--- /dev/null
+From c7e2d94b3d1634988a95ac4d77a72dc7487ece06 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Tue, 30 Apr 2019 09:52:25 +0800
+Subject: blk-mq: free hw queue's resource in hctx's release handler
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 upstream.
+
+Once blk_cleanup_queue() returns, tags shouldn't be used any more,
+because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2
+("blk-mq: Fix a use-after-free") fixes this issue exactly.
+
+However, that commit introduces another issue. Before 45a9c9d909b2,
+we are allowed to run queue during cleaning up queue if the queue's
+kobj refcount is held. After that commit, queue can't be run during
+queue cleaning up, otherwise oops can be triggered easily because
+some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue().
+
+We have invented ways for addressing this kind of issue before, such as:
+
+ 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done")
+ c2856ae2f315 ("blk-mq: quiesce queue before freeing queue")
+
+But still can't cover all cases, recently James reports another such
+kind of issue:
+
+ https://marc.info/?l=linux-scsi&m=155389088124782&w=2
+
+This issue can be quite hard to address by previous way, given
+scsi_run_queue() may run requeues for other LUNs.
+
+Fixes the above issue by freeing hctx's resources in its release handler, and this
+way is safe becasue tags isn't needed for freeing such hctx resource.
+
+This approach follows typical design pattern wrt. kobject's release handler.
+
+Cc: Dongli Zhang <dongli.zhang@oracle.com>
+Cc: James Smart <james.smart@broadcom.com>
+Cc: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: linux-scsi@vger.kernel.org,
+Cc: Martin K . Petersen <martin.petersen@oracle.com>,
+Cc: Christoph Hellwig <hch@lst.de>,
+Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>,
+Reported-by: James Smart <james.smart@broadcom.com>
+Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Tested-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-core.c | 2 +-
+ block/blk-mq-sysfs.c | 6 ++++++
+ block/blk-mq.c | 8 ++------
+ block/blk-mq.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_qu
+ blk_exit_queue(q);
+
+ if (queue_is_mq(q))
+- blk_mq_free_queue(q);
++ blk_mq_exit_queue(q);
+
+ percpu_ref_exit(&q->q_usage_counter);
+
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/smp.h>
+
+ #include <linux/blk-mq.h>
++#include "blk.h"
+ #include "blk-mq.h"
+ #include "blk-mq-tag.h"
+
+@@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(stru
+ {
+ struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+ kobj);
++
++ if (hctx->flags & BLK_MQ_F_BLOCKING)
++ cleanup_srcu_struct(hctx->srcu);
++ blk_free_flush_queue(hctx->fq);
++ sbitmap_free(&hctx->ctx_map);
+ free_cpumask_var(hctx->cpumask);
+ kfree(hctx->ctxs);
+ kfree(hctx);
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2270,12 +2270,7 @@ static void blk_mq_exit_hctx(struct requ
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- if (hctx->flags & BLK_MQ_F_BLOCKING)
+- cleanup_srcu_struct(hctx->srcu);
+-
+ blk_mq_remove_cpuhp(hctx);
+- blk_free_flush_queue(hctx->fq);
+- sbitmap_free(&hctx->ctx_map);
+ }
+
+ static void blk_mq_exit_hw_queues(struct request_queue *q,
+@@ -2904,7 +2899,8 @@ err_exit:
+ }
+ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+
+-void blk_mq_free_queue(struct request_queue *q)
++/* tags can _not_ be used after returning from blk_mq_exit_queue */
++void blk_mq_exit_queue(struct request_queue *q)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -36,7 +36,7 @@ struct blk_mq_ctx {
+ struct kobject kobj;
+ } ____cacheline_aligned_in_smp;
+
+-void blk_mq_free_queue(struct request_queue *q);
++void blk_mq_exit_queue(struct request_queue *q);
+ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
--- /dev/null
+From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 22 Apr 2019 22:41:23 +0200
+Subject: brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe upstream.
+
+The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
+is way too generic.
+
+The DMI strings on which we are matching are somewhat generic too, but
+"To be filled by O.E.M." is less common then "Default string" and the
+system-sku and bios-version strings are pretty unique. Beside the DMI
+strings we also check the wifi-module chip-id and revision. I'm confident
+that the combination of all this is unique.
+
+Both the T8 and T11 use the same wifi-module, this commit adds DMI
+quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
+
+ /* NOTE: Please keep all entries sorted alphabetically */
+
++static const struct brcmf_dmi_data acepc_t8_data = {
++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
++};
++
+ static const struct brcmf_dmi_data gpd_win_pocket_data = {
+ BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
+ };
+@@ -45,6 +49,28 @@ static const struct brcmf_dmi_data meego
+
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
++ /* ACEPC T8 Cherry Trail Z8350 mini PC */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
++ {
++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
++ {
+ /* Match for the GPDwin which unfortunately uses somewhat
+ * generic dmi strings, which is why we test for 4 strings.
+ * Comparing against 23 other byt/cht boards, board_vendor
--- /dev/null
+From f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Mon, 22 Apr 2019 21:23:21 +0800
+Subject: brd: re-enable __GFP_HIGHMEM in brd_insert_page()
+
+From: Hou Tao <houtao1@huawei.com>
+
+commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream.
+
+__GFP_HIGHMEM is disabled if dax is enabled on brd, however
+dax support for brd has been removed since commit (7a862fbbdec6
+"brd: remove dax support"), so restore __GFP_HIGHMEM in
+brd_insert_page().
+
+Also remove the no longer applicable comments about DAX and highmem.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a862fbbdec6 ("brd: remove dax support")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/brd.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -96,13 +96,8 @@ static struct page *brd_insert_page(stru
+ /*
+ * Must use NOIO because we don't want to recurse back into the
+ * block or filesystem layers from page reclaim.
+- *
+- * Cannot support DAX and highmem, because our ->direct_access
+- * routine for DAX must return memory that is always addressable.
+- * If DAX was reworked to use pfns and kmap throughout, this
+- * restriction might be able to be lifted.
+ */
+- gfp_flags = GFP_NOIO | __GFP_ZERO;
++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+ page = alloc_page(gfp_flags);
+ if (!page)
+ return NULL;
--- /dev/null
+From 00abf69dd24f4444d185982379c5cc3bb7b6d1fc Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Tue, 7 May 2019 09:20:54 -0400
+Subject: ceph: flush dirty inodes before proceeding with remount
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit 00abf69dd24f4444d185982379c5cc3bb7b6d1fc upstream.
+
+xfstest generic/452 was triggering a "Busy inodes after umount" warning.
+ceph was allowing the mount to go read-only without first flushing out
+dirty inodes in the cache. Ensure we sync out the filesystem before
+allowing a remount to proceed.
+
+Cc: stable@vger.kernel.org
+Link: http://tracker.ceph.com/issues/39571
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/super.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -832,6 +832,12 @@ static void ceph_umount_begin(struct sup
+ return;
+ }
+
++static int ceph_remount(struct super_block *sb, int *flags, char *data)
++{
++ sync_filesystem(sb);
++ return 0;
++}
++
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+ .destroy_inode = ceph_destroy_inode,
+@@ -839,6 +845,7 @@ static const struct super_operations cep
+ .drop_inode = ceph_drop_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
++ .remount_fs = ceph_remount,
+ .show_options = ceph_show_options,
+ .statfs = ceph_statfs,
+ .umount_begin = ceph_umount_begin,
--- /dev/null
+From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001
+From: Christoph Probst <kernel@probst.it>
+Date: Tue, 7 May 2019 17:16:40 +0200
+Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
+
+From: Christoph Probst <kernel@probst.it>
+
+commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
+
+Change strcat to strncpy in the "None" case to fix a buffer overflow
+when cinode->oplock is reset to 0 by another thread accessing the same
+cinode. It is never valid to append "None" to any other message.
+
+Consolidate multiple writes to cinode->oplock to reduce raciness.
+
+Signed-off-by: Christoph Probst <kernel@probst.it>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2652,26 +2652,28 @@ smb21_set_oplock_level(struct cifsInodeI
+ unsigned int epoch, bool *purge_cache)
+ {
+ char message[5] = {0};
++ unsigned int new_oplock = 0;
+
+ oplock &= 0xFF;
+ if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+ return;
+
+- cinode->oplock = 0;
+ if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_READ_FLG;
++ new_oplock |= CIFS_CACHE_READ_FLG;
+ strcat(message, "R");
+ }
+ if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
++ new_oplock |= CIFS_CACHE_HANDLE_FLG;
+ strcat(message, "H");
+ }
+ if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_WRITE_FLG;
++ new_oplock |= CIFS_CACHE_WRITE_FLG;
+ strcat(message, "W");
+ }
+- if (!cinode->oplock)
+- strcat(message, "None");
++ if (!new_oplock)
++ strncpy(message, "None", sizeof(message));
++
++ cinode->oplock = new_oplock;
+ cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+ &cinode->vfs_inode);
+ }
--- /dev/null
+From 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa Mon Sep 17 00:00:00 2001
+From: Leo Yan <leo.yan@linaro.org>
+Date: Wed, 20 Mar 2019 18:05:08 +0800
+Subject: clk: hi3660: Mark clk_gate_ufs_subsys as critical
+
+From: Leo Yan <leo.yan@linaro.org>
+
+commit 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa upstream.
+
+clk_gate_ufs_subsys is a system bus clock, turning off it will
+introduce lockup issue during system suspend flow. Let's mark
+clk_gate_ufs_subsys as critical clock, thus keeps it on during
+system suspend and resume.
+
+Fixes: d374e6fd5088 ("clk: hisilicon: Add clock driver for hi3660 SoC")
+Cc: stable@vger.kernel.org
+Cc: Zhong Kaihua <zhongkaihua@huawei.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Zhangfei Gao <zhangfei.gao@linaro.org>
+Suggested-by: Dong Zhang <zhangdong46@hisilicon.com>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/hisilicon/clk-hi3660.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi36
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, },
+ { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2",
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, },
++ /*
++ * clk_gate_ufs_subsys is a system bus clock, mark it as critical
++ * clock and keep it on for system suspend and resume.
++ */
+ { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus",
+- CLK_SET_RATE_PARENT, 0x50, 21, 0, },
++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, },
+ { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus",
+ CLK_SET_RATE_PARENT, 0x50, 28, 0, },
+ { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus",
--- /dev/null
+From be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb Mon Sep 17 00:00:00 2001
+From: Owen Chen <owen.chen@mediatek.com>
+Date: Tue, 5 Mar 2019 13:05:38 +0800
+Subject: clk: mediatek: Disable tuner_en before change PLL rate
+
+From: Owen Chen <owen.chen@mediatek.com>
+
+commit be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb upstream.
+
+PLLs with tuner_en bit, such as APLL1, need to disable
+tuner_en before apply new frequency settings, or the new frequency
+settings (pcw) will not be applied.
+The tuner_en bit will be disabled during changing PLL rate
+and be restored after new settings applied.
+
+Fixes: e2f744a82d725 (clk: mediatek: Add MT2712 clock support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Owen Chen <owen.chen@mediatek.com>
+Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>
+Reviewed-by: James Liao <jamesjj.liao@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/mediatek/clk-pll.c | 48 +++++++++++++++++++++++++++++------------
+ 1 file changed, 34 insertions(+), 14 deletions(-)
+
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_ra
+ return ((unsigned long)vco + postdiv - 1) / postdiv;
+ }
+
++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
+ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ int postdiv)
+ {
+@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct
+
+ pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN;
+
++ /* disable tuner */
++ __mtk_pll_tuner_disable(pll);
++
+ /* set postdiv */
+ val = readl(pll->pd_addr);
+ val &= ~(POSTDIV_MASK << pll->data->pd_shift);
+@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct
+ if (pll->tuner_addr)
+ writel(con1 + 1, pll->tuner_addr);
+
++ /* restore tuner_en */
++ __mtk_pll_tuner_enable(pll);
++
+ if (pll_en)
+ udelay(20);
+ }
+@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw
+ r |= pll->data->en_mask;
+ writel(r, pll->base_addr + REG_CON0);
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_enable(pll);
+
+ udelay(20);
+
+@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk
+ writel(r, pll->base_addr + REG_CON0);
+ }
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_disable(pll);
+
+ r = readl(pll->base_addr + REG_CON0);
+ r &= ~CON0_BASE_EN;
--- /dev/null
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: clk: rockchip: fix wrong clock definitions for rk3328
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit fb903392131a324a243c7731389277db1cd9f8df upstream.
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struc
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
--- /dev/null
+From 40db569d6769ffa3864fd1b89616b1a7323568a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 00:48:34 +0300
+Subject: clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 40db569d6769ffa3864fd1b89616b1a7323568a8 upstream.
+
+There are wrongly set parenthesis in the code that are resulting in a
+wrong configuration being programmed for PLLM. The original fix was made
+by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
+Tegra124 chromebook, PLLM rate changing works correctly now and system
+doesn't lock up after changing the PLLM rate due to EMC scaling.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/tegra/clk-pll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -663,8 +663,8 @@ static void _update_pll_mnp(struct tegra
+ pll_override_writel(val, params->pmc_divp_reg, pll);
+
+ val = pll_override_readl(params->pmc_divnm_reg, pll);
+- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+- ~(divn_mask(pll) << div_nmp->override_divn_shift);
++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++ (divn_mask(pll) << div_nmp->override_divn_shift));
+ val |= (cfg->m << div_nmp->override_divm_shift) |
+ (cfg->n << div_nmp->override_divn_shift);
+ pll_override_writel(val, params->pmc_divnm_reg, pll);
--- /dev/null
+From 5467a68cbf6884c9a9d91e2a89140afb1839c835 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 15 Mar 2019 22:23:19 -0400
+Subject: dcache: sort the freeing-without-RCU-delay mess for good.
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream.
+
+For lockless accesses to dentries we don't have pinned we rely
+(among other things) upon having an RCU delay between dropping
+the last reference and actually freeing the memory.
+
+On the other hand, for things like pipes and sockets we neither
+do that kind of lockless access, nor want to deal with the
+overhead of an RCU delay every time a socket gets closed.
+
+So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags
+made sure it would happen. We tried to avoid setting it unless
+we knew we need it. Unfortunately, that had led to recurring
+class of bugs, in which we missed the need to set it.
+
+We only really need it for dentries that are created by
+d_alloc_pseudo(), so let's not bother with trying to be smart -
+just make having an RCU delay the default. The ones that do
+*not* get it set the replacement flag (DCACHE_NORCU) and we'd
+better use that sparingly. d_alloc_pseudo() is the only
+such user right now.
+
+FWIW, the race that finally prompted that switch had been
+between __lock_parent() of immediate subdirectory of what's
+currently the root of a disconnected tree (e.g. from
+open-by-handle in progress) racing with d_splice_alias()
+elsewhere picking another alias for the same inode, either
+on outright corrupted fs image, or (in case of open-by-handle
+on NFS) that subdirectory having been just moved on server.
+It's not easy to hit, so the sky is not falling, but that's
+not the first race on similar missed cases and the logics
+for settinf DCACHE_RCUACCESS has gotten ridiculously
+convoluted.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/porting | 5 +++++
+ fs/dcache.c | 24 +++++++++++++-----------
+ fs/nsfs.c | 3 +--
+ include/linux/dcache.h | 2 +-
+ 4 files changed, 20 insertions(+), 14 deletions(-)
+
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -638,3 +638,8 @@ in your dentry operations instead.
+ inode to d_splice_alias() will also do the right thing (equivalent of
+ d_add(dentry, NULL); return NULL;), so that kind of special cases
+ also doesn't need a separate treatment.
++--
++[mandatory]
++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
++ business doing so.
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *d
+ }
+ }
+ /* if dentry was never visible to RCU, immediate free is OK */
+- if (!(dentry->d_flags & DCACHE_RCUACCESS))
++ if (dentry->d_flags & DCACHE_NORCU)
+ __d_free(&dentry->d_u.d_rcu);
+ else
+ call_rcu(&dentry->d_u.d_rcu, __d_free);
+@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * p
+ struct dentry *dentry = __d_alloc(parent->d_sb, name);
+ if (!dentry)
+ return NULL;
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ spin_lock(&parent->d_lock);
+ /*
+ * don't need child lock because it is not subject
+@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct den
+ {
+ struct dentry *dentry = d_alloc_anon(parent->d_sb);
+ if (dentry) {
+- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
++ dentry->d_flags |= DCACHE_DENTRY_CURSOR;
+ dentry->d_parent = dget(parent);
+ }
+ return dentry;
+@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct den
+ *
+ * For a filesystem that just pins its dentries in memory and never
+ * performs lookups at all, return an unhashed IS_ROOT dentry.
++ * This is used for pipes, sockets et.al. - the stuff that should
++ * never be anyone's children or parents. Unlike all other
++ * dentries, these will not have RCU delay between dropping the
++ * last reference and freeing them.
+ */
+ struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
+ {
+- return __d_alloc(sb, name);
++ struct dentry *dentry = __d_alloc(sb, name);
++ if (likely(dentry))
++ dentry->d_flags |= DCACHE_NORCU;
++ return dentry;
+ }
+ EXPORT_SYMBOL(d_alloc_pseudo);
+
+@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode
+
+ if (root_inode) {
+ res = d_alloc_anon(root_inode->i_sb);
+- if (res) {
+- res->d_flags |= DCACHE_RCUACCESS;
++ if (res)
+ d_instantiate(res, root_inode);
+- } else {
++ else
+ iput(root_inode);
+- }
+ }
+ return res;
+ }
+@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dent
+ copy_name(dentry, target);
+ target->d_hash.pprev = NULL;
+ dentry->d_parent->d_lockref.count++;
+- if (dentry == old_parent)
+- dentry->d_flags |= DCACHE_RCUACCESS;
+- else
++ if (dentry != old_parent) /* wasn't IS_ROOT */
+ WARN_ON(!--old_parent->d_lockref.count);
+ } else {
+ target->d_parent = old_parent;
+--- a/fs/nsfs.c
++++ b/fs/nsfs.c
+@@ -85,13 +85,12 @@ slow:
+ inode->i_fop = &ns_file_operations;
+ inode->i_private = ns;
+
+- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
++ dentry = d_alloc_anon(mnt->mnt_sb);
+ if (!dentry) {
+ iput(inode);
+ return ERR_PTR(-ENOMEM);
+ }
+ d_instantiate(dentry, inode);
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ dentry->d_fsdata = (void *)ns->ops;
+ d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+ if (d) {
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -176,7 +176,6 @@ struct dentry_operations {
+ * typically using d_splice_alias. */
+
+ #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */
+-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */
+
+ #define DCACHE_CANT_MOUNT 0x00000100
+ #define DCACHE_GENOCIDE 0x00000200
+@@ -217,6 +216,7 @@ struct dentry_operations {
+
+ #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
+ #define DCACHE_DENTRY_CURSOR 0x20000000
++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */
+
+ extern seqlock_t rename_lock;
+
--- /dev/null
+From 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 24 Apr 2019 17:05:06 +0200
+Subject: fuse: fix writepages on 32bit
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 upstream.
+
+Writepage requests were cropped to i_size & 0xffffffff, which meant that
+mmaped writes to any file larger than 4G might be silently discarded.
+
+Fix by storing the file size in a properly sized variable (loff_t instead
+of size_t).
+
+Reported-by: Antonio SJ Musumeci <trapexit@spawn.link>
+Fixes: 6eaf4782eb09 ("fuse: writepages: crop secondary requests")
+Cc: <stable@vger.kernel.org> # v3.13
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1530,7 +1530,7 @@ __acquires(fc->lock)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ struct fuse_inode *fi = get_fuse_inode(inode);
+- size_t crop = i_size_read(inode);
++ loff_t crop = i_size_read(inode);
+ struct fuse_req *req;
+
+ while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
--- /dev/null
+From 0cbade024ba501313da3b7e5dd2a188a6bc491b5 Mon Sep 17 00:00:00 2001
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Thu, 18 Apr 2019 04:04:41 +0800
+Subject: fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
+
+From: Liu Bo <bo.liu@linux.alibaba.com>
+
+commit 0cbade024ba501313da3b7e5dd2a188a6bc491b5 upstream.
+
+fstests generic/228 reported this failure that fuse fallocate does not
+honor what 'ulimit -f' has set.
+
+This adds the necessary inode_newsize_ok() check.
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation")
+Cc: <stable@vger.kernel.org> # v3.5
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2987,6 +2987,13 @@ static long fuse_file_fallocate(struct f
+ }
+ }
+
++ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
++ offset + length > i_size_read(inode)) {
++ err = inode_newsize_ok(inode, offset + length);
++ if (err)
++ return err;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE))
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
--- /dev/null
+From 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Fri, 10 May 2019 21:00:25 +1200
+Subject: gcc-plugins: arm_ssp_per_task_plugin: Fix for older GCC < 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e upstream.
+
+Use gen_rtx_set instead of gen_rtx_SET. The former is a wrapper macro
+that handles the difference between GCC versions implementing
+the latter.
+
+This fixes the following error on my system with g++ 5.4.0 as the host
+compiler
+
+ HOSTCXX -fPIC scripts/gcc-plugins/arm_ssp_per_task_plugin.o
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:42:14: error: macro "gen_rtx_SET" requires 3 arguments, but only 2 given
+ mask)),
+ ^
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c: In function ‘unsigned int arm_pertask_ssp_rtl_execute()’:
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:39:20: error: ‘gen_rtx_SET’ was not declared in this scope
+ emit_insn_before(gen_rtx_SET
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
+Cc: stable@vger.kernel.org
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
++++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+@@ -36,7 +36,7 @@ static unsigned int arm_pertask_ssp_rtl_
+ mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
+ masked_sp = gen_reg_rtx(Pmode);
+
+- emit_insn_before(gen_rtx_SET(masked_sp,
++ emit_insn_before(gen_rtx_set(masked_sp,
+ gen_rtx_AND(Pmode,
+ stack_pointer_rtx,
+ mask)),
--- /dev/null
+From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 3 May 2019 11:44:34 +0300
+Subject: intel_th: msu: Fix single mode with IOMMU
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream.
+
+Currently, the pages that are allocated for the single mode of MSC are not
+mapped into the device's dma space and the code is incorrectly using
+*_to_phys() in place of a dma address. This fails with IOMMU enabled and
+is otherwise bad practice.
+
+Fix the single mode buffer allocation to map the pages into the device's
+DMA space.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+ * @reg_base: register window base address
+ * @thdev: intel_th_device pointer
+ * @win_list: list of windows in multiblock mode
++ * @single_sgt: single mode buffer
+ * @nr_pages: total number of pages allocated for this buffer
+ * @single_sz: amount of data in single mode
+ * @single_wrap: single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+ struct intel_th_device *thdev;
+
+ struct list_head win_list;
++ struct sg_table single_sgt;
+ unsigned long nr_pages;
+ unsigned long single_sz;
+ unsigned int single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(stru
+ */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++ unsigned long nr_pages = size >> PAGE_SHIFT;
+ unsigned int order = get_order(size);
+ struct page *page;
++ int ret;
+
+ if (!size)
+ return 0;
+
++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++ if (ret)
++ goto err_out;
++
++ ret = -ENOMEM;
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+- return -ENOMEM;
++ goto err_free_sgt;
+
+ split_page(page, order);
+- msc->nr_pages = size >> PAGE_SHIFT;
++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++ DMA_FROM_DEVICE);
++ if (ret < 0)
++ goto err_free_pages;
++
++ msc->nr_pages = nr_pages;
+ msc->base = page_address(page);
+- msc->base_addr = page_to_phys(page);
++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+
+ return 0;
++
++err_free_pages:
++ __free_pages(page, order);
++
++err_free_sgt:
++ sg_free_table(&msc->single_sgt);
++
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struc
+ {
+ unsigned long off;
+
++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++ 1, DMA_FROM_DEVICE);
++ sg_free_table(&msc->single_sgt);
++
+ for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+ struct page *page = virt_to_page(msc->base + off);
+
--- /dev/null
+From 43a0541e312f7136e081e6bf58f6c8a2e9672688 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:50:07 +0300
+Subject: iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 43a0541e312f7136e081e6bf58f6c8a2e9672688 upstream.
+
+Both Tegra30 and Tegra114 have 4 ASID's and the corresponding bitfield of
+the TLB_FLUSH register differs from later Tegra generations that have 128
+ASID's.
+
+In a result the PTE's are now flushed correctly from TLB and this fixes
+problems with graphics (randomly failing tests) on Tegra30.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/tegra-smmu.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegr
+ #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0)
+-#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24)
+ #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \
+ SMMU_TLB_FLUSH_VA_MATCH_SECTION)
+ #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \
+@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(s
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_MATCH_ALL;
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL;
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_sectio
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_SECTION(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group(
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_GROUP(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
--- /dev/null
+From ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Thu, 4 Apr 2019 18:56:10 +0200
+Subject: md: add a missing endianness conversion in check_sb_changes
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream.
+
+The on-disk value is little endian and we need to convert it to
+native endian before storing the value in the in-core structure.
+
+Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode")
+Cc: <stable@vger.kernel.org> # 4.20+
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9229,7 +9229,7 @@ static void check_sb_changes(struct mdde
+ * reshape is happening in the remote node, we need to
+ * update reshape_position and call start_reshape.
+ */
+- mddev->reshape_position = sb->reshape_position;
++ mddev->reshape_position = le64_to_cpu(sb->reshape_position);
+ if (mddev->pers->update_reshape_pos)
+ mddev->pers->update_reshape_pos(mddev);
+ if (mddev->pers->start_reshape)
--- /dev/null
+From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Tue, 2 Apr 2019 14:22:14 +0800
+Subject: md: add mddev->pers to avoid potential NULL pointer dereference
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.
+
+When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
+which can avoid potential NULL pointer derefence in fallowing
+add_bound_rdev().
+
+Fixes: a6da4ef85cef ("md: re-add a failed disk")
+Cc: Xiao Ni <xni@redhat.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: <stable@vger.kernel.org> # 4.4+
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2852,8 +2852,10 @@ state_store(struct md_rdev *rdev, const
+ err = 0;
+ }
+ } else if (cmd_match(buf, "re-add")) {
+- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+- rdev->saved_raid_disk >= 0) {
++ if (!rdev->mddev->pers)
++ err = -EINVAL;
++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++ rdev->saved_raid_disk >= 0) {
+ /* clear_bit is performed _after_ all the devices
+ * have their local Faulty bit cleared. If any writes
+ * happen in the meantime in the local node, they
--- /dev/null
+From 2bc13b83e6298486371761de503faeffd15b7534 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:17 -0700
+Subject: md: batch flush requests.
+
+From: NeilBrown <neilb@suse.com>
+
+commit 2bc13b83e6298486371761de503faeffd15b7534 upstream.
+
+Currently if many flush requests are submitted to an md device is quick
+succession, they are serialized and can take a long to process them all.
+We don't really need to call flush all those times - a single flush call
+can satisfy all requests submitted before it started.
+So keep track of when the current flush started and when it finished,
+allow any pending flush that was requested before the flush started
+to complete without waiting any more.
+
+Test results from Xiao:
+
+Test is done on a raid10 device which is created by 4 SSDs. The tool is
+dbench.
+
+1. The latest linux stable kernel
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 10.509 78.305
+ Flush 2078376 0.013 10.094
+ Close 21787697 0.019 18.821
+ LockX 96580 0.007 3.184
+ Mkdir 384 0.008 0.062
+ Rename 1255883 0.191 23.534
+ ReadX 46495589 0.020 14.230
+ WriteX 14790591 7.123 60.706
+ Unlink 5989118 0.440 54.551
+ UnlockX 96580 0.005 2.736
+ FIND_FIRST 10393845 0.042 12.079
+ SET_FILE_INFORMATION 2415558 0.129 10.088
+ QUERY_FILE_INFORMATION 4711725 0.005 8.462
+ QUERY_PATH_INFORMATION 26883327 0.032 21.715
+ QUERY_FS_INFORMATION 4929409 0.010 8.238
+ NTCreateX 29660080 0.100 53.268
+
+Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.712 ms
+
+2. With patch1 "Revert "MD: fix lock contention for flush bios""
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 256 8.326 36.761
+ Flush 693291 3.974 180.269
+ Close 7266404 0.009 36.929
+ LockX 32160 0.006 0.840
+ Mkdir 128 0.008 0.021
+ Rename 418755 0.063 29.945
+ ReadX 15498708 0.007 7.216
+ WriteX 4932310 22.482 267.928
+ Unlink 1997557 0.109 47.553
+ UnlockX 32160 0.004 1.110
+ FIND_FIRST 3465791 0.036 7.320
+ SET_FILE_INFORMATION 805825 0.015 1.561
+ QUERY_FILE_INFORMATION 1570950 0.005 2.403
+ QUERY_PATH_INFORMATION 8965483 0.013 14.277
+ QUERY_FS_INFORMATION 1643626 0.009 3.314
+ NTCreateX 9892174 0.061 41.278
+
+Throughput 345.009 MB/sec (sync open) 128 clients 128 procs
+max_latency=267.939 m
+
+3. With patch1 and patch2
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 9.570 54.588
+ Flush 2061354 0.666 15.102
+ Close 21604811 0.012 25.697
+ LockX 95770 0.007 1.424
+ Mkdir 384 0.008 0.053
+ Rename 1245411 0.096 12.263
+ ReadX 46103198 0.011 12.116
+ WriteX 14667988 7.375 60.069
+ Unlink 5938936 0.173 30.905
+ UnlockX 95770 0.005 4.147
+ FIND_FIRST 10306407 0.041 11.715
+ SET_FILE_INFORMATION 2395987 0.048 7.640
+ QUERY_FILE_INFORMATION 4672371 0.005 9.291
+ QUERY_PATH_INFORMATION 26656735 0.018 19.719
+ QUERY_FS_INFORMATION 4887940 0.010 7.654
+ NTCreateX 29410811 0.059 28.551
+
+Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.075 ms
+
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 27 +++++++++++++++++++++++----
+ drivers/md/md.h | 3 +++
+ 2 files changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -427,6 +427,7 @@ static void submit_flushes(struct work_s
+ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+
++ mddev->start_flush = ktime_get_boottime();
+ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
+ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+@@ -467,6 +468,7 @@ static void md_submit_flush_data(struct
+ * could wait for this and below md_handle_request could wait for those
+ * bios because of suspend check
+ */
++ mddev->last_flush = mddev->start_flush;
+ mddev->flush_bio = NULL;
+ wake_up(&mddev->sb_wait);
+
+@@ -481,15 +483,32 @@ static void md_submit_flush_data(struct
+
+ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
++ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+ wait_event_lock_irq(mddev->sb_wait,
+- !mddev->flush_bio,
++ !mddev->flush_bio ||
++ ktime_after(mddev->last_flush, start),
+ mddev->lock);
+- mddev->flush_bio = bio;
++ if (!ktime_after(mddev->last_flush, start)) {
++ WARN_ON(mddev->flush_bio);
++ mddev->flush_bio = bio;
++ bio = NULL;
++ }
+ spin_unlock_irq(&mddev->lock);
+
+- INIT_WORK(&mddev->flush_work, submit_flushes);
+- queue_work(md_wq, &mddev->flush_work);
++ if (!bio) {
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++ } else {
++ /* flush was performed for some other bio while we waited. */
++ if (bio->bi_iter.bi_size == 0)
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ mddev->pers->make_request(mddev, bio);
++ }
++ }
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -463,6 +463,9 @@ struct mddev {
+ */
+ struct bio *flush_bio;
+ atomic_t flush_pending;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
+ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
--- /dev/null
+From 107927fa597c99eaeee4f51865ca0956ec71b6a2 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:30 -0500
+Subject: media: imx: Clear fwnode link struct for each endpoint iteration
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream.
+
+In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must
+be cleared for each endpoint iteration, otherwise if the remote port
+has no "reg" property, link.remote_port will not be reset to zero.
+This was discovered on the i.MX53 SMD board, since the OV5642 connects
+directly to ipu1_csi0 and has a single source port with no "reg"
+property.
+
+Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-of.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -143,15 +143,18 @@ int imx_media_create_csi_of_links(struct
+ struct v4l2_subdev *csi)
+ {
+ struct device_node *csi_np = csi->dev->of_node;
+- struct fwnode_handle *fwnode, *csi_ep;
+- struct v4l2_fwnode_link link;
+ struct device_node *ep;
+- int ret;
+-
+- link.local_node = of_fwnode_handle(csi_np);
+- link.local_port = CSI_SINK_PAD;
+
+ for_each_child_of_node(csi_np, ep) {
++ struct fwnode_handle *fwnode, *csi_ep;
++ struct v4l2_fwnode_link link;
++ int ret;
++
++ memset(&link, 0, sizeof(link));
++
++ link.local_node = of_fwnode_handle(csi_np);
++ link.local_port = CSI_SINK_PAD;
++
+ csi_ep = of_fwnode_handle(ep);
+
+ fwnode = fwnode_graph_get_remote_endpoint(csi_ep);
--- /dev/null
+From 904371f90b2c0c749a5ab75478c129a4682ac3d8 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:29 -0500
+Subject: media: imx: csi: Allow unknown nearest upstream entities
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream.
+
+On i.MX6, the nearest upstream entity to the CSI can only be the
+CSI video muxes or the Synopsys DW MIPI CSI-2 receiver.
+
+However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver.
+So allow for the nearest upstream entity to the CSI to be something
+other than those.
+
+Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest
+upstream entity")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-csi.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -153,9 +153,10 @@ static inline bool requires_passthrough(
+ /*
+ * Parses the fwnode endpoint from the source pad of the entity
+ * connected to this CSI. This will either be the entity directly
+- * upstream from the CSI-2 receiver, or directly upstream from the
+- * video mux. The endpoint is needed to determine the bus type and
+- * bus config coming into the CSI.
++ * upstream from the CSI-2 receiver, directly upstream from the
++ * video mux, or directly upstream from the CSI itself. The endpoint
++ * is needed to determine the bus type and bus config coming into
++ * the CSI.
+ */
+ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_fwnode_endpoint *ep)
+@@ -171,7 +172,8 @@ static int csi_get_upstream_endpoint(str
+ if (!priv->src_sd)
+ return -EPIPE;
+
+- src = &priv->src_sd->entity;
++ sd = priv->src_sd;
++ src = &sd->entity;
+
+ if (src->function == MEDIA_ENT_F_VID_MUX) {
+ /*
+@@ -185,6 +187,14 @@ static int csi_get_upstream_endpoint(str
+ src = &sd->entity;
+ }
+
++ /*
++ * If the source is neither the video mux nor the CSI-2 receiver,
++ * get the source pad directly upstream from CSI itself.
++ */
++ if (src->function != MEDIA_ENT_F_VID_MUX &&
++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2)
++ src = &priv->sd.entity;
++
+ /* get source pad of entity directly upstream from src */
+ pad = imx_media_find_upstream_pad(priv->md, src, 0);
+ if (IS_ERR(pad))
--- /dev/null
+From 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Sun, 24 Mar 2019 20:21:12 -0400
+Subject: media: ov6650: Fix sensor possibly not detected on probe
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream.
+
+After removal of clock_start() from before soc_camera_init_i2c() in
+soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
+I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
+driver could no longer probe the sensor successfully because its clock
+was no longer turned on in advance. The issue was initially worked
+around by adding that missing clock_start() equivalent to OMAP1 camera
+interface driver - the only user of this sensor - but a propoer fix
+should be rather implemented in the sensor driver code itself.
+
+Fix the issue by inserting a delay between the clock is turned on and
+the sensor I2C registers are read for the first time.
+
+Tested on Amstrad Delta with now out of tree but still locally
+maintained omap1_camera host driver.
+
+Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk")
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -814,6 +814,8 @@ static int ov6650_video_probe(struct i2c
+ if (ret < 0)
+ return ret;
+
++ msleep(20);
++
+ /*
+ * check and show product ID and manufacturer ID
+ */
--- /dev/null
+From f02f3755dbd14fb935d24b14650fff9ba92243b8 Mon Sep 17 00:00:00 2001
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 6 May 2019 11:57:03 +0800
+Subject: NFS4: Fix v4.0 client state corruption when mount
+
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+
+commit f02f3755dbd14fb935d24b14650fff9ba92243b8 upstream.
+
+stat command with soft mount never return after server is stopped.
+
+When alloc a new client, the state of the client will be set to
+NFS4CLNT_LEASE_EXPIRED.
+
+When the server is stopped, the state manager will work, and accord
+the state to recover. But the state is NFS4CLNT_LEASE_EXPIRED, it
+will drain the slot table and lead other task to wait queue, until
+the client recovered. Then the stat command is hung.
+
+When discover server trunking, the client will renew the lease,
+but check the client state, it lead the client state corruption.
+
+So, we need to call state manager to recover it when detect server
+ip trunking.
+
+Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struc
+ /* Sustain the lease, even if it's empty. If the clientid4
+ * goes stale it's of no use for trunking discovery. */
+ nfs4_schedule_state_renewal(*result);
++
++ /* If the client state need to recover, do it. */
++ if (clp->cl_state)
++ nfs4_schedule_state_manager(clp);
+ }
+ out:
+ return status;
--- /dev/null
+From 440868661f36071886ed360d91de83bd67c73b4f Mon Sep 17 00:00:00 2001
+From: Phong Tran <tranmanphong@gmail.com>
+Date: Tue, 30 Apr 2019 21:56:24 +0700
+Subject: of: fix clang -Wunsequenced for be32_to_cpu()
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+commit 440868661f36071886ed360d91de83bd67c73b4f upstream.
+
+Now, make the loop explicit to avoid clang warning.
+
+./include/linux/of.h:238:37: warning: multiple unsequenced modifications
+to 'cell' [-Wunsequenced]
+ r = (r << 32) | be32_to_cpu(*(cell++));
+ ^~
+./include/linux/byteorder/generic.h:95:21: note: expanded from macro
+'be32_to_cpu'
+ ^
+./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded
+from macro '__be32_to_cpu'
+ ^
+./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32'
+ ___constant_swab32(x) : \
+ ^
+./include/uapi/linux/swab.h:18:12: note: expanded from macro
+'___constant_swab32'
+ (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \
+ ^
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/460
+Suggested-by: David Laight <David.Laight@ACULAB.COM>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable@vger.kernel.org
+[robh: fix up whitespace]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/of.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -234,8 +234,8 @@ extern struct device_node *of_find_all_n
+ static inline u64 of_read_number(const __be32 *cell, int size)
+ {
+ u64 r = 0;
+- while (size--)
+- r = (r << 32) | be32_to_cpu(*(cell++));
++ for (; size--; cell++)
++ r = (r << 32) | be32_to_cpu(*cell);
+ return r;
+ }
+
--- /dev/null
+From 3428030da004a1128cbdcf93dc03e16f184d845b Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Tue, 22 Jan 2019 07:01:39 +0200
+Subject: ovl: fix missing upper fs freeze protection on copy up for ioctl
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream.
+
+Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file
+with data before FS_IOC_SETFLAGS ioctl.
+
+The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably
+caused the confusion. File may be open O_RDONLY, but ioctl modifies the
+file. VFS does not call mnt_want_write_file() nor lock inode mutex, but
+fs-specific code for FS_IOC_SETFLAGS does. So ovl_ioctl() calls
+mnt_want_write_file() for the overlay file, and fs-specific code calls
+mnt_want_write_file() for upper fs file, but there was no call for
+ovl_want_write() for copy up duration which prevents overlayfs from copying
+up on a frozen upper fs.
+
+Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/copy_up.c | 6 +++---
+ fs/overlayfs/file.c | 5 ++---
+ fs/overlayfs/overlayfs.h | 2 +-
+ 3 files changed, 6 insertions(+), 7 deletions(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -909,14 +909,14 @@ static bool ovl_open_need_copy_up(struct
+ return true;
+ }
+
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags)
++int ovl_maybe_copy_up(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+
+- if (ovl_open_need_copy_up(dentry, file_flags)) {
++ if (ovl_open_need_copy_up(dentry, flags)) {
+ err = ovl_want_write(dentry);
+ if (!err) {
+- err = ovl_copy_up_flags(dentry, file_flags);
++ err = ovl_copy_up_flags(dentry, flags);
+ ovl_drop_write(dentry);
+ }
+ }
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct f
+
+ static int ovl_open(struct inode *inode, struct file *file)
+ {
+- struct dentry *dentry = file_dentry(file);
+ struct file *realfile;
+ int err;
+
+- err = ovl_open_maybe_copy_up(dentry, file->f_flags);
++ err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
+ if (err)
+ return err;
+
+@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file,
+ if (ret)
+ return ret;
+
+- ret = ovl_copy_up_with_data(file_dentry(file));
++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+ if (!ret) {
+ ret = ovl_real_ioctl(file, cmd, arg);
+
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -421,7 +421,7 @@ extern const struct file_operations ovl_
+ int ovl_copy_up(struct dentry *dentry);
+ int ovl_copy_up_with_data(struct dentry *dentry);
+ int ovl_copy_up_flags(struct dentry *dentry, int flags);
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
++int ovl_maybe_copy_up(struct dentry *dentry, int flags);
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new);
+ int ovl_set_attr(struct dentry *upper, struct kstat *stat);
+ struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper);
--- /dev/null
+From 8149069db81853570a665f5e5648c0e526dc0e43 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 17 Apr 2019 17:41:23 +0800
+Subject: p54: drop device reference count if fails to enable device
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream.
+
+The function p54p_probe takes an extra reference count of the PCI
+device. However, the extra reference count is not dropped when it fails
+to enable the PCI device. This patch fixes the bug.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intersil/p54/p54pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pd
+ err = pci_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Cannot enable new PCI device\n");
+- return err;
++ goto err_put;
+ }
+
+ mem_addr = pci_resource_start(pdev, 0);
+@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pd
+ pci_release_regions(pdev);
+ err_disable_dev:
+ pci_disable_device(pdev);
++err_put:
+ pci_dev_put(pdev);
+ return err;
+ }
--- /dev/null
+From 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 27 Apr 2019 23:57:49 +0200
+Subject: parisc: Add memory barrier to asm pdc and sync instructions
+
+From: Helge Deller <deller@gmx.de>
+
+commit 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 upstream.
+
+Add compiler memory barriers to ensure the compiler doesn't reorder memory
+operations around these instructions.
+
+Cc: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/cache.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -56,10 +56,10 @@ void parisc_setup_cache_timing(void);
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define asm_io_sync() asm volatile("sync" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+- ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :: )
++ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :::"memory")
+
+ #endif /* ! __ASSEMBLY__ */
+
--- /dev/null
+From 44224bdb99150ad17cf394973b25736cb92c246a Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sun, 21 Apr 2019 19:47:17 -0400
+Subject: parisc: Add memory clobber to TLB purges
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit 44224bdb99150ad17cf394973b25736cb92c246a upstream.
+
+The pdtlb and pitlb instructions are strongly ordered. The asms invoking
+these instructions should be compiler memory barriers to ensure the
+compiler doesn't reorder memory operations around these instructions.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+CC: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/cache.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -44,14 +44,14 @@ void parisc_setup_cache_timing(void);
+
+ #define pdtlb(addr) asm volatile("pdtlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pitlb(addr) asm volatile("pitlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+ ALTERNATIVE(ALT_COND_NO_SPLIT_TLB, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pdtlb_kernel(addr) asm volatile("pdtlb 0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
--- /dev/null
+From d19a12906e5e558c0f6b6cfece7b7caf1012ef95 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 1 May 2019 14:59:58 +0200
+Subject: parisc: Allow live-patching of __meminit functions
+
+From: Helge Deller <deller@gmx.de>
+
+commit d19a12906e5e558c0f6b6cfece7b7caf1012ef95 upstream.
+
+When making the text sections writeable with set_kernel_text_rw(1),
+include all text sections including those in the __init section.
+Otherwise functions marked with __meminit will stay read-only.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -512,7 +512,7 @@ static void __init map_pages(unsigned lo
+
+ void __init set_kernel_text_rw(int enable_read_write)
+ {
+- unsigned long start = (unsigned long) _text;
++ unsigned long start = (unsigned long) __init_begin;
+ unsigned long end = (unsigned long) &data_start;
+
+ map_pages(start, __pa(start), end-start,
--- /dev/null
+From 3e1120f4b57bc12437048494ab56648edaa5b57d Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 6 Apr 2019 16:45:14 +0200
+Subject: parisc: Export running_on_qemu symbol for modules
+
+From: Helge Deller <deller@gmx.de>
+
+commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/process.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *t
+ */
+
+ int running_on_qemu __read_mostly;
++EXPORT_SYMBOL(running_on_qemu);
+
+ void __cpuidle arch_cpu_idle_dead(void)
+ {
--- /dev/null
+From 1829dda0e87f4462782ca81be474c7890efe31ce Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:54:34 +0200
+Subject: parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
+
+From: Helge Deller <deller@gmx.de>
+
+commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream.
+
+LEVEL is a very common word, and now after many years it suddenly
+clashed with another LEVEL define in the DRBD code.
+Rename it to PA_ASM_LEVEL instead.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/assembly.h | 6 +++---
+ arch/parisc/kernel/head.S | 4 ++--
+ arch/parisc/kernel/syscall.S | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/parisc/include/asm/assembly.h
++++ b/arch/parisc/include/asm/assembly.h
+@@ -61,14 +61,14 @@
+ #define LDCW ldcw,co
+ #define BL b,l
+ # ifdef CONFIG_64BIT
+-# define LEVEL 2.0w
++# define PA_ASM_LEVEL 2.0w
+ # else
+-# define LEVEL 2.0
++# define PA_ASM_LEVEL 2.0
+ # endif
+ #else
+ #define LDCW ldcw
+ #define BL bl
+-#define LEVEL 1.1
++#define PA_ASM_LEVEL 1.1
+ #endif
+
+ #ifdef __ASSEMBLY__
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ __INITDATA
+ ENTRY(boot_args)
+@@ -258,7 +258,7 @@ stext_pdc_ret:
+ ldo R%PA(fault_vector_11)(%r10),%r10
+
+ $is_pa20:
+- .level LEVEL /* restore 1.1 || 2.0w */
++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */
+ #endif /*!CONFIG_64BIT*/
+ load32 PA(fault_vector_20),%r10
+
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -48,7 +48,7 @@ registers).
+ */
+ #define KILL_INSN break 0,0
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ .text
+
--- /dev/null
+From b438749044356dd1329c45e9b5a9377b6ea13eb2 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 2 Apr 2019 12:17:08 +0200
+Subject: parisc: Skip registering LED when running in QEMU
+
+From: Helge Deller <deller@gmx.de>
+
+commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream.
+
+No need to spend CPU cycles when we run on QEMU.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/parisc/led.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -568,6 +568,9 @@ int __init register_led_driver(int model
+ break;
+
+ case DISPLAY_MODEL_LASI:
++ /* Skip to register LED in QEMU */
++ if (running_on_qemu)
++ return 1;
+ LED_DATA_REG = data_reg;
+ led_func_ptr = led_LASI_driver;
+ printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG);
--- /dev/null
+From bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:55:02 +0200
+Subject: parisc: Use PA_ASM_LEVEL in boot code
+
+From: Helge Deller <deller@gmx.de>
+
+commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream.
+
+The LEVEL define clashed with the DRBD code.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/boot/compressed/head.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/boot/compressed/head.S
++++ b/arch/parisc/boot/compressed/head.S
+@@ -22,7 +22,7 @@
+ __HEAD
+
+ ENTRY(startup)
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ #define PSW_W_SM 0x200
+ #define PSW_W_BIT 36
+@@ -63,7 +63,7 @@ $bss_loop:
+ load32 BOOTADDR(decompress_kernel),%r3
+
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ ssm PSW_W_SM, %r0 /* set W-bit */
+ depdi 0, 31, 32, %r3
+ #endif
+@@ -72,7 +72,7 @@ $bss_loop:
+
+ startup_continue:
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ rsm PSW_W_SM, %r0 /* clear W-bit */
+ #endif
+
--- /dev/null
+From e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 19 Feb 2019 14:53:49 +0000
+Subject: phy: ti-pipe3: fix missing bit-wise or operator when assigning val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream.
+
+There seems to be a missing bit-wise or operator when setting val,
+fix this by adding it in.
+
+Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/ti/phy-ti-pipe3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/ti/phy-ti-pipe3.c
++++ b/drivers/phy/ti/phy-ti-pipe3.c
+@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY);
+ val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV);
+- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
+ ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val);
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES);
--- /dev/null
+From b1029c9bc078a6f1515f55dd993b507dcc7e3440 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Tue, 7 May 2019 13:41:49 -0400
+Subject: PNFS fallback to MDS if no deviceid found
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+commit b1029c9bc078a6f1515f55dd993b507dcc7e3440 upstream.
+
+If we fail to find a good deviceid while trying to pnfs instead of
+propogating an error back fallback to doing IO to the MDS. Currently,
+code with fals the IO with EINVAL.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 8d40b0f14846f ("NFS filelayout:call GETDEVICEINFO after pnfs_layout_process completes"
+Cc: stable@vger.kernel.org # v4.11+
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/filelayout/filelayout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino,
+ status = filelayout_check_deviceid(lo, fl, gfp_flags);
+ if (status) {
+ pnfs_put_lseg(lseg);
+- lseg = ERR_PTR(status);
++ lseg = NULL;
+ }
+ out:
+ return lseg;
--- /dev/null
+From 35a196bef449b5824033865b963ed9a43fb8c730 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 19 Apr 2019 14:55:12 -0400
+Subject: proc: prevent changes to overridden credentials
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream.
+
+Prevent userspace from changing the the /proc/PID/attr values if the
+task's credentials are currently overriden. This not only makes sense
+conceptually, it also prevents some really bizarre error cases caused
+when trying to commit credentials to a task with overridden
+credentials.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: "chengjian (D)" <cj.chengjian@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Acked-by: James Morris <james.morris@microsoft.com>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2550,6 +2550,11 @@ static ssize_t proc_pid_attr_write(struc
+ rcu_read_unlock();
+ return -EACCES;
+ }
++ /* Prevent changes to overridden credentials. */
++ if (current_cred() != current_real_cred()) {
++ rcu_read_unlock();
++ return -EBUSY;
++ }
+ rcu_read_unlock();
+
+ if (count > PAGE_SIZE)
--- /dev/null
+From b79656ed44c6865e17bcd93472ec39488bcc4984 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Mon, 6 May 2019 14:23:04 +0300
+Subject: RDMA/ipoib: Allow user space differentiate between valid dev_port
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+commit b79656ed44c6865e17bcd93472ec39488bcc4984 upstream.
+
+Systemd triggers the following warning during IPoIB device load:
+
+ mlx5_core 0000:00:0c.0 ib0: "systemd-udevd" wants to know my dev_id.
+ Should it look at dev_port instead?
+ See Documentation/ABI/testing/sysfs-class-net for more info.
+
+This is caused due to user space attempt to differentiate old systems
+without dev_port and new systems with dev_port. In case dev_port will be
+zero, the systemd will try to read dev_id instead.
+
+There is no need to print a warning in such case, because it is valid
+situation and it is needed to ensure systemd compatibility with old
+kernels.
+
+Link: https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
+Cc: <stable@vger.kernel.org> # 4.19
+Fixes: f6350da41dc7 ("IB/ipoib: Log sysfs 'dev_id' accesses from userspace")
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2402,7 +2402,18 @@ static ssize_t dev_id_show(struct device
+ {
+ struct net_device *ndev = to_net_dev(dev);
+
+- if (ndev->dev_id == ndev->dev_port)
++ /*
++ * ndev->dev_port will be equal to 0 in old kernel prior to commit
++ * 9b8b2a323008 ("IB/ipoib: Use dev_port to expose network interface
++ * port numbers") Zero was chosen as special case for user space
++ * applications to fallback and query dev_id to check if it has
++ * different value or not.
++ *
++ * Don't print warning in such scenario.
++ *
++ * https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
++ */
++ if (ndev->dev_port && ndev->dev_id == ndev->dev_port)
+ netdev_info_once(ndev,
+ "\"%s\" wants to know my dev_id. Should it look at dev_port instead? See Documentation/ABI/testing/sysfs-class-net for more info.\n",
+ current->comm);
--- /dev/null
+From ddcdc368b1033e19fd3a5f750752e10e28a87826 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 16 Apr 2019 14:07:29 +0300
+Subject: RDMA/mlx5: Use get_zeroed_page() for clock_info
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit ddcdc368b1033e19fd3a5f750752e10e28a87826 upstream.
+
+get_zeroed_page() returns a virtual address for the page which is better
+than allocating a struct page and doing a permanent kmap on it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 5 ++-
+ drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 30 +++++++-------------
+ include/linux/mlx5/driver.h | 1
+ 3 files changed, 14 insertions(+), 22 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1986,11 +1986,12 @@ static int mlx5_ib_mmap_clock_info_page(
+ return -EPERM;
+ vma->vm_flags &= ~VM_MAYWRITE;
+
+- if (!dev->mdev->clock_info_page)
++ if (!dev->mdev->clock_info)
+ return -EOPNOTSUPP;
+
+ return rdma_user_mmap_page(&context->ibucontext, vma,
+- dev->mdev->clock_info_page, PAGE_SIZE);
++ virt_to_page(dev->mdev->clock_info),
++ PAGE_SIZE);
+ }
+
+ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd,
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -535,23 +535,16 @@ void mlx5_init_clock(struct mlx5_core_de
+ do_div(ns, NSEC_PER_SEC / HZ);
+ clock->overflow_period = ns;
+
+- mdev->clock_info_page = alloc_page(GFP_KERNEL);
+- if (mdev->clock_info_page) {
+- mdev->clock_info = kmap(mdev->clock_info_page);
+- if (!mdev->clock_info) {
+- __free_page(mdev->clock_info_page);
+- mlx5_core_warn(mdev, "failed to map clock page\n");
+- } else {
+- mdev->clock_info->sign = 0;
+- mdev->clock_info->nsec = clock->tc.nsec;
+- mdev->clock_info->cycles = clock->tc.cycle_last;
+- mdev->clock_info->mask = clock->cycles.mask;
+- mdev->clock_info->mult = clock->nominal_c_mult;
+- mdev->clock_info->shift = clock->cycles.shift;
+- mdev->clock_info->frac = clock->tc.frac;
+- mdev->clock_info->overflow_period =
+- clock->overflow_period;
+- }
++ mdev->clock_info =
++ (struct mlx5_ib_clock_info *)get_zeroed_page(GFP_KERNEL);
++ if (mdev->clock_info) {
++ mdev->clock_info->nsec = clock->tc.nsec;
++ mdev->clock_info->cycles = clock->tc.cycle_last;
++ mdev->clock_info->mask = clock->cycles.mask;
++ mdev->clock_info->mult = clock->nominal_c_mult;
++ mdev->clock_info->shift = clock->cycles.shift;
++ mdev->clock_info->frac = clock->tc.frac;
++ mdev->clock_info->overflow_period = clock->overflow_period;
+ }
+
+ INIT_WORK(&clock->pps_info.out_work, mlx5_pps_out);
+@@ -599,8 +592,7 @@ void mlx5_cleanup_clock(struct mlx5_core
+ cancel_delayed_work_sync(&clock->overflow_work);
+
+ if (mdev->clock_info) {
+- kunmap(mdev->clock_info_page);
+- __free_page(mdev->clock_info_page);
++ free_page((unsigned long)mdev->clock_info);
+ mdev->clock_info = NULL;
+ }
+
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -677,7 +677,6 @@ struct mlx5_core_dev {
+ #endif
+ struct mlx5_clock clock;
+ struct mlx5_ib_clock_info *clock_info;
+- struct page *clock_info_page;
+ struct mlx5_fw_tracer *tracer;
+ };
+
--- /dev/null
+From 70b464918e5331e488058870fcc6821d54c4e541 Mon Sep 17 00:00:00 2001
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+Date: Mon, 18 Mar 2019 16:17:57 +0000
+Subject: regulator: core: fix error path for regulator_set_voltage_unlocked
+
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+
+commit 70b464918e5331e488058870fcc6821d54c4e541 upstream.
+
+During several error paths in the function
+regulator_set_voltage_unlocked() the value of 'ret' can take on negative
+error values. However, in calls that go through the 'goto out' statement,
+this return value is lost and return 0 is used instead, indicating a
+'pass'.
+
+There are several cases where this function should legitimately return a
+fail instead of a pass: one such case includes constraints check during
+voltage selection in the call to regulator_check_voltage(), which can
+have -EINVAL for the case when an unsupported voltage is incorrectly
+requested. In that case, -22 is expected as the return value, not 0.
+
+Fixes: 9243a195be7a ("regulator: core: Change voltage setting path")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Steve Twiss <stwiss.opensource@diasemi.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3360,15 +3360,12 @@ static int regulator_set_voltage_unlocke
+
+ /* for not coupled regulators this will just set the voltage */
+ ret = regulator_balance_voltage(rdev, state);
+- if (ret < 0)
+- goto out2;
++ if (ret < 0) {
++ voltage->min_uV = old_min_uV;
++ voltage->max_uV = old_max_uV;
++ }
+
+ out:
+- return 0;
+-out2:
+- voltage->min_uV = old_min_uV;
+- voltage->max_uV = old_max_uV;
+-
+ return ret;
+ }
+
--- /dev/null
+From 4bc034d35377196c854236133b07730a777c4aba Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:16 -0700
+Subject: Revert "MD: fix lock contention for flush bios"
+
+From: NeilBrown <neilb@suse.com>
+
+commit 4bc034d35377196c854236133b07730a777c4aba upstream.
+
+This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85.
+
+This patch has two problems.
+
+1/ it make multiple calls to submit_bio() from inside a make_request_fn.
+ The bios thus submitted will be queued on current->bio_list and not
+ submitted immediately. As the bios are allocated from a mempool,
+ this can theoretically result in a deadlock - all the pool of requests
+ could be in various ->bio_list queues and a subsequent mempool_alloc
+ could block waiting for one of them to be released.
+
+2/ It aims to handle a case when there are many concurrent flush requests.
+ It handles this by submitting many requests in parallel - all of which
+ are identical and so most of which do nothing useful.
+ It would be more efficient to just send one lower-level request, but
+ allow that to satisfy multiple upper-level requests.
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 159 +++++++++++++++++++-------------------------------------
+ drivers/md/md.h | 22 ++-----
+ 2 files changed, 62 insertions(+), 119 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev
+ mddev->sync_speed_max : sysctl_speed_limit_max;
+ }
+
+-static void * flush_info_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_info), gfp_flags);
+-}
+-static void flush_info_free(void *flush_info, void *data)
+-{
+- kfree(flush_info);
+-}
+-
+-static void * flush_bio_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_bio), gfp_flags);
+-}
+-static void flush_bio_free(void *flush_bio, void *data)
+-{
+- kfree(flush_bio);
+-}
+-
+ static struct ctl_table_header *raid_table_header;
+
+ static struct ctl_table raid_table[] = {
+@@ -423,54 +405,30 @@ static int md_congested(void *data, int
+ /*
+ * Generic flush handling for md
+ */
+-static void submit_flushes(struct work_struct *ws)
+-{
+- struct flush_info *fi = container_of(ws, struct flush_info, flush_work);
+- struct mddev *mddev = fi->mddev;
+- struct bio *bio = fi->bio;
+-
+- bio->bi_opf &= ~REQ_PREFLUSH;
+- md_handle_request(mddev, bio);
+-
+- mempool_free(fi, mddev->flush_pool);
+-}
+
+-static void md_end_flush(struct bio *fbio)
++static void md_end_flush(struct bio *bio)
+ {
+- struct flush_bio *fb = fbio->bi_private;
+- struct md_rdev *rdev = fb->rdev;
+- struct flush_info *fi = fb->fi;
+- struct bio *bio = fi->bio;
+- struct mddev *mddev = fi->mddev;
++ struct md_rdev *rdev = bio->bi_private;
++ struct mddev *mddev = rdev->mddev;
+
+ rdev_dec_pending(rdev, mddev);
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++ if (atomic_dec_and_test(&mddev->flush_pending)) {
++ /* The pre-request flush has finished */
++ queue_work(md_wq, &mddev->flush_work);
+ }
+-
+- mempool_free(fb, mddev->flush_bio_pool);
+- bio_put(fbio);
++ bio_put(bio);
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++static void md_submit_flush_data(struct work_struct *ws);
++
++static void submit_flushes(struct work_struct *ws)
+ {
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+- struct flush_info *fi;
+-
+- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO);
+-
+- fi->bio = bio;
+- fi->mddev = mddev;
+- atomic_set(&fi->flush_pending, 1);
+
++ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
++ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+ rdev_for_each_rcu(rdev, mddev)
+ if (rdev->raid_disk >= 0 &&
+@@ -480,40 +438,59 @@ void md_flush_request(struct mddev *mdde
+ * we reclaim rcu_read_lock
+ */
+ struct bio *bi;
+- struct flush_bio *fb;
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+-
+- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO);
+- fb->fi = fi;
+- fb->rdev = rdev;
+-
+ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+- bio_set_dev(bi, rdev->bdev);
+ bi->bi_end_io = md_end_flush;
+- bi->bi_private = fb;
++ bi->bi_private = rdev;
++ bio_set_dev(bi, rdev->bdev);
+ bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+-
+- atomic_inc(&fi->flush_pending);
++ atomic_inc(&mddev->flush_pending);
+ submit_bio(bi);
+-
+ rcu_read_lock();
+ rdev_dec_pending(rdev, mddev);
+ }
+ rcu_read_unlock();
++ if (atomic_dec_and_test(&mddev->flush_pending))
++ queue_work(md_wq, &mddev->flush_work);
++}
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++static void md_submit_flush_data(struct work_struct *ws)
++{
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
++ struct bio *bio = mddev->flush_bio;
++
++ /*
++ * must reset flush_bio before calling into md_handle_request to avoid a
++ * deadlock, because other bios passed md_handle_request suspend check
++ * could wait for this and below md_handle_request could wait for those
++ * bios because of suspend check
++ */
++ mddev->flush_bio = NULL;
++ wake_up(&mddev->sb_wait);
++
++ if (bio->bi_iter.bi_size == 0) {
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ } else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ md_handle_request(mddev, bio);
+ }
+ }
++
++void md_flush_request(struct mddev *mddev, struct bio *bio)
++{
++ spin_lock_irq(&mddev->lock);
++ wait_event_lock_irq(mddev->sb_wait,
++ !mddev->flush_bio,
++ mddev->lock);
++ mddev->flush_bio = bio;
++ spin_unlock_irq(&mddev->lock);
++
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++}
+ EXPORT_SYMBOL(md_flush_request);
+
+ static inline struct mddev *mddev_get(struct mddev *mddev)
+@@ -560,6 +537,7 @@ void mddev_init(struct mddev *mddev)
+ atomic_set(&mddev->openers, 0);
+ atomic_set(&mddev->active_io, 0);
+ spin_lock_init(&mddev->lock);
++ atomic_set(&mddev->flush_pending, 0);
+ init_waitqueue_head(&mddev->sb_wait);
+ init_waitqueue_head(&mddev->recovery_wait);
+ mddev->reshape_position = MaxSector;
+@@ -5511,22 +5489,6 @@ int md_run(struct mddev *mddev)
+ if (err)
+ return err;
+ }
+- if (mddev->flush_pool == NULL) {
+- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc,
+- flush_info_free, mddev);
+- if (!mddev->flush_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+- if (mddev->flush_bio_pool == NULL) {
+- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc,
+- flush_bio_free, mddev);
+- if (!mddev->flush_bio_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+
+ spin_lock(&pers_lock);
+ pers = find_pers(mddev->level, mddev->clevel);
+@@ -5686,11 +5648,8 @@ int md_run(struct mddev *mddev)
+ return 0;
+
+ abort:
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+-
++ bioset_exit(&mddev->bio_set);
++ bioset_exit(&mddev->sync_set);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(md_run);
+@@ -5894,14 +5853,6 @@ static void __md_stop(struct mddev *mdde
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+- if (mddev->flush_bio_pool) {
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- }
+- if (mddev->flush_pool) {
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+- }
+ }
+
+ void md_stop(struct mddev *mddev)
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -252,19 +252,6 @@ enum mddev_sb_flags {
+ MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */
+ };
+
+-#define NR_FLUSH_INFOS 8
+-#define NR_FLUSH_BIOS 64
+-struct flush_info {
+- struct bio *bio;
+- struct mddev *mddev;
+- struct work_struct flush_work;
+- atomic_t flush_pending;
+-};
+-struct flush_bio {
+- struct flush_info *fi;
+- struct md_rdev *rdev;
+-};
+-
+ struct mddev {
+ void *private;
+ struct md_personality *pers;
+@@ -470,8 +457,13 @@ struct mddev {
+ * metadata and bitmap writes
+ */
+
+- mempool_t *flush_pool;
+- mempool_t *flush_bio_pool;
++ /* Generic flush handling.
++ * The last to finish preflush schedules a worker to submit
++ * the rest of the request (without the REQ_PREFLUSH flag).
++ */
++ struct bio *flush_bio;
++ atomic_t flush_pending;
++ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+ struct md_cluster_info *cluster_info;
net-mlx5-imply-mlxfw-in-mlx5_core.patch
net-mlx5e-fix-ethtool-rxfh-commands-when-config_mlx5_en_rxnfc-is-disabled.patch
mm-gup-remove-the-write-parameter-from-gup_fast_permitted.patch
+blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch
+regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch
+parisc-export-running_on_qemu-symbol-for-modules.patch
+parisc-add-memory-clobber-to-tlb-purges.patch
+parisc-skip-registering-led-when-running-in-qemu.patch
+parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch
+parisc-allow-live-patching-of-__meminit-functions.patch
+parisc-use-pa_asm_level-in-boot-code.patch
+parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch
+stm-class-fix-channel-free-in-stm-output-free-path.patch
+stm-class-fix-channel-bitmap-on-32-bit-systems.patch
+brd-re-enable-__gfp_highmem-in-brd_insert_page.patch
+proc-prevent-changes-to-overridden-credentials.patch
+revert-md-fix-lock-contention-for-flush-bios.patch
+md-batch-flush-requests.patch
+md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch
+md-add-a-missing-endianness-conversion-in-check_sb_changes.patch
+dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch
+intel_th-msu-fix-single-mode-with-iommu.patch
+p54-drop-device-reference-count-if-fails-to-enable-device.patch
+of-fix-clang-wunsequenced-for-be32_to_cpu.patch
+brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch
+cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch
+phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch
+media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch
+media-imx-csi-allow-unknown-nearest-upstream-entities.patch
+media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
+rdma-mlx5-use-get_zeroed_page-for-clock_info.patch
+rdma-ipoib-allow-user-space-differentiate-between-valid-dev_port.patch
+nfs4-fix-v4.0-client-state-corruption-when-mount.patch
+pnfs-fallback-to-mds-if-no-deviceid-found.patch
+clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch
+clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch
+clk-mediatek-disable-tuner_en-before-change-pll-rate.patch
+clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
+udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch
+udlfb-fix-sleeping-inside-spinlock.patch
+udlfb-introduce-a-rendering-mutex.patch
+fuse-fix-writepages-on-32bit.patch
+fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch
+ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch
+gcc-plugins-arm_ssp_per_task_plugin-fix-for-older-gcc-6.patch
+iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch
+ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
--- /dev/null
+From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:35 +0300
+Subject: stm class: Fix channel bitmap on 32-bit systems
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream.
+
+Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace
+Module devices") naively calculates the channel bitmap size in 64-bit
+chunks regardless of the size of underlying unsigned long, making the
+bitmap half as big on a 32-bit system. This leads to an out of bounds
+access with the upper half of the bitmap.
+
+Fix this by using BITS_TO_LONGS. While at it, convert to using
+struct_size() for the total size calculation of the master struct.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Reported-by: Mulu He <muluhe@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig
+ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
+ {
+ struct stp_master *master;
+- size_t size;
+
+- size = ALIGN(stm->data->sw_nchannels, 8) / 8;
+- size += sizeof(struct stp_master);
+- master = kzalloc(size, GFP_ATOMIC);
++ master = kzalloc(struct_size(master, chan_map,
++ BITS_TO_LONGS(stm->data->sw_nchannels)),
++ GFP_ATOMIC);
+ if (!master)
+ return -ENOMEM;
+
--- /dev/null
+From ee496da4c3915de3232b5f5cd20e21ae3e46fe8d Mon Sep 17 00:00:00 2001
+From: Tingwei Zhang <tingwei@codeaurora.org>
+Date: Wed, 17 Apr 2019 10:35:34 +0300
+Subject: stm class: Fix channel free in stm output free path
+
+From: Tingwei Zhang <tingwei@codeaurora.org>
+
+commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream.
+
+Number of free masters is not set correctly in stm
+free path. Fix this by properly adding the number
+of output channels before setting them to 0 in
+stm_output_disclaim().
+
+Currently it is equivalent to doing nothing since
+master->nr_free is incremented by 0.
+
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Signed-off-by: Tingwei Zhang <tingwei@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *s
+ bitmap_release_region(&master->chan_map[0], output->channel,
+ ilog2(output->nr_chans));
+
+- output->nr_chans = 0;
+ master->nr_free += output->nr_chans;
++ output->nr_chans = 0;
+ }
+
+ /*
--- /dev/null
+From bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: delete the unused parameter for dlfb_handle_damage
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 upstream.
+
+Remove the unused parameter "data" and unused variable "ret".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -594,10 +594,9 @@ static int dlfb_render_hline(struct dlfb
+ return 0;
+ }
+
+-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+- int width, int height, char *data)
++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i, ret;
++ int i;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -641,7 +640,7 @@ static int dlfb_handle_damage(struct dlf
+ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+ len = cmd - (char *) urb->transfer_buffer;
+- ret = dlfb_submit_urb(dlfb, urb, len);
++ dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+ dlfb_urb_completion(urb);
+@@ -679,7 +678,7 @@ static ssize_t dlfb_ops_write(struct fb_
+ (u32)info->var.yres);
+
+ dlfb_handle_damage(dlfb, 0, start, info->var.xres,
+- lines, info->screen_base);
++ lines);
+ }
+
+ return result;
+@@ -695,7 +694,7 @@ static void dlfb_ops_copyarea(struct fb_
+ sys_copyarea(info, area);
+
+ dlfb_handle_damage(dlfb, area->dx, area->dy,
+- area->width, area->height, info->screen_base);
++ area->width, area->height);
+ }
+
+ static void dlfb_ops_imageblit(struct fb_info *info,
+@@ -706,7 +705,7 @@ static void dlfb_ops_imageblit(struct fb
+ sys_imageblit(info, image);
+
+ dlfb_handle_damage(dlfb, image->dx, image->dy,
+- image->width, image->height, info->screen_base);
++ image->width, image->height);
+ }
+
+ static void dlfb_ops_fillrect(struct fb_info *info,
+@@ -717,7 +716,7 @@ static void dlfb_ops_fillrect(struct fb_
+ sys_fillrect(info, rect);
+
+ dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
+- rect->height, info->screen_base);
++ rect->height);
+ }
+
+ /*
+@@ -859,8 +858,7 @@ static int dlfb_ops_ioctl(struct fb_info
+ if (area.y > info->var.yres)
+ area.y = info->var.yres;
+
+- dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h);
+ }
+
+ return 0;
+@@ -1065,8 +1063,7 @@ static int dlfb_ops_set_par(struct fb_in
+ pix_framebuffer[i] = 0x37e6;
+ }
+
+- dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres);
+
+ return 0;
+ }
--- /dev/null
+From 6b11f9d8433b471fdd3ebed232b43a4b723be6ff Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: fix sleeping inside spinlock
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6b11f9d8433b471fdd3ebed232b43a4b723be6ff upstream.
+
+If a framebuffer device is used as a console, the rendering calls
+(copyarea, fillrect, imageblit) may be done with the console spinlock
+held. On udlfb, these function call dlfb_handle_damage that takes a
+blocking semaphore before acquiring an URB.
+
+In order to fix the bug, this patch changes the calls copyarea, fillrect
+and imageblit to offload USB work to a workqueue.
+
+A side effect of this patch is 3x improvement in console scrolling speed
+because the device doesn't have to be updated after each copyarea call.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 56 +++++++++++++++++++++++++++++++++++++++++---
+ include/video/udlfb.h | 6 ++++
+ 2 files changed, 59 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -657,6 +657,50 @@ error:
+ return 0;
+ }
+
++static void dlfb_init_damage(struct dlfb_data *dlfb)
++{
++ dlfb->damage_x = INT_MAX;
++ dlfb->damage_x2 = 0;
++ dlfb->damage_y = INT_MAX;
++ dlfb->damage_y2 = 0;
++}
++
++static void dlfb_damage_work(struct work_struct *w)
++{
++ struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work);
++ int x, x2, y, y2;
++
++ spin_lock_irq(&dlfb->damage_lock);
++ x = dlfb->damage_x;
++ x2 = dlfb->damage_x2;
++ y = dlfb->damage_y;
++ y2 = dlfb->damage_y2;
++ dlfb_init_damage(dlfb);
++ spin_unlock_irq(&dlfb->damage_lock);
++
++ if (x < x2 && y < y2)
++ dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y);
++}
++
++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
++{
++ unsigned long flags;
++ int x2 = x + width;
++ int y2 = y + height;
++
++ if (x >= x2 || y >= y2)
++ return;
++
++ spin_lock_irqsave(&dlfb->damage_lock, flags);
++ dlfb->damage_x = min(x, dlfb->damage_x);
++ dlfb->damage_x2 = max(x2, dlfb->damage_x2);
++ dlfb->damage_y = min(y, dlfb->damage_y);
++ dlfb->damage_y2 = max(y2, dlfb->damage_y2);
++ spin_unlock_irqrestore(&dlfb->damage_lock, flags);
++
++ schedule_work(&dlfb->damage_work);
++}
++
+ /*
+ * Path triggered by usermode clients who write to filesystem
+ * e.g. cat filename > /dev/fb1
+@@ -693,7 +737,7 @@ static void dlfb_ops_copyarea(struct fb_
+
+ sys_copyarea(info, area);
+
+- dlfb_handle_damage(dlfb, area->dx, area->dy,
++ dlfb_offload_damage(dlfb, area->dx, area->dy,
+ area->width, area->height);
+ }
+
+@@ -704,7 +748,7 @@ static void dlfb_ops_imageblit(struct fb
+
+ sys_imageblit(info, image);
+
+- dlfb_handle_damage(dlfb, image->dx, image->dy,
++ dlfb_offload_damage(dlfb, image->dx, image->dy,
+ image->width, image->height);
+ }
+
+@@ -715,7 +759,7 @@ static void dlfb_ops_fillrect(struct fb_
+
+ sys_fillrect(info, rect);
+
+- dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
++ dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width,
+ rect->height);
+ }
+
+@@ -940,6 +984,8 @@ static void dlfb_ops_destroy(struct fb_i
+ {
+ struct dlfb_data *dlfb = info->par;
+
++ cancel_work_sync(&dlfb->damage_work);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1636,6 +1682,10 @@ static int dlfb_usb_probe(struct usb_int
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ dlfb_init_damage(dlfb);
++ spin_lock_init(&dlfb->damage_lock);
++ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
++
+ INIT_LIST_HEAD(&info->modelist);
+
+ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,12 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ int damage_x;
++ int damage_y;
++ int damage_x2;
++ int damage_y2;
++ spinlock_t damage_lock;
++ struct work_struct damage_work;
+ struct fb_ops ops;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
--- /dev/null
+From babc250e278eac7b0e671bdaedf833759b43bb78 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:57 +0200
+Subject: udlfb: introduce a rendering mutex
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit babc250e278eac7b0e671bdaedf833759b43bb78 upstream.
+
+Rendering calls may be done simultaneously from the workqueue,
+dlfb_ops_write, dlfb_ops_ioctl, dlfb_ops_set_par and dlfb_dpy_deferred_io.
+The code is robust enough so that it won't crash on concurrent rendering.
+
+However, concurrent rendering may cause display corruption if the same
+pixel is simultaneously being rendered. In order to avoid this corruption,
+this patch adds a mutex around the rendering calls.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+[b.zolnierkie: replace "dlfb:" with "uldfb:" in the patch summary]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c | 41 ++++++++++++++++++++++++++++++-----------
+ include/video/udlfb.h | 1 +
+ 2 files changed, 31 insertions(+), 11 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -596,7 +596,7 @@ static int dlfb_render_hline(struct dlfb
+
+ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i;
++ int i, ret;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -606,21 +606,29 @@ static int dlfb_handle_damage(struct dlf
+
+ start_cycles = get_cycles();
+
++ mutex_lock(&dlfb->render_mutex);
++
+ aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long));
+ width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long));
+ x = aligned_x;
+
+ if ((width <= 0) ||
+ (x + width > dlfb->info->var.xres) ||
+- (y + height > dlfb->info->var.yres))
+- return -EINVAL;
++ (y + height > dlfb->info->var.yres)) {
++ ret = -EINVAL;
++ goto unlock_ret;
++ }
+
+- if (!atomic_read(&dlfb->usb_active))
+- return 0;
++ if (!atomic_read(&dlfb->usb_active)) {
++ ret = 0;
++ goto unlock_ret;
++ }
+
+ urb = dlfb_get_urb(dlfb);
+- if (!urb)
+- return 0;
++ if (!urb) {
++ ret = 0;
++ goto unlock_ret;
++ }
+ cmd = urb->transfer_buffer;
+
+ for (i = y; i < y + height ; i++) {
+@@ -654,7 +662,11 @@ error:
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
+
+- return 0;
++ ret = 0;
++
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
++ return ret;
+ }
+
+ static void dlfb_init_damage(struct dlfb_data *dlfb)
+@@ -782,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct
+ int bytes_identical = 0;
+ int bytes_rendered = 0;
+
++ mutex_lock(&dlfb->render_mutex);
++
+ if (!fb_defio)
+- return;
++ goto unlock_ret;
+
+ if (!atomic_read(&dlfb->usb_active))
+- return;
++ goto unlock_ret;
+
+ start_cycles = get_cycles();
+
+ urb = dlfb_get_urb(dlfb);
+ if (!urb)
+- return;
++ goto unlock_ret;
+
+ cmd = urb->transfer_buffer;
+
+@@ -825,6 +839,8 @@ error:
+ atomic_add(((unsigned int) ((end_cycles - start_cycles)
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
+ }
+
+ static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len)
+@@ -986,6 +1002,8 @@ static void dlfb_ops_destroy(struct fb_i
+
+ cancel_work_sync(&dlfb->damage_work);
+
++ mutex_destroy(&dlfb->render_mutex);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1682,6 +1700,7 @@ static int dlfb_usb_probe(struct usb_int
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ mutex_init(&dlfb->render_mutex);
+ dlfb_init_damage(dlfb);
+ spin_lock_init(&dlfb->damage_lock);
+ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,7 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ struct mutex render_mutex;
+ int damage_x;
+ int damage_y;
+ int damage_x2;
projects / thirdparty / kernel / stable-queue.git / commitdiff
