--- /dev/null
+From 4087df8a37908a13aa217ffe2292fc5e79c94248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 15:34:21 -0300
+Subject: ARM: dts: imx6qdl-gw551x: Do not use 'simple-audio-card,dai-link'
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit e52928e8d5c1c4837a0c6ec2068beea99defde8b ]
+
+According to Documentation/devicetree/bindings/sound/simple-card.txt
+the 'simple-audio-card,dai-link' may be omitted when the card has
+only one DAI link, which is the case here.
+
+Get rid of 'simple-audio-card,dai-link' in order to fix the following
+build warning with W=1:
+
+arch/arm/boot/dts/imx6qdl-gw551x.dtsi:109.32-121.5: Warning (unit_address_vs_reg): /sound-digital/simple-audio-card,dai-link@0: node has a unit name, but no reg property
+
+Cc: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+index c23ba229fd057..c38e86eedcc01 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+@@ -105,19 +105,16 @@
+ sound-digital {
+ compatible = "simple-audio-card";
+ simple-audio-card,name = "tda1997x-audio";
++ simple-audio-card,format = "i2s";
++ simple-audio-card,bitclock-master = <&sound_codec>;
++ simple-audio-card,frame-master = <&sound_codec>;
+
+- simple-audio-card,dai-link@0 {
+- format = "i2s";
+-
+- cpu {
+- sound-dai = <&ssi2>;
+- };
++ sound_cpu: simple-audio-card,cpu {
++ sound-dai = <&ssi2>;
++ };
+
+- codec {
+- bitclock-master;
+- frame-master;
+- sound-dai = <&hdmi_receiver>;
+- };
++ sound_codec: simple-audio-card,codec {
++ sound-dai = <&hdmi_receiver>;
+ };
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 0f10b9688fe24e28d0996c4562d6865a6c431344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 12:06:54 -0700
+Subject: ARM: dts: imx6qdl-gw551x: fix audio SSI
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit 4237c625304b212a3f30adf787901082082511ec ]
+
+The audio codec on the GW551x routes to ssi1. It fixes audio capture on
+the device.
+
+Cc: stable@vger.kernel.org
+Fixes: 3117e851cef1 ("ARM: dts: imx: Add TDA19971 HDMI Receiver to GW551x")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+index c38e86eedcc01..8c33510c9519d 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi
+@@ -110,7 +110,7 @@
+ simple-audio-card,frame-master = <&sound_codec>;
+
+ sound_cpu: simple-audio-card,cpu {
+- sound-dai = <&ssi2>;
++ sound-dai = <&ssi1>;
+ };
+
+ sound_codec: simple-audio-card,codec {
+--
+2.25.1
+
--- /dev/null
+From 4bdbbcc2e8b0a8b4983e3561756907fffb9d9997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 16:00:58 -0400
+Subject: dm: do not use waitqueue for request-based DM
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 85067747cf9888249fa11fa49ef75af5192d3988 ]
+
+Given request-based DM now uses blk-mq's blk_mq_queue_inflight() to
+determine if outstanding IO has completed (and DM has no control over
+the blk-mq state machine used to track outstanding IO) it is unsafe to
+wakeup waiter (dm_wait_for_completion) before blk-mq has cleared a
+request's state bits (e.g. MQ_RQ_IN_FLIGHT or MQ_RQ_COMPLETE). As
+such dm_wait_for_completion() could be left to wait indefinitely if no
+other requests complete.
+
+Fix this by eliminating request-based DM's use of waitqueue to wait
+for blk-mq requests to complete in dm_wait_for_completion.
+
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Depends-on: 3c94d83cb3526 ("blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 4 ---
+ drivers/md/dm.c | 64 ++++++++++++++++++++++++++++------------------
+ 2 files changed, 39 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 3f8577e2c13be..9fb46a6301d80 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -146,10 +146,6 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
+ */
+ static void rq_completed(struct mapped_device *md)
+ {
+- /* nudge anyone waiting on suspend queue */
+- if (unlikely(wq_has_sleeper(&md->wait)))
+- wake_up(&md->wait);
+-
+ /*
+ * dm_put() must be at the end of this function. See the comment above
+ */
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 1e7ad2ad48295..87319c473594a 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -627,28 +627,6 @@ static void free_tio(struct dm_target_io *tio)
+ bio_put(&tio->clone);
+ }
+
+-static bool md_in_flight_bios(struct mapped_device *md)
+-{
+- int cpu;
+- struct hd_struct *part = &dm_disk(md)->part0;
+- long sum = 0;
+-
+- for_each_possible_cpu(cpu) {
+- sum += part_stat_local_read_cpu(part, in_flight[0], cpu);
+- sum += part_stat_local_read_cpu(part, in_flight[1], cpu);
+- }
+-
+- return sum != 0;
+-}
+-
+-static bool md_in_flight(struct mapped_device *md)
+-{
+- if (queue_is_mq(md->queue))
+- return blk_mq_queue_inflight(md->queue);
+- else
+- return md_in_flight_bios(md);
+-}
+-
+ u64 dm_start_time_ns_from_clone(struct bio *bio)
+ {
+ struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
+@@ -2439,15 +2417,29 @@ void dm_put(struct mapped_device *md)
+ }
+ EXPORT_SYMBOL_GPL(dm_put);
+
+-static int dm_wait_for_completion(struct mapped_device *md, long task_state)
++static bool md_in_flight_bios(struct mapped_device *md)
++{
++ int cpu;
++ struct hd_struct *part = &dm_disk(md)->part0;
++ long sum = 0;
++
++ for_each_possible_cpu(cpu) {
++ sum += part_stat_local_read_cpu(part, in_flight[0], cpu);
++ sum += part_stat_local_read_cpu(part, in_flight[1], cpu);
++ }
++
++ return sum != 0;
++}
++
++static int dm_wait_for_bios_completion(struct mapped_device *md, long task_state)
+ {
+ int r = 0;
+ DEFINE_WAIT(wait);
+
+- while (1) {
++ while (true) {
+ prepare_to_wait(&md->wait, &wait, task_state);
+
+- if (!md_in_flight(md))
++ if (!md_in_flight_bios(md))
+ break;
+
+ if (signal_pending_state(task_state, current)) {
+@@ -2462,6 +2454,28 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state)
+ return r;
+ }
+
++static int dm_wait_for_completion(struct mapped_device *md, long task_state)
++{
++ int r = 0;
++
++ if (!queue_is_mq(md->queue))
++ return dm_wait_for_bios_completion(md, task_state);
++
++ while (true) {
++ if (!blk_mq_queue_inflight(md->queue))
++ break;
++
++ if (signal_pending_state(task_state, current)) {
++ r = -EINTR;
++ break;
++ }
++
++ msleep(5);
++ }
++
++ return r;
++}
++
+ /*
+ * Process the deferred bios
+ */
+--
+2.25.1
+
--- /dev/null
+From d2ae7485cc17a3217e5d79b14de45b844c2d363f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 16:48:29 -0400
+Subject: dm mpath: pass IO start time to path selector
+
+From: Gabriel Krisman Bertazi <krisman@collabora.com>
+
+[ Upstream commit 087615bf3acdafd0ba7c7c9ed5286e7b7c80fe1b ]
+
+The HST path selector needs this information to perform path
+prediction. For request-based mpath, struct request's io_start_time_ns
+is used, while for bio-based, use the start_time stored in dm_io.
+
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-mpath.c | 9 ++++++---
+ drivers/md/dm-path-selector.h | 2 +-
+ drivers/md/dm-queue-length.c | 2 +-
+ drivers/md/dm-service-time.c | 2 +-
+ drivers/md/dm.c | 9 +++++++++
+ include/linux/device-mapper.h | 2 ++
+ 6 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index f2de4c73cc8fa..d7ebed50895f0 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -558,7 +558,8 @@ static void multipath_release_clone(struct request *clone,
+ if (pgpath && pgpath->pg->ps.type->end_io)
+ pgpath->pg->ps.type->end_io(&pgpath->pg->ps,
+ &pgpath->path,
+- mpio->nr_bytes);
++ mpio->nr_bytes,
++ clone->io_start_time_ns);
+ }
+
+ blk_put_request(clone);
+@@ -1560,7 +1561,8 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
+ struct path_selector *ps = &pgpath->pg->ps;
+
+ if (ps->type->end_io)
+- ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes);
++ ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes,
++ clone->io_start_time_ns);
+ }
+
+ return r;
+@@ -1604,7 +1606,8 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone,
+ struct path_selector *ps = &pgpath->pg->ps;
+
+ if (ps->type->end_io)
+- ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes);
++ ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes,
++ dm_start_time_ns_from_clone(clone));
+ }
+
+ return r;
+diff --git a/drivers/md/dm-path-selector.h b/drivers/md/dm-path-selector.h
+index b6eb5365b1a46..c47bc0e20275b 100644
+--- a/drivers/md/dm-path-selector.h
++++ b/drivers/md/dm-path-selector.h
+@@ -74,7 +74,7 @@ struct path_selector_type {
+ int (*start_io) (struct path_selector *ps, struct dm_path *path,
+ size_t nr_bytes);
+ int (*end_io) (struct path_selector *ps, struct dm_path *path,
+- size_t nr_bytes);
++ size_t nr_bytes, u64 start_time);
+ };
+
+ /* Register a path selector */
+diff --git a/drivers/md/dm-queue-length.c b/drivers/md/dm-queue-length.c
+index 969c4f1a36336..5fd018d184187 100644
+--- a/drivers/md/dm-queue-length.c
++++ b/drivers/md/dm-queue-length.c
+@@ -227,7 +227,7 @@ static int ql_start_io(struct path_selector *ps, struct dm_path *path,
+ }
+
+ static int ql_end_io(struct path_selector *ps, struct dm_path *path,
+- size_t nr_bytes)
++ size_t nr_bytes, u64 start_time)
+ {
+ struct path_info *pi = path->pscontext;
+
+diff --git a/drivers/md/dm-service-time.c b/drivers/md/dm-service-time.c
+index f006a9005593b..9cfda665e9ebd 100644
+--- a/drivers/md/dm-service-time.c
++++ b/drivers/md/dm-service-time.c
+@@ -309,7 +309,7 @@ static int st_start_io(struct path_selector *ps, struct dm_path *path,
+ }
+
+ static int st_end_io(struct path_selector *ps, struct dm_path *path,
+- size_t nr_bytes)
++ size_t nr_bytes, u64 start_time)
+ {
+ struct path_info *pi = path->pscontext;
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 3cf5b354568e5..1e7ad2ad48295 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -649,6 +649,15 @@ static bool md_in_flight(struct mapped_device *md)
+ return md_in_flight_bios(md);
+ }
+
++u64 dm_start_time_ns_from_clone(struct bio *bio)
++{
++ struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
++ struct dm_io *io = tio->io;
++
++ return jiffies_to_nsecs(io->start_time);
++}
++EXPORT_SYMBOL_GPL(dm_start_time_ns_from_clone);
++
+ static void start_io_acct(struct dm_io *io)
+ {
+ struct mapped_device *md = io->md;
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index 399ad86323568..ec19222f67666 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -328,6 +328,8 @@ void *dm_per_bio_data(struct bio *bio, size_t data_size);
+ struct bio *dm_bio_from_per_bio_data(void *data, size_t data_size);
+ unsigned dm_bio_get_target_bio_nr(const struct bio *bio);
+
++u64 dm_start_time_ns_from_clone(struct bio *bio);
++
+ int dm_register_target(struct target_type *t);
+ void dm_unregister_target(struct target_type *t);
+
+--
+2.25.1
+
--- /dev/null
+From 825d6edf0991d6b9f46e14f10fe33f55e46572a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 17:27:19 +0530
+Subject: dmabuf: use spinlock to access dmabuf->name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Charan Teja Kalla <charante@codeaurora.org>
+
+[ Upstream commit 6348dd291e3653534a9e28e6917569bc9967b35b ]
+
+There exists a sleep-while-atomic bug while accessing the dmabuf->name
+under mutex in the dmabuffs_dname(). This is caused from the SELinux
+permissions checks on a process where it tries to validate the inherited
+files from fork() by traversing them through iterate_fd() (which
+traverse files under spin_lock) and call
+match_file(security/selinux/hooks.c) where the permission checks happen.
+This audit information is logged using dump_common_audit_data() where it
+calls d_path() to get the file path name. If the file check happen on
+the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to
+access dmabuf->name. The flow will be like below:
+flush_unauthorized_files()
+ iterate_fd()
+ spin_lock() --> Start of the atomic section.
+ match_file()
+ file_has_perm()
+ avc_has_perm()
+ avc_audit()
+ slow_avc_audit()
+ common_lsm_audit()
+ dump_common_audit_data()
+ audit_log_d_path()
+ d_path()
+ dmabuffs_dname()
+ mutex_lock()--> Sleep while atomic.
+
+Call trace captured (on 4.19 kernels) is below:
+___might_sleep+0x204/0x208
+__might_sleep+0x50/0x88
+__mutex_lock_common+0x5c/0x1068
+__mutex_lock_common+0x5c/0x1068
+mutex_lock_nested+0x40/0x50
+dmabuffs_dname+0xa0/0x170
+d_path+0x84/0x290
+audit_log_d_path+0x74/0x130
+common_lsm_audit+0x334/0x6e8
+slow_avc_audit+0xb8/0xf8
+avc_has_perm+0x154/0x218
+file_has_perm+0x70/0x180
+match_file+0x60/0x78
+iterate_fd+0x128/0x168
+selinux_bprm_committing_creds+0x178/0x248
+security_bprm_committing_creds+0x30/0x48
+install_exec_creds+0x1c/0x68
+load_elf_binary+0x3a4/0x14e0
+search_binary_handler+0xb0/0x1e0
+
+So, use spinlock to access dmabuf->name to avoid sleep-while-atomic.
+
+Cc: <stable@vger.kernel.org> [5.3+]
+Signed-off-by: Charan Teja Kalla <charante@codeaurora.org>
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+ [sumits: added comment to spinlock_t definition to avoid warning]
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/a83e7f0d-4e54-9848-4b58-e1acdbe06735@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-buf.c | 11 +++++++----
+ include/linux/dma-buf.h | 1 +
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index cf65a47310c3a..eba7e3fe769cf 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -45,10 +45,10 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen)
+ size_t ret = 0;
+
+ dmabuf = dentry->d_fsdata;
+- mutex_lock(&dmabuf->lock);
++ spin_lock(&dmabuf->name_lock);
+ if (dmabuf->name)
+ ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN);
+- mutex_unlock(&dmabuf->lock);
++ spin_unlock(&dmabuf->name_lock);
+
+ return dynamic_dname(dentry, buffer, buflen, "/%s:%s",
+ dentry->d_name.name, ret > 0 ? name : "");
+@@ -338,8 +338,10 @@ static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf)
+ kfree(name);
+ goto out_unlock;
+ }
++ spin_lock(&dmabuf->name_lock);
+ kfree(dmabuf->name);
+ dmabuf->name = name;
++ spin_unlock(&dmabuf->name_lock);
+
+ out_unlock:
+ mutex_unlock(&dmabuf->lock);
+@@ -402,10 +404,10 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file)
+ /* Don't count the temporary reference taken inside procfs seq_show */
+ seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1);
+ seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name);
+- mutex_lock(&dmabuf->lock);
++ spin_lock(&dmabuf->name_lock);
+ if (dmabuf->name)
+ seq_printf(m, "name:\t%s\n", dmabuf->name);
+- mutex_unlock(&dmabuf->lock);
++ spin_unlock(&dmabuf->name_lock);
+ }
+
+ static const struct file_operations dma_buf_fops = {
+@@ -537,6 +539,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info)
+ dmabuf->size = exp_info->size;
+ dmabuf->exp_name = exp_info->exp_name;
+ dmabuf->owner = exp_info->owner;
++ spin_lock_init(&dmabuf->name_lock);
+ init_waitqueue_head(&dmabuf->poll);
+ dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll;
+ dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0;
+diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
+index ec212cb27fdc6..12eac4293af66 100644
+--- a/include/linux/dma-buf.h
++++ b/include/linux/dma-buf.h
+@@ -303,6 +303,7 @@ struct dma_buf {
+ void *vmap_ptr;
+ const char *exp_name;
+ const char *name;
++ spinlock_t name_lock; /* spinlock to protect name access */
+ struct module *owner;
+ struct list_head list_node;
+ void *priv;
+--
+2.25.1
+
--- /dev/null
+From 450d69d82f6da097db9a0c858907dffa0d72780d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Apr 2020 14:09:23 -0400
+Subject: drm/amd/display: Check DMCU Exists Before Loading
+
+From: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
+
+[ Upstream commit 17bdb4a82fe5014c8aa5b2103c80c5729744a096 ]
+
+Signed-off-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 4fad0b603b3ab..c7d8edf450d3c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -928,9 +928,14 @@ static int dm_late_init(void *handle)
+ struct dmcu_iram_parameters params;
+ unsigned int linear_lut[16];
+ int i;
+- struct dmcu *dmcu = adev->dm.dc->res_pool->dmcu;
++ struct dmcu *dmcu = NULL;
+ bool ret;
+
++ if (!adev->dm.fw_dmcu)
++ return detect_mst_link_for_all_connectors(adev->ddev);
++
++ dmcu = adev->dm.dc->res_pool->dmcu;
++
+ for (i = 0; i < 16; i++)
+ linear_lut[i] = 0xFFFF * i / 15;
+
+--
+2.25.1
+
--- /dev/null
+From 57ccade5eb7b2276621af12dc5dc4ca2397b119c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 15:54:59 -0300
+Subject: fuse: fix weird page warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit a5005c3cda6eeb6b95645e6cc32f58dafeffc976 upstream.
+
+When PageWaiters was added, updating this check was missed.
+
+Reported-by: Nikolaus Rath <Nikolaus@rath.org>
+Reported-by: Hugh Dickins <hughd@google.com>
+Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: André Almeida <andrealmeid@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 4f2e4f38feb86..06dd38e76c62a 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -771,7 +771,8 @@ static int fuse_check_page(struct page *page)
+ 1 << PG_uptodate |
+ 1 << PG_lru |
+ 1 << PG_active |
+- 1 << PG_reclaim))) {
++ 1 << PG_reclaim |
++ 1 << PG_waiters))) {
+ pr_warn("trying to steal weird page\n");
+ pr_warn(" page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
+ return 1;
+--
+2.25.1
+
--- /dev/null
+From 82de4bcd151fda8a7c83190fc4f6f2be29621814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 11:53:06 +0200
+Subject: irqdomain/treewide: Keep firmware node unconditionally allocated
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit e3beca48a45b5e0e6e6a4e0124276b8248dcc9bb ]
+
+Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type
+IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after
+creating the irqdomain. The only purpose of these FW nodes is to convey
+name information. When this was introduced the core code did not store the
+pointer to the node in the irqdomain. A recent change stored the firmware
+node pointer in irqdomain for other reasons and missed to notice that the
+usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence
+are broken by this. Storing a dangling pointer is dangerous itself, but in
+case that the domain is destroyed later on this leads to a double free.
+
+Remove the freeing of the firmware node after creating the irqdomain from
+all affected call sites to cure this.
+
+Fixes: 711419e504eb ("irqdomain: Add the missing assignment of domain->fwnode for named fwnode")
+Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/873661qakd.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/pci/pci-xtalk-bridge.c | 5 +++--
+ arch/x86/kernel/apic/io_apic.c | 10 +++++-----
+ arch/x86/kernel/apic/msi.c | 18 ++++++++++++------
+ arch/x86/kernel/apic/vector.c | 1 -
+ arch/x86/platform/uv/uv_irq.c | 3 ++-
+ drivers/iommu/amd_iommu.c | 5 +++--
+ drivers/iommu/hyperv-iommu.c | 5 ++++-
+ drivers/iommu/intel_irq_remapping.c | 2 +-
+ drivers/pci/controller/vmd.c | 5 +++--
+ 9 files changed, 33 insertions(+), 21 deletions(-)
+
+diff --git a/arch/mips/pci/pci-xtalk-bridge.c b/arch/mips/pci/pci-xtalk-bridge.c
+index 30017d5945bc2..6ce76b18186e5 100644
+--- a/arch/mips/pci/pci-xtalk-bridge.c
++++ b/arch/mips/pci/pci-xtalk-bridge.c
+@@ -444,9 +444,10 @@ static int bridge_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ domain = irq_domain_create_hierarchy(parent, 0, 8, fn,
+ &bridge_domain_ops, NULL);
+- irq_domain_free_fwnode(fn);
+- if (!domain)
++ if (!domain) {
++ irq_domain_free_fwnode(fn);
+ return -ENOMEM;
++ }
+
+ pci_set_flags(PCI_PROBE_ONLY);
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index f0262cb5657a7..16699101fd2fe 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2329,12 +2329,12 @@ static int mp_irqdomain_create(int ioapic)
+ ip->irqdomain = irq_domain_create_linear(fn, hwirqs, cfg->ops,
+ (void *)(long)ioapic);
+
+- /* Release fw handle if it was allocated above */
+- if (!cfg->dev)
+- irq_domain_free_fwnode(fn);
+-
+- if (!ip->irqdomain)
++ if (!ip->irqdomain) {
++ /* Release fw handle if it was allocated above */
++ if (!cfg->dev)
++ irq_domain_free_fwnode(fn);
+ return -ENOMEM;
++ }
+
+ ip->irqdomain->parent = parent;
+
+diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
+index 159bd0cb85486..a20873bbbed67 100644
+--- a/arch/x86/kernel/apic/msi.c
++++ b/arch/x86/kernel/apic/msi.c
+@@ -262,12 +262,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent)
+ msi_default_domain =
+ pci_msi_create_irq_domain(fn, &pci_msi_domain_info,
+ parent);
+- irq_domain_free_fwnode(fn);
+ }
+- if (!msi_default_domain)
++ if (!msi_default_domain) {
++ irq_domain_free_fwnode(fn);
+ pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n");
+- else
++ } else {
+ msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK;
++ }
+ }
+
+ #ifdef CONFIG_IRQ_REMAP
+@@ -300,7 +301,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent,
+ if (!fn)
+ return NULL;
+ d = pci_msi_create_irq_domain(fn, &pci_msi_ir_domain_info, parent);
+- irq_domain_free_fwnode(fn);
++ if (!d)
++ irq_domain_free_fwnode(fn);
+ return d;
+ }
+ #endif
+@@ -363,7 +365,8 @@ static struct irq_domain *dmar_get_irq_domain(void)
+ if (fn) {
+ dmar_domain = msi_create_irq_domain(fn, &dmar_msi_domain_info,
+ x86_vector_domain);
+- irq_domain_free_fwnode(fn);
++ if (!dmar_domain)
++ irq_domain_free_fwnode(fn);
+ }
+ out:
+ mutex_unlock(&dmar_lock);
+@@ -488,7 +491,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id)
+ }
+
+ d = msi_create_irq_domain(fn, domain_info, parent);
+- irq_domain_free_fwnode(fn);
++ if (!d) {
++ irq_domain_free_fwnode(fn);
++ kfree(domain_info);
++ }
+ return d;
+ }
+
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 18c0dca081633..df4d5385e6ddd 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -701,7 +701,6 @@ int __init arch_early_irq_init(void)
+ x86_vector_domain = irq_domain_create_tree(fn, &x86_vector_domain_ops,
+ NULL);
+ BUG_ON(x86_vector_domain == NULL);
+- irq_domain_free_fwnode(fn);
+ irq_set_default_host(x86_vector_domain);
+
+ arch_init_msi_domain(x86_vector_domain);
+diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
+index fc13cbbb2dce2..abb6075397f05 100644
+--- a/arch/x86/platform/uv/uv_irq.c
++++ b/arch/x86/platform/uv/uv_irq.c
+@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void)
+ goto out;
+
+ uv_domain = irq_domain_create_tree(fn, &uv_domain_ops, NULL);
+- irq_domain_free_fwnode(fn);
+ if (uv_domain)
+ uv_domain->parent = x86_vector_domain;
++ else
++ irq_domain_free_fwnode(fn);
+ out:
+ mutex_unlock(&uv_lock);
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 32de8e7bb8b45..3a7094f4813f2 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4575,9 +4575,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu)
+ if (!fn)
+ return -ENOMEM;
+ iommu->ir_domain = irq_domain_create_tree(fn, &amd_ir_domain_ops, iommu);
+- irq_domain_free_fwnode(fn);
+- if (!iommu->ir_domain)
++ if (!iommu->ir_domain) {
++ irq_domain_free_fwnode(fn);
+ return -ENOMEM;
++ }
+
+ iommu->ir_domain->parent = arch_get_ir_parent_domain();
+ iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain,
+diff --git a/drivers/iommu/hyperv-iommu.c b/drivers/iommu/hyperv-iommu.c
+index a386b83e0e34b..f0fe5030acd36 100644
+--- a/drivers/iommu/hyperv-iommu.c
++++ b/drivers/iommu/hyperv-iommu.c
+@@ -155,7 +155,10 @@ static int __init hyperv_prepare_irq_remapping(void)
+ 0, IOAPIC_REMAPPING_ENTRY, fn,
+ &hyperv_ir_domain_ops, NULL);
+
+- irq_domain_free_fwnode(fn);
++ if (!ioapic_ir_domain) {
++ irq_domain_free_fwnode(fn);
++ return -ENOMEM;
++ }
+
+ /*
+ * Hyper-V doesn't provide irq remapping function for
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 81e43c1df7ecb..982d796b686b8 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -563,8 +563,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+ 0, INTR_REMAP_TABLE_ENTRIES,
+ fn, &intel_ir_domain_ops,
+ iommu);
+- irq_domain_free_fwnode(fn);
+ if (!iommu->ir_domain) {
++ irq_domain_free_fwnode(fn);
+ pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
+ goto out_free_bitmap;
+ }
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 87348ecfe3fcf..7c24c0aedad4a 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -680,9 +680,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+
+ vmd->irq_domain = pci_msi_create_irq_domain(fn, &vmd_msi_domain_info,
+ x86_vector_domain);
+- irq_domain_free_fwnode(fn);
+- if (!vmd->irq_domain)
++ if (!vmd->irq_domain) {
++ irq_domain_free_fwnode(fn);
+ return -ENODEV;
++ }
+
+ pci_add_resource(&resources, &vmd->resources[0]);
+ pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]);
+--
+2.25.1
+
scsi-dh-add-fujitsu-device-to-devinfo-and-dh-lists.patch
dm-use-bio_uninit-instead-of-bio_disassociate_blkg.patch
drivers-firmware-psci-fix-memory-leakage-in-alloc_in.patch
+fuse-fix-weird-page-warning.patch
+irqdomain-treewide-keep-firmware-node-unconditionall.patch
+arm-dts-imx6qdl-gw551x-do-not-use-simple-audio-card-.patch
+arm-dts-imx6qdl-gw551x-fix-audio-ssi.patch
+dmabuf-use-spinlock-to-access-dmabuf-name.patch
+drm-amd-display-check-dmcu-exists-before-loading.patch
+dm-mpath-pass-io-start-time-to-path-selector.patch
+dm-do-not-use-waitqueue-for-request-based-dm.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
