]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.18-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 9 Jul 2022 08:29:31 +0000 (10:29 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 9 Jul 2022 08:29:31 +0000 (10:29 +0200)
added patches:
cxl-fix-cleanup-of-port-devices-on-failure-to-probe-driver.patch
cxl-mbox-use-__le32-in-get-set_lsa-mailbox-structures.patch
fbcon-disallow-setting-font-bigger-than-screen-size.patch
fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
fbdev-fbmem-fix-logo-center-image-dx-issue.patch
fbmem-check-virtual-screen-sizes-in-fb_set_var.patch
fscache-fix-if-condition-in-fscache_wait_on_volume_collision.patch
fscache-fix-invalidation-lookup-race.patch
iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch
iommu-vt-d-fix-rid2pasid-setup-teardown-failure.patch
maintainers-remove-iommu-lists.linux-foundation.org.patch
memregion-fix-memregion_free-fallback-definition.patch
pm-runtime-fix-supplier-device-management-during-consumer-probe.patch
pm-runtime-redefine-pm_runtime_release_supplier.patch
video-of_display_timing.h-include-errno.h.patch

16 files changed:
queue-5.18/cxl-fix-cleanup-of-port-devices-on-failure-to-probe-driver.patch [new file with mode: 0644]
queue-5.18/cxl-mbox-use-__le32-in-get-set_lsa-mailbox-structures.patch [new file with mode: 0644]
queue-5.18/fbcon-disallow-setting-font-bigger-than-screen-size.patch [new file with mode: 0644]
queue-5.18/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch [new file with mode: 0644]
queue-5.18/fbdev-fbmem-fix-logo-center-image-dx-issue.patch [new file with mode: 0644]
queue-5.18/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch [new file with mode: 0644]
queue-5.18/fscache-fix-if-condition-in-fscache_wait_on_volume_collision.patch [new file with mode: 0644]
queue-5.18/fscache-fix-invalidation-lookup-race.patch [new file with mode: 0644]
queue-5.18/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch [new file with mode: 0644]
queue-5.18/iommu-vt-d-fix-rid2pasid-setup-teardown-failure.patch [new file with mode: 0644]
queue-5.18/maintainers-remove-iommu-lists.linux-foundation.org.patch [new file with mode: 0644]
queue-5.18/memregion-fix-memregion_free-fallback-definition.patch [new file with mode: 0644]
queue-5.18/pm-runtime-fix-supplier-device-management-during-consumer-probe.patch [new file with mode: 0644]
queue-5.18/pm-runtime-redefine-pm_runtime_release_supplier.patch [new file with mode: 0644]
queue-5.18/series
queue-5.18/video-of_display_timing.h-include-errno.h.patch [new file with mode: 0644]

diff --git a/queue-5.18/cxl-fix-cleanup-of-port-devices-on-failure-to-probe-driver.patch b/queue-5.18/cxl-fix-cleanup-of-port-devices-on-failure-to-probe-driver.patch
new file mode 100644 (file)
index 0000000..08d2688
--- /dev/null
@@ -0,0 +1,62 @@
+From db9a3a35d31ea337331f0e6e07e04bcd52642894 Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Thu, 9 Jun 2022 14:45:19 +0100
+Subject: cxl: Fix cleanup of port devices on failure to probe driver.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit db9a3a35d31ea337331f0e6e07e04bcd52642894 upstream.
+
+The device is created, and then there is a check if a driver succesfully
+bound to it. In event of failing the bind (e.g. failure in cxl_port_probe())
+the device is left registered. When a bus rescan later occurs, fresh
+devices are created leading to a multiple device representing the same
+underlying hardware. Bad things may follow and at very least we have far too many
+devices.
+
+Fix by ensuring autoremove is registered if the device create succeeds,
+but doesn't depend on sucessful binding to a driver.
+
+Bug was observed as side effect of incorrect ownership in
+[PATCH v9 6/9] cxl/port: Read CDAT table
+but will result from any failure to in cxl_port_probe().
+
+Fixes: 8dd2bc0f8e02 ("cxl/mem: Add the cxl_mem driver")
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Link: https://lore.kernel.org/r/20220609134519.11668-1-Jonathan.Cameron@huawei.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/mem.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/cxl/mem.c
++++ b/drivers/cxl/mem.c
+@@ -46,6 +46,7 @@ static int create_endpoint(struct cxl_me
+ {
+       struct cxl_dev_state *cxlds = cxlmd->cxlds;
+       struct cxl_port *endpoint;
++      int rc;
+       endpoint = devm_cxl_add_port(&parent_port->dev, &cxlmd->dev,
+                                    cxlds->component_reg_phys, parent_port);
+@@ -54,13 +55,17 @@ static int create_endpoint(struct cxl_me
+       dev_dbg(&cxlmd->dev, "add: %s\n", dev_name(&endpoint->dev));
++      rc = cxl_endpoint_autoremove(cxlmd, endpoint);
++      if (rc)
++              return rc;
++
+       if (!endpoint->dev.driver) {
+               dev_err(&cxlmd->dev, "%s failed probe\n",
+                       dev_name(&endpoint->dev));
+               return -ENXIO;
+       }
+-      return cxl_endpoint_autoremove(cxlmd, endpoint);
++      return 0;
+ }
+ /**
diff --git a/queue-5.18/cxl-mbox-use-__le32-in-get-set_lsa-mailbox-structures.patch b/queue-5.18/cxl-mbox-use-__le32-in-get-set_lsa-mailbox-structures.patch
new file mode 100644 (file)
index 0000000..f18b082
--- /dev/null
@@ -0,0 +1,64 @@
+From 8a66487506161dbc1d22fd154d2de0244e232040 Mon Sep 17 00:00:00 2001
+From: Alison Schofield <alison.schofield@intel.com>
+Date: Fri, 25 Feb 2022 14:14:56 -0800
+Subject: cxl/mbox: Use __le32 in get,set_lsa mailbox structures
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+commit 8a66487506161dbc1d22fd154d2de0244e232040 upstream.
+
+CXL specification defines these as little endian.
+
+Fixes: 60b8f17215de ("cxl/pmem: Translate NVDIMM label commands to CXL label commands")
+Reported-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Link: https://lore.kernel.org/r/20220225221456.1025635-1-alison.schofield@intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/cxlmem.h |    8 ++++----
+ drivers/cxl/pmem.c   |    6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/cxl/cxlmem.h
++++ b/drivers/cxl/cxlmem.h
+@@ -252,13 +252,13 @@ struct cxl_mbox_identify {
+ } __packed;
+ struct cxl_mbox_get_lsa {
+-      u32 offset;
+-      u32 length;
++      __le32 offset;
++      __le32 length;
+ } __packed;
+ struct cxl_mbox_set_lsa {
+-      u32 offset;
+-      u32 reserved;
++      __le32 offset;
++      __le32 reserved;
+       u8 data[];
+ } __packed;
+--- a/drivers/cxl/pmem.c
++++ b/drivers/cxl/pmem.c
+@@ -108,8 +108,8 @@ static int cxl_pmem_get_config_data(stru
+               return -EINVAL;
+       get_lsa = (struct cxl_mbox_get_lsa) {
+-              .offset = cmd->in_offset,
+-              .length = cmd->in_length,
++              .offset = cpu_to_le32(cmd->in_offset),
++              .length = cpu_to_le32(cmd->in_length),
+       };
+       rc = cxl_mbox_send_cmd(cxlds, CXL_MBOX_OP_GET_LSA, &get_lsa,
+@@ -139,7 +139,7 @@ static int cxl_pmem_set_config_data(stru
+               return -ENOMEM;
+       *set_lsa = (struct cxl_mbox_set_lsa) {
+-              .offset = cmd->in_offset,
++              .offset = cpu_to_le32(cmd->in_offset),
+       };
+       memcpy(set_lsa->data, cmd->in_buf, cmd->in_length);
diff --git a/queue-5.18/fbcon-disallow-setting-font-bigger-than-screen-size.patch b/queue-5.18/fbcon-disallow-setting-font-bigger-than-screen-size.patch
new file mode 100644 (file)
index 0000000..5aa33e5
--- /dev/null
@@ -0,0 +1,37 @@
+From 65a01e601dbba8b7a51a2677811f70f783766682 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 25 Jun 2022 12:56:49 +0200
+Subject: fbcon: Disallow setting font bigger than screen size
+
+From: Helge Deller <deller@gmx.de>
+
+commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream.
+
+Prevent that users set a font size which is bigger than the physical screen.
+It's unlikely this may happen (because screens are usually much larger than the
+fonts and each font char is limited to 32x32 pixels), but it may happen on
+smaller screens/LCD displays.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: stable@vger.kernel.org # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2480,6 +2480,11 @@ static int fbcon_set_font(struct vc_data
+       if (charcount != 256 && charcount != 512)
+               return -EINVAL;
++      /* font bigger than screen resolution ? */
++      if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) ||
++          h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
++              return -EINVAL;
++
+       /* Make sure drawing engine can handle the font */
+       if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
+           !(info->pixmap.blit_y & (1 << (font->height - 1))))
diff --git a/queue-5.18/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch b/queue-5.18/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
new file mode 100644 (file)
index 0000000..a1182ef
--- /dev/null
@@ -0,0 +1,99 @@
+From e64242caef18b4a5840b0e7a9bff37abd4f4f933 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 25 Jun 2022 13:00:34 +0200
+Subject: fbcon: Prevent that screen size is smaller than font size
+
+From: Helge Deller <deller@gmx.de>
+
+commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 upstream.
+
+We need to prevent that users configure a screen size which is smaller than the
+currently selected font size. Otherwise rendering chars on the screen will
+access memory outside the graphics memory region.
+
+This patch adds a new function fbcon_modechange_possible() which
+implements this check and which later may be extended with other checks
+if necessary.  The new function is called from the FBIOPUT_VSCREENINFO
+ioctl handler in fbmem.c, which will return -EINVAL if userspace asked
+for a too small screen size.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: stable@vger.kernel.org # v5.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c |   28 ++++++++++++++++++++++++++++
+ drivers/video/fbdev/core/fbmem.c |    4 +++-
+ include/linux/fbcon.h            |    4 ++++
+ 3 files changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2747,6 +2747,34 @@ void fbcon_update_vcs(struct fb_info *in
+ }
+ EXPORT_SYMBOL(fbcon_update_vcs);
++/* let fbcon check if it supports a new screen resolution */
++int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
++{
++      struct fbcon_ops *ops = info->fbcon_par;
++      struct vc_data *vc;
++      unsigned int i;
++
++      WARN_CONSOLE_UNLOCKED();
++
++      if (!ops)
++              return 0;
++
++      /* prevent setting a screen size which is smaller than font size */
++      for (i = first_fb_vc; i <= last_fb_vc; i++) {
++              vc = vc_cons[i].d;
++              if (!vc || vc->vc_mode != KD_TEXT ||
++                         registered_fb[con2fb_map[i]] != info)
++                      continue;
++
++              if (vc->vc_font.width  > FBCON_SWAP(var->rotate, var->xres, var->yres) ||
++                  vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres))
++                      return -EINVAL;
++      }
++
++      return 0;
++}
++EXPORT_SYMBOL_GPL(fbcon_modechange_possible);
++
+ int fbcon_mode_deleted(struct fb_info *info,
+                      struct fb_videomode *mode)
+ {
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1116,7 +1116,9 @@ static long do_fb_ioctl(struct fb_info *
+                       return -EFAULT;
+               console_lock();
+               lock_fb_info(info);
+-              ret = fb_set_var(info, &var);
++              ret = fbcon_modechange_possible(info, &var);
++              if (!ret)
++                      ret = fb_set_var(info, &var);
+               if (!ret)
+                       fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
+               unlock_fb_info(info);
+--- a/include/linux/fbcon.h
++++ b/include/linux/fbcon.h
+@@ -15,6 +15,8 @@ void fbcon_new_modelist(struct fb_info *
+ void fbcon_get_requirement(struct fb_info *info,
+                          struct fb_blit_caps *caps);
+ void fbcon_fb_blanked(struct fb_info *info, int blank);
++int  fbcon_modechange_possible(struct fb_info *info,
++                             struct fb_var_screeninfo *var);
+ void fbcon_update_vcs(struct fb_info *info, bool all);
+ void fbcon_remap_all(struct fb_info *info);
+ int fbcon_set_con2fb_map_ioctl(void __user *argp);
+@@ -33,6 +35,8 @@ static inline void fbcon_new_modelist(st
+ static inline void fbcon_get_requirement(struct fb_info *info,
+                                        struct fb_blit_caps *caps) {}
+ static inline void fbcon_fb_blanked(struct fb_info *info, int blank) {}
++static inline int  fbcon_modechange_possible(struct fb_info *info,
++                              struct fb_var_screeninfo *var) { return 0; }
+ static inline void fbcon_update_vcs(struct fb_info *info, bool all) {}
+ static inline void fbcon_remap_all(struct fb_info *info) {}
+ static inline int fbcon_set_con2fb_map_ioctl(void __user *argp) { return 0; }
diff --git a/queue-5.18/fbdev-fbmem-fix-logo-center-image-dx-issue.patch b/queue-5.18/fbdev-fbmem-fix-logo-center-image-dx-issue.patch
new file mode 100644 (file)
index 0000000..10d3f79
--- /dev/null
@@ -0,0 +1,33 @@
+From 955f04766d4e6eb94bf3baa539e096808c74ebfb Mon Sep 17 00:00:00 2001
+From: Guiling Deng <greens9@163.com>
+Date: Tue, 28 Jun 2022 09:36:41 -0700
+Subject: fbdev: fbmem: Fix logo center image dx issue
+
+From: Guiling Deng <greens9@163.com>
+
+commit 955f04766d4e6eb94bf3baa539e096808c74ebfb upstream.
+
+Image.dx gets wrong value because of missing '()'.
+
+If xres == logo->width and n == 1, image.dx = -16.
+
+Signed-off-by: Guiling Deng <greens9@163.com>
+Fixes: 3d8b1933eb1c ("fbdev: fbmem: add config option to center the bootup logo")
+Cc: stable@vger.kernel.org # v5.0+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbmem.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -510,7 +510,7 @@ static int fb_show_logo_line(struct fb_i
+               while (n && (n * (logo->width + 8) - 8 > xres))
+                       --n;
+-              image.dx = (xres - n * (logo->width + 8) - 8) / 2;
++              image.dx = (xres - (n * (logo->width + 8) - 8)) / 2;
+               image.dy = y ?: (yres - logo->height) / 2;
+       } else {
+               image.dx = 0;
diff --git a/queue-5.18/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch b/queue-5.18/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch
new file mode 100644 (file)
index 0000000..2a48e68
--- /dev/null
@@ -0,0 +1,40 @@
+From 6c11df58fd1ac0aefcb3b227f72769272b939e56 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 29 Jun 2022 15:53:55 +0200
+Subject: fbmem: Check virtual screen sizes in fb_set_var()
+
+From: Helge Deller <deller@gmx.de>
+
+commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream.
+
+Verify that the fbdev or drm driver correctly adjusted the virtual
+screen sizes. On failure report the failing driver and reject the screen
+size change.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: stable@vger.kernel.org # v5.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbmem.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1016,6 +1016,16 @@ fb_set_var(struct fb_info *info, struct
+       if (ret)
+               return ret;
++      /* verify that virtual resolution >= physical resolution */
++      if (var->xres_virtual < var->xres ||
++          var->yres_virtual < var->yres) {
++              pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n",
++                      info->fix.id,
++                      var->xres_virtual, var->yres_virtual,
++                      var->xres, var->yres);
++              return -EINVAL;
++      }
++
+       if ((var->activate & FB_ACTIVATE_MASK) != FB_ACTIVATE_NOW)
+               return 0;
diff --git a/queue-5.18/fscache-fix-if-condition-in-fscache_wait_on_volume_collision.patch b/queue-5.18/fscache-fix-if-condition-in-fscache_wait_on_volume_collision.patch
new file mode 100644 (file)
index 0000000..cd2b3ef
--- /dev/null
@@ -0,0 +1,47 @@
+From bf17455b9cbd4b10bf30d39c047307e1d774fb1a Mon Sep 17 00:00:00 2001
+From: Yue Hu <huyue2@coolpad.com>
+Date: Wed, 25 May 2022 10:32:22 +0800
+Subject: fscache: Fix if condition in fscache_wait_on_volume_collision()
+
+From: Yue Hu <huyue2@coolpad.com>
+
+commit bf17455b9cbd4b10bf30d39c047307e1d774fb1a upstream.
+
+After waiting for the volume to complete the acquisition with timeout,
+the if condition under which potential volume collision occurs should be
+acquire the volume is still pending rather than not pending so that we
+will continue to wait until the pending flag is cleared. Also, use the
+existing test pending wrapper directly instead of test_bit().
+
+Fixes: 62ab63352350 ("fscache: Implement volume registration")
+Signed-off-by: Yue Hu <huyue2@coolpad.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Jeffle Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Link: https://listman.redhat.com/archives/linux-cachefs/2022-May/006918.html
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fscache/volume.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/fscache/volume.c
++++ b/fs/fscache/volume.c
+@@ -143,7 +143,7 @@ static void fscache_wait_on_volume_colli
+ {
+       wait_var_event_timeout(&candidate->flags,
+                              !fscache_is_acquire_pending(candidate), 20 * HZ);
+-      if (!fscache_is_acquire_pending(candidate)) {
++      if (fscache_is_acquire_pending(candidate)) {
+               pr_notice("Potential volume collision new=%08x old=%08x",
+                         candidate->debug_id, collidee_debug_id);
+               fscache_stat(&fscache_n_volumes_collision);
+@@ -182,7 +182,7 @@ static bool fscache_hash_volume(struct f
+       hlist_bl_add_head(&candidate->hash_link, h);
+       hlist_bl_unlock(h);
+-      if (test_bit(FSCACHE_VOLUME_ACQUIRE_PENDING, &candidate->flags))
++      if (fscache_is_acquire_pending(candidate))
+               fscache_wait_on_volume_collision(candidate, collidee_debug_id);
+       return true;
diff --git a/queue-5.18/fscache-fix-invalidation-lookup-race.patch b/queue-5.18/fscache-fix-invalidation-lookup-race.patch
new file mode 100644 (file)
index 0000000..87238eb
--- /dev/null
@@ -0,0 +1,85 @@
+From 85e4ea1049c70fb99de5c6057e835d151fb647da Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 20 Apr 2022 14:27:17 +0100
+Subject: fscache: Fix invalidation/lookup race
+
+From: David Howells <dhowells@redhat.com>
+
+commit 85e4ea1049c70fb99de5c6057e835d151fb647da upstream.
+
+If an NFS file is opened for writing and closed, fscache_invalidate() will
+be asked to invalidate the file - however, if the cookie is in the
+LOOKING_UP state (or the CREATING state), then request to invalidate
+doesn't get recorded for fscache_cookie_state_machine() to do something
+with.
+
+Fix this by making __fscache_invalidate() set a flag if it sees the cookie
+is in the LOOKING_UP state to indicate that we need to go to invalidation.
+Note that this requires a count on the n_accesses counter for the state
+machine, which that will release when it's done.
+
+fscache_cookie_state_machine() then shifts to the INVALIDATING state if it
+sees the flag.
+
+Without this, an nfs file can get corrupted if it gets modified locally and
+then read locally as the cache contents may not get updated.
+
+Fixes: d24af13e2e23 ("fscache: Implement cookie invalidation")
+Reported-by: Max Kellermann <mk@cm4all.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Max Kellermann <mk@cm4all.com>
+Link: https://lore.kernel.org/r/YlWWbpW5Foynjllo@rabbit.intern.cm-ag [1]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fscache/cookie.c     |   15 ++++++++++++++-
+ include/linux/fscache.h |    1 +
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -517,7 +517,14 @@ static void fscache_perform_lookup(struc
+       }
+       fscache_see_cookie(cookie, fscache_cookie_see_active);
+-      fscache_set_cookie_state(cookie, FSCACHE_COOKIE_STATE_ACTIVE);
++      spin_lock(&cookie->lock);
++      if (test_and_clear_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags))
++              __fscache_set_cookie_state(cookie,
++                                         FSCACHE_COOKIE_STATE_INVALIDATING);
++      else
++              __fscache_set_cookie_state(cookie, FSCACHE_COOKIE_STATE_ACTIVE);
++      spin_unlock(&cookie->lock);
++      wake_up_cookie_state(cookie);
+       trace = fscache_access_lookup_cookie_end;
+ out:
+@@ -752,6 +759,9 @@ again_locked:
+                       spin_lock(&cookie->lock);
+               }
++              if (test_and_clear_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags))
++                      fscache_end_cookie_access(cookie, fscache_access_invalidate_cookie_end);
++
+               switch (state) {
+               case FSCACHE_COOKIE_STATE_RELINQUISHING:
+                       fscache_see_cookie(cookie, fscache_cookie_see_relinquish);
+@@ -1048,6 +1058,9 @@ void __fscache_invalidate(struct fscache
+               return;
+       case FSCACHE_COOKIE_STATE_LOOKING_UP:
++              __fscache_begin_cookie_access(cookie, fscache_access_invalidate_cookie);
++              set_bit(FSCACHE_COOKIE_DO_INVALIDATE, &cookie->flags);
++              fallthrough;
+       case FSCACHE_COOKIE_STATE_CREATING:
+               spin_unlock(&cookie->lock);
+               _leave(" [look %x]", cookie->inval_counter);
+--- a/include/linux/fscache.h
++++ b/include/linux/fscache.h
+@@ -129,6 +129,7 @@ struct fscache_cookie {
+ #define FSCACHE_COOKIE_DO_PREP_TO_WRITE       12              /* T if cookie needs write preparation */
+ #define FSCACHE_COOKIE_HAVE_DATA      13              /* T if this cookie has data stored */
+ #define FSCACHE_COOKIE_IS_HASHED      14              /* T if this cookie is hashed */
++#define FSCACHE_COOKIE_DO_INVALIDATE  15              /* T if cookie needs invalidation */
+       enum fscache_cookie_state       state;
+       u8                              advice;         /* FSCACHE_ADV_* */
diff --git a/queue-5.18/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch b/queue-5.18/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch
new file mode 100644 (file)
index 0000000..71ce680
--- /dev/null
@@ -0,0 +1,57 @@
+From 316f92a705a4c2bf4712135180d56f3cca09243a Mon Sep 17 00:00:00 2001
+From: Yian Chen <yian.chen@intel.com>
+Date: Fri, 20 May 2022 17:21:15 -0700
+Subject: iommu/vt-d: Fix PCI bus rescan device hot add
+
+From: Yian Chen <yian.chen@intel.com>
+
+commit 316f92a705a4c2bf4712135180d56f3cca09243a upstream.
+
+Notifier calling chain uses priority to determine the execution
+order of the notifiers or listeners registered to the chain.
+PCI bus device hot add utilizes the notification mechanism.
+
+The current code sets low priority (INT_MIN) to Intel
+dmar_pci_bus_notifier and postpones DMAR decoding after adding
+new device into IOMMU. The result is that struct device pointer
+cannot be found in DRHD search for the new device's DMAR/IOMMU.
+Subsequently, the device is put under the "catch-all" IOMMU
+instead of the correct one. This could cause system hang when
+device TLB invalidation is sent to the wrong IOMMU. Invalidation
+timeout error and hard lockup have been observed and data
+inconsistency/crush may occur as well.
+
+This patch fixes the issue by setting a positive priority(1) for
+dmar_pci_bus_notifier while the priority of IOMMU bus notifier
+uses the default value(0), therefore DMAR decoding will be in
+advance of DRHD search for a new device to find the correct IOMMU.
+
+Following is a 2-step example that triggers the bug by simulating
+PCI device hot add behavior in Intel Sapphire Rapids server.
+
+echo 1 > /sys/bus/pci/devices/0000:6a:01.0/remove
+echo 1 > /sys/bus/pci/rescan
+
+Fixes: 59ce0515cdaf ("iommu/vt-d: Update DRHD/RMRR/ATSR device scope")
+Cc: stable@vger.kernel.org # v3.15+
+Reported-by: Zhang, Bernice <bernice.zhang@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Yian Chen <yian.chen@intel.com>
+Link: https://lore.kernel.org/r/20220521002115.1624069-1-yian.chen@intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/intel/dmar.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -383,7 +383,7 @@ static int dmar_pci_bus_notifier(struct
+ static struct notifier_block dmar_pci_bus_nb = {
+       .notifier_call = dmar_pci_bus_notifier,
+-      .priority = INT_MIN,
++      .priority = 1,
+ };
+ static struct dmar_drhd_unit *
diff --git a/queue-5.18/iommu-vt-d-fix-rid2pasid-setup-teardown-failure.patch b/queue-5.18/iommu-vt-d-fix-rid2pasid-setup-teardown-failure.patch
new file mode 100644 (file)
index 0000000..ee41a12
--- /dev/null
@@ -0,0 +1,216 @@
+From 4140d77a022101376bbfa3ec3e3da5063455c60e Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Sat, 25 Jun 2022 21:34:30 +0800
+Subject: iommu/vt-d: Fix RID2PASID setup/teardown failure
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit 4140d77a022101376bbfa3ec3e3da5063455c60e upstream.
+
+The IOMMU driver shares the pasid table for PCI alias devices. When the
+RID2PASID entry of the shared pasid table has been filled by the first
+device, the subsequent device will encounter the "DMAR: Setup RID2PASID
+failed" failure as the pasid entry has already been marked as present.
+As the result, the IOMMU probing process will be aborted.
+
+On the contrary, when any alias device is hot-removed from the system,
+for example, by writing to /sys/bus/pci/devices/.../remove, the shared
+RID2PASID will be cleared without any notifications to other devices.
+As the result, any DMAs from those rest devices are blocked.
+
+Sharing pasid table among PCI alias devices could save two memory pages
+for devices underneath the PCIe-to-PCI bridges. Anyway, considering that
+those devices are rare on modern platforms that support VT-d in scalable
+mode and the saved memory is negligible, it's reasonable to remove this
+part of immature code to make the driver feasible and stable.
+
+Fixes: ef848b7e5a6a0 ("iommu/vt-d: Setup pasid entry for RID2PASID support")
+Reported-by: Chenyi Qiang <chenyi.qiang@intel.com>
+Reported-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220623065720.727849-1-baolu.lu@linux.intel.com
+Link: https://lore.kernel.org/r/20220625133430.2200315-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/intel/iommu.c |   24 ---------------
+ drivers/iommu/intel/pasid.c |   69 +-------------------------------------------
+ drivers/iommu/intel/pasid.h |    1 
+ include/linux/intel-iommu.h |    3 -
+ 4 files changed, 3 insertions(+), 94 deletions(-)
+
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -320,30 +320,6 @@ EXPORT_SYMBOL_GPL(intel_iommu_gfx_mapped
+ DEFINE_SPINLOCK(device_domain_lock);
+ static LIST_HEAD(device_domain_list);
+-/*
+- * Iterate over elements in device_domain_list and call the specified
+- * callback @fn against each element.
+- */
+-int for_each_device_domain(int (*fn)(struct device_domain_info *info,
+-                                   void *data), void *data)
+-{
+-      int ret = 0;
+-      unsigned long flags;
+-      struct device_domain_info *info;
+-
+-      spin_lock_irqsave(&device_domain_lock, flags);
+-      list_for_each_entry(info, &device_domain_list, global) {
+-              ret = fn(info, data);
+-              if (ret) {
+-                      spin_unlock_irqrestore(&device_domain_lock, flags);
+-                      return ret;
+-              }
+-      }
+-      spin_unlock_irqrestore(&device_domain_lock, flags);
+-
+-      return 0;
+-}
+-
+ const struct iommu_ops intel_iommu_ops;
+ static bool translation_pre_enabled(struct intel_iommu *iommu)
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -86,54 +86,6 @@ void vcmd_free_pasid(struct intel_iommu
+ /*
+  * Per device pasid table management:
+  */
+-static inline void
+-device_attach_pasid_table(struct device_domain_info *info,
+-                        struct pasid_table *pasid_table)
+-{
+-      info->pasid_table = pasid_table;
+-      list_add(&info->table, &pasid_table->dev);
+-}
+-
+-static inline void
+-device_detach_pasid_table(struct device_domain_info *info,
+-                        struct pasid_table *pasid_table)
+-{
+-      info->pasid_table = NULL;
+-      list_del(&info->table);
+-}
+-
+-struct pasid_table_opaque {
+-      struct pasid_table      **pasid_table;
+-      int                     segment;
+-      int                     bus;
+-      int                     devfn;
+-};
+-
+-static int search_pasid_table(struct device_domain_info *info, void *opaque)
+-{
+-      struct pasid_table_opaque *data = opaque;
+-
+-      if (info->iommu->segment == data->segment &&
+-          info->bus == data->bus &&
+-          info->devfn == data->devfn &&
+-          info->pasid_table) {
+-              *data->pasid_table = info->pasid_table;
+-              return 1;
+-      }
+-
+-      return 0;
+-}
+-
+-static int get_alias_pasid_table(struct pci_dev *pdev, u16 alias, void *opaque)
+-{
+-      struct pasid_table_opaque *data = opaque;
+-
+-      data->segment = pci_domain_nr(pdev->bus);
+-      data->bus = PCI_BUS_NUM(alias);
+-      data->devfn = alias & 0xff;
+-
+-      return for_each_device_domain(&search_pasid_table, data);
+-}
+ /*
+  * Allocate a pasid table for @dev. It should be called in a
+@@ -143,28 +95,18 @@ int intel_pasid_alloc_table(struct devic
+ {
+       struct device_domain_info *info;
+       struct pasid_table *pasid_table;
+-      struct pasid_table_opaque data;
+       struct page *pages;
+       u32 max_pasid = 0;
+-      int ret, order;
+-      int size;
++      int order, size;
+       might_sleep();
+       info = dev_iommu_priv_get(dev);
+       if (WARN_ON(!info || !dev_is_pci(dev) || info->pasid_table))
+               return -EINVAL;
+-      /* DMA alias device already has a pasid table, use it: */
+-      data.pasid_table = &pasid_table;
+-      ret = pci_for_each_dma_alias(to_pci_dev(dev),
+-                                   &get_alias_pasid_table, &data);
+-      if (ret)
+-              goto attach_out;
+-
+       pasid_table = kzalloc(sizeof(*pasid_table), GFP_KERNEL);
+       if (!pasid_table)
+               return -ENOMEM;
+-      INIT_LIST_HEAD(&pasid_table->dev);
+       if (info->pasid_supported)
+               max_pasid = min_t(u32, pci_max_pasids(to_pci_dev(dev)),
+@@ -182,9 +124,7 @@ int intel_pasid_alloc_table(struct devic
+       pasid_table->table = page_address(pages);
+       pasid_table->order = order;
+       pasid_table->max_pasid = 1 << (order + PAGE_SHIFT + 3);
+-
+-attach_out:
+-      device_attach_pasid_table(info, pasid_table);
++      info->pasid_table = pasid_table;
+       return 0;
+ }
+@@ -202,10 +142,7 @@ void intel_pasid_free_table(struct devic
+               return;
+       pasid_table = info->pasid_table;
+-      device_detach_pasid_table(info, pasid_table);
+-
+-      if (!list_empty(&pasid_table->dev))
+-              return;
++      info->pasid_table = NULL;
+       /* Free scalable mode PASID directory tables: */
+       dir = pasid_table->table;
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -74,7 +74,6 @@ struct pasid_table {
+       void                    *table;         /* pasid table pointer */
+       int                     order;          /* page order of pasid table */
+       u32                     max_pasid;      /* max pasid */
+-      struct list_head        dev;            /* device list */
+ };
+ /* Get PRESENT bit of a PASID directory entry. */
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -611,7 +611,6 @@ struct intel_iommu {
+ struct device_domain_info {
+       struct list_head link;  /* link to domain siblings */
+       struct list_head global; /* link to global list */
+-      struct list_head table; /* link to pasid table */
+       u32 segment;            /* PCI segment number */
+       u8 bus;                 /* PCI bus number */
+       u8 devfn;               /* PCI devfn number */
+@@ -728,8 +727,6 @@ extern int dmar_ir_support(void);
+ void *alloc_pgtable_page(int node);
+ void free_pgtable_page(void *vaddr);
+ struct intel_iommu *domain_get_iommu(struct dmar_domain *domain);
+-int for_each_device_domain(int (*fn)(struct device_domain_info *info,
+-                                   void *data), void *data);
+ void iommu_flush_write_buffer(struct intel_iommu *iommu);
+ int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct device *dev);
+ struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devfn);
diff --git a/queue-5.18/maintainers-remove-iommu-lists.linux-foundation.org.patch b/queue-5.18/maintainers-remove-iommu-lists.linux-foundation.org.patch
new file mode 100644 (file)
index 0000000..0be3bd7
--- /dev/null
@@ -0,0 +1,111 @@
+From c51b8f85c4157eb91c2f4ab34b0c52fea642e77c Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Wed, 6 Jul 2022 12:33:31 +0200
+Subject: MAINTAINERS: Remove iommu@lists.linux-foundation.org
+
+From: Joerg Roedel <jroedel@suse.de>
+
+commit c51b8f85c4157eb91c2f4ab34b0c52fea642e77c upstream.
+
+The IOMMU mailing list has moved to iommu@lists.linux.dev
+and the old list should bounce by now. Remove it from the
+MAINTAINERS file.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Link: https://lore.kernel.org/r/20220706103331.10215-1-joro@8bytes.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ MAINTAINERS |   11 -----------
+ 1 file changed, 11 deletions(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -426,7 +426,6 @@ F: drivers/acpi/*thermal*
+ ACPI VIOT DRIVER
+ M:    Jean-Philippe Brucker <jean-philippe@linaro.org>
+ L:    linux-acpi@vger.kernel.org
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Maintained
+ F:    drivers/acpi/viot.c
+@@ -960,7 +959,6 @@ F: drivers/video/fbdev/geode/
+ AMD IOMMU (AMD-VI)
+ M:    Joerg Roedel <joro@8bytes.org>
+ R:    Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Maintained
+ T:    git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
+@@ -5899,7 +5897,6 @@ DMA MAPPING HELPERS
+ M:    Christoph Hellwig <hch@lst.de>
+ M:    Marek Szyprowski <m.szyprowski@samsung.com>
+ R:    Robin Murphy <robin.murphy@arm.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Supported
+ W:    http://git.infradead.org/users/hch/dma-mapping.git
+@@ -5912,7 +5909,6 @@ F:       kernel/dma/
+ DMA MAPPING BENCHMARK
+ M:    Xiang Chen <chenxiang66@hisilicon.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ F:    kernel/dma/map_benchmark.c
+ F:    tools/testing/selftests/dma/
+@@ -7479,7 +7475,6 @@ F:       drivers/gpu/drm/exynos/exynos_dp*
+ EXYNOS SYSMMU (IOMMU) driver
+ M:    Marek Szyprowski <m.szyprowski@samsung.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Maintained
+ F:    drivers/iommu/exynos-iommu.c
+@@ -9879,7 +9874,6 @@ F:       drivers/hid/intel-ish-hid/
+ INTEL IOMMU (VT-d)
+ M:    David Woodhouse <dwmw2@infradead.org>
+ M:    Lu Baolu <baolu.lu@linux.intel.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Supported
+ T:    git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
+@@ -10258,7 +10252,6 @@ F:     include/linux/iomap.h
+ IOMMU DRIVERS
+ M:    Joerg Roedel <joro@8bytes.org>
+ M:    Will Deacon <will@kernel.org>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Maintained
+ T:    git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
+@@ -12375,7 +12368,6 @@ F:     drivers/i2c/busses/i2c-mt65xx.c
+ MEDIATEK IOMMU DRIVER
+ M:    Yong Wu <yong.wu@mediatek.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ L:    linux-mediatek@lists.infradead.org (moderated for non-subscribers)
+ S:    Supported
+@@ -16361,7 +16353,6 @@ F:     drivers/i2c/busses/i2c-qcom-cci.c
+ QUALCOMM IOMMU
+ M:    Rob Clark <robdclark@gmail.com>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ L:    linux-arm-msm@vger.kernel.org
+ S:    Maintained
+@@ -18947,7 +18938,6 @@ F:     arch/x86/boot/video*
+ SWIOTLB SUBSYSTEM
+ M:    Christoph Hellwig <hch@infradead.org>
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Supported
+ W:    http://git.infradead.org/users/hch/dma-mapping.git
+@@ -21618,7 +21608,6 @@ XEN SWIOTLB SUBSYSTEM
+ M:    Juergen Gross <jgross@suse.com>
+ M:    Stefano Stabellini <sstabellini@kernel.org>
+ L:    xen-devel@lists.xenproject.org (moderated for non-subscribers)
+-L:    iommu@lists.linux-foundation.org
+ L:    iommu@lists.linux.dev
+ S:    Supported
+ F:    arch/x86/xen/*swiotlb*
diff --git a/queue-5.18/memregion-fix-memregion_free-fallback-definition.patch b/queue-5.18/memregion-fix-memregion_free-fallback-definition.patch
new file mode 100644 (file)
index 0000000..fc6332b
--- /dev/null
@@ -0,0 +1,39 @@
+From f50974eee5c4a5de1e4f1a3d873099f170df25f8 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 23 Jun 2022 13:02:31 -0700
+Subject: memregion: Fix memregion_free() fallback definition
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit f50974eee5c4a5de1e4f1a3d873099f170df25f8 upstream.
+
+In the CONFIG_MEMREGION=n case, memregion_free() is meant to be a static
+inline. 0day reports:
+
+    In file included from drivers/cxl/core/port.c:4:
+    include/linux/memregion.h:19:6: warning: no previous prototype for
+    function 'memregion_free' [-Wmissing-prototypes]
+
+Mark memregion_free() static.
+
+Fixes: 33dd70752cd7 ("lib: Uplevel the pmem "region" ida to a global allocator")
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Link: https://lore.kernel.org/r/165601455171.4042645.3350844271068713515.stgit@dwillia2-xfh
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/memregion.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/memregion.h
++++ b/include/linux/memregion.h
+@@ -16,7 +16,7 @@ static inline int memregion_alloc(gfp_t
+ {
+       return -ENOMEM;
+ }
+-void memregion_free(int id)
++static inline void memregion_free(int id)
+ {
+ }
+ #endif
diff --git a/queue-5.18/pm-runtime-fix-supplier-device-management-during-consumer-probe.patch b/queue-5.18/pm-runtime-fix-supplier-device-management-during-consumer-probe.patch
new file mode 100644 (file)
index 0000000..e0076bf
--- /dev/null
@@ -0,0 +1,104 @@
+From 887371066039011144b4a94af97d9328df6869a2 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 30 Jun 2022 21:16:41 +0200
+Subject: PM: runtime: Fix supplier device management during consumer probe
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 887371066039011144b4a94af97d9328df6869a2 upstream.
+
+Because pm_runtime_get_suppliers() bumps up the rpm_active counter
+of each device link to a supplier of the given device in addition
+to bumping up the supplier's PM-runtime usage counter, a runtime
+suspend of the consumer device may case the latter to go down to 0
+when pm_runtime_put_suppliers() is running on a remote CPU.  If that
+happens after pm_runtime_put_suppliers() has released power.lock for
+the consumer device, and a runtime resume of that device takes place
+immediately after it, before pm_runtime_put() is called for the
+supplier, that pm_runtime_put() call may cause the supplier to be
+suspended even though the consumer is active.
+
+To prevent that from happening, modify pm_runtime_get_suppliers() to
+call pm_runtime_get_sync() for the given device's suppliers without
+touching the rpm_active counters of the involved device links
+Accordingly, modify pm_runtime_put_suppliers() to call pm_runtime_put()
+for the given device's suppliers without looking at the rpm_active
+counters of the device links at hand.  [This is analogous to what
+happened before commit 4c06c4e6cf63 ("driver core: Fix possible
+supplier PM-usage counter imbalance").]
+
+Since pm_runtime_get_suppliers() sets supplier_preactivated for each
+device link where the supplier's PM-runtime usage counter has been
+incremented and pm_runtime_put_suppliers() calls pm_runtime_put() for
+the suppliers whose device links have supplier_preactivated set, the
+PM-runtime usage counter is balanced for each supplier and this is
+independent of the runtime suspend and resume of the consumer device.
+
+However, in case a device link with DL_FLAG_PM_RUNTIME set is dropped
+during the consumer device probe, so pm_runtime_get_suppliers() bumps
+up the supplier's PM-runtime usage counter, but it cannot be dropped by
+pm_runtime_put_suppliers(), make device_link_release_fn() take care of
+that.
+
+Fixes: 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage counter imbalance")
+Reported-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/core.c          |   10 ++++++++++
+ drivers/base/power/runtime.c |   14 +-------------
+ 2 files changed, 11 insertions(+), 13 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -486,6 +486,16 @@ static void device_link_release_fn(struc
+       device_link_synchronize_removal();
+       pm_runtime_release_supplier(link);
++      /*
++       * If supplier_preactivated is set, the link has been dropped between
++       * the pm_runtime_get_suppliers() and pm_runtime_put_suppliers() calls
++       * in __driver_probe_device().  In that case, drop the supplier's
++       * PM-runtime usage counter to remove the reference taken by
++       * pm_runtime_get_suppliers().
++       */
++      if (link->supplier_preactivated)
++              pm_runtime_put_noidle(link->supplier);
++
+       pm_request_idle(link->supplier);
+       put_device(link->consumer);
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1737,7 +1737,6 @@ void pm_runtime_get_suppliers(struct dev
+               if (link->flags & DL_FLAG_PM_RUNTIME) {
+                       link->supplier_preactivated = true;
+                       pm_runtime_get_sync(link->supplier);
+-                      refcount_inc(&link->rpm_active);
+               }
+       device_links_read_unlock(idx);
+@@ -1757,19 +1756,8 @@ void pm_runtime_put_suppliers(struct dev
+       list_for_each_entry_rcu(link, &dev->links.suppliers, c_node,
+                               device_links_read_lock_held())
+               if (link->supplier_preactivated) {
+-                      bool put;
+-
+                       link->supplier_preactivated = false;
+-
+-                      spin_lock_irq(&dev->power.lock);
+-
+-                      put = pm_runtime_status_suspended(dev) &&
+-                            refcount_dec_not_one(&link->rpm_active);
+-
+-                      spin_unlock_irq(&dev->power.lock);
+-
+-                      if (put)
+-                              pm_runtime_put(link->supplier);
++                      pm_runtime_put(link->supplier);
+               }
+       device_links_read_unlock(idx);
diff --git a/queue-5.18/pm-runtime-redefine-pm_runtime_release_supplier.patch b/queue-5.18/pm-runtime-redefine-pm_runtime_release_supplier.patch
new file mode 100644 (file)
index 0000000..f78d6c3
--- /dev/null
@@ -0,0 +1,111 @@
+From 07358194badf73e267289b40b761f5dc56928eab Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Mon, 27 Jun 2022 20:42:18 +0200
+Subject: PM: runtime: Redefine pm_runtime_release_supplier()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 07358194badf73e267289b40b761f5dc56928eab upstream.
+
+Instead of passing an extra bool argument to pm_runtime_release_supplier(),
+make its callers take care of triggering a runtime-suspend of the
+supplier device as needed.
+
+No expected functional impact.
+
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/core.c          |    3 ++-
+ drivers/base/power/runtime.c |   20 +++++++++-----------
+ include/linux/pm_runtime.h   |    5 ++---
+ 3 files changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -485,7 +485,8 @@ static void device_link_release_fn(struc
+       /* Ensure that all references to the link object have been dropped. */
+       device_link_synchronize_removal();
+-      pm_runtime_release_supplier(link, true);
++      pm_runtime_release_supplier(link);
++      pm_request_idle(link->supplier);
+       put_device(link->consumer);
+       put_device(link->supplier);
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -308,13 +308,10 @@ static int rpm_get_suppliers(struct devi
+ /**
+  * pm_runtime_release_supplier - Drop references to device link's supplier.
+  * @link: Target device link.
+- * @check_idle: Whether or not to check if the supplier device is idle.
+  *
+- * Drop all runtime PM references associated with @link to its supplier device
+- * and if @check_idle is set, check if that device is idle (and so it can be
+- * suspended).
++ * Drop all runtime PM references associated with @link to its supplier device.
+  */
+-void pm_runtime_release_supplier(struct device_link *link, bool check_idle)
++void pm_runtime_release_supplier(struct device_link *link)
+ {
+       struct device *supplier = link->supplier;
+@@ -327,9 +324,6 @@ void pm_runtime_release_supplier(struct
+       while (refcount_dec_not_one(&link->rpm_active) &&
+              atomic_read(&supplier->power.usage_count) > 0)
+               pm_runtime_put_noidle(supplier);
+-
+-      if (check_idle)
+-              pm_request_idle(supplier);
+ }
+ static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend)
+@@ -337,8 +331,11 @@ static void __rpm_put_suppliers(struct d
+       struct device_link *link;
+       list_for_each_entry_rcu(link, &dev->links.suppliers, c_node,
+-                              device_links_read_lock_held())
+-              pm_runtime_release_supplier(link, try_to_suspend);
++                              device_links_read_lock_held()) {
++              pm_runtime_release_supplier(link);
++              if (try_to_suspend)
++                      pm_request_idle(link->supplier);
++      }
+ }
+ static void rpm_put_suppliers(struct device *dev)
+@@ -1807,7 +1804,8 @@ void pm_runtime_drop_link(struct device_
+               return;
+       pm_runtime_drop_link_count(link->consumer);
+-      pm_runtime_release_supplier(link, true);
++      pm_runtime_release_supplier(link);
++      pm_request_idle(link->supplier);
+ }
+ static bool pm_runtime_need_not_resume(struct device *dev)
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -82,7 +82,7 @@ extern void pm_runtime_get_suppliers(str
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+ extern void pm_runtime_drop_link(struct device_link *link);
+-extern void pm_runtime_release_supplier(struct device_link *link, bool check_idle);
++extern void pm_runtime_release_supplier(struct device_link *link);
+ extern int devm_pm_runtime_enable(struct device *dev);
+@@ -308,8 +308,7 @@ static inline void pm_runtime_get_suppli
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
+ static inline void pm_runtime_drop_link(struct device_link *link) {}
+-static inline void pm_runtime_release_supplier(struct device_link *link,
+-                                             bool check_idle) {}
++static inline void pm_runtime_release_supplier(struct device_link *link) {}
+ #endif /* !CONFIG_PM */
index 1a4b13bcd67c6088aa5777bfa820f7daae314a29..43345ad22cde6565205ecb42939eef02a9dfee50 100644 (file)
@@ -25,3 +25,18 @@ can-mcp251xfd-mcp251xfd_register_get_dev_id-use-correct-length-to-read-dev_id.pa
 can-mcp251xfd-mcp251xfd_register_get_dev_id-fix-endianness-conversion.patch
 can-rcar_canfd-fix-data-transmission-failed-on-r-car-v3u.patch
 asoc-qdsp6-q6apm-dai-unprepare-stream-if-its-already-prepared.patch
+maintainers-remove-iommu-lists.linux-foundation.org.patch
+iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch
+iommu-vt-d-fix-rid2pasid-setup-teardown-failure.patch
+cxl-mbox-use-__le32-in-get-set_lsa-mailbox-structures.patch
+cxl-fix-cleanup-of-port-devices-on-failure-to-probe-driver.patch
+fbdev-fbmem-fix-logo-center-image-dx-issue.patch
+fbmem-check-virtual-screen-sizes-in-fb_set_var.patch
+fbcon-disallow-setting-font-bigger-than-screen-size.patch
+fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
+pm-runtime-redefine-pm_runtime_release_supplier.patch
+pm-runtime-fix-supplier-device-management-during-consumer-probe.patch
+memregion-fix-memregion_free-fallback-definition.patch
+video-of_display_timing.h-include-errno.h.patch
+fscache-fix-invalidation-lookup-race.patch
+fscache-fix-if-condition-in-fscache_wait_on_volume_collision.patch
diff --git a/queue-5.18/video-of_display_timing.h-include-errno.h.patch b/queue-5.18/video-of_display_timing.h-include-errno.h.patch
new file mode 100644 (file)
index 0000000..d4279e9
--- /dev/null
@@ -0,0 +1,33 @@
+From 3663a2fb325b8782524f3edb0ae32d6faa615109 Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Fri, 1 Jul 2022 01:33:29 +0800
+Subject: video: of_display_timing.h: include errno.h
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+commit 3663a2fb325b8782524f3edb0ae32d6faa615109 upstream.
+
+If CONFIG_OF is not enabled, default of_get_display_timing() returns an
+errno, so include the header.
+
+Fixes: 422b67e0b31a ("videomode: provide dummy inline functions for !CONFIG_OF")
+Suggested-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/video/of_display_timing.h |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/video/of_display_timing.h
++++ b/include/video/of_display_timing.h
+@@ -8,6 +8,8 @@
+ #ifndef __LINUX_OF_DISPLAY_TIMING_H
+ #define __LINUX_OF_DISPLAY_TIMING_H
++#include <linux/errno.h>
++
+ struct device_node;
+ struct display_timing;
+ struct display_timings;