--- /dev/null
+From 00abf69dd24f4444d185982379c5cc3bb7b6d1fc Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Tue, 7 May 2019 09:20:54 -0400
+Subject: ceph: flush dirty inodes before proceeding with remount
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit 00abf69dd24f4444d185982379c5cc3bb7b6d1fc upstream.
+
+xfstest generic/452 was triggering a "Busy inodes after umount" warning.
+ceph was allowing the mount to go read-only without first flushing out
+dirty inodes in the cache. Ensure we sync out the filesystem before
+allowing a remount to proceed.
+
+Cc: stable@vger.kernel.org
+Link: http://tracker.ceph.com/issues/39571
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/super.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -845,6 +845,12 @@ static void ceph_umount_begin(struct sup
+ return;
+ }
+
++static int ceph_remount(struct super_block *sb, int *flags, char *data)
++{
++ sync_filesystem(sb);
++ return 0;
++}
++
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+ .destroy_inode = ceph_destroy_inode,
+@@ -852,6 +858,7 @@ static const struct super_operations cep
+ .drop_inode = ceph_drop_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
++ .remount_fs = ceph_remount,
+ .show_options = ceph_show_options,
+ .statfs = ceph_statfs,
+ .umount_begin = ceph_umount_begin,
--- /dev/null
+From 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa Mon Sep 17 00:00:00 2001
+From: Leo Yan <leo.yan@linaro.org>
+Date: Wed, 20 Mar 2019 18:05:08 +0800
+Subject: clk: hi3660: Mark clk_gate_ufs_subsys as critical
+
+From: Leo Yan <leo.yan@linaro.org>
+
+commit 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa upstream.
+
+clk_gate_ufs_subsys is a system bus clock, turning off it will
+introduce lockup issue during system suspend flow. Let's mark
+clk_gate_ufs_subsys as critical clock, thus keeps it on during
+system suspend and resume.
+
+Fixes: d374e6fd5088 ("clk: hisilicon: Add clock driver for hi3660 SoC")
+Cc: stable@vger.kernel.org
+Cc: Zhong Kaihua <zhongkaihua@huawei.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Zhangfei Gao <zhangfei.gao@linaro.org>
+Suggested-by: Dong Zhang <zhangdong46@hisilicon.com>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/hisilicon/clk-hi3660.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi36
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, },
+ { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2",
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, },
++ /*
++ * clk_gate_ufs_subsys is a system bus clock, mark it as critical
++ * clock and keep it on for system suspend and resume.
++ */
+ { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus",
+- CLK_SET_RATE_PARENT, 0x50, 21, 0, },
++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, },
+ { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus",
+ CLK_SET_RATE_PARENT, 0x50, 28, 0, },
+ { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus",
--- /dev/null
+From be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb Mon Sep 17 00:00:00 2001
+From: Owen Chen <owen.chen@mediatek.com>
+Date: Tue, 5 Mar 2019 13:05:38 +0800
+Subject: clk: mediatek: Disable tuner_en before change PLL rate
+
+From: Owen Chen <owen.chen@mediatek.com>
+
+commit be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb upstream.
+
+PLLs with tuner_en bit, such as APLL1, need to disable
+tuner_en before apply new frequency settings, or the new frequency
+settings (pcw) will not be applied.
+The tuner_en bit will be disabled during changing PLL rate
+and be restored after new settings applied.
+
+Fixes: e2f744a82d725 (clk: mediatek: Add MT2712 clock support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Owen Chen <owen.chen@mediatek.com>
+Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>
+Reviewed-by: James Liao <jamesjj.liao@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/mediatek/clk-pll.c | 48 +++++++++++++++++++++++++++++------------
+ 1 file changed, 34 insertions(+), 14 deletions(-)
+
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_ra
+ return ((unsigned long)vco + postdiv - 1) / postdiv;
+ }
+
++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
+ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ int postdiv)
+ {
+@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct
+
+ pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN;
+
++ /* disable tuner */
++ __mtk_pll_tuner_disable(pll);
++
+ /* set postdiv */
+ val = readl(pll->pd_addr);
+ val &= ~(POSTDIV_MASK << pll->data->pd_shift);
+@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct
+ if (pll->tuner_addr)
+ writel(con1 + 1, pll->tuner_addr);
+
++ /* restore tuner_en */
++ __mtk_pll_tuner_enable(pll);
++
+ if (pll_en)
+ udelay(20);
+ }
+@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw
+ r |= pll->data->en_mask;
+ writel(r, pll->base_addr + REG_CON0);
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_enable(pll);
+
+ udelay(20);
+
+@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk
+ writel(r, pll->base_addr + REG_CON0);
+ }
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_disable(pll);
+
+ r = readl(pll->base_addr + REG_CON0);
+ r &= ~CON0_BASE_EN;
--- /dev/null
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: clk: rockchip: fix wrong clock definitions for rk3328
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit fb903392131a324a243c7731389277db1cd9f8df upstream.
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struc
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
--- /dev/null
+From 40db569d6769ffa3864fd1b89616b1a7323568a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 00:48:34 +0300
+Subject: clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 40db569d6769ffa3864fd1b89616b1a7323568a8 upstream.
+
+There are wrongly set parenthesis in the code that are resulting in a
+wrong configuration being programmed for PLLM. The original fix was made
+by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
+Tegra124 chromebook, PLLM rate changing works correctly now and system
+doesn't lock up after changing the PLLM rate due to EMC scaling.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/tegra/clk-pll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -663,8 +663,8 @@ static void _update_pll_mnp(struct tegra
+ pll_override_writel(val, params->pmc_divp_reg, pll);
+
+ val = pll_override_readl(params->pmc_divnm_reg, pll);
+- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+- ~(divn_mask(pll) << div_nmp->override_divn_shift);
++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++ (divn_mask(pll) << div_nmp->override_divn_shift));
+ val |= (cfg->m << div_nmp->override_divm_shift) |
+ (cfg->n << div_nmp->override_divn_shift);
+ pll_override_writel(val, params->pmc_divnm_reg, pll);
--- /dev/null
+From 4d8e7055a4058ee191296699803c5090e14f0dff Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Sun, 5 May 2019 12:15:49 +0300
+Subject: fsnotify: fix unlink performance regression
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 4d8e7055a4058ee191296699803c5090e14f0dff upstream.
+
+__fsnotify_parent() has an optimization in place to avoid unneeded
+take_dentry_name_snapshot(). When fsnotify_nameremove() was changed
+not to call __fsnotify_parent(), we left out the optimization.
+Kernel test robot reported a 5% performance regression in concurrent
+unlink() workload.
+
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Link: https://lore.kernel.org/lkml/20190505062153.GG29809@shao2-debian/
+Link: https://lore.kernel.org/linux-fsdevel/20190104090357.GD22409@quack2.suse.cz/
+Fixes: 5f02a8776384 ("fsnotify: annotate directory entry modification events")
+CC: stable@vger.kernel.org
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/notify/fsnotify.c | 41 +++++++++++++++++++++++++++++++++++++++
+ include/linux/fsnotify.h | 33 -------------------------------
+ include/linux/fsnotify_backend.h | 4 +++
+ 3 files changed, 45 insertions(+), 33 deletions(-)
+
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -108,6 +108,47 @@ void fsnotify_sb_delete(struct super_blo
+ }
+
+ /*
++ * fsnotify_nameremove - a filename was removed from a directory
++ *
++ * This is mostly called under parent vfs inode lock so name and
++ * dentry->d_parent should be stable. However there are some corner cases where
++ * inode lock is not held. So to be on the safe side and be reselient to future
++ * callers and out of tree users of d_delete(), we do not assume that d_parent
++ * and d_name are stable and we use dget_parent() and
++ * take_dentry_name_snapshot() to grab stable references.
++ */
++void fsnotify_nameremove(struct dentry *dentry, int isdir)
++{
++ struct dentry *parent;
++ struct name_snapshot name;
++ __u32 mask = FS_DELETE;
++
++ /* d_delete() of pseudo inode? (e.g. __ns_get_path() playing tricks) */
++ if (IS_ROOT(dentry))
++ return;
++
++ if (isdir)
++ mask |= FS_ISDIR;
++
++ parent = dget_parent(dentry);
++ /* Avoid unneeded take_dentry_name_snapshot() */
++ if (!(d_inode(parent)->i_fsnotify_mask & FS_DELETE) &&
++ !(dentry->d_sb->s_fsnotify_mask & FS_DELETE))
++ goto out_dput;
++
++ take_dentry_name_snapshot(&name, dentry);
++
++ fsnotify(d_inode(parent), mask, d_inode(dentry), FSNOTIFY_EVENT_INODE,
++ name.name, 0);
++
++ release_dentry_name_snapshot(&name);
++
++out_dput:
++ dput(parent);
++}
++EXPORT_SYMBOL(fsnotify_nameremove);
++
++/*
+ * Given an inode, first check if we care what happens to our children. Inotify
+ * and dnotify both tell their parents about events. If we care about any event
+ * on a child we run all of our children and set a dentry flag saying that the
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -152,39 +152,6 @@ static inline void fsnotify_vfsmount_del
+ }
+
+ /*
+- * fsnotify_nameremove - a filename was removed from a directory
+- *
+- * This is mostly called under parent vfs inode lock so name and
+- * dentry->d_parent should be stable. However there are some corner cases where
+- * inode lock is not held. So to be on the safe side and be reselient to future
+- * callers and out of tree users of d_delete(), we do not assume that d_parent
+- * and d_name are stable and we use dget_parent() and
+- * take_dentry_name_snapshot() to grab stable references.
+- */
+-static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
+-{
+- struct dentry *parent;
+- struct name_snapshot name;
+- __u32 mask = FS_DELETE;
+-
+- /* d_delete() of pseudo inode? (e.g. __ns_get_path() playing tricks) */
+- if (IS_ROOT(dentry))
+- return;
+-
+- if (isdir)
+- mask |= FS_ISDIR;
+-
+- parent = dget_parent(dentry);
+- take_dentry_name_snapshot(&name, dentry);
+-
+- fsnotify(d_inode(parent), mask, d_inode(dentry), FSNOTIFY_EVENT_INODE,
+- name.name, 0);
+-
+- release_dentry_name_snapshot(&name);
+- dput(parent);
+-}
+-
+-/*
+ * fsnotify_inoderemove - an inode is going away
+ */
+ static inline void fsnotify_inoderemove(struct inode *inode)
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -355,6 +355,7 @@ extern int __fsnotify_parent(const struc
+ extern void __fsnotify_inode_delete(struct inode *inode);
+ extern void __fsnotify_vfsmount_delete(struct vfsmount *mnt);
+ extern void fsnotify_sb_delete(struct super_block *sb);
++extern void fsnotify_nameremove(struct dentry *dentry, int isdir);
+ extern u32 fsnotify_get_cookie(void);
+
+ static inline int fsnotify_inode_watches_children(struct inode *inode)
+@@ -524,6 +525,9 @@ static inline void __fsnotify_vfsmount_d
+ static inline void fsnotify_sb_delete(struct super_block *sb)
+ {}
+
++static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
++{}
++
+ static inline void fsnotify_update_flags(struct dentry *dentry)
+ {}
+
--- /dev/null
+From 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 24 Apr 2019 17:05:06 +0200
+Subject: fuse: fix writepages on 32bit
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 upstream.
+
+Writepage requests were cropped to i_size & 0xffffffff, which meant that
+mmaped writes to any file larger than 4G might be silently discarded.
+
+Fix by storing the file size in a properly sized variable (loff_t instead
+of size_t).
+
+Reported-by: Antonio SJ Musumeci <trapexit@spawn.link>
+Fixes: 6eaf4782eb09 ("fuse: writepages: crop secondary requests")
+Cc: <stable@vger.kernel.org> # v3.13
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1586,7 +1586,7 @@ __acquires(fi->lock)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ struct fuse_inode *fi = get_fuse_inode(inode);
+- size_t crop = i_size_read(inode);
++ loff_t crop = i_size_read(inode);
+ struct fuse_req *req;
+
+ while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
--- /dev/null
+From 0cbade024ba501313da3b7e5dd2a188a6bc491b5 Mon Sep 17 00:00:00 2001
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Thu, 18 Apr 2019 04:04:41 +0800
+Subject: fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
+
+From: Liu Bo <bo.liu@linux.alibaba.com>
+
+commit 0cbade024ba501313da3b7e5dd2a188a6bc491b5 upstream.
+
+fstests generic/228 reported this failure that fuse fallocate does not
+honor what 'ulimit -f' has set.
+
+This adds the necessary inode_newsize_ok() check.
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation")
+Cc: <stable@vger.kernel.org> # v3.5
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -3044,6 +3044,13 @@ static long fuse_file_fallocate(struct f
+ }
+ }
+
++ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
++ offset + length > i_size_read(inode)) {
++ err = inode_newsize_ok(inode, offset + length);
++ if (err)
++ return err;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE))
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
--- /dev/null
+From 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Fri, 10 May 2019 21:00:25 +1200
+Subject: gcc-plugins: arm_ssp_per_task_plugin: Fix for older GCC < 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e upstream.
+
+Use gen_rtx_set instead of gen_rtx_SET. The former is a wrapper macro
+that handles the difference between GCC versions implementing
+the latter.
+
+This fixes the following error on my system with g++ 5.4.0 as the host
+compiler
+
+ HOSTCXX -fPIC scripts/gcc-plugins/arm_ssp_per_task_plugin.o
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:42:14: error: macro "gen_rtx_SET" requires 3 arguments, but only 2 given
+ mask)),
+ ^
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c: In function ‘unsigned int arm_pertask_ssp_rtl_execute()’:
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:39:20: error: ‘gen_rtx_SET’ was not declared in this scope
+ emit_insn_before(gen_rtx_SET
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
+Cc: stable@vger.kernel.org
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
++++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+@@ -36,7 +36,7 @@ static unsigned int arm_pertask_ssp_rtl_
+ mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
+ masked_sp = gen_reg_rtx(Pmode);
+
+- emit_insn_before(gen_rtx_SET(masked_sp,
++ emit_insn_before(gen_rtx_set(masked_sp,
+ gen_rtx_AND(Pmode,
+ stack_pointer_rtx,
+ mask)),
--- /dev/null
+From 43a0541e312f7136e081e6bf58f6c8a2e9672688 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:50:07 +0300
+Subject: iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 43a0541e312f7136e081e6bf58f6c8a2e9672688 upstream.
+
+Both Tegra30 and Tegra114 have 4 ASID's and the corresponding bitfield of
+the TLB_FLUSH register differs from later Tegra generations that have 128
+ASID's.
+
+In a result the PTE's are now flushed correctly from TLB and this fixes
+problems with graphics (randomly failing tests) on Tegra30.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/tegra-smmu.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegr
+ #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0)
+-#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24)
+ #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \
+ SMMU_TLB_FLUSH_VA_MATCH_SECTION)
+ #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \
+@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(s
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_MATCH_ALL;
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL;
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_sectio
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_SECTION(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group(
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_GROUP(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
--- /dev/null
+From f02f3755dbd14fb935d24b14650fff9ba92243b8 Mon Sep 17 00:00:00 2001
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 6 May 2019 11:57:03 +0800
+Subject: NFS4: Fix v4.0 client state corruption when mount
+
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+
+commit f02f3755dbd14fb935d24b14650fff9ba92243b8 upstream.
+
+stat command with soft mount never return after server is stopped.
+
+When alloc a new client, the state of the client will be set to
+NFS4CLNT_LEASE_EXPIRED.
+
+When the server is stopped, the state manager will work, and accord
+the state to recover. But the state is NFS4CLNT_LEASE_EXPIRED, it
+will drain the slot table and lead other task to wait queue, until
+the client recovered. Then the stat command is hung.
+
+When discover server trunking, the client will renew the lease,
+but check the client state, it lead the client state corruption.
+
+So, we need to call state manager to recover it when detect server
+ip trunking.
+
+Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struc
+ /* Sustain the lease, even if it's empty. If the clientid4
+ * goes stale it's of no use for trunking discovery. */
+ nfs4_schedule_state_renewal(*result);
++
++ /* If the client state need to recover, do it. */
++ if (clp->cl_state)
++ nfs4_schedule_state_manager(clp);
+ }
+ out:
+ return status;
--- /dev/null
+From 3428030da004a1128cbdcf93dc03e16f184d845b Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Tue, 22 Jan 2019 07:01:39 +0200
+Subject: ovl: fix missing upper fs freeze protection on copy up for ioctl
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream.
+
+Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file
+with data before FS_IOC_SETFLAGS ioctl.
+
+The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably
+caused the confusion. File may be open O_RDONLY, but ioctl modifies the
+file. VFS does not call mnt_want_write_file() nor lock inode mutex, but
+fs-specific code for FS_IOC_SETFLAGS does. So ovl_ioctl() calls
+mnt_want_write_file() for the overlay file, and fs-specific code calls
+mnt_want_write_file() for upper fs file, but there was no call for
+ovl_want_write() for copy up duration which prevents overlayfs from copying
+up on a frozen upper fs.
+
+Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/copy_up.c | 6 +++---
+ fs/overlayfs/file.c | 5 ++---
+ fs/overlayfs/overlayfs.h | 2 +-
+ 3 files changed, 6 insertions(+), 7 deletions(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -909,14 +909,14 @@ static bool ovl_open_need_copy_up(struct
+ return true;
+ }
+
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags)
++int ovl_maybe_copy_up(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+
+- if (ovl_open_need_copy_up(dentry, file_flags)) {
++ if (ovl_open_need_copy_up(dentry, flags)) {
+ err = ovl_want_write(dentry);
+ if (!err) {
+- err = ovl_copy_up_flags(dentry, file_flags);
++ err = ovl_copy_up_flags(dentry, flags);
+ ovl_drop_write(dentry);
+ }
+ }
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct f
+
+ static int ovl_open(struct inode *inode, struct file *file)
+ {
+- struct dentry *dentry = file_dentry(file);
+ struct file *realfile;
+ int err;
+
+- err = ovl_open_maybe_copy_up(dentry, file->f_flags);
++ err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
+ if (err)
+ return err;
+
+@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file,
+ if (ret)
+ return ret;
+
+- ret = ovl_copy_up_with_data(file_dentry(file));
++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+ if (!ret) {
+ ret = ovl_real_ioctl(file, cmd, arg);
+
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -421,7 +421,7 @@ extern const struct file_operations ovl_
+ int ovl_copy_up(struct dentry *dentry);
+ int ovl_copy_up_with_data(struct dentry *dentry);
+ int ovl_copy_up_flags(struct dentry *dentry, int flags);
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
++int ovl_maybe_copy_up(struct dentry *dentry, int flags);
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new);
+ int ovl_set_attr(struct dentry *upper, struct kstat *stat);
+ struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper);
--- /dev/null
+From b1029c9bc078a6f1515f55dd993b507dcc7e3440 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Tue, 7 May 2019 13:41:49 -0400
+Subject: PNFS fallback to MDS if no deviceid found
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+commit b1029c9bc078a6f1515f55dd993b507dcc7e3440 upstream.
+
+If we fail to find a good deviceid while trying to pnfs instead of
+propogating an error back fallback to doing IO to the MDS. Currently,
+code with fals the IO with EINVAL.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 8d40b0f14846f ("NFS filelayout:call GETDEVICEINFO after pnfs_layout_process completes"
+Cc: stable@vger.kernel.org # v4.11+
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/filelayout/filelayout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino,
+ status = filelayout_check_deviceid(lo, fl, gfp_flags);
+ if (status) {
+ pnfs_put_lseg(lseg);
+- lseg = ERR_PTR(status);
++ lseg = NULL;
+ }
+ out:
+ return lseg;
--- /dev/null
+From b79656ed44c6865e17bcd93472ec39488bcc4984 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Mon, 6 May 2019 14:23:04 +0300
+Subject: RDMA/ipoib: Allow user space differentiate between valid dev_port
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+commit b79656ed44c6865e17bcd93472ec39488bcc4984 upstream.
+
+Systemd triggers the following warning during IPoIB device load:
+
+ mlx5_core 0000:00:0c.0 ib0: "systemd-udevd" wants to know my dev_id.
+ Should it look at dev_port instead?
+ See Documentation/ABI/testing/sysfs-class-net for more info.
+
+This is caused due to user space attempt to differentiate old systems
+without dev_port and new systems with dev_port. In case dev_port will be
+zero, the systemd will try to read dev_id instead.
+
+There is no need to print a warning in such case, because it is valid
+situation and it is needed to ensure systemd compatibility with old
+kernels.
+
+Link: https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
+Cc: <stable@vger.kernel.org> # 4.19
+Fixes: f6350da41dc7 ("IB/ipoib: Log sysfs 'dev_id' accesses from userspace")
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2402,7 +2402,18 @@ static ssize_t dev_id_show(struct device
+ {
+ struct net_device *ndev = to_net_dev(dev);
+
+- if (ndev->dev_id == ndev->dev_port)
++ /*
++ * ndev->dev_port will be equal to 0 in old kernel prior to commit
++ * 9b8b2a323008 ("IB/ipoib: Use dev_port to expose network interface
++ * port numbers") Zero was chosen as special case for user space
++ * applications to fallback and query dev_id to check if it has
++ * different value or not.
++ *
++ * Don't print warning in such scenario.
++ *
++ * https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
++ */
++ if (ndev->dev_port && ndev->dev_id == ndev->dev_port)
+ netdev_info_once(ndev,
+ "\"%s\" wants to know my dev_id. Should it look at dev_port instead? See Documentation/ABI/testing/sysfs-class-net for more info.\n",
+ current->comm);
--- /dev/null
+From ddcdc368b1033e19fd3a5f750752e10e28a87826 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 16 Apr 2019 14:07:29 +0300
+Subject: RDMA/mlx5: Use get_zeroed_page() for clock_info
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit ddcdc368b1033e19fd3a5f750752e10e28a87826 upstream.
+
+get_zeroed_page() returns a virtual address for the page which is better
+than allocating a struct page and doing a permanent kmap on it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 5 ++-
+ drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 30 +++++++-------------
+ include/linux/mlx5/driver.h | 1
+ 3 files changed, 14 insertions(+), 22 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2070,11 +2070,12 @@ static int mlx5_ib_mmap_clock_info_page(
+ return -EPERM;
+ vma->vm_flags &= ~VM_MAYWRITE;
+
+- if (!dev->mdev->clock_info_page)
++ if (!dev->mdev->clock_info)
+ return -EOPNOTSUPP;
+
+ return rdma_user_mmap_page(&context->ibucontext, vma,
+- dev->mdev->clock_info_page, PAGE_SIZE);
++ virt_to_page(dev->mdev->clock_info),
++ PAGE_SIZE);
+ }
+
+ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd,
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -535,23 +535,16 @@ void mlx5_init_clock(struct mlx5_core_de
+ do_div(ns, NSEC_PER_SEC / HZ);
+ clock->overflow_period = ns;
+
+- mdev->clock_info_page = alloc_page(GFP_KERNEL);
+- if (mdev->clock_info_page) {
+- mdev->clock_info = kmap(mdev->clock_info_page);
+- if (!mdev->clock_info) {
+- __free_page(mdev->clock_info_page);
+- mlx5_core_warn(mdev, "failed to map clock page\n");
+- } else {
+- mdev->clock_info->sign = 0;
+- mdev->clock_info->nsec = clock->tc.nsec;
+- mdev->clock_info->cycles = clock->tc.cycle_last;
+- mdev->clock_info->mask = clock->cycles.mask;
+- mdev->clock_info->mult = clock->nominal_c_mult;
+- mdev->clock_info->shift = clock->cycles.shift;
+- mdev->clock_info->frac = clock->tc.frac;
+- mdev->clock_info->overflow_period =
+- clock->overflow_period;
+- }
++ mdev->clock_info =
++ (struct mlx5_ib_clock_info *)get_zeroed_page(GFP_KERNEL);
++ if (mdev->clock_info) {
++ mdev->clock_info->nsec = clock->tc.nsec;
++ mdev->clock_info->cycles = clock->tc.cycle_last;
++ mdev->clock_info->mask = clock->cycles.mask;
++ mdev->clock_info->mult = clock->nominal_c_mult;
++ mdev->clock_info->shift = clock->cycles.shift;
++ mdev->clock_info->frac = clock->tc.frac;
++ mdev->clock_info->overflow_period = clock->overflow_period;
+ }
+
+ INIT_WORK(&clock->pps_info.out_work, mlx5_pps_out);
+@@ -599,8 +592,7 @@ void mlx5_cleanup_clock(struct mlx5_core
+ cancel_delayed_work_sync(&clock->overflow_work);
+
+ if (mdev->clock_info) {
+- kunmap(mdev->clock_info_page);
+- __free_page(mdev->clock_info_page);
++ free_page((unsigned long)mdev->clock_info);
+ mdev->clock_info = NULL;
+ }
+
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -681,7 +681,6 @@ struct mlx5_core_dev {
+ #endif
+ struct mlx5_clock clock;
+ struct mlx5_ib_clock_info *clock_info;
+- struct page *clock_info_page;
+ struct mlx5_fw_tracer *tracer;
+ };
+
media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
media-imx-rename-functions-that-add-ipu-internal-subdevs.patch
media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch
+rdma-mlx5-use-get_zeroed_page-for-clock_info.patch
+rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch
+nfs4-fix-v4.0-client-state-corruption-when-mount.patch
+pnfs-fallback-to-mds-if-no-deviceid-found.patch
+clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch
+clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch
+clk-mediatek-disable-tuner_en-before-change-pll-rate.patch
+clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
+udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch
+udlfb-fix-sleeping-inside-spinlock.patch
+udlfb-introduce-a-rendering-mutex.patch
+fuse-fix-writepages-on-32bit.patch
+fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch
+ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch
+fsnotify-fix-unlink-performance-regression.patch
+gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch
+iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch
+ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
--- /dev/null
+From bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: delete the unused parameter for dlfb_handle_damage
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 upstream.
+
+Remove the unused parameter "data" and unused variable "ret".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -594,10 +594,9 @@ static int dlfb_render_hline(struct dlfb
+ return 0;
+ }
+
+-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+- int width, int height, char *data)
++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i, ret;
++ int i;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -641,7 +640,7 @@ static int dlfb_handle_damage(struct dlf
+ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+ len = cmd - (char *) urb->transfer_buffer;
+- ret = dlfb_submit_urb(dlfb, urb, len);
++ dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+ dlfb_urb_completion(urb);
+@@ -679,7 +678,7 @@ static ssize_t dlfb_ops_write(struct fb_
+ (u32)info->var.yres);
+
+ dlfb_handle_damage(dlfb, 0, start, info->var.xres,
+- lines, info->screen_base);
++ lines);
+ }
+
+ return result;
+@@ -695,7 +694,7 @@ static void dlfb_ops_copyarea(struct fb_
+ sys_copyarea(info, area);
+
+ dlfb_handle_damage(dlfb, area->dx, area->dy,
+- area->width, area->height, info->screen_base);
++ area->width, area->height);
+ }
+
+ static void dlfb_ops_imageblit(struct fb_info *info,
+@@ -706,7 +705,7 @@ static void dlfb_ops_imageblit(struct fb
+ sys_imageblit(info, image);
+
+ dlfb_handle_damage(dlfb, image->dx, image->dy,
+- image->width, image->height, info->screen_base);
++ image->width, image->height);
+ }
+
+ static void dlfb_ops_fillrect(struct fb_info *info,
+@@ -717,7 +716,7 @@ static void dlfb_ops_fillrect(struct fb_
+ sys_fillrect(info, rect);
+
+ dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
+- rect->height, info->screen_base);
++ rect->height);
+ }
+
+ /*
+@@ -859,8 +858,7 @@ static int dlfb_ops_ioctl(struct fb_info
+ if (area.y > info->var.yres)
+ area.y = info->var.yres;
+
+- dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h);
+ }
+
+ return 0;
+@@ -1065,8 +1063,7 @@ static int dlfb_ops_set_par(struct fb_in
+ pix_framebuffer[i] = 0x37e6;
+ }
+
+- dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres);
+
+ return 0;
+ }
--- /dev/null
+From 6b11f9d8433b471fdd3ebed232b43a4b723be6ff Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: fix sleeping inside spinlock
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6b11f9d8433b471fdd3ebed232b43a4b723be6ff upstream.
+
+If a framebuffer device is used as a console, the rendering calls
+(copyarea, fillrect, imageblit) may be done with the console spinlock
+held. On udlfb, these function call dlfb_handle_damage that takes a
+blocking semaphore before acquiring an URB.
+
+In order to fix the bug, this patch changes the calls copyarea, fillrect
+and imageblit to offload USB work to a workqueue.
+
+A side effect of this patch is 3x improvement in console scrolling speed
+because the device doesn't have to be updated after each copyarea call.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 56 +++++++++++++++++++++++++++++++++++++++++---
+ include/video/udlfb.h | 6 ++++
+ 2 files changed, 59 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -657,6 +657,50 @@ error:
+ return 0;
+ }
+
++static void dlfb_init_damage(struct dlfb_data *dlfb)
++{
++ dlfb->damage_x = INT_MAX;
++ dlfb->damage_x2 = 0;
++ dlfb->damage_y = INT_MAX;
++ dlfb->damage_y2 = 0;
++}
++
++static void dlfb_damage_work(struct work_struct *w)
++{
++ struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work);
++ int x, x2, y, y2;
++
++ spin_lock_irq(&dlfb->damage_lock);
++ x = dlfb->damage_x;
++ x2 = dlfb->damage_x2;
++ y = dlfb->damage_y;
++ y2 = dlfb->damage_y2;
++ dlfb_init_damage(dlfb);
++ spin_unlock_irq(&dlfb->damage_lock);
++
++ if (x < x2 && y < y2)
++ dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y);
++}
++
++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
++{
++ unsigned long flags;
++ int x2 = x + width;
++ int y2 = y + height;
++
++ if (x >= x2 || y >= y2)
++ return;
++
++ spin_lock_irqsave(&dlfb->damage_lock, flags);
++ dlfb->damage_x = min(x, dlfb->damage_x);
++ dlfb->damage_x2 = max(x2, dlfb->damage_x2);
++ dlfb->damage_y = min(y, dlfb->damage_y);
++ dlfb->damage_y2 = max(y2, dlfb->damage_y2);
++ spin_unlock_irqrestore(&dlfb->damage_lock, flags);
++
++ schedule_work(&dlfb->damage_work);
++}
++
+ /*
+ * Path triggered by usermode clients who write to filesystem
+ * e.g. cat filename > /dev/fb1
+@@ -693,7 +737,7 @@ static void dlfb_ops_copyarea(struct fb_
+
+ sys_copyarea(info, area);
+
+- dlfb_handle_damage(dlfb, area->dx, area->dy,
++ dlfb_offload_damage(dlfb, area->dx, area->dy,
+ area->width, area->height);
+ }
+
+@@ -704,7 +748,7 @@ static void dlfb_ops_imageblit(struct fb
+
+ sys_imageblit(info, image);
+
+- dlfb_handle_damage(dlfb, image->dx, image->dy,
++ dlfb_offload_damage(dlfb, image->dx, image->dy,
+ image->width, image->height);
+ }
+
+@@ -715,7 +759,7 @@ static void dlfb_ops_fillrect(struct fb_
+
+ sys_fillrect(info, rect);
+
+- dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
++ dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width,
+ rect->height);
+ }
+
+@@ -940,6 +984,8 @@ static void dlfb_ops_destroy(struct fb_i
+ {
+ struct dlfb_data *dlfb = info->par;
+
++ cancel_work_sync(&dlfb->damage_work);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1636,6 +1682,10 @@ static int dlfb_usb_probe(struct usb_int
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ dlfb_init_damage(dlfb);
++ spin_lock_init(&dlfb->damage_lock);
++ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
++
+ INIT_LIST_HEAD(&info->modelist);
+
+ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,12 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ int damage_x;
++ int damage_y;
++ int damage_x2;
++ int damage_y2;
++ spinlock_t damage_lock;
++ struct work_struct damage_work;
+ struct fb_ops ops;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
--- /dev/null
+From babc250e278eac7b0e671bdaedf833759b43bb78 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:57 +0200
+Subject: udlfb: introduce a rendering mutex
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit babc250e278eac7b0e671bdaedf833759b43bb78 upstream.
+
+Rendering calls may be done simultaneously from the workqueue,
+dlfb_ops_write, dlfb_ops_ioctl, dlfb_ops_set_par and dlfb_dpy_deferred_io.
+The code is robust enough so that it won't crash on concurrent rendering.
+
+However, concurrent rendering may cause display corruption if the same
+pixel is simultaneously being rendered. In order to avoid this corruption,
+this patch adds a mutex around the rendering calls.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+[b.zolnierkie: replace "dlfb:" with "uldfb:" in the patch summary]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 41 ++++++++++++++++++++++++++++++-----------
+ include/video/udlfb.h | 1 +
+ 2 files changed, 31 insertions(+), 11 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -596,7 +596,7 @@ static int dlfb_render_hline(struct dlfb
+
+ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i;
++ int i, ret;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -606,21 +606,29 @@ static int dlfb_handle_damage(struct dlf
+
+ start_cycles = get_cycles();
+
++ mutex_lock(&dlfb->render_mutex);
++
+ aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long));
+ width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long));
+ x = aligned_x;
+
+ if ((width <= 0) ||
+ (x + width > dlfb->info->var.xres) ||
+- (y + height > dlfb->info->var.yres))
+- return -EINVAL;
++ (y + height > dlfb->info->var.yres)) {
++ ret = -EINVAL;
++ goto unlock_ret;
++ }
+
+- if (!atomic_read(&dlfb->usb_active))
+- return 0;
++ if (!atomic_read(&dlfb->usb_active)) {
++ ret = 0;
++ goto unlock_ret;
++ }
+
+ urb = dlfb_get_urb(dlfb);
+- if (!urb)
+- return 0;
++ if (!urb) {
++ ret = 0;
++ goto unlock_ret;
++ }
+ cmd = urb->transfer_buffer;
+
+ for (i = y; i < y + height ; i++) {
+@@ -654,7 +662,11 @@ error:
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
+
+- return 0;
++ ret = 0;
++
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
++ return ret;
+ }
+
+ static void dlfb_init_damage(struct dlfb_data *dlfb)
+@@ -782,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct
+ int bytes_identical = 0;
+ int bytes_rendered = 0;
+
++ mutex_lock(&dlfb->render_mutex);
++
+ if (!fb_defio)
+- return;
++ goto unlock_ret;
+
+ if (!atomic_read(&dlfb->usb_active))
+- return;
++ goto unlock_ret;
+
+ start_cycles = get_cycles();
+
+ urb = dlfb_get_urb(dlfb);
+ if (!urb)
+- return;
++ goto unlock_ret;
+
+ cmd = urb->transfer_buffer;
+
+@@ -825,6 +839,8 @@ error:
+ atomic_add(((unsigned int) ((end_cycles - start_cycles)
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
+ }
+
+ static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len)
+@@ -986,6 +1002,8 @@ static void dlfb_ops_destroy(struct fb_i
+
+ cancel_work_sync(&dlfb->damage_work);
+
++ mutex_destroy(&dlfb->render_mutex);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1682,6 +1700,7 @@ static int dlfb_usb_probe(struct usb_int
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ mutex_init(&dlfb->render_mutex);
+ dlfb_init_damage(dlfb);
+ spin_lock_init(&dlfb->damage_lock);
+ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,7 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ struct mutex render_mutex;
+ int damage_x;
+ int damage_y;
+ int damage_x2;
projects / thirdparty / kernel / stable-queue.git / commitdiff
