_remain = remain; ++ } ++ ++ return host->num_sg; ++} ++ + static int moxart_wait_for_status(struct moxart_host *host, + u32 mask, u32 *status) + { +@@ -278,29 +309,14 @@ static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host) + + static void moxart_transfer_pio(struct moxart_host *host) + { +- struct sg_mapping_iter *sgm = &host->sg_miter; + struct mmc_data *data = host->mrq->cmd->data; + u32 *sgp, len = 0, remain, status; + + if (host->data_len == data->bytes_xfered) + return; + +- /* +- * By updating sgm->consumes this will get a proper pointer into the +- * buffer at any time. +- */ +- if (!sg_miter_next(sgm)) { +- /* This shold not happen */ +- dev_err(mmc_dev(host->mmc), "ran out of scatterlist prematurely\n"); +- data->error = -EINVAL; +- complete(&host->pio_complete); +- return; +- } +- sgp = sgm->addr; +- remain = sgm->length; +- if (remain > host->data_len) +- remain = host->data_len; +- sgm->consumed = 0; ++ sgp = sg_virt(host->cur_sg); ++ remain = host->data_remain; + + if (data->flags & MMC_DATA_WRITE) { + while (remain > 0) { +@@ -315,7 +331,6 @@ static void moxart_transfer_pio(struct moxart_host *host) + sgp++; + len += 4; + } +- sgm->consumed += len; + remain -= len; + } + +@@ -332,22 +347,22 @@ static void moxart_transfer_pio(struct moxart_host *host) + sgp++; + len += 4; + } +- sgm->consumed += len; + remain -= len; + } + } + +- data->bytes_xfered += sgm->consumed; +- if (host->data_len == data->bytes_xfered) { ++ data->bytes_xfered += host->data_remain - remain; ++ host->data_remain = remain; ++ ++ if (host->data_len != data->bytes_xfered) ++ moxart_next_sg(host); ++ else + complete(&host->pio_complete); +- return; +- } + } + + static void moxart_prepare_data(struct moxart_host *host) + { + struct mmc_data *data = host->mrq->cmd->data; +- unsigned int flags = SG_MITER_ATOMIC; /* Used from IRQ */ + u32 datactrl; + int blksz_bits; + +@@ -358,19 +373,15 @@ static void moxart_prepare_data(struct moxart_host *host) + blksz_bits = ffs(data->blksz) - 1; + BUG_ON(1 << blksz_bits != data->blksz); + ++ moxart_init_sg(host, data); ++ + datactrl = DCR_DATA_EN | (blksz_bits & DCR_BLK_SIZE); + +- if (data->flags & MMC_DATA_WRITE) { +- flags |= SG_MITER_FROM_SG; ++ if (data->flags & MMC_DATA_WRITE) + datactrl |= DCR_DATA_WRITE; +- } else { +- flags |= SG_MITER_TO_SG; +- } + + if (moxart_use_dma(host)) + datactrl |= DCR_DMA_EN; +- else +- sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags); + + writel(DCR_DATA_FIFO_RESET, host->base + REG_DATA_CONTROL); + writel(MASK_DATA | FIFO_URUN | FIFO_ORUN, host->base + REG_CLEAR); +@@ -443,9 +454,6 @@ static void moxart_request(struct mmc_host *mmc, struct mmc_request *mrq) + } + + request_done: +- if (!moxart_use_dma(host)) +- sg_miter_stop(&host->sg_miter); +- + spin_unlock_irqrestore(&host->lock, flags); + mmc_request_done(host->mmc, mrq); + } +-- +2.45.2 + diff --git a/queue-6.9/series b/queue-6.9/series index 5e9fc16c49d..2c963b54d7a 100644 --- a/queue-6.9/series +++ b/queue-6.9/series @@ -111,3 +111,16 @@ tools-power-turbostat-option-n-is-ambiguous.patch randomize_kstack-remove-non-functional-per-arch-entr.patch x86-stop-playing-stack-games-in-profile_pc.patch parisc-use-generic-sys_fanotify_mark-implementation.patch +revert-mips-pci-lantiq-restore-reset-gpio-polarity.patch +pinctrl-qcom-spmi-gpio-drop-broken-pm8008-support.patch +ocfs2-fix-dio-failure-due-to-insufficient-transaction-credits.patch +nfs-drop-the-incorrect-assertion-in-nfs_swap_rw.patch +kasan-fix-bad-call-to-unpoison_slab_object.patch +mm-fix-incorrect-vbq-reference-in-purge_fragmented_block.patch +mm-memory-don-t-require-head-page-for-do_set_pmd.patch +revert-mmc-moxart-mmc-use-sg_miter-for-pio.patch +mmc-sdhci-pci-o2micro-convert-pcibios_-return-codes-to-errnos.patch +mmc-sdhci-brcmstb-check-r1_status-for-erase-trim-discard.patch +mmc-sdhci-pci-convert-pcibios_-return-codes-to-errnos.patch +mmc-sdhci-do-not-invert-write-protect-twice.patch +mmc-sdhci-do-not-lock-spinlock-around-mmc_gpio_get_ro.patch -- 2.47.3