--- /dev/null
+From c7e2d94b3d1634988a95ac4d77a72dc7487ece06 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Tue, 30 Apr 2019 09:52:25 +0800
+Subject: blk-mq: free hw queue's resource in hctx's release handler
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 upstream.
+
+Once blk_cleanup_queue() returns, tags shouldn't be used any more,
+because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2
+("blk-mq: Fix a use-after-free") fixes this issue exactly.
+
+However, that commit introduces another issue. Before 45a9c9d909b2,
+we are allowed to run queue during cleaning up queue if the queue's
+kobj refcount is held. After that commit, queue can't be run during
+queue cleaning up, otherwise oops can be triggered easily because
+some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue().
+
+We have invented ways for addressing this kind of issue before, such as:
+
+ 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done")
+ c2856ae2f315 ("blk-mq: quiesce queue before freeing queue")
+
+But still can't cover all cases, recently James reports another such
+kind of issue:
+
+ https://marc.info/?l=linux-scsi&m=155389088124782&w=2
+
+This issue can be quite hard to address by previous way, given
+scsi_run_queue() may run requeues for other LUNs.
+
+Fixes the above issue by freeing hctx's resources in its release handler, and this
+way is safe becasue tags isn't needed for freeing such hctx resource.
+
+This approach follows typical design pattern wrt. kobject's release handler.
+
+Cc: Dongli Zhang <dongli.zhang@oracle.com>
+Cc: James Smart <james.smart@broadcom.com>
+Cc: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: linux-scsi@vger.kernel.org,
+Cc: Martin K . Petersen <martin.petersen@oracle.com>,
+Cc: Christoph Hellwig <hch@lst.de>,
+Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>,
+Reported-by: James Smart <james.smart@broadcom.com>
+Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Tested-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-core.c | 2 +-
+ block/blk-mq-sysfs.c | 6 ++++++
+ block/blk-mq.c | 8 ++------
+ block/blk-mq.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_qu
+ blk_exit_queue(q);
+
+ if (queue_is_mq(q))
+- blk_mq_free_queue(q);
++ blk_mq_exit_queue(q);
+
+ percpu_ref_exit(&q->q_usage_counter);
+
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/smp.h>
+
+ #include <linux/blk-mq.h>
++#include "blk.h"
+ #include "blk-mq.h"
+ #include "blk-mq-tag.h"
+
+@@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(stru
+ {
+ struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+ kobj);
++
++ if (hctx->flags & BLK_MQ_F_BLOCKING)
++ cleanup_srcu_struct(hctx->srcu);
++ blk_free_flush_queue(hctx->fq);
++ sbitmap_free(&hctx->ctx_map);
+ free_cpumask_var(hctx->cpumask);
+ kfree(hctx->ctxs);
+ kfree(hctx);
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2267,12 +2267,7 @@ static void blk_mq_exit_hctx(struct requ
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- if (hctx->flags & BLK_MQ_F_BLOCKING)
+- cleanup_srcu_struct(hctx->srcu);
+-
+ blk_mq_remove_cpuhp(hctx);
+- blk_free_flush_queue(hctx->fq);
+- sbitmap_free(&hctx->ctx_map);
+ }
+
+ static void blk_mq_exit_hw_queues(struct request_queue *q,
+@@ -2905,7 +2900,8 @@ err_exit:
+ }
+ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+
+-void blk_mq_free_queue(struct request_queue *q)
++/* tags can _not_ be used after returning from blk_mq_exit_queue */
++void blk_mq_exit_queue(struct request_queue *q)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -37,7 +37,7 @@ struct blk_mq_ctx {
+ struct kobject kobj;
+ } ____cacheline_aligned_in_smp;
+
+-void blk_mq_free_queue(struct request_queue *q);
++void blk_mq_exit_queue(struct request_queue *q);
+ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
--- /dev/null
+From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 22 Apr 2019 22:41:23 +0200
+Subject: brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe upstream.
+
+The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
+is way too generic.
+
+The DMI strings on which we are matching are somewhat generic too, but
+"To be filled by O.E.M." is less common then "Default string" and the
+system-sku and bios-version strings are pretty unique. Beside the DMI
+strings we also check the wifi-module chip-id and revision. I'm confident
+that the combination of all this is unique.
+
+Both the T8 and T11 use the same wifi-module, this commit adds DMI
+quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
+
+ /* NOTE: Please keep all entries sorted alphabetically */
+
++static const struct brcmf_dmi_data acepc_t8_data = {
++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
++};
++
+ static const struct brcmf_dmi_data gpd_win_pocket_data = {
+ BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
+ };
+@@ -49,6 +53,28 @@ static const struct brcmf_dmi_data pov_t
+
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
++ /* ACEPC T8 Cherry Trail Z8350 mini PC */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
++ {
++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
++ {
+ /* Match for the GPDwin which unfortunately uses somewhat
+ * generic dmi strings, which is why we test for 4 strings.
+ * Comparing against 23 other byt/cht boards, board_vendor
--- /dev/null
+From f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Mon, 22 Apr 2019 21:23:21 +0800
+Subject: brd: re-enable __GFP_HIGHMEM in brd_insert_page()
+
+From: Hou Tao <houtao1@huawei.com>
+
+commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream.
+
+__GFP_HIGHMEM is disabled if dax is enabled on brd, however
+dax support for brd has been removed since commit (7a862fbbdec6
+"brd: remove dax support"), so restore __GFP_HIGHMEM in
+brd_insert_page().
+
+Also remove the no longer applicable comments about DAX and highmem.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a862fbbdec6 ("brd: remove dax support")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/brd.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -96,13 +96,8 @@ static struct page *brd_insert_page(stru
+ /*
+ * Must use NOIO because we don't want to recurse back into the
+ * block or filesystem layers from page reclaim.
+- *
+- * Cannot support DAX and highmem, because our ->direct_access
+- * routine for DAX must return memory that is always addressable.
+- * If DAX was reworked to use pfns and kmap throughout, this
+- * restriction might be able to be lifted.
+ */
+- gfp_flags = GFP_NOIO | __GFP_ZERO;
++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+ page = alloc_page(gfp_flags);
+ if (!page)
+ return NULL;
--- /dev/null
+From d69cb728e70c40268762182a62f5d5d6fa51c5b2 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Wed, 1 May 2019 12:03:41 +1000
+Subject: cifs: fix credits leak for SMB1 oplock breaks
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+commit d69cb728e70c40268762182a62f5d5d6fa51c5b2 upstream.
+
+For SMB1 oplock breaks we would grab one credit while sending the PDU
+but we would never relese the credit back since we will never receive a
+response to this from the server. Eventuallt this would lead to a hang
+once all credits are leaked.
+
+Fix this by defining a new flag CIFS_NO_SRV_RSP which indicates that there
+is no server response to this command and thus we need to add any credits back
+immediately after sending the PDU.
+
+CC: Stable <stable@vger.kernel.org> #v5.0+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifsglob.h | 1 +
+ fs/cifs/cifssmb.c | 2 +-
+ fs/cifs/transport.c | 10 +++++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1687,6 +1687,7 @@ static inline bool is_retryable_error(in
+
+ #define CIFS_HAS_CREDITS 0x0400 /* already has credits */
+ #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */
++#define CIFS_NO_SRV_RSP 0x1000 /* there is no server response */
+
+ /* Security Flags: indicate type of session setup needed */
+ #define CIFSSEC_MAY_SIGN 0x00001
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2540,7 +2540,7 @@ CIFSSMBLock(const unsigned int xid, stru
+
+ if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
+ /* no response expected */
+- flags = CIFS_ASYNC_OP | CIFS_OBREAK_OP;
++ flags = CIFS_NO_SRV_RSP | CIFS_ASYNC_OP | CIFS_OBREAK_OP;
+ pSMB->Timeout = 0;
+ } else if (waitFlag) {
+ flags = CIFS_BLOCKING_OP; /* blocking operation, no timeout */
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -1054,8 +1054,11 @@ compound_send_recv(const unsigned int xi
+
+ mutex_unlock(&ses->server->srv_mutex);
+
+- if (rc < 0) {
+- /* Sending failed for some reason - return credits back */
++ /*
++ * If sending failed for some reason or it is an oplock break that we
++ * will not receive a response to - return credits back
++ */
++ if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) {
+ for (i = 0; i < num_rqst; i++)
+ add_credits(ses->server, &credits[i], optype);
+ goto out;
+@@ -1076,9 +1079,6 @@ compound_send_recv(const unsigned int xi
+ smb311_update_preauth_hash(ses, rqst[0].rq_iov,
+ rqst[0].rq_nvec);
+
+- if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP)
+- goto out;
+-
+ for (i = 0; i < num_rqst; i++) {
+ rc = wait_for_response(ses->server, midQ[i]);
+ if (rc != 0)
--- /dev/null
+From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001
+From: Christoph Probst <kernel@probst.it>
+Date: Tue, 7 May 2019 17:16:40 +0200
+Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
+
+From: Christoph Probst <kernel@probst.it>
+
+commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
+
+Change strcat to strncpy in the "None" case to fix a buffer overflow
+when cinode->oplock is reset to 0 by another thread accessing the same
+cinode. It is never valid to append "None" to any other message.
+
+Consolidate multiple writes to cinode->oplock to reduce raciness.
+
+Signed-off-by: Christoph Probst <kernel@probst.it>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2917,26 +2917,28 @@ smb21_set_oplock_level(struct cifsInodeI
+ unsigned int epoch, bool *purge_cache)
+ {
+ char message[5] = {0};
++ unsigned int new_oplock = 0;
+
+ oplock &= 0xFF;
+ if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+ return;
+
+- cinode->oplock = 0;
+ if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_READ_FLG;
++ new_oplock |= CIFS_CACHE_READ_FLG;
+ strcat(message, "R");
+ }
+ if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
++ new_oplock |= CIFS_CACHE_HANDLE_FLG;
+ strcat(message, "H");
+ }
+ if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_WRITE_FLG;
++ new_oplock |= CIFS_CACHE_WRITE_FLG;
+ strcat(message, "W");
+ }
+- if (!cinode->oplock)
+- strcat(message, "None");
++ if (!new_oplock)
++ strncpy(message, "None", sizeof(message));
++
++ cinode->oplock = new_oplock;
+ cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+ &cinode->vfs_inode);
+ }
--- /dev/null
+From 5467a68cbf6884c9a9d91e2a89140afb1839c835 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 15 Mar 2019 22:23:19 -0400
+Subject: dcache: sort the freeing-without-RCU-delay mess for good.
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream.
+
+For lockless accesses to dentries we don't have pinned we rely
+(among other things) upon having an RCU delay between dropping
+the last reference and actually freeing the memory.
+
+On the other hand, for things like pipes and sockets we neither
+do that kind of lockless access, nor want to deal with the
+overhead of an RCU delay every time a socket gets closed.
+
+So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags
+made sure it would happen. We tried to avoid setting it unless
+we knew we need it. Unfortunately, that had led to recurring
+class of bugs, in which we missed the need to set it.
+
+We only really need it for dentries that are created by
+d_alloc_pseudo(), so let's not bother with trying to be smart -
+just make having an RCU delay the default. The ones that do
+*not* get it set the replacement flag (DCACHE_NORCU) and we'd
+better use that sparingly. d_alloc_pseudo() is the only
+such user right now.
+
+FWIW, the race that finally prompted that switch had been
+between __lock_parent() of immediate subdirectory of what's
+currently the root of a disconnected tree (e.g. from
+open-by-handle in progress) racing with d_splice_alias()
+elsewhere picking another alias for the same inode, either
+on outright corrupted fs image, or (in case of open-by-handle
+on NFS) that subdirectory having been just moved on server.
+It's not easy to hit, so the sky is not falling, but that's
+not the first race on similar missed cases and the logics
+for settinf DCACHE_RCUACCESS has gotten ridiculously
+convoluted.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/filesystems/porting | 5 +++++
+ fs/dcache.c | 24 +++++++++++++-----------
+ fs/nsfs.c | 3 +--
+ include/linux/dcache.h | 2 +-
+ 4 files changed, 20 insertions(+), 14 deletions(-)
+
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -638,3 +638,8 @@ in your dentry operations instead.
+ inode to d_splice_alias() will also do the right thing (equivalent of
+ d_add(dentry, NULL); return NULL;), so that kind of special cases
+ also doesn't need a separate treatment.
++--
++[mandatory]
++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
++ business doing so.
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *d
+ }
+ }
+ /* if dentry was never visible to RCU, immediate free is OK */
+- if (!(dentry->d_flags & DCACHE_RCUACCESS))
++ if (dentry->d_flags & DCACHE_NORCU)
+ __d_free(&dentry->d_u.d_rcu);
+ else
+ call_rcu(&dentry->d_u.d_rcu, __d_free);
+@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * p
+ struct dentry *dentry = __d_alloc(parent->d_sb, name);
+ if (!dentry)
+ return NULL;
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ spin_lock(&parent->d_lock);
+ /*
+ * don't need child lock because it is not subject
+@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct den
+ {
+ struct dentry *dentry = d_alloc_anon(parent->d_sb);
+ if (dentry) {
+- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
++ dentry->d_flags |= DCACHE_DENTRY_CURSOR;
+ dentry->d_parent = dget(parent);
+ }
+ return dentry;
+@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct den
+ *
+ * For a filesystem that just pins its dentries in memory and never
+ * performs lookups at all, return an unhashed IS_ROOT dentry.
++ * This is used for pipes, sockets et.al. - the stuff that should
++ * never be anyone's children or parents. Unlike all other
++ * dentries, these will not have RCU delay between dropping the
++ * last reference and freeing them.
+ */
+ struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
+ {
+- return __d_alloc(sb, name);
++ struct dentry *dentry = __d_alloc(sb, name);
++ if (likely(dentry))
++ dentry->d_flags |= DCACHE_NORCU;
++ return dentry;
+ }
+ EXPORT_SYMBOL(d_alloc_pseudo);
+
+@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode
+
+ if (root_inode) {
+ res = d_alloc_anon(root_inode->i_sb);
+- if (res) {
+- res->d_flags |= DCACHE_RCUACCESS;
++ if (res)
+ d_instantiate(res, root_inode);
+- } else {
++ else
+ iput(root_inode);
+- }
+ }
+ return res;
+ }
+@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dent
+ copy_name(dentry, target);
+ target->d_hash.pprev = NULL;
+ dentry->d_parent->d_lockref.count++;
+- if (dentry == old_parent)
+- dentry->d_flags |= DCACHE_RCUACCESS;
+- else
++ if (dentry != old_parent) /* wasn't IS_ROOT */
+ WARN_ON(!--old_parent->d_lockref.count);
+ } else {
+ target->d_parent = old_parent;
+--- a/fs/nsfs.c
++++ b/fs/nsfs.c
+@@ -85,13 +85,12 @@ slow:
+ inode->i_fop = &ns_file_operations;
+ inode->i_private = ns;
+
+- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
++ dentry = d_alloc_anon(mnt->mnt_sb);
+ if (!dentry) {
+ iput(inode);
+ return ERR_PTR(-ENOMEM);
+ }
+ d_instantiate(dentry, inode);
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ dentry->d_fsdata = (void *)ns->ops;
+ d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+ if (d) {
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -176,7 +176,6 @@ struct dentry_operations {
+ * typically using d_splice_alias. */
+
+ #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */
+-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */
+
+ #define DCACHE_CANT_MOUNT 0x00000100
+ #define DCACHE_GENOCIDE 0x00000200
+@@ -217,6 +216,7 @@ struct dentry_operations {
+
+ #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
+ #define DCACHE_DENTRY_CURSOR 0x20000000
++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */
+
+ extern seqlock_t rename_lock;
+
--- /dev/null
+From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 3 May 2019 11:44:34 +0300
+Subject: intel_th: msu: Fix single mode with IOMMU
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream.
+
+Currently, the pages that are allocated for the single mode of MSC are not
+mapped into the device's dma space and the code is incorrectly using
+*_to_phys() in place of a dma address. This fails with IOMMU enabled and
+is otherwise bad practice.
+
+Fix the single mode buffer allocation to map the pages into the device's
+DMA space.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+ * @reg_base: register window base address
+ * @thdev: intel_th_device pointer
+ * @win_list: list of windows in multiblock mode
++ * @single_sgt: single mode buffer
+ * @nr_pages: total number of pages allocated for this buffer
+ * @single_sz: amount of data in single mode
+ * @single_wrap: single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+ struct intel_th_device *thdev;
+
+ struct list_head win_list;
++ struct sg_table single_sgt;
+ unsigned long nr_pages;
+ unsigned long single_sz;
+ unsigned int single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(stru
+ */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++ unsigned long nr_pages = size >> PAGE_SHIFT;
+ unsigned int order = get_order(size);
+ struct page *page;
++ int ret;
+
+ if (!size)
+ return 0;
+
++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++ if (ret)
++ goto err_out;
++
++ ret = -ENOMEM;
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+- return -ENOMEM;
++ goto err_free_sgt;
+
+ split_page(page, order);
+- msc->nr_pages = size >> PAGE_SHIFT;
++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++ DMA_FROM_DEVICE);
++ if (ret < 0)
++ goto err_free_pages;
++
++ msc->nr_pages = nr_pages;
+ msc->base = page_address(page);
+- msc->base_addr = page_to_phys(page);
++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+
+ return 0;
++
++err_free_pages:
++ __free_pages(page, order);
++
++err_free_sgt:
++ sg_free_table(&msc->single_sgt);
++
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struc
+ {
+ unsigned long off;
+
++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++ 1, DMA_FROM_DEVICE);
++ sg_free_table(&msc->single_sgt);
++
+ for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+ struct page *page = virt_to_page(msc->base + off);
+
--- /dev/null
+From ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Thu, 4 Apr 2019 18:56:10 +0200
+Subject: md: add a missing endianness conversion in check_sb_changes
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream.
+
+The on-disk value is little endian and we need to convert it to
+native endian before storing the value in the in-core structure.
+
+Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode")
+Cc: <stable@vger.kernel.org> # 4.20+
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9229,7 +9229,7 @@ static void check_sb_changes(struct mdde
+ * reshape is happening in the remote node, we need to
+ * update reshape_position and call start_reshape.
+ */
+- mddev->reshape_position = sb->reshape_position;
++ mddev->reshape_position = le64_to_cpu(sb->reshape_position);
+ if (mddev->pers->update_reshape_pos)
+ mddev->pers->update_reshape_pos(mddev);
+ if (mddev->pers->start_reshape)
--- /dev/null
+From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Tue, 2 Apr 2019 14:22:14 +0800
+Subject: md: add mddev->pers to avoid potential NULL pointer dereference
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.
+
+When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
+which can avoid potential NULL pointer derefence in fallowing
+add_bound_rdev().
+
+Fixes: a6da4ef85cef ("md: re-add a failed disk")
+Cc: Xiao Ni <xni@redhat.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: <stable@vger.kernel.org> # 4.4+
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2852,8 +2852,10 @@ state_store(struct md_rdev *rdev, const
+ err = 0;
+ }
+ } else if (cmd_match(buf, "re-add")) {
+- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+- rdev->saved_raid_disk >= 0) {
++ if (!rdev->mddev->pers)
++ err = -EINVAL;
++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++ rdev->saved_raid_disk >= 0) {
+ /* clear_bit is performed _after_ all the devices
+ * have their local Faulty bit cleared. If any writes
+ * happen in the meantime in the local node, they
--- /dev/null
+From 2bc13b83e6298486371761de503faeffd15b7534 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:17 -0700
+Subject: md: batch flush requests.
+
+From: NeilBrown <neilb@suse.com>
+
+commit 2bc13b83e6298486371761de503faeffd15b7534 upstream.
+
+Currently if many flush requests are submitted to an md device is quick
+succession, they are serialized and can take a long to process them all.
+We don't really need to call flush all those times - a single flush call
+can satisfy all requests submitted before it started.
+So keep track of when the current flush started and when it finished,
+allow any pending flush that was requested before the flush started
+to complete without waiting any more.
+
+Test results from Xiao:
+
+Test is done on a raid10 device which is created by 4 SSDs. The tool is
+dbench.
+
+1. The latest linux stable kernel
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 10.509 78.305
+ Flush 2078376 0.013 10.094
+ Close 21787697 0.019 18.821
+ LockX 96580 0.007 3.184
+ Mkdir 384 0.008 0.062
+ Rename 1255883 0.191 23.534
+ ReadX 46495589 0.020 14.230
+ WriteX 14790591 7.123 60.706
+ Unlink 5989118 0.440 54.551
+ UnlockX 96580 0.005 2.736
+ FIND_FIRST 10393845 0.042 12.079
+ SET_FILE_INFORMATION 2415558 0.129 10.088
+ QUERY_FILE_INFORMATION 4711725 0.005 8.462
+ QUERY_PATH_INFORMATION 26883327 0.032 21.715
+ QUERY_FS_INFORMATION 4929409 0.010 8.238
+ NTCreateX 29660080 0.100 53.268
+
+Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.712 ms
+
+2. With patch1 "Revert "MD: fix lock contention for flush bios""
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 256 8.326 36.761
+ Flush 693291 3.974 180.269
+ Close 7266404 0.009 36.929
+ LockX 32160 0.006 0.840
+ Mkdir 128 0.008 0.021
+ Rename 418755 0.063 29.945
+ ReadX 15498708 0.007 7.216
+ WriteX 4932310 22.482 267.928
+ Unlink 1997557 0.109 47.553
+ UnlockX 32160 0.004 1.110
+ FIND_FIRST 3465791 0.036 7.320
+ SET_FILE_INFORMATION 805825 0.015 1.561
+ QUERY_FILE_INFORMATION 1570950 0.005 2.403
+ QUERY_PATH_INFORMATION 8965483 0.013 14.277
+ QUERY_FS_INFORMATION 1643626 0.009 3.314
+ NTCreateX 9892174 0.061 41.278
+
+Throughput 345.009 MB/sec (sync open) 128 clients 128 procs
+max_latency=267.939 m
+
+3. With patch1 and patch2
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 9.570 54.588
+ Flush 2061354 0.666 15.102
+ Close 21604811 0.012 25.697
+ LockX 95770 0.007 1.424
+ Mkdir 384 0.008 0.053
+ Rename 1245411 0.096 12.263
+ ReadX 46103198 0.011 12.116
+ WriteX 14667988 7.375 60.069
+ Unlink 5938936 0.173 30.905
+ UnlockX 95770 0.005 4.147
+ FIND_FIRST 10306407 0.041 11.715
+ SET_FILE_INFORMATION 2395987 0.048 7.640
+ QUERY_FILE_INFORMATION 4672371 0.005 9.291
+ QUERY_PATH_INFORMATION 26656735 0.018 19.719
+ QUERY_FS_INFORMATION 4887940 0.010 7.654
+ NTCreateX 29410811 0.059 28.551
+
+Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.075 ms
+
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 27 +++++++++++++++++++++++----
+ drivers/md/md.h | 3 +++
+ 2 files changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -427,6 +427,7 @@ static void submit_flushes(struct work_s
+ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+
++ mddev->start_flush = ktime_get_boottime();
+ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
+ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+@@ -467,6 +468,7 @@ static void md_submit_flush_data(struct
+ * could wait for this and below md_handle_request could wait for those
+ * bios because of suspend check
+ */
++ mddev->last_flush = mddev->start_flush;
+ mddev->flush_bio = NULL;
+ wake_up(&mddev->sb_wait);
+
+@@ -481,15 +483,32 @@ static void md_submit_flush_data(struct
+
+ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
++ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+ wait_event_lock_irq(mddev->sb_wait,
+- !mddev->flush_bio,
++ !mddev->flush_bio ||
++ ktime_after(mddev->last_flush, start),
+ mddev->lock);
+- mddev->flush_bio = bio;
++ if (!ktime_after(mddev->last_flush, start)) {
++ WARN_ON(mddev->flush_bio);
++ mddev->flush_bio = bio;
++ bio = NULL;
++ }
+ spin_unlock_irq(&mddev->lock);
+
+- INIT_WORK(&mddev->flush_work, submit_flushes);
+- queue_work(md_wq, &mddev->flush_work);
++ if (!bio) {
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++ } else {
++ /* flush was performed for some other bio while we waited. */
++ if (bio->bi_iter.bi_size == 0)
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ mddev->pers->make_request(mddev, bio);
++ }
++ }
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -463,6 +463,9 @@ struct mddev {
+ */
+ struct bio *flush_bio;
+ atomic_t flush_pending;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
+ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
--- /dev/null
+From 107927fa597c99eaeee4f51865ca0956ec71b6a2 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:30 -0500
+Subject: media: imx: Clear fwnode link struct for each endpoint iteration
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream.
+
+In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must
+be cleared for each endpoint iteration, otherwise if the remote port
+has no "reg" property, link.remote_port will not be reset to zero.
+This was discovered on the i.MX53 SMD board, since the OV5642 connects
+directly to ipu1_csi0 and has a single source port with no "reg"
+property.
+
+Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-of.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -145,15 +145,18 @@ int imx_media_create_csi_of_links(struct
+ struct v4l2_subdev *csi)
+ {
+ struct device_node *csi_np = csi->dev->of_node;
+- struct fwnode_handle *fwnode, *csi_ep;
+- struct v4l2_fwnode_link link;
+ struct device_node *ep;
+- int ret;
+-
+- link.local_node = of_fwnode_handle(csi_np);
+- link.local_port = CSI_SINK_PAD;
+
+ for_each_child_of_node(csi_np, ep) {
++ struct fwnode_handle *fwnode, *csi_ep;
++ struct v4l2_fwnode_link link;
++ int ret;
++
++ memset(&link, 0, sizeof(link));
++
++ link.local_node = of_fwnode_handle(csi_np);
++ link.local_port = CSI_SINK_PAD;
++
+ csi_ep = of_fwnode_handle(ep);
+
+ fwnode = fwnode_graph_get_remote_endpoint(csi_ep);
--- /dev/null
+From 904371f90b2c0c749a5ab75478c129a4682ac3d8 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:29 -0500
+Subject: media: imx: csi: Allow unknown nearest upstream entities
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream.
+
+On i.MX6, the nearest upstream entity to the CSI can only be the
+CSI video muxes or the Synopsys DW MIPI CSI-2 receiver.
+
+However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver.
+So allow for the nearest upstream entity to the CSI to be something
+other than those.
+
+Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest
+upstream entity")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-csi.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -154,9 +154,10 @@ static inline bool requires_passthrough(
+ /*
+ * Parses the fwnode endpoint from the source pad of the entity
+ * connected to this CSI. This will either be the entity directly
+- * upstream from the CSI-2 receiver, or directly upstream from the
+- * video mux. The endpoint is needed to determine the bus type and
+- * bus config coming into the CSI.
++ * upstream from the CSI-2 receiver, directly upstream from the
++ * video mux, or directly upstream from the CSI itself. The endpoint
++ * is needed to determine the bus type and bus config coming into
++ * the CSI.
+ */
+ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_fwnode_endpoint *ep)
+@@ -172,7 +173,8 @@ static int csi_get_upstream_endpoint(str
+ if (!priv->src_sd)
+ return -EPIPE;
+
+- src = &priv->src_sd->entity;
++ sd = priv->src_sd;
++ src = &sd->entity;
+
+ if (src->function == MEDIA_ENT_F_VID_MUX) {
+ /*
+@@ -186,6 +188,14 @@ static int csi_get_upstream_endpoint(str
+ src = &sd->entity;
+ }
+
++ /*
++ * If the source is neither the video mux nor the CSI-2 receiver,
++ * get the source pad directly upstream from CSI itself.
++ */
++ if (src->function != MEDIA_ENT_F_VID_MUX &&
++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2)
++ src = &priv->sd.entity;
++
+ /* get source pad of entity directly upstream from src */
+ pad = imx_media_find_upstream_pad(priv->md, src, 0);
+ if (IS_ERR(pad))
--- /dev/null
+From dee747f88167124884a918855c1f438e2f7f39e2 Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:32 -0500
+Subject: media: imx: Don't register IPU subdevs/links if CSI port missing
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit dee747f88167124884a918855c1f438e2f7f39e2 upstream.
+
+The second IPU internal sub-devices were being registered and links
+to them created even when the second IPU is not present. This is wrong
+for i.MX6 S/DL and i.MX53 which have only a single IPU.
+
+Fixes: e130291212df5 ("[media] media: Add i.MX media core driver")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-media-dev.c | 7 --
+ drivers/staging/media/imx/imx-media-internal-sd.c | 22 +-------
+ drivers/staging/media/imx/imx-media-of.c | 58 ++++++++++++++--------
+ drivers/staging/media/imx/imx-media.h | 3 -
+ drivers/staging/media/imx/imx7-media-csi.c | 2
+ 5 files changed, 46 insertions(+), 46 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -477,13 +477,6 @@ static int imx_media_probe(struct platfo
+ goto cleanup;
+ }
+
+- ret = imx_media_add_ipu_internal_subdevs(imxmd);
+- if (ret) {
+- v4l2_err(&imxmd->v4l2_dev,
+- "add_ipu_internal_subdevs failed with %d\n", ret);
+- goto cleanup;
+- }
+-
+ ret = imx_media_dev_notifier_register(imxmd);
+ if (ret)
+ goto del_int;
+--- a/drivers/staging/media/imx/imx-media-internal-sd.c
++++ b/drivers/staging/media/imx/imx-media-internal-sd.c
+@@ -298,13 +298,14 @@ static int add_internal_subdev(struct im
+ }
+
+ /* adds the internal subdevs in one ipu */
+-static int add_ipu_internal_subdevs(struct imx_media_dev *imxmd, int ipu_id)
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd,
++ int ipu_id)
+ {
+ enum isd_enum i;
++ int ret;
+
+ for (i = 0; i < num_isd; i++) {
+ const struct internal_subdev *isd = &int_subdev[i];
+- int ret;
+
+ /*
+ * the CSIs are represented in the device-tree, so those
+@@ -322,25 +323,10 @@ static int add_ipu_internal_subdevs(stru
+ }
+
+ if (ret)
+- return ret;
++ goto remove;
+ }
+
+ return 0;
+-}
+-
+-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+-{
+- int ret;
+-
+- ret = add_ipu_internal_subdevs(imxmd, 0);
+- if (ret)
+- goto remove;
+-
+- ret = add_ipu_internal_subdevs(imxmd, 1);
+- if (ret)
+- goto remove;
+-
+- return 0;
+
+ remove:
+ imx_media_remove_ipu_internal_subdevs(imxmd);
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -23,36 +23,25 @@
+ int imx_media_of_add_csi(struct imx_media_dev *imxmd,
+ struct device_node *csi_np)
+ {
+- int ret;
+-
+ if (!of_device_is_available(csi_np)) {
+ dev_dbg(imxmd->md.dev, "%s: %pOFn not enabled\n", __func__,
+ csi_np);
+- /* unavailable is not an error */
+- return 0;
++ return -ENODEV;
+ }
+
+ /* add CSI fwnode to async notifier */
+- ret = imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np), NULL);
+- if (ret) {
+- if (ret == -EEXIST) {
+- /* already added, everything is fine */
+- return 0;
+- }
+-
+- /* other error, can't continue */
+- return ret;
+- }
+-
+- return 0;
++ return imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np),
++ NULL);
+ }
+ EXPORT_SYMBOL_GPL(imx_media_of_add_csi);
+
+ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd,
+ struct device_node *np)
+ {
++ bool ipu_found[2] = {false, false};
+ struct device_node *csi_np;
+ int i, ret;
++ u32 ipu_id;
+
+ for (i = 0; ; i++) {
+ csi_np = of_parse_phandle(np, "ports", i);
+@@ -60,12 +49,43 @@ int imx_media_add_of_subdevs(struct imx_
+ break;
+
+ ret = imx_media_of_add_csi(imxmd, csi_np);
+- of_node_put(csi_np);
+- if (ret)
+- return ret;
++ if (ret) {
++ /* unavailable or already added is not an error */
++ if (ret == -ENODEV || ret == -EEXIST) {
++ of_node_put(csi_np);
++ continue;
++ }
++
++ /* other error, can't continue */
++ goto err_out;
++ }
++
++ ret = of_alias_get_id(csi_np->parent, "ipu");
++ if (ret < 0)
++ goto err_out;
++ if (ret > 1) {
++ ret = -EINVAL;
++ goto err_out;
++ }
++
++ ipu_id = ret;
++
++ if (!ipu_found[ipu_id]) {
++ ret = imx_media_add_ipu_internal_subdevs(imxmd,
++ ipu_id);
++ if (ret)
++ goto err_out;
++ }
++
++ ipu_found[ipu_id] = true;
+ }
+
+ return 0;
++
++err_out:
++ imx_media_remove_ipu_internal_subdevs(imxmd);
++ of_node_put(csi_np);
++ return ret;
+ }
+
+ /*
+--- a/drivers/staging/media/imx/imx-media.h
++++ b/drivers/staging/media/imx/imx-media.h
+@@ -252,7 +252,8 @@ struct imx_media_fim *imx_media_fim_init
+ void imx_media_fim_free(struct imx_media_fim *fim);
+
+ /* imx-media-internal-sd.c */
+-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd);
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd,
++ int ipu_id);
+ int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *sd);
+ void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+--- a/drivers/staging/media/imx/imx7-media-csi.c
++++ b/drivers/staging/media/imx/imx7-media-csi.c
+@@ -1271,7 +1271,7 @@ static int imx7_csi_probe(struct platfor
+ platform_set_drvdata(pdev, &csi->sd);
+
+ ret = imx_media_of_add_csi(imxmd, node);
+- if (ret < 0)
++ if (ret < 0 && ret != -ENODEV && ret != -EEXIST)
+ goto cleanup;
+
+ ret = imx_media_dev_notifier_register(imxmd);
--- /dev/null
+From 085b26da62211cb77622008082adff56aefa771d Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:31 -0500
+Subject: media: imx: Rename functions that add IPU-internal subdevs
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+commit 085b26da62211cb77622008082adff56aefa771d upstream.
+
+For the functions that add and remove the internal IPU subdevice
+descriptors, rename them to make clear they are the subdevs internal
+to the IPU. Also rename the platform data structure for the internal
+IPU subdevices. No functional changes.
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/imx/imx-ic-common.c | 2 +-
+ drivers/staging/media/imx/imx-media-dev.c | 8 ++++----
+ drivers/staging/media/imx/imx-media-internal-sd.c | 12 ++++++------
+ drivers/staging/media/imx/imx-media-vdic.c | 2 +-
+ drivers/staging/media/imx/imx-media.h | 6 +++---
+ 5 files changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/staging/media/imx/imx-ic-common.c
++++ b/drivers/staging/media/imx/imx-ic-common.c
+@@ -26,7 +26,7 @@ static struct imx_ic_ops *ic_ops[IC_NUM_
+
+ static int imx_ic_probe(struct platform_device *pdev)
+ {
+- struct imx_media_internal_sd_platformdata *pdata;
++ struct imx_media_ipu_internal_sd_pdata *pdata;
+ struct imx_ic_priv *priv;
+ int ret;
+
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -477,10 +477,10 @@ static int imx_media_probe(struct platfo
+ goto cleanup;
+ }
+
+- ret = imx_media_add_internal_subdevs(imxmd);
++ ret = imx_media_add_ipu_internal_subdevs(imxmd);
+ if (ret) {
+ v4l2_err(&imxmd->v4l2_dev,
+- "add_internal_subdevs failed with %d\n", ret);
++ "add_ipu_internal_subdevs failed with %d\n", ret);
+ goto cleanup;
+ }
+
+@@ -491,7 +491,7 @@ static int imx_media_probe(struct platfo
+ return 0;
+
+ del_int:
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ cleanup:
+ v4l2_async_notifier_cleanup(&imxmd->notifier);
+ v4l2_device_unregister(&imxmd->v4l2_dev);
+@@ -508,7 +508,7 @@ static int imx_media_remove(struct platf
+ v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
+
+ v4l2_async_notifier_unregister(&imxmd->notifier);
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ v4l2_async_notifier_cleanup(&imxmd->notifier);
+ media_device_unregister(&imxmd->md);
+ v4l2_device_unregister(&imxmd->v4l2_dev);
+--- a/drivers/staging/media/imx/imx-media-internal-sd.c
++++ b/drivers/staging/media/imx/imx-media-internal-sd.c
+@@ -1,7 +1,7 @@
+ /*
+ * Media driver for Freescale i.MX5/6 SOC
+ *
+- * Adds the internal subdevices and the media links between them.
++ * Adds the IPU internal subdevices and the media links between them.
+ *
+ * Copyright (c) 2016 Mentor Graphics Inc.
+ *
+@@ -192,7 +192,7 @@ static struct v4l2_subdev *find_sink(str
+
+ /*
+ * retrieve IPU id from subdev name, note: can't get this from
+- * struct imx_media_internal_sd_platformdata because if src is
++ * struct imx_media_ipu_internal_sd_pdata because if src is
+ * a CSI, it has different struct ipu_client_platformdata which
+ * does not contain IPU id.
+ */
+@@ -270,7 +270,7 @@ static int add_internal_subdev(struct im
+ const struct internal_subdev *isd,
+ int ipu_id)
+ {
+- struct imx_media_internal_sd_platformdata pdata;
++ struct imx_media_ipu_internal_sd_pdata pdata;
+ struct platform_device_info pdevinfo = {};
+ struct platform_device *pdev;
+
+@@ -328,7 +328,7 @@ static int add_ipu_internal_subdevs(stru
+ return 0;
+ }
+
+-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd)
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+ {
+ int ret;
+
+@@ -343,11 +343,11 @@ int imx_media_add_internal_subdevs(struc
+ return 0;
+
+ remove:
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ return ret;
+ }
+
+-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd)
++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+ {
+ struct imx_media_async_subdev *imxasd;
+ struct v4l2_async_subdev *asd;
+--- a/drivers/staging/media/imx/imx-media-vdic.c
++++ b/drivers/staging/media/imx/imx-media-vdic.c
+@@ -934,7 +934,7 @@ static const struct v4l2_subdev_internal
+
+ static int imx_vdic_probe(struct platform_device *pdev)
+ {
+- struct imx_media_internal_sd_platformdata *pdata;
++ struct imx_media_ipu_internal_sd_pdata *pdata;
+ struct vdic_priv *priv;
+ int ret;
+
+--- a/drivers/staging/media/imx/imx-media.h
++++ b/drivers/staging/media/imx/imx-media.h
+@@ -115,7 +115,7 @@ struct imx_media_pad_vdev {
+ struct list_head list;
+ };
+
+-struct imx_media_internal_sd_platformdata {
++struct imx_media_ipu_internal_sd_pdata {
+ char sd_name[V4L2_SUBDEV_NAME_SIZE];
+ u32 grp_id;
+ int ipu_id;
+@@ -252,10 +252,10 @@ struct imx_media_fim *imx_media_fim_init
+ void imx_media_fim_free(struct imx_media_fim *fim);
+
+ /* imx-media-internal-sd.c */
+-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd);
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+ int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *sd);
+-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd);
++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+
+ /* imx-media-of.c */
+ int imx_media_add_of_subdevs(struct imx_media_dev *dev,
--- /dev/null
+From 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Sun, 24 Mar 2019 20:21:12 -0400
+Subject: media: ov6650: Fix sensor possibly not detected on probe
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream.
+
+After removal of clock_start() from before soc_camera_init_i2c() in
+soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
+I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
+driver could no longer probe the sensor successfully because its clock
+was no longer turned on in advance. The issue was initially worked
+around by adding that missing clock_start() equivalent to OMAP1 camera
+interface driver - the only user of this sensor - but a propoer fix
+should be rather implemented in the sensor driver code itself.
+
+Fix the issue by inserting a delay between the clock is turned on and
+the sensor I2C registers are read for the first time.
+
+Tested on Amstrad Delta with now out of tree but still locally
+maintained omap1_camera host driver.
+
+Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk")
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -814,6 +814,8 @@ static int ov6650_video_probe(struct i2c
+ if (ret < 0)
+ return ret;
+
++ msleep(20);
++
+ /*
+ * check and show product ID and manufacturer ID
+ */
--- /dev/null
+From 63604a143fe168094fbbccba56f6e3241683e399 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 13 Mar 2019 17:18:07 -0400
+Subject: media: seco-cec: fix building with RC_CORE=m
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 63604a143fe168094fbbccba56f6e3241683e399 upstream.
+
+I previously added an RC_CORE dependency here, but missed the corner
+case of CONFIG_VIDEO_SECO_CEC=y with CONFIG_RC_CORE=m, which still
+causes a link error:
+
+drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_probe':
+seco-cec.c:(.text+0x1b8): undefined reference to `devm_rc_allocate_device'
+seco-cec.c:(.text+0x2e8): undefined reference to `devm_rc_register_device'
+drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_irq_handler':
+seco-cec.c:(.text+0xa2c): undefined reference to `rc_keydown'
+
+Refine the dependency to disallow building the RC subdriver in this case.
+This is the same logic we apply in other drivers like it.
+
+Fixes: f27dd0ad6885 ("media: seco-cec: fix RC_CORE dependency")
+
+Cc: <stable@vger.kernel.org> # 5.1
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -649,7 +649,7 @@ config VIDEO_SECO_CEC
+ config VIDEO_SECO_RC
+ bool "SECO Boards IR RC5 support"
+ depends on VIDEO_SECO_CEC
+- depends on RC_CORE
++ depends on RC_CORE=y || RC_CORE = VIDEO_SECO_CEC
+ help
+ If you say yes here you will get support for the
+ SECO Boards Consumer-IR in seco-cec driver.
--- /dev/null
+From 440868661f36071886ed360d91de83bd67c73b4f Mon Sep 17 00:00:00 2001
+From: Phong Tran <tranmanphong@gmail.com>
+Date: Tue, 30 Apr 2019 21:56:24 +0700
+Subject: of: fix clang -Wunsequenced for be32_to_cpu()
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+commit 440868661f36071886ed360d91de83bd67c73b4f upstream.
+
+Now, make the loop explicit to avoid clang warning.
+
+./include/linux/of.h:238:37: warning: multiple unsequenced modifications
+to 'cell' [-Wunsequenced]
+ r = (r << 32) | be32_to_cpu(*(cell++));
+ ^~
+./include/linux/byteorder/generic.h:95:21: note: expanded from macro
+'be32_to_cpu'
+ ^
+./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded
+from macro '__be32_to_cpu'
+ ^
+./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32'
+ ___constant_swab32(x) : \
+ ^
+./include/uapi/linux/swab.h:18:12: note: expanded from macro
+'___constant_swab32'
+ (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \
+ ^
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/460
+Suggested-by: David Laight <David.Laight@ACULAB.COM>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable@vger.kernel.org
+[robh: fix up whitespace]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/of.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -234,8 +234,8 @@ extern struct device_node *of_find_all_n
+ static inline u64 of_read_number(const __be32 *cell, int size)
+ {
+ u64 r = 0;
+- while (size--)
+- r = (r << 32) | be32_to_cpu(*(cell++));
++ for (; size--; cell++)
++ r = (r << 32) | be32_to_cpu(*cell);
+ return r;
+ }
+
--- /dev/null
+From 8149069db81853570a665f5e5648c0e526dc0e43 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 17 Apr 2019 17:41:23 +0800
+Subject: p54: drop device reference count if fails to enable device
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream.
+
+The function p54p_probe takes an extra reference count of the PCI
+device. However, the extra reference count is not dropped when it fails
+to enable the PCI device. This patch fixes the bug.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intersil/p54/p54pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pd
+ err = pci_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Cannot enable new PCI device\n");
+- return err;
++ goto err_put;
+ }
+
+ mem_addr = pci_resource_start(pdev, 0);
+@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pd
+ pci_release_regions(pdev);
+ err_disable_dev:
+ pci_disable_device(pdev);
++err_put:
+ pci_dev_put(pdev);
+ return err;
+ }
--- /dev/null
+From 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 27 Apr 2019 23:57:49 +0200
+Subject: parisc: Add memory barrier to asm pdc and sync instructions
+
+From: Helge Deller <deller@gmx.de>
+
+commit 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 upstream.
+
+Add compiler memory barriers to ensure the compiler doesn't reorder memory
+operations around these instructions.
+
+Cc: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/cache.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -56,10 +56,10 @@ void parisc_setup_cache_timing(void);
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define asm_io_sync() asm volatile("sync" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+- ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :: )
++ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :::"memory")
+
+ #endif /* ! __ASSEMBLY__ */
+
--- /dev/null
+From 44224bdb99150ad17cf394973b25736cb92c246a Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sun, 21 Apr 2019 19:47:17 -0400
+Subject: parisc: Add memory clobber to TLB purges
+
+From: John David Anglin <dave.anglin@bell.net>
+
+commit 44224bdb99150ad17cf394973b25736cb92c246a upstream.
+
+The pdtlb and pitlb instructions are strongly ordered. The asms invoking
+these instructions should be compiler memory barriers to ensure the
+compiler doesn't reorder memory operations around these instructions.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+CC: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/cache.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -44,14 +44,14 @@ void parisc_setup_cache_timing(void);
+
+ #define pdtlb(addr) asm volatile("pdtlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pitlb(addr) asm volatile("pitlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+ ALTERNATIVE(ALT_COND_NO_SPLIT_TLB, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pdtlb_kernel(addr) asm volatile("pdtlb 0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
--- /dev/null
+From d19a12906e5e558c0f6b6cfece7b7caf1012ef95 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 1 May 2019 14:59:58 +0200
+Subject: parisc: Allow live-patching of __meminit functions
+
+From: Helge Deller <deller@gmx.de>
+
+commit d19a12906e5e558c0f6b6cfece7b7caf1012ef95 upstream.
+
+When making the text sections writeable with set_kernel_text_rw(1),
+include all text sections including those in the __init section.
+Otherwise functions marked with __meminit will stay read-only.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -495,7 +495,7 @@ static void __init map_pages(unsigned lo
+
+ void __init set_kernel_text_rw(int enable_read_write)
+ {
+- unsigned long start = (unsigned long) _text;
++ unsigned long start = (unsigned long) __init_begin;
+ unsigned long end = (unsigned long) &data_start;
+
+ map_pages(start, __pa(start), end-start,
--- /dev/null
+From 3e1120f4b57bc12437048494ab56648edaa5b57d Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 6 Apr 2019 16:45:14 +0200
+Subject: parisc: Export running_on_qemu symbol for modules
+
+From: Helge Deller <deller@gmx.de>
+
+commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/kernel/process.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *t
+ */
+
+ int running_on_qemu __read_mostly;
++EXPORT_SYMBOL(running_on_qemu);
+
+ void __cpuidle arch_cpu_idle_dead(void)
+ {
--- /dev/null
+From 1829dda0e87f4462782ca81be474c7890efe31ce Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:54:34 +0200
+Subject: parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code
+
+From: Helge Deller <deller@gmx.de>
+
+commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream.
+
+LEVEL is a very common word, and now after many years it suddenly
+clashed with another LEVEL define in the DRBD code.
+Rename it to PA_ASM_LEVEL instead.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/asm/assembly.h | 6 +++---
+ arch/parisc/kernel/head.S | 4 ++--
+ arch/parisc/kernel/syscall.S | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/parisc/include/asm/assembly.h
++++ b/arch/parisc/include/asm/assembly.h
+@@ -61,14 +61,14 @@
+ #define LDCW ldcw,co
+ #define BL b,l
+ # ifdef CONFIG_64BIT
+-# define LEVEL 2.0w
++# define PA_ASM_LEVEL 2.0w
+ # else
+-# define LEVEL 2.0
++# define PA_ASM_LEVEL 2.0
+ # endif
+ #else
+ #define LDCW ldcw
+ #define BL bl
+-#define LEVEL 1.1
++#define PA_ASM_LEVEL 1.1
+ #endif
+
+ #ifdef __ASSEMBLY__
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ __INITDATA
+ ENTRY(boot_args)
+@@ -258,7 +258,7 @@ stext_pdc_ret:
+ ldo R%PA(fault_vector_11)(%r10),%r10
+
+ $is_pa20:
+- .level LEVEL /* restore 1.1 || 2.0w */
++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */
+ #endif /*!CONFIG_64BIT*/
+ load32 PA(fault_vector_20),%r10
+
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -48,7 +48,7 @@ registers).
+ */
+ #define KILL_INSN break 0,0
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ .text
+
--- /dev/null
+From b438749044356dd1329c45e9b5a9377b6ea13eb2 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 2 Apr 2019 12:17:08 +0200
+Subject: parisc: Skip registering LED when running in QEMU
+
+From: Helge Deller <deller@gmx.de>
+
+commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream.
+
+No need to spend CPU cycles when we run on QEMU.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/parisc/led.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -568,6 +568,9 @@ int __init register_led_driver(int model
+ break;
+
+ case DISPLAY_MODEL_LASI:
++ /* Skip to register LED in QEMU */
++ if (running_on_qemu)
++ return 1;
+ LED_DATA_REG = data_reg;
+ led_func_ptr = led_LASI_driver;
+ printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG);
--- /dev/null
+From bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:55:02 +0200
+Subject: parisc: Use PA_ASM_LEVEL in boot code
+
+From: Helge Deller <deller@gmx.de>
+
+commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream.
+
+The LEVEL define clashed with the DRBD code.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/boot/compressed/head.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/boot/compressed/head.S
++++ b/arch/parisc/boot/compressed/head.S
+@@ -22,7 +22,7 @@
+ __HEAD
+
+ ENTRY(startup)
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ #define PSW_W_SM 0x200
+ #define PSW_W_BIT 36
+@@ -63,7 +63,7 @@ $bss_loop:
+ load32 BOOTADDR(decompress_kernel),%r3
+
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ ssm PSW_W_SM, %r0 /* set W-bit */
+ depdi 0, 31, 32, %r3
+ #endif
+@@ -72,7 +72,7 @@ $bss_loop:
+
+ startup_continue:
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ rsm PSW_W_SM, %r0 /* clear W-bit */
+ #endif
+
--- /dev/null
+From e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 19 Feb 2019 14:53:49 +0000
+Subject: phy: ti-pipe3: fix missing bit-wise or operator when assigning val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream.
+
+There seems to be a missing bit-wise or operator when setting val,
+fix this by adding it in.
+
+Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/ti/phy-ti-pipe3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/ti/phy-ti-pipe3.c
++++ b/drivers/phy/ti/phy-ti-pipe3.c
+@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY);
+ val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV);
+- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
+ ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val);
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES);
--- /dev/null
+From 35a196bef449b5824033865b963ed9a43fb8c730 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 19 Apr 2019 14:55:12 -0400
+Subject: proc: prevent changes to overridden credentials
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream.
+
+Prevent userspace from changing the the /proc/PID/attr values if the
+task's credentials are currently overriden. This not only makes sense
+conceptually, it also prevents some really bizarre error cases caused
+when trying to commit credentials to a task with overridden
+credentials.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: "chengjian (D)" <cj.chengjian@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Acked-by: James Morris <james.morris@microsoft.com>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2540,6 +2540,11 @@ static ssize_t proc_pid_attr_write(struc
+ rcu_read_unlock();
+ return -EACCES;
+ }
++ /* Prevent changes to overridden credentials. */
++ if (current_cred() != current_real_cred()) {
++ rcu_read_unlock();
++ return -EBUSY;
++ }
+ rcu_read_unlock();
+
+ if (count > PAGE_SIZE)
--- /dev/null
+From 70b464918e5331e488058870fcc6821d54c4e541 Mon Sep 17 00:00:00 2001
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+Date: Mon, 18 Mar 2019 16:17:57 +0000
+Subject: regulator: core: fix error path for regulator_set_voltage_unlocked
+
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+
+commit 70b464918e5331e488058870fcc6821d54c4e541 upstream.
+
+During several error paths in the function
+regulator_set_voltage_unlocked() the value of 'ret' can take on negative
+error values. However, in calls that go through the 'goto out' statement,
+this return value is lost and return 0 is used instead, indicating a
+'pass'.
+
+There are several cases where this function should legitimately return a
+fail instead of a pass: one such case includes constraints check during
+voltage selection in the call to regulator_check_voltage(), which can
+have -EINVAL for the case when an unsupported voltage is incorrectly
+requested. In that case, -22 is expected as the return value, not 0.
+
+Fixes: 9243a195be7a ("regulator: core: Change voltage setting path")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Steve Twiss <stwiss.opensource@diasemi.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3322,15 +3322,12 @@ static int regulator_set_voltage_unlocke
+
+ /* for not coupled regulators this will just set the voltage */
+ ret = regulator_balance_voltage(rdev, state);
+- if (ret < 0)
+- goto out2;
++ if (ret < 0) {
++ voltage->min_uV = old_min_uV;
++ voltage->max_uV = old_max_uV;
++ }
+
+ out:
+- return 0;
+-out2:
+- voltage->min_uV = old_min_uV;
+- voltage->max_uV = old_max_uV;
+-
+ return ret;
+ }
+
--- /dev/null
+From 4bc034d35377196c854236133b07730a777c4aba Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:16 -0700
+Subject: Revert "MD: fix lock contention for flush bios"
+
+From: NeilBrown <neilb@suse.com>
+
+commit 4bc034d35377196c854236133b07730a777c4aba upstream.
+
+This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85.
+
+This patch has two problems.
+
+1/ it make multiple calls to submit_bio() from inside a make_request_fn.
+ The bios thus submitted will be queued on current->bio_list and not
+ submitted immediately. As the bios are allocated from a mempool,
+ this can theoretically result in a deadlock - all the pool of requests
+ could be in various ->bio_list queues and a subsequent mempool_alloc
+ could block waiting for one of them to be released.
+
+2/ It aims to handle a case when there are many concurrent flush requests.
+ It handles this by submitting many requests in parallel - all of which
+ are identical and so most of which do nothing useful.
+ It would be more efficient to just send one lower-level request, but
+ allow that to satisfy multiple upper-level requests.
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 159 +++++++++++++++++++-------------------------------------
+ drivers/md/md.h | 22 ++-----
+ 2 files changed, 62 insertions(+), 119 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev
+ mddev->sync_speed_max : sysctl_speed_limit_max;
+ }
+
+-static void * flush_info_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_info), gfp_flags);
+-}
+-static void flush_info_free(void *flush_info, void *data)
+-{
+- kfree(flush_info);
+-}
+-
+-static void * flush_bio_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_bio), gfp_flags);
+-}
+-static void flush_bio_free(void *flush_bio, void *data)
+-{
+- kfree(flush_bio);
+-}
+-
+ static struct ctl_table_header *raid_table_header;
+
+ static struct ctl_table raid_table[] = {
+@@ -423,54 +405,30 @@ static int md_congested(void *data, int
+ /*
+ * Generic flush handling for md
+ */
+-static void submit_flushes(struct work_struct *ws)
+-{
+- struct flush_info *fi = container_of(ws, struct flush_info, flush_work);
+- struct mddev *mddev = fi->mddev;
+- struct bio *bio = fi->bio;
+-
+- bio->bi_opf &= ~REQ_PREFLUSH;
+- md_handle_request(mddev, bio);
+-
+- mempool_free(fi, mddev->flush_pool);
+-}
+
+-static void md_end_flush(struct bio *fbio)
++static void md_end_flush(struct bio *bio)
+ {
+- struct flush_bio *fb = fbio->bi_private;
+- struct md_rdev *rdev = fb->rdev;
+- struct flush_info *fi = fb->fi;
+- struct bio *bio = fi->bio;
+- struct mddev *mddev = fi->mddev;
++ struct md_rdev *rdev = bio->bi_private;
++ struct mddev *mddev = rdev->mddev;
+
+ rdev_dec_pending(rdev, mddev);
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++ if (atomic_dec_and_test(&mddev->flush_pending)) {
++ /* The pre-request flush has finished */
++ queue_work(md_wq, &mddev->flush_work);
+ }
+-
+- mempool_free(fb, mddev->flush_bio_pool);
+- bio_put(fbio);
++ bio_put(bio);
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++static void md_submit_flush_data(struct work_struct *ws);
++
++static void submit_flushes(struct work_struct *ws)
+ {
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+- struct flush_info *fi;
+-
+- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO);
+-
+- fi->bio = bio;
+- fi->mddev = mddev;
+- atomic_set(&fi->flush_pending, 1);
+
++ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
++ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+ rdev_for_each_rcu(rdev, mddev)
+ if (rdev->raid_disk >= 0 &&
+@@ -480,40 +438,59 @@ void md_flush_request(struct mddev *mdde
+ * we reclaim rcu_read_lock
+ */
+ struct bio *bi;
+- struct flush_bio *fb;
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+-
+- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO);
+- fb->fi = fi;
+- fb->rdev = rdev;
+-
+ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+- bio_set_dev(bi, rdev->bdev);
+ bi->bi_end_io = md_end_flush;
+- bi->bi_private = fb;
++ bi->bi_private = rdev;
++ bio_set_dev(bi, rdev->bdev);
+ bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+-
+- atomic_inc(&fi->flush_pending);
++ atomic_inc(&mddev->flush_pending);
+ submit_bio(bi);
+-
+ rcu_read_lock();
+ rdev_dec_pending(rdev, mddev);
+ }
+ rcu_read_unlock();
++ if (atomic_dec_and_test(&mddev->flush_pending))
++ queue_work(md_wq, &mddev->flush_work);
++}
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++static void md_submit_flush_data(struct work_struct *ws)
++{
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
++ struct bio *bio = mddev->flush_bio;
++
++ /*
++ * must reset flush_bio before calling into md_handle_request to avoid a
++ * deadlock, because other bios passed md_handle_request suspend check
++ * could wait for this and below md_handle_request could wait for those
++ * bios because of suspend check
++ */
++ mddev->flush_bio = NULL;
++ wake_up(&mddev->sb_wait);
++
++ if (bio->bi_iter.bi_size == 0) {
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ } else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ md_handle_request(mddev, bio);
+ }
+ }
++
++void md_flush_request(struct mddev *mddev, struct bio *bio)
++{
++ spin_lock_irq(&mddev->lock);
++ wait_event_lock_irq(mddev->sb_wait,
++ !mddev->flush_bio,
++ mddev->lock);
++ mddev->flush_bio = bio;
++ spin_unlock_irq(&mddev->lock);
++
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++}
+ EXPORT_SYMBOL(md_flush_request);
+
+ static inline struct mddev *mddev_get(struct mddev *mddev)
+@@ -560,6 +537,7 @@ void mddev_init(struct mddev *mddev)
+ atomic_set(&mddev->openers, 0);
+ atomic_set(&mddev->active_io, 0);
+ spin_lock_init(&mddev->lock);
++ atomic_set(&mddev->flush_pending, 0);
+ init_waitqueue_head(&mddev->sb_wait);
+ init_waitqueue_head(&mddev->recovery_wait);
+ mddev->reshape_position = MaxSector;
+@@ -5511,22 +5489,6 @@ int md_run(struct mddev *mddev)
+ if (err)
+ return err;
+ }
+- if (mddev->flush_pool == NULL) {
+- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc,
+- flush_info_free, mddev);
+- if (!mddev->flush_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+- if (mddev->flush_bio_pool == NULL) {
+- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc,
+- flush_bio_free, mddev);
+- if (!mddev->flush_bio_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+
+ spin_lock(&pers_lock);
+ pers = find_pers(mddev->level, mddev->clevel);
+@@ -5686,11 +5648,8 @@ int md_run(struct mddev *mddev)
+ return 0;
+
+ abort:
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+-
++ bioset_exit(&mddev->bio_set);
++ bioset_exit(&mddev->sync_set);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(md_run);
+@@ -5894,14 +5853,6 @@ static void __md_stop(struct mddev *mdde
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+- if (mddev->flush_bio_pool) {
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- }
+- if (mddev->flush_pool) {
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+- }
+ }
+
+ void md_stop(struct mddev *mddev)
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -252,19 +252,6 @@ enum mddev_sb_flags {
+ MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */
+ };
+
+-#define NR_FLUSH_INFOS 8
+-#define NR_FLUSH_BIOS 64
+-struct flush_info {
+- struct bio *bio;
+- struct mddev *mddev;
+- struct work_struct flush_work;
+- atomic_t flush_pending;
+-};
+-struct flush_bio {
+- struct flush_info *fi;
+- struct md_rdev *rdev;
+-};
+-
+ struct mddev {
+ void *private;
+ struct md_personality *pers;
+@@ -470,8 +457,13 @@ struct mddev {
+ * metadata and bitmap writes
+ */
+
+- mempool_t *flush_pool;
+- mempool_t *flush_bio_pool;
++ /* Generic flush handling.
++ * The last to finish preflush schedules a worker to submit
++ * the rest of the request (without the REQ_PREFLUSH flag).
++ */
++ struct bio *flush_bio;
++ atomic_t flush_pending;
++ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+ struct md_cluster_info *cluster_info;
net-mlx5e-additional-check-for-flow-destination-comparison.patch
net-mlx5-imply-mlxfw-in-mlx5_core.patch
net-mlx5e-fix-ethtool-rxfh-commands-when-config_mlx5_en_rxnfc-is-disabled.patch
+blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch
+regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch
+parisc-export-running_on_qemu-symbol-for-modules.patch
+parisc-add-memory-clobber-to-tlb-purges.patch
+parisc-skip-registering-led-when-running-in-qemu.patch
+parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch
+parisc-allow-live-patching-of-__meminit-functions.patch
+parisc-use-pa_asm_level-in-boot-code.patch
+parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch
+stm-class-fix-channel-free-in-stm-output-free-path.patch
+stm-class-fix-channel-bitmap-on-32-bit-systems.patch
+brd-re-enable-__gfp_highmem-in-brd_insert_page.patch
+proc-prevent-changes-to-overridden-credentials.patch
+revert-md-fix-lock-contention-for-flush-bios.patch
+md-batch-flush-requests.patch
+md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch
+md-add-a-missing-endianness-conversion-in-check_sb_changes.patch
+dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch
+intel_th-msu-fix-single-mode-with-iommu.patch
+p54-drop-device-reference-count-if-fails-to-enable-device.patch
+of-fix-clang-wunsequenced-for-be32_to_cpu.patch
+brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch
+cifs-fix-credits-leak-for-smb1-oplock-breaks.patch
+cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch
+phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch
+media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch
+media-seco-cec-fix-building-with-rc_core-m.patch
+media-imx-csi-allow-unknown-nearest-upstream-entities.patch
+media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch
+media-imx-rename-functions-that-add-ipu-internal-subdevs.patch
+media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch
--- /dev/null
+From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:35 +0300
+Subject: stm class: Fix channel bitmap on 32-bit systems
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream.
+
+Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace
+Module devices") naively calculates the channel bitmap size in 64-bit
+chunks regardless of the size of underlying unsigned long, making the
+bitmap half as big on a 32-bit system. This leads to an out of bounds
+access with the upper half of the bitmap.
+
+Fix this by using BITS_TO_LONGS. While at it, convert to using
+struct_size() for the total size calculation of the master struct.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Reported-by: Mulu He <muluhe@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig
+ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
+ {
+ struct stp_master *master;
+- size_t size;
+
+- size = ALIGN(stm->data->sw_nchannels, 8) / 8;
+- size += sizeof(struct stp_master);
+- master = kzalloc(size, GFP_ATOMIC);
++ master = kzalloc(struct_size(master, chan_map,
++ BITS_TO_LONGS(stm->data->sw_nchannels)),
++ GFP_ATOMIC);
+ if (!master)
+ return -ENOMEM;
+
--- /dev/null
+From ee496da4c3915de3232b5f5cd20e21ae3e46fe8d Mon Sep 17 00:00:00 2001
+From: Tingwei Zhang <tingwei@codeaurora.org>
+Date: Wed, 17 Apr 2019 10:35:34 +0300
+Subject: stm class: Fix channel free in stm output free path
+
+From: Tingwei Zhang <tingwei@codeaurora.org>
+
+commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream.
+
+Number of free masters is not set correctly in stm
+free path. Fix this by properly adding the number
+of output channels before setting them to 0 in
+stm_output_disclaim().
+
+Currently it is equivalent to doing nothing since
+master->nr_free is incremented by 0.
+
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Signed-off-by: Tingwei Zhang <tingwei@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *s
+ bitmap_release_region(&master->chan_map[0], output->channel,
+ ilog2(output->nr_chans));
+
+- output->nr_chans = 0;
+ master->nr_free += output->nr_chans;
++ output->nr_chans = 0;
+ }
+
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
