diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2017-03-13 09:56:26 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2017-03-13 09:56:26 -0400 |
| commit | 543fcca01ae724bf3e27aa69e98282afc8e41645 (patch) | |
| tree | 84c9c490e59aca9d58303d2098468ebd7e485d44 /4.9.14/1013_linux-4.9.14.patch | |
| parent | grsecurity-3.1-4.9.13-201703052141 (diff) | |
| download | hardened-patchset-543fcca01ae724bf3e27aa69e98282afc8e41645.tar.gz hardened-patchset-543fcca01ae724bf3e27aa69e98282afc8e41645.tar.bz2 hardened-patchset-543fcca01ae724bf3e27aa69e98282afc8e41645.zip | |
grsecurity-3.1-4.9.14-20170312124520170312
Diffstat (limited to '4.9.14/1013_linux-4.9.14.patch')
| -rw-r--r-- | 4.9.14/1013_linux-4.9.14.patch | 6768 |
1 files changed, 6768 insertions, 0 deletions
diff --git a/4.9.14/1013_linux-4.9.14.patch b/4.9.14/1013_linux-4.9.14.patch new file mode 100644 index 0000000..5d8c119 --- /dev/null +++ b/4.9.14/1013_linux-4.9.14.patch @@ -0,0 +1,6768 @@ +diff --git a/Makefile b/Makefile +index 14dc275..5e7706e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 13 ++SUBLEVEL = 14 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts +index 0b9a59d..30fac04 100644 +--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts +@@ -148,6 +148,8 @@ + uart1: serial@f8020000 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_uart1_default>; ++ atmel,use-dma-rx; ++ atmel,use-dma-tx; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index ed7fce2..44d1171 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -110,6 +110,8 @@ + }; + + usart3: serial@fc00c000 { ++ atmel,use-dma-rx; ++ atmel,use-dma-tx; + status = "okay"; + }; + +diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h +index 74a44727..a58bbaa 100644 +--- a/arch/arm/include/asm/kvm_mmu.h ++++ b/arch/arm/include/asm/kvm_mmu.h +@@ -150,18 +150,12 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, + * and iterate over the range. + */ + +- bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached; +- + VM_BUG_ON(size & ~PAGE_MASK); + +- if (!need_flush && !icache_is_pipt()) +- goto vipt_cache; +- + while (size) { + void *va = kmap_atomic_pfn(pfn); + +- if (need_flush) +- kvm_flush_dcache_to_poc(va, PAGE_SIZE); ++ kvm_flush_dcache_to_poc(va, PAGE_SIZE); + + if (icache_is_pipt()) + __cpuc_coherent_user_range((unsigned long)va, +@@ -173,7 +167,6 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, + kunmap_atomic(va); + } + +-vipt_cache: + if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) { + /* any kind of VIPT cache */ + __flush_icache_all(); +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index 6f72fe8..6d22017 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -241,8 +241,7 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, + { + void *va = page_address(pfn_to_page(pfn)); + +- if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached) +- kvm_flush_dcache_to_poc(va, size); ++ kvm_flush_dcache_to_poc(va, size); + + if (!icache_is_aliasing()) { /* PIPT */ + flush_icache_range((unsigned long)va, +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index c02504e..3a129d4 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -653,15 +653,15 @@ static u64 __raw_read_system_reg(u32 sys_id) + case SYS_ID_ISAR2_EL1: return read_cpuid(ID_ISAR2_EL1); + case SYS_ID_ISAR3_EL1: return read_cpuid(ID_ISAR3_EL1); + case SYS_ID_ISAR4_EL1: return read_cpuid(ID_ISAR4_EL1); +- case SYS_ID_ISAR5_EL1: return read_cpuid(ID_ISAR4_EL1); ++ case SYS_ID_ISAR5_EL1: return read_cpuid(ID_ISAR5_EL1); + case SYS_MVFR0_EL1: return read_cpuid(MVFR0_EL1); + case SYS_MVFR1_EL1: return read_cpuid(MVFR1_EL1); + case SYS_MVFR2_EL1: return read_cpuid(MVFR2_EL1); + + case SYS_ID_AA64PFR0_EL1: return read_cpuid(ID_AA64PFR0_EL1); +- case SYS_ID_AA64PFR1_EL1: return read_cpuid(ID_AA64PFR0_EL1); ++ case SYS_ID_AA64PFR1_EL1: return read_cpuid(ID_AA64PFR1_EL1); + case SYS_ID_AA64DFR0_EL1: return read_cpuid(ID_AA64DFR0_EL1); +- case SYS_ID_AA64DFR1_EL1: return read_cpuid(ID_AA64DFR0_EL1); ++ case SYS_ID_AA64DFR1_EL1: return read_cpuid(ID_AA64DFR1_EL1); + case SYS_ID_AA64MMFR0_EL1: return read_cpuid(ID_AA64MMFR0_EL1); + case SYS_ID_AA64MMFR1_EL1: return read_cpuid(ID_AA64MMFR1_EL1); + case SYS_ID_AA64MMFR2_EL1: return read_cpuid(ID_AA64MMFR2_EL1); +diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c +index 02265a5..b5bf46c 100644 +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -352,6 +352,13 @@ static int __swiotlb_dma_supported(struct device *hwdev, u64 mask) + return 1; + } + ++static int __swiotlb_dma_mapping_error(struct device *hwdev, dma_addr_t addr) ++{ ++ if (swiotlb) ++ return swiotlb_dma_mapping_error(hwdev, addr); ++ return 0; ++} ++ + static struct dma_map_ops swiotlb_dma_ops = { + .alloc = __dma_alloc, + .free = __dma_free, +@@ -366,7 +373,7 @@ static struct dma_map_ops swiotlb_dma_ops = { + .sync_sg_for_cpu = __swiotlb_sync_sg_for_cpu, + .sync_sg_for_device = __swiotlb_sync_sg_for_device, + .dma_supported = __swiotlb_dma_supported, +- .mapping_error = swiotlb_dma_mapping_error, ++ .mapping_error = __swiotlb_dma_mapping_error, + }; + + static int __init atomic_pool_init(void) +diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c +index 52caa75..e2f50d6 100644 +--- a/arch/mips/bcm47xx/buttons.c ++++ b/arch/mips/bcm47xx/buttons.c +@@ -17,6 +17,12 @@ + .active_low = 1, \ + } + ++#define BCM47XX_GPIO_KEY_H(_gpio, _code) \ ++ { \ ++ .code = _code, \ ++ .gpio = _gpio, \ ++ } ++ + /* Asus */ + + static const struct gpio_keys_button +@@ -79,8 +85,8 @@ bcm47xx_buttons_asus_wl500gpv2[] __initconst = { + + static const struct gpio_keys_button + bcm47xx_buttons_asus_wl500w[] __initconst = { +- BCM47XX_GPIO_KEY(6, KEY_RESTART), +- BCM47XX_GPIO_KEY(7, KEY_WPS_BUTTON), ++ BCM47XX_GPIO_KEY_H(6, KEY_RESTART), ++ BCM47XX_GPIO_KEY_H(7, KEY_WPS_BUTTON), + }; + + static const struct gpio_keys_button +diff --git a/arch/mips/cavium-octeon/octeon-memcpy.S b/arch/mips/cavium-octeon/octeon-memcpy.S +index 64e08df..8b70041 100644 +--- a/arch/mips/cavium-octeon/octeon-memcpy.S ++++ b/arch/mips/cavium-octeon/octeon-memcpy.S +@@ -208,18 +208,18 @@ EXC( STORE t2, UNIT(6)(dst), s_exc_p10u) + ADD src, src, 16*NBYTES + EXC( STORE t3, UNIT(7)(dst), s_exc_p9u) + ADD dst, dst, 16*NBYTES +-EXC( LOAD t0, UNIT(-8)(src), l_exc_copy) +-EXC( LOAD t1, UNIT(-7)(src), l_exc_copy) +-EXC( LOAD t2, UNIT(-6)(src), l_exc_copy) +-EXC( LOAD t3, UNIT(-5)(src), l_exc_copy) ++EXC( LOAD t0, UNIT(-8)(src), l_exc_copy_rewind16) ++EXC( LOAD t1, UNIT(-7)(src), l_exc_copy_rewind16) ++EXC( LOAD t2, UNIT(-6)(src), l_exc_copy_rewind16) ++EXC( LOAD t3, UNIT(-5)(src), l_exc_copy_rewind16) + EXC( STORE t0, UNIT(-8)(dst), s_exc_p8u) + EXC( STORE t1, UNIT(-7)(dst), s_exc_p7u) + EXC( STORE t2, UNIT(-6)(dst), s_exc_p6u) + EXC( STORE t3, UNIT(-5)(dst), s_exc_p5u) +-EXC( LOAD t0, UNIT(-4)(src), l_exc_copy) +-EXC( LOAD t1, UNIT(-3)(src), l_exc_copy) +-EXC( LOAD t2, UNIT(-2)(src), l_exc_copy) +-EXC( LOAD t3, UNIT(-1)(src), l_exc_copy) ++EXC( LOAD t0, UNIT(-4)(src), l_exc_copy_rewind16) ++EXC( LOAD t1, UNIT(-3)(src), l_exc_copy_rewind16) ++EXC( LOAD t2, UNIT(-2)(src), l_exc_copy_rewind16) ++EXC( LOAD t3, UNIT(-1)(src), l_exc_copy_rewind16) + EXC( STORE t0, UNIT(-4)(dst), s_exc_p4u) + EXC( STORE t1, UNIT(-3)(dst), s_exc_p3u) + EXC( STORE t2, UNIT(-2)(dst), s_exc_p2u) +@@ -383,6 +383,10 @@ done: + nop + END(memcpy) + ++l_exc_copy_rewind16: ++ /* Rewind src and dst by 16*NBYTES for l_exc_copy */ ++ SUB src, src, 16*NBYTES ++ SUB dst, dst, 16*NBYTES + l_exc_copy: + /* + * Copy bytes from src until faulting load address (or until a +diff --git a/arch/mips/include/asm/checksum.h b/arch/mips/include/asm/checksum.h +index bce1ce5..0e23197 100644 +--- a/arch/mips/include/asm/checksum.h ++++ b/arch/mips/include/asm/checksum.h +@@ -186,7 +186,9 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, + " daddu %0, %4 \n" + " dsll32 $1, %0, 0 \n" + " daddu %0, $1 \n" ++ " sltu $1, %0, $1 \n" + " dsra32 %0, %0, 0 \n" ++ " addu %0, $1 \n" + #endif + " .set pop" + : "=r" (sum) +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 9514e5f..1652f36 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -195,11 +195,9 @@ struct mips_frame_info { + #define J_TARGET(pc,target) \ + (((unsigned long)(pc) & 0xf0000000) | ((target) << 2)) + +-static inline int is_ra_save_ins(union mips_instruction *ip) ++static inline int is_ra_save_ins(union mips_instruction *ip, int *poff) + { + #ifdef CONFIG_CPU_MICROMIPS +- union mips_instruction mmi; +- + /* + * swsp ra,offset + * swm16 reglist,offset(sp) +@@ -209,29 +207,71 @@ static inline int is_ra_save_ins(union mips_instruction *ip) + * + * microMIPS is way more fun... + */ +- if (mm_insn_16bit(ip->halfword[0])) { +- mmi.word = (ip->halfword[0] << 16); +- return (mmi.mm16_r5_format.opcode == mm_swsp16_op && +- mmi.mm16_r5_format.rt == 31) || +- (mmi.mm16_m_format.opcode == mm_pool16c_op && +- mmi.mm16_m_format.func == mm_swm16_op); ++ if (mm_insn_16bit(ip->halfword[1])) { ++ switch (ip->mm16_r5_format.opcode) { ++ case mm_swsp16_op: ++ if (ip->mm16_r5_format.rt != 31) ++ return 0; ++ ++ *poff = ip->mm16_r5_format.simmediate; ++ *poff = (*poff << 2) / sizeof(ulong); ++ return 1; ++ ++ case mm_pool16c_op: ++ switch (ip->mm16_m_format.func) { ++ case mm_swm16_op: ++ *poff = ip->mm16_m_format.imm; ++ *poff += 1 + ip->mm16_m_format.rlist; ++ *poff = (*poff << 2) / sizeof(ulong); ++ return 1; ++ ++ default: ++ return 0; ++ } ++ ++ default: ++ return 0; ++ } + } +- else { +- mmi.halfword[0] = ip->halfword[1]; +- mmi.halfword[1] = ip->halfword[0]; +- return (mmi.mm_m_format.opcode == mm_pool32b_op && +- mmi.mm_m_format.rd > 9 && +- mmi.mm_m_format.base == 29 && +- mmi.mm_m_format.func == mm_swm32_func) || +- (mmi.i_format.opcode == mm_sw32_op && +- mmi.i_format.rs == 29 && +- mmi.i_format.rt == 31); ++ ++ switch (ip->i_format.opcode) { ++ case mm_sw32_op: ++ if (ip->i_format.rs != 29) ++ return 0; ++ if (ip->i_format.rt != 31) ++ return 0; ++ ++ *poff = ip->i_format.simmediate / sizeof(ulong); ++ return 1; ++ ++ case mm_pool32b_op: ++ switch (ip->mm_m_format.func) { ++ case mm_swm32_func: ++ if (ip->mm_m_format.rd < 0x10) ++ return 0; ++ if (ip->mm_m_format.base != 29) ++ return 0; ++ ++ *poff = ip->mm_m_format.simmediate; ++ *poff += (ip->mm_m_format.rd & 0xf) * sizeof(u32); ++ *poff /= sizeof(ulong); ++ return 1; ++ default: ++ return 0; ++ } ++ ++ default: ++ return 0; + } + #else + /* sw / sd $ra, offset($sp) */ +- return (ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && +- ip->i_format.rs == 29 && +- ip->i_format.rt == 31; ++ if ((ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && ++ ip->i_format.rs == 29 && ip->i_format.rt == 31) { ++ *poff = ip->i_format.simmediate / sizeof(ulong); ++ return 1; ++ } ++ ++ return 0; + #endif + } + +@@ -246,13 +286,16 @@ static inline int is_jump_ins(union mips_instruction *ip) + * + * microMIPS is kind of more fun... + */ +- union mips_instruction mmi; +- +- mmi.word = (ip->halfword[0] << 16); ++ if (mm_insn_16bit(ip->halfword[1])) { ++ if ((ip->mm16_r5_format.opcode == mm_pool16c_op && ++ (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op)) ++ return 1; ++ return 0; ++ } + +- if ((mmi.mm16_r5_format.opcode == mm_pool16c_op && +- (mmi.mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) || +- ip->j_format.opcode == mm_jal32_op) ++ if (ip->j_format.opcode == mm_j32_op) ++ return 1; ++ if (ip->j_format.opcode == mm_jal32_op) + return 1; + if (ip->r_format.opcode != mm_pool32a_op || + ip->r_format.func != mm_pool32axf_op) +@@ -280,15 +323,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip) + * + * microMIPS is not more fun... + */ +- if (mm_insn_16bit(ip->halfword[0])) { +- union mips_instruction mmi; +- +- mmi.word = (ip->halfword[0] << 16); +- return (mmi.mm16_r3_format.opcode == mm_pool16d_op && +- mmi.mm16_r3_format.simmediate && mm_addiusp_func) || +- (mmi.mm16_r5_format.opcode == mm_pool16d_op && +- mmi.mm16_r5_format.rt == 29); ++ if (mm_insn_16bit(ip->halfword[1])) { ++ return (ip->mm16_r3_format.opcode == mm_pool16d_op && ++ ip->mm16_r3_format.simmediate && mm_addiusp_func) || ++ (ip->mm16_r5_format.opcode == mm_pool16d_op && ++ ip->mm16_r5_format.rt == 29); + } ++ + return ip->mm_i_format.opcode == mm_addiu32_op && + ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29; + #else +@@ -303,30 +344,36 @@ static inline int is_sp_move_ins(union mips_instruction *ip) + + static int get_frame_info(struct mips_frame_info *info) + { +-#ifdef CONFIG_CPU_MICROMIPS +- union mips_instruction *ip = (void *) (((char *) info->func) - 1); +-#else +- union mips_instruction *ip = info->func; +-#endif +- unsigned max_insns = info->func_size / sizeof(union mips_instruction); +- unsigned i; ++ bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); ++ union mips_instruction insn, *ip, *ip_end; ++ const unsigned int max_insns = 128; ++ unsigned int i; + + info->pc_offset = -1; + info->frame_size = 0; + ++ ip = (void *)msk_isa16_mode((ulong)info->func); + if (!ip) + goto err; + +- if (max_insns == 0) +- max_insns = 128U; /* unknown function size */ +- max_insns = min(128U, max_insns); ++ ip_end = (void *)ip + info->func_size; + +- for (i = 0; i < max_insns; i++, ip++) { ++ for (i = 0; i < max_insns && ip < ip_end; i++, ip++) { ++ if (is_mmips && mm_insn_16bit(ip->halfword[0])) { ++ insn.halfword[0] = 0; ++ insn.halfword[1] = ip->halfword[0]; ++ } else if (is_mmips) { ++ insn.halfword[0] = ip->halfword[1]; ++ insn.halfword[1] = ip->halfword[0]; ++ } else { ++ insn.word = ip->word; ++ } + +- if (is_jump_ins(ip)) ++ if (is_jump_ins(&insn)) + break; ++ + if (!info->frame_size) { +- if (is_sp_move_ins(ip)) ++ if (is_sp_move_ins(&insn)) + { + #ifdef CONFIG_CPU_MICROMIPS + if (mm_insn_16bit(ip->halfword[0])) +@@ -349,11 +396,9 @@ static int get_frame_info(struct mips_frame_info *info) + } + continue; + } +- if (info->pc_offset == -1 && is_ra_save_ins(ip)) { +- info->pc_offset = +- ip->i_format.simmediate / sizeof(long); ++ if (info->pc_offset == -1 && ++ is_ra_save_ins(&insn, &info->pc_offset)) + break; +- } + } + if (info->frame_size && info->pc_offset >= 0) /* nested */ + return 0; +diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c +index 236193b..9a61671 100644 +--- a/arch/mips/lantiq/xway/sysctrl.c ++++ b/arch/mips/lantiq/xway/sysctrl.c +@@ -545,7 +545,7 @@ void __init ltq_soc_init(void) + clkdev_add_pmu("1a800000.pcie", "msi", 1, 1, PMU1_PCIE2_MSI); + clkdev_add_pmu("1a800000.pcie", "pdi", 1, 1, PMU1_PCIE2_PDI); + clkdev_add_pmu("1a800000.pcie", "ctl", 1, 1, PMU1_PCIE2_CTL); +- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | PMU_PPE_DP); ++ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | PMU_PPE_DP); + clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); + } else if (of_machine_is_compatible("lantiq,ar10")) { +@@ -553,7 +553,7 @@ void __init ltq_soc_init(void) + ltq_ar10_fpi_hz(), ltq_ar10_pp32_hz()); + clkdev_add_pmu("1e101000.usb", "ctl", 1, 0, PMU_USB0); + clkdev_add_pmu("1e106000.usb", "ctl", 1, 0, PMU_USB1); +- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | ++ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | + PMU_PPE_DP | PMU_PPE_TC); + clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); + clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); +@@ -575,11 +575,11 @@ void __init ltq_soc_init(void) + clkdev_add_pmu(NULL, "ahb", 1, 0, PMU_AHBM | PMU_AHBS); + + clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); +- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, ++ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, + PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM | + PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 | + PMU_PPE_QSB | PMU_PPE_TOP); +- clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); ++ clkdev_add_pmu("1f203000.rcu", "gphy", 0, 0, PMU_GPHY); + clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); + clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); +diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c +index 026cb59..f293a97 100644 +--- a/arch/mips/mm/sc-ip22.c ++++ b/arch/mips/mm/sc-ip22.c +@@ -31,26 +31,40 @@ static inline void indy_sc_wipe(unsigned long first, unsigned long last) + unsigned long tmp; + + __asm__ __volatile__( +- ".set\tpush\t\t\t# indy_sc_wipe\n\t" +- ".set\tnoreorder\n\t" +- ".set\tmips3\n\t" +- ".set\tnoat\n\t" +- "mfc0\t%2, $12\n\t" +- "li\t$1, 0x80\t\t\t# Go 64 bit\n\t" +- "mtc0\t$1, $12\n\t" +- +- "dli\t$1, 0x9000000080000000\n\t" +- "or\t%0, $1\t\t\t# first line to flush\n\t" +- "or\t%1, $1\t\t\t# last line to flush\n\t" +- ".set\tat\n\t" +- +- "1:\tsw\t$0, 0(%0)\n\t" +- "bne\t%0, %1, 1b\n\t" +- " daddu\t%0, 32\n\t" +- +- "mtc0\t%2, $12\t\t\t# Back to 32 bit\n\t" +- "nop; nop; nop; nop;\n\t" +- ".set\tpop" ++ " .set push # indy_sc_wipe \n" ++ " .set noreorder \n" ++ " .set mips3 \n" ++ " .set noat \n" ++ " mfc0 %2, $12 \n" ++ " li $1, 0x80 # Go 64 bit \n" ++ " mtc0 $1, $12 \n" ++ " \n" ++ " # \n" ++ " # Open code a dli $1, 0x9000000080000000 \n" ++ " # \n" ++ " # Required because binutils 2.25 will happily accept \n" ++ " # 64 bit instructions in .set mips3 mode but puke on \n" ++ " # 64 bit constants when generating 32 bit ELF \n" ++ " # \n" ++ " lui $1,0x9000 \n" ++ " dsll $1,$1,0x10 \n" ++ " ori $1,$1,0x8000 \n" ++ " dsll $1,$1,0x10 \n" ++ " \n" ++ " or %0, $1 # first line to flush \n" ++ " or %1, $1 # last line to flush \n" ++ " .set at \n" ++ " \n" ++ "1: sw $0, 0(%0) \n" ++ " bne %0, %1, 1b \n" ++ " daddu %0, 32 \n" ++ " \n" ++ " mtc0 %2, $12 # Back to 32 bit \n" ++ " nop # pipeline hazard \n" ++ " nop \n" ++ " nop \n" ++ " nop \n" ++ " .set pop \n" + : "=r" (first), "=r" (last), "=&r" (tmp) + : "0" (first), "1" (last)); + } +diff --git a/arch/mips/pic32/pic32mzda/Makefile b/arch/mips/pic32/pic32mzda/Makefile +index 4a4c272..c286496 100644 +--- a/arch/mips/pic32/pic32mzda/Makefile ++++ b/arch/mips/pic32/pic32mzda/Makefile +@@ -2,8 +2,7 @@ + # Joshua Henderson, <joshua.henderson@microchip.com> + # Copyright (C) 2015 Microchip Technology, Inc. All rights reserved. + # +-obj-y := init.o time.o config.o ++obj-y := config.o early_clk.o init.o time.o + + obj-$(CONFIG_EARLY_PRINTK) += early_console.o \ +- early_pin.o \ +- early_clk.o ++ early_pin.o +diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h +index a244e09..5d22b0b 100644 +--- a/arch/powerpc/include/asm/mmu.h ++++ b/arch/powerpc/include/asm/mmu.h +@@ -136,6 +136,7 @@ enum { + MMU_FTR_NO_SLBIE_B | MMU_FTR_16M_PAGE | MMU_FTR_TLBIEL | + MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_CI_LARGE_PAGE | + MMU_FTR_1T_SEGMENT | MMU_FTR_TLBIE_CROP_VA | ++ MMU_FTR_KERNEL_RO | + #ifdef CONFIG_PPC_RADIX_MMU + MMU_FTR_TYPE_RADIX | + #endif +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 37c027c..7803756 100644 +--- a/arch/powerpc/kernel/cpu_setup_power.S ++++ b/arch/powerpc/kernel/cpu_setup_power.S +@@ -100,6 +100,8 @@ _GLOBAL(__setup_cpu_power9) + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) + or r3, r3, r4 ++ LOAD_REG_IMMEDIATE(r4, LPCR_UPRT | LPCR_HR) ++ andc r3, r3, r4 + bl __init_LPCR + bl __init_HFSCR + bl __init_tlb_power9 +@@ -120,6 +122,8 @@ _GLOBAL(__restore_cpu_power9) + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) + or r3, r3, r4 ++ LOAD_REG_IMMEDIATE(r4, LPCR_UPRT | LPCR_HR) ++ andc r3, r3, r4 + bl __init_LPCR + bl __init_HFSCR + bl __init_tlb_power9 +diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c +index 03d089b..469d86d 100644 +--- a/arch/powerpc/kernel/hw_breakpoint.c ++++ b/arch/powerpc/kernel/hw_breakpoint.c +@@ -228,8 +228,10 @@ int hw_breakpoint_handler(struct die_args *args) + rcu_read_lock(); + + bp = __this_cpu_read(bp_per_reg); +- if (!bp) ++ if (!bp) { ++ rc = NOTIFY_DONE; + goto out; ++ } + info = counter_arch_bp(bp); + + /* +diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h +index 34684ad..b3b09b9 100644 +--- a/arch/x86/include/asm/pkeys.h ++++ b/arch/x86/include/asm/pkeys.h +@@ -46,6 +46,15 @@ extern int __arch_set_user_pkey_access(struct task_struct *tsk, int pkey, + static inline + bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) + { ++ /* ++ * "Allocated" pkeys are those that have been returned ++ * from pkey_alloc(). pkey 0 is special, and never ++ * returned from pkey_alloc(). ++ */ ++ if (pkey <= 0) ++ return false; ++ if (pkey >= arch_max_pkey()) ++ return false; + return mm_pkey_allocation_map(mm) & (1U << pkey); + } + +@@ -82,12 +91,6 @@ int mm_pkey_alloc(struct mm_struct *mm) + static inline + int mm_pkey_free(struct mm_struct *mm, int pkey) + { +- /* +- * pkey 0 is special, always allocated and can never +- * be freed. +- */ +- if (!pkey) +- return -EINVAL; + if (!mm_pkey_is_allocated(mm, pkey)) + return -EINVAL; + +diff --git a/crypto/testmgr.h b/crypto/testmgr.h +index e64a4ef..9033088 100644 +--- a/crypto/testmgr.h ++++ b/crypto/testmgr.h +@@ -22813,7 +22813,7 @@ static struct aead_testvec aes_ccm_enc_tv_template[] = { + "\x09\x75\x9a\x9b\x3c\x9b\x27\x39", + .klen = 32, + .iv = "\x03\xf9\xd9\x4e\x63\xb5\x3d\x9d" +- "\x43\xf6\x1e\x50", ++ "\x43\xf6\x1e\x50\0\0\0\0", + .assoc = "\x57\xf5\x6b\x8b\x57\x5c\x3d\x3b" + "\x13\x02\x01\x0c\x83\x4c\x96\x35" + "\x8e\xd6\x39\xcf\x7d\x14\x9b\x94" +diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c +index 2c1798e..3868823 100644 +--- a/drivers/bcma/main.c ++++ b/drivers/bcma/main.c +@@ -633,8 +633,11 @@ static int bcma_device_probe(struct device *dev) + drv); + int err = 0; + ++ get_device(dev); + if (adrv->probe) + err = adrv->probe(core); ++ if (err) ++ put_device(dev); + + return err; + } +@@ -647,6 +650,7 @@ static int bcma_device_remove(struct device *dev) + + if (adrv->remove) + adrv->remove(core); ++ put_device(dev); + + return 0; + } +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 4af8187..24d6cef 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1097,9 +1097,12 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) + return -EINVAL; + ++ /* I/O need to be drained during transfer transition */ ++ blk_mq_freeze_queue(lo->lo_queue); ++ + err = loop_release_xfer(lo); + if (err) +- return err; ++ goto exit; + + if (info->lo_encrypt_type) { + unsigned int type = info->lo_encrypt_type; +@@ -1114,12 +1117,14 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + + err = loop_init_xfer(lo, xfer, info); + if (err) +- return err; ++ goto exit; + + if (lo->lo_offset != info->lo_offset || + lo->lo_sizelimit != info->lo_sizelimit) +- if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) +- return -EFBIG; ++ if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) { ++ err = -EFBIG; ++ goto exit; ++ } + + loop_config_discard(lo); + +@@ -1137,13 +1142,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + (info->lo_flags & LO_FLAGS_AUTOCLEAR)) + lo->lo_flags ^= LO_FLAGS_AUTOCLEAR; + +- if ((info->lo_flags & LO_FLAGS_PARTSCAN) && +- !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { +- lo->lo_flags |= LO_FLAGS_PARTSCAN; +- lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; +- loop_reread_partitions(lo, lo->lo_device); +- } +- + lo->lo_encrypt_key_size = info->lo_encrypt_key_size; + lo->lo_init[0] = info->lo_init[0]; + lo->lo_init[1] = info->lo_init[1]; +@@ -1156,7 +1154,17 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + /* update dio if lo_offset or transfer is changed */ + __loop_update_dio(lo, lo->use_dio); + +- return 0; ++ exit: ++ blk_mq_unfreeze_queue(lo->lo_queue); ++ ++ if (!err && (info->lo_flags & LO_FLAGS_PARTSCAN) && ++ !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { ++ lo->lo_flags |= LO_FLAGS_PARTSCAN; ++ lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; ++ loop_reread_partitions(lo, lo->lo_device); ++ } ++ ++ return err; + } + + static int +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index eaf5730..8022bea 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -421,7 +421,7 @@ static int __init init_tis(void) + acpi_bus_unregister_driver(&tis_acpi_driver); + err_acpi: + #endif +- platform_device_unregister(force_pdev); ++ platform_driver_unregister(&tis_drv); + err_platform: + if (force_pdev) + platform_device_unregister(force_pdev); +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 712592c..7309c08 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -130,7 +130,7 @@ static void devfreq_set_freq_table(struct devfreq *devfreq) + * @devfreq: the devfreq instance + * @freq: the update target frequency + */ +-static int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) ++int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) + { + int lev, prev_lev, ret = 0; + unsigned long cur_time; +@@ -166,6 +166,7 @@ static int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) + devfreq->last_stat_updated = cur_time; + return ret; + } ++EXPORT_SYMBOL(devfreq_update_status); + + /** + * find_devfreq_governor() - find devfreq governor from name +@@ -939,6 +940,9 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr, + if (df->governor == governor) { + ret = 0; + goto out; ++ } else if (df->governor->immutable || governor->immutable) { ++ ret = -EINVAL; ++ goto out; + } + + if (df->governor) { +@@ -968,13 +972,33 @@ static ssize_t available_governors_show(struct device *d, + struct device_attribute *attr, + char *buf) + { +- struct devfreq_governor *tmp_governor; ++ struct devfreq *df = to_devfreq(d); + ssize_t count = 0; + + mutex_lock(&devfreq_list_lock); +- list_for_each_entry(tmp_governor, &devfreq_governor_list, node) +- count += scnprintf(&buf[count], (PAGE_SIZE - count - 2), +- "%s ", tmp_governor->name); ++ ++ /* ++ * The devfreq with immutable governor (e.g., passive) shows ++ * only own governor. ++ */ ++ if (df->governor->immutable) { ++ count = scnprintf(&buf[count], DEVFREQ_NAME_LEN, ++ "%s ", df->governor_name); ++ /* ++ * The devfreq device shows the registered governor except for ++ * immutable governors such as passive governor . ++ */ ++ } else { ++ struct devfreq_governor *governor; ++ ++ list_for_each_entry(governor, &devfreq_governor_list, node) { ++ if (governor->immutable) ++ continue; ++ count += scnprintf(&buf[count], (PAGE_SIZE - count - 2), ++ "%s ", governor->name); ++ } ++ } ++ + mutex_unlock(&devfreq_list_lock); + + /* Truncate the trailing space */ +diff --git a/drivers/devfreq/governor.h b/drivers/devfreq/governor.h +index fad7d63..71576b8 100644 +--- a/drivers/devfreq/governor.h ++++ b/drivers/devfreq/governor.h +@@ -38,4 +38,6 @@ extern void devfreq_interval_update(struct devfreq *devfreq, + extern int devfreq_add_governor(struct devfreq_governor *governor); + extern int devfreq_remove_governor(struct devfreq_governor *governor); + ++extern int devfreq_update_status(struct devfreq *devfreq, unsigned long freq); ++ + #endif /* _GOVERNOR_H */ +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index 9ef46e2..5be96b2 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -112,6 +112,11 @@ static int update_devfreq_passive(struct devfreq *devfreq, unsigned long freq) + if (ret < 0) + goto out; + ++ if (devfreq->profile->freq_table ++ && (devfreq_update_status(devfreq, freq))) ++ dev_err(&devfreq->dev, ++ "Couldn't update frequency transition information.\n"); ++ + devfreq->previous_freq = freq; + + out: +@@ -179,6 +184,7 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq, + + static struct devfreq_governor devfreq_passive = { + .name = "passive", ++ .immutable = 1, + .get_target_freq = devfreq_passive_get_target_freq, + .event_handler = devfreq_passive_event_handler, + }; +diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c +index dd184b5..2846278 100644 +--- a/drivers/dma/ipu/ipu_irq.c ++++ b/drivers/dma/ipu/ipu_irq.c +@@ -272,7 +272,7 @@ static void ipu_irq_handler(struct irq_desc *desc) + u32 status; + int i, line; + +- for (i = IPU_IRQ_NR_FN_BANKS; i < IPU_IRQ_NR_BANKS; i++) { ++ for (i = 0; i < IPU_IRQ_NR_BANKS; i++) { + struct ipu_irq_bank *bank = irq_bank + i; + + raw_spin_lock(&bank_lock); +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 5fb4c6d..be34547 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -157,6 +157,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + } + + init_completion(&open_info->waitevent); ++ open_info->waiting_channel = newchannel; + + open_msg = (struct vmbus_channel_open_channel *)open_info->msg; + open_msg->header.msgtype = CHANNELMSG_OPENCHANNEL; +@@ -181,7 +182,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + + ret = vmbus_post_msg(open_msg, +- sizeof(struct vmbus_channel_open_channel)); ++ sizeof(struct vmbus_channel_open_channel), true); + + if (ret != 0) { + err = ret; +@@ -194,6 +195,11 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + ++ if (newchannel->rescind) { ++ err = -ENODEV; ++ goto error_free_gpadl; ++ } ++ + if (open_info->response.open_result.status) { + err = -EAGAIN; + goto error_free_gpadl; +@@ -233,7 +239,7 @@ int vmbus_send_tl_connect_request(const uuid_le *shv_guest_servie_id, + conn_msg.guest_endpoint_id = *shv_guest_servie_id; + conn_msg.host_service_id = *shv_host_servie_id; + +- return vmbus_post_msg(&conn_msg, sizeof(conn_msg)); ++ return vmbus_post_msg(&conn_msg, sizeof(conn_msg), true); + } + EXPORT_SYMBOL_GPL(vmbus_send_tl_connect_request); + +@@ -405,6 +411,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, + return ret; + + init_completion(&msginfo->waitevent); ++ msginfo->waiting_channel = channel; + + gpadlmsg = (struct vmbus_channel_gpadl_header *)msginfo->msg; + gpadlmsg->header.msgtype = CHANNELMSG_GPADL_HEADER; +@@ -419,7 +426,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + + ret = vmbus_post_msg(gpadlmsg, msginfo->msgsize - +- sizeof(*msginfo)); ++ sizeof(*msginfo), true); + if (ret != 0) + goto cleanup; + +@@ -433,14 +440,19 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, + gpadl_body->gpadl = next_gpadl_handle; + + ret = vmbus_post_msg(gpadl_body, +- submsginfo->msgsize - +- sizeof(*submsginfo)); ++ submsginfo->msgsize - sizeof(*submsginfo), ++ true); + if (ret != 0) + goto cleanup; + + } + wait_for_completion(&msginfo->waitevent); + ++ if (channel->rescind) { ++ ret = -ENODEV; ++ goto cleanup; ++ } ++ + /* At this point, we received the gpadl created msg */ + *gpadl_handle = gpadlmsg->gpadl; + +@@ -474,6 +486,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) + return -ENOMEM; + + init_completion(&info->waitevent); ++ info->waiting_channel = channel; + + msg = (struct vmbus_channel_gpadl_teardown *)info->msg; + +@@ -485,14 +498,19 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) + list_add_tail(&info->msglistentry, + &vmbus_connection.chn_msg_list); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); +- ret = vmbus_post_msg(msg, +- sizeof(struct vmbus_channel_gpadl_teardown)); ++ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_gpadl_teardown), ++ true); + + if (ret) + goto post_msg_err; + + wait_for_completion(&info->waitevent); + ++ if (channel->rescind) { ++ ret = -ENODEV; ++ goto post_msg_err; ++ } ++ + post_msg_err: + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&info->msglistentry); +@@ -557,7 +575,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel) + msg->header.msgtype = CHANNELMSG_CLOSECHANNEL; + msg->child_relid = channel->offermsg.child_relid; + +- ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel)); ++ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel), ++ true); + + if (ret) { + pr_err("Close failed: close post msg return is %d\n", ret); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index caf3418..cb95315 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -147,6 +147,29 @@ static const struct { + { HV_RDV_GUID }, + }; + ++/* ++ * The rescinded channel may be blocked waiting for a response from the host; ++ * take care of that. ++ */ ++static void vmbus_rescind_cleanup(struct vmbus_channel *channel) ++{ ++ struct vmbus_channel_msginfo *msginfo; ++ unsigned long flags; ++ ++ ++ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); ++ ++ list_for_each_entry(msginfo, &vmbus_connection.chn_msg_list, ++ msglistentry) { ++ ++ if (msginfo->waiting_channel == channel) { ++ complete(&msginfo->waitevent); ++ break; ++ } ++ } ++ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); ++} ++ + static bool is_unsupported_vmbus_devs(const uuid_le *guid) + { + int i; +@@ -321,7 +344,8 @@ static void vmbus_release_relid(u32 relid) + memset(&msg, 0, sizeof(struct vmbus_channel_relid_released)); + msg.child_relid = relid; + msg.header.msgtype = CHANNELMSG_RELID_RELEASED; +- vmbus_post_msg(&msg, sizeof(struct vmbus_channel_relid_released)); ++ vmbus_post_msg(&msg, sizeof(struct vmbus_channel_relid_released), ++ true); + } + + void hv_event_tasklet_disable(struct vmbus_channel *channel) +@@ -728,7 +752,8 @@ void vmbus_initiate_unload(bool crash) + init_completion(&vmbus_connection.unload_event); + memset(&hdr, 0, sizeof(struct vmbus_channel_message_header)); + hdr.msgtype = CHANNELMSG_UNLOAD; +- vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header)); ++ vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header), ++ !crash); + + /* + * vmbus_initiate_unload() is also called on crash and the crash can be +@@ -823,6 +848,8 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) + channel->rescind = true; + spin_unlock_irqrestore(&channel->lock, flags); + ++ vmbus_rescind_cleanup(channel); ++ + if (channel->device_obj) { + if (channel->chn_rescind_callback) { + channel->chn_rescind_callback(channel); +@@ -1116,8 +1143,8 @@ int vmbus_request_offers(void) + msg->msgtype = CHANNELMSG_REQUESTOFFERS; + + +- ret = vmbus_post_msg(msg, +- sizeof(struct vmbus_channel_message_header)); ++ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_message_header), ++ true); + if (ret != 0) { + pr_err("Unable to request offers - %d\n", ret); + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 78e6368..840b6db 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -110,7 +110,8 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); + + ret = vmbus_post_msg(msg, +- sizeof(struct vmbus_channel_initiate_contact)); ++ sizeof(struct vmbus_channel_initiate_contact), ++ true); + if (ret != 0) { + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&msginfo->msglistentry); +@@ -434,7 +435,7 @@ void vmbus_on_event(unsigned long data) + /* + * vmbus_post_msg - Send a msg on the vmbus's message connection + */ +-int vmbus_post_msg(void *buffer, size_t buflen) ++int vmbus_post_msg(void *buffer, size_t buflen, bool can_sleep) + { + union hv_connection_id conn_id; + int ret = 0; +@@ -449,7 +450,7 @@ int vmbus_post_msg(void *buffer, size_t buflen) + * insufficient resources. Retry the operation a couple of + * times before giving up. + */ +- while (retries < 20) { ++ while (retries < 100) { + ret = hv_post_message(conn_id, 1, buffer, buflen); + + switch (ret) { +@@ -472,8 +473,14 @@ int vmbus_post_msg(void *buffer, size_t buflen) + } + + retries++; +- udelay(usec); +- if (usec < 2048) ++ if (can_sleep && usec > 1000) ++ msleep(usec / 1000); ++ else if (usec < MAX_UDELAY_MS * 1000) ++ udelay(usec); ++ else ++ mdelay(usec / 1000); ++ ++ if (usec < 256000) + usec *= 2; + } + return ret; +diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c +index 60dbd6c..6e49a4d 100644 +--- a/drivers/hv/hv.c ++++ b/drivers/hv/hv.c +@@ -309,9 +309,10 @@ void hv_cleanup(bool crash) + + hypercall_msr.as_uint64 = 0; + wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64); +- if (!crash) ++ if (!crash) { + vfree(hv_context.tsc_page); +- hv_context.tsc_page = NULL; ++ hv_context.tsc_page = NULL; ++ } + } + #endif + } +@@ -411,7 +412,7 @@ int hv_synic_alloc(void) + goto err; + } + +- for_each_online_cpu(cpu) { ++ for_each_present_cpu(cpu) { + hv_context.event_dpc[cpu] = kmalloc(size, GFP_ATOMIC); + if (hv_context.event_dpc[cpu] == NULL) { + pr_err("Unable to allocate event dpc\n"); +@@ -457,6 +458,8 @@ int hv_synic_alloc(void) + pr_err("Unable to allocate post msg page\n"); + goto err; + } ++ ++ INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); + } + + return 0; +@@ -482,7 +485,7 @@ void hv_synic_free(void) + int cpu; + + kfree(hv_context.hv_numa_map); +- for_each_online_cpu(cpu) ++ for_each_present_cpu(cpu) + hv_synic_free_cpu(cpu); + } + +@@ -552,8 +555,6 @@ void hv_synic_init(void *arg) + rdmsrl(HV_X64_MSR_VP_INDEX, vp_index); + hv_context.vp_index[cpu] = (u32)vp_index; + +- INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); +- + /* + * Register the per-cpu clockevent source. + */ +diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c +index 8b2ba98..e47d8c9 100644 +--- a/drivers/hv/hv_fcopy.c ++++ b/drivers/hv/hv_fcopy.c +@@ -61,6 +61,7 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data); + static const char fcopy_devname[] = "vmbus/hv_fcopy"; + static u8 *recv_buffer; + static struct hvutil_transport *hvt; ++static struct completion release_event; + /* + * This state maintains the version number registered by the daemon. + */ +@@ -317,6 +318,7 @@ static void fcopy_on_reset(void) + + if (cancel_delayed_work_sync(&fcopy_timeout_work)) + fcopy_respond_to_host(HV_E_FAIL); ++ complete(&release_event); + } + + int hv_fcopy_init(struct hv_util_service *srv) +@@ -324,6 +326,7 @@ int hv_fcopy_init(struct hv_util_service *srv) + recv_buffer = srv->recv_buffer; + fcopy_transaction.recv_channel = srv->channel; + ++ init_completion(&release_event); + /* + * When this driver loads, the user level daemon that + * processes the host requests may not yet be running. +@@ -345,4 +348,5 @@ void hv_fcopy_deinit(void) + fcopy_transaction.state = HVUTIL_DEVICE_DYING; + cancel_delayed_work_sync(&fcopy_timeout_work); + hvutil_transport_destroy(hvt); ++ wait_for_completion(&release_event); + } +diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c +index 5e1fdc8..3abfc59 100644 +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -88,6 +88,7 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key); + static const char kvp_devname[] = "vmbus/hv_kvp"; + static u8 *recv_buffer; + static struct hvutil_transport *hvt; ++static struct completion release_event; + /* + * Register the kernel component with the user-level daemon. + * As part of this registration, pass the LIC version number. +@@ -716,6 +717,7 @@ static void kvp_on_reset(void) + if (cancel_delayed_work_sync(&kvp_timeout_work)) + kvp_respond_to_host(NULL, HV_E_FAIL); + kvp_transaction.state = HVUTIL_DEVICE_INIT; ++ complete(&release_event); + } + + int +@@ -724,6 +726,7 @@ hv_kvp_init(struct hv_util_service *srv) + recv_buffer = srv->recv_buffer; + kvp_transaction.recv_channel = srv->channel; + ++ init_completion(&release_event); + /* + * When this driver loads, the user level daemon that + * processes the host requests may not yet be running. +@@ -747,4 +750,5 @@ void hv_kvp_deinit(void) + cancel_delayed_work_sync(&kvp_timeout_work); + cancel_work_sync(&kvp_sendkey_work); + hvutil_transport_destroy(hvt); ++ wait_for_completion(&release_event); + } +diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c +index a670713..a76e3db 100644 +--- a/drivers/hv/hv_snapshot.c ++++ b/drivers/hv/hv_snapshot.c +@@ -66,6 +66,7 @@ static int dm_reg_value; + static const char vss_devname[] = "vmbus/hv_vss"; + static __u8 *recv_buffer; + static struct hvutil_transport *hvt; ++static struct completion release_event; + + static void vss_timeout_func(struct work_struct *dummy); + static void vss_handle_request(struct work_struct *dummy); +@@ -330,11 +331,13 @@ static void vss_on_reset(void) + if (cancel_delayed_work_sync(&vss_timeout_work)) + vss_respond_to_host(HV_E_FAIL); + vss_transaction.state = HVUTIL_DEVICE_INIT; ++ complete(&release_event); + } + + int + hv_vss_init(struct hv_util_service *srv) + { ++ init_completion(&release_event); + if (vmbus_proto_version < VERSION_WIN8_1) { + pr_warn("Integration service 'Backup (volume snapshot)'" + " not supported on this host version.\n"); +@@ -365,4 +368,5 @@ void hv_vss_deinit(void) + cancel_delayed_work_sync(&vss_timeout_work); + cancel_work_sync(&vss_handle_request_work); + hvutil_transport_destroy(hvt); ++ wait_for_completion(&release_event); + } +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 2b13f2a..8d7f865 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -683,7 +683,7 @@ void vmbus_free_channels(void); + int vmbus_connect(void); + void vmbus_disconnect(void); + +-int vmbus_post_msg(void *buffer, size_t buflen); ++int vmbus_post_msg(void *buffer, size_t buflen, bool can_sleep); + + void vmbus_on_event(unsigned long data); + void vmbus_on_msg_dpc(unsigned long data); +diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c +index 308dbda..e94ed1c 100644 +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -298,6 +298,9 @@ int hv_ringbuffer_write(struct vmbus_channel *channel, + unsigned long flags = 0; + struct hv_ring_buffer_info *outring_info = &channel->outbound; + ++ if (channel->rescind) ++ return -ENODEV; ++ + for (i = 0; i < kv_count; i++) + totalbytes_towrite += kv_list[i].iov_len; + +@@ -350,6 +353,10 @@ int hv_ringbuffer_write(struct vmbus_channel *channel, + spin_unlock_irqrestore(&outring_info->ring_lock, flags); + + hv_signal_on_write(old_write, channel, kick_q); ++ ++ if (channel->rescind) ++ return -ENODEV; ++ + return 0; + } + +diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c +index ad82cb2..4314616 100644 +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -1300,25 +1300,35 @@ static ssize_t set_pwm_enable(struct device *dev, struct device_attribute *attr, + it87_write_value(data, IT87_REG_FAN_MAIN_CTRL, + data->fan_main_ctrl); + } else { ++ u8 ctrl; ++ + /* No on/off mode, set maximum pwm value */ + data->pwm_duty[nr] = pwm_to_reg(data, 0xff); + it87_write_value(data, IT87_REG_PWM_DUTY[nr], + data->pwm_duty[nr]); + /* and set manual mode */ +- data->pwm_ctrl[nr] = has_newer_autopwm(data) ? +- data->pwm_temp_map[nr] : +- data->pwm_duty[nr]; +- it87_write_value(data, IT87_REG_PWM[nr], +- data->pwm_ctrl[nr]); ++ if (has_newer_autopwm(data)) { ++ ctrl = (data->pwm_ctrl[nr] & 0x7c) | ++ data->pwm_temp_map[nr]; ++ } else { ++ ctrl = data->pwm_duty[nr]; ++ } ++ data->pwm_ctrl[nr] = ctrl; ++ it87_write_value(data, IT87_REG_PWM[nr], ctrl); + } + } else { +- if (val == 1) /* Manual mode */ +- data->pwm_ctrl[nr] = has_newer_autopwm(data) ? +- data->pwm_temp_map[nr] : +- data->pwm_duty[nr]; +- else /* Automatic mode */ +- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr]; +- it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]); ++ u8 ctrl; ++ ++ if (has_newer_autopwm(data)) { ++ ctrl = (data->pwm_ctrl[nr] & 0x7c) | ++ data->pwm_temp_map[nr]; ++ if (val != 1) ++ ctrl |= 0x80; ++ } else { ++ ctrl = (val == 1 ? data->pwm_duty[nr] : 0x80); ++ } ++ data->pwm_ctrl[nr] = ctrl; ++ it87_write_value(data, IT87_REG_PWM[nr], ctrl); + + if (data->type != it8603 && nr < 3) { + /* set SmartGuardian mode */ +@@ -1344,6 +1354,7 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr, + return -EINVAL; + + mutex_lock(&data->update_lock); ++ it87_update_pwm_ctrl(data, nr); + if (has_newer_autopwm(data)) { + /* + * If we are in automatic mode, the PWM duty cycle register +@@ -1456,13 +1467,15 @@ static ssize_t set_pwm_temp_map(struct device *dev, + } + + mutex_lock(&data->update_lock); ++ it87_update_pwm_ctrl(data, nr); + data->pwm_temp_map[nr] = reg; + /* + * If we are in automatic mode, write the temp mapping immediately; + * otherwise, just store it for later use. + */ + if (data->pwm_ctrl[nr] & 0x80) { +- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr]; ++ data->pwm_ctrl[nr] = (data->pwm_ctrl[nr] & 0xfc) | ++ data->pwm_temp_map[nr]; + it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]); + } + mutex_unlock(&data->update_lock); +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index 49e0f1b..8e79056 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -356,7 +356,7 @@ static void stm_generic_unlink(struct stm_data *stm_data, + if (!drvdata || !drvdata->csdev) + return; + +- stm_disable(drvdata->csdev, NULL); ++ coresight_disable(drvdata->csdev); + } + + static phys_addr_t +diff --git a/drivers/iio/pressure/mpl115.c b/drivers/iio/pressure/mpl115.c +index 73f2f0c..8f2bce2 100644 +--- a/drivers/iio/pressure/mpl115.c ++++ b/drivers/iio/pressure/mpl115.c +@@ -137,6 +137,7 @@ static const struct iio_chan_spec mpl115_channels[] = { + { + .type = IIO_TEMP, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), ++ .info_mask_shared_by_type = + BIT(IIO_CHAN_INFO_OFFSET) | BIT(IIO_CHAN_INFO_SCALE), + }, + }; +diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c +index 6392d7b..eb87948 100644 +--- a/drivers/iio/pressure/mpl3115.c ++++ b/drivers/iio/pressure/mpl3115.c +@@ -182,7 +182,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + { + .type = IIO_PRESSURE, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), +- BIT(IIO_CHAN_INFO_SCALE), ++ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { + .sign = 'u', +@@ -195,7 +195,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + { + .type = IIO_TEMP, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), +- BIT(IIO_CHAN_INFO_SCALE), ++ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 1, + .scan_type = { + .sign = 's', +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index c25768c..f2d40c0 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3540,6 +3540,9 @@ static int cma_accept_iw(struct rdma_id_private *id_priv, + struct iw_cm_conn_param iw_param; + int ret; + ++ if (!conn_param) ++ return -EINVAL; ++ + ret = cma_modify_qp_rtr(id_priv, conn_param); + if (ret) + return ret; +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index d82637a..34be95e 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3325,13 +3325,14 @@ static int __init init_dmars(void) + iommu_identity_mapping |= IDENTMAP_GFX; + #endif + ++ check_tylersburg_isoch(); ++ + if (iommu_identity_mapping) { + ret = si_domain_init(hw_pass_through); + if (ret) + goto free_iommu; + } + +- check_tylersburg_isoch(); + + /* + * If we copied translations from a previous kernel in the kdump +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index 59b2c50..c817627 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -248,7 +248,7 @@ struct cache { + /* + * Fields for converting from sectors to blocks. + */ +- uint32_t sectors_per_block; ++ sector_t sectors_per_block; + int sectors_per_block_shift; + + spinlock_t lock; +@@ -3546,11 +3546,11 @@ static void cache_status(struct dm_target *ti, status_type_t type, + + residency = policy_residency(cache->policy); + +- DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ", ++ DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ", + (unsigned)DM_CACHE_METADATA_BLOCK_SIZE, + (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata), + (unsigned long long)nr_blocks_metadata, +- cache->sectors_per_block, ++ (unsigned long long)cache->sectors_per_block, + (unsigned long long) from_cblock(residency), + (unsigned long long) from_cblock(cache->cache_size), + (unsigned) atomic_read(&cache->stats.read_hit), +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index af2d79b..15daa36 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3621,6 +3621,8 @@ static int raid_preresume(struct dm_target *ti) + return r; + } + ++#define RESUME_STAY_FROZEN_FLAGS (CTR_FLAG_DELTA_DISKS | CTR_FLAG_DATA_OFFSET) ++ + static void raid_resume(struct dm_target *ti) + { + struct raid_set *rs = ti->private; +@@ -3638,7 +3640,15 @@ static void raid_resume(struct dm_target *ti) + mddev->ro = 0; + mddev->in_sync = 0; + +- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); ++ /* ++ * Keep the RAID set frozen if reshape/rebuild flags are set. ++ * The RAID set is unfrozen once the next table load/resume, ++ * which clears the reshape/rebuild flags, occurs. ++ * This ensures that the constructor for the inactive table ++ * retrieves an up-to-date reshape_position. ++ */ ++ if (!(rs->ctr_flags & RESUME_STAY_FROZEN_FLAGS)) ++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + + if (mddev->suspended) + mddev_resume(mddev); +diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c +index 6c25213..bdbb7e6 100644 +--- a/drivers/md/dm-round-robin.c ++++ b/drivers/md/dm-round-robin.c +@@ -17,8 +17,8 @@ + #include <linux/module.h> + + #define DM_MSG_PREFIX "multipath round-robin" +-#define RR_MIN_IO 1000 +-#define RR_VERSION "1.1.0" ++#define RR_MIN_IO 1 ++#define RR_VERSION "1.2.0" + + /*----------------------------------------------------------------- + * Path-handling code, paths are held in lists +@@ -47,44 +47,19 @@ struct selector { + struct list_head valid_paths; + struct list_head invalid_paths; + spinlock_t lock; +- struct dm_path * __percpu *current_path; +- struct percpu_counter repeat_count; + }; + +-static void set_percpu_current_path(struct selector *s, struct dm_path *path) +-{ +- int cpu; +- +- for_each_possible_cpu(cpu) +- *per_cpu_ptr(s->current_path, cpu) = path; +-} +- + static struct selector *alloc_selector(void) + { + struct selector *s = kmalloc(sizeof(*s), GFP_KERNEL); + +- if (!s) +- return NULL; +- +- INIT_LIST_HEAD(&s->valid_paths); +- INIT_LIST_HEAD(&s->invalid_paths); +- spin_lock_init(&s->lock); +- +- s->current_path = alloc_percpu(struct dm_path *); +- if (!s->current_path) +- goto out_current_path; +- set_percpu_current_path(s, NULL); +- +- if (percpu_counter_init(&s->repeat_count, 0, GFP_KERNEL)) +- goto out_repeat_count; ++ if (s) { ++ INIT_LIST_HEAD(&s->valid_paths); ++ INIT_LIST_HEAD(&s->invalid_paths); ++ spin_lock_init(&s->lock); ++ } + + return s; +- +-out_repeat_count: +- free_percpu(s->current_path); +-out_current_path: +- kfree(s); +- return NULL;; + } + + static int rr_create(struct path_selector *ps, unsigned argc, char **argv) +@@ -105,8 +80,6 @@ static void rr_destroy(struct path_selector *ps) + + free_paths(&s->valid_paths); + free_paths(&s->invalid_paths); +- free_percpu(s->current_path); +- percpu_counter_destroy(&s->repeat_count); + kfree(s); + ps->context = NULL; + } +@@ -157,6 +130,11 @@ static int rr_add_path(struct path_selector *ps, struct dm_path *path, + return -EINVAL; + } + ++ if (repeat_count > 1) { ++ DMWARN_LIMIT("repeat_count > 1 is deprecated, using 1 instead"); ++ repeat_count = 1; ++ } ++ + /* allocate the path */ + pi = kmalloc(sizeof(*pi), GFP_KERNEL); + if (!pi) { +@@ -183,9 +161,6 @@ static void rr_fail_path(struct path_selector *ps, struct dm_path *p) + struct path_info *pi = p->pscontext; + + spin_lock_irqsave(&s->lock, flags); +- if (p == *this_cpu_ptr(s->current_path)) +- set_percpu_current_path(s, NULL); +- + list_move(&pi->list, &s->invalid_paths); + spin_unlock_irqrestore(&s->lock, flags); + } +@@ -208,29 +183,15 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes) + unsigned long flags; + struct selector *s = ps->context; + struct path_info *pi = NULL; +- struct dm_path *current_path = NULL; +- +- local_irq_save(flags); +- current_path = *this_cpu_ptr(s->current_path); +- if (current_path) { +- percpu_counter_dec(&s->repeat_count); +- if (percpu_counter_read_positive(&s->repeat_count) > 0) { +- local_irq_restore(flags); +- return current_path; +- } +- } + +- spin_lock(&s->lock); ++ spin_lock_irqsave(&s->lock, flags); + if (!list_empty(&s->valid_paths)) { + pi = list_entry(s->valid_paths.next, struct path_info, list); + list_move_tail(&pi->list, &s->valid_paths); +- percpu_counter_set(&s->repeat_count, pi->repeat_count); +- set_percpu_current_path(s, pi->path); +- current_path = pi->path; + } + spin_unlock_irqrestore(&s->lock, flags); + +- return current_path; ++ return pi ? pi->path : NULL; + } + + static struct path_selector_type rr_ps = { +diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c +index 38b05f2..0250e7e 100644 +--- a/drivers/md/dm-stats.c ++++ b/drivers/md/dm-stats.c +@@ -175,6 +175,7 @@ static void dm_stat_free(struct rcu_head *head) + int cpu; + struct dm_stat *s = container_of(head, struct dm_stat, rcu_head); + ++ kfree(s->histogram_boundaries); + kfree(s->program_id); + kfree(s->aux_data); + for_each_possible_cpu(cpu) { +diff --git a/drivers/md/linear.c b/drivers/md/linear.c +index 86f5d43..b0c0aef 100644 +--- a/drivers/md/linear.c ++++ b/drivers/md/linear.c +@@ -52,18 +52,26 @@ static inline struct dev_info *which_dev(struct mddev *mddev, sector_t sector) + return conf->disks + lo; + } + ++/* ++ * In linear_congested() conf->raid_disks is used as a copy of ++ * mddev->raid_disks to iterate conf->disks[], because conf->raid_disks ++ * and conf->disks[] are created in linear_conf(), they are always ++ * consitent with each other, but mddev->raid_disks does not. ++ */ + static int linear_congested(struct mddev *mddev, int bits) + { + struct linear_conf *conf; + int i, ret = 0; + +- conf = mddev->private; ++ rcu_read_lock(); ++ conf = rcu_dereference(mddev->private); + +- for (i = 0; i < mddev->raid_disks && !ret ; i++) { ++ for (i = 0; i < conf->raid_disks && !ret ; i++) { + struct request_queue *q = bdev_get_queue(conf->disks[i].rdev->bdev); + ret |= bdi_congested(&q->backing_dev_info, bits); + } + ++ rcu_read_unlock(); + return ret; + } + +@@ -143,6 +151,19 @@ static struct linear_conf *linear_conf(struct mddev *mddev, int raid_disks) + conf->disks[i-1].end_sector + + conf->disks[i].rdev->sectors; + ++ /* ++ * conf->raid_disks is copy of mddev->raid_disks. The reason to ++ * keep a copy of mddev->raid_disks in struct linear_conf is, ++ * mddev->raid_disks may not be consistent with pointers number of ++ * conf->disks[] when it is updated in linear_add() and used to ++ * iterate old conf->disks[] earray in linear_congested(). ++ * Here conf->raid_disks is always consitent with number of ++ * pointers in conf->disks[] array, and mddev->private is updated ++ * with rcu_assign_pointer() in linear_addr(), such race can be ++ * avoided. ++ */ ++ conf->raid_disks = raid_disks; ++ + return conf; + + out: +@@ -195,15 +216,23 @@ static int linear_add(struct mddev *mddev, struct md_rdev *rdev) + if (!newconf) + return -ENOMEM; + ++ /* newconf->raid_disks already keeps a copy of * the increased ++ * value of mddev->raid_disks, WARN_ONCE() is just used to make ++ * sure of this. It is possible that oldconf is still referenced ++ * in linear_congested(), therefore kfree_rcu() is used to free ++ * oldconf until no one uses it anymore. ++ */ + mddev_suspend(mddev); +- oldconf = mddev->private; ++ oldconf = rcu_dereference(mddev->private); + mddev->raid_disks++; +- mddev->private = newconf; ++ WARN_ONCE(mddev->raid_disks != newconf->raid_disks, ++ "copied raid_disks doesn't match mddev->raid_disks"); ++ rcu_assign_pointer(mddev->private, newconf); + md_set_array_sectors(mddev, linear_size(mddev, 0, 0)); + set_capacity(mddev->gendisk, mddev->array_sectors); + mddev_resume(mddev); + revalidate_disk(mddev->gendisk); +- kfree(oldconf); ++ kfree_rcu(oldconf, rcu); + return 0; + } + +diff --git a/drivers/md/linear.h b/drivers/md/linear.h +index b685ddd..8d392e6 100644 +--- a/drivers/md/linear.h ++++ b/drivers/md/linear.h +@@ -10,6 +10,7 @@ struct linear_conf + { + struct rcu_head rcu; + sector_t array_sectors; ++ int raid_disks; /* a copy of mddev->raid_disks */ + struct dev_info disks[0]; + }; + #endif +diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c +index 95267c6..f6ebbb4 100644 +--- a/drivers/media/dvb-frontends/cxd2820r_core.c ++++ b/drivers/media/dvb-frontends/cxd2820r_core.c +@@ -615,6 +615,7 @@ static int cxd2820r_probe(struct i2c_client *client, + } + + priv->client[0] = client; ++ priv->fe.demodulator_priv = priv; + priv->i2c = client->adapter; + priv->ts_mode = pdata->ts_mode; + priv->ts_clk_inv = pdata->ts_clk_inv; +@@ -697,7 +698,6 @@ static int cxd2820r_probe(struct i2c_client *client, + memcpy(&priv->fe.ops, &cxd2820r_ops, sizeof(priv->fe.ops)); + if (!pdata->attach_in_use) + priv->fe.ops.release = NULL; +- priv->fe.demodulator_priv = priv; + i2c_set_clientdata(client, priv); + + /* Setup callbacks */ +diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c +index 2783531..4462d8c 100644 +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -130,7 +130,7 @@ static long media_device_enum_entities(struct media_device *mdev, + * old range. + */ + if (ent->function < MEDIA_ENT_F_OLD_BASE || +- ent->function > MEDIA_ENT_T_DEVNODE_UNKNOWN) { ++ ent->function > MEDIA_ENT_F_TUNER) { + if (is_media_entity_v4l2_subdev(ent)) + entd->type = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN; + else if (ent->function != MEDIA_ENT_F_IO_V4L) +diff --git a/drivers/media/pci/dm1105/Kconfig b/drivers/media/pci/dm1105/Kconfig +index 173daf0..14fa7e4 100644 +--- a/drivers/media/pci/dm1105/Kconfig ++++ b/drivers/media/pci/dm1105/Kconfig +@@ -1,6 +1,6 @@ + config DVB_DM1105 + tristate "SDMC DM1105 based PCI cards" +- depends on DVB_CORE && PCI && I2C ++ depends on DVB_CORE && PCI && I2C && I2C_ALGOBIT + select DVB_PLL if MEDIA_SUBDRV_AUTOSELECT + select DVB_STV0299 if MEDIA_SUBDRV_AUTOSELECT + select DVB_STV0288 if MEDIA_SUBDRV_AUTOSELECT +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index b33b9e3..05489a4 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1576,7 +1576,7 @@ static int vpfe_s_fmt(struct file *file, void *priv, + return -EBUSY; + } + +- ret = vpfe_try_fmt(file, priv, &format); ++ ret = __vpfe_get_format(vpfe, &format, &bpp); + if (ret) + return ret; + +diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c +index 91f9bb8..6ebe895 100644 +--- a/drivers/media/rc/lirc_dev.c ++++ b/drivers/media/rc/lirc_dev.c +@@ -589,7 +589,7 @@ long lirc_dev_fop_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + result = put_user(ir->d.features, (__u32 __user *)arg); + break; + case LIRC_GET_REC_MODE: +- if (LIRC_CAN_REC(ir->d.features)) { ++ if (!LIRC_CAN_REC(ir->d.features)) { + result = -ENOTTY; + break; + } +@@ -599,7 +599,7 @@ long lirc_dev_fop_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + (__u32 __user *)arg); + break; + case LIRC_SET_REC_MODE: +- if (LIRC_CAN_REC(ir->d.features)) { ++ if (!LIRC_CAN_REC(ir->d.features)) { + result = -ENOTTY; + break; + } +diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c +index 77edd20..40e5a6b 100644 +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -412,7 +412,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue, + nextbuf = NULL; + spin_unlock_irqrestore(&queue->irqlock, flags); + +- buf->state = buf->error ? VB2_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; ++ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); + +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index fa50635..41f3186 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -182,32 +182,36 @@ static ssize_t mei_read(struct file *file, char __user *ubuf, + goto out; + } + +- if (rets == -EBUSY && +- !mei_cl_enqueue_ctrl_wr_cb(cl, length, MEI_FOP_READ, file)) { +- rets = -ENOMEM; +- goto out; +- } + +- do { +- mutex_unlock(&dev->device_lock); +- +- if (wait_event_interruptible(cl->rx_wait, +- (!list_empty(&cl->rd_completed)) || +- (!mei_cl_is_connected(cl)))) { ++again: ++ mutex_unlock(&dev->device_lock); ++ if (wait_event_interruptible(cl->rx_wait, ++ !list_empty(&cl->rd_completed) || ++ !mei_cl_is_connected(cl))) { ++ if (signal_pending(current)) ++ return -EINTR; ++ return -ERESTARTSYS; ++ } ++ mutex_lock(&dev->device_lock); + +- if (signal_pending(current)) +- return -EINTR; +- return -ERESTARTSYS; +- } ++ if (!mei_cl_is_connected(cl)) { ++ rets = -ENODEV; ++ goto out; ++ } + +- mutex_lock(&dev->device_lock); +- if (!mei_cl_is_connected(cl)) { +- rets = -ENODEV; +- goto out; +- } ++ cb = mei_cl_read_cb(cl, file); ++ if (!cb) { ++ /* ++ * For amthif all the waiters are woken up, ++ * but only fp with matching cb->fp get the cb, ++ * the others have to return to wait on read. ++ */ ++ if (cl == &dev->iamthif_cl) ++ goto again; + +- cb = mei_cl_read_cb(cl, file); +- } while (!cb); ++ rets = 0; ++ goto out; ++ } + + copy_buffer: + /* now copy the data to user space */ +diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c +index fddd0be..80918ab 100644 +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -466,7 +466,10 @@ static int sdhci_acpi_probe(struct platform_device *pdev) + if (sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD)) { + bool v = sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD_OVERRIDE_LEVEL); + +- if (mmc_gpiod_request_cd(host->mmc, NULL, 0, v, 0, NULL)) { ++ err = mmc_gpiod_request_cd(host->mmc, NULL, 0, v, 0, NULL); ++ if (err) { ++ if (err == -EPROBE_DEFER) ++ goto err_free; + dev_warn(dev, "failed to setup card detect gpio\n"); + c->use_runtime_pm = false; + } +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index 0a177b1..d1570f5 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -258,9 +258,15 @@ static void fsl_ifc_run_command(struct mtd_info *mtd) + int bufnum = nctrl->page & priv->bufnum_mask; + int sector = bufnum * chip->ecc.steps; + int sector_end = sector + chip->ecc.steps - 1; ++ __be32 *eccstat_regs; ++ ++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0) ++ eccstat_regs = ifc->ifc_nand.v2_nand_eccstat; ++ else ++ eccstat_regs = ifc->ifc_nand.v1_nand_eccstat; + + for (i = sector / 4; i <= sector_end / 4; i++) +- eccstat[i] = ifc_in32(&ifc->ifc_nand.nand_eccstat[i]); ++ eccstat[i] = ifc_in32(&eccstat_regs[i]); + + for (i = sector; i <= sector_end; i++) { + errors = check_read_ecc(mtd, ctrl, eccstat, i); +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index 77e3cc0..a0dabd4 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -908,10 +908,14 @@ static int gs_usb_probe(struct usb_interface *intf, + struct gs_usb *dev; + int rc = -ENOMEM; + unsigned int icount, i; +- struct gs_host_config hconf = { +- .byte_order = 0x0000beef, +- }; +- struct gs_device_config dconf; ++ struct gs_host_config *hconf; ++ struct gs_device_config *dconf; ++ ++ hconf = kmalloc(sizeof(*hconf), GFP_KERNEL); ++ if (!hconf) ++ return -ENOMEM; ++ ++ hconf->byte_order = 0x0000beef; + + /* send host config */ + rc = usb_control_msg(interface_to_usbdev(intf), +@@ -920,16 +924,22 @@ static int gs_usb_probe(struct usb_interface *intf, + USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, + intf->altsetting[0].desc.bInterfaceNumber, +- &hconf, +- sizeof(hconf), ++ hconf, ++ sizeof(*hconf), + 1000); + ++ kfree(hconf); ++ + if (rc < 0) { + dev_err(&intf->dev, "Couldn't send data format (err=%d)\n", + rc); + return rc; + } + ++ dconf = kmalloc(sizeof(*dconf), GFP_KERNEL); ++ if (!dconf) ++ return -ENOMEM; ++ + /* read device config */ + rc = usb_control_msg(interface_to_usbdev(intf), + usb_rcvctrlpipe(interface_to_usbdev(intf), 0), +@@ -937,28 +947,33 @@ static int gs_usb_probe(struct usb_interface *intf, + USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 1, + intf->altsetting[0].desc.bInterfaceNumber, +- &dconf, +- sizeof(dconf), ++ dconf, ++ sizeof(*dconf), + 1000); + if (rc < 0) { + dev_err(&intf->dev, "Couldn't get device config: (err=%d)\n", + rc); ++ kfree(dconf); + return rc; + } + +- icount = dconf.icount + 1; ++ icount = dconf->icount + 1; + dev_info(&intf->dev, "Configuring for %d interfaces\n", icount); + + if (icount > GS_MAX_INTF) { + dev_err(&intf->dev, + "Driver cannot handle more that %d CAN interfaces\n", + GS_MAX_INTF); ++ kfree(dconf); + return -EINVAL; + } + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); +- if (!dev) ++ if (!dev) { ++ kfree(dconf); + return -ENOMEM; ++ } ++ + init_usb_anchor(&dev->rx_submitted); + + atomic_set(&dev->active_channels, 0); +@@ -967,7 +982,7 @@ static int gs_usb_probe(struct usb_interface *intf, + dev->udev = interface_to_usbdev(intf); + + for (i = 0; i < icount; i++) { +- dev->canch[i] = gs_make_candev(i, intf, &dconf); ++ dev->canch[i] = gs_make_candev(i, intf, dconf); + if (IS_ERR_OR_NULL(dev->canch[i])) { + /* save error code to return later */ + rc = PTR_ERR(dev->canch[i]); +@@ -978,12 +993,15 @@ static int gs_usb_probe(struct usb_interface *intf, + gs_destroy_candev(dev->canch[i]); + + usb_kill_anchored_urbs(&dev->rx_submitted); ++ kfree(dconf); + kfree(dev); + return rc; + } + dev->canch[i]->parent = dev; + } + ++ kfree(dconf); ++ + return 0; + } + +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index 108a30e..d000cb6 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -951,8 +951,8 @@ static int usb_8dev_probe(struct usb_interface *intf, + for (i = 0; i < MAX_TX_URBS; i++) + priv->tx_contexts[i].echo_index = MAX_TX_URBS; + +- priv->cmd_msg_buffer = kzalloc(sizeof(struct usb_8dev_cmd_msg), +- GFP_KERNEL); ++ priv->cmd_msg_buffer = devm_kzalloc(&intf->dev, sizeof(struct usb_8dev_cmd_msg), ++ GFP_KERNEL); + if (!priv->cmd_msg_buffer) + goto cleanup_candev; + +@@ -966,7 +966,7 @@ static int usb_8dev_probe(struct usb_interface *intf, + if (err) { + netdev_err(netdev, + "couldn't register CAN device: %d\n", err); +- goto cleanup_cmd_msg_buffer; ++ goto cleanup_candev; + } + + err = usb_8dev_cmd_version(priv, &version); +@@ -987,9 +987,6 @@ static int usb_8dev_probe(struct usb_interface *intf, + cleanup_unregister_candev: + unregister_netdev(priv->netdev); + +-cleanup_cmd_msg_buffer: +- kfree(priv->cmd_msg_buffer); +- + cleanup_candev: + free_candev(netdev); + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 0c45322..972b5e2 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -1901,7 +1901,8 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode, + ath10k_dbg(ar, ATH10K_DBG_BOOT, "firmware %s booted\n", + ar->hw->wiphy->fw_version); + +- if (test_bit(WMI_SERVICE_EXT_RES_CFG_SUPPORT, ar->wmi.svc_map)) { ++ if (test_bit(WMI_SERVICE_EXT_RES_CFG_SUPPORT, ar->wmi.svc_map) && ++ mode == ATH10K_FIRMWARE_MODE_NORMAL) { + val = 0; + if (ath10k_peer_stats_enabled(ar)) + val = WMI_10_4_PEER_STATS; +@@ -1954,10 +1955,13 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode, + * possible to implicitly make it correct by creating a dummy vdev and + * then deleting it. + */ +- status = ath10k_core_reset_rx_filter(ar); +- if (status) { +- ath10k_err(ar, "failed to reset rx filter: %d\n", status); +- goto err_hif_stop; ++ if (mode == ATH10K_FIRMWARE_MODE_NORMAL) { ++ status = ath10k_core_reset_rx_filter(ar); ++ if (status) { ++ ath10k_err(ar, ++ "failed to reset rx filter: %d\n", status); ++ goto err_hif_stop; ++ } + } + + /* If firmware indicates Full Rx Reorder support it must be used in a +diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +index dc44cfe..16e052d 100644 +--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c ++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +@@ -502,8 +502,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + break; + return -EOPNOTSUPP; + default: +- WARN_ON(1); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + + mutex_lock(&ah->lock); +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h +index 107bcfb..cb37bf0 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h +@@ -73,13 +73,13 @@ + #define AR9300_OTP_BASE \ + ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000) + #define AR9300_OTP_STATUS \ +- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18) ++ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x31018 : 0x15f18) + #define AR9300_OTP_STATUS_TYPE 0x7 + #define AR9300_OTP_STATUS_VALID 0x4 + #define AR9300_OTP_STATUS_ACCESS_BUSY 0x2 + #define AR9300_OTP_STATUS_SM_BUSY 0x1 + #define AR9300_OTP_READ_DATA \ +- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c) ++ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3101c : 0x15f1c) + + enum targetPowerHTRates { + HT_TARGET_RATE_0_8_16, +diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h +index 26fc8ec..a731671 100644 +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -959,6 +959,7 @@ struct ath_softc { + struct survey_info *cur_survey; + struct survey_info survey[ATH9K_NUM_CHANNELS]; + ++ spinlock_t intr_lock; + struct tasklet_struct intr_tq; + struct tasklet_struct bcon_tasklet; + struct ath_hw *sc_ah; +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index cfa3fe8..297d4bb 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -626,6 +626,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, + common->bt_ant_diversity = 1; + + spin_lock_init(&common->cc_lock); ++ spin_lock_init(&sc->intr_lock); + spin_lock_init(&sc->sc_serial_rw); + spin_lock_init(&sc->sc_pm_lock); + spin_lock_init(&sc->chan_lock); +diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c +index bba85d1..d937c39 100644 +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -805,21 +805,12 @@ void ath9k_hw_disable_interrupts(struct ath_hw *ah) + } + EXPORT_SYMBOL(ath9k_hw_disable_interrupts); + +-void ath9k_hw_enable_interrupts(struct ath_hw *ah) ++static void __ath9k_hw_enable_interrupts(struct ath_hw *ah) + { + struct ath_common *common = ath9k_hw_common(ah); + u32 sync_default = AR_INTR_SYNC_DEFAULT; + u32 async_mask; + +- if (!(ah->imask & ATH9K_INT_GLOBAL)) +- return; +- +- if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { +- ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", +- atomic_read(&ah->intr_ref_cnt)); +- return; +- } +- + if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) || + AR_SREV_9561(ah)) + sync_default &= ~AR_INTR_SYNC_HOST1_FATAL; +@@ -841,6 +832,39 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah) + ath_dbg(common, INTERRUPT, "AR_IMR 0x%x IER 0x%x\n", + REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER)); + } ++ ++void ath9k_hw_resume_interrupts(struct ath_hw *ah) ++{ ++ struct ath_common *common = ath9k_hw_common(ah); ++ ++ if (!(ah->imask & ATH9K_INT_GLOBAL)) ++ return; ++ ++ if (atomic_read(&ah->intr_ref_cnt) != 0) { ++ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", ++ atomic_read(&ah->intr_ref_cnt)); ++ return; ++ } ++ ++ __ath9k_hw_enable_interrupts(ah); ++} ++EXPORT_SYMBOL(ath9k_hw_resume_interrupts); ++ ++void ath9k_hw_enable_interrupts(struct ath_hw *ah) ++{ ++ struct ath_common *common = ath9k_hw_common(ah); ++ ++ if (!(ah->imask & ATH9K_INT_GLOBAL)) ++ return; ++ ++ if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { ++ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", ++ atomic_read(&ah->intr_ref_cnt)); ++ return; ++ } ++ ++ __ath9k_hw_enable_interrupts(ah); ++} + EXPORT_SYMBOL(ath9k_hw_enable_interrupts); + + void ath9k_hw_set_interrupts(struct ath_hw *ah) +diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h +index 3bab014..770fc11 100644 +--- a/drivers/net/wireless/ath/ath9k/mac.h ++++ b/drivers/net/wireless/ath/ath9k/mac.h +@@ -744,6 +744,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah); + void ath9k_hw_enable_interrupts(struct ath_hw *ah); + void ath9k_hw_disable_interrupts(struct ath_hw *ah); + void ath9k_hw_kill_interrupts(struct ath_hw *ah); ++void ath9k_hw_resume_interrupts(struct ath_hw *ah); + + void ar9002_hw_attach_mac_ops(struct ath_hw *ah); + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index e9f32b5..b868f02 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -373,21 +373,20 @@ void ath9k_tasklet(unsigned long data) + struct ath_common *common = ath9k_hw_common(ah); + enum ath_reset_type type; + unsigned long flags; +- u32 status = sc->intrstatus; ++ u32 status; + u32 rxmask; + ++ spin_lock_irqsave(&sc->intr_lock, flags); ++ status = sc->intrstatus; ++ sc->intrstatus = 0; ++ spin_unlock_irqrestore(&sc->intr_lock, flags); ++ + ath9k_ps_wakeup(sc); + spin_lock(&sc->sc_pcu_lock); + + if (status & ATH9K_INT_FATAL) { + type = RESET_TYPE_FATAL_INT; + ath9k_queue_reset(sc, type); +- +- /* +- * Increment the ref. counter here so that +- * interrupts are enabled in the reset routine. +- */ +- atomic_inc(&ah->intr_ref_cnt); + ath_dbg(common, RESET, "FATAL: Skipping interrupts\n"); + goto out; + } +@@ -403,11 +402,6 @@ void ath9k_tasklet(unsigned long data) + type = RESET_TYPE_BB_WATCHDOG; + ath9k_queue_reset(sc, type); + +- /* +- * Increment the ref. counter here so that +- * interrupts are enabled in the reset routine. +- */ +- atomic_inc(&ah->intr_ref_cnt); + ath_dbg(common, RESET, + "BB_WATCHDOG: Skipping interrupts\n"); + goto out; +@@ -420,7 +414,6 @@ void ath9k_tasklet(unsigned long data) + if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) { + type = RESET_TYPE_TX_GTT; + ath9k_queue_reset(sc, type); +- atomic_inc(&ah->intr_ref_cnt); + ath_dbg(common, RESET, + "GTT: Skipping interrupts\n"); + goto out; +@@ -477,7 +470,7 @@ void ath9k_tasklet(unsigned long data) + ath9k_btcoex_handle_interrupt(sc, status); + + /* re-enable hardware interrupt */ +- ath9k_hw_enable_interrupts(ah); ++ ath9k_hw_resume_interrupts(ah); + out: + spin_unlock(&sc->sc_pcu_lock); + ath9k_ps_restore(sc); +@@ -541,7 +534,9 @@ irqreturn_t ath_isr(int irq, void *dev) + return IRQ_NONE; + + /* Cache the status */ +- sc->intrstatus = status; ++ spin_lock(&sc->intr_lock); ++ sc->intrstatus |= status; ++ spin_unlock(&sc->intr_lock); + + if (status & SCHED_INTR) + sched = true; +@@ -587,7 +582,7 @@ irqreturn_t ath_isr(int irq, void *dev) + + if (sched) { + /* turn off every interrupt */ +- ath9k_hw_disable_interrupts(ah); ++ ath9k_hw_kill_interrupts(ah); + tasklet_schedule(&sc->intr_tq); + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h +index b951eba..d2f4dd4 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.h ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.h +@@ -275,10 +275,10 @@ struct mp_adapter { + }; + + struct rtl_pci_priv { ++ struct bt_coexist_info bt_coexist; ++ struct rtl_led_ctl ledctl; + struct rtl_pci dev; + struct mp_adapter ndis_adapter; +- struct rtl_led_ctl ledctl; +- struct bt_coexist_info bt_coexist; + }; + + #define rtl_pcipriv(hw) (((struct rtl_pci_priv *)(rtl_priv(hw))->priv)) +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c +index ebf663e..cab4601 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c +@@ -1006,7 +1006,7 @@ static void _rtl92ee_hw_configure(struct ieee80211_hw *hw) + rtl_write_word(rtlpriv, REG_SIFS_TRX, 0x100a); + + /* Note Data sheet don't define */ +- rtl_write_word(rtlpriv, 0x4C7, 0x80); ++ rtl_write_byte(rtlpriv, 0x4C7, 0x80); + + rtl_write_byte(rtlpriv, REG_RX_PKT_LIMIT, 0x20); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +index 1281ebe..2cbef96 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +@@ -1128,7 +1128,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) + } + if (0 == tmp) { + read_addr = REG_DBI_RDATA + addr % 4; +- ret = rtl_read_word(rtlpriv, read_addr); ++ ret = rtl_read_byte(rtlpriv, read_addr); + } + return ret; + } +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.h b/drivers/net/wireless/realtek/rtlwifi/usb.h +index 685273c..441c441 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.h ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.h +@@ -150,8 +150,9 @@ struct rtl_usb { + }; + + struct rtl_usb_priv { +- struct rtl_usb dev; ++ struct bt_coexist_info bt_coexist; + struct rtl_led_ctl ledctl; ++ struct rtl_usb dev; + }; + + #define rtl_usbpriv(hw) (((struct rtl_usb_priv *)(rtl_priv(hw))->priv)) +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 763ff87..61fc349 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -130,7 +130,8 @@ union pci_version { + */ + union win_slot_encoding { + struct { +- u32 func:8; ++ u32 dev:5; ++ u32 func:3; + u32 reserved:24; + } bits; + u32 slot; +@@ -483,7 +484,8 @@ static u32 devfn_to_wslot(int devfn) + union win_slot_encoding wslot; + + wslot.slot = 0; +- wslot.bits.func = PCI_SLOT(devfn) | (PCI_FUNC(devfn) << 5); ++ wslot.bits.dev = PCI_SLOT(devfn); ++ wslot.bits.func = PCI_FUNC(devfn); + + return wslot.slot; + } +@@ -501,7 +503,7 @@ static int wslot_to_devfn(u32 wslot) + union win_slot_encoding slot_no; + + slot_no.slot = wslot; +- return PCI_DEVFN(0, slot_no.bits.func); ++ return PCI_DEVFN(slot_no.bits.dev, slot_no.bits.func); + } + + /* +diff --git a/drivers/pci/host/pcie-altera.c b/drivers/pci/host/pcie-altera.c +index b0ac4df..f2907e7 100644 +--- a/drivers/pci/host/pcie-altera.c ++++ b/drivers/pci/host/pcie-altera.c +@@ -57,10 +57,14 @@ + #define TLP_WRITE_TAG 0x10 + #define RP_DEVFN 0 + #define TLP_REQ_ID(bus, devfn) (((bus) << 8) | (devfn)) +-#define TLP_CFG_DW0(pcie, bus) \ ++#define TLP_CFGRD_DW0(pcie, bus) \ + ((((bus == pcie->root_bus_nr) ? TLP_FMTTYPE_CFGRD0 \ + : TLP_FMTTYPE_CFGRD1) << 24) | \ + TLP_PAYLOAD_SIZE) ++#define TLP_CFGWR_DW0(pcie, bus) \ ++ ((((bus == pcie->root_bus_nr) ? TLP_FMTTYPE_CFGWR0 \ ++ : TLP_FMTTYPE_CFGWR1) << 24) | \ ++ TLP_PAYLOAD_SIZE) + #define TLP_CFG_DW1(pcie, tag, be) \ + (((TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN)) << 16) | (tag << 8) | (be)) + #define TLP_CFG_DW2(bus, devfn, offset) \ +@@ -222,7 +226,7 @@ static int tlp_cfg_dword_read(struct altera_pcie *pcie, u8 bus, u32 devfn, + { + u32 headers[TLP_HDR_SIZE]; + +- headers[0] = TLP_CFG_DW0(pcie, bus); ++ headers[0] = TLP_CFGRD_DW0(pcie, bus); + headers[1] = TLP_CFG_DW1(pcie, TLP_READ_TAG, byte_en); + headers[2] = TLP_CFG_DW2(bus, devfn, where); + +@@ -237,7 +241,7 @@ static int tlp_cfg_dword_write(struct altera_pcie *pcie, u8 bus, u32 devfn, + u32 headers[TLP_HDR_SIZE]; + int ret; + +- headers[0] = TLP_CFG_DW0(pcie, bus); ++ headers[0] = TLP_CFGWR_DW0(pcie, bus); + headers[1] = TLP_CFG_DW1(pcie, TLP_WRITE_TAG, byte_en); + headers[2] = TLP_CFG_DW2(bus, devfn, where); + +diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c +index 56efaf7..acb2be0 100644 +--- a/drivers/pci/hotplug/pnv_php.c ++++ b/drivers/pci/hotplug/pnv_php.c +@@ -35,9 +35,11 @@ static void pnv_php_register(struct device_node *dn); + static void pnv_php_unregister_one(struct device_node *dn); + static void pnv_php_unregister(struct device_node *dn); + +-static void pnv_php_disable_irq(struct pnv_php_slot *php_slot) ++static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, ++ bool disable_device) + { + struct pci_dev *pdev = php_slot->pdev; ++ int irq = php_slot->irq; + u16 ctrl; + + if (php_slot->irq > 0) { +@@ -56,10 +58,14 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot) + php_slot->wq = NULL; + } + +- if (pdev->msix_enabled) +- pci_disable_msix(pdev); +- else if (pdev->msi_enabled) +- pci_disable_msi(pdev); ++ if (disable_device || irq > 0) { ++ if (pdev->msix_enabled) ++ pci_disable_msix(pdev); ++ else if (pdev->msi_enabled) ++ pci_disable_msi(pdev); ++ ++ pci_disable_device(pdev); ++ } + } + + static void pnv_php_free_slot(struct kref *kref) +@@ -68,7 +74,7 @@ static void pnv_php_free_slot(struct kref *kref) + struct pnv_php_slot, kref); + + WARN_ON(!list_empty(&php_slot->children)); +- pnv_php_disable_irq(php_slot); ++ pnv_php_disable_irq(php_slot, false); + kfree(php_slot->name); + kfree(php_slot); + } +@@ -759,7 +765,7 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) + php_slot->wq = alloc_workqueue("pciehp-%s", 0, 0, php_slot->name); + if (!php_slot->wq) { + dev_warn(&pdev->dev, "Cannot alloc workqueue\n"); +- pnv_php_disable_irq(php_slot); ++ pnv_php_disable_irq(php_slot, true); + return; + } + +@@ -772,7 +778,7 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) + ret = request_irq(irq, pnv_php_interrupt, IRQF_SHARED, + php_slot->name, php_slot); + if (ret) { +- pnv_php_disable_irq(php_slot); ++ pnv_php_disable_irq(php_slot, true); + dev_warn(&pdev->dev, "Error %d enabling IRQ %d\n", ret, irq); + return; + } +diff --git a/drivers/power/reset/Kconfig b/drivers/power/reset/Kconfig +index c74c3f6..02e46bb 100644 +--- a/drivers/power/reset/Kconfig ++++ b/drivers/power/reset/Kconfig +@@ -32,7 +32,7 @@ config POWER_RESET_AT91_RESET + + config POWER_RESET_AT91_SAMA5D2_SHDWC + tristate "Atmel AT91 SAMA5D2-Compatible shutdown controller driver" +- depends on ARCH_AT91 || COMPILE_TEST ++ depends on ARCH_AT91 + default SOC_SAMA5 + help + This driver supports the alternate shutdown controller for some Atmel +diff --git a/drivers/power/reset/at91-poweroff.c b/drivers/power/reset/at91-poweroff.c +index e9e24df..2579f02 100644 +--- a/drivers/power/reset/at91-poweroff.c ++++ b/drivers/power/reset/at91-poweroff.c +@@ -14,9 +14,12 @@ + #include <linux/io.h> + #include <linux/module.h> + #include <linux/of.h> ++#include <linux/of_address.h> + #include <linux/platform_device.h> + #include <linux/printk.h> + ++#include <soc/at91/at91sam9_ddrsdr.h> ++ + #define AT91_SHDW_CR 0x00 /* Shut Down Control Register */ + #define AT91_SHDW_SHDW BIT(0) /* Shut Down command */ + #define AT91_SHDW_KEY (0xa5 << 24) /* KEY Password */ +@@ -50,6 +53,7 @@ static const char *shdwc_wakeup_modes[] = { + + static void __iomem *at91_shdwc_base; + static struct clk *sclk; ++static void __iomem *mpddrc_base; + + static void __init at91_wakeup_status(void) + { +@@ -73,6 +77,29 @@ static void at91_poweroff(void) + writel(AT91_SHDW_KEY | AT91_SHDW_SHDW, at91_shdwc_base + AT91_SHDW_CR); + } + ++static void at91_lpddr_poweroff(void) ++{ ++ asm volatile( ++ /* Align to cache lines */ ++ ".balign 32\n\t" ++ ++ /* Ensure AT91_SHDW_CR is in the TLB by reading it */ ++ " ldr r6, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" ++ ++ /* Power down SDRAM0 */ ++ " str %1, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t" ++ /* Shutdown CPU */ ++ " str %3, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" ++ ++ " b .\n\t" ++ : ++ : "r" (mpddrc_base), ++ "r" cpu_to_le32(AT91_DDRSDRC_LPDDR2_PWOFF), ++ "r" (at91_shdwc_base), ++ "r" cpu_to_le32(AT91_SHDW_KEY | AT91_SHDW_SHDW) ++ : "r0"); ++} ++ + static int at91_poweroff_get_wakeup_mode(struct device_node *np) + { + const char *pm; +@@ -124,6 +151,8 @@ static void at91_poweroff_dt_set_wakeup_mode(struct platform_device *pdev) + static int __init at91_poweroff_probe(struct platform_device *pdev) + { + struct resource *res; ++ struct device_node *np; ++ u32 ddr_type; + int ret; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -150,12 +179,30 @@ static int __init at91_poweroff_probe(struct platform_device *pdev) + + pm_power_off = at91_poweroff; + ++ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d3-ddramc"); ++ if (!np) ++ return 0; ++ ++ mpddrc_base = of_iomap(np, 0); ++ of_node_put(np); ++ ++ if (!mpddrc_base) ++ return 0; ++ ++ ddr_type = readl(mpddrc_base + AT91_DDRSDRC_MDR) & AT91_DDRSDRC_MD; ++ if ((ddr_type == AT91_DDRSDRC_MD_LPDDR2) || ++ (ddr_type == AT91_DDRSDRC_MD_LPDDR3)) ++ pm_power_off = at91_lpddr_poweroff; ++ else ++ iounmap(mpddrc_base); ++ + return 0; + } + + static int __exit at91_poweroff_remove(struct platform_device *pdev) + { +- if (pm_power_off == at91_poweroff) ++ if (pm_power_off == at91_poweroff || ++ pm_power_off == at91_lpddr_poweroff) + pm_power_off = NULL; + + clk_disable_unprepare(sclk); +@@ -163,6 +210,11 @@ static int __exit at91_poweroff_remove(struct platform_device *pdev) + return 0; + } + ++static const struct of_device_id at91_ramc_of_match[] = { ++ { .compatible = "atmel,sama5d3-ddramc", }, ++ { /* sentinel */ } ++}; ++ + static const struct of_device_id at91_poweroff_of_match[] = { + { .compatible = "atmel,at91sam9260-shdwc", }, + { .compatible = "atmel,at91sam9rl-shdwc", }, +diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c +index 8a5ac97..90b0b5a 100644 +--- a/drivers/power/reset/at91-sama5d2_shdwc.c ++++ b/drivers/power/reset/at91-sama5d2_shdwc.c +@@ -22,9 +22,12 @@ + #include <linux/io.h> + #include <linux/module.h> + #include <linux/of.h> ++#include <linux/of_address.h> + #include <linux/platform_device.h> + #include <linux/printk.h> + ++#include <soc/at91/at91sam9_ddrsdr.h> ++ + #define SLOW_CLOCK_FREQ 32768 + + #define AT91_SHDW_CR 0x00 /* Shut Down Control Register */ +@@ -75,6 +78,7 @@ struct shdwc { + */ + static struct shdwc *at91_shdwc; + static struct clk *sclk; ++static void __iomem *mpddrc_base; + + static const unsigned long long sdwc_dbc_period[] = { + 0, 3, 32, 512, 4096, 32768, +@@ -108,6 +112,29 @@ static void at91_poweroff(void) + at91_shdwc->at91_shdwc_base + AT91_SHDW_CR); + } + ++static void at91_lpddr_poweroff(void) ++{ ++ asm volatile( ++ /* Align to cache lines */ ++ ".balign 32\n\t" ++ ++ /* Ensure AT91_SHDW_CR is in the TLB by reading it */ ++ " ldr r6, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" ++ ++ /* Power down SDRAM0 */ ++ " str %1, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t" ++ /* Shutdown CPU */ ++ " str %3, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" ++ ++ " b .\n\t" ++ : ++ : "r" (mpddrc_base), ++ "r" cpu_to_le32(AT91_DDRSDRC_LPDDR2_PWOFF), ++ "r" (at91_shdwc->at91_shdwc_base), ++ "r" cpu_to_le32(AT91_SHDW_KEY | AT91_SHDW_SHDW) ++ : "r0"); ++} ++ + static u32 at91_shdwc_debouncer_value(struct platform_device *pdev, + u32 in_period_us) + { +@@ -212,6 +239,8 @@ static int __init at91_shdwc_probe(struct platform_device *pdev) + { + struct resource *res; + const struct of_device_id *match; ++ struct device_node *np; ++ u32 ddr_type; + int ret; + + if (!pdev->dev.of_node) +@@ -249,6 +278,23 @@ static int __init at91_shdwc_probe(struct platform_device *pdev) + + pm_power_off = at91_poweroff; + ++ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d3-ddramc"); ++ if (!np) ++ return 0; ++ ++ mpddrc_base = of_iomap(np, 0); ++ of_node_put(np); ++ ++ if (!mpddrc_base) ++ return 0; ++ ++ ddr_type = readl(mpddrc_base + AT91_DDRSDRC_MDR) & AT91_DDRSDRC_MD; ++ if ((ddr_type == AT91_DDRSDRC_MD_LPDDR2) || ++ (ddr_type == AT91_DDRSDRC_MD_LPDDR3)) ++ pm_power_off = at91_lpddr_poweroff; ++ else ++ iounmap(mpddrc_base); ++ + return 0; + } + +@@ -256,7 +302,8 @@ static int __exit at91_shdwc_remove(struct platform_device *pdev) + { + struct shdwc *shdw = platform_get_drvdata(pdev); + +- if (pm_power_off == at91_poweroff) ++ if (pm_power_off == at91_poweroff || ++ pm_power_off == at91_lpddr_poweroff) + pm_power_off = NULL; + + /* Reset values to disable wake-up features */ +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 5c1519b..9faccfc 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4357,12 +4357,13 @@ static void regulator_summary_show_subtree(struct seq_file *s, + seq_puts(s, "\n"); + + list_for_each_entry(consumer, &rdev->consumer_list, list) { +- if (consumer->dev->class == ®ulator_class) ++ if (consumer->dev && consumer->dev->class == ®ulator_class) + continue; + + seq_printf(s, "%*s%-*s ", + (level + 1) * 3 + 1, "", +- 30 - (level + 1) * 3, dev_name(consumer->dev)); ++ 30 - (level + 1) * 3, ++ consumer->dev ? dev_name(consumer->dev) : "deviceless"); + + switch (rdev->desc->type) { + case REGULATOR_VOLTAGE: +diff --git a/drivers/remoteproc/qcom_mdt_loader.c b/drivers/remoteproc/qcom_mdt_loader.c +index 114e8e4..04db02d 100644 +--- a/drivers/remoteproc/qcom_mdt_loader.c ++++ b/drivers/remoteproc/qcom_mdt_loader.c +@@ -115,6 +115,7 @@ int qcom_mdt_load(struct rproc *rproc, + const struct elf32_phdr *phdrs; + const struct elf32_phdr *phdr; + const struct elf32_hdr *ehdr; ++ const struct firmware *seg_fw; + size_t fw_name_len; + char *fw_name; + void *ptr; +@@ -153,16 +154,16 @@ int qcom_mdt_load(struct rproc *rproc, + + if (phdr->p_filesz) { + sprintf(fw_name + fw_name_len - 3, "b%02d", i); +- ret = request_firmware(&fw, fw_name, &rproc->dev); ++ ret = request_firmware(&seg_fw, fw_name, &rproc->dev); + if (ret) { + dev_err(&rproc->dev, "failed to load %s\n", + fw_name); + break; + } + +- memcpy(ptr, fw->data, fw->size); ++ memcpy(ptr, seg_fw->data, seg_fw->size); + +- release_firmware(fw); ++ release_firmware(seg_fw); + } + + if (phdr->p_memsz > phdr->p_filesz) +diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig +index e859d14..0723c97 100644 +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -1432,7 +1432,7 @@ config RTC_DRV_SUN4V + based RTC on SUN4V systems. + + config RTC_DRV_SUN6I +- tristate "Allwinner A31 RTC" ++ bool "Allwinner A31 RTC" + default MACH_SUN6I || MACH_SUN8I || COMPILE_TEST + depends on ARCH_SUNXI + help +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index c169a2c..b0d45d2 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -37,9 +37,11 @@ + + /* Control register */ + #define SUN6I_LOSC_CTRL 0x0000 ++#define SUN6I_LOSC_CTRL_KEY (0x16aa << 16) + #define SUN6I_LOSC_CTRL_ALM_DHMS_ACC BIT(9) + #define SUN6I_LOSC_CTRL_RTC_HMS_ACC BIT(8) + #define SUN6I_LOSC_CTRL_RTC_YMD_ACC BIT(7) ++#define SUN6I_LOSC_CTRL_EXT_OSC BIT(0) + #define SUN6I_LOSC_CTRL_ACC_MASK GENMASK(9, 7) + + /* RTC */ +@@ -114,13 +116,17 @@ struct sun6i_rtc_dev { + void __iomem *base; + int irq; + unsigned long alarm; ++ ++ spinlock_t lock; + }; + + static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) + { + struct sun6i_rtc_dev *chip = (struct sun6i_rtc_dev *) id; ++ irqreturn_t ret = IRQ_NONE; + u32 val; + ++ spin_lock(&chip->lock); + val = readl(chip->base + SUN6I_ALRM_IRQ_STA); + + if (val & SUN6I_ALRM_IRQ_STA_CNT_IRQ_PEND) { +@@ -129,10 +135,11 @@ static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) + + rtc_update_irq(chip->rtc, 1, RTC_AF | RTC_IRQF); + +- return IRQ_HANDLED; ++ ret = IRQ_HANDLED; + } ++ spin_unlock(&chip->lock); + +- return IRQ_NONE; ++ return ret; + } + + static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) +@@ -140,6 +147,7 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) + u32 alrm_val = 0; + u32 alrm_irq_val = 0; + u32 alrm_wake_val = 0; ++ unsigned long flags; + + if (to) { + alrm_val = SUN6I_ALRM_EN_CNT_EN; +@@ -150,9 +158,11 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) + chip->base + SUN6I_ALRM_IRQ_STA); + } + ++ spin_lock_irqsave(&chip->lock, flags); + writel(alrm_val, chip->base + SUN6I_ALRM_EN); + writel(alrm_irq_val, chip->base + SUN6I_ALRM_IRQ_EN); + writel(alrm_wake_val, chip->base + SUN6I_ALARM_CONFIG); ++ spin_unlock_irqrestore(&chip->lock, flags); + } + + static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) +@@ -191,11 +201,15 @@ static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) + static int sun6i_rtc_getalarm(struct device *dev, struct rtc_wkalrm *wkalrm) + { + struct sun6i_rtc_dev *chip = dev_get_drvdata(dev); ++ unsigned long flags; + u32 alrm_st; + u32 alrm_en; + ++ spin_lock_irqsave(&chip->lock, flags); + alrm_en = readl(chip->base + SUN6I_ALRM_IRQ_EN); + alrm_st = readl(chip->base + SUN6I_ALRM_IRQ_STA); ++ spin_unlock_irqrestore(&chip->lock, flags); ++ + wkalrm->enabled = !!(alrm_en & SUN6I_ALRM_EN_CNT_EN); + wkalrm->pending = !!(alrm_st & SUN6I_ALRM_EN_CNT_EN); + rtc_time_to_tm(chip->alarm, &wkalrm->time); +@@ -356,6 +370,7 @@ static int sun6i_rtc_probe(struct platform_device *pdev) + chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); + if (!chip) + return -ENOMEM; ++ spin_lock_init(&chip->lock); + + platform_set_drvdata(pdev, chip); + chip->dev = &pdev->dev; +@@ -404,6 +419,10 @@ static int sun6i_rtc_probe(struct platform_device *pdev) + /* disable alarm wakeup */ + writel(0, chip->base + SUN6I_ALARM_CONFIG); + ++ /* switch to the external, more precise, oscillator */ ++ writel(SUN6I_LOSC_CTRL_KEY | SUN6I_LOSC_CTRL_EXT_OSC, ++ chip->base + SUN6I_LOSC_CTRL); ++ + chip->rtc = rtc_device_register("rtc-sun6i", &pdev->dev, + &sun6i_rtc_ops, THIS_MODULE); + if (IS_ERR(chip->rtc)) { +@@ -439,9 +458,4 @@ static struct platform_driver sun6i_rtc_driver = { + .of_match_table = sun6i_rtc_dt_ids, + }, + }; +- +-module_platform_driver(sun6i_rtc_driver); +- +-MODULE_DESCRIPTION("sun6i RTC driver"); +-MODULE_AUTHOR("Chen-Yu Tsai <wens@csie.org>"); +-MODULE_LICENSE("GPL"); ++builtin_platform_driver(sun6i_rtc_driver); +diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c +index 0c45388..7b178d7 100644 +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -414,16 +414,23 @@ static int aac_src_check_health(struct aac_dev *dev) + u32 status = src_readl(dev, MUnit.OMR); + + /* ++ * Check to see if the board panic'd. ++ */ ++ if (unlikely(status & KERNEL_PANIC)) ++ goto err_blink; ++ ++ /* + * Check to see if the board failed any self tests. + */ + if (unlikely(status & SELF_TEST_FAILED)) +- return -1; ++ goto err_out; + + /* +- * Check to see if the board panic'd. ++ * Check to see if the board failed any self tests. + */ +- if (unlikely(status & KERNEL_PANIC)) +- return (status >> 16) & 0xFF; ++ if (unlikely(status & MONITOR_PANIC)) ++ goto err_out; ++ + /* + * Wait for the adapter to be up and running. + */ +@@ -433,6 +440,12 @@ static int aac_src_check_health(struct aac_dev *dev) + * Everything is OK + */ + return 0; ++ ++err_out: ++ return -1; ++ ++err_blink: ++ return (status > 16) & 0xFF; + } + + /** +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index ee802273..55faa94 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -1185,6 +1185,7 @@ struct lpfc_mbx_wq_create { + #define lpfc_mbx_wq_create_page_size_SHIFT 0 + #define lpfc_mbx_wq_create_page_size_MASK 0x000000FF + #define lpfc_mbx_wq_create_page_size_WORD word1 ++#define LPFC_WQ_PAGE_SIZE_4096 0x1 + #define lpfc_mbx_wq_create_wqe_size_SHIFT 8 + #define lpfc_mbx_wq_create_wqe_size_MASK 0x0000000F + #define lpfc_mbx_wq_create_wqe_size_WORD word1 +@@ -1256,6 +1257,7 @@ struct rq_context { + #define lpfc_rq_context_page_size_SHIFT 0 /* Version 1 Only */ + #define lpfc_rq_context_page_size_MASK 0x000000FF + #define lpfc_rq_context_page_size_WORD word0 ++#define LPFC_RQ_PAGE_SIZE_4096 0x1 + uint32_t reserved1; + uint32_t word2; + #define lpfc_rq_context_cq_id_SHIFT 16 +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index f4f77c5..49b4c79 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -13678,7 +13678,7 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + LPFC_WQ_WQE_SIZE_128); + bf_set(lpfc_mbx_wq_create_page_size, + &wq_create->u.request_1, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ LPFC_WQ_PAGE_SIZE_4096); + page = wq_create->u.request_1.page; + break; + } +@@ -13704,8 +13704,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + LPFC_WQ_WQE_SIZE_128); + break; + } +- bf_set(lpfc_mbx_wq_create_page_size, &wq_create->u.request_1, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ bf_set(lpfc_mbx_wq_create_page_size, ++ &wq_create->u.request_1, ++ LPFC_WQ_PAGE_SIZE_4096); + page = wq_create->u.request_1.page; + break; + default: +@@ -13891,7 +13892,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq, + LPFC_RQE_SIZE_8); + bf_set(lpfc_rq_context_page_size, + &rq_create->u.request.context, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ LPFC_RQ_PAGE_SIZE_4096); + } else { + switch (hrq->entry_count) { + default: +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index b8d3b97..84addee 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -219,20 +219,6 @@ int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh) + } + EXPORT_SYMBOL_GPL(scsi_unregister_device_handler); + +-static struct scsi_device *get_sdev_from_queue(struct request_queue *q) +-{ +- struct scsi_device *sdev; +- unsigned long flags; +- +- spin_lock_irqsave(q->queue_lock, flags); +- sdev = q->queuedata; +- if (!sdev || !get_device(&sdev->sdev_gendev)) +- sdev = NULL; +- spin_unlock_irqrestore(q->queue_lock, flags); +- +- return sdev; +-} +- + /* + * scsi_dh_activate - activate the path associated with the scsi_device + * corresponding to the given request queue. +@@ -251,7 +237,7 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data) + struct scsi_device *sdev; + int err = SCSI_DH_NOSYS; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) { + if (fn) + fn(data, err); +@@ -298,7 +284,7 @@ int scsi_dh_set_params(struct request_queue *q, const char *params) + struct scsi_device *sdev; + int err = -SCSI_DH_NOSYS; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return err; + +@@ -321,7 +307,7 @@ int scsi_dh_attach(struct request_queue *q, const char *name) + struct scsi_device_handler *scsi_dh; + int err = 0; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return -ENODEV; + +@@ -359,7 +345,7 @@ const char *scsi_dh_attached_handler_name(struct request_queue *q, gfp_t gfp) + struct scsi_device *sdev; + const char *handler_name = NULL; + +- sdev = get_sdev_from_queue(q); ++ sdev = scsi_device_from_queue(q); + if (!sdev) + return NULL; + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index e64eae4..d8099c7 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -2127,6 +2127,29 @@ void scsi_mq_destroy_tags(struct Scsi_Host *shost) + blk_mq_free_tag_set(&shost->tag_set); + } + ++/** ++ * scsi_device_from_queue - return sdev associated with a request_queue ++ * @q: The request queue to return the sdev from ++ * ++ * Return the sdev associated with a request queue or NULL if the ++ * request_queue does not reference a SCSI device. ++ */ ++struct scsi_device *scsi_device_from_queue(struct request_queue *q) ++{ ++ struct scsi_device *sdev = NULL; ++ ++ if (q->mq_ops) { ++ if (q->mq_ops == &scsi_mq_ops) ++ sdev = q->queuedata; ++ } else if (q->request_fn == scsi_request_fn) ++ sdev = q->queuedata; ++ if (!sdev || !get_device(&sdev->sdev_gendev)) ++ sdev = NULL; ++ ++ return sdev; ++} ++EXPORT_SYMBOL_GPL(scsi_device_from_queue); ++ + /* + * Function: scsi_block_requests() + * +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 8ccfc9e..3f218f5 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -136,6 +136,8 @@ struct hv_fc_wwn_packet { + #define SRB_FLAGS_PORT_DRIVER_RESERVED 0x0F000000 + #define SRB_FLAGS_CLASS_DRIVER_RESERVED 0xF0000000 + ++#define SP_UNTAGGED ((unsigned char) ~0) ++#define SRB_SIMPLE_TAG_REQUEST 0x20 + + /* + * Platform neutral description of a scsi request - +@@ -375,6 +377,7 @@ enum storvsc_request_type { + #define SRB_STATUS_SUCCESS 0x01 + #define SRB_STATUS_ABORTED 0x02 + #define SRB_STATUS_ERROR 0x04 ++#define SRB_STATUS_DATA_OVERRUN 0x12 + + #define SRB_STATUS(status) \ + (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN)) +@@ -889,6 +892,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + switch (SRB_STATUS(vm_srb->srb_status)) { + case SRB_STATUS_ERROR: + /* ++ * Let upper layer deal with error when ++ * sense message is present. ++ */ ++ ++ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) ++ break; ++ /* + * If there is an error; offline the device since all + * error recovery strategies would have already been + * deployed on the host side. However, if the command +@@ -953,6 +963,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, + struct scsi_cmnd *scmnd = cmd_request->cmd; + struct scsi_sense_hdr sense_hdr; + struct vmscsi_request *vm_srb; ++ u32 data_transfer_length; + struct Scsi_Host *host; + u32 payload_sz = cmd_request->payload_sz; + void *payload = cmd_request->payload; +@@ -960,6 +971,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, + host = stor_dev->host; + + vm_srb = &cmd_request->vstor_packet.vm_srb; ++ data_transfer_length = vm_srb->data_transfer_length; + + scmnd->result = vm_srb->scsi_status; + +@@ -973,13 +985,20 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, + &sense_hdr); + } + +- if (vm_srb->srb_status != SRB_STATUS_SUCCESS) ++ if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { + storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, + sense_hdr.ascq); ++ /* ++ * The Windows driver set data_transfer_length on ++ * SRB_STATUS_DATA_OVERRUN. On other errors, this value ++ * is untouched. In these cases we set it to 0. ++ */ ++ if (vm_srb->srb_status != SRB_STATUS_DATA_OVERRUN) ++ data_transfer_length = 0; ++ } + + scsi_set_resid(scmnd, +- cmd_request->payload->range.len - +- vm_srb->data_transfer_length); ++ cmd_request->payload->range.len - data_transfer_length); + + scmnd->scsi_done(scmnd); + +@@ -1451,6 +1470,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + vm_srb->win8_extension.srb_flags |= + SRB_FLAGS_DISABLE_SYNCH_TRANSFER; + ++ if (scmnd->device->tagged_supported) { ++ vm_srb->win8_extension.srb_flags |= ++ (SRB_FLAGS_QUEUE_ACTION_ENABLE | SRB_FLAGS_NO_QUEUE_FREEZE); ++ vm_srb->win8_extension.queue_tag = SP_UNTAGGED; ++ vm_srb->win8_extension.queue_action = SRB_SIMPLE_TAG_REQUEST; ++ } ++ + /* Build the SRB */ + switch (scmnd->sc_data_direction) { + case DMA_TO_DEVICE: +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 3c09e94..186342b 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -1003,7 +1003,7 @@ static struct s3c64xx_spi_info *s3c64xx_spi_parse_dt(struct device *dev) + sci->num_cs = temp; + } + +- sci->no_cs = of_property_read_bool(dev->of_node, "broken-cs"); ++ sci->no_cs = of_property_read_bool(dev->of_node, "no-cs-readback"); + + return sci; + } +diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c +index 7882306..29dc249 100644 +--- a/drivers/staging/greybus/loopback.c ++++ b/drivers/staging/greybus/loopback.c +@@ -1051,8 +1051,13 @@ static int gb_loopback_fn(void *data) + gb_loopback_calculate_stats(gb, !!error); + } + gb->send_count++; +- if (us_wait) +- udelay(us_wait); ++ ++ if (us_wait) { ++ if (us_wait < 20000) ++ usleep_range(us_wait, us_wait + 100); ++ else ++ msleep(us_wait / 1000); ++ } + } + + gb_pm_runtime_put_autosuspend(bundle); +diff --git a/drivers/staging/lustre/lnet/selftest/rpc.c b/drivers/staging/lustre/lnet/selftest/rpc.c +index f5619d8..0256d65 100644 +--- a/drivers/staging/lustre/lnet/selftest/rpc.c ++++ b/drivers/staging/lustre/lnet/selftest/rpc.c +@@ -252,7 +252,7 @@ srpc_service_init(struct srpc_service *svc) + svc->sv_shuttingdown = 0; + + svc->sv_cpt_data = cfs_percpt_alloc(lnet_cpt_table(), +- sizeof(*svc->sv_cpt_data)); ++ sizeof(**svc->sv_cpt_data)); + if (!svc->sv_cpt_data) + return -ENOMEM; + +diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c +index b87cbbb..b39fd1e 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_recv.c ++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c +@@ -1383,6 +1383,9 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) + ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); + } + ++ if (!ptr) ++ return _FAIL; ++ + memcpy(ptr, pattrib->dst, ETH_ALEN); + memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); + +diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c +index cbd2e51..cedf25b 100644 +--- a/drivers/staging/rtl8712/rtl871x_recv.c ++++ b/drivers/staging/rtl8712/rtl871x_recv.c +@@ -643,11 +643,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) + /* append rx status for mp test packets */ + ptr = recvframe_pull(precvframe, (rmv_len - + sizeof(struct ethhdr) + 2) - 24); ++ if (!ptr) ++ return _FAIL; + memcpy(ptr, get_rxmem(precvframe), 24); + ptr += 24; +- } else ++ } else { + ptr = recvframe_pull(precvframe, (rmv_len - + sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); ++ if (!ptr) ++ return _FAIL; ++ } + + memcpy(ptr, pattrib->dst, ETH_ALEN); + memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index d2b860e..5dc6bfc 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1234,6 +1234,9 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) + unsigned transfer_in_flight; + unsigned started; + ++ if (dep->flags & DWC3_EP_STALL) ++ return 0; ++ + if (dep->number > 1) + trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue); + else +@@ -1258,6 +1261,8 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) + else + dep->flags |= DWC3_EP_STALL; + } else { ++ if (!(dep->flags & DWC3_EP_STALL)) ++ return 0; + + ret = dwc3_send_clear_stall_ep_cmd(dep); + if (ret) +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index e2966f8..b0f7195 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -50,12 +50,12 @@ struct f_hidg { + + /* recv report */ + struct list_head completed_out_req; +- spinlock_t spinlock; ++ spinlock_t read_spinlock; + wait_queue_head_t read_queue; + unsigned int qlen; + + /* send report */ +- struct mutex lock; ++ spinlock_t write_spinlock; + bool write_pending; + wait_queue_head_t write_queue; + struct usb_request *req; +@@ -204,28 +204,35 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + if (!access_ok(VERIFY_WRITE, buffer, count)) + return -EFAULT; + +- spin_lock_irqsave(&hidg->spinlock, flags); ++ spin_lock_irqsave(&hidg->read_spinlock, flags); + + #define READ_COND (!list_empty(&hidg->completed_out_req)) + + /* wait for at least one buffer to complete */ + while (!READ_COND) { +- spin_unlock_irqrestore(&hidg->spinlock, flags); ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); + if (file->f_flags & O_NONBLOCK) + return -EAGAIN; + + if (wait_event_interruptible(hidg->read_queue, READ_COND)) + return -ERESTARTSYS; + +- spin_lock_irqsave(&hidg->spinlock, flags); ++ spin_lock_irqsave(&hidg->read_spinlock, flags); + } + + /* pick the first one */ + list = list_first_entry(&hidg->completed_out_req, + struct f_hidg_req_list, list); ++ ++ /* ++ * Remove this from list to protect it from beign free() ++ * while host disables our function ++ */ ++ list_del(&list->list); ++ + req = list->req; + count = min_t(unsigned int, count, req->actual - list->pos); +- spin_unlock_irqrestore(&hidg->spinlock, flags); ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); + + /* copy to user outside spinlock */ + count -= copy_to_user(buffer, req->buf + list->pos, count); +@@ -238,15 +245,20 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + * call, taking into account its current read position. + */ + if (list->pos == req->actual) { +- spin_lock_irqsave(&hidg->spinlock, flags); +- list_del(&list->list); + kfree(list); +- spin_unlock_irqrestore(&hidg->spinlock, flags); + + req->length = hidg->report_length; + ret = usb_ep_queue(hidg->out_ep, req, GFP_KERNEL); +- if (ret < 0) ++ if (ret < 0) { ++ free_ep_req(hidg->out_ep, req); + return ret; ++ } ++ } else { ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ list_add(&list->list, &hidg->completed_out_req); ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); ++ ++ wake_up(&hidg->read_queue); + } + + return count; +@@ -255,13 +267,16 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req) + { + struct f_hidg *hidg = (struct f_hidg *)ep->driver_data; ++ unsigned long flags; + + if (req->status != 0) { + ERROR(hidg->func.config->cdev, + "End Point Request ERROR: %d\n", req->status); + } + ++ spin_lock_irqsave(&hidg->write_spinlock, flags); + hidg->write_pending = 0; ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); + wake_up(&hidg->write_queue); + } + +@@ -269,18 +284,19 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, + size_t count, loff_t *offp) + { + struct f_hidg *hidg = file->private_data; ++ unsigned long flags; + ssize_t status = -ENOMEM; + + if (!access_ok(VERIFY_READ, buffer, count)) + return -EFAULT; + +- mutex_lock(&hidg->lock); ++ spin_lock_irqsave(&hidg->write_spinlock, flags); + + #define WRITE_COND (!hidg->write_pending) + + /* write queue */ + while (!WRITE_COND) { +- mutex_unlock(&hidg->lock); ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); + if (file->f_flags & O_NONBLOCK) + return -EAGAIN; + +@@ -288,17 +304,20 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, + hidg->write_queue, WRITE_COND)) + return -ERESTARTSYS; + +- mutex_lock(&hidg->lock); ++ spin_lock_irqsave(&hidg->write_spinlock, flags); + } + ++ hidg->write_pending = 1; + count = min_t(unsigned, count, hidg->report_length); ++ ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); + status = copy_from_user(hidg->req->buf, buffer, count); + + if (status != 0) { + ERROR(hidg->func.config->cdev, + "copy_from_user error\n"); +- mutex_unlock(&hidg->lock); +- return -EINVAL; ++ status = -EINVAL; ++ goto release_write_pending; + } + + hidg->req->status = 0; +@@ -306,19 +325,23 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, + hidg->req->length = count; + hidg->req->complete = f_hidg_req_complete; + hidg->req->context = hidg; +- hidg->write_pending = 1; + + status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); + if (status < 0) { + ERROR(hidg->func.config->cdev, + "usb_ep_queue error on int endpoint %zd\n", status); +- hidg->write_pending = 0; +- wake_up(&hidg->write_queue); ++ goto release_write_pending; + } else { + status = count; + } + +- mutex_unlock(&hidg->lock); ++ return status; ++release_write_pending: ++ spin_lock_irqsave(&hidg->write_spinlock, flags); ++ hidg->write_pending = 0; ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ ++ wake_up(&hidg->write_queue); + + return status; + } +@@ -371,20 +394,36 @@ static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep, + static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req) + { + struct f_hidg *hidg = (struct f_hidg *) req->context; ++ struct usb_composite_dev *cdev = hidg->func.config->cdev; + struct f_hidg_req_list *req_list; + unsigned long flags; + +- req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC); +- if (!req_list) +- return; ++ switch (req->status) { ++ case 0: ++ req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC); ++ if (!req_list) { ++ ERROR(cdev, "Unable to allocate mem for req_list\n"); ++ goto free_req; ++ } + +- req_list->req = req; ++ req_list->req = req; + +- spin_lock_irqsave(&hidg->spinlock, flags); +- list_add_tail(&req_list->list, &hidg->completed_out_req); +- spin_unlock_irqrestore(&hidg->spinlock, flags); ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ list_add_tail(&req_list->list, &hidg->completed_out_req); ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); + +- wake_up(&hidg->read_queue); ++ wake_up(&hidg->read_queue); ++ break; ++ default: ++ ERROR(cdev, "Set report failed %d\n", req->status); ++ /* FALLTHROUGH */ ++ case -ECONNABORTED: /* hardware forced ep reset */ ++ case -ECONNRESET: /* request dequeued */ ++ case -ESHUTDOWN: /* disconnect from host */ ++free_req: ++ free_ep_req(ep, req); ++ return; ++ } + } + + static int hidg_setup(struct usb_function *f, +@@ -490,14 +529,18 @@ static void hidg_disable(struct usb_function *f) + { + struct f_hidg *hidg = func_to_hidg(f); + struct f_hidg_req_list *list, *next; ++ unsigned long flags; + + usb_ep_disable(hidg->in_ep); + usb_ep_disable(hidg->out_ep); + ++ spin_lock_irqsave(&hidg->read_spinlock, flags); + list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { ++ free_ep_req(hidg->out_ep, list->req); + list_del(&list->list); + kfree(list); + } ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); + } + + static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) +@@ -646,8 +689,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + if (status) + goto fail; + +- mutex_init(&hidg->lock); +- spin_lock_init(&hidg->spinlock); ++ spin_lock_init(&hidg->write_spinlock); ++ spin_lock_init(&hidg->read_spinlock); + init_waitqueue_head(&hidg->write_queue); + init_waitqueue_head(&hidg->read_queue); + INIT_LIST_HEAD(&hidg->completed_out_req); +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index 0402177..d685d82 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1080,6 +1080,24 @@ static void usb_udc_nop_release(struct device *dev) + dev_vdbg(dev, "%s\n", __func__); + } + ++/* should be called with udc_lock held */ ++static int check_pending_gadget_drivers(struct usb_udc *udc) ++{ ++ struct usb_gadget_driver *driver; ++ int ret = 0; ++ ++ list_for_each_entry(driver, &gadget_driver_pending_list, pending) ++ if (!driver->udc_name || strcmp(driver->udc_name, ++ dev_name(&udc->dev)) == 0) { ++ ret = udc_bind_to_driver(udc, driver); ++ if (ret != -EPROBE_DEFER) ++ list_del(&driver->pending); ++ break; ++ } ++ ++ return ret; ++} ++ + /** + * usb_add_gadget_udc_release - adds a new gadget to the udc class driver list + * @parent: the parent device to this udc. Usually the controller driver's +@@ -1093,7 +1111,6 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget, + void (*release)(struct device *dev)) + { + struct usb_udc *udc; +- struct usb_gadget_driver *driver; + int ret = -ENOMEM; + + udc = kzalloc(sizeof(*udc), GFP_KERNEL); +@@ -1136,17 +1153,9 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget, + udc->vbus = true; + + /* pick up one of pending gadget drivers */ +- list_for_each_entry(driver, &gadget_driver_pending_list, pending) { +- if (!driver->udc_name || strcmp(driver->udc_name, +- dev_name(&udc->dev)) == 0) { +- ret = udc_bind_to_driver(udc, driver); +- if (ret != -EPROBE_DEFER) +- list_del(&driver->pending); +- if (ret) +- goto err5; +- break; +- } +- } ++ ret = check_pending_gadget_drivers(udc); ++ if (ret) ++ goto err5; + + mutex_unlock(&udc_lock); + +@@ -1356,14 +1365,22 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver) + return -EINVAL; + + mutex_lock(&udc_lock); +- list_for_each_entry(udc, &udc_list, list) ++ list_for_each_entry(udc, &udc_list, list) { + if (udc->driver == driver) { + usb_gadget_remove_driver(udc); + usb_gadget_set_state(udc->gadget, +- USB_STATE_NOTATTACHED); ++ USB_STATE_NOTATTACHED); ++ ++ /* Maybe there is someone waiting for this UDC? */ ++ check_pending_gadget_drivers(udc); ++ /* ++ * For now we ignore bind errors as probably it's ++ * not a valid reason to fail other's gadget unbind ++ */ + ret = 0; + break; + } ++ } + + if (ret) { + list_del(&driver->pending); +diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c +index aab5221..aac0ce8 100644 +--- a/drivers/usb/gadget/udc/fsl_udc_core.c ++++ b/drivers/usb/gadget/udc/fsl_udc_core.c +@@ -1249,6 +1249,12 @@ static const struct usb_gadget_ops fsl_gadget_ops = { + .udc_stop = fsl_udc_stop, + }; + ++/* ++ * Empty complete function used by this driver to fill in the req->complete ++ * field when creating a request since the complete field is mandatory. ++ */ ++static void fsl_noop_complete(struct usb_ep *ep, struct usb_request *req) { } ++ + /* Set protocol stall on ep0, protocol stall will automatically be cleared + on new transaction */ + static void ep0stall(struct fsl_udc *udc) +@@ -1283,7 +1289,7 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction) + req->req.length = 0; + req->req.status = -EINPROGRESS; + req->req.actual = 0; +- req->req.complete = NULL; ++ req->req.complete = fsl_noop_complete; + req->dtd_count = 0; + + ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); +@@ -1366,7 +1372,7 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value, + req->req.length = 2; + req->req.status = -EINPROGRESS; + req->req.actual = 0; +- req->req.complete = NULL; ++ req->req.complete = fsl_noop_complete; + req->dtd_count = 0; + + ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index ed56bf9..abe3606 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -223,9 +223,6 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (device_property_read_bool(&pdev->dev, "usb3-lpm-capable")) + xhci->quirks |= XHCI_LPM_SUPPORT; + +- if (HCC_MAX_PSA(xhci->hcc_params) >= 4) +- xhci->shared_hcd->can_do_streams = 1; +- + hcd->usb_phy = devm_usb_get_phy_by_phandle(&pdev->dev, "usb-phy", 0); + if (IS_ERR(hcd->usb_phy)) { + ret = PTR_ERR(hcd->usb_phy); +@@ -242,6 +239,9 @@ static int xhci_plat_probe(struct platform_device *pdev) + if (ret) + goto disable_usb_phy; + ++ if (HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ xhci->shared_hcd->can_do_streams = 1; ++ + ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); + if (ret) + goto dealloc_usb2_hcd; +diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c +index 2440f88..bacee0f 100644 +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -434,15 +434,11 @@ static int da8xx_musb_exit(struct musb *musb) + } + + static const struct musb_platform_ops da8xx_ops = { +- .quirks = MUSB_DMA_CPPI | MUSB_INDEXED_EP, ++ .quirks = MUSB_INDEXED_EP, + .init = da8xx_musb_init, + .exit = da8xx_musb_exit, + + .fifo_mode = 2, +-#ifdef CONFIG_USB_TI_CPPI_DMA +- .dma_init = cppi_dma_controller_create, +- .dma_exit = cppi_dma_controller_destroy, +-#endif + .enable = da8xx_musb_enable, + .disable = da8xx_musb_disable, + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index 181793f..9d2738e 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -615,8 +615,12 @@ static void virtballoon_remove(struct virtio_device *vdev) + cancel_work_sync(&vb->update_balloon_stats_work); + + remove_common(vb); ++#ifdef CONFIG_BALLOON_COMPACTION + if (vb->vb_dev_info.inode) + iput(vb->vb_dev_info.inode); ++ ++ kern_unmount(balloon_mnt); ++#endif + kfree(vb); + } + +diff --git a/drivers/vme/vme.c b/drivers/vme/vme.c +index bdbadaa..0035cf7 100644 +--- a/drivers/vme/vme.c ++++ b/drivers/vme/vme.c +@@ -1625,10 +1625,25 @@ static int vme_bus_probe(struct device *dev) + return retval; + } + ++static int vme_bus_remove(struct device *dev) ++{ ++ int retval = -ENODEV; ++ struct vme_driver *driver; ++ struct vme_dev *vdev = dev_to_vme_dev(dev); ++ ++ driver = dev->platform_data; ++ ++ if (driver->remove != NULL) ++ retval = driver->remove(vdev); ++ ++ return retval; ++} ++ + struct bus_type vme_bus_type = { + .name = "vme", + .match = vme_bus_match, + .probe = vme_bus_probe, ++ .remove = vme_bus_remove, + }; + EXPORT_SYMBOL(vme_bus_type); + +diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c +index 049a884..59d74d1 100644 +--- a/drivers/w1/masters/ds2490.c ++++ b/drivers/w1/masters/ds2490.c +@@ -153,6 +153,9 @@ struct ds_device + */ + u16 spu_bit; + ++ u8 st_buf[ST_SIZE]; ++ u8 byte_buf; ++ + struct w1_bus_master master; + }; + +@@ -174,7 +177,6 @@ struct ds_status + u8 data_in_buffer_status; + u8 reserved1; + u8 reserved2; +- + }; + + static struct usb_device_id ds_id_table [] = { +@@ -244,28 +246,6 @@ static int ds_send_control(struct ds_device *dev, u16 value, u16 index) + return err; + } + +-static int ds_recv_status_nodump(struct ds_device *dev, struct ds_status *st, +- unsigned char *buf, int size) +-{ +- int count, err; +- +- memset(st, 0, sizeof(*st)); +- +- count = 0; +- err = usb_interrupt_msg(dev->udev, usb_rcvintpipe(dev->udev, +- dev->ep[EP_STATUS]), buf, size, &count, 1000); +- if (err < 0) { +- pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", +- dev->ep[EP_STATUS], err); +- return err; +- } +- +- if (count >= sizeof(*st)) +- memcpy(st, buf, sizeof(*st)); +- +- return count; +-} +- + static inline void ds_print_msg(unsigned char *buf, unsigned char *str, int off) + { + pr_info("%45s: %8x\n", str, buf[off]); +@@ -324,6 +304,35 @@ static void ds_dump_status(struct ds_device *dev, unsigned char *buf, int count) + } + } + ++static int ds_recv_status(struct ds_device *dev, struct ds_status *st, ++ bool dump) ++{ ++ int count, err; ++ ++ if (st) ++ memset(st, 0, sizeof(*st)); ++ ++ count = 0; ++ err = usb_interrupt_msg(dev->udev, ++ usb_rcvintpipe(dev->udev, ++ dev->ep[EP_STATUS]), ++ dev->st_buf, sizeof(dev->st_buf), ++ &count, 1000); ++ if (err < 0) { ++ pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", ++ dev->ep[EP_STATUS], err); ++ return err; ++ } ++ ++ if (dump) ++ ds_dump_status(dev, dev->st_buf, count); ++ ++ if (st && count >= sizeof(*st)) ++ memcpy(st, dev->st_buf, sizeof(*st)); ++ ++ return count; ++} ++ + static void ds_reset_device(struct ds_device *dev) + { + ds_send_control_cmd(dev, CTL_RESET_DEVICE, 0); +@@ -344,7 +353,6 @@ static void ds_reset_device(struct ds_device *dev) + static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) + { + int count, err; +- struct ds_status st; + + /* Careful on size. If size is less than what is available in + * the input buffer, the device fails the bulk transfer and +@@ -359,14 +367,9 @@ static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) + err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN]), + buf, size, &count, 1000); + if (err < 0) { +- u8 buf[ST_SIZE]; +- int count; +- + pr_info("Clearing ep0x%x.\n", dev->ep[EP_DATA_IN]); + usb_clear_halt(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN])); +- +- count = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); +- ds_dump_status(dev, buf, count); ++ ds_recv_status(dev, NULL, true); + return err; + } + +@@ -404,7 +407,6 @@ int ds_stop_pulse(struct ds_device *dev, int limit) + { + struct ds_status st; + int count = 0, err = 0; +- u8 buf[ST_SIZE]; + + do { + err = ds_send_control(dev, CTL_HALT_EXE_IDLE, 0); +@@ -413,7 +415,7 @@ int ds_stop_pulse(struct ds_device *dev, int limit) + err = ds_send_control(dev, CTL_RESUME_EXE, 0); + if (err) + break; +- err = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); ++ err = ds_recv_status(dev, &st, false); + if (err) + break; + +@@ -456,18 +458,17 @@ int ds_detect(struct ds_device *dev, struct ds_status *st) + + static int ds_wait_status(struct ds_device *dev, struct ds_status *st) + { +- u8 buf[ST_SIZE]; + int err, count = 0; + + do { + st->status = 0; +- err = ds_recv_status_nodump(dev, st, buf, sizeof(buf)); ++ err = ds_recv_status(dev, st, false); + #if 0 + if (err >= 0) { + int i; + printk("0x%x: count=%d, status: ", dev->ep[EP_STATUS], err); + for (i=0; i<err; ++i) +- printk("%02x ", buf[i]); ++ printk("%02x ", dev->st_buf[i]); + printk("\n"); + } + #endif +@@ -485,7 +486,7 @@ static int ds_wait_status(struct ds_device *dev, struct ds_status *st) + * can do something with it). + */ + if (err > 16 || count >= 100 || err < 0) +- ds_dump_status(dev, buf, err); ++ ds_dump_status(dev, dev->st_buf, err); + + /* Extended data isn't an error. Well, a short is, but the dump + * would have already told the user that and we can't do anything +@@ -608,7 +609,6 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) + { + int err; + struct ds_status st; +- u8 rbyte; + + err = ds_send_control(dev, COMM_BYTE_IO | COMM_IM | dev->spu_bit, byte); + if (err) +@@ -621,11 +621,11 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) + if (err) + return err; + +- err = ds_recv_data(dev, &rbyte, sizeof(rbyte)); ++ err = ds_recv_data(dev, &dev->byte_buf, 1); + if (err < 0) + return err; + +- return !(byte == rbyte); ++ return !(byte == dev->byte_buf); + } + + static int ds_read_byte(struct ds_device *dev, u8 *byte) +@@ -712,7 +712,6 @@ static void ds9490r_search(void *data, struct w1_master *master, + int err; + u16 value, index; + struct ds_status st; +- u8 st_buf[ST_SIZE]; + int search_limit; + int found = 0; + int i; +@@ -724,7 +723,12 @@ static void ds9490r_search(void *data, struct w1_master *master, + /* FIFO 128 bytes, bulk packet size 64, read a multiple of the + * packet size. + */ +- u64 buf[2*64/8]; ++ const size_t bufsize = 2 * 64; ++ u64 *buf; ++ ++ buf = kmalloc(bufsize, GFP_KERNEL); ++ if (!buf) ++ return; + + mutex_lock(&master->bus_mutex); + +@@ -745,10 +749,9 @@ static void ds9490r_search(void *data, struct w1_master *master, + do { + schedule_timeout(jtime); + +- if (ds_recv_status_nodump(dev, &st, st_buf, sizeof(st_buf)) < +- sizeof(st)) { ++ err = ds_recv_status(dev, &st, false); ++ if (err < 0 || err < sizeof(st)) + break; +- } + + if (st.data_in_buffer_status) { + /* Bulk in can receive partial ids, but when it does +@@ -758,7 +761,7 @@ static void ds9490r_search(void *data, struct w1_master *master, + * bulk without first checking if status says there + * is data to read. + */ +- err = ds_recv_data(dev, (u8 *)buf, sizeof(buf)); ++ err = ds_recv_data(dev, (u8 *)buf, bufsize); + if (err < 0) + break; + for (i = 0; i < err/8; ++i) { +@@ -794,9 +797,14 @@ static void ds9490r_search(void *data, struct w1_master *master, + } + search_out: + mutex_unlock(&master->bus_mutex); ++ kfree(buf); + } + + #if 0 ++/* ++ * FIXME: if this disabled code is ever used in the future all ds_send_data() ++ * calls must be changed to use a DMAable buffer. ++ */ + static int ds_match_access(struct ds_device *dev, u64 init) + { + int err; +@@ -845,13 +853,12 @@ static int ds_set_path(struct ds_device *dev, u64 init) + + static u8 ds9490r_touch_bit(void *data, u8 bit) + { +- u8 ret; + struct ds_device *dev = data; + +- if (ds_touch_bit(dev, bit, &ret)) ++ if (ds_touch_bit(dev, bit, &dev->byte_buf)) + return 0; + +- return ret; ++ return dev->byte_buf; + } + + #if 0 +@@ -866,13 +873,12 @@ static u8 ds9490r_read_bit(void *data) + { + struct ds_device *dev = data; + int err; +- u8 bit = 0; + +- err = ds_touch_bit(dev, 1, &bit); ++ err = ds_touch_bit(dev, 1, &dev->byte_buf); + if (err) + return 0; + +- return bit & 1; ++ return dev->byte_buf & 1; + } + #endif + +@@ -887,32 +893,52 @@ static u8 ds9490r_read_byte(void *data) + { + struct ds_device *dev = data; + int err; +- u8 byte = 0; + +- err = ds_read_byte(dev, &byte); ++ err = ds_read_byte(dev, &dev->byte_buf); + if (err) + return 0; + +- return byte; ++ return dev->byte_buf; + } + + static void ds9490r_write_block(void *data, const u8 *buf, int len) + { + struct ds_device *dev = data; ++ u8 *tbuf; ++ ++ if (len <= 0) ++ return; ++ ++ tbuf = kmalloc(len, GFP_KERNEL); ++ if (!tbuf) ++ return; + +- ds_write_block(dev, (u8 *)buf, len); ++ memcpy(tbuf, buf, len); ++ ds_write_block(dev, tbuf, len); ++ ++ kfree(tbuf); + } + + static u8 ds9490r_read_block(void *data, u8 *buf, int len) + { + struct ds_device *dev = data; + int err; ++ u8 *tbuf; + +- err = ds_read_block(dev, buf, len); +- if (err < 0) ++ if (len <= 0) ++ return 0; ++ ++ tbuf = kmalloc(len, GFP_KERNEL); ++ if (!tbuf) + return 0; + +- return len; ++ err = ds_read_block(dev, tbuf, len); ++ if (err >= 0) ++ memcpy(buf, tbuf, len); ++ ++ kfree(tbuf); ++ ++ return err >= 0 ? len : 0; + } + + static u8 ds9490r_reset(void *data) +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index e213c67..ab0931e 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -763,6 +763,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn) + dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__, + sl->name); + w1_family_put(sl->family); ++ atomic_dec(&sl->master->refcnt); + kfree(sl); + return err; + } +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index ef3ebd7..1e643c7 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -363,6 +363,7 @@ static int start_read(struct inode *inode, struct list_head *page_list, int max) + nr_pages = i; + if (nr_pages > 0) { + len = nr_pages << PAGE_SHIFT; ++ osd_req_op_extent_update(req, 0, len); + break; + } + goto out_pages; +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 18a1e1d..1cd0e2e 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -2884,7 +2884,15 @@ cifs_readdata_to_iov(struct cifs_readdata *rdata, struct iov_iter *iter) + for (i = 0; i < rdata->nr_pages; i++) { + struct page *page = rdata->pages[i]; + size_t copy = min_t(size_t, remaining, PAGE_SIZE); +- size_t written = copy_page_to_iter(page, 0, copy, iter); ++ size_t written; ++ ++ if (unlikely(iter->type & ITER_PIPE)) { ++ void *addr = kmap_atomic(page); ++ ++ written = copy_to_iter(addr, copy, iter); ++ kunmap_atomic(addr); ++ } else ++ written = copy_page_to_iter(page, 0, copy, iter); + remaining -= written; + if (written < copy && iov_iter_count(iter) > 0) + break; +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index c930a01..9fbf92c 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5344,7 +5344,8 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + ext4_lblk_t stop, *iterator, ex_start, ex_end; + + /* Let path point to the last extent */ +- path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, 0); ++ path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, ++ EXT4_EX_NOCACHE); + if (IS_ERR(path)) + return PTR_ERR(path); + +@@ -5353,15 +5354,15 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + if (!extent) + goto out; + +- stop = le32_to_cpu(extent->ee_block) + +- ext4_ext_get_actual_len(extent); ++ stop = le32_to_cpu(extent->ee_block); + + /* + * In case of left shift, Don't start shifting extents until we make + * sure the hole is big enough to accommodate the shift. + */ + if (SHIFT == SHIFT_LEFT) { +- path = ext4_find_extent(inode, start - 1, &path, 0); ++ path = ext4_find_extent(inode, start - 1, &path, ++ EXT4_EX_NOCACHE); + if (IS_ERR(path)) + return PTR_ERR(path); + depth = path->p_depth; +@@ -5393,9 +5394,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + else + iterator = &stop; + +- /* Its safe to start updating extents */ +- while (start < stop) { +- path = ext4_find_extent(inode, *iterator, &path, 0); ++ /* ++ * Its safe to start updating extents. Start and stop are unsigned, so ++ * in case of right shift if extent with 0 block is reached, iterator ++ * becomes NULL to indicate the end of the loop. ++ */ ++ while (iterator && start <= stop) { ++ path = ext4_find_extent(inode, *iterator, &path, ++ EXT4_EX_NOCACHE); + if (IS_ERR(path)) + return PTR_ERR(path); + depth = path->p_depth; +@@ -5422,8 +5428,11 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + ext4_ext_get_actual_len(extent); + } else { + extent = EXT_FIRST_EXTENT(path[depth].p_hdr); +- *iterator = le32_to_cpu(extent->ee_block) > 0 ? +- le32_to_cpu(extent->ee_block) - 1 : 0; ++ if (le32_to_cpu(extent->ee_block) > 0) ++ *iterator = le32_to_cpu(extent->ee_block) - 1; ++ else ++ /* Beginning is reached, end of the loop */ ++ iterator = NULL; + /* Update path extent in case we need to stop */ + while (le32_to_cpu(extent->ee_block) < start) + extent++; +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index d8ca4b9..37b521e 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -376,7 +376,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, + static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, + unsigned int len) + { +- int ret, size; ++ int ret, size, no_expand; + struct ext4_inode_info *ei = EXT4_I(inode); + + if (!ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) +@@ -386,15 +386,14 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, + if (size < len) + return -ENOSPC; + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + + if (ei->i_inline_off) + ret = ext4_update_inline_data(handle, inode, len); + else + ret = ext4_create_inline_data(handle, inode, len); + +- up_write(&EXT4_I(inode)->xattr_sem); +- ++ ext4_write_unlock_xattr(inode, &no_expand); + return ret; + } + +@@ -523,7 +522,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, + struct inode *inode, + unsigned flags) + { +- int ret, needed_blocks; ++ int ret, needed_blocks, no_expand; + handle_t *handle = NULL; + int retries = 0, sem_held = 0; + struct page *page = NULL; +@@ -563,7 +562,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, + goto out; + } + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + sem_held = 1; + /* If some one has already done this for us, just exit. */ + if (!ext4_has_inline_data(inode)) { +@@ -600,7 +599,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, + put_page(page); + page = NULL; + ext4_orphan_add(handle, inode); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + sem_held = 0; + ext4_journal_stop(handle); + handle = NULL; +@@ -626,7 +625,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, + put_page(page); + } + if (sem_held) +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + if (handle) + ext4_journal_stop(handle); + brelse(iloc.bh); +@@ -719,7 +718,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping, + int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + unsigned copied, struct page *page) + { +- int ret; ++ int ret, no_expand; + void *kaddr; + struct ext4_iloc iloc; + +@@ -737,7 +736,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + goto out; + } + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + BUG_ON(!ext4_has_inline_data(inode)); + + kaddr = kmap_atomic(page); +@@ -747,7 +746,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + /* clear page dirty so that writepages wouldn't work for us. */ + ClearPageDirty(page); + +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + brelse(iloc.bh); + out: + return copied; +@@ -758,7 +757,7 @@ ext4_journalled_write_inline_data(struct inode *inode, + unsigned len, + struct page *page) + { +- int ret; ++ int ret, no_expand; + void *kaddr; + struct ext4_iloc iloc; + +@@ -768,11 +767,11 @@ ext4_journalled_write_inline_data(struct inode *inode, + return NULL; + } + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + kaddr = kmap_atomic(page); + ext4_write_inline_data(inode, &iloc, kaddr, 0, len); + kunmap_atomic(kaddr); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + + return iloc.bh; + } +@@ -934,8 +933,15 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, + struct page *page) + { + int i_size_changed = 0; ++ int ret; + +- copied = ext4_write_inline_data_end(inode, pos, len, copied, page); ++ ret = ext4_write_inline_data_end(inode, pos, len, copied, page); ++ if (ret < 0) { ++ unlock_page(page); ++ put_page(page); ++ return ret; ++ } ++ copied = ret; + + /* + * No need to use i_size_read() here, the i_size +@@ -1249,7 +1255,7 @@ static int ext4_convert_inline_data_nolock(handle_t *handle, + int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, + struct inode *dir, struct inode *inode) + { +- int ret, inline_size; ++ int ret, inline_size, no_expand; + void *inline_start; + struct ext4_iloc iloc; + +@@ -1257,7 +1263,7 @@ int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, + if (ret) + return ret; + +- down_write(&EXT4_I(dir)->xattr_sem); ++ ext4_write_lock_xattr(dir, &no_expand); + if (!ext4_has_inline_data(dir)) + goto out; + +@@ -1303,7 +1309,7 @@ int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, + + out: + ext4_mark_inode_dirty(handle, dir); +- up_write(&EXT4_I(dir)->xattr_sem); ++ ext4_write_unlock_xattr(dir, &no_expand); + brelse(iloc.bh); + return ret; + } +@@ -1663,7 +1669,7 @@ int ext4_delete_inline_entry(handle_t *handle, + struct buffer_head *bh, + int *has_inline_data) + { +- int err, inline_size; ++ int err, inline_size, no_expand; + struct ext4_iloc iloc; + void *inline_start; + +@@ -1671,7 +1677,7 @@ int ext4_delete_inline_entry(handle_t *handle, + if (err) + return err; + +- down_write(&EXT4_I(dir)->xattr_sem); ++ ext4_write_lock_xattr(dir, &no_expand); + if (!ext4_has_inline_data(dir)) { + *has_inline_data = 0; + goto out; +@@ -1705,7 +1711,7 @@ int ext4_delete_inline_entry(handle_t *handle, + + ext4_show_inline_dir(dir, iloc.bh, inline_start, inline_size); + out: +- up_write(&EXT4_I(dir)->xattr_sem); ++ ext4_write_unlock_xattr(dir, &no_expand); + brelse(iloc.bh); + if (err != -ENOENT) + ext4_std_error(dir->i_sb, err); +@@ -1804,11 +1810,11 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) + + int ext4_destroy_inline_data(handle_t *handle, struct inode *inode) + { +- int ret; ++ int ret, no_expand; + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + ret = ext4_destroy_inline_data_nolock(handle, inode); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + + return ret; + } +@@ -1893,7 +1899,7 @@ int ext4_try_to_evict_inline_data(handle_t *handle, + void ext4_inline_data_truncate(struct inode *inode, int *has_inline) + { + handle_t *handle; +- int inline_size, value_len, needed_blocks; ++ int inline_size, value_len, needed_blocks, no_expand; + size_t i_size; + void *value = NULL; + struct ext4_xattr_ibody_find is = { +@@ -1910,7 +1916,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) + if (IS_ERR(handle)) + return; + +- down_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_lock_xattr(inode, &no_expand); + if (!ext4_has_inline_data(inode)) { + *has_inline = 0; + ext4_journal_stop(handle); +@@ -1968,7 +1974,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) + up_write(&EXT4_I(inode)->i_data_sem); + out: + brelse(is.iloc.bh); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + kfree(value); + if (inode->i_nlink) + ext4_orphan_del(handle, inode); +@@ -1984,7 +1990,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) + + int ext4_convert_inline_data(struct inode *inode) + { +- int error, needed_blocks; ++ int error, needed_blocks, no_expand; + handle_t *handle; + struct ext4_iloc iloc; + +@@ -2006,15 +2012,10 @@ int ext4_convert_inline_data(struct inode *inode) + goto out_free; + } + +- down_write(&EXT4_I(inode)->xattr_sem); +- if (!ext4_has_inline_data(inode)) { +- up_write(&EXT4_I(inode)->xattr_sem); +- goto out; +- } +- +- error = ext4_convert_inline_data_nolock(handle, inode, &iloc); +- up_write(&EXT4_I(inode)->xattr_sem); +-out: ++ ext4_write_lock_xattr(inode, &no_expand); ++ if (ext4_has_inline_data(inode)) ++ error = ext4_convert_inline_data_nolock(handle, inode, &iloc); ++ ext4_write_unlock_xattr(inode, &no_expand); + ext4_journal_stop(handle); + out_free: + brelse(iloc.bh); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 33a509c..1d4f5fa 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1324,8 +1324,11 @@ static int ext4_write_end(struct file *file, + if (ext4_has_inline_data(inode)) { + ret = ext4_write_inline_data_end(inode, pos, len, + copied, page); +- if (ret < 0) ++ if (ret < 0) { ++ unlock_page(page); ++ put_page(page); + goto errout; ++ } + copied = ret; + } else + copied = block_write_end(file, mapping, pos, +@@ -1379,7 +1382,9 @@ static int ext4_write_end(struct file *file, + * set the buffer to be dirty, since in data=journalled mode we need + * to call ext4_handle_dirty_metadata() instead. + */ +-static void zero_new_buffers(struct page *page, unsigned from, unsigned to) ++static void ext4_journalled_zero_new_buffers(handle_t *handle, ++ struct page *page, ++ unsigned from, unsigned to) + { + unsigned int block_start = 0, block_end; + struct buffer_head *head, *bh; +@@ -1396,7 +1401,7 @@ static void zero_new_buffers(struct page *page, unsigned from, unsigned to) + size = min(to, block_end) - start; + + zero_user(page, start, size); +- set_buffer_uptodate(bh); ++ write_end_fn(handle, bh); + } + clear_buffer_new(bh); + } +@@ -1425,18 +1430,25 @@ static int ext4_journalled_write_end(struct file *file, + + BUG_ON(!ext4_handle_valid(handle)); + +- if (ext4_has_inline_data(inode)) +- copied = ext4_write_inline_data_end(inode, pos, len, +- copied, page); +- else { +- if (copied < len) { +- if (!PageUptodate(page)) +- copied = 0; +- zero_new_buffers(page, from+copied, to); ++ if (ext4_has_inline_data(inode)) { ++ ret = ext4_write_inline_data_end(inode, pos, len, ++ copied, page); ++ if (ret < 0) { ++ unlock_page(page); ++ put_page(page); ++ goto errout; + } +- ++ copied = ret; ++ } else if (unlikely(copied < len) && !PageUptodate(page)) { ++ copied = 0; ++ ext4_journalled_zero_new_buffers(handle, page, from, to); ++ } else { ++ if (unlikely(copied < len)) ++ ext4_journalled_zero_new_buffers(handle, page, ++ from + copied, to); + ret = ext4_walk_page_buffers(handle, page_buffers(page), from, +- to, &partial, write_end_fn); ++ from + copied, &partial, ++ write_end_fn); + if (!partial) + SetPageUptodate(page); + } +@@ -1462,6 +1474,7 @@ static int ext4_journalled_write_end(struct file *file, + */ + ext4_orphan_add(handle, inode); + ++errout: + ret2 = ext4_journal_stop(handle); + if (!ret) + ret = ret2; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 7ae43c5..2e9fc7a 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3123,6 +3123,13 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, + if (ar->pright && start + size - 1 >= ar->lright) + size -= start + size - ar->lright; + ++ /* ++ * Trim allocation request for filesystems with artificially small ++ * groups. ++ */ ++ if (size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb)) ++ size = EXT4_BLOCKS_PER_GROUP(ac->ac_sb); ++ + end = start + size; + + /* check we don't cross already preallocated blocks */ +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 104f8bf..c4a389a 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1616,13 +1616,15 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi + !fscrypt_has_permitted_context(dir, inode)) { + int nokey = ext4_encrypted_inode(inode) && + !fscrypt_has_encryption_key(inode); +- iput(inode); +- if (nokey) ++ if (nokey) { ++ iput(inode); + return ERR_PTR(-ENOKEY); ++ } + ext4_warning(inode->i_sb, + "Inconsistent encryption contexts: %lu/%lu", + (unsigned long) dir->i_ino, + (unsigned long) inode->i_ino); ++ iput(inode); + return ERR_PTR(-EPERM); + } + } +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index bbc316d..afe29ba 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -825,6 +825,7 @@ static void ext4_put_super(struct super_block *sb) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + struct ext4_super_block *es = sbi->s_es; ++ int aborted = 0; + int i, err; + + ext4_unregister_li_request(sb); +@@ -834,9 +835,10 @@ static void ext4_put_super(struct super_block *sb) + destroy_workqueue(sbi->rsv_conversion_wq); + + if (sbi->s_journal) { ++ aborted = is_journal_aborted(sbi->s_journal); + err = jbd2_journal_destroy(sbi->s_journal); + sbi->s_journal = NULL; +- if (err < 0) ++ if ((err < 0) && !aborted) + ext4_abort(sb, "Couldn't clean up the journal"); + } + +@@ -847,7 +849,7 @@ static void ext4_put_super(struct super_block *sb) + ext4_mb_release(sb); + ext4_ext_release(sb); + +- if (!(sb->s_flags & MS_RDONLY)) { ++ if (!(sb->s_flags & MS_RDONLY) && !aborted) { + ext4_clear_feature_journal_needs_recovery(sb); + es->s_state = cpu_to_le16(sbi->s_mount_state); + } +@@ -3911,7 +3913,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + * root first: it may be modified in the journal! + */ + if (!test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) { +- if (ext4_load_journal(sb, es, journal_devnum)) ++ err = ext4_load_journal(sb, es, journal_devnum); ++ if (err) + goto failed_mount3a; + } else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) && + ext4_has_feature_journal_needs_recovery(sb)) { +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index d77be9e..4448ed3 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1174,16 +1174,14 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, + struct ext4_xattr_block_find bs = { + .s = { .not_found = -ENODATA, }, + }; +- unsigned long no_expand; ++ int no_expand; + int error; + + if (!name) + return -EINVAL; + if (strlen(name) > 255) + return -ERANGE; +- down_write(&EXT4_I(inode)->xattr_sem); +- no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); +- ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ ext4_write_lock_xattr(inode, &no_expand); + + error = ext4_reserve_inode_write(handle, inode, &is.iloc); + if (error) +@@ -1251,7 +1249,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, + ext4_xattr_update_super_block(handle, inode->i_sb); + inode->i_ctime = ext4_current_time(inode); + if (!value) +- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ no_expand = 0; + error = ext4_mark_iloc_dirty(handle, inode, &is.iloc); + /* + * The bh is consumed by ext4_mark_iloc_dirty, even with +@@ -1265,9 +1263,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, + cleanup: + brelse(is.iloc.bh); + brelse(bs.bh); +- if (no_expand == 0) +- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + return error; + } + +@@ -1484,12 +1480,11 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + int error = 0, tried_min_extra_isize = 0; + int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); + int isize_diff; /* How much do we need to grow i_extra_isize */ ++ int no_expand; ++ ++ if (ext4_write_trylock_xattr(inode, &no_expand) == 0) ++ return 0; + +- down_write(&EXT4_I(inode)->xattr_sem); +- /* +- * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty +- */ +- ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); + retry: + isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize; + if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) +@@ -1571,17 +1566,16 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + EXT4_I(inode)->i_extra_isize = new_extra_isize; + brelse(bh); + out: +- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); +- up_write(&EXT4_I(inode)->xattr_sem); ++ ext4_write_unlock_xattr(inode, &no_expand); + return 0; + + cleanup: + brelse(bh); + /* +- * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode +- * size expansion failed. ++ * Inode size expansion failed; don't try again + */ +- up_write(&EXT4_I(inode)->xattr_sem); ++ no_expand = 1; ++ ext4_write_unlock_xattr(inode, &no_expand); + return error; + } + +diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h +index a92e783..099c8b6 100644 +--- a/fs/ext4/xattr.h ++++ b/fs/ext4/xattr.h +@@ -102,6 +102,38 @@ extern const struct xattr_handler ext4_xattr_security_handler; + + #define EXT4_XATTR_NAME_ENCRYPTION_CONTEXT "c" + ++/* ++ * The EXT4_STATE_NO_EXPAND is overloaded and used for two purposes. ++ * The first is to signal that there the inline xattrs and data are ++ * taking up so much space that we might as well not keep trying to ++ * expand it. The second is that xattr_sem is taken for writing, so ++ * we shouldn't try to recurse into the inode expansion. For this ++ * second case, we need to make sure that we take save and restore the ++ * NO_EXPAND state flag appropriately. ++ */ ++static inline void ext4_write_lock_xattr(struct inode *inode, int *save) ++{ ++ down_write(&EXT4_I(inode)->xattr_sem); ++ *save = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); ++} ++ ++static inline int ext4_write_trylock_xattr(struct inode *inode, int *save) ++{ ++ if (down_write_trylock(&EXT4_I(inode)->xattr_sem) == 0) ++ return 0; ++ *save = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ return 1; ++} ++ ++static inline void ext4_write_unlock_xattr(struct inode *inode, int *save) ++{ ++ if (*save == 0) ++ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); ++ up_write(&EXT4_I(inode)->xattr_sem); ++} ++ + extern ssize_t ext4_listxattr(struct dentry *, char *, size_t); + + extern int ext4_xattr_get(struct inode *, int, const char *, void *, size_t); +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c +index 369f451..ebdc90f 100644 +--- a/fs/f2fs/dir.c ++++ b/fs/f2fs/dir.c +@@ -207,9 +207,13 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, + f2fs_put_page(dentry_page, 0); + } + +- if (!de && room && F2FS_I(dir)->chash != namehash) { +- F2FS_I(dir)->chash = namehash; +- F2FS_I(dir)->clevel = level; ++ /* This is to increase the speed of f2fs_create */ ++ if (!de && room) { ++ F2FS_I(dir)->task = current; ++ if (F2FS_I(dir)->chash != namehash) { ++ F2FS_I(dir)->chash = namehash; ++ F2FS_I(dir)->clevel = level; ++ } + } + + return de; +@@ -643,14 +647,34 @@ int __f2fs_add_link(struct inode *dir, const struct qstr *name, + struct inode *inode, nid_t ino, umode_t mode) + { + struct fscrypt_name fname; ++ struct page *page = NULL; ++ struct f2fs_dir_entry *de = NULL; + int err; + + err = fscrypt_setup_filename(dir, name, 0, &fname); + if (err) + return err; + +- err = __f2fs_do_add_link(dir, &fname, inode, ino, mode); +- ++ /* ++ * An immature stakable filesystem shows a race condition between lookup ++ * and create. If we have same task when doing lookup and create, it's ++ * definitely fine as expected by VFS normally. Otherwise, let's just ++ * verify on-disk dentry one more time, which guarantees filesystem ++ * consistency more. ++ */ ++ if (current != F2FS_I(dir)->task) { ++ de = __f2fs_find_entry(dir, &fname, &page); ++ F2FS_I(dir)->task = NULL; ++ } ++ if (de) { ++ f2fs_dentry_kunmap(dir, page); ++ f2fs_put_page(page, 0); ++ err = -EEXIST; ++ } else if (IS_ERR(page)) { ++ err = PTR_ERR(page); ++ } else { ++ err = __f2fs_do_add_link(dir, &fname, inode, ino, mode); ++ } + fscrypt_free_filename(&fname); + return err; + } +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index 2b06d4f..7b32ce9 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -352,11 +352,12 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode, + } + + if (next_ex && __is_front_mergeable(ei, &next_ex->ei)) { +- if (en) +- __release_extent_node(sbi, et, prev_ex); + next_ex->ei.fofs = ei->fofs; + next_ex->ei.blk = ei->blk; + next_ex->ei.len += ei->len; ++ if (en) ++ __release_extent_node(sbi, et, prev_ex); ++ + en = next_ex; + } + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 506af45..3a1640b 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -431,6 +431,7 @@ struct f2fs_inode_info { + atomic_t dirty_pages; /* # of dirty pages */ + f2fs_hash_t chash; /* hash value of given file name */ + unsigned int clevel; /* maximum level of given file name */ ++ struct task_struct *task; /* lookup and create consistency */ + nid_t i_xattr_nid; /* node id that contains xattrs */ + unsigned long long xattr_ver; /* cp version of xattr modification */ + loff_t last_disk_size; /* lastly written file size */ +@@ -833,6 +834,9 @@ struct f2fs_sb_info { + struct f2fs_gc_kthread *gc_thread; /* GC thread */ + unsigned int cur_victim_sec; /* current victim section num */ + ++ /* threshold for converting bg victims for fg */ ++ u64 fggc_threshold; ++ + /* maximum # of trials to find a victim segment for SSR and GC */ + unsigned int max_victim_search; + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 6f14ee9..34a69e7 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -166,7 +166,8 @@ static void select_policy(struct f2fs_sb_info *sbi, int gc_type, + p->ofs_unit = sbi->segs_per_sec; + } + +- if (p->max_search > sbi->max_victim_search) ++ /* we need to check every dirty segments in the FG_GC case */ ++ if (gc_type != FG_GC && p->max_search > sbi->max_victim_search) + p->max_search = sbi->max_victim_search; + + p->offset = sbi->last_victim[p->gc_mode]; +@@ -199,6 +200,10 @@ static unsigned int check_bg_victims(struct f2fs_sb_info *sbi) + for_each_set_bit(secno, dirty_i->victim_secmap, MAIN_SECS(sbi)) { + if (sec_usage_check(sbi, secno)) + continue; ++ ++ if (no_fggc_candidate(sbi, secno)) ++ continue; ++ + clear_bit(secno, dirty_i->victim_secmap); + return secno * sbi->segs_per_sec; + } +@@ -322,13 +327,15 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, + nsearched++; + } + +- + secno = GET_SECNO(sbi, segno); + + if (sec_usage_check(sbi, secno)) + goto next; + if (gc_type == BG_GC && test_bit(secno, dirty_i->victim_secmap)) + goto next; ++ if (gc_type == FG_GC && p.alloc_mode == LFS && ++ no_fggc_candidate(sbi, secno)) ++ goto next; + + cost = get_gc_cost(sbi, segno, &p); + +@@ -972,5 +979,16 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync) + + void build_gc_manager(struct f2fs_sb_info *sbi) + { ++ u64 main_count, resv_count, ovp_count, blocks_per_sec; ++ + DIRTY_I(sbi)->v_ops = &default_v_ops; ++ ++ /* threshold of # of valid blocks in a section for victims of FG_GC */ ++ main_count = SM_I(sbi)->main_segments << sbi->log_blocks_per_seg; ++ resv_count = SM_I(sbi)->reserved_segments << sbi->log_blocks_per_seg; ++ ovp_count = SM_I(sbi)->ovp_segments << sbi->log_blocks_per_seg; ++ blocks_per_sec = sbi->blocks_per_seg * sbi->segs_per_sec; ++ ++ sbi->fggc_threshold = div_u64((main_count - ovp_count) * blocks_per_sec, ++ (main_count - resv_count)); + } +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index fc886f0..a7943f86 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -813,6 +813,8 @@ void clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc) + start = start_segno + sbi->segs_per_sec; + if (start < end) + goto next; ++ else ++ end = start - 1; + } + mutex_unlock(&dirty_i->seglist_lock); + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index fecb856..b164f83 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -688,6 +688,15 @@ static inline block_t sum_blk_addr(struct f2fs_sb_info *sbi, int base, int type) + - (base + 1) + type; + } + ++static inline bool no_fggc_candidate(struct f2fs_sb_info *sbi, ++ unsigned int secno) ++{ ++ if (get_valid_blocks(sbi, secno, sbi->segs_per_sec) >= ++ sbi->fggc_threshold) ++ return true; ++ return false; ++} ++ + static inline bool sec_usage_check(struct f2fs_sb_info *sbi, unsigned int secno) + { + if (IS_CURSEC(sbi, secno) || (sbi->cur_victim_sec == secno)) +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 2401c5d..5ec5870 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -100,6 +100,7 @@ static void fuse_file_put(struct fuse_file *ff, bool sync) + iput(req->misc.release.inode); + fuse_put_request(ff->fc, req); + } else if (sync) { ++ __set_bit(FR_FORCE, &req->flags); + __clear_bit(FR_BACKGROUND, &req->flags); + fuse_request_send(ff->fc, req); + iput(req->misc.release.inode); +diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c +index 14cbf60..133f322 100644 +--- a/fs/gfs2/glock.c ++++ b/fs/gfs2/glock.c +@@ -658,9 +658,11 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, + struct kmem_cache *cachep; + int ret, tries = 0; + ++ rcu_read_lock(); + gl = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); + if (gl && !lockref_get_not_dead(&gl->gl_lockref)) + gl = NULL; ++ rcu_read_unlock(); + + *glp = gl; + if (gl) +@@ -728,15 +730,18 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, + + if (ret == -EEXIST) { + ret = 0; ++ rcu_read_lock(); + tmp = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); + if (tmp == NULL || !lockref_get_not_dead(&tmp->gl_lockref)) { + if (++tries < 100) { ++ rcu_read_unlock(); + cond_resched(); + goto again; + } + tmp = NULL; + ret = -ENOMEM; + } ++ rcu_read_unlock(); + } else { + WARN_ON_ONCE(ret); + } +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index e165266..5e659ee 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1863,7 +1863,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) + + __blist_del_buffer(list, jh); + jh->b_jlist = BJ_None; +- if (test_clear_buffer_jbddirty(bh)) ++ if (transaction && is_journal_aborted(transaction->t_journal)) ++ clear_buffer_jbddirty(bh); ++ else if (test_clear_buffer_jbddirty(bh)) + mark_buffer_dirty(bh); /* Expose it to the VM */ + } + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index a5c3888..13abd60 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1073,9 +1073,6 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, + struct nfs_client *mds_client = mds_server->nfs_client; + struct nfs4_slot_table *tbl = &clp->cl_session->fc_slot_table; + +- if (task->tk_status >= 0) +- return 0; +- + switch (task->tk_status) { + /* MDS state errors */ + case -NFS4ERR_DELEG_REVOKED: +@@ -1176,9 +1173,6 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, + { + struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); + +- if (task->tk_status >= 0) +- return 0; +- + switch (task->tk_status) { + /* File access problems. Don't mark the device as unavailable */ + case -EACCES: +@@ -1213,6 +1207,13 @@ static int ff_layout_async_handle_error(struct rpc_task *task, + { + int vers = clp->cl_nfs_mod->rpc_vers->number; + ++ if (task->tk_status >= 0) ++ return 0; ++ ++ /* Handle the case of an invalid layout segment */ ++ if (!pnfs_is_valid_lseg(lseg)) ++ return -NFS4ERR_RESET_TO_PNFS; ++ + switch (vers) { + case 3: + return ff_layout_async_handle_error_v3(task, lseg, idx); +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 6085019..5cda392 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -128,30 +128,26 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len) + return err; + } + +-static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, ++static ssize_t _nfs42_proc_copy(struct file *src, + struct nfs_lock_context *src_lock, +- struct file *dst, loff_t pos_dst, ++ struct file *dst, + struct nfs_lock_context *dst_lock, +- size_t count) ++ struct nfs42_copy_args *args, ++ struct nfs42_copy_res *res) + { +- struct nfs42_copy_args args = { +- .src_fh = NFS_FH(file_inode(src)), +- .src_pos = pos_src, +- .dst_fh = NFS_FH(file_inode(dst)), +- .dst_pos = pos_dst, +- .count = count, +- }; +- struct nfs42_copy_res res; + struct rpc_message msg = { + .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COPY], +- .rpc_argp = &args, +- .rpc_resp = &res, ++ .rpc_argp = args, ++ .rpc_resp = res, + }; + struct inode *dst_inode = file_inode(dst); + struct nfs_server *server = NFS_SERVER(dst_inode); ++ loff_t pos_src = args->src_pos; ++ loff_t pos_dst = args->dst_pos; ++ size_t count = args->count; + int status; + +- status = nfs4_set_rw_stateid(&args.src_stateid, src_lock->open_context, ++ status = nfs4_set_rw_stateid(&args->src_stateid, src_lock->open_context, + src_lock, FMODE_READ); + if (status) + return status; +@@ -161,7 +157,7 @@ static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, + if (status) + return status; + +- status = nfs4_set_rw_stateid(&args.dst_stateid, dst_lock->open_context, ++ status = nfs4_set_rw_stateid(&args->dst_stateid, dst_lock->open_context, + dst_lock, FMODE_WRITE); + if (status) + return status; +@@ -171,22 +167,22 @@ static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, + return status; + + status = nfs4_call_sync(server->client, server, &msg, +- &args.seq_args, &res.seq_res, 0); ++ &args->seq_args, &res->seq_res, 0); + if (status == -ENOTSUPP) + server->caps &= ~NFS_CAP_COPY; + if (status) + return status; + +- if (res.write_res.verifier.committed != NFS_FILE_SYNC) { +- status = nfs_commit_file(dst, &res.write_res.verifier.verifier); ++ if (res->write_res.verifier.committed != NFS_FILE_SYNC) { ++ status = nfs_commit_file(dst, &res->write_res.verifier.verifier); + if (status) + return status; + } + + truncate_pagecache_range(dst_inode, pos_dst, +- pos_dst + res.write_res.count); ++ pos_dst + res->write_res.count); + +- return res.write_res.count; ++ return res->write_res.count; + } + + ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, +@@ -196,8 +192,22 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, + struct nfs_server *server = NFS_SERVER(file_inode(dst)); + struct nfs_lock_context *src_lock; + struct nfs_lock_context *dst_lock; +- struct nfs4_exception src_exception = { }; +- struct nfs4_exception dst_exception = { }; ++ struct nfs42_copy_args args = { ++ .src_fh = NFS_FH(file_inode(src)), ++ .src_pos = pos_src, ++ .dst_fh = NFS_FH(file_inode(dst)), ++ .dst_pos = pos_dst, ++ .count = count, ++ }; ++ struct nfs42_copy_res res; ++ struct nfs4_exception src_exception = { ++ .inode = file_inode(src), ++ .stateid = &args.src_stateid, ++ }; ++ struct nfs4_exception dst_exception = { ++ .inode = file_inode(dst), ++ .stateid = &args.dst_stateid, ++ }; + ssize_t err, err2; + + if (!nfs_server_capable(file_inode(dst), NFS_CAP_COPY)) +@@ -207,7 +217,6 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, + if (IS_ERR(src_lock)) + return PTR_ERR(src_lock); + +- src_exception.inode = file_inode(src); + src_exception.state = src_lock->open_context->state; + + dst_lock = nfs_get_lock_context(nfs_file_open_context(dst)); +@@ -216,15 +225,17 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, + goto out_put_src_lock; + } + +- dst_exception.inode = file_inode(dst); + dst_exception.state = dst_lock->open_context->state; + + do { + inode_lock(file_inode(dst)); +- err = _nfs42_proc_copy(src, pos_src, src_lock, +- dst, pos_dst, dst_lock, count); ++ err = _nfs42_proc_copy(src, src_lock, ++ dst, dst_lock, ++ &args, &res); + inode_unlock(file_inode(dst)); + ++ if (err >= 0) ++ break; + if (err == -ENOTSUPP) { + err = -EOPNOTSUPP; + break; +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 78ff8b6..609840d 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2708,6 +2708,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + ret = PTR_ERR(state); + if (IS_ERR(state)) + goto out; ++ ctx->state = state; + if (server->caps & NFS_CAP_POSIX_LOCK) + set_bit(NFS_STATE_POSIX_LOCKS, &state->flags); + if (opendata->o_res.rflags & NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK) +@@ -2733,7 +2734,6 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + if (ret != 0) + goto out; + +- ctx->state = state; + if (d_inode(dentry) == state->inode) { + nfs_inode_attach_open_context(ctx); + if (read_seqcount_retry(&sp->so_reclaim_seqcount, seq)) +@@ -4990,7 +4990,7 @@ static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size + */ + static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen) + { +- struct page *pages[NFS4ACL_MAXPAGES] = {NULL, }; ++ struct page *pages[NFS4ACL_MAXPAGES + 1] = {NULL, }; + struct nfs_getaclargs args = { + .fh = NFS_FH(inode), + .acl_pages = pages, +@@ -5004,13 +5004,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu + .rpc_argp = &args, + .rpc_resp = &res, + }; +- unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); ++ unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE) + 1; + int ret = -ENOMEM, i; + +- /* As long as we're doing a round trip to the server anyway, +- * let's be prepared for a page of acl data. */ +- if (npages == 0) +- npages = 1; + if (npages > ARRAY_SIZE(pages)) + return -ERANGE; + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index fc89e5e..c9c4d985 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -2492,7 +2492,7 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr, + encode_compound_hdr(xdr, req, &hdr); + encode_sequence(xdr, &args->seq_args, &hdr); + encode_putfh(xdr, args->fh, &hdr); +- replen = hdr.replen + op_decode_hdr_maxsz + 1; ++ replen = hdr.replen + op_decode_hdr_maxsz; + encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr); + + xdr_inline_pages(&req->rq_rcv_buf, replen << 2, +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 8ca642f..b829cc9 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -377,7 +377,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + __be32 err; + int host_err; + bool get_write_count; +- int size_change = 0; ++ bool size_change = (iap->ia_valid & ATTR_SIZE); + + if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +@@ -390,11 +390,11 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + /* Get inode */ + err = fh_verify(rqstp, fhp, ftype, accmode); + if (err) +- goto out; ++ return err; + if (get_write_count) { + host_err = fh_want_write(fhp); + if (host_err) +- return nfserrno(host_err); ++ goto out; + } + + dentry = fhp->fh_dentry; +@@ -405,20 +405,28 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + iap->ia_valid &= ~ATTR_MODE; + + if (!iap->ia_valid) +- goto out; ++ return 0; + + nfsd_sanitize_attrs(inode, iap); + ++ if (check_guard && guardtime != inode->i_ctime.tv_sec) ++ return nfserr_notsync; ++ + /* + * The size case is special, it changes the file in addition to the +- * attributes. ++ * attributes, and file systems don't expect it to be mixed with ++ * "random" attribute changes. We thus split out the size change ++ * into a separate call to ->setattr, and do the rest as a separate ++ * setattr call. + */ +- if (iap->ia_valid & ATTR_SIZE) { ++ if (size_change) { + err = nfsd_get_write_access(rqstp, fhp, iap); + if (err) +- goto out; +- size_change = 1; ++ return err; ++ } + ++ fh_lock(fhp); ++ if (size_change) { + /* + * RFC5661, Section 18.30.4: + * Changing the size of a file with SETATTR indirectly +@@ -426,29 +434,36 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + * + * (and similar for the older RFCs) + */ +- if (iap->ia_size != i_size_read(inode)) +- iap->ia_valid |= ATTR_MTIME; +- } ++ struct iattr size_attr = { ++ .ia_valid = ATTR_SIZE | ATTR_CTIME | ATTR_MTIME, ++ .ia_size = iap->ia_size, ++ }; + +- iap->ia_valid |= ATTR_CTIME; ++ host_err = notify_change(dentry, &size_attr, NULL); ++ if (host_err) ++ goto out_unlock; ++ iap->ia_valid &= ~ATTR_SIZE; + +- if (check_guard && guardtime != inode->i_ctime.tv_sec) { +- err = nfserr_notsync; +- goto out_put_write_access; ++ /* ++ * Avoid the additional setattr call below if the only other ++ * attribute that the client sends is the mtime, as we update ++ * it as part of the size change above. ++ */ ++ if ((iap->ia_valid & ~ATTR_MTIME) == 0) ++ goto out_unlock; + } + +- fh_lock(fhp); ++ iap->ia_valid |= ATTR_CTIME; + host_err = notify_change(dentry, iap, NULL); +- fh_unlock(fhp); +- err = nfserrno(host_err); + +-out_put_write_access: ++out_unlock: ++ fh_unlock(fhp); + if (size_change) + put_write_access(inode); +- if (!err) +- err = nfserrno(commit_metadata(fhp)); + out: +- return err; ++ if (!host_err) ++ host_err = commit_metadata(fhp); ++ return nfserrno(host_err); + } + + #if defined(CONFIG_NFSD_V4) +diff --git a/include/linux/compat.h b/include/linux/compat.h +index 6360939..d8535a4 100644 +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -711,8 +711,10 @@ int __compat_save_altstack(compat_stack_t __user *, unsigned long); + compat_stack_t __user *__uss = uss; \ + struct task_struct *t = current; \ + put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \ +- put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \ ++ put_user_ex(t->sas_ss_flags, &__uss->ss_flags); \ + put_user_ex(t->sas_ss_size, &__uss->ss_size); \ ++ if (t->sas_ss_flags & SS_AUTODISARM) \ ++ sas_ss_reset(t); \ + } while (0); + + asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid, +diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h +index 2de4e2e..e0acb0e 100644 +--- a/include/linux/devfreq.h ++++ b/include/linux/devfreq.h +@@ -104,6 +104,8 @@ struct devfreq_dev_profile { + * struct devfreq_governor - Devfreq policy governor + * @node: list node - contains registered devfreq governors + * @name: Governor's name ++ * @immutable: Immutable flag for governor. If the value is 1, ++ * this govenror is never changeable to other governor. + * @get_target_freq: Returns desired operating frequency for the device. + * Basically, get_target_freq will run + * devfreq_dev_profile.get_dev_status() to get the +@@ -121,6 +123,7 @@ struct devfreq_governor { + struct list_head node; + + const char name[DEVFREQ_NAME_LEN]; ++ const unsigned int immutable; + int (*get_target_freq)(struct devfreq *this, unsigned long *freq); + int (*event_handler)(struct devfreq *devfreq, + unsigned int event, void *data); +diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h +index 3f9778c..c332f0a 100644 +--- a/include/linux/fsl_ifc.h ++++ b/include/linux/fsl_ifc.h +@@ -733,8 +733,12 @@ struct fsl_ifc_nand { + __be32 nand_erattr1; + u32 res19[0x10]; + __be32 nand_fsr; +- u32 res20[0x3]; +- __be32 nand_eccstat[6]; ++ u32 res20; ++ /* The V1 nand_eccstat is actually 4 words that overlaps the ++ * V2 nand_eccstat. ++ */ ++ __be32 v1_nand_eccstat[2]; ++ __be32 v2_nand_eccstat[6]; + u32 res21[0x1c]; + __be32 nanndcr; + u32 res22[0x2]; +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index c92a083..192eef2f 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -641,6 +641,7 @@ struct vmbus_channel_msginfo { + + /* Synchronize the request/response if needed */ + struct completion waitevent; ++ struct vmbus_channel *waiting_channel; + union { + struct vmbus_channel_version_supported version_supported; + struct vmbus_channel_open_result open_result; +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index d49e26c..23e129e 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -153,8 +153,8 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) + #define DMA_TLB_GLOBAL_FLUSH (((u64)1) << 60) + #define DMA_TLB_DSI_FLUSH (((u64)2) << 60) + #define DMA_TLB_PSI_FLUSH (((u64)3) << 60) +-#define DMA_TLB_IIRG(type) ((type >> 60) & 7) +-#define DMA_TLB_IAIG(val) (((val) >> 57) & 7) ++#define DMA_TLB_IIRG(type) ((type >> 60) & 3) ++#define DMA_TLB_IAIG(val) (((val) >> 57) & 3) + #define DMA_TLB_READ_DRAIN (((u64)1) << 49) + #define DMA_TLB_WRITE_DRAIN (((u64)1) << 48) + #define DMA_TLB_DID(id) (((u64)((id) & 0xffff)) << 32) +@@ -164,9 +164,9 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) + + /* INVALID_DESC */ + #define DMA_CCMD_INVL_GRANU_OFFSET 61 +-#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 3) +-#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 3) +-#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 3) ++#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 4) ++#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 4) ++#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 4) + #define DMA_ID_TLB_READ_DRAIN (((u64)1) << 7) + #define DMA_ID_TLB_WRITE_DRAIN (((u64)1) << 6) + #define DMA_ID_TLB_DID(id) (((u64)((id & 0xffff) << 16))) +@@ -316,8 +316,8 @@ enum { + #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) + #define QI_DEV_EIOTLB_GLOB(g) ((u64)g) + #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) +-#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32) +-#define QI_DEV_EIOTLB_QDEP(qd) (((qd) & 0x1f) << 16) ++#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) ++#define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) + #define QI_DEV_EIOTLB_MAX_INVS 32 + + #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55) +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index f99c993..7e273e2 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -779,7 +779,7 @@ static inline struct pglist_data *lruvec_pgdat(struct lruvec *lruvec) + #endif + } + +-extern unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru); ++extern unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone_idx); + + #ifdef CONFIG_HAVE_MEMORY_PRESENT + void memory_present(int nid, unsigned long start, unsigned long end); +diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h +index 5ee7aab..fd0e532 100644 +--- a/include/rdma/ib_sa.h ++++ b/include/rdma/ib_sa.h +@@ -153,12 +153,12 @@ struct ib_sa_path_rec { + union ib_gid sgid; + __be16 dlid; + __be16 slid; +- int raw_traffic; ++ u8 raw_traffic; + /* reserved */ + __be32 flow_label; + u8 hop_limit; + u8 traffic_class; +- int reversible; ++ u8 reversible; + u8 numb_path; + __be16 pkey; + __be16 qos_class; +@@ -220,7 +220,7 @@ struct ib_sa_mcmember_rec { + u8 hop_limit; + u8 scope; + u8 join_state; +- int proxy_join; ++ u8 proxy_join; + }; + + /* Service Record Component Mask Sec 15.2.5.14 Ver 1.1 */ +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h +index 8a95631..b9ec493 100644 +--- a/include/scsi/scsi_device.h ++++ b/include/scsi/scsi_device.h +@@ -315,6 +315,7 @@ extern void scsi_remove_device(struct scsi_device *); + extern int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh); + void scsi_attach_vpd(struct scsi_device *sdev); + ++extern struct scsi_device *scsi_device_from_queue(struct request_queue *q); + extern int scsi_device_get(struct scsi_device *); + extern void scsi_device_put(struct scsi_device *); + extern struct scsi_device *scsi_device_lookup(struct Scsi_Host *, +diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h +index dc10c52..393362b 100644 +--- a/include/soc/at91/at91sam9_ddrsdr.h ++++ b/include/soc/at91/at91sam9_ddrsdr.h +@@ -81,6 +81,7 @@ + #define AT91_DDRSDRC_LPCB_POWER_DOWN 2 + #define AT91_DDRSDRC_LPCB_DEEP_POWER_DOWN 3 + #define AT91_DDRSDRC_CLKFR (1 << 2) /* Clock Frozen */ ++#define AT91_DDRSDRC_LPDDR2_PWOFF (1 << 3) /* LPDDR Power Off */ + #define AT91_DDRSDRC_PASR (7 << 4) /* Partial Array Self Refresh */ + #define AT91_DDRSDRC_TCSR (3 << 8) /* Temperature Compensated Self Refresh */ + #define AT91_DDRSDRC_DS (3 << 10) /* Drive Strength */ +@@ -96,7 +97,9 @@ + #define AT91_DDRSDRC_MD_SDR 0 + #define AT91_DDRSDRC_MD_LOW_POWER_SDR 1 + #define AT91_DDRSDRC_MD_LOW_POWER_DDR 3 ++#define AT91_DDRSDRC_MD_LPDDR3 5 + #define AT91_DDRSDRC_MD_DDR2 6 /* [SAM9 Only] */ ++#define AT91_DDRSDRC_MD_LPDDR2 7 + #define AT91_DDRSDRC_DBW (1 << 4) /* Data Bus Width */ + #define AT91_DDRSDRC_DBW_32BITS (0 << 4) + #define AT91_DDRSDRC_DBW_16BITS (1 << 4) +diff --git a/ipc/shm.c b/ipc/shm.c +index dbac886..e2072ae 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -1085,8 +1085,8 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) + * "raddr" thing points to kernel space, and there has to be a wrapper around + * this. + */ +-long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, +- unsigned long shmlba) ++long do_shmat(int shmid, char __user *shmaddr, int shmflg, ++ ulong *raddr, unsigned long shmlba) + { + struct shmid_kernel *shp; + unsigned long addr; +@@ -1107,8 +1107,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, + goto out; + else if ((addr = (ulong)shmaddr)) { + if (addr & (shmlba - 1)) { +- if (shmflg & SHM_RND) +- addr &= ~(shmlba - 1); /* round down */ ++ /* ++ * Round down to the nearest multiple of shmlba. ++ * For sane do_mmap_pgoff() parameters, avoid ++ * round downs that trigger nil-page and MAP_FIXED. ++ */ ++ if ((shmflg & SHM_RND) && addr >= shmlba) ++ addr &= ~(shmlba - 1); + else + #ifndef __ARCH_FORCE_SHMLBA + if (addr & ~PAGE_MASK) +diff --git a/kernel/membarrier.c b/kernel/membarrier.c +index 536c727..9f9284f 100644 +--- a/kernel/membarrier.c ++++ b/kernel/membarrier.c +@@ -16,6 +16,7 @@ + + #include <linux/syscalls.h> + #include <linux/membarrier.h> ++#include <linux/tick.h> + + /* + * Bitmask made from a "or" of all commands within enum membarrier_cmd, +@@ -51,6 +52,9 @@ + */ + SYSCALL_DEFINE2(membarrier, int, cmd, int, flags) + { ++ /* MEMBARRIER_CMD_SHARED is not compatible with nohz_full. */ ++ if (tick_nohz_full_enabled()) ++ return -ENOSYS; + if (unlikely(flags)) + return -EINVAL; + switch (cmd) { +diff --git a/kernel/memremap.c b/kernel/memremap.c +index 9ecedc2..0612323 100644 +--- a/kernel/memremap.c ++++ b/kernel/memremap.c +@@ -246,9 +246,13 @@ static void devm_memremap_pages_release(struct device *dev, void *data) + /* pages are dead and unused, undo the arch mapping */ + align_start = res->start & ~(SECTION_SIZE - 1); + align_size = ALIGN(resource_size(res), SECTION_SIZE); ++ ++ lock_device_hotplug(); + mem_hotplug_begin(); + arch_remove_memory(align_start, align_size); + mem_hotplug_done(); ++ unlock_device_hotplug(); ++ + untrack_pfn(NULL, PHYS_PFN(align_start), align_size); + pgmap_radix_release(res); + dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc, +@@ -360,9 +364,11 @@ void *devm_memremap_pages(struct device *dev, struct resource *res, + if (error) + goto err_pfn_remap; + ++ lock_device_hotplug(); + mem_hotplug_begin(); + error = arch_add_memory(nid, align_start, align_size, true); + mem_hotplug_done(); ++ unlock_device_hotplug(); + if (error) + goto err_add_memory; + +diff --git a/kernel/signal.c b/kernel/signal.c +index 75761ac..0b14157 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -3226,10 +3226,17 @@ int compat_restore_altstack(const compat_stack_t __user *uss) + + int __compat_save_altstack(compat_stack_t __user *uss, unsigned long sp) + { ++ int err; + struct task_struct *t = current; +- return __put_user(ptr_to_compat((void __user *)t->sas_ss_sp), &uss->ss_sp) | +- __put_user(sas_ss_flags(sp), &uss->ss_flags) | ++ err = __put_user(ptr_to_compat((void __user *)t->sas_ss_sp), ++ &uss->ss_sp) | ++ __put_user(t->sas_ss_flags, &uss->ss_flags) | + __put_user(t->sas_ss_size, &uss->ss_size); ++ if (err) ++ return err; ++ if (t->sas_ss_flags & SS_AUTODISARM) ++ sas_ss_reset(t); ++ return 0; + } + #endif + +diff --git a/mm/filemap.c b/mm/filemap.c +index d8d7df8..edfb90e 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -910,9 +910,12 @@ void page_endio(struct page *page, bool is_write, int err) + unlock_page(page); + } else { + if (err) { ++ struct address_space *mapping; ++ + SetPageError(page); +- if (page->mapping) +- mapping_set_error(page->mapping, err); ++ mapping = page_mapping(page); ++ if (mapping) ++ mapping_set_error(mapping, err); + } + end_page_writeback(page); + } +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index f4a02e2..1460e6a 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2858,7 +2858,7 @@ bool zone_watermark_ok_safe(struct zone *z, unsigned int order, + #ifdef CONFIG_NUMA + static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone) + { +- return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) < ++ return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <= + RECLAIM_DISTANCE; + } + #else /* CONFIG_NUMA */ +diff --git a/mm/vmpressure.c b/mm/vmpressure.c +index 149fdf6..6063581 100644 +--- a/mm/vmpressure.c ++++ b/mm/vmpressure.c +@@ -112,9 +112,16 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, + unsigned long reclaimed) + { + unsigned long scale = scanned + reclaimed; +- unsigned long pressure; ++ unsigned long pressure = 0; + + /* ++ * reclaimed can be greater than scanned in cases ++ * like THP, where the scanned is 1 and reclaimed ++ * could be 512 ++ */ ++ if (reclaimed >= scanned) ++ goto out; ++ /* + * We calculate the ratio (in percents) of how many pages were + * scanned vs. reclaimed in a given time frame (window). Note that + * time is in VM reclaimer's "ticks", i.e. number of pages +@@ -124,6 +131,7 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, + pressure = scale - (reclaimed * scale / scanned); + pressure = pressure * 100 / scale; + ++out: + pr_debug("%s: %3lu (s: %lu r: %lu)\n", __func__, pressure, + scanned, reclaimed); + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index fa30010..30a88b9 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -234,22 +234,39 @@ bool pgdat_reclaimable(struct pglist_data *pgdat) + pgdat_reclaimable_pages(pgdat) * 6; + } + +-unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru) ++/** ++ * lruvec_lru_size - Returns the number of pages on the given LRU list. ++ * @lruvec: lru vector ++ * @lru: lru to use ++ * @zone_idx: zones to consider (use MAX_NR_ZONES for the whole LRU list) ++ */ ++unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone_idx) + { ++ unsigned long lru_size; ++ int zid; ++ + if (!mem_cgroup_disabled()) +- return mem_cgroup_get_lru_size(lruvec, lru); ++ lru_size = mem_cgroup_get_lru_size(lruvec, lru); ++ else ++ lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); + +- return node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); +-} ++ for (zid = zone_idx + 1; zid < MAX_NR_ZONES; zid++) { ++ struct zone *zone = &lruvec_pgdat(lruvec)->node_zones[zid]; ++ unsigned long size; + +-unsigned long lruvec_zone_lru_size(struct lruvec *lruvec, enum lru_list lru, +- int zone_idx) +-{ +- if (!mem_cgroup_disabled()) +- return mem_cgroup_get_zone_lru_size(lruvec, lru, zone_idx); ++ if (!managed_zone(zone)) ++ continue; ++ ++ if (!mem_cgroup_disabled()) ++ size = mem_cgroup_get_zone_lru_size(lruvec, lru, zid); ++ else ++ size = zone_page_state(&lruvec_pgdat(lruvec)->node_zones[zid], ++ NR_ZONE_LRU_BASE + lru); ++ lru_size -= min(size, lru_size); ++ } ++ ++ return lru_size; + +- return zone_page_state(&lruvec_pgdat(lruvec)->node_zones[zone_idx], +- NR_ZONE_LRU_BASE + lru); + } + + /* +@@ -2028,11 +2045,10 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, + struct scan_control *sc) + { + unsigned long inactive_ratio; +- unsigned long inactive; +- unsigned long active; ++ unsigned long inactive, active; ++ enum lru_list inactive_lru = file * LRU_FILE; ++ enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE; + unsigned long gb; +- struct pglist_data *pgdat = lruvec_pgdat(lruvec); +- int zid; + + /* + * If we don't have swap space, anonymous page deactivation +@@ -2041,27 +2057,8 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, + if (!file && !total_swap_pages) + return false; + +- inactive = lruvec_lru_size(lruvec, file * LRU_FILE); +- active = lruvec_lru_size(lruvec, file * LRU_FILE + LRU_ACTIVE); +- +- /* +- * For zone-constrained allocations, it is necessary to check if +- * deactivations are required for lowmem to be reclaimed. This +- * calculates the inactive/active pages available in eligible zones. +- */ +- for (zid = sc->reclaim_idx + 1; zid < MAX_NR_ZONES; zid++) { +- struct zone *zone = &pgdat->node_zones[zid]; +- unsigned long inactive_zone, active_zone; +- +- if (!managed_zone(zone)) +- continue; +- +- inactive_zone = lruvec_zone_lru_size(lruvec, file * LRU_FILE, zid); +- active_zone = lruvec_zone_lru_size(lruvec, (file * LRU_FILE) + LRU_ACTIVE, zid); +- +- inactive -= min(inactive, inactive_zone); +- active -= min(active, active_zone); +- } ++ inactive = lruvec_lru_size(lruvec, inactive_lru, sc->reclaim_idx); ++ active = lruvec_lru_size(lruvec, active_lru, sc->reclaim_idx); + + gb = (inactive + active) >> (30 - PAGE_SHIFT); + if (gb) +@@ -2208,7 +2205,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, + * system is under heavy pressure. + */ + if (!inactive_list_is_low(lruvec, true, sc) && +- lruvec_lru_size(lruvec, LRU_INACTIVE_FILE) >> sc->priority) { ++ lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) >> sc->priority) { + scan_balance = SCAN_FILE; + goto out; + } +@@ -2234,10 +2231,10 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, + * anon in [0], file in [1] + */ + +- anon = lruvec_lru_size(lruvec, LRU_ACTIVE_ANON) + +- lruvec_lru_size(lruvec, LRU_INACTIVE_ANON); +- file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE) + +- lruvec_lru_size(lruvec, LRU_INACTIVE_FILE); ++ anon = lruvec_lru_size(lruvec, LRU_ACTIVE_ANON, MAX_NR_ZONES) + ++ lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, MAX_NR_ZONES); ++ file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, MAX_NR_ZONES) + ++ lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, MAX_NR_ZONES); + + spin_lock_irq(&pgdat->lru_lock); + if (unlikely(reclaim_stat->recent_scanned[0] > anon / 4)) { +@@ -2275,7 +2272,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, + unsigned long size; + unsigned long scan; + +- size = lruvec_lru_size(lruvec, lru); ++ size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); + scan = size >> sc->priority; + + if (!scan && pass && force_scan) +diff --git a/mm/workingset.c b/mm/workingset.c +index fb1f918..33f6f4d 100644 +--- a/mm/workingset.c ++++ b/mm/workingset.c +@@ -266,7 +266,7 @@ bool workingset_refault(void *shadow) + } + lruvec = mem_cgroup_lruvec(pgdat, memcg); + refault = atomic_long_read(&lruvec->inactive_age); +- active_file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE); ++ active_file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, MAX_NR_ZONES); + rcu_read_unlock(); + + /* +diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c +index e6ae15b..0ffeb60 100644 +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -672,7 +672,8 @@ void osd_req_op_extent_update(struct ceph_osd_request *osd_req, + BUG_ON(length > previous); + + op->extent.length = length; +- op->indata_len -= previous - length; ++ if (op->op == CEPH_OSD_OP_WRITE || op->op == CEPH_OSD_OP_WRITEFULL) ++ op->indata_len -= previous - length; + } + EXPORT_SYMBOL(osd_req_op_extent_update); + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 0f87e5d..6bd1508 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -85,11 +85,11 @@ static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock); + static __read_mostly bool nf_conntrack_locks_all; + + /* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */ +-#define GC_MAX_BUCKETS_DIV 64u +-/* upper bound of scan intervals */ +-#define GC_INTERVAL_MAX (2 * HZ) +-/* maximum conntracks to evict per gc run */ +-#define GC_MAX_EVICTS 256u ++#define GC_MAX_BUCKETS_DIV 128u ++/* upper bound of full table scan */ ++#define GC_MAX_SCAN_JIFFIES (16u * HZ) ++/* desired ratio of entries found to be expired */ ++#define GC_EVICT_RATIO 50u + + static struct conntrack_gc_work conntrack_gc_work; + +@@ -938,6 +938,7 @@ static noinline int early_drop(struct net *net, unsigned int _hash) + + static void gc_worker(struct work_struct *work) + { ++ unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); + unsigned int i, goal, buckets = 0, expired_count = 0; + struct conntrack_gc_work *gc_work; + unsigned int ratio, scanned = 0; +@@ -979,8 +980,7 @@ static void gc_worker(struct work_struct *work) + */ + rcu_read_unlock(); + cond_resched_rcu_qs(); +- } while (++buckets < goal && +- expired_count < GC_MAX_EVICTS); ++ } while (++buckets < goal); + + if (gc_work->exiting) + return; +@@ -997,27 +997,25 @@ static void gc_worker(struct work_struct *work) + * 1. Minimize time until we notice a stale entry + * 2. Maximize scan intervals to not waste cycles + * +- * Normally, expired_count will be 0, this increases the next_run time +- * to priorize 2) above. ++ * Normally, expire ratio will be close to 0. + * +- * As soon as a timed-out entry is found, move towards 1) and increase +- * the scan frequency. +- * In case we have lots of evictions next scan is done immediately. ++ * As soon as a sizeable fraction of the entries have expired ++ * increase scan frequency. + */ + ratio = scanned ? expired_count * 100 / scanned : 0; +- if (ratio >= 90 || expired_count == GC_MAX_EVICTS) { +- gc_work->next_gc_run = 0; +- next_run = 0; +- } else if (expired_count) { +- gc_work->next_gc_run /= 2U; +- next_run = msecs_to_jiffies(1); ++ if (ratio > GC_EVICT_RATIO) { ++ gc_work->next_gc_run = min_interval; + } else { +- if (gc_work->next_gc_run < GC_INTERVAL_MAX) +- gc_work->next_gc_run += msecs_to_jiffies(1); ++ unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV; + +- next_run = gc_work->next_gc_run; ++ BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0); ++ ++ gc_work->next_gc_run += min_interval; ++ if (gc_work->next_gc_run > max) ++ gc_work->next_gc_run = max; + } + ++ next_run = gc_work->next_gc_run; + gc_work->last_bucket = i; + queue_delayed_work(system_long_wq, &gc_work->dwork, next_run); + } +@@ -1025,7 +1023,7 @@ static void gc_worker(struct work_struct *work) + static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work) + { + INIT_DELAYED_WORK(&gc_work->dwork, gc_worker); +- gc_work->next_gc_run = GC_INTERVAL_MAX; ++ gc_work->next_gc_run = HZ; + gc_work->exiting = false; + } + +@@ -1918,7 +1916,7 @@ int nf_conntrack_init_start(void) + nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED); + + conntrack_gc_work_init(&conntrack_gc_work); +- queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, GC_INTERVAL_MAX); ++ queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, HZ); + + return 0; + +diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c +index d987c2d..f57c9f0 100644 +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -125,14 +125,34 @@ void rpcrdma_set_max_header_sizes(struct rpcrdma_xprt *r_xprt) + /* The client can send a request inline as long as the RPCRDMA header + * plus the RPC call fit under the transport's inline limit. If the + * combined call message size exceeds that limit, the client must use +- * the read chunk list for this operation. ++ * a Read chunk for this operation. ++ * ++ * A Read chunk is also required if sending the RPC call inline would ++ * exceed this device's max_sge limit. + */ + static bool rpcrdma_args_inline(struct rpcrdma_xprt *r_xprt, + struct rpc_rqst *rqst) + { +- struct rpcrdma_ia *ia = &r_xprt->rx_ia; ++ struct xdr_buf *xdr = &rqst->rq_snd_buf; ++ unsigned int count, remaining, offset; ++ ++ if (xdr->len > r_xprt->rx_ia.ri_max_inline_write) ++ return false; ++ ++ if (xdr->page_len) { ++ remaining = xdr->page_len; ++ offset = xdr->page_base & ~PAGE_MASK; ++ count = 0; ++ while (remaining) { ++ remaining -= min_t(unsigned int, ++ PAGE_SIZE - offset, remaining); ++ offset = 0; ++ if (++count > r_xprt->rx_ia.ri_max_send_sges) ++ return false; ++ } ++ } + +- return rqst->rq_snd_buf.len <= ia->ri_max_inline_write; ++ return true; + } + + /* The client can't know how large the actual reply will be. Thus it +@@ -186,9 +206,9 @@ rpcrdma_convert_kvec(struct kvec *vec, struct rpcrdma_mr_seg *seg, int n) + */ + + static int +-rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos, +- enum rpcrdma_chunktype type, struct rpcrdma_mr_seg *seg, +- bool reminv_expected) ++rpcrdma_convert_iovs(struct rpcrdma_xprt *r_xprt, struct xdr_buf *xdrbuf, ++ unsigned int pos, enum rpcrdma_chunktype type, ++ struct rpcrdma_mr_seg *seg) + { + int len, n, p, page_base; + struct page **ppages; +@@ -226,22 +246,21 @@ rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos, + if (len && n == RPCRDMA_MAX_SEGS) + goto out_overflow; + +- /* When encoding the read list, the tail is always sent inline */ +- if (type == rpcrdma_readch) ++ /* When encoding a Read chunk, the tail iovec contains an ++ * XDR pad and may be omitted. ++ */ ++ if (type == rpcrdma_readch && r_xprt->rx_ia.ri_implicit_roundup) + return n; + +- /* When encoding the Write list, some servers need to see an extra +- * segment for odd-length Write chunks. The upper layer provides +- * space in the tail iovec for this purpose. ++ /* When encoding a Write chunk, some servers need to see an ++ * extra segment for non-XDR-aligned Write chunks. The upper ++ * layer provides space in the tail iovec that may be used ++ * for this purpose. + */ +- if (type == rpcrdma_writech && reminv_expected) ++ if (type == rpcrdma_writech && r_xprt->rx_ia.ri_implicit_roundup) + return n; + + if (xdrbuf->tail[0].iov_len) { +- /* the rpcrdma protocol allows us to omit any trailing +- * xdr pad bytes, saving the server an RDMA operation. */ +- if (xdrbuf->tail[0].iov_len < 4 && xprt_rdma_pad_optimize) +- return n; + n = rpcrdma_convert_kvec(&xdrbuf->tail[0], seg, n); + if (n == RPCRDMA_MAX_SEGS) + goto out_overflow; +@@ -293,7 +312,8 @@ rpcrdma_encode_read_list(struct rpcrdma_xprt *r_xprt, + if (rtype == rpcrdma_areadch) + pos = 0; + seg = req->rl_segments; +- nsegs = rpcrdma_convert_iovs(&rqst->rq_snd_buf, pos, rtype, seg, false); ++ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_snd_buf, pos, ++ rtype, seg); + if (nsegs < 0) + return ERR_PTR(nsegs); + +@@ -355,10 +375,9 @@ rpcrdma_encode_write_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req, + } + + seg = req->rl_segments; +- nsegs = rpcrdma_convert_iovs(&rqst->rq_rcv_buf, ++ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_rcv_buf, + rqst->rq_rcv_buf.head[0].iov_len, +- wtype, seg, +- r_xprt->rx_ia.ri_reminv_expected); ++ wtype, seg); + if (nsegs < 0) + return ERR_PTR(nsegs); + +@@ -423,8 +442,7 @@ rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt, + } + + seg = req->rl_segments; +- nsegs = rpcrdma_convert_iovs(&rqst->rq_rcv_buf, 0, wtype, seg, +- r_xprt->rx_ia.ri_reminv_expected); ++ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_rcv_buf, 0, wtype, seg); + if (nsegs < 0) + return ERR_PTR(nsegs); + +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index ed5e285..fa324fe 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -67,7 +67,7 @@ unsigned int xprt_rdma_max_inline_read = RPCRDMA_DEF_INLINE; + static unsigned int xprt_rdma_max_inline_write = RPCRDMA_DEF_INLINE; + static unsigned int xprt_rdma_inline_write_padding; + static unsigned int xprt_rdma_memreg_strategy = RPCRDMA_FRMR; +- int xprt_rdma_pad_optimize = 1; ++ int xprt_rdma_pad_optimize = 0; + + #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 8da7f6a..e2c37061 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -208,6 +208,7 @@ rpcrdma_update_connect_private(struct rpcrdma_xprt *r_xprt, + + /* Default settings for RPC-over-RDMA Version One */ + r_xprt->rx_ia.ri_reminv_expected = false; ++ r_xprt->rx_ia.ri_implicit_roundup = xprt_rdma_pad_optimize; + rsize = RPCRDMA_V1_DEF_INLINE_SIZE; + wsize = RPCRDMA_V1_DEF_INLINE_SIZE; + +@@ -215,6 +216,7 @@ rpcrdma_update_connect_private(struct rpcrdma_xprt *r_xprt, + pmsg->cp_magic == rpcrdma_cmp_magic && + pmsg->cp_version == RPCRDMA_CMP_VERSION) { + r_xprt->rx_ia.ri_reminv_expected = true; ++ r_xprt->rx_ia.ri_implicit_roundup = true; + rsize = rpcrdma_decode_buffer_size(pmsg->cp_send_size); + wsize = rpcrdma_decode_buffer_size(pmsg->cp_recv_size); + } +@@ -477,18 +479,19 @@ rpcrdma_ia_close(struct rpcrdma_ia *ia) + */ + int + rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, +- struct rpcrdma_create_data_internal *cdata) ++ struct rpcrdma_create_data_internal *cdata) + { + struct rpcrdma_connect_private *pmsg = &ep->rep_cm_private; ++ unsigned int max_qp_wr, max_sge; + struct ib_cq *sendcq, *recvcq; +- unsigned int max_qp_wr; + int rc; + +- if (ia->ri_device->attrs.max_sge < RPCRDMA_MAX_SEND_SGES) { +- dprintk("RPC: %s: insufficient sge's available\n", +- __func__); ++ max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES); ++ if (max_sge < RPCRDMA_MIN_SEND_SGES) { ++ pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge); + return -ENOMEM; + } ++ ia->ri_max_send_sges = max_sge - RPCRDMA_MIN_SEND_SGES; + + if (ia->ri_device->attrs.max_qp_wr <= RPCRDMA_BACKWARD_WRS) { + dprintk("RPC: %s: insufficient wqe's available\n", +@@ -513,7 +516,7 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, + ep->rep_attr.cap.max_recv_wr = cdata->max_requests; + ep->rep_attr.cap.max_recv_wr += RPCRDMA_BACKWARD_WRS; + ep->rep_attr.cap.max_recv_wr += 1; /* drain cqe */ +- ep->rep_attr.cap.max_send_sge = RPCRDMA_MAX_SEND_SGES; ++ ep->rep_attr.cap.max_send_sge = max_sge; + ep->rep_attr.cap.max_recv_sge = 1; + ep->rep_attr.cap.max_inline_data = 0; + ep->rep_attr.sq_sig_type = IB_SIGNAL_REQ_WR; +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index f6ae1b2..48989d5 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -74,7 +74,9 @@ struct rpcrdma_ia { + unsigned int ri_max_frmr_depth; + unsigned int ri_max_inline_write; + unsigned int ri_max_inline_read; ++ unsigned int ri_max_send_sges; + bool ri_reminv_expected; ++ bool ri_implicit_roundup; + struct ib_qp_attr ri_qp_attr; + struct ib_qp_init_attr ri_qp_init_attr; + }; +@@ -309,6 +311,7 @@ struct rpcrdma_mr_seg { /* chunk descriptors */ + * - xdr_buf tail iovec + */ + enum { ++ RPCRDMA_MIN_SEND_SGES = 3, + RPCRDMA_MAX_SEND_PAGES = PAGE_SIZE + RPCRDMA_MAX_INLINE - 1, + RPCRDMA_MAX_PAGE_SGES = (RPCRDMA_MAX_SEND_PAGES >> PAGE_SHIFT) + 1, + RPCRDMA_MAX_SEND_SGES = 1 + 1 + RPCRDMA_MAX_PAGE_SGES + 1, +diff --git a/samples/seccomp/bpf-helper.h b/samples/seccomp/bpf-helper.h +index 38ee70f..1d8de9e 100644 +--- a/samples/seccomp/bpf-helper.h ++++ b/samples/seccomp/bpf-helper.h +@@ -138,7 +138,7 @@ union arg64 { + #define ARG_32(idx) \ + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)) + +-/* Loads hi into A and lo in X */ ++/* Loads lo into M[0] and hi into M[1] and A */ + #define ARG_64(idx) \ + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)), \ + BPF_STMT(BPF_ST, 0), /* lo -> M[0] */ \ +@@ -153,88 +153,107 @@ union arg64 { + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 1, 0), \ + jt + +-/* Checks the lo, then swaps to check the hi. A=lo,X=hi */ ++#define JA32(value, jt) \ ++ BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ ++ jt ++ ++#define JGE32(value, jt) \ ++ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ ++ jt ++ ++#define JGT32(value, jt) \ ++ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ ++ jt ++ ++#define JLE32(value, jt) \ ++ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ ++ jt ++ ++#define JLT32(value, jt) \ ++ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ ++ jt ++ ++/* ++ * All the JXX64 checks assume lo is saved in M[0] and hi is saved in both ++ * A and M[1]. This invariant is kept by restoring A if necessary. ++ */ + #define JEQ64(lo, hi, jt) \ ++ /* if (hi != arg.hi) goto NOMATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ /* if (lo != arg.lo) goto NOMATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 0, 2), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + + #define JNE64(lo, hi, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 5, 0), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ /* if (hi != arg.hi) goto MATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo != arg.lo) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 2, 0), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ +- +-#define JA32(value, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ +- jt ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + + #define JA64(lo, hi, jt) \ ++ /* if (hi & arg.hi) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (hi), 3, 0), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo & arg.lo) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (lo), 0, 2), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + +-#define JGE32(value, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ +- jt +- +-#define JLT32(value, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ +- jt +- +-/* Shortcut checking if hi > arg.hi. */ + #define JGE64(lo, hi, jt) \ ++ /* if (hi > arg.hi) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ ++ /* if (hi != arg.hi) goto NOMATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo >= arg.lo) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 0, 2), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ +- jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ +- +-#define JLT64(lo, hi, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ +- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ +- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + +-#define JGT32(value, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ +- jt +- +-#define JLE32(value, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ +- jt +- +-/* Check hi > args.hi first, then do the GE checking */ + #define JGT64(lo, hi, jt) \ ++ /* if (hi > arg.hi) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ ++ /* if (hi != arg.hi) goto NOMATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo > arg.lo) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 0, 2), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + + #define JLE64(lo, hi, jt) \ +- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 6, 0), \ +- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ +- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ ++ /* if (hi < arg.hi) goto MATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ ++ /* if (hi != arg.hi) goto NOMATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo <= arg.lo) goto MATCH; */ \ + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ +- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ ++ jt, \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) ++ ++#define JLT64(lo, hi, jt) \ ++ /* if (hi < arg.hi) goto MATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ ++ /* if (hi != arg.hi) goto NOMATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ ++ BPF_STMT(BPF_LD+BPF_MEM, 0), \ ++ /* if (lo < arg.lo) goto MATCH; */ \ ++ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 2, 0), \ ++ BPF_STMT(BPF_LD+BPF_MEM, 1), \ + jt, \ +- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ ++ BPF_STMT(BPF_LD+BPF_MEM, 1) + + #define LOAD_SYSCALL_NR \ + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \ +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index db25f54..df7834a 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -173,7 +173,7 @@ int ima_store_template(struct ima_template_entry *entry, int violation, + struct inode *inode, + const unsigned char *filename, int pcr); + void ima_free_template_entry(struct ima_template_entry *entry); +-const char *ima_d_path(const struct path *path, char **pathbuf); ++const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); + + /* IMA policy related functions */ + int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index 9df26a2..d01a52f 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -318,7 +318,17 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, + iint->flags |= IMA_AUDITED; + } + +-const char *ima_d_path(const struct path *path, char **pathbuf) ++/* ++ * ima_d_path - return a pointer to the full pathname ++ * ++ * Attempt to return a pointer to the full pathname for use in the ++ * IMA measurement list, IMA audit records, and auditing logs. ++ * ++ * On failure, return a pointer to a copy of the filename, not dname. ++ * Returning a pointer to dname, could result in using the pointer ++ * after the memory has been freed. ++ */ ++const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf) + { + char *pathname = NULL; + +@@ -331,5 +341,11 @@ const char *ima_d_path(const struct path *path, char **pathbuf) + pathname = NULL; + } + } +- return pathname ?: (const char *)path->dentry->d_name.name; ++ ++ if (!pathname) { ++ strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX); ++ pathname = namebuf; ++ } ++ ++ return pathname; + } +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 423d111..0e87629 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -83,6 +83,7 @@ static void ima_rdwr_violation_check(struct file *file, + const char **pathname) + { + struct inode *inode = file_inode(file); ++ char filename[NAME_MAX]; + fmode_t mode = file->f_mode; + bool send_tomtou = false, send_writers = false; + +@@ -102,7 +103,7 @@ static void ima_rdwr_violation_check(struct file *file, + if (!send_tomtou && !send_writers) + return; + +- *pathname = ima_d_path(&file->f_path, pathbuf); ++ *pathname = ima_d_path(&file->f_path, pathbuf, filename); + + if (send_tomtou) + ima_add_violation(file, *pathname, iint, +@@ -161,6 +162,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, + struct integrity_iint_cache *iint = NULL; + struct ima_template_desc *template_desc; + char *pathbuf = NULL; ++ char filename[NAME_MAX]; + const char *pathname = NULL; + int rc = -ENOMEM, action, must_appraise; + int pcr = CONFIG_IMA_MEASURE_PCR_IDX; +@@ -239,8 +241,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size, + goto out_digsig; + } + +- if (!pathname) /* ima_rdwr_violation possibly pre-fetched */ +- pathname = ima_d_path(&file->f_path, &pathbuf); ++ if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */ ++ pathname = ima_d_path(&file->f_path, &pathbuf, filename); + + if (action & IMA_MEASURE) + ima_store_measurement(iint, file, pathname, +diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c +index 1d5acbe..86240d0 100644 +--- a/sound/core/seq/seq_fifo.c ++++ b/sound/core/seq/seq_fifo.c +@@ -135,6 +135,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, + f->tail = cell; + if (f->head == NULL) + f->head = cell; ++ cell->next = NULL; + f->cells++; + spin_unlock_irqrestore(&f->lock, flags); + +@@ -214,6 +215,8 @@ void snd_seq_fifo_cell_putback(struct snd_seq_fifo *f, + spin_lock_irqsave(&f->lock, flags); + cell->next = f->head; + f->head = cell; ++ if (!f->tail) ++ f->tail = cell; + f->cells++; + spin_unlock_irqrestore(&f->lock, flags); + } +diff --git a/sound/core/timer.c b/sound/core/timer.c +index fc144f4..ad15314 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1702,9 +1702,21 @@ static int snd_timer_user_params(struct file *file, + return -EBADFD; + if (copy_from_user(¶ms, _params, sizeof(params))) + return -EFAULT; +- if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) { +- err = -EINVAL; +- goto _end; ++ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) { ++ u64 resolution; ++ ++ if (params.ticks < 1) { ++ err = -EINVAL; ++ goto _end; ++ } ++ ++ /* Don't allow resolution less than 1ms */ ++ resolution = snd_timer_resolution(tu->timeri); ++ resolution *= params.ticks; ++ if (resolution < 1000000) { ++ err = -EINVAL; ++ goto _end; ++ } + } + if (params.queue_size > 0 && + (params.queue_size < 32 || params.queue_size > 1024)) { +diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c +index 9667cbf..ab4cdab 100644 +--- a/sound/pci/ctxfi/cthw20k1.c ++++ b/sound/pci/ctxfi/cthw20k1.c +@@ -27,12 +27,6 @@ + #include "cthw20k1.h" + #include "ct20k1reg.h" + +-#if BITS_PER_LONG == 32 +-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ +-#else +-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ +-#endif +- + struct hw20k1 { + struct hw hw; + spinlock_t reg_20k1_lock; +@@ -1904,19 +1898,18 @@ static int hw_card_start(struct hw *hw) + { + int err; + struct pci_dev *pci = hw->pci; ++ const unsigned int dma_bits = BITS_PER_LONG; + + err = pci_enable_device(pci); + if (err < 0) + return err; + + /* Set DMA transfer mask */ +- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || +- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { +- dev_err(hw->card->dev, +- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", +- CT_XFI_DMA_MASK); +- err = -ENXIO; +- goto error1; ++ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { ++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); ++ } else { ++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); ++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); + } + + if (!hw->io_base) { +diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c +index 6414ecf..18ee776 100644 +--- a/sound/pci/ctxfi/cthw20k2.c ++++ b/sound/pci/ctxfi/cthw20k2.c +@@ -26,12 +26,6 @@ + #include "cthw20k2.h" + #include "ct20k2reg.h" + +-#if BITS_PER_LONG == 32 +-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ +-#else +-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ +-#endif +- + struct hw20k2 { + struct hw hw; + /* for i2c */ +@@ -2029,19 +2023,18 @@ static int hw_card_start(struct hw *hw) + int err = 0; + struct pci_dev *pci = hw->pci; + unsigned int gctl; ++ const unsigned int dma_bits = BITS_PER_LONG; + + err = pci_enable_device(pci); + if (err < 0) + return err; + + /* Set DMA transfer mask */ +- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || +- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { +- dev_err(hw->card->dev, +- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", +- CT_XFI_DMA_MASK); +- err = -ENXIO; +- goto error1; ++ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { ++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); ++ } else { ++ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); ++ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); + } + + if (!hw->io_base) { +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index c64d986..bc44626 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2197,9 +2197,9 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, + /* Lewisburg */ + { PCI_DEVICE(0x8086, 0xa1f0), +- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, + { PCI_DEVICE(0x8086, 0xa270), +- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, + /* Lynx Point-LP */ + { PCI_DEVICE(0x8086, 0x9c20), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 758ac86..0c62b1d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5577,6 +5577,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ++ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), +@@ -5692,6 +5693,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), ++ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), +@@ -6065,6 +6067,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC298_STANDARD_PINS, + {0x17, 0x90170150}), ++ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_SPK_VOLUME, ++ {0x12, 0xb7a60140}, ++ {0x13, 0xb7a60150}, ++ {0x17, 0x90170110}, ++ {0x1a, 0x03011020}, ++ {0x21, 0x03211030}), + {} + }; + +diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c +index ae58b49..ecf6236 100644 +--- a/tools/perf/util/callchain.c ++++ b/tools/perf/util/callchain.c +@@ -437,7 +437,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor) + } + call->ip = cursor_node->ip; + call->ms.sym = cursor_node->sym; +- call->ms.map = cursor_node->map; ++ call->ms.map = map__get(cursor_node->map); + list_add_tail(&call->list, &node->val); + + callchain_cursor_advance(cursor); +@@ -462,6 +462,7 @@ add_child(struct callchain_node *parent, + + list_for_each_entry_safe(call, tmp, &new->val, list) { + list_del(&call->list); ++ map__zput(call->ms.map); + free(call); + } + free(new); +@@ -730,6 +731,7 @@ merge_chain_branch(struct callchain_cursor *cursor, + callchain_cursor_append(cursor, list->ip, + list->ms.map, list->ms.sym); + list_del(&list->list); ++ map__zput(list->ms.map); + free(list); + } + +@@ -778,7 +780,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor, + } + + node->ip = ip; +- node->map = map; ++ map__zput(node->map); ++ node->map = map__get(map); + node->sym = sym; + + cursor->nr++; +@@ -945,11 +948,13 @@ static void free_callchain_node(struct callchain_node *node) + + list_for_each_entry_safe(list, tmp, &node->parent_val, list) { + list_del(&list->list); ++ map__zput(list->ms.map); + free(list); + } + + list_for_each_entry_safe(list, tmp, &node->val, list) { + list_del(&list->list); ++ map__zput(list->ms.map); + free(list); + } + +@@ -1013,6 +1018,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) + goto out; + *new = *chain; + new->has_children = false; ++ map__get(new->ms.map); + list_add_tail(&new->list, &head); + } + parent = parent->parent; +@@ -1033,6 +1039,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) + out: + list_for_each_entry_safe(chain, new, &head, list) { + list_del(&chain->list); ++ map__zput(chain->ms.map); + free(chain); + } + return -ENOMEM; +diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h +index 47cfd10..b7cbabb 100644 +--- a/tools/perf/util/callchain.h ++++ b/tools/perf/util/callchain.h +@@ -5,6 +5,7 @@ + #include <linux/list.h> + #include <linux/rbtree.h> + #include "event.h" ++#include "map.h" + #include "symbol.h" + + #define HELP_PAD "\t\t\t\t" +@@ -174,8 +175,13 @@ int callchain_merge(struct callchain_cursor *cursor, + */ + static inline void callchain_cursor_reset(struct callchain_cursor *cursor) + { ++ struct callchain_cursor_node *node; ++ + cursor->nr = 0; + cursor->last = &cursor->first; ++ ++ for (node = cursor->first; node != NULL; node = node->next) ++ map__zput(node->map); + } + + int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip, +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index a69f027..10849a0 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -1,6 +1,7 @@ + #include "util.h" + #include "build-id.h" + #include "hist.h" ++#include "map.h" + #include "session.h" + #include "sort.h" + #include "evlist.h" +@@ -1019,6 +1020,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, + int max_stack_depth, void *arg) + { + int err, err2; ++ struct map *alm = NULL; ++ ++ if (al && al->map) ++ alm = map__get(al->map); + + err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, + iter->evsel, al, max_stack_depth); +@@ -1058,6 +1063,8 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, + if (!err) + err = err2; + ++ map__put(alm); ++ + return err; + } + +diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c +index d918dcf..f138ed2 100644 +--- a/virt/kvm/arm/vgic/vgic-irqfd.c ++++ b/virt/kvm/arm/vgic/vgic-irqfd.c +@@ -99,6 +99,9 @@ int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e, + if (!vgic_has_its(kvm)) + return -ENODEV; + ++ if (!level) ++ return -1; ++ + return vgic_its_inject_msi(kvm, &msi); + } + |