From: Sasha Levin Date: Thu, 23 Jul 2020 00:03:37 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.190~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bc9bb15cb6b3680fa6b0aec02e34971261e7462d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-imx6qdl-gw551x-do-not-use-simple-audio-card-.patch b/queue-5.4/arm-dts-imx6qdl-gw551x-do-not-use-simple-audio-card-.patch new file mode 100644 index 00000000000..d97509551b4 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-gw551x-do-not-use-simple-audio-card-.patch @@ -0,0 +1,61 @@ +From 4087df8a37908a13aa217ffe2292fc5e79c94248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2019 15:34:21 -0300 +Subject: ARM: dts: imx6qdl-gw551x: Do not use 'simple-audio-card,dai-link' + +From: Fabio Estevam + +[ Upstream commit e52928e8d5c1c4837a0c6ec2068beea99defde8b ] + +According to Documentation/devicetree/bindings/sound/simple-card.txt +the 'simple-audio-card,dai-link' may be omitted when the card has +only one DAI link, which is the case here. + +Get rid of 'simple-audio-card,dai-link' in order to fix the following +build warning with W=1: + +arch/arm/boot/dts/imx6qdl-gw551x.dtsi:109.32-121.5: Warning (unit_address_vs_reg): /sound-digital/simple-audio-card,dai-link@0: node has a unit name, but no reg property + +Cc: Tim Harvey +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi +index c23ba229fd057..c38e86eedcc01 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi +@@ -105,19 +105,16 @@ + sound-digital { + compatible = "simple-audio-card"; + simple-audio-card,name = "tda1997x-audio"; ++ simple-audio-card,format = "i2s"; ++ simple-audio-card,bitclock-master = <&sound_codec>; ++ simple-audio-card,frame-master = <&sound_codec>; + +- simple-audio-card,dai-link@0 { +- format = "i2s"; +- +- cpu { +- sound-dai = <&ssi2>; +- }; ++ sound_cpu: simple-audio-card,cpu { ++ sound-dai = <&ssi2>; ++ }; + +- codec { +- bitclock-master; +- frame-master; +- sound-dai = <&hdmi_receiver>; +- }; ++ sound_codec: simple-audio-card,codec { ++ sound-dai = <&hdmi_receiver>; + }; + }; + }; +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-imx6qdl-gw551x-fix-audio-ssi.patch b/queue-5.4/arm-dts-imx6qdl-gw551x-fix-audio-ssi.patch new file mode 100644 index 00000000000..63387ec1b74 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-gw551x-fix-audio-ssi.patch @@ -0,0 +1,37 @@ +From 0f10b9688fe24e28d0996c4562d6865a6c431344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 12:06:54 -0700 +Subject: ARM: dts: imx6qdl-gw551x: fix audio SSI + +From: Tim Harvey + +[ Upstream commit 4237c625304b212a3f30adf787901082082511ec ] + +The audio codec on the GW551x routes to ssi1. It fixes audio capture on +the device. + +Cc: stable@vger.kernel.org +Fixes: 3117e851cef1 ("ARM: dts: imx: Add TDA19971 HDMI Receiver to GW551x") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw551x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi +index c38e86eedcc01..8c33510c9519d 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw551x.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw551x.dtsi +@@ -110,7 +110,7 @@ + simple-audio-card,frame-master = <&sound_codec>; + + sound_cpu: simple-audio-card,cpu { +- sound-dai = <&ssi2>; ++ sound-dai = <&ssi1>; + }; + + sound_codec: simple-audio-card,codec { +-- +2.25.1 + diff --git a/queue-5.4/dm-do-not-use-waitqueue-for-request-based-dm.patch b/queue-5.4/dm-do-not-use-waitqueue-for-request-based-dm.patch new file mode 100644 index 00000000000..32220f65470 --- /dev/null +++ b/queue-5.4/dm-do-not-use-waitqueue-for-request-based-dm.patch @@ -0,0 +1,143 @@ +From 4bdbbcc2e8b0a8b4983e3561756907fffb9d9997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 16:00:58 -0400 +Subject: dm: do not use waitqueue for request-based DM + +From: Ming Lei + +[ Upstream commit 85067747cf9888249fa11fa49ef75af5192d3988 ] + +Given request-based DM now uses blk-mq's blk_mq_queue_inflight() to +determine if outstanding IO has completed (and DM has no control over +the blk-mq state machine used to track outstanding IO) it is unsafe to +wakeup waiter (dm_wait_for_completion) before blk-mq has cleared a +request's state bits (e.g. MQ_RQ_IN_FLIGHT or MQ_RQ_COMPLETE). As +such dm_wait_for_completion() could be left to wait indefinitely if no +other requests complete. + +Fix this by eliminating request-based DM's use of waitqueue to wait +for blk-mq requests to complete in dm_wait_for_completion. + +Signed-off-by: Ming Lei +Depends-on: 3c94d83cb3526 ("blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight()") +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 4 --- + drivers/md/dm.c | 64 ++++++++++++++++++++++++++++------------------ + 2 files changed, 39 insertions(+), 29 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 3f8577e2c13be..9fb46a6301d80 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -146,10 +146,6 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig) + */ + static void rq_completed(struct mapped_device *md) + { +- /* nudge anyone waiting on suspend queue */ +- if (unlikely(wq_has_sleeper(&md->wait))) +- wake_up(&md->wait); +- + /* + * dm_put() must be at the end of this function. See the comment above + */ +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 1e7ad2ad48295..87319c473594a 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -627,28 +627,6 @@ static void free_tio(struct dm_target_io *tio) + bio_put(&tio->clone); + } + +-static bool md_in_flight_bios(struct mapped_device *md) +-{ +- int cpu; +- struct hd_struct *part = &dm_disk(md)->part0; +- long sum = 0; +- +- for_each_possible_cpu(cpu) { +- sum += part_stat_local_read_cpu(part, in_flight[0], cpu); +- sum += part_stat_local_read_cpu(part, in_flight[1], cpu); +- } +- +- return sum != 0; +-} +- +-static bool md_in_flight(struct mapped_device *md) +-{ +- if (queue_is_mq(md->queue)) +- return blk_mq_queue_inflight(md->queue); +- else +- return md_in_flight_bios(md); +-} +- + u64 dm_start_time_ns_from_clone(struct bio *bio) + { + struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone); +@@ -2439,15 +2417,29 @@ void dm_put(struct mapped_device *md) + } + EXPORT_SYMBOL_GPL(dm_put); + +-static int dm_wait_for_completion(struct mapped_device *md, long task_state) ++static bool md_in_flight_bios(struct mapped_device *md) ++{ ++ int cpu; ++ struct hd_struct *part = &dm_disk(md)->part0; ++ long sum = 0; ++ ++ for_each_possible_cpu(cpu) { ++ sum += part_stat_local_read_cpu(part, in_flight[0], cpu); ++ sum += part_stat_local_read_cpu(part, in_flight[1], cpu); ++ } ++ ++ return sum != 0; ++} ++ ++static int dm_wait_for_bios_completion(struct mapped_device *md, long task_state) + { + int r = 0; + DEFINE_WAIT(wait); + +- while (1) { ++ while (true) { + prepare_to_wait(&md->wait, &wait, task_state); + +- if (!md_in_flight(md)) ++ if (!md_in_flight_bios(md)) + break; + + if (signal_pending_state(task_state, current)) { +@@ -2462,6 +2454,28 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state) + return r; + } + ++static int dm_wait_for_completion(struct mapped_device *md, long task_state) ++{ ++ int r = 0; ++ ++ if (!queue_is_mq(md->queue)) ++ return dm_wait_for_bios_completion(md, task_state); ++ ++ while (true) { ++ if (!blk_mq_queue_inflight(md->queue)) ++ break; ++ ++ if (signal_pending_state(task_state, current)) { ++ r = -EINTR; ++ break; ++ } ++ ++ msleep(5); ++ } ++ ++ return r; ++} ++ + /* + * Process the deferred bios + */ +-- +2.25.1 + diff --git a/queue-5.4/dm-mpath-pass-io-start-time-to-path-selector.patch b/queue-5.4/dm-mpath-pass-io-start-time-to-path-selector.patch new file mode 100644 index 00000000000..402c2368e4b --- /dev/null +++ b/queue-5.4/dm-mpath-pass-io-start-time-to-path-selector.patch @@ -0,0 +1,134 @@ +From d2ae7485cc17a3217e5d79b14de45b844c2d363f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 16:48:29 -0400 +Subject: dm mpath: pass IO start time to path selector + +From: Gabriel Krisman Bertazi + +[ Upstream commit 087615bf3acdafd0ba7c7c9ed5286e7b7c80fe1b ] + +The HST path selector needs this information to perform path +prediction. For request-based mpath, struct request's io_start_time_ns +is used, while for bio-based, use the start_time stored in dm_io. + +Signed-off-by: Gabriel Krisman Bertazi +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-mpath.c | 9 ++++++--- + drivers/md/dm-path-selector.h | 2 +- + drivers/md/dm-queue-length.c | 2 +- + drivers/md/dm-service-time.c | 2 +- + drivers/md/dm.c | 9 +++++++++ + include/linux/device-mapper.h | 2 ++ + 6 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index f2de4c73cc8fa..d7ebed50895f0 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -558,7 +558,8 @@ static void multipath_release_clone(struct request *clone, + if (pgpath && pgpath->pg->ps.type->end_io) + pgpath->pg->ps.type->end_io(&pgpath->pg->ps, + &pgpath->path, +- mpio->nr_bytes); ++ mpio->nr_bytes, ++ clone->io_start_time_ns); + } + + blk_put_request(clone); +@@ -1560,7 +1561,8 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone, + struct path_selector *ps = &pgpath->pg->ps; + + if (ps->type->end_io) +- ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes); ++ ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes, ++ clone->io_start_time_ns); + } + + return r; +@@ -1604,7 +1606,8 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone, + struct path_selector *ps = &pgpath->pg->ps; + + if (ps->type->end_io) +- ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes); ++ ps->type->end_io(ps, &pgpath->path, mpio->nr_bytes, ++ dm_start_time_ns_from_clone(clone)); + } + + return r; +diff --git a/drivers/md/dm-path-selector.h b/drivers/md/dm-path-selector.h +index b6eb5365b1a46..c47bc0e20275b 100644 +--- a/drivers/md/dm-path-selector.h ++++ b/drivers/md/dm-path-selector.h +@@ -74,7 +74,7 @@ struct path_selector_type { + int (*start_io) (struct path_selector *ps, struct dm_path *path, + size_t nr_bytes); + int (*end_io) (struct path_selector *ps, struct dm_path *path, +- size_t nr_bytes); ++ size_t nr_bytes, u64 start_time); + }; + + /* Register a path selector */ +diff --git a/drivers/md/dm-queue-length.c b/drivers/md/dm-queue-length.c +index 969c4f1a36336..5fd018d184187 100644 +--- a/drivers/md/dm-queue-length.c ++++ b/drivers/md/dm-queue-length.c +@@ -227,7 +227,7 @@ static int ql_start_io(struct path_selector *ps, struct dm_path *path, + } + + static int ql_end_io(struct path_selector *ps, struct dm_path *path, +- size_t nr_bytes) ++ size_t nr_bytes, u64 start_time) + { + struct path_info *pi = path->pscontext; + +diff --git a/drivers/md/dm-service-time.c b/drivers/md/dm-service-time.c +index f006a9005593b..9cfda665e9ebd 100644 +--- a/drivers/md/dm-service-time.c ++++ b/drivers/md/dm-service-time.c +@@ -309,7 +309,7 @@ static int st_start_io(struct path_selector *ps, struct dm_path *path, + } + + static int st_end_io(struct path_selector *ps, struct dm_path *path, +- size_t nr_bytes) ++ size_t nr_bytes, u64 start_time) + { + struct path_info *pi = path->pscontext; + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 3cf5b354568e5..1e7ad2ad48295 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -649,6 +649,15 @@ static bool md_in_flight(struct mapped_device *md) + return md_in_flight_bios(md); + } + ++u64 dm_start_time_ns_from_clone(struct bio *bio) ++{ ++ struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone); ++ struct dm_io *io = tio->io; ++ ++ return jiffies_to_nsecs(io->start_time); ++} ++EXPORT_SYMBOL_GPL(dm_start_time_ns_from_clone); ++ + static void start_io_acct(struct dm_io *io) + { + struct mapped_device *md = io->md; +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index 399ad86323568..ec19222f67666 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -328,6 +328,8 @@ void *dm_per_bio_data(struct bio *bio, size_t data_size); + struct bio *dm_bio_from_per_bio_data(void *data, size_t data_size); + unsigned dm_bio_get_target_bio_nr(const struct bio *bio); + ++u64 dm_start_time_ns_from_clone(struct bio *bio); ++ + int dm_register_target(struct target_type *t); + void dm_unregister_target(struct target_type *t); + +-- +2.25.1 + diff --git a/queue-5.4/dmabuf-use-spinlock-to-access-dmabuf-name.patch b/queue-5.4/dmabuf-use-spinlock-to-access-dmabuf-name.patch new file mode 100644 index 00000000000..73535535a28 --- /dev/null +++ b/queue-5.4/dmabuf-use-spinlock-to-access-dmabuf-name.patch @@ -0,0 +1,137 @@ +From 825d6edf0991d6b9f46e14f10fe33f55e46572a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 17:27:19 +0530 +Subject: dmabuf: use spinlock to access dmabuf->name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Charan Teja Kalla + +[ Upstream commit 6348dd291e3653534a9e28e6917569bc9967b35b ] + +There exists a sleep-while-atomic bug while accessing the dmabuf->name +under mutex in the dmabuffs_dname(). This is caused from the SELinux +permissions checks on a process where it tries to validate the inherited +files from fork() by traversing them through iterate_fd() (which +traverse files under spin_lock) and call +match_file(security/selinux/hooks.c) where the permission checks happen. +This audit information is logged using dump_common_audit_data() where it +calls d_path() to get the file path name. If the file check happen on +the dmabuf's fd, then it ends up in ->dmabuffs_dname() and use mutex to +access dmabuf->name. The flow will be like below: +flush_unauthorized_files() + iterate_fd() + spin_lock() --> Start of the atomic section. + match_file() + file_has_perm() + avc_has_perm() + avc_audit() + slow_avc_audit() + common_lsm_audit() + dump_common_audit_data() + audit_log_d_path() + d_path() + dmabuffs_dname() + mutex_lock()--> Sleep while atomic. + +Call trace captured (on 4.19 kernels) is below: +___might_sleep+0x204/0x208 +__might_sleep+0x50/0x88 +__mutex_lock_common+0x5c/0x1068 +__mutex_lock_common+0x5c/0x1068 +mutex_lock_nested+0x40/0x50 +dmabuffs_dname+0xa0/0x170 +d_path+0x84/0x290 +audit_log_d_path+0x74/0x130 +common_lsm_audit+0x334/0x6e8 +slow_avc_audit+0xb8/0xf8 +avc_has_perm+0x154/0x218 +file_has_perm+0x70/0x180 +match_file+0x60/0x78 +iterate_fd+0x128/0x168 +selinux_bprm_committing_creds+0x178/0x248 +security_bprm_committing_creds+0x30/0x48 +install_exec_creds+0x1c/0x68 +load_elf_binary+0x3a4/0x14e0 +search_binary_handler+0xb0/0x1e0 + +So, use spinlock to access dmabuf->name to avoid sleep-while-atomic. + +Cc: [5.3+] +Signed-off-by: Charan Teja Kalla +Reviewed-by: Michael J. Ruhl +Acked-by: Christian König + [sumits: added comment to spinlock_t definition to avoid warning] +Signed-off-by: Sumit Semwal +Link: https://patchwork.freedesktop.org/patch/msgid/a83e7f0d-4e54-9848-4b58-e1acdbe06735@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/dma-buf.c | 11 +++++++---- + include/linux/dma-buf.h | 1 + + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c +index cf65a47310c3a..eba7e3fe769cf 100644 +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -45,10 +45,10 @@ static char *dmabuffs_dname(struct dentry *dentry, char *buffer, int buflen) + size_t ret = 0; + + dmabuf = dentry->d_fsdata; +- mutex_lock(&dmabuf->lock); ++ spin_lock(&dmabuf->name_lock); + if (dmabuf->name) + ret = strlcpy(name, dmabuf->name, DMA_BUF_NAME_LEN); +- mutex_unlock(&dmabuf->lock); ++ spin_unlock(&dmabuf->name_lock); + + return dynamic_dname(dentry, buffer, buflen, "/%s:%s", + dentry->d_name.name, ret > 0 ? name : ""); +@@ -338,8 +338,10 @@ static long dma_buf_set_name(struct dma_buf *dmabuf, const char __user *buf) + kfree(name); + goto out_unlock; + } ++ spin_lock(&dmabuf->name_lock); + kfree(dmabuf->name); + dmabuf->name = name; ++ spin_unlock(&dmabuf->name_lock); + + out_unlock: + mutex_unlock(&dmabuf->lock); +@@ -402,10 +404,10 @@ static void dma_buf_show_fdinfo(struct seq_file *m, struct file *file) + /* Don't count the temporary reference taken inside procfs seq_show */ + seq_printf(m, "count:\t%ld\n", file_count(dmabuf->file) - 1); + seq_printf(m, "exp_name:\t%s\n", dmabuf->exp_name); +- mutex_lock(&dmabuf->lock); ++ spin_lock(&dmabuf->name_lock); + if (dmabuf->name) + seq_printf(m, "name:\t%s\n", dmabuf->name); +- mutex_unlock(&dmabuf->lock); ++ spin_unlock(&dmabuf->name_lock); + } + + static const struct file_operations dma_buf_fops = { +@@ -537,6 +539,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) + dmabuf->size = exp_info->size; + dmabuf->exp_name = exp_info->exp_name; + dmabuf->owner = exp_info->owner; ++ spin_lock_init(&dmabuf->name_lock); + init_waitqueue_head(&dmabuf->poll); + dmabuf->cb_excl.poll = dmabuf->cb_shared.poll = &dmabuf->poll; + dmabuf->cb_excl.active = dmabuf->cb_shared.active = 0; +diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h +index ec212cb27fdc6..12eac4293af66 100644 +--- a/include/linux/dma-buf.h ++++ b/include/linux/dma-buf.h +@@ -303,6 +303,7 @@ struct dma_buf { + void *vmap_ptr; + const char *exp_name; + const char *name; ++ spinlock_t name_lock; /* spinlock to protect name access */ + struct module *owner; + struct list_head list_node; + void *priv; +-- +2.25.1 + diff --git a/queue-5.4/drm-amd-display-check-dmcu-exists-before-loading.patch b/queue-5.4/drm-amd-display-check-dmcu-exists-before-loading.patch new file mode 100644 index 00000000000..7862e3d6a33 --- /dev/null +++ b/queue-5.4/drm-amd-display-check-dmcu-exists-before-loading.patch @@ -0,0 +1,41 @@ +From 450d69d82f6da097db9a0c858907dffa0d72780d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Apr 2020 14:09:23 -0400 +Subject: drm/amd/display: Check DMCU Exists Before Loading + +From: Jerry (Fangzhi) Zuo + +[ Upstream commit 17bdb4a82fe5014c8aa5b2103c80c5729744a096 ] + +Signed-off-by: Jerry (Fangzhi) Zuo +Reviewed-by: Hersen Wu +Acked-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 4fad0b603b3ab..c7d8edf450d3c 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -928,9 +928,14 @@ static int dm_late_init(void *handle) + struct dmcu_iram_parameters params; + unsigned int linear_lut[16]; + int i; +- struct dmcu *dmcu = adev->dm.dc->res_pool->dmcu; ++ struct dmcu *dmcu = NULL; + bool ret; + ++ if (!adev->dm.fw_dmcu) ++ return detect_mst_link_for_all_connectors(adev->ddev); ++ ++ dmcu = adev->dm.dc->res_pool->dmcu; ++ + for (i = 0; i < 16; i++) + linear_lut[i] = 0xFFFF * i / 15; + +-- +2.25.1 + diff --git a/queue-5.4/fuse-fix-weird-page-warning.patch b/queue-5.4/fuse-fix-weird-page-warning.patch new file mode 100644 index 00000000000..c80cca0492f --- /dev/null +++ b/queue-5.4/fuse-fix-weird-page-warning.patch @@ -0,0 +1,41 @@ +From 57ccade5eb7b2276621af12dc5dc4ca2397b119c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 15:54:59 -0300 +Subject: fuse: fix weird page warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miklos Szeredi + +commit a5005c3cda6eeb6b95645e6cc32f58dafeffc976 upstream. + +When PageWaiters was added, updating this check was missed. + +Reported-by: Nikolaus Rath +Reported-by: Hugh Dickins +Fixes: 62906027091f ("mm: add PageWaiters indicating tasks are waiting for a page bit") +Signed-off-by: Miklos Szeredi +Signed-off-by: André Almeida +Signed-off-by: Sasha Levin +--- + fs/fuse/dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 4f2e4f38feb86..06dd38e76c62a 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -771,7 +771,8 @@ static int fuse_check_page(struct page *page) + 1 << PG_uptodate | + 1 << PG_lru | + 1 << PG_active | +- 1 << PG_reclaim))) { ++ 1 << PG_reclaim | ++ 1 << PG_waiters))) { + pr_warn("trying to steal weird page\n"); + pr_warn(" page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping); + return 1; +-- +2.25.1 + diff --git a/queue-5.4/irqdomain-treewide-keep-firmware-node-unconditionall.patch b/queue-5.4/irqdomain-treewide-keep-firmware-node-unconditionall.patch new file mode 100644 index 00000000000..6674e52a142 --- /dev/null +++ b/queue-5.4/irqdomain-treewide-keep-firmware-node-unconditionall.patch @@ -0,0 +1,229 @@ +From 82de4bcd151fda8a7c83190fc4f6f2be29621814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 11:53:06 +0200 +Subject: irqdomain/treewide: Keep firmware node unconditionally allocated + +From: Thomas Gleixner + +[ Upstream commit e3beca48a45b5e0e6e6a4e0124276b8248dcc9bb ] + +Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type +IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after +creating the irqdomain. The only purpose of these FW nodes is to convey +name information. When this was introduced the core code did not store the +pointer to the node in the irqdomain. A recent change stored the firmware +node pointer in irqdomain for other reasons and missed to notice that the +usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence +are broken by this. Storing a dangling pointer is dangerous itself, but in +case that the domain is destroyed later on this leads to a double free. + +Remove the freeing of the firmware node after creating the irqdomain from +all affected call sites to cure this. + +Fixes: 711419e504eb ("irqdomain: Add the missing assignment of domain->fwnode for named fwnode") +Reported-by: Andy Shevchenko +Signed-off-by: Thomas Gleixner +Acked-by: Bjorn Helgaas +Acked-by: Marc Zyngier +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/873661qakd.fsf@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pci-xtalk-bridge.c | 5 +++-- + arch/x86/kernel/apic/io_apic.c | 10 +++++----- + arch/x86/kernel/apic/msi.c | 18 ++++++++++++------ + arch/x86/kernel/apic/vector.c | 1 - + arch/x86/platform/uv/uv_irq.c | 3 ++- + drivers/iommu/amd_iommu.c | 5 +++-- + drivers/iommu/hyperv-iommu.c | 5 ++++- + drivers/iommu/intel_irq_remapping.c | 2 +- + drivers/pci/controller/vmd.c | 5 +++-- + 9 files changed, 33 insertions(+), 21 deletions(-) + +diff --git a/arch/mips/pci/pci-xtalk-bridge.c b/arch/mips/pci/pci-xtalk-bridge.c +index 30017d5945bc2..6ce76b18186e5 100644 +--- a/arch/mips/pci/pci-xtalk-bridge.c ++++ b/arch/mips/pci/pci-xtalk-bridge.c +@@ -444,9 +444,10 @@ static int bridge_probe(struct platform_device *pdev) + return -ENOMEM; + domain = irq_domain_create_hierarchy(parent, 0, 8, fn, + &bridge_domain_ops, NULL); +- irq_domain_free_fwnode(fn); +- if (!domain) ++ if (!domain) { ++ irq_domain_free_fwnode(fn); + return -ENOMEM; ++ } + + pci_set_flags(PCI_PROBE_ONLY); + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index f0262cb5657a7..16699101fd2fe 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2329,12 +2329,12 @@ static int mp_irqdomain_create(int ioapic) + ip->irqdomain = irq_domain_create_linear(fn, hwirqs, cfg->ops, + (void *)(long)ioapic); + +- /* Release fw handle if it was allocated above */ +- if (!cfg->dev) +- irq_domain_free_fwnode(fn); +- +- if (!ip->irqdomain) ++ if (!ip->irqdomain) { ++ /* Release fw handle if it was allocated above */ ++ if (!cfg->dev) ++ irq_domain_free_fwnode(fn); + return -ENOMEM; ++ } + + ip->irqdomain->parent = parent; + +diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c +index 159bd0cb85486..a20873bbbed67 100644 +--- a/arch/x86/kernel/apic/msi.c ++++ b/arch/x86/kernel/apic/msi.c +@@ -262,12 +262,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent) + msi_default_domain = + pci_msi_create_irq_domain(fn, &pci_msi_domain_info, + parent); +- irq_domain_free_fwnode(fn); + } +- if (!msi_default_domain) ++ if (!msi_default_domain) { ++ irq_domain_free_fwnode(fn); + pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n"); +- else ++ } else { + msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK; ++ } + } + + #ifdef CONFIG_IRQ_REMAP +@@ -300,7 +301,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent, + if (!fn) + return NULL; + d = pci_msi_create_irq_domain(fn, &pci_msi_ir_domain_info, parent); +- irq_domain_free_fwnode(fn); ++ if (!d) ++ irq_domain_free_fwnode(fn); + return d; + } + #endif +@@ -363,7 +365,8 @@ static struct irq_domain *dmar_get_irq_domain(void) + if (fn) { + dmar_domain = msi_create_irq_domain(fn, &dmar_msi_domain_info, + x86_vector_domain); +- irq_domain_free_fwnode(fn); ++ if (!dmar_domain) ++ irq_domain_free_fwnode(fn); + } + out: + mutex_unlock(&dmar_lock); +@@ -488,7 +491,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id) + } + + d = msi_create_irq_domain(fn, domain_info, parent); +- irq_domain_free_fwnode(fn); ++ if (!d) { ++ irq_domain_free_fwnode(fn); ++ kfree(domain_info); ++ } + return d; + } + +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 18c0dca081633..df4d5385e6ddd 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -701,7 +701,6 @@ int __init arch_early_irq_init(void) + x86_vector_domain = irq_domain_create_tree(fn, &x86_vector_domain_ops, + NULL); + BUG_ON(x86_vector_domain == NULL); +- irq_domain_free_fwnode(fn); + irq_set_default_host(x86_vector_domain); + + arch_init_msi_domain(x86_vector_domain); +diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c +index fc13cbbb2dce2..abb6075397f05 100644 +--- a/arch/x86/platform/uv/uv_irq.c ++++ b/arch/x86/platform/uv/uv_irq.c +@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void) + goto out; + + uv_domain = irq_domain_create_tree(fn, &uv_domain_ops, NULL); +- irq_domain_free_fwnode(fn); + if (uv_domain) + uv_domain->parent = x86_vector_domain; ++ else ++ irq_domain_free_fwnode(fn); + out: + mutex_unlock(&uv_lock); + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 32de8e7bb8b45..3a7094f4813f2 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -4575,9 +4575,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu) + if (!fn) + return -ENOMEM; + iommu->ir_domain = irq_domain_create_tree(fn, &amd_ir_domain_ops, iommu); +- irq_domain_free_fwnode(fn); +- if (!iommu->ir_domain) ++ if (!iommu->ir_domain) { ++ irq_domain_free_fwnode(fn); + return -ENOMEM; ++ } + + iommu->ir_domain->parent = arch_get_ir_parent_domain(); + iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain, +diff --git a/drivers/iommu/hyperv-iommu.c b/drivers/iommu/hyperv-iommu.c +index a386b83e0e34b..f0fe5030acd36 100644 +--- a/drivers/iommu/hyperv-iommu.c ++++ b/drivers/iommu/hyperv-iommu.c +@@ -155,7 +155,10 @@ static int __init hyperv_prepare_irq_remapping(void) + 0, IOAPIC_REMAPPING_ENTRY, fn, + &hyperv_ir_domain_ops, NULL); + +- irq_domain_free_fwnode(fn); ++ if (!ioapic_ir_domain) { ++ irq_domain_free_fwnode(fn); ++ return -ENOMEM; ++ } + + /* + * Hyper-V doesn't provide irq remapping function for +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 81e43c1df7ecb..982d796b686b8 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -563,8 +563,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) + 0, INTR_REMAP_TABLE_ENTRIES, + fn, &intel_ir_domain_ops, + iommu); +- irq_domain_free_fwnode(fn); + if (!iommu->ir_domain) { ++ irq_domain_free_fwnode(fn); + pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); + goto out_free_bitmap; + } +diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c +index 87348ecfe3fcf..7c24c0aedad4a 100644 +--- a/drivers/pci/controller/vmd.c ++++ b/drivers/pci/controller/vmd.c +@@ -680,9 +680,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) + + vmd->irq_domain = pci_msi_create_irq_domain(fn, &vmd_msi_domain_info, + x86_vector_domain); +- irq_domain_free_fwnode(fn); +- if (!vmd->irq_domain) ++ if (!vmd->irq_domain) { ++ irq_domain_free_fwnode(fn); + return -ENODEV; ++ } + + pci_add_resource(&resources, &vmd->resources[0]); + pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]); +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 8f9771f25f1..ad8a0eeee26 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -14,3 +14,11 @@ scsi-mpt3sas-fix-error-returns-in-brm_status_show.patch scsi-dh-add-fujitsu-device-to-devinfo-and-dh-lists.patch dm-use-bio_uninit-instead-of-bio_disassociate_blkg.patch drivers-firmware-psci-fix-memory-leakage-in-alloc_in.patch +fuse-fix-weird-page-warning.patch +irqdomain-treewide-keep-firmware-node-unconditionall.patch +arm-dts-imx6qdl-gw551x-do-not-use-simple-audio-card-.patch +arm-dts-imx6qdl-gw551x-fix-audio-ssi.patch +dmabuf-use-spinlock-to-access-dmabuf-name.patch +drm-amd-display-check-dmcu-exists-before-loading.patch +dm-mpath-pass-io-start-time-to-path-selector.patch +dm-do-not-use-waitqueue-for-request-based-dm.patch