]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.19-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 May 2019 09:29:04 +0000 (11:29 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 May 2019 09:29:04 +0000 (11:29 +0200)
added patches:
brd-re-enable-__gfp_highmem-in-brd_insert_page.patch
ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch
clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch
clk-mediatek-disable-tuner_en-before-change-pll-rate.patch
clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch
dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch
fuse-fix-writepages-on-32bit.patch
fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch
intel_th-msu-fix-single-mode-with-iommu.patch
iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch
md-add-a-missing-endianness-conversion-in-check_sb_changes.patch
md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch
md-batch-flush-requests.patch
media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
media-imx-csi-allow-unknown-nearest-upstream-entities.patch
media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch
nfs4-fix-v4.0-client-state-corruption-when-mount.patch
of-fix-clang-wunsequenced-for-be32_to_cpu.patch
ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch
p54-drop-device-reference-count-if-fails-to-enable-device.patch
parisc-export-running_on_qemu-symbol-for-modules.patch
parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch
parisc-skip-registering-led-when-running-in-qemu.patch
parisc-use-pa_asm_level-in-boot-code.patch
phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch
pnfs-fallback-to-mds-if-no-deviceid-found.patch
proc-prevent-changes-to-overridden-credentials.patch
revert-md-fix-lock-contention-for-flush-bios.patch
stm-class-fix-channel-bitmap-on-32-bit-systems.patch
stm-class-fix-channel-free-in-stm-output-free-path.patch
udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch
udlfb-fix-sleeping-inside-spinlock.patch
udlfb-introduce-a-rendering-mutex.patch

36 files changed:
queue-4.19/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch [new file with mode: 0644]
queue-4.19/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch [new file with mode: 0644]
queue-4.19/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch [new file with mode: 0644]
queue-4.19/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch [new file with mode: 0644]
queue-4.19/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch [new file with mode: 0644]
queue-4.19/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch [new file with mode: 0644]
queue-4.19/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch [new file with mode: 0644]
queue-4.19/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch [new file with mode: 0644]
queue-4.19/fuse-fix-writepages-on-32bit.patch [new file with mode: 0644]
queue-4.19/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch [new file with mode: 0644]
queue-4.19/intel_th-msu-fix-single-mode-with-iommu.patch [new file with mode: 0644]
queue-4.19/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch [new file with mode: 0644]
queue-4.19/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch [new file with mode: 0644]
queue-4.19/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch [new file with mode: 0644]
queue-4.19/md-batch-flush-requests.patch [new file with mode: 0644]
queue-4.19/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch [new file with mode: 0644]
queue-4.19/media-imx-csi-allow-unknown-nearest-upstream-entities.patch [new file with mode: 0644]
queue-4.19/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch [new file with mode: 0644]
queue-4.19/nfs4-fix-v4.0-client-state-corruption-when-mount.patch [new file with mode: 0644]
queue-4.19/of-fix-clang-wunsequenced-for-be32_to_cpu.patch [new file with mode: 0644]
queue-4.19/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch [new file with mode: 0644]
queue-4.19/p54-drop-device-reference-count-if-fails-to-enable-device.patch [new file with mode: 0644]
queue-4.19/parisc-export-running_on_qemu-symbol-for-modules.patch [new file with mode: 0644]
queue-4.19/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch [new file with mode: 0644]
queue-4.19/parisc-skip-registering-led-when-running-in-qemu.patch [new file with mode: 0644]
queue-4.19/parisc-use-pa_asm_level-in-boot-code.patch [new file with mode: 0644]
queue-4.19/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch [new file with mode: 0644]
queue-4.19/pnfs-fallback-to-mds-if-no-deviceid-found.patch [new file with mode: 0644]
queue-4.19/proc-prevent-changes-to-overridden-credentials.patch [new file with mode: 0644]
queue-4.19/revert-md-fix-lock-contention-for-flush-bios.patch [new file with mode: 0644]
queue-4.19/series
queue-4.19/stm-class-fix-channel-bitmap-on-32-bit-systems.patch [new file with mode: 0644]
queue-4.19/stm-class-fix-channel-free-in-stm-output-free-path.patch [new file with mode: 0644]
queue-4.19/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch [new file with mode: 0644]
queue-4.19/udlfb-fix-sleeping-inside-spinlock.patch [new file with mode: 0644]
queue-4.19/udlfb-introduce-a-rendering-mutex.patch [new file with mode: 0644]

diff --git a/queue-4.19/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch b/queue-4.19/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch
new file mode 100644 (file)
index 0000000..017ce52
--- /dev/null
@@ -0,0 +1,43 @@
+From f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Mon, 22 Apr 2019 21:23:21 +0800
+Subject: brd: re-enable __GFP_HIGHMEM in brd_insert_page()
+
+From: Hou Tao <houtao1@huawei.com>
+
+commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream.
+
+__GFP_HIGHMEM is disabled if dax is enabled on brd, however
+dax support for brd has been removed since commit (7a862fbbdec6
+"brd: remove dax support"), so restore __GFP_HIGHMEM in
+brd_insert_page().
+
+Also remove the no longer applicable comments about DAX and highmem.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a862fbbdec6 ("brd: remove dax support")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/brd.c |    7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -96,13 +96,8 @@ static struct page *brd_insert_page(stru
+       /*
+        * Must use NOIO because we don't want to recurse back into the
+        * block or filesystem layers from page reclaim.
+-       *
+-       * Cannot support DAX and highmem, because our ->direct_access
+-       * routine for DAX must return memory that is always addressable.
+-       * If DAX was reworked to use pfns and kmap throughout, this
+-       * restriction might be able to be lifted.
+        */
+-      gfp_flags = GFP_NOIO | __GFP_ZERO;
++      gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+       page = alloc_page(gfp_flags);
+       if (!page)
+               return NULL;
diff --git a/queue-4.19/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch b/queue-4.19/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
new file mode 100644 (file)
index 0000000..69069e4
--- /dev/null
@@ -0,0 +1,48 @@
+From 00abf69dd24f4444d185982379c5cc3bb7b6d1fc Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Tue, 7 May 2019 09:20:54 -0400
+Subject: ceph: flush dirty inodes before proceeding with remount
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit 00abf69dd24f4444d185982379c5cc3bb7b6d1fc upstream.
+
+xfstest generic/452 was triggering a "Busy inodes after umount" warning.
+ceph was allowing the mount to go read-only without first flushing out
+dirty inodes in the cache. Ensure we sync out the filesystem before
+allowing a remount to proceed.
+
+Cc: stable@vger.kernel.org
+Link: http://tracker.ceph.com/issues/39571
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ceph/super.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -819,6 +819,12 @@ static void ceph_umount_begin(struct sup
+       return;
+ }
++static int ceph_remount(struct super_block *sb, int *flags, char *data)
++{
++      sync_filesystem(sb);
++      return 0;
++}
++
+ static const struct super_operations ceph_super_ops = {
+       .alloc_inode    = ceph_alloc_inode,
+       .destroy_inode  = ceph_destroy_inode,
+@@ -826,6 +832,7 @@ static const struct super_operations cep
+       .drop_inode     = ceph_drop_inode,
+       .sync_fs        = ceph_sync_fs,
+       .put_super      = ceph_put_super,
++      .remount_fs     = ceph_remount,
+       .show_options   = ceph_show_options,
+       .statfs         = ceph_statfs,
+       .umount_begin   = ceph_umount_begin,
diff --git a/queue-4.19/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch b/queue-4.19/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch
new file mode 100644 (file)
index 0000000..56c1fa4
--- /dev/null
@@ -0,0 +1,62 @@
+From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001
+From: Christoph Probst <kernel@probst.it>
+Date: Tue, 7 May 2019 17:16:40 +0200
+Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
+
+From: Christoph Probst <kernel@probst.it>
+
+commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
+
+Change strcat to strncpy in the "None" case to fix a buffer overflow
+when cinode->oplock is reset to 0 by another thread accessing the same
+cinode. It is never valid to append "None" to any other message.
+
+Consolidate multiple writes to cinode->oplock to reduce raciness.
+
+Signed-off-by: Christoph Probst <kernel@probst.it>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2348,26 +2348,28 @@ smb21_set_oplock_level(struct cifsInodeI
+                      unsigned int epoch, bool *purge_cache)
+ {
+       char message[5] = {0};
++      unsigned int new_oplock = 0;
+       oplock &= 0xFF;
+       if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+               return;
+-      cinode->oplock = 0;
+       if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+-              cinode->oplock |= CIFS_CACHE_READ_FLG;
++              new_oplock |= CIFS_CACHE_READ_FLG;
+               strcat(message, "R");
+       }
+       if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
+-              cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
++              new_oplock |= CIFS_CACHE_HANDLE_FLG;
+               strcat(message, "H");
+       }
+       if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
+-              cinode->oplock |= CIFS_CACHE_WRITE_FLG;
++              new_oplock |= CIFS_CACHE_WRITE_FLG;
+               strcat(message, "W");
+       }
+-      if (!cinode->oplock)
+-              strcat(message, "None");
++      if (!new_oplock)
++              strncpy(message, "None", sizeof(message));
++
++      cinode->oplock = new_oplock;
+       cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+                &cinode->vfs_inode);
+ }
diff --git a/queue-4.19/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch b/queue-4.19/clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch
new file mode 100644 (file)
index 0000000..8a13d1e
--- /dev/null
@@ -0,0 +1,44 @@
+From 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa Mon Sep 17 00:00:00 2001
+From: Leo Yan <leo.yan@linaro.org>
+Date: Wed, 20 Mar 2019 18:05:08 +0800
+Subject: clk: hi3660: Mark clk_gate_ufs_subsys as critical
+
+From: Leo Yan <leo.yan@linaro.org>
+
+commit 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa upstream.
+
+clk_gate_ufs_subsys is a system bus clock, turning off it will
+introduce lockup issue during system suspend flow.  Let's mark
+clk_gate_ufs_subsys as critical clock, thus keeps it on during
+system suspend and resume.
+
+Fixes: d374e6fd5088 ("clk: hisilicon: Add clock driver for hi3660 SoC")
+Cc: stable@vger.kernel.org
+Cc: Zhong Kaihua <zhongkaihua@huawei.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Zhangfei Gao <zhangfei.gao@linaro.org>
+Suggested-by: Dong Zhang <zhangdong46@hisilicon.com>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/hisilicon/clk-hi3660.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi36
+         "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, },
+       { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2",
+         "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, },
++      /*
++       * clk_gate_ufs_subsys is a system bus clock, mark it as critical
++       * clock and keep it on for system suspend and resume.
++       */
+       { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus",
+-        CLK_SET_RATE_PARENT, 0x50, 21, 0, },
++        CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, },
+       { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus",
+         CLK_SET_RATE_PARENT, 0x50, 28, 0, },
+       { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus",
diff --git a/queue-4.19/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch b/queue-4.19/clk-mediatek-disable-tuner_en-before-change-pll-rate.patch
new file mode 100644 (file)
index 0000000..eb5621d
--- /dev/null
@@ -0,0 +1,113 @@
+From be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb Mon Sep 17 00:00:00 2001
+From: Owen Chen <owen.chen@mediatek.com>
+Date: Tue, 5 Mar 2019 13:05:38 +0800
+Subject: clk: mediatek: Disable tuner_en before change PLL rate
+
+From: Owen Chen <owen.chen@mediatek.com>
+
+commit be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb upstream.
+
+PLLs with tuner_en bit, such as APLL1, need to disable
+tuner_en before apply new frequency settings, or the new frequency
+settings (pcw) will not be applied.
+The tuner_en bit will be disabled during changing PLL rate
+and be restored after new settings applied.
+
+Fixes: e2f744a82d725 (clk: mediatek: Add MT2712 clock support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Owen Chen <owen.chen@mediatek.com>
+Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>
+Reviewed-by: James Liao <jamesjj.liao@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/mediatek/clk-pll.c |   48 +++++++++++++++++++++++++++++------------
+ 1 file changed, 34 insertions(+), 14 deletions(-)
+
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_ra
+       return ((unsigned long)vco + postdiv - 1) / postdiv;
+ }
++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll)
++{
++      u32 r;
++
++      if (pll->tuner_en_addr) {
++              r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
++              writel(r, pll->tuner_en_addr);
++      } else if (pll->tuner_addr) {
++              r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
++              writel(r, pll->tuner_addr);
++      }
++}
++
++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll)
++{
++      u32 r;
++
++      if (pll->tuner_en_addr) {
++              r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
++              writel(r, pll->tuner_en_addr);
++      } else if (pll->tuner_addr) {
++              r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
++              writel(r, pll->tuner_addr);
++      }
++}
++
+ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+               int postdiv)
+ {
+@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct
+       pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN;
++      /* disable tuner */
++      __mtk_pll_tuner_disable(pll);
++
+       /* set postdiv */
+       val = readl(pll->pd_addr);
+       val &= ~(POSTDIV_MASK << pll->data->pd_shift);
+@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct
+       if (pll->tuner_addr)
+               writel(con1 + 1, pll->tuner_addr);
++      /* restore tuner_en */
++      __mtk_pll_tuner_enable(pll);
++
+       if (pll_en)
+               udelay(20);
+ }
+@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw
+       r |= pll->data->en_mask;
+       writel(r, pll->base_addr + REG_CON0);
+-      if (pll->tuner_en_addr) {
+-              r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
+-              writel(r, pll->tuner_en_addr);
+-      } else if (pll->tuner_addr) {
+-              r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
+-              writel(r, pll->tuner_addr);
+-      }
++      __mtk_pll_tuner_enable(pll);
+       udelay(20);
+@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk
+               writel(r, pll->base_addr + REG_CON0);
+       }
+-      if (pll->tuner_en_addr) {
+-              r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
+-              writel(r, pll->tuner_en_addr);
+-      } else if (pll->tuner_addr) {
+-              r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
+-              writel(r, pll->tuner_addr);
+-      }
++      __mtk_pll_tuner_disable(pll);
+       r = readl(pll->base_addr + REG_CON0);
+       r &= ~CON0_BASE_EN;
diff --git a/queue-4.19/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch b/queue-4.19/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
new file mode 100644 (file)
index 0000000..6f20fac
--- /dev/null
@@ -0,0 +1,93 @@
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: clk: rockchip: fix wrong clock definitions for rk3328
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit fb903392131a324a243c7731389277db1cd9f8df upstream.
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c |   18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+                       RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+                       RK3328_CLKGATE_CON(2), 12, GFLAGS),
+       COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+-                      RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++                      RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+                       RK3328_CLKGATE_CON(2), 4, GFLAGS),
+       COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+                       RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+       GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0,
+                       RK3328_CLKGATE_CON(25), 1, GFLAGS),
+       GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+-                      RK3328_CLKGATE_CON(25), 0, GFLAGS),
++                      RK3328_CLKGATE_CON(25), 2, GFLAGS),
+       GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+-                      RK3328_CLKGATE_CON(25), 1, GFLAGS),
++                      RK3328_CLKGATE_CON(25), 3, GFLAGS),
+       GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+-                      RK3328_CLKGATE_CON(25), 0, GFLAGS),
++                      RK3328_CLKGATE_CON(25), 4, GFLAGS),
+       GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+-                      RK3328_CLKGATE_CON(25), 1, GFLAGS),
++                      RK3328_CLKGATE_CON(25), 5, GFLAGS),
+       GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+-                      RK3328_CLKGATE_CON(25), 0, GFLAGS),
++                      RK3328_CLKGATE_CON(25), 6, GFLAGS),
+       COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+                       RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+       /* PD_GMAC */
+       COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+-                      RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++                      RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+                       RK3328_CLKGATE_CON(3), 2, GFLAGS),
+       COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+                       RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+       /* PD_PERI */
+       GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+-      GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++      GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+       GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+       GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struc
+                                    &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+                                    ARRAY_SIZE(rk3328_cpuclk_rates));
+-      rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++      rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+                                 ROCKCHIP_SOFTRST_HIWORD_MASK);
+       rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
diff --git a/queue-4.19/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch b/queue-4.19/clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch
new file mode 100644 (file)
index 0000000..93c1531
--- /dev/null
@@ -0,0 +1,39 @@
+From 40db569d6769ffa3864fd1b89616b1a7323568a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 00:48:34 +0300
+Subject: clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 40db569d6769ffa3864fd1b89616b1a7323568a8 upstream.
+
+There are wrongly set parenthesis in the code that are resulting in a
+wrong configuration being programmed for PLLM. The original fix was made
+by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
+Tegra124 chromebook, PLLM rate changing works correctly now and system
+doesn't lock up after changing the PLLM rate due to EMC scaling.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/tegra/clk-pll.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -662,8 +662,8 @@ static void _update_pll_mnp(struct tegra
+               pll_override_writel(val, params->pmc_divp_reg, pll);
+               val = pll_override_readl(params->pmc_divnm_reg, pll);
+-              val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+-                      ~(divn_mask(pll) << div_nmp->override_divn_shift);
++              val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++                      (divn_mask(pll) << div_nmp->override_divn_shift));
+               val |= (cfg->m << div_nmp->override_divm_shift) |
+                       (cfg->n << div_nmp->override_divn_shift);
+               pll_override_writel(val, params->pmc_divnm_reg, pll);
diff --git a/queue-4.19/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch b/queue-4.19/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch
new file mode 100644 (file)
index 0000000..ec7119e
--- /dev/null
@@ -0,0 +1,171 @@
+From 5467a68cbf6884c9a9d91e2a89140afb1839c835 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 15 Mar 2019 22:23:19 -0400
+Subject: dcache: sort the freeing-without-RCU-delay mess for good.
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream.
+
+For lockless accesses to dentries we don't have pinned we rely
+(among other things) upon having an RCU delay between dropping
+the last reference and actually freeing the memory.
+
+On the other hand, for things like pipes and sockets we neither
+do that kind of lockless access, nor want to deal with the
+overhead of an RCU delay every time a socket gets closed.
+
+So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags
+made sure it would happen.  We tried to avoid setting it unless
+we knew we need it.  Unfortunately, that had led to recurring
+class of bugs, in which we missed the need to set it.
+
+We only really need it for dentries that are created by
+d_alloc_pseudo(), so let's not bother with trying to be smart -
+just make having an RCU delay the default.  The ones that do
+*not* get it set the replacement flag (DCACHE_NORCU) and we'd
+better use that sparingly.  d_alloc_pseudo() is the only
+such user right now.
+
+FWIW, the race that finally prompted that switch had been
+between __lock_parent() of immediate subdirectory of what's
+currently the root of a disconnected tree (e.g. from
+open-by-handle in progress) racing with d_splice_alias()
+elsewhere picking another alias for the same inode, either
+on outright corrupted fs image, or (in case of open-by-handle
+on NFS) that subdirectory having been just moved on server.
+It's not easy to hit, so the sky is not falling, but that's
+not the first race on similar missed cases and the logics
+for settinf DCACHE_RCUACCESS has gotten ridiculously
+convoluted.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/porting |    5 +++++
+ fs/dcache.c                       |   24 +++++++++++++-----------
+ fs/nsfs.c                         |    3 +--
+ include/linux/dcache.h            |    2 +-
+ 4 files changed, 20 insertions(+), 14 deletions(-)
+
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -622,3 +622,8 @@ in your dentry operations instead.
+       alloc_file_clone(file, flags, ops) does not affect any caller's references.
+       On success you get a new struct file sharing the mount/dentry with the
+       original, on failure - ERR_PTR().
++--
++[mandatory]
++      DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
++      default.  DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
++      business doing so.
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *d
+               }
+       }
+       /* if dentry was never visible to RCU, immediate free is OK */
+-      if (!(dentry->d_flags & DCACHE_RCUACCESS))
++      if (dentry->d_flags & DCACHE_NORCU)
+               __d_free(&dentry->d_u.d_rcu);
+       else
+               call_rcu(&dentry->d_u.d_rcu, __d_free);
+@@ -1694,7 +1694,6 @@ struct dentry *d_alloc(struct dentry * p
+       struct dentry *dentry = __d_alloc(parent->d_sb, name);
+       if (!dentry)
+               return NULL;
+-      dentry->d_flags |= DCACHE_RCUACCESS;
+       spin_lock(&parent->d_lock);
+       /*
+        * don't need child lock because it is not subject
+@@ -1719,7 +1718,7 @@ struct dentry *d_alloc_cursor(struct den
+ {
+       struct dentry *dentry = d_alloc_anon(parent->d_sb);
+       if (dentry) {
+-              dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
++              dentry->d_flags |= DCACHE_DENTRY_CURSOR;
+               dentry->d_parent = dget(parent);
+       }
+       return dentry;
+@@ -1732,10 +1731,17 @@ struct dentry *d_alloc_cursor(struct den
+  *
+  * For a filesystem that just pins its dentries in memory and never
+  * performs lookups at all, return an unhashed IS_ROOT dentry.
++ * This is used for pipes, sockets et.al. - the stuff that should
++ * never be anyone's children or parents.  Unlike all other
++ * dentries, these will not have RCU delay between dropping the
++ * last reference and freeing them.
+  */
+ struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
+ {
+-      return __d_alloc(sb, name);
++      struct dentry *dentry = __d_alloc(sb, name);
++      if (likely(dentry))
++              dentry->d_flags |= DCACHE_NORCU;
++      return dentry;
+ }
+ EXPORT_SYMBOL(d_alloc_pseudo);
+@@ -1899,12 +1905,10 @@ struct dentry *d_make_root(struct inode
+       if (root_inode) {
+               res = d_alloc_anon(root_inode->i_sb);
+-              if (res) {
+-                      res->d_flags |= DCACHE_RCUACCESS;
++              if (res)
+                       d_instantiate(res, root_inode);
+-              } else {
++              else
+                       iput(root_inode);
+-              }
+       }
+       return res;
+ }
+@@ -2769,9 +2773,7 @@ static void __d_move(struct dentry *dent
+               copy_name(dentry, target);
+               target->d_hash.pprev = NULL;
+               dentry->d_parent->d_lockref.count++;
+-              if (dentry == old_parent)
+-                      dentry->d_flags |= DCACHE_RCUACCESS;
+-              else
++              if (dentry != old_parent) /* wasn't IS_ROOT */
+                       WARN_ON(!--old_parent->d_lockref.count);
+       } else {
+               target->d_parent = old_parent;
+--- a/fs/nsfs.c
++++ b/fs/nsfs.c
+@@ -85,13 +85,12 @@ slow:
+       inode->i_fop = &ns_file_operations;
+       inode->i_private = ns;
+-      dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
++      dentry = d_alloc_anon(mnt->mnt_sb);
+       if (!dentry) {
+               iput(inode);
+               return ERR_PTR(-ENOMEM);
+       }
+       d_instantiate(dentry, inode);
+-      dentry->d_flags |= DCACHE_RCUACCESS;
+       dentry->d_fsdata = (void *)ns->ops;
+       d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+       if (d) {
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -175,7 +175,6 @@ struct dentry_operations {
+       * typically using d_splice_alias. */
+ #define DCACHE_REFERENCED             0x00000040 /* Recently used, don't discard. */
+-#define DCACHE_RCUACCESS              0x00000080 /* Entry has ever been RCU-visible */
+ #define DCACHE_CANT_MOUNT             0x00000100
+ #define DCACHE_GENOCIDE                       0x00000200
+@@ -216,6 +215,7 @@ struct dentry_operations {
+ #define DCACHE_PAR_LOOKUP             0x10000000 /* being looked up (with parent locked shared) */
+ #define DCACHE_DENTRY_CURSOR          0x20000000
++#define DCACHE_NORCU                  0x40000000 /* No RCU delay for freeing */
+ extern seqlock_t rename_lock;
diff --git a/queue-4.19/fuse-fix-writepages-on-32bit.patch b/queue-4.19/fuse-fix-writepages-on-32bit.patch
new file mode 100644 (file)
index 0000000..3645f7d
--- /dev/null
@@ -0,0 +1,36 @@
+From 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 24 Apr 2019 17:05:06 +0200
+Subject: fuse: fix writepages on 32bit
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 upstream.
+
+Writepage requests were cropped to i_size & 0xffffffff, which meant that
+mmaped writes to any file larger than 4G might be silently discarded.
+
+Fix by storing the file size in a properly sized variable (loff_t instead
+of size_t).
+
+Reported-by: Antonio SJ Musumeci <trapexit@spawn.link>
+Fixes: 6eaf4782eb09 ("fuse: writepages: crop secondary requests")
+Cc: <stable@vger.kernel.org> # v3.13
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1526,7 +1526,7 @@ __acquires(fc->lock)
+ {
+       struct fuse_conn *fc = get_fuse_conn(inode);
+       struct fuse_inode *fi = get_fuse_inode(inode);
+-      size_t crop = i_size_read(inode);
++      loff_t crop = i_size_read(inode);
+       struct fuse_req *req;
+       while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
diff --git a/queue-4.19/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch b/queue-4.19/fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch
new file mode 100644 (file)
index 0000000..2634287
--- /dev/null
@@ -0,0 +1,40 @@
+From 0cbade024ba501313da3b7e5dd2a188a6bc491b5 Mon Sep 17 00:00:00 2001
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Thu, 18 Apr 2019 04:04:41 +0800
+Subject: fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
+
+From: Liu Bo <bo.liu@linux.alibaba.com>
+
+commit 0cbade024ba501313da3b7e5dd2a188a6bc491b5 upstream.
+
+fstests generic/228 reported this failure that fuse fallocate does not
+honor what 'ulimit -f' has set.
+
+This adds the necessary inode_newsize_ok() check.
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation")
+Cc: <stable@vger.kernel.org> # v3.5
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2975,6 +2975,13 @@ static long fuse_file_fallocate(struct f
+               }
+       }
++      if (!(mode & FALLOC_FL_KEEP_SIZE) &&
++          offset + length > i_size_read(inode)) {
++              err = inode_newsize_ok(inode, offset + length);
++              if (err)
++                      return err;
++      }
++
+       if (!(mode & FALLOC_FL_KEEP_SIZE))
+               set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
diff --git a/queue-4.19/intel_th-msu-fix-single-mode-with-iommu.patch b/queue-4.19/intel_th-msu-fix-single-mode-with-iommu.patch
new file mode 100644 (file)
index 0000000..bf101b4
--- /dev/null
@@ -0,0 +1,104 @@
+From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 3 May 2019 11:44:34 +0300
+Subject: intel_th: msu: Fix single mode with IOMMU
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream.
+
+Currently, the pages that are allocated for the single mode of MSC are not
+mapped into the device's dma space and the code is incorrectly using
+*_to_phys() in place of a dma address. This fails with IOMMU enabled and
+is otherwise bad practice.
+
+Fix the single mode buffer allocation to map the pages into the device's
+DMA space.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c |   35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+  * @reg_base:         register window base address
+  * @thdev:            intel_th_device pointer
+  * @win_list:         list of windows in multiblock mode
++ * @single_sgt:               single mode buffer
+  * @nr_pages:         total number of pages allocated for this buffer
+  * @single_sz:                amount of data in single mode
+  * @single_wrap:      single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+       struct intel_th_device  *thdev;
+       struct list_head        win_list;
++      struct sg_table         single_sgt;
+       unsigned long           nr_pages;
+       unsigned long           single_sz;
+       unsigned int            single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(stru
+  */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++      unsigned long nr_pages = size >> PAGE_SHIFT;
+       unsigned int order = get_order(size);
+       struct page *page;
++      int ret;
+       if (!size)
+               return 0;
++      ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++      if (ret)
++              goto err_out;
++
++      ret = -ENOMEM;
+       page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+       if (!page)
+-              return -ENOMEM;
++              goto err_free_sgt;
+       split_page(page, order);
+-      msc->nr_pages = size >> PAGE_SHIFT;
++      sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++      ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++                       DMA_FROM_DEVICE);
++      if (ret < 0)
++              goto err_free_pages;
++
++      msc->nr_pages = nr_pages;
+       msc->base = page_address(page);
+-      msc->base_addr = page_to_phys(page);
++      msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+       return 0;
++
++err_free_pages:
++      __free_pages(page, order);
++
++err_free_sgt:
++      sg_free_table(&msc->single_sgt);
++
++err_out:
++      return ret;
+ }
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struc
+ {
+       unsigned long off;
++      dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++                   1, DMA_FROM_DEVICE);
++      sg_free_table(&msc->single_sgt);
++
+       for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+               struct page *page = virt_to_page(msc->base + off);
diff --git a/queue-4.19/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch b/queue-4.19/iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch
new file mode 100644 (file)
index 0000000..3b184df
--- /dev/null
@@ -0,0 +1,81 @@
+From 43a0541e312f7136e081e6bf58f6c8a2e9672688 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:50:07 +0300
+Subject: iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 43a0541e312f7136e081e6bf58f6c8a2e9672688 upstream.
+
+Both Tegra30 and Tegra114 have 4 ASID's and the corresponding bitfield of
+the TLB_FLUSH register differs from later Tegra generations that have 128
+ASID's.
+
+In a result the PTE's are now flushed correctly from TLB and this fixes
+problems with graphics (randomly failing tests) on Tegra30.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/tegra-smmu.c |   25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegr
+ #define  SMMU_TLB_FLUSH_VA_MATCH_ALL     (0 << 0)
+ #define  SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0)
+ #define  SMMU_TLB_FLUSH_VA_MATCH_GROUP   (3 << 0)
+-#define  SMMU_TLB_FLUSH_ASID(x)          (((x) & 0x7f) << 24)
+ #define  SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \
+                                         SMMU_TLB_FLUSH_VA_MATCH_SECTION)
+ #define  SMMU_TLB_FLUSH_VA_GROUP(addr)   ((((addr) & 0xffffc000) >> 12) | \
+@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(s
+ {
+       u32 value;
+-      value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+-              SMMU_TLB_FLUSH_VA_MATCH_ALL;
++      if (smmu->soc->num_asids == 4)
++              value = (asid & 0x3) << 29;
++      else
++              value = (asid & 0x7f) << 24;
++
++      value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL;
+       smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_sectio
+ {
+       u32 value;
+-      value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+-              SMMU_TLB_FLUSH_VA_SECTION(iova);
++      if (smmu->soc->num_asids == 4)
++              value = (asid & 0x3) << 29;
++      else
++              value = (asid & 0x7f) << 24;
++
++      value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova);
+       smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group(
+ {
+       u32 value;
+-      value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+-              SMMU_TLB_FLUSH_VA_GROUP(iova);
++      if (smmu->soc->num_asids == 4)
++              value = (asid & 0x3) << 29;
++      else
++              value = (asid & 0x7f) << 24;
++
++      value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova);
+       smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
diff --git a/queue-4.19/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch b/queue-4.19/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch
new file mode 100644 (file)
index 0000000..a1bdecb
--- /dev/null
@@ -0,0 +1,32 @@
+From ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Thu, 4 Apr 2019 18:56:10 +0200
+Subject: md: add a missing endianness conversion in check_sb_changes
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream.
+
+The on-disk value is little endian and we need to convert it to
+native endian before storing the value in the in-core structure.
+
+Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode")
+Cc: <stable@vger.kernel.org> # 4.20+
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 664b77ceaf2d..a15eb7e37c6d 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9227,7 +9227,7 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
+                * reshape is happening in the remote node, we need to
+                * update reshape_position and call start_reshape.
+                */
+-              mddev->reshape_position = sb->reshape_position;
++              mddev->reshape_position = le64_to_cpu(sb->reshape_position);
+               if (mddev->pers->update_reshape_pos)
+                       mddev->pers->update_reshape_pos(mddev);
+               if (mddev->pers->start_reshape)
diff --git a/queue-4.19/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch b/queue-4.19/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch
new file mode 100644 (file)
index 0000000..eeefdf9
--- /dev/null
@@ -0,0 +1,41 @@
+From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Tue, 2 Apr 2019 14:22:14 +0800
+Subject: md: add mddev->pers to avoid potential NULL pointer dereference
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.
+
+When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
+which can avoid potential NULL pointer derefence in fallowing
+add_bound_rdev().
+
+Fixes: a6da4ef85cef ("md: re-add a failed disk")
+Cc: Xiao Ni <xni@redhat.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: <stable@vger.kernel.org> # 4.4+
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2860,8 +2860,10 @@ state_store(struct md_rdev *rdev, const
+                       err = 0;
+               }
+       } else if (cmd_match(buf, "re-add")) {
+-              if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+-                      rdev->saved_raid_disk >= 0) {
++              if (!rdev->mddev->pers)
++                      err = -EINVAL;
++              else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++                              rdev->saved_raid_disk >= 0) {
+                       /* clear_bit is performed _after_ all the devices
+                        * have their local Faulty bit cleared. If any writes
+                        * happen in the meantime in the local node, they
diff --git a/queue-4.19/md-batch-flush-requests.patch b/queue-4.19/md-batch-flush-requests.patch
new file mode 100644 (file)
index 0000000..d0db877
--- /dev/null
@@ -0,0 +1,170 @@
+From 2bc13b83e6298486371761de503faeffd15b7534 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:17 -0700
+Subject: md: batch flush requests.
+
+From: NeilBrown <neilb@suse.com>
+
+commit 2bc13b83e6298486371761de503faeffd15b7534 upstream.
+
+Currently if many flush requests are submitted to an md device is quick
+succession, they are serialized and can take a long to process them all.
+We don't really need to call flush all those times - a single flush call
+can satisfy all requests submitted before it started.
+So keep track of when the current flush started and when it finished,
+allow any pending flush that was requested before the flush started
+to complete without waiting any more.
+
+Test results from Xiao:
+
+Test is done on a raid10 device which is created by 4 SSDs. The tool is
+dbench.
+
+1. The latest linux stable kernel
+  Operation                Count    AvgLat    MaxLat
+  --------------------------------------------------
+  Deltree                    768    10.509    78.305
+  Flush                  2078376     0.013    10.094
+  Close                  21787697     0.019    18.821
+  LockX                    96580     0.007     3.184
+  Mkdir                      384     0.008     0.062
+  Rename                 1255883     0.191    23.534
+  ReadX                  46495589     0.020    14.230
+  WriteX                 14790591     7.123    60.706
+  Unlink                 5989118     0.440    54.551
+  UnlockX                  96580     0.005     2.736
+  FIND_FIRST             10393845     0.042    12.079
+  SET_FILE_INFORMATION   2415558     0.129    10.088
+  QUERY_FILE_INFORMATION 4711725     0.005     8.462
+  QUERY_PATH_INFORMATION 26883327     0.032    21.715
+  QUERY_FS_INFORMATION   4929409     0.010     8.238
+  NTCreateX              29660080     0.100    53.268
+
+Throughput 1034.88 MB/sec (sync open)  128 clients  128 procs
+max_latency=60.712 ms
+
+2. With patch1 "Revert "MD: fix lock contention for flush bios""
+  Operation                Count    AvgLat    MaxLat
+  --------------------------------------------------
+  Deltree                    256     8.326    36.761
+  Flush                   693291     3.974   180.269
+  Close                  7266404     0.009    36.929
+  LockX                    32160     0.006     0.840
+  Mkdir                      128     0.008     0.021
+  Rename                  418755     0.063    29.945
+  ReadX                  15498708     0.007     7.216
+  WriteX                 4932310    22.482   267.928
+  Unlink                 1997557     0.109    47.553
+  UnlockX                  32160     0.004     1.110
+  FIND_FIRST             3465791     0.036     7.320
+  SET_FILE_INFORMATION    805825     0.015     1.561
+  QUERY_FILE_INFORMATION 1570950     0.005     2.403
+  QUERY_PATH_INFORMATION 8965483     0.013    14.277
+  QUERY_FS_INFORMATION   1643626     0.009     3.314
+  NTCreateX              9892174     0.061    41.278
+
+Throughput 345.009 MB/sec (sync open)  128 clients  128 procs
+max_latency=267.939 m
+
+3. With patch1 and patch2
+  Operation                Count    AvgLat    MaxLat
+  --------------------------------------------------
+  Deltree                    768     9.570    54.588
+  Flush                  2061354     0.666    15.102
+  Close                  21604811     0.012    25.697
+  LockX                    95770     0.007     1.424
+  Mkdir                      384     0.008     0.053
+  Rename                 1245411     0.096    12.263
+  ReadX                  46103198     0.011    12.116
+  WriteX                 14667988     7.375    60.069
+  Unlink                 5938936     0.173    30.905
+  UnlockX                  95770     0.005     4.147
+  FIND_FIRST             10306407     0.041    11.715
+  SET_FILE_INFORMATION   2395987     0.048     7.640
+  QUERY_FILE_INFORMATION 4672371     0.005     9.291
+  QUERY_PATH_INFORMATION 26656735     0.018    19.719
+  QUERY_FS_INFORMATION   4887940     0.010     7.654
+  NTCreateX              29410811     0.059    28.551
+
+Throughput 1026.21 MB/sec (sync open)  128 clients  128 procs
+max_latency=60.075 ms
+
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c |   27 +++++++++++++++++++++++----
+ drivers/md/md.h |    3 +++
+ 2 files changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -433,6 +433,7 @@ static void submit_flushes(struct work_s
+       struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+       struct md_rdev *rdev;
++      mddev->start_flush = ktime_get_boottime();
+       INIT_WORK(&mddev->flush_work, md_submit_flush_data);
+       atomic_set(&mddev->flush_pending, 1);
+       rcu_read_lock();
+@@ -473,6 +474,7 @@ static void md_submit_flush_data(struct
+        * could wait for this and below md_handle_request could wait for those
+        * bios because of suspend check
+        */
++      mddev->last_flush = mddev->start_flush;
+       mddev->flush_bio = NULL;
+       wake_up(&mddev->sb_wait);
+@@ -487,15 +489,32 @@ static void md_submit_flush_data(struct
+ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
++      ktime_t start = ktime_get_boottime();
+       spin_lock_irq(&mddev->lock);
+       wait_event_lock_irq(mddev->sb_wait,
+-                          !mddev->flush_bio,
++                          !mddev->flush_bio ||
++                          ktime_after(mddev->last_flush, start),
+                           mddev->lock);
+-      mddev->flush_bio = bio;
++      if (!ktime_after(mddev->last_flush, start)) {
++              WARN_ON(mddev->flush_bio);
++              mddev->flush_bio = bio;
++              bio = NULL;
++      }
+       spin_unlock_irq(&mddev->lock);
+-      INIT_WORK(&mddev->flush_work, submit_flushes);
+-      queue_work(md_wq, &mddev->flush_work);
++      if (!bio) {
++              INIT_WORK(&mddev->flush_work, submit_flushes);
++              queue_work(md_wq, &mddev->flush_work);
++      } else {
++              /* flush was performed for some other bio while we waited. */
++              if (bio->bi_iter.bi_size == 0)
++                      /* an empty barrier - all done */
++                      bio_endio(bio);
++              else {
++                      bio->bi_opf &= ~REQ_PREFLUSH;
++                      mddev->pers->make_request(mddev, bio);
++              }
++      }
+ }
+ EXPORT_SYMBOL(md_flush_request);
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -463,6 +463,9 @@ struct mddev {
+        */
+       struct bio *flush_bio;
+       atomic_t flush_pending;
++      ktime_t start_flush, last_flush; /* last_flush is when the last completed
++                                        * flush was started.
++                                        */
+       struct work_struct flush_work;
+       struct work_struct event_work;  /* used by dm to report failure event */
+       void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
diff --git a/queue-4.19/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch b/queue-4.19/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
new file mode 100644 (file)
index 0000000..1a55ca9
--- /dev/null
@@ -0,0 +1,55 @@
+From 107927fa597c99eaeee4f51865ca0956ec71b6a2 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:30 -0500
+Subject: media: imx: Clear fwnode link struct for each endpoint iteration
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream.
+
+In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must
+be cleared for each endpoint iteration, otherwise if the remote port
+has no "reg" property, link.remote_port will not be reset to zero.
+This was discovered on the i.MX53 SMD board, since the OV5642 connects
+directly to ipu1_csi0 and has a single source port with no "reg"
+property.
+
+Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-of.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -233,15 +233,18 @@ int imx_media_create_csi_of_links(struct
+                                 struct v4l2_subdev *csi)
+ {
+       struct device_node *csi_np = csi->dev->of_node;
+-      struct fwnode_handle *fwnode, *csi_ep;
+-      struct v4l2_fwnode_link link;
+       struct device_node *ep;
+-      int ret;
+-
+-      link.local_node = of_fwnode_handle(csi_np);
+-      link.local_port = CSI_SINK_PAD;
+       for_each_child_of_node(csi_np, ep) {
++              struct fwnode_handle *fwnode, *csi_ep;
++              struct v4l2_fwnode_link link;
++              int ret;
++
++              memset(&link, 0, sizeof(link));
++
++              link.local_node = of_fwnode_handle(csi_np);
++              link.local_port = CSI_SINK_PAD;
++
+               csi_ep = of_fwnode_handle(ep);
+               fwnode = fwnode_graph_get_remote_endpoint(csi_ep);
diff --git a/queue-4.19/media-imx-csi-allow-unknown-nearest-upstream-entities.patch b/queue-4.19/media-imx-csi-allow-unknown-nearest-upstream-entities.patch
new file mode 100644 (file)
index 0000000..7540b56
--- /dev/null
@@ -0,0 +1,70 @@
+From 904371f90b2c0c749a5ab75478c129a4682ac3d8 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:29 -0500
+Subject: media: imx: csi: Allow unknown nearest upstream entities
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream.
+
+On i.MX6, the nearest upstream entity to the CSI can only be the
+CSI video muxes or the Synopsys DW MIPI CSI-2 receiver.
+
+However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver.
+So allow for the nearest upstream entity to the CSI to be something
+other than those.
+
+Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest
+upstream entity")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-csi.c |   18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -153,9 +153,10 @@ static inline bool requires_passthrough(
+ /*
+  * Parses the fwnode endpoint from the source pad of the entity
+  * connected to this CSI. This will either be the entity directly
+- * upstream from the CSI-2 receiver, or directly upstream from the
+- * video mux. The endpoint is needed to determine the bus type and
+- * bus config coming into the CSI.
++ * upstream from the CSI-2 receiver, directly upstream from the
++ * video mux, or directly upstream from the CSI itself. The endpoint
++ * is needed to determine the bus type and bus config coming into
++ * the CSI.
+  */
+ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+                                    struct v4l2_fwnode_endpoint *ep)
+@@ -168,7 +169,8 @@ static int csi_get_upstream_endpoint(str
+       if (!priv->src_sd)
+               return -EPIPE;
+-      src = &priv->src_sd->entity;
++      sd = priv->src_sd;
++      src = &sd->entity;
+       if (src->function == MEDIA_ENT_F_VID_MUX) {
+               /*
+@@ -182,6 +184,14 @@ static int csi_get_upstream_endpoint(str
+                       src = &sd->entity;
+       }
++      /*
++       * If the source is neither the video mux nor the CSI-2 receiver,
++       * get the source pad directly upstream from CSI itself.
++       */
++      if (src->function != MEDIA_ENT_F_VID_MUX &&
++          sd->grp_id != IMX_MEDIA_GRP_ID_CSI2)
++              src = &priv->sd.entity;
++
+       /* get source pad of entity directly upstream from src */
+       pad = imx_media_find_upstream_pad(priv->md, src, 0);
+       if (IS_ERR(pad))
diff --git a/queue-4.19/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch b/queue-4.19/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch
new file mode 100644 (file)
index 0000000..b40b170
--- /dev/null
@@ -0,0 +1,47 @@
+From 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Sun, 24 Mar 2019 20:21:12 -0400
+Subject: media: ov6650: Fix sensor possibly not detected on probe
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream.
+
+After removal of clock_start() from before soc_camera_init_i2c() in
+soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
+I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
+driver could no longer probe the sensor successfully because its clock
+was no longer turned on in advance.  The issue was initially worked
+around by adding that missing clock_start() equivalent to OMAP1 camera
+interface driver - the only user of this sensor - but a propoer fix
+should be rather implemented in the sensor driver code itself.
+
+Fix the issue by inserting a delay between the clock is turned on and
+the sensor I2C registers are read for the first time.
+
+Tested on Amstrad Delta with now out of tree but still locally
+maintained omap1_camera host driver.
+
+Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk")
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -815,6 +815,8 @@ static int ov6650_video_probe(struct i2c
+       if (ret < 0)
+               return ret;
++      msleep(20);
++
+       /*
+        * check and show product ID and manufacturer ID
+        */
diff --git a/queue-4.19/nfs4-fix-v4.0-client-state-corruption-when-mount.patch b/queue-4.19/nfs4-fix-v4.0-client-state-corruption-when-mount.patch
new file mode 100644 (file)
index 0000000..ad62c85
--- /dev/null
@@ -0,0 +1,47 @@
+From f02f3755dbd14fb935d24b14650fff9ba92243b8 Mon Sep 17 00:00:00 2001
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 6 May 2019 11:57:03 +0800
+Subject: NFS4: Fix v4.0 client state corruption when mount
+
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+
+commit f02f3755dbd14fb935d24b14650fff9ba92243b8 upstream.
+
+stat command with soft mount never return after server is stopped.
+
+When alloc a new client, the state of the client will be set to
+NFS4CLNT_LEASE_EXPIRED.
+
+When the server is stopped, the state manager will work, and accord
+the state to recover. But the state is NFS4CLNT_LEASE_EXPIRED, it
+will drain the slot table and lead other task to wait queue, until
+the client recovered. Then the stat command is hung.
+
+When discover server trunking, the client will renew the lease,
+but check the client state, it lead the client state corruption.
+
+So, we need to call state manager to recover it when detect server
+ip trunking.
+
+Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4state.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struc
+               /* Sustain the lease, even if it's empty.  If the clientid4
+                * goes stale it's of no use for trunking discovery. */
+               nfs4_schedule_state_renewal(*result);
++
++              /* If the client state need to recover, do it. */
++              if (clp->cl_state)
++                      nfs4_schedule_state_manager(clp);
+       }
+ out:
+       return status;
diff --git a/queue-4.19/of-fix-clang-wunsequenced-for-be32_to_cpu.patch b/queue-4.19/of-fix-clang-wunsequenced-for-be32_to_cpu.patch
new file mode 100644 (file)
index 0000000..1ba0132
--- /dev/null
@@ -0,0 +1,56 @@
+From 440868661f36071886ed360d91de83bd67c73b4f Mon Sep 17 00:00:00 2001
+From: Phong Tran <tranmanphong@gmail.com>
+Date: Tue, 30 Apr 2019 21:56:24 +0700
+Subject: of: fix clang -Wunsequenced for be32_to_cpu()
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+commit 440868661f36071886ed360d91de83bd67c73b4f upstream.
+
+Now, make the loop explicit to avoid clang warning.
+
+./include/linux/of.h:238:37: warning: multiple unsequenced modifications
+to 'cell' [-Wunsequenced]
+                r = (r << 32) | be32_to_cpu(*(cell++));
+                                                  ^~
+./include/linux/byteorder/generic.h:95:21: note: expanded from macro
+'be32_to_cpu'
+                    ^
+./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded
+from macro '__be32_to_cpu'
+                                                          ^
+./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32'
+        ___constant_swab32(x) :                 \
+                           ^
+./include/uapi/linux/swab.h:18:12: note: expanded from macro
+'___constant_swab32'
+        (((__u32)(x) & (__u32)0x000000ffUL) << 24) |            \
+                  ^
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/460
+Suggested-by: David Laight <David.Laight@ACULAB.COM>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable@vger.kernel.org
+[robh: fix up whitespace]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/of.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -236,8 +236,8 @@ extern struct device_node *of_find_all_n
+ static inline u64 of_read_number(const __be32 *cell, int size)
+ {
+       u64 r = 0;
+-      while (size--)
+-              r = (r << 32) | be32_to_cpu(*(cell++));
++      for (; size--; cell++)
++              r = (r << 32) | be32_to_cpu(*cell);
+       return r;
+ }
diff --git a/queue-4.19/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch b/queue-4.19/ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch
new file mode 100644 (file)
index 0000000..5484879
--- /dev/null
@@ -0,0 +1,89 @@
+From 3428030da004a1128cbdcf93dc03e16f184d845b Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Tue, 22 Jan 2019 07:01:39 +0200
+Subject: ovl: fix missing upper fs freeze protection on copy up for ioctl
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream.
+
+Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file
+with data before FS_IOC_SETFLAGS ioctl.
+
+The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably
+caused the confusion.  File may be open O_RDONLY, but ioctl modifies the
+file.  VFS does not call mnt_want_write_file() nor lock inode mutex, but
+fs-specific code for FS_IOC_SETFLAGS does.  So ovl_ioctl() calls
+mnt_want_write_file() for the overlay file, and fs-specific code calls
+mnt_want_write_file() for upper fs file, but there was no call for
+ovl_want_write() for copy up duration which prevents overlayfs from copying
+up on a frozen upper fs.
+
+Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/overlayfs/copy_up.c   |    6 +++---
+ fs/overlayfs/file.c      |    5 ++---
+ fs/overlayfs/overlayfs.h |    2 +-
+ 3 files changed, 6 insertions(+), 7 deletions(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -878,14 +878,14 @@ static bool ovl_open_need_copy_up(struct
+       return true;
+ }
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags)
++int ovl_maybe_copy_up(struct dentry *dentry, int flags)
+ {
+       int err = 0;
+-      if (ovl_open_need_copy_up(dentry, file_flags)) {
++      if (ovl_open_need_copy_up(dentry, flags)) {
+               err = ovl_want_write(dentry);
+               if (!err) {
+-                      err = ovl_copy_up_flags(dentry, file_flags);
++                      err = ovl_copy_up_flags(dentry, flags);
+                       ovl_drop_write(dentry);
+               }
+       }
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct f
+ static int ovl_open(struct inode *inode, struct file *file)
+ {
+-      struct dentry *dentry = file_dentry(file);
+       struct file *realfile;
+       int err;
+-      err = ovl_open_maybe_copy_up(dentry, file->f_flags);
++      err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
+       if (err)
+               return err;
+@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file,
+               if (ret)
+                       return ret;
+-              ret = ovl_copy_up_with_data(file_dentry(file));
++              ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+               if (!ret) {
+                       ret = ovl_real_ioctl(file, cmd, arg);
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -411,7 +411,7 @@ extern const struct file_operations ovl_
+ int ovl_copy_up(struct dentry *dentry);
+ int ovl_copy_up_with_data(struct dentry *dentry);
+ int ovl_copy_up_flags(struct dentry *dentry, int flags);
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
++int ovl_maybe_copy_up(struct dentry *dentry, int flags);
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new);
+ int ovl_set_attr(struct dentry *upper, struct kstat *stat);
+ struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper);
diff --git a/queue-4.19/p54-drop-device-reference-count-if-fails-to-enable-device.patch b/queue-4.19/p54-drop-device-reference-count-if-fails-to-enable-device.patch
new file mode 100644 (file)
index 0000000..89727cc
--- /dev/null
@@ -0,0 +1,42 @@
+From 8149069db81853570a665f5e5648c0e526dc0e43 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 17 Apr 2019 17:41:23 +0800
+Subject: p54: drop device reference count if fails to enable device
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream.
+
+The function p54p_probe takes an extra reference count of the PCI
+device. However, the extra reference count is not dropped when it fails
+to enable the PCI device. This patch fixes the bug.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intersil/p54/p54pci.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pd
+       err = pci_enable_device(pdev);
+       if (err) {
+               dev_err(&pdev->dev, "Cannot enable new PCI device\n");
+-              return err;
++              goto err_put;
+       }
+       mem_addr = pci_resource_start(pdev, 0);
+@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pd
+       pci_release_regions(pdev);
+  err_disable_dev:
+       pci_disable_device(pdev);
++err_put:
+       pci_dev_put(pdev);
+       return err;
+ }
diff --git a/queue-4.19/parisc-export-running_on_qemu-symbol-for-modules.patch b/queue-4.19/parisc-export-running_on_qemu-symbol-for-modules.patch
new file mode 100644 (file)
index 0000000..8b55206
--- /dev/null
@@ -0,0 +1,27 @@
+From 3e1120f4b57bc12437048494ab56648edaa5b57d Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 6 Apr 2019 16:45:14 +0200
+Subject: parisc: Export running_on_qemu symbol for modules
+
+From: Helge Deller <deller@gmx.de>
+
+commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/process.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *t
+  */
+ int running_on_qemu __read_mostly;
++EXPORT_SYMBOL(running_on_qemu);
+ void __cpuidle arch_cpu_idle_dead(void)
+ {
diff --git a/queue-4.19/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch b/queue-4.19/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch
new file mode 100644 (file)
index 0000000..44ea2a0
--- /dev/null
@@ -0,0 +1,75 @@
+From 1829dda0e87f4462782ca81be474c7890efe31ce Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:54:34 +0200
+Subject: parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
+
+From: Helge Deller <deller@gmx.de>
+
+commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream.
+
+LEVEL is a very common word, and now after many years it suddenly
+clashed with another LEVEL define in the DRBD code.
+Rename it to PA_ASM_LEVEL instead.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/assembly.h |    6 +++---
+ arch/parisc/kernel/head.S          |    4 ++--
+ arch/parisc/kernel/syscall.S       |    2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/parisc/include/asm/assembly.h
++++ b/arch/parisc/include/asm/assembly.h
+@@ -61,14 +61,14 @@
+ #define LDCW          ldcw,co
+ #define BL            b,l
+ # ifdef CONFIG_64BIT
+-#  define LEVEL               2.0w
++#  define PA_ASM_LEVEL        2.0w
+ # else
+-#  define LEVEL               2.0
++#  define PA_ASM_LEVEL        2.0
+ # endif
+ #else
+ #define LDCW          ldcw
+ #define BL            bl
+-#define LEVEL         1.1
++#define PA_ASM_LEVEL  1.1
+ #endif
+ #ifdef __ASSEMBLY__
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+-      .level  LEVEL
++      .level  PA_ASM_LEVEL
+       __INITDATA
+ ENTRY(boot_args)
+@@ -258,7 +258,7 @@ stext_pdc_ret:
+       ldo             R%PA(fault_vector_11)(%r10),%r10
+ $is_pa20:
+-      .level          LEVEL /* restore 1.1 || 2.0w */
++      .level          PA_ASM_LEVEL /* restore 1.1 || 2.0w */
+ #endif /*!CONFIG_64BIT*/
+       load32          PA(fault_vector_20),%r10
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -48,7 +48,7 @@ registers).
+        */
+ #define KILL_INSN     break   0,0
+-      .level          LEVEL
++      .level          PA_ASM_LEVEL
+       .text
diff --git a/queue-4.19/parisc-skip-registering-led-when-running-in-qemu.patch b/queue-4.19/parisc-skip-registering-led-when-running-in-qemu.patch
new file mode 100644 (file)
index 0000000..aa59c7c
--- /dev/null
@@ -0,0 +1,31 @@
+From b438749044356dd1329c45e9b5a9377b6ea13eb2 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 2 Apr 2019 12:17:08 +0200
+Subject: parisc: Skip registering LED when running in QEMU
+
+From: Helge Deller <deller@gmx.de>
+
+commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream.
+
+No need to spend CPU cycles when we run on QEMU.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/parisc/led.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -568,6 +568,9 @@ int __init register_led_driver(int model
+               break;
+       case DISPLAY_MODEL_LASI:
++              /* Skip to register LED in QEMU */
++              if (running_on_qemu)
++                      return 1;
+               LED_DATA_REG = data_reg;
+               led_func_ptr = led_LASI_driver;
+               printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG);
diff --git a/queue-4.19/parisc-use-pa_asm_level-in-boot-code.patch b/queue-4.19/parisc-use-pa_asm_level-in-boot-code.patch
new file mode 100644 (file)
index 0000000..512b2d7
--- /dev/null
@@ -0,0 +1,49 @@
+From bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:55:02 +0200
+Subject: parisc: Use PA_ASM_LEVEL in boot code
+
+From: Helge Deller <deller@gmx.de>
+
+commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream.
+
+The LEVEL define clashed with the DRBD code.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/boot/compressed/head.S |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/boot/compressed/head.S
++++ b/arch/parisc/boot/compressed/head.S
+@@ -22,7 +22,7 @@
+       __HEAD
+ ENTRY(startup)
+-       .level LEVEL
++       .level PA_ASM_LEVEL
+ #define PSW_W_SM      0x200
+ #define PSW_W_BIT       36
+@@ -63,7 +63,7 @@ $bss_loop:
+       load32  BOOTADDR(decompress_kernel),%r3
+ #ifdef CONFIG_64BIT
+-      .level LEVEL
++      .level PA_ASM_LEVEL
+       ssm     PSW_W_SM, %r0           /* set W-bit */
+       depdi   0, 31, 32, %r3
+ #endif
+@@ -72,7 +72,7 @@ $bss_loop:
+ startup_continue:
+ #ifdef CONFIG_64BIT
+-      .level LEVEL
++      .level PA_ASM_LEVEL
+       rsm     PSW_W_SM, %r0           /* clear W-bit */
+ #endif
diff --git a/queue-4.19/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch b/queue-4.19/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch
new file mode 100644 (file)
index 0000000..0856dfb
--- /dev/null
@@ -0,0 +1,33 @@
+From e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 19 Feb 2019 14:53:49 +0000
+Subject: phy: ti-pipe3: fix missing bit-wise or operator when assigning val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream.
+
+There seems to be a missing bit-wise or operator when setting val,
+fix this by adding it in.
+
+Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/ti/phy-ti-pipe3.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/ti/phy-ti-pipe3.c
++++ b/drivers/phy/ti/phy-ti-pipe3.c
+@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti
+       val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY);
+       val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV);
+-      val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
++      val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
+       ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val);
+       val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES);
diff --git a/queue-4.19/pnfs-fallback-to-mds-if-no-deviceid-found.patch b/queue-4.19/pnfs-fallback-to-mds-if-no-deviceid-found.patch
new file mode 100644 (file)
index 0000000..f4236c7
--- /dev/null
@@ -0,0 +1,34 @@
+From b1029c9bc078a6f1515f55dd993b507dcc7e3440 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Tue, 7 May 2019 13:41:49 -0400
+Subject: PNFS fallback to MDS if no deviceid found
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+commit b1029c9bc078a6f1515f55dd993b507dcc7e3440 upstream.
+
+If we fail to find a good deviceid while trying to pnfs instead of
+propogating an error back fallback to doing IO to the MDS. Currently,
+code with fals the IO with EINVAL.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 8d40b0f14846f ("NFS filelayout:call GETDEVICEINFO after pnfs_layout_process completes"
+Cc: stable@vger.kernel.org # v4.11+
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/filelayout/filelayout.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino,
+       status = filelayout_check_deviceid(lo, fl, gfp_flags);
+       if (status) {
+               pnfs_put_lseg(lseg);
+-              lseg = ERR_PTR(status);
++              lseg = NULL;
+       }
+ out:
+       return lseg;
diff --git a/queue-4.19/proc-prevent-changes-to-overridden-credentials.patch b/queue-4.19/proc-prevent-changes-to-overridden-credentials.patch
new file mode 100644 (file)
index 0000000..ac055b7
--- /dev/null
@@ -0,0 +1,41 @@
+From 35a196bef449b5824033865b963ed9a43fb8c730 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 19 Apr 2019 14:55:12 -0400
+Subject: proc: prevent changes to overridden credentials
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream.
+
+Prevent userspace from changing the the /proc/PID/attr values if the
+task's credentials are currently overriden.  This not only makes sense
+conceptually, it also prevents some really bizarre error cases caused
+when trying to commit credentials to a task with overridden
+credentials.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: "chengjian (D)" <cj.chengjian@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Acked-by: James Morris <james.morris@microsoft.com>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2542,6 +2542,11 @@ static ssize_t proc_pid_attr_write(struc
+               rcu_read_unlock();
+               return -EACCES;
+       }
++      /* Prevent changes to overridden credentials. */
++      if (current_cred() != current_real_cred()) {
++              rcu_read_unlock();
++              return -EBUSY;
++      }
+       rcu_read_unlock();
+       if (count > PAGE_SIZE)
diff --git a/queue-4.19/revert-md-fix-lock-contention-for-flush-bios.patch b/queue-4.19/revert-md-fix-lock-contention-for-flush-bios.patch
new file mode 100644 (file)
index 0000000..a63a167
--- /dev/null
@@ -0,0 +1,316 @@
+From 4bc034d35377196c854236133b07730a777c4aba Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:16 -0700
+Subject: Revert "MD: fix lock contention for flush bios"
+
+From: NeilBrown <neilb@suse.com>
+
+commit 4bc034d35377196c854236133b07730a777c4aba upstream.
+
+This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85.
+
+This patch has two problems.
+
+1/ it make multiple calls to submit_bio() from inside a make_request_fn.
+ The bios thus submitted will be queued on current->bio_list and not
+ submitted immediately.  As the bios are allocated from a mempool,
+ this can theoretically result in a deadlock - all the pool of requests
+ could be in various ->bio_list queues and a subsequent mempool_alloc
+ could block waiting for one of them to be released.
+
+2/ It aims to handle a case when there are many concurrent flush requests.
+  It handles this by submitting many requests in parallel - all of which
+  are identical and so most of which do nothing useful.
+  It would be more efficient to just send one lower-level request, but
+  allow that to satisfy multiple upper-level requests.
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c |  163 ++++++++++++++++++--------------------------------------
+ drivers/md/md.h |   22 ++-----
+ 2 files changed, 62 insertions(+), 123 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev
+               mddev->sync_speed_max : sysctl_speed_limit_max;
+ }
+-static void * flush_info_alloc(gfp_t gfp_flags, void *data)
+-{
+-        return kzalloc(sizeof(struct flush_info), gfp_flags);
+-}
+-static void flush_info_free(void *flush_info, void *data)
+-{
+-        kfree(flush_info);
+-}
+-
+-static void * flush_bio_alloc(gfp_t gfp_flags, void *data)
+-{
+-      return kzalloc(sizeof(struct flush_bio), gfp_flags);
+-}
+-static void flush_bio_free(void *flush_bio, void *data)
+-{
+-      kfree(flush_bio);
+-}
+-
+ static struct ctl_table_header *raid_table_header;
+ static struct ctl_table raid_table[] = {
+@@ -429,54 +411,30 @@ static int md_congested(void *data, int
+ /*
+  * Generic flush handling for md
+  */
+-static void submit_flushes(struct work_struct *ws)
+-{
+-      struct flush_info *fi = container_of(ws, struct flush_info, flush_work);
+-      struct mddev *mddev = fi->mddev;
+-      struct bio *bio = fi->bio;
+-
+-      bio->bi_opf &= ~REQ_PREFLUSH;
+-      md_handle_request(mddev, bio);
+-
+-      mempool_free(fi, mddev->flush_pool);
+-}
+-static void md_end_flush(struct bio *fbio)
++static void md_end_flush(struct bio *bio)
+ {
+-      struct flush_bio *fb = fbio->bi_private;
+-      struct md_rdev *rdev = fb->rdev;
+-      struct flush_info *fi = fb->fi;
+-      struct bio *bio = fi->bio;
+-      struct mddev *mddev = fi->mddev;
++      struct md_rdev *rdev = bio->bi_private;
++      struct mddev *mddev = rdev->mddev;
+       rdev_dec_pending(rdev, mddev);
+-      if (atomic_dec_and_test(&fi->flush_pending)) {
+-              if (bio->bi_iter.bi_size == 0) {
+-                      /* an empty barrier - all done */
+-                      bio_endio(bio);
+-                      mempool_free(fi, mddev->flush_pool);
+-              } else {
+-                      INIT_WORK(&fi->flush_work, submit_flushes);
+-                      queue_work(md_wq, &fi->flush_work);
+-              }
++      if (atomic_dec_and_test(&mddev->flush_pending)) {
++              /* The pre-request flush has finished */
++              queue_work(md_wq, &mddev->flush_work);
+       }
+-
+-      mempool_free(fb, mddev->flush_bio_pool);
+-      bio_put(fbio);
++      bio_put(bio);
+ }
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++static void md_submit_flush_data(struct work_struct *ws);
++
++static void submit_flushes(struct work_struct *ws)
+ {
++      struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+       struct md_rdev *rdev;
+-      struct flush_info *fi;
+-
+-      fi = mempool_alloc(mddev->flush_pool, GFP_NOIO);
+-
+-      fi->bio = bio;
+-      fi->mddev = mddev;
+-      atomic_set(&fi->flush_pending, 1);
++      INIT_WORK(&mddev->flush_work, md_submit_flush_data);
++      atomic_set(&mddev->flush_pending, 1);
+       rcu_read_lock();
+       rdev_for_each_rcu(rdev, mddev)
+               if (rdev->raid_disk >= 0 &&
+@@ -486,40 +444,59 @@ void md_flush_request(struct mddev *mdde
+                        * we reclaim rcu_read_lock
+                        */
+                       struct bio *bi;
+-                      struct flush_bio *fb;
+                       atomic_inc(&rdev->nr_pending);
+                       atomic_inc(&rdev->nr_pending);
+                       rcu_read_unlock();
+-
+-                      fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO);
+-                      fb->fi = fi;
+-                      fb->rdev = rdev;
+-
+                       bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+-                      bio_set_dev(bi, rdev->bdev);
+                       bi->bi_end_io = md_end_flush;
+-                      bi->bi_private = fb;
++                      bi->bi_private = rdev;
++                      bio_set_dev(bi, rdev->bdev);
+                       bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+-
+-                      atomic_inc(&fi->flush_pending);
++                      atomic_inc(&mddev->flush_pending);
+                       submit_bio(bi);
+-
+                       rcu_read_lock();
+                       rdev_dec_pending(rdev, mddev);
+               }
+       rcu_read_unlock();
++      if (atomic_dec_and_test(&mddev->flush_pending))
++              queue_work(md_wq, &mddev->flush_work);
++}
+-      if (atomic_dec_and_test(&fi->flush_pending)) {
+-              if (bio->bi_iter.bi_size == 0) {
+-                      /* an empty barrier - all done */
+-                      bio_endio(bio);
+-                      mempool_free(fi, mddev->flush_pool);
+-              } else {
+-                      INIT_WORK(&fi->flush_work, submit_flushes);
+-                      queue_work(md_wq, &fi->flush_work);
+-              }
++static void md_submit_flush_data(struct work_struct *ws)
++{
++      struct mddev *mddev = container_of(ws, struct mddev, flush_work);
++      struct bio *bio = mddev->flush_bio;
++
++      /*
++       * must reset flush_bio before calling into md_handle_request to avoid a
++       * deadlock, because other bios passed md_handle_request suspend check
++       * could wait for this and below md_handle_request could wait for those
++       * bios because of suspend check
++       */
++      mddev->flush_bio = NULL;
++      wake_up(&mddev->sb_wait);
++
++      if (bio->bi_iter.bi_size == 0) {
++              /* an empty barrier - all done */
++              bio_endio(bio);
++      } else {
++              bio->bi_opf &= ~REQ_PREFLUSH;
++              md_handle_request(mddev, bio);
+       }
+ }
++
++void md_flush_request(struct mddev *mddev, struct bio *bio)
++{
++      spin_lock_irq(&mddev->lock);
++      wait_event_lock_irq(mddev->sb_wait,
++                          !mddev->flush_bio,
++                          mddev->lock);
++      mddev->flush_bio = bio;
++      spin_unlock_irq(&mddev->lock);
++
++      INIT_WORK(&mddev->flush_work, submit_flushes);
++      queue_work(md_wq, &mddev->flush_work);
++}
+ EXPORT_SYMBOL(md_flush_request);
+ static inline struct mddev *mddev_get(struct mddev *mddev)
+@@ -566,6 +543,7 @@ void mddev_init(struct mddev *mddev)
+       atomic_set(&mddev->openers, 0);
+       atomic_set(&mddev->active_io, 0);
+       spin_lock_init(&mddev->lock);
++      atomic_set(&mddev->flush_pending, 0);
+       init_waitqueue_head(&mddev->sb_wait);
+       init_waitqueue_head(&mddev->recovery_wait);
+       mddev->reshape_position = MaxSector;
+@@ -5519,22 +5497,6 @@ int md_run(struct mddev *mddev)
+               if (err)
+                       return err;
+       }
+-      if (mddev->flush_pool == NULL) {
+-              mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc,
+-                                              flush_info_free, mddev);
+-              if (!mddev->flush_pool) {
+-                      err = -ENOMEM;
+-                      goto abort;
+-              }
+-      }
+-      if (mddev->flush_bio_pool == NULL) {
+-              mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc,
+-                                              flush_bio_free, mddev);
+-              if (!mddev->flush_bio_pool) {
+-                      err = -ENOMEM;
+-                      goto abort;
+-              }
+-      }
+       spin_lock(&pers_lock);
+       pers = find_pers(mddev->level, mddev->clevel);
+@@ -5694,15 +5656,8 @@ int md_run(struct mddev *mddev)
+       return 0;
+ abort:
+-      if (mddev->flush_bio_pool) {
+-              mempool_destroy(mddev->flush_bio_pool);
+-              mddev->flush_bio_pool = NULL;
+-      }
+-      if (mddev->flush_pool){
+-              mempool_destroy(mddev->flush_pool);
+-              mddev->flush_pool = NULL;
+-      }
+-
++      bioset_exit(&mddev->bio_set);
++      bioset_exit(&mddev->sync_set);
+       return err;
+ }
+ EXPORT_SYMBOL_GPL(md_run);
+@@ -5906,14 +5861,6 @@ static void __md_stop(struct mddev *mdde
+               mddev->to_remove = &md_redundancy_group;
+       module_put(pers->owner);
+       clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+-      if (mddev->flush_bio_pool) {
+-              mempool_destroy(mddev->flush_bio_pool);
+-              mddev->flush_bio_pool = NULL;
+-      }
+-      if (mddev->flush_pool) {
+-              mempool_destroy(mddev->flush_pool);
+-              mddev->flush_pool = NULL;
+-      }
+ }
+ void md_stop(struct mddev *mddev)
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -252,19 +252,6 @@ enum mddev_sb_flags {
+       MD_SB_NEED_REWRITE,     /* metadata write needs to be repeated */
+ };
+-#define NR_FLUSH_INFOS 8
+-#define NR_FLUSH_BIOS 64
+-struct flush_info {
+-      struct bio                      *bio;
+-      struct mddev                    *mddev;
+-      struct work_struct              flush_work;
+-      atomic_t                        flush_pending;
+-};
+-struct flush_bio {
+-      struct flush_info *fi;
+-      struct md_rdev *rdev;
+-};
+-
+ struct mddev {
+       void                            *private;
+       struct md_personality           *pers;
+@@ -470,8 +457,13 @@ struct mddev {
+                                                  * metadata and bitmap writes
+                                                  */
+-      mempool_t                       *flush_pool;
+-      mempool_t                       *flush_bio_pool;
++      /* Generic flush handling.
++       * The last to finish preflush schedules a worker to submit
++       * the rest of the request (without the REQ_PREFLUSH flag).
++       */
++      struct bio *flush_bio;
++      atomic_t flush_pending;
++      struct work_struct flush_work;
+       struct work_struct event_work;  /* used by dm to report failure event */
+       void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+       struct md_cluster_info          *cluster_info;
index 6b9a62d2f8cd903f42d9188ce593ee5cda4e3925..b6a730b44b67457a85492e4b2d4ea19f26852738 100644 (file)
@@ -14,3 +14,38 @@ tipc-fix-modprobe-tipc-failed-after-switch-order-of-device-registration.patch
 vsock-virtio-initialize-core-virtio-vsock-before-registering-the-driver.patch
 net-mlx5-imply-mlxfw-in-mlx5_core.patch
 net-mlx5e-fix-ethtool-rxfh-commands-when-config_mlx5_en_rxnfc-is-disabled.patch
+parisc-export-running_on_qemu-symbol-for-modules.patch
+parisc-skip-registering-led-when-running-in-qemu.patch
+parisc-use-pa_asm_level-in-boot-code.patch
+parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch
+stm-class-fix-channel-free-in-stm-output-free-path.patch
+stm-class-fix-channel-bitmap-on-32-bit-systems.patch
+brd-re-enable-__gfp_highmem-in-brd_insert_page.patch
+proc-prevent-changes-to-overridden-credentials.patch
+revert-md-fix-lock-contention-for-flush-bios.patch
+md-batch-flush-requests.patch
+md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch
+dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch
+intel_th-msu-fix-single-mode-with-iommu.patch
+p54-drop-device-reference-count-if-fails-to-enable-device.patch
+of-fix-clang-wunsequenced-for-be32_to_cpu.patch
+cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch
+phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch
+media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch
+media-imx-csi-allow-unknown-nearest-upstream-entities.patch
+media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
+nfs4-fix-v4.0-client-state-corruption-when-mount.patch
+pnfs-fallback-to-mds-if-no-deviceid-found.patch
+clk-hi3660-mark-clk_gate_ufs_subsys-as-critical.patch
+clk-tegra-fix-pllm-programming-on-tegra124-when-pmc-overrides-divider.patch
+clk-mediatek-disable-tuner_en-before-change-pll-rate.patch
+clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
+udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch
+udlfb-fix-sleeping-inside-spinlock.patch
+udlfb-introduce-a-rendering-mutex.patch
+fuse-fix-writepages-on-32bit.patch
+fuse-honor-rlimit_fsize-in-fuse_file_fallocate.patch
+ovl-fix-missing-upper-fs-freeze-protection-on-copy-up-for-ioctl.patch
+iommu-tegra-smmu-fix-invalid-asid-bits-on-tegra30-114.patch
+ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
+md-add-a-missing-endianness-conversion-in-check_sb_changes.patch
diff --git a/queue-4.19/stm-class-fix-channel-bitmap-on-32-bit-systems.patch b/queue-4.19/stm-class-fix-channel-bitmap-on-32-bit-systems.patch
new file mode 100644 (file)
index 0000000..74d4a71
--- /dev/null
@@ -0,0 +1,45 @@
+From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:35 +0300
+Subject: stm class: Fix channel bitmap on 32-bit systems
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream.
+
+Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace
+Module devices") naively calculates the channel bitmap size in 64-bit
+chunks regardless of the size of underlying unsigned long, making the
+bitmap half as big on a 32-bit system. This leads to an out of bounds
+access with the upper half of the bitmap.
+
+Fix this by using BITS_TO_LONGS. While at it, convert to using
+struct_size() for the total size calculation of the master struct.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Reported-by: Mulu He <muluhe@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c |    7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig
+ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
+ {
+       struct stp_master *master;
+-      size_t size;
+-      size = ALIGN(stm->data->sw_nchannels, 8) / 8;
+-      size += sizeof(struct stp_master);
+-      master = kzalloc(size, GFP_ATOMIC);
++      master = kzalloc(struct_size(master, chan_map,
++                                   BITS_TO_LONGS(stm->data->sw_nchannels)),
++                       GFP_ATOMIC);
+       if (!master)
+               return -ENOMEM;
diff --git a/queue-4.19/stm-class-fix-channel-free-in-stm-output-free-path.patch b/queue-4.19/stm-class-fix-channel-free-in-stm-output-free-path.patch
new file mode 100644 (file)
index 0000000..e6aa1cf
--- /dev/null
@@ -0,0 +1,40 @@
+From ee496da4c3915de3232b5f5cd20e21ae3e46fe8d Mon Sep 17 00:00:00 2001
+From: Tingwei Zhang <tingwei@codeaurora.org>
+Date: Wed, 17 Apr 2019 10:35:34 +0300
+Subject: stm class: Fix channel free in stm output free path
+
+From: Tingwei Zhang <tingwei@codeaurora.org>
+
+commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream.
+
+Number of free masters is not set correctly in stm
+free path. Fix this by properly adding the number
+of output channels before setting them to 0 in
+stm_output_disclaim().
+
+Currently it is equivalent to doing nothing since
+master->nr_free is incremented by 0.
+
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Signed-off-by: Tingwei Zhang <tingwei@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *s
+       bitmap_release_region(&master->chan_map[0], output->channel,
+                             ilog2(output->nr_chans));
+-      output->nr_chans = 0;
+       master->nr_free += output->nr_chans;
++      output->nr_chans = 0;
+ }
+ /*
diff --git a/queue-4.19/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch b/queue-4.19/udlfb-delete-the-unused-parameter-for-dlfb_handle_damage.patch
new file mode 100644 (file)
index 0000000..de8ae50
--- /dev/null
@@ -0,0 +1,102 @@
+From bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: delete the unused parameter for dlfb_handle_damage
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 upstream.
+
+Remove the unused parameter "data" and unused variable "ret".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c |   21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -594,10 +594,9 @@ static int dlfb_render_hline(struct dlfb
+       return 0;
+ }
+-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+-             int width, int height, char *data)
++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+-      int i, ret;
++      int i;
+       char *cmd;
+       cycles_t start_cycles, end_cycles;
+       int bytes_sent = 0;
+@@ -641,7 +640,7 @@ static int dlfb_handle_damage(struct dlf
+                       *cmd++ = 0xAF;
+               /* Send partial buffer remaining before exiting */
+               len = cmd - (char *) urb->transfer_buffer;
+-              ret = dlfb_submit_urb(dlfb, urb, len);
++              dlfb_submit_urb(dlfb, urb, len);
+               bytes_sent += len;
+       } else
+               dlfb_urb_completion(urb);
+@@ -679,7 +678,7 @@ static ssize_t dlfb_ops_write(struct fb_
+                               (u32)info->var.yres);
+               dlfb_handle_damage(dlfb, 0, start, info->var.xres,
+-                      lines, info->screen_base);
++                      lines);
+       }
+       return result;
+@@ -695,7 +694,7 @@ static void dlfb_ops_copyarea(struct fb_
+       sys_copyarea(info, area);
+       dlfb_handle_damage(dlfb, area->dx, area->dy,
+-                      area->width, area->height, info->screen_base);
++                      area->width, area->height);
+ }
+ static void dlfb_ops_imageblit(struct fb_info *info,
+@@ -706,7 +705,7 @@ static void dlfb_ops_imageblit(struct fb
+       sys_imageblit(info, image);
+       dlfb_handle_damage(dlfb, image->dx, image->dy,
+-                      image->width, image->height, info->screen_base);
++                      image->width, image->height);
+ }
+ static void dlfb_ops_fillrect(struct fb_info *info,
+@@ -717,7 +716,7 @@ static void dlfb_ops_fillrect(struct fb_
+       sys_fillrect(info, rect);
+       dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
+-                            rect->height, info->screen_base);
++                            rect->height);
+ }
+ /*
+@@ -859,8 +858,7 @@ static int dlfb_ops_ioctl(struct fb_info
+               if (area.y > info->var.yres)
+                       area.y = info->var.yres;
+-              dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h,
+-                         info->screen_base);
++              dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h);
+       }
+       return 0;
+@@ -1065,8 +1063,7 @@ static int dlfb_ops_set_par(struct fb_in
+                       pix_framebuffer[i] = 0x37e6;
+       }
+-      dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres,
+-                         info->screen_base);
++      dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres);
+       return 0;
+ }
diff --git a/queue-4.19/udlfb-fix-sleeping-inside-spinlock.patch b/queue-4.19/udlfb-fix-sleeping-inside-spinlock.patch
new file mode 100644 (file)
index 0000000..9f8af96
--- /dev/null
@@ -0,0 +1,147 @@
+From 6b11f9d8433b471fdd3ebed232b43a4b723be6ff Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: udlfb: fix sleeping inside spinlock
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6b11f9d8433b471fdd3ebed232b43a4b723be6ff upstream.
+
+If a framebuffer device is used as a console, the rendering calls
+(copyarea, fillrect, imageblit) may be done with the console spinlock
+held. On udlfb, these function call dlfb_handle_damage that takes a
+blocking semaphore before acquiring an URB.
+
+In order to fix the bug, this patch changes the calls copyarea, fillrect
+and imageblit to offload USB work to a workqueue.
+
+A side effect of this patch is 3x improvement in console scrolling speed
+because the device doesn't have to be updated after each copyarea call.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c |   56 +++++++++++++++++++++++++++++++++++++++++---
+ include/video/udlfb.h       |    6 ++++
+ 2 files changed, 59 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -657,6 +657,50 @@ error:
+       return 0;
+ }
++static void dlfb_init_damage(struct dlfb_data *dlfb)
++{
++      dlfb->damage_x = INT_MAX;
++      dlfb->damage_x2 = 0;
++      dlfb->damage_y = INT_MAX;
++      dlfb->damage_y2 = 0;
++}
++
++static void dlfb_damage_work(struct work_struct *w)
++{
++      struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work);
++      int x, x2, y, y2;
++
++      spin_lock_irq(&dlfb->damage_lock);
++      x = dlfb->damage_x;
++      x2 = dlfb->damage_x2;
++      y = dlfb->damage_y;
++      y2 = dlfb->damage_y2;
++      dlfb_init_damage(dlfb);
++      spin_unlock_irq(&dlfb->damage_lock);
++
++      if (x < x2 && y < y2)
++              dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y);
++}
++
++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
++{
++      unsigned long flags;
++      int x2 = x + width;
++      int y2 = y + height;
++
++      if (x >= x2 || y >= y2)
++              return;
++
++      spin_lock_irqsave(&dlfb->damage_lock, flags);
++      dlfb->damage_x = min(x, dlfb->damage_x);
++      dlfb->damage_x2 = max(x2, dlfb->damage_x2);
++      dlfb->damage_y = min(y, dlfb->damage_y);
++      dlfb->damage_y2 = max(y2, dlfb->damage_y2);
++      spin_unlock_irqrestore(&dlfb->damage_lock, flags);
++
++      schedule_work(&dlfb->damage_work);
++}
++
+ /*
+  * Path triggered by usermode clients who write to filesystem
+  * e.g. cat filename > /dev/fb1
+@@ -693,7 +737,7 @@ static void dlfb_ops_copyarea(struct fb_
+       sys_copyarea(info, area);
+-      dlfb_handle_damage(dlfb, area->dx, area->dy,
++      dlfb_offload_damage(dlfb, area->dx, area->dy,
+                       area->width, area->height);
+ }
+@@ -704,7 +748,7 @@ static void dlfb_ops_imageblit(struct fb
+       sys_imageblit(info, image);
+-      dlfb_handle_damage(dlfb, image->dx, image->dy,
++      dlfb_offload_damage(dlfb, image->dx, image->dy,
+                       image->width, image->height);
+ }
+@@ -715,7 +759,7 @@ static void dlfb_ops_fillrect(struct fb_
+       sys_fillrect(info, rect);
+-      dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
++      dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width,
+                             rect->height);
+ }
+@@ -940,6 +984,8 @@ static void dlfb_ops_destroy(struct fb_i
+ {
+       struct dlfb_data *dlfb = info->par;
++      cancel_work_sync(&dlfb->damage_work);
++
+       if (info->cmap.len != 0)
+               fb_dealloc_cmap(&info->cmap);
+       if (info->monspecs.modedb)
+@@ -1636,6 +1682,10 @@ static int dlfb_usb_probe(struct usb_int
+       dlfb->ops = dlfb_ops;
+       info->fbops = &dlfb->ops;
++      dlfb_init_damage(dlfb);
++      spin_lock_init(&dlfb->damage_lock);
++      INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
++
+       INIT_LIST_HEAD(&info->modelist);
+       if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,12 @@ struct dlfb_data {
+       int base8;
+       u32 pseudo_palette[256];
+       int blank_mode; /*one of FB_BLANK_ */
++      int damage_x;
++      int damage_y;
++      int damage_x2;
++      int damage_y2;
++      spinlock_t damage_lock;
++      struct work_struct damage_work;
+       struct fb_ops ops;
+       /* blit-only rendering path metrics, exposed through sysfs */
+       atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
diff --git a/queue-4.19/udlfb-introduce-a-rendering-mutex.patch b/queue-4.19/udlfb-introduce-a-rendering-mutex.patch
new file mode 100644 (file)
index 0000000..7d1a891
--- /dev/null
@@ -0,0 +1,149 @@
+From babc250e278eac7b0e671bdaedf833759b43bb78 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:57 +0200
+Subject: udlfb: introduce a rendering mutex
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit babc250e278eac7b0e671bdaedf833759b43bb78 upstream.
+
+Rendering calls may be done simultaneously from the workqueue,
+dlfb_ops_write, dlfb_ops_ioctl, dlfb_ops_set_par and dlfb_dpy_deferred_io.
+The code is robust enough so that it won't crash on concurrent rendering.
+
+However, concurrent rendering may cause display corruption if the same
+pixel is simultaneously being rendered. In order to avoid this corruption,
+this patch adds a mutex around the rendering calls.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+[b.zolnierkie: replace "dlfb:" with "uldfb:" in the patch summary]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/udlfb.c |   41 ++++++++++++++++++++++++++++++-----------
+ include/video/udlfb.h       |    1 +
+ 2 files changed, 31 insertions(+), 11 deletions(-)
+
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -596,7 +596,7 @@ static int dlfb_render_hline(struct dlfb
+ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+-      int i;
++      int i, ret;
+       char *cmd;
+       cycles_t start_cycles, end_cycles;
+       int bytes_sent = 0;
+@@ -606,21 +606,29 @@ static int dlfb_handle_damage(struct dlf
+       start_cycles = get_cycles();
++      mutex_lock(&dlfb->render_mutex);
++
+       aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long));
+       width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long));
+       x = aligned_x;
+       if ((width <= 0) ||
+           (x + width > dlfb->info->var.xres) ||
+-          (y + height > dlfb->info->var.yres))
+-              return -EINVAL;
++          (y + height > dlfb->info->var.yres)) {
++              ret = -EINVAL;
++              goto unlock_ret;
++      }
+-      if (!atomic_read(&dlfb->usb_active))
+-              return 0;
++      if (!atomic_read(&dlfb->usb_active)) {
++              ret = 0;
++              goto unlock_ret;
++      }
+       urb = dlfb_get_urb(dlfb);
+-      if (!urb)
+-              return 0;
++      if (!urb) {
++              ret = 0;
++              goto unlock_ret;
++      }
+       cmd = urb->transfer_buffer;
+       for (i = y; i < y + height ; i++) {
+@@ -654,7 +662,11 @@ error:
+                   >> 10)), /* Kcycles */
+                  &dlfb->cpu_kcycles_used);
+-      return 0;
++      ret = 0;
++
++unlock_ret:
++      mutex_unlock(&dlfb->render_mutex);
++      return ret;
+ }
+ static void dlfb_init_damage(struct dlfb_data *dlfb)
+@@ -782,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct
+       int bytes_identical = 0;
+       int bytes_rendered = 0;
++      mutex_lock(&dlfb->render_mutex);
++
+       if (!fb_defio)
+-              return;
++              goto unlock_ret;
+       if (!atomic_read(&dlfb->usb_active))
+-              return;
++              goto unlock_ret;
+       start_cycles = get_cycles();
+       urb = dlfb_get_urb(dlfb);
+       if (!urb)
+-              return;
++              goto unlock_ret;
+       cmd = urb->transfer_buffer;
+@@ -825,6 +839,8 @@ error:
+       atomic_add(((unsigned int) ((end_cycles - start_cycles)
+                   >> 10)), /* Kcycles */
+                  &dlfb->cpu_kcycles_used);
++unlock_ret:
++      mutex_unlock(&dlfb->render_mutex);
+ }
+ static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len)
+@@ -986,6 +1002,8 @@ static void dlfb_ops_destroy(struct fb_i
+       cancel_work_sync(&dlfb->damage_work);
++      mutex_destroy(&dlfb->render_mutex);
++
+       if (info->cmap.len != 0)
+               fb_dealloc_cmap(&info->cmap);
+       if (info->monspecs.modedb)
+@@ -1682,6 +1700,7 @@ static int dlfb_usb_probe(struct usb_int
+       dlfb->ops = dlfb_ops;
+       info->fbops = &dlfb->ops;
++      mutex_init(&dlfb->render_mutex);
+       dlfb_init_damage(dlfb);
+       spin_lock_init(&dlfb->damage_lock);
+       INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,7 @@ struct dlfb_data {
+       int base8;
+       u32 pseudo_palette[256];
+       int blank_mode; /*one of FB_BLANK_ */
++      struct mutex render_mutex;
+       int damage_x;
+       int damage_y;
+       int damage_x2;