diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2017-03-19 08:36:53 -0400 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2017-03-19 08:36:53 -0400 |
| commit | db4d425687c2f11a1b02baa400b30b5a170540c9 (patch) | |
| tree | 410fd6e54c007bd3ab803acead1f61e157ae7b8c /4.9.15/1013_linux-4.9.14.patch | |
| parent | grsecurity-3.1-4.9.15-201703150049 (diff) | |
| download | hardened-patchset-db4d425687c2f11a1b02baa400b30b5a170540c9.tar.gz hardened-patchset-db4d425687c2f11a1b02baa400b30b5a170540c9.tar.bz2 hardened-patchset-db4d425687c2f11a1b02baa400b30b5a170540c9.zip | |
grsecurity-3.1-4.9.16-20170318082020170318
Diffstat (limited to '4.9.15/1013_linux-4.9.14.patch')
| -rw-r--r-- | 4.9.15/1013_linux-4.9.14.patch | 6768 |
1 files changed, 0 insertions, 6768 deletions
diff --git a/4.9.15/1013_linux-4.9.14.patch b/4.9.15/1013_linux-4.9.14.patch deleted file mode 100644 index 5d8c119..0000000 --- a/4.9.15/1013_linux-4.9.14.patch +++ /dev/null @@ -1,6768 +0,0 @@ -diff --git a/Makefile b/Makefile -index 14dc275..5e7706e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 9 --SUBLEVEL = 13 -+SUBLEVEL = 14 - EXTRAVERSION = - NAME = Roaring Lionus - -diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts -index 0b9a59d..30fac04 100644 ---- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts -@@ -148,6 +148,8 @@ - uart1: serial@f8020000 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_uart1_default>; -+ atmel,use-dma-rx; -+ atmel,use-dma-tx; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -index ed7fce2..44d1171 100644 ---- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -@@ -110,6 +110,8 @@ - }; - - usart3: serial@fc00c000 { -+ atmel,use-dma-rx; -+ atmel,use-dma-tx; - status = "okay"; - }; - -diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h -index 74a44727..a58bbaa 100644 ---- a/arch/arm/include/asm/kvm_mmu.h -+++ b/arch/arm/include/asm/kvm_mmu.h -@@ -150,18 +150,12 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, - * and iterate over the range. - */ - -- bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached; -- - VM_BUG_ON(size & ~PAGE_MASK); - -- if (!need_flush && !icache_is_pipt()) -- goto vipt_cache; -- - while (size) { - void *va = kmap_atomic_pfn(pfn); - -- if (need_flush) -- kvm_flush_dcache_to_poc(va, PAGE_SIZE); -+ kvm_flush_dcache_to_poc(va, PAGE_SIZE); - - if (icache_is_pipt()) - __cpuc_coherent_user_range((unsigned long)va, -@@ -173,7 +167,6 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, - kunmap_atomic(va); - } - --vipt_cache: - if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) { - /* any kind of VIPT cache */ - __flush_icache_all(); -diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h -index 6f72fe8..6d22017 100644 ---- a/arch/arm64/include/asm/kvm_mmu.h -+++ b/arch/arm64/include/asm/kvm_mmu.h -@@ -241,8 +241,7 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, - { - void *va = page_address(pfn_to_page(pfn)); - -- if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached) -- kvm_flush_dcache_to_poc(va, size); -+ kvm_flush_dcache_to_poc(va, size); - - if (!icache_is_aliasing()) { /* PIPT */ - flush_icache_range((unsigned long)va, -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index c02504e..3a129d4 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -653,15 +653,15 @@ static u64 __raw_read_system_reg(u32 sys_id) - case SYS_ID_ISAR2_EL1: return read_cpuid(ID_ISAR2_EL1); - case SYS_ID_ISAR3_EL1: return read_cpuid(ID_ISAR3_EL1); - case SYS_ID_ISAR4_EL1: return read_cpuid(ID_ISAR4_EL1); -- case SYS_ID_ISAR5_EL1: return read_cpuid(ID_ISAR4_EL1); -+ case SYS_ID_ISAR5_EL1: return read_cpuid(ID_ISAR5_EL1); - case SYS_MVFR0_EL1: return read_cpuid(MVFR0_EL1); - case SYS_MVFR1_EL1: return read_cpuid(MVFR1_EL1); - case SYS_MVFR2_EL1: return read_cpuid(MVFR2_EL1); - - case SYS_ID_AA64PFR0_EL1: return read_cpuid(ID_AA64PFR0_EL1); -- case SYS_ID_AA64PFR1_EL1: return read_cpuid(ID_AA64PFR0_EL1); -+ case SYS_ID_AA64PFR1_EL1: return read_cpuid(ID_AA64PFR1_EL1); - case SYS_ID_AA64DFR0_EL1: return read_cpuid(ID_AA64DFR0_EL1); -- case SYS_ID_AA64DFR1_EL1: return read_cpuid(ID_AA64DFR0_EL1); -+ case SYS_ID_AA64DFR1_EL1: return read_cpuid(ID_AA64DFR1_EL1); - case SYS_ID_AA64MMFR0_EL1: return read_cpuid(ID_AA64MMFR0_EL1); - case SYS_ID_AA64MMFR1_EL1: return read_cpuid(ID_AA64MMFR1_EL1); - case SYS_ID_AA64MMFR2_EL1: return read_cpuid(ID_AA64MMFR2_EL1); -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index 02265a5..b5bf46c 100644 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -352,6 +352,13 @@ static int __swiotlb_dma_supported(struct device *hwdev, u64 mask) - return 1; - } - -+static int __swiotlb_dma_mapping_error(struct device *hwdev, dma_addr_t addr) -+{ -+ if (swiotlb) -+ return swiotlb_dma_mapping_error(hwdev, addr); -+ return 0; -+} -+ - static struct dma_map_ops swiotlb_dma_ops = { - .alloc = __dma_alloc, - .free = __dma_free, -@@ -366,7 +373,7 @@ static struct dma_map_ops swiotlb_dma_ops = { - .sync_sg_for_cpu = __swiotlb_sync_sg_for_cpu, - .sync_sg_for_device = __swiotlb_sync_sg_for_device, - .dma_supported = __swiotlb_dma_supported, -- .mapping_error = swiotlb_dma_mapping_error, -+ .mapping_error = __swiotlb_dma_mapping_error, - }; - - static int __init atomic_pool_init(void) -diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c -index 52caa75..e2f50d6 100644 ---- a/arch/mips/bcm47xx/buttons.c -+++ b/arch/mips/bcm47xx/buttons.c -@@ -17,6 +17,12 @@ - .active_low = 1, \ - } - -+#define BCM47XX_GPIO_KEY_H(_gpio, _code) \ -+ { \ -+ .code = _code, \ -+ .gpio = _gpio, \ -+ } -+ - /* Asus */ - - static const struct gpio_keys_button -@@ -79,8 +85,8 @@ bcm47xx_buttons_asus_wl500gpv2[] __initconst = { - - static const struct gpio_keys_button - bcm47xx_buttons_asus_wl500w[] __initconst = { -- BCM47XX_GPIO_KEY(6, KEY_RESTART), -- BCM47XX_GPIO_KEY(7, KEY_WPS_BUTTON), -+ BCM47XX_GPIO_KEY_H(6, KEY_RESTART), -+ BCM47XX_GPIO_KEY_H(7, KEY_WPS_BUTTON), - }; - - static const struct gpio_keys_button -diff --git a/arch/mips/cavium-octeon/octeon-memcpy.S b/arch/mips/cavium-octeon/octeon-memcpy.S -index 64e08df..8b70041 100644 ---- a/arch/mips/cavium-octeon/octeon-memcpy.S -+++ b/arch/mips/cavium-octeon/octeon-memcpy.S -@@ -208,18 +208,18 @@ EXC( STORE t2, UNIT(6)(dst), s_exc_p10u) - ADD src, src, 16*NBYTES - EXC( STORE t3, UNIT(7)(dst), s_exc_p9u) - ADD dst, dst, 16*NBYTES --EXC( LOAD t0, UNIT(-8)(src), l_exc_copy) --EXC( LOAD t1, UNIT(-7)(src), l_exc_copy) --EXC( LOAD t2, UNIT(-6)(src), l_exc_copy) --EXC( LOAD t3, UNIT(-5)(src), l_exc_copy) -+EXC( LOAD t0, UNIT(-8)(src), l_exc_copy_rewind16) -+EXC( LOAD t1, UNIT(-7)(src), l_exc_copy_rewind16) -+EXC( LOAD t2, UNIT(-6)(src), l_exc_copy_rewind16) -+EXC( LOAD t3, UNIT(-5)(src), l_exc_copy_rewind16) - EXC( STORE t0, UNIT(-8)(dst), s_exc_p8u) - EXC( STORE t1, UNIT(-7)(dst), s_exc_p7u) - EXC( STORE t2, UNIT(-6)(dst), s_exc_p6u) - EXC( STORE t3, UNIT(-5)(dst), s_exc_p5u) --EXC( LOAD t0, UNIT(-4)(src), l_exc_copy) --EXC( LOAD t1, UNIT(-3)(src), l_exc_copy) --EXC( LOAD t2, UNIT(-2)(src), l_exc_copy) --EXC( LOAD t3, UNIT(-1)(src), l_exc_copy) -+EXC( LOAD t0, UNIT(-4)(src), l_exc_copy_rewind16) -+EXC( LOAD t1, UNIT(-3)(src), l_exc_copy_rewind16) -+EXC( LOAD t2, UNIT(-2)(src), l_exc_copy_rewind16) -+EXC( LOAD t3, UNIT(-1)(src), l_exc_copy_rewind16) - EXC( STORE t0, UNIT(-4)(dst), s_exc_p4u) - EXC( STORE t1, UNIT(-3)(dst), s_exc_p3u) - EXC( STORE t2, UNIT(-2)(dst), s_exc_p2u) -@@ -383,6 +383,10 @@ done: - nop - END(memcpy) - -+l_exc_copy_rewind16: -+ /* Rewind src and dst by 16*NBYTES for l_exc_copy */ -+ SUB src, src, 16*NBYTES -+ SUB dst, dst, 16*NBYTES - l_exc_copy: - /* - * Copy bytes from src until faulting load address (or until a -diff --git a/arch/mips/include/asm/checksum.h b/arch/mips/include/asm/checksum.h -index bce1ce5..0e23197 100644 ---- a/arch/mips/include/asm/checksum.h -+++ b/arch/mips/include/asm/checksum.h -@@ -186,7 +186,9 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, - " daddu %0, %4 \n" - " dsll32 $1, %0, 0 \n" - " daddu %0, $1 \n" -+ " sltu $1, %0, $1 \n" - " dsra32 %0, %0, 0 \n" -+ " addu %0, $1 \n" - #endif - " .set pop" - : "=r" (sum) -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 9514e5f..1652f36 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -195,11 +195,9 @@ struct mips_frame_info { - #define J_TARGET(pc,target) \ - (((unsigned long)(pc) & 0xf0000000) | ((target) << 2)) - --static inline int is_ra_save_ins(union mips_instruction *ip) -+static inline int is_ra_save_ins(union mips_instruction *ip, int *poff) - { - #ifdef CONFIG_CPU_MICROMIPS -- union mips_instruction mmi; -- - /* - * swsp ra,offset - * swm16 reglist,offset(sp) -@@ -209,29 +207,71 @@ static inline int is_ra_save_ins(union mips_instruction *ip) - * - * microMIPS is way more fun... - */ -- if (mm_insn_16bit(ip->halfword[0])) { -- mmi.word = (ip->halfword[0] << 16); -- return (mmi.mm16_r5_format.opcode == mm_swsp16_op && -- mmi.mm16_r5_format.rt == 31) || -- (mmi.mm16_m_format.opcode == mm_pool16c_op && -- mmi.mm16_m_format.func == mm_swm16_op); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ switch (ip->mm16_r5_format.opcode) { -+ case mm_swsp16_op: -+ if (ip->mm16_r5_format.rt != 31) -+ return 0; -+ -+ *poff = ip->mm16_r5_format.simmediate; -+ *poff = (*poff << 2) / sizeof(ulong); -+ return 1; -+ -+ case mm_pool16c_op: -+ switch (ip->mm16_m_format.func) { -+ case mm_swm16_op: -+ *poff = ip->mm16_m_format.imm; -+ *poff += 1 + ip->mm16_m_format.rlist; -+ *poff = (*poff << 2) / sizeof(ulong); -+ return 1; -+ -+ default: -+ return 0; -+ } -+ -+ default: -+ return 0; -+ } - } -- else { -- mmi.halfword[0] = ip->halfword[1]; -- mmi.halfword[1] = ip->halfword[0]; -- return (mmi.mm_m_format.opcode == mm_pool32b_op && -- mmi.mm_m_format.rd > 9 && -- mmi.mm_m_format.base == 29 && -- mmi.mm_m_format.func == mm_swm32_func) || -- (mmi.i_format.opcode == mm_sw32_op && -- mmi.i_format.rs == 29 && -- mmi.i_format.rt == 31); -+ -+ switch (ip->i_format.opcode) { -+ case mm_sw32_op: -+ if (ip->i_format.rs != 29) -+ return 0; -+ if (ip->i_format.rt != 31) -+ return 0; -+ -+ *poff = ip->i_format.simmediate / sizeof(ulong); -+ return 1; -+ -+ case mm_pool32b_op: -+ switch (ip->mm_m_format.func) { -+ case mm_swm32_func: -+ if (ip->mm_m_format.rd < 0x10) -+ return 0; -+ if (ip->mm_m_format.base != 29) -+ return 0; -+ -+ *poff = ip->mm_m_format.simmediate; -+ *poff += (ip->mm_m_format.rd & 0xf) * sizeof(u32); -+ *poff /= sizeof(ulong); -+ return 1; -+ default: -+ return 0; -+ } -+ -+ default: -+ return 0; - } - #else - /* sw / sd $ra, offset($sp) */ -- return (ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && -- ip->i_format.rs == 29 && -- ip->i_format.rt == 31; -+ if ((ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && -+ ip->i_format.rs == 29 && ip->i_format.rt == 31) { -+ *poff = ip->i_format.simmediate / sizeof(ulong); -+ return 1; -+ } -+ -+ return 0; - #endif - } - -@@ -246,13 +286,16 @@ static inline int is_jump_ins(union mips_instruction *ip) - * - * microMIPS is kind of more fun... - */ -- union mips_instruction mmi; -- -- mmi.word = (ip->halfword[0] << 16); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ if ((ip->mm16_r5_format.opcode == mm_pool16c_op && -+ (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op)) -+ return 1; -+ return 0; -+ } - -- if ((mmi.mm16_r5_format.opcode == mm_pool16c_op && -- (mmi.mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) || -- ip->j_format.opcode == mm_jal32_op) -+ if (ip->j_format.opcode == mm_j32_op) -+ return 1; -+ if (ip->j_format.opcode == mm_jal32_op) - return 1; - if (ip->r_format.opcode != mm_pool32a_op || - ip->r_format.func != mm_pool32axf_op) -@@ -280,15 +323,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip) - * - * microMIPS is not more fun... - */ -- if (mm_insn_16bit(ip->halfword[0])) { -- union mips_instruction mmi; -- -- mmi.word = (ip->halfword[0] << 16); -- return (mmi.mm16_r3_format.opcode == mm_pool16d_op && -- mmi.mm16_r3_format.simmediate && mm_addiusp_func) || -- (mmi.mm16_r5_format.opcode == mm_pool16d_op && -- mmi.mm16_r5_format.rt == 29); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ return (ip->mm16_r3_format.opcode == mm_pool16d_op && -+ ip->mm16_r3_format.simmediate && mm_addiusp_func) || -+ (ip->mm16_r5_format.opcode == mm_pool16d_op && -+ ip->mm16_r5_format.rt == 29); - } -+ - return ip->mm_i_format.opcode == mm_addiu32_op && - ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29; - #else -@@ -303,30 +344,36 @@ static inline int is_sp_move_ins(union mips_instruction *ip) - - static int get_frame_info(struct mips_frame_info *info) - { --#ifdef CONFIG_CPU_MICROMIPS -- union mips_instruction *ip = (void *) (((char *) info->func) - 1); --#else -- union mips_instruction *ip = info->func; --#endif -- unsigned max_insns = info->func_size / sizeof(union mips_instruction); -- unsigned i; -+ bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); -+ union mips_instruction insn, *ip, *ip_end; -+ const unsigned int max_insns = 128; -+ unsigned int i; - - info->pc_offset = -1; - info->frame_size = 0; - -+ ip = (void *)msk_isa16_mode((ulong)info->func); - if (!ip) - goto err; - -- if (max_insns == 0) -- max_insns = 128U; /* unknown function size */ -- max_insns = min(128U, max_insns); -+ ip_end = (void *)ip + info->func_size; - -- for (i = 0; i < max_insns; i++, ip++) { -+ for (i = 0; i < max_insns && ip < ip_end; i++, ip++) { -+ if (is_mmips && mm_insn_16bit(ip->halfword[0])) { -+ insn.halfword[0] = 0; -+ insn.halfword[1] = ip->halfword[0]; -+ } else if (is_mmips) { -+ insn.halfword[0] = ip->halfword[1]; -+ insn.halfword[1] = ip->halfword[0]; -+ } else { -+ insn.word = ip->word; -+ } - -- if (is_jump_ins(ip)) -+ if (is_jump_ins(&insn)) - break; -+ - if (!info->frame_size) { -- if (is_sp_move_ins(ip)) -+ if (is_sp_move_ins(&insn)) - { - #ifdef CONFIG_CPU_MICROMIPS - if (mm_insn_16bit(ip->halfword[0])) -@@ -349,11 +396,9 @@ static int get_frame_info(struct mips_frame_info *info) - } - continue; - } -- if (info->pc_offset == -1 && is_ra_save_ins(ip)) { -- info->pc_offset = -- ip->i_format.simmediate / sizeof(long); -+ if (info->pc_offset == -1 && -+ is_ra_save_ins(&insn, &info->pc_offset)) - break; -- } - } - if (info->frame_size && info->pc_offset >= 0) /* nested */ - return 0; -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 236193b..9a61671 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -545,7 +545,7 @@ void __init ltq_soc_init(void) - clkdev_add_pmu("1a800000.pcie", "msi", 1, 1, PMU1_PCIE2_MSI); - clkdev_add_pmu("1a800000.pcie", "pdi", 1, 1, PMU1_PCIE2_PDI); - clkdev_add_pmu("1a800000.pcie", "ctl", 1, 1, PMU1_PCIE2_CTL); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | PMU_PPE_DP); -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | PMU_PPE_DP); - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); - clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); - } else if (of_machine_is_compatible("lantiq,ar10")) { -@@ -553,7 +553,7 @@ void __init ltq_soc_init(void) - ltq_ar10_fpi_hz(), ltq_ar10_pp32_hz()); - clkdev_add_pmu("1e101000.usb", "ctl", 1, 0, PMU_USB0); - clkdev_add_pmu("1e106000.usb", "ctl", 1, 0, PMU_USB1); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | - PMU_PPE_DP | PMU_PPE_TC); - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); - clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); -@@ -575,11 +575,11 @@ void __init ltq_soc_init(void) - clkdev_add_pmu(NULL, "ahb", 1, 0, PMU_AHBM | PMU_AHBS); - - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, - PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM | - PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 | - PMU_PPE_QSB | PMU_PPE_TOP); -- clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); -+ clkdev_add_pmu("1f203000.rcu", "gphy", 0, 0, PMU_GPHY); - clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); - clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); - clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); -diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c -index 026cb59..f293a97 100644 ---- a/arch/mips/mm/sc-ip22.c -+++ b/arch/mips/mm/sc-ip22.c -@@ -31,26 +31,40 @@ static inline void indy_sc_wipe(unsigned long first, unsigned long last) - unsigned long tmp; - - __asm__ __volatile__( -- ".set\tpush\t\t\t# indy_sc_wipe\n\t" -- ".set\tnoreorder\n\t" -- ".set\tmips3\n\t" -- ".set\tnoat\n\t" -- "mfc0\t%2, $12\n\t" -- "li\t$1, 0x80\t\t\t# Go 64 bit\n\t" -- "mtc0\t$1, $12\n\t" -- -- "dli\t$1, 0x9000000080000000\n\t" -- "or\t%0, $1\t\t\t# first line to flush\n\t" -- "or\t%1, $1\t\t\t# last line to flush\n\t" -- ".set\tat\n\t" -- -- "1:\tsw\t$0, 0(%0)\n\t" -- "bne\t%0, %1, 1b\n\t" -- " daddu\t%0, 32\n\t" -- -- "mtc0\t%2, $12\t\t\t# Back to 32 bit\n\t" -- "nop; nop; nop; nop;\n\t" -- ".set\tpop" -+ " .set push # indy_sc_wipe \n" -+ " .set noreorder \n" -+ " .set mips3 \n" -+ " .set noat \n" -+ " mfc0 %2, $12 \n" -+ " li $1, 0x80 # Go 64 bit \n" -+ " mtc0 $1, $12 \n" -+ " \n" -+ " # \n" -+ " # Open code a dli $1, 0x9000000080000000 \n" -+ " # \n" -+ " # Required because binutils 2.25 will happily accept \n" -+ " # 64 bit instructions in .set mips3 mode but puke on \n" -+ " # 64 bit constants when generating 32 bit ELF \n" -+ " # \n" -+ " lui $1,0x9000 \n" -+ " dsll $1,$1,0x10 \n" -+ " ori $1,$1,0x8000 \n" -+ " dsll $1,$1,0x10 \n" -+ " \n" -+ " or %0, $1 # first line to flush \n" -+ " or %1, $1 # last line to flush \n" -+ " .set at \n" -+ " \n" -+ "1: sw $0, 0(%0) \n" -+ " bne %0, %1, 1b \n" -+ " daddu %0, 32 \n" -+ " \n" -+ " mtc0 %2, $12 # Back to 32 bit \n" -+ " nop # pipeline hazard \n" -+ " nop \n" -+ " nop \n" -+ " nop \n" -+ " .set pop \n" - : "=r" (first), "=r" (last), "=&r" (tmp) - : "0" (first), "1" (last)); - } -diff --git a/arch/mips/pic32/pic32mzda/Makefile b/arch/mips/pic32/pic32mzda/Makefile -index 4a4c272..c286496 100644 ---- a/arch/mips/pic32/pic32mzda/Makefile -+++ b/arch/mips/pic32/pic32mzda/Makefile -@@ -2,8 +2,7 @@ - # Joshua Henderson, <joshua.henderson@microchip.com> - # Copyright (C) 2015 Microchip Technology, Inc. All rights reserved. - # --obj-y := init.o time.o config.o -+obj-y := config.o early_clk.o init.o time.o - - obj-$(CONFIG_EARLY_PRINTK) += early_console.o \ -- early_pin.o \ -- early_clk.o -+ early_pin.o -diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h -index a244e09..5d22b0b 100644 ---- a/arch/powerpc/include/asm/mmu.h -+++ b/arch/powerpc/include/asm/mmu.h -@@ -136,6 +136,7 @@ enum { - MMU_FTR_NO_SLBIE_B | MMU_FTR_16M_PAGE | MMU_FTR_TLBIEL | - MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_CI_LARGE_PAGE | - MMU_FTR_1T_SEGMENT | MMU_FTR_TLBIE_CROP_VA | -+ MMU_FTR_KERNEL_RO | - #ifdef CONFIG_PPC_RADIX_MMU - MMU_FTR_TYPE_RADIX | - #endif -diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S -index 37c027c..7803756 100644 ---- a/arch/powerpc/kernel/cpu_setup_power.S -+++ b/arch/powerpc/kernel/cpu_setup_power.S -@@ -100,6 +100,8 @@ _GLOBAL(__setup_cpu_power9) - mfspr r3,SPRN_LPCR - LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) - or r3, r3, r4 -+ LOAD_REG_IMMEDIATE(r4, LPCR_UPRT | LPCR_HR) -+ andc r3, r3, r4 - bl __init_LPCR - bl __init_HFSCR - bl __init_tlb_power9 -@@ -120,6 +122,8 @@ _GLOBAL(__restore_cpu_power9) - mfspr r3,SPRN_LPCR - LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) - or r3, r3, r4 -+ LOAD_REG_IMMEDIATE(r4, LPCR_UPRT | LPCR_HR) -+ andc r3, r3, r4 - bl __init_LPCR - bl __init_HFSCR - bl __init_tlb_power9 -diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c -index 03d089b..469d86d 100644 ---- a/arch/powerpc/kernel/hw_breakpoint.c -+++ b/arch/powerpc/kernel/hw_breakpoint.c -@@ -228,8 +228,10 @@ int hw_breakpoint_handler(struct die_args *args) - rcu_read_lock(); - - bp = __this_cpu_read(bp_per_reg); -- if (!bp) -+ if (!bp) { -+ rc = NOTIFY_DONE; - goto out; -+ } - info = counter_arch_bp(bp); - - /* -diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h -index 34684ad..b3b09b9 100644 ---- a/arch/x86/include/asm/pkeys.h -+++ b/arch/x86/include/asm/pkeys.h -@@ -46,6 +46,15 @@ extern int __arch_set_user_pkey_access(struct task_struct *tsk, int pkey, - static inline - bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) - { -+ /* -+ * "Allocated" pkeys are those that have been returned -+ * from pkey_alloc(). pkey 0 is special, and never -+ * returned from pkey_alloc(). -+ */ -+ if (pkey <= 0) -+ return false; -+ if (pkey >= arch_max_pkey()) -+ return false; - return mm_pkey_allocation_map(mm) & (1U << pkey); - } - -@@ -82,12 +91,6 @@ int mm_pkey_alloc(struct mm_struct *mm) - static inline - int mm_pkey_free(struct mm_struct *mm, int pkey) - { -- /* -- * pkey 0 is special, always allocated and can never -- * be freed. -- */ -- if (!pkey) -- return -EINVAL; - if (!mm_pkey_is_allocated(mm, pkey)) - return -EINVAL; - -diff --git a/crypto/testmgr.h b/crypto/testmgr.h -index e64a4ef..9033088 100644 ---- a/crypto/testmgr.h -+++ b/crypto/testmgr.h -@@ -22813,7 +22813,7 @@ static struct aead_testvec aes_ccm_enc_tv_template[] = { - "\x09\x75\x9a\x9b\x3c\x9b\x27\x39", - .klen = 32, - .iv = "\x03\xf9\xd9\x4e\x63\xb5\x3d\x9d" -- "\x43\xf6\x1e\x50", -+ "\x43\xf6\x1e\x50\0\0\0\0", - .assoc = "\x57\xf5\x6b\x8b\x57\x5c\x3d\x3b" - "\x13\x02\x01\x0c\x83\x4c\x96\x35" - "\x8e\xd6\x39\xcf\x7d\x14\x9b\x94" -diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c -index 2c1798e..3868823 100644 ---- a/drivers/bcma/main.c -+++ b/drivers/bcma/main.c -@@ -633,8 +633,11 @@ static int bcma_device_probe(struct device *dev) - drv); - int err = 0; - -+ get_device(dev); - if (adrv->probe) - err = adrv->probe(core); -+ if (err) -+ put_device(dev); - - return err; - } -@@ -647,6 +650,7 @@ static int bcma_device_remove(struct device *dev) - - if (adrv->remove) - adrv->remove(core); -+ put_device(dev); - - return 0; - } -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 4af8187..24d6cef 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1097,9 +1097,12 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) - return -EINVAL; - -+ /* I/O need to be drained during transfer transition */ -+ blk_mq_freeze_queue(lo->lo_queue); -+ - err = loop_release_xfer(lo); - if (err) -- return err; -+ goto exit; - - if (info->lo_encrypt_type) { - unsigned int type = info->lo_encrypt_type; -@@ -1114,12 +1117,14 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - - err = loop_init_xfer(lo, xfer, info); - if (err) -- return err; -+ goto exit; - - if (lo->lo_offset != info->lo_offset || - lo->lo_sizelimit != info->lo_sizelimit) -- if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) -- return -EFBIG; -+ if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) { -+ err = -EFBIG; -+ goto exit; -+ } - - loop_config_discard(lo); - -@@ -1137,13 +1142,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - (info->lo_flags & LO_FLAGS_AUTOCLEAR)) - lo->lo_flags ^= LO_FLAGS_AUTOCLEAR; - -- if ((info->lo_flags & LO_FLAGS_PARTSCAN) && -- !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { -- lo->lo_flags |= LO_FLAGS_PARTSCAN; -- lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; -- loop_reread_partitions(lo, lo->lo_device); -- } -- - lo->lo_encrypt_key_size = info->lo_encrypt_key_size; - lo->lo_init[0] = info->lo_init[0]; - lo->lo_init[1] = info->lo_init[1]; -@@ -1156,7 +1154,17 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - /* update dio if lo_offset or transfer is changed */ - __loop_update_dio(lo, lo->use_dio); - -- return 0; -+ exit: -+ blk_mq_unfreeze_queue(lo->lo_queue); -+ -+ if (!err && (info->lo_flags & LO_FLAGS_PARTSCAN) && -+ !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { -+ lo->lo_flags |= LO_FLAGS_PARTSCAN; -+ lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; -+ loop_reread_partitions(lo, lo->lo_device); -+ } -+ -+ return err; - } - - static int -diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c -index eaf5730..8022bea 100644 ---- a/drivers/char/tpm/tpm_tis.c -+++ b/drivers/char/tpm/tpm_tis.c -@@ -421,7 +421,7 @@ static int __init init_tis(void) - acpi_bus_unregister_driver(&tis_acpi_driver); - err_acpi: - #endif -- platform_device_unregister(force_pdev); -+ platform_driver_unregister(&tis_drv); - err_platform: - if (force_pdev) - platform_device_unregister(force_pdev); -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index 712592c..7309c08 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -130,7 +130,7 @@ static void devfreq_set_freq_table(struct devfreq *devfreq) - * @devfreq: the devfreq instance - * @freq: the update target frequency - */ --static int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) -+int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) - { - int lev, prev_lev, ret = 0; - unsigned long cur_time; -@@ -166,6 +166,7 @@ static int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) - devfreq->last_stat_updated = cur_time; - return ret; - } -+EXPORT_SYMBOL(devfreq_update_status); - - /** - * find_devfreq_governor() - find devfreq governor from name -@@ -939,6 +940,9 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr, - if (df->governor == governor) { - ret = 0; - goto out; -+ } else if (df->governor->immutable || governor->immutable) { -+ ret = -EINVAL; -+ goto out; - } - - if (df->governor) { -@@ -968,13 +972,33 @@ static ssize_t available_governors_show(struct device *d, - struct device_attribute *attr, - char *buf) - { -- struct devfreq_governor *tmp_governor; -+ struct devfreq *df = to_devfreq(d); - ssize_t count = 0; - - mutex_lock(&devfreq_list_lock); -- list_for_each_entry(tmp_governor, &devfreq_governor_list, node) -- count += scnprintf(&buf[count], (PAGE_SIZE - count - 2), -- "%s ", tmp_governor->name); -+ -+ /* -+ * The devfreq with immutable governor (e.g., passive) shows -+ * only own governor. -+ */ -+ if (df->governor->immutable) { -+ count = scnprintf(&buf[count], DEVFREQ_NAME_LEN, -+ "%s ", df->governor_name); -+ /* -+ * The devfreq device shows the registered governor except for -+ * immutable governors such as passive governor . -+ */ -+ } else { -+ struct devfreq_governor *governor; -+ -+ list_for_each_entry(governor, &devfreq_governor_list, node) { -+ if (governor->immutable) -+ continue; -+ count += scnprintf(&buf[count], (PAGE_SIZE - count - 2), -+ "%s ", governor->name); -+ } -+ } -+ - mutex_unlock(&devfreq_list_lock); - - /* Truncate the trailing space */ -diff --git a/drivers/devfreq/governor.h b/drivers/devfreq/governor.h -index fad7d63..71576b8 100644 ---- a/drivers/devfreq/governor.h -+++ b/drivers/devfreq/governor.h -@@ -38,4 +38,6 @@ extern void devfreq_interval_update(struct devfreq *devfreq, - extern int devfreq_add_governor(struct devfreq_governor *governor); - extern int devfreq_remove_governor(struct devfreq_governor *governor); - -+extern int devfreq_update_status(struct devfreq *devfreq, unsigned long freq); -+ - #endif /* _GOVERNOR_H */ -diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c -index 9ef46e2..5be96b2 100644 ---- a/drivers/devfreq/governor_passive.c -+++ b/drivers/devfreq/governor_passive.c -@@ -112,6 +112,11 @@ static int update_devfreq_passive(struct devfreq *devfreq, unsigned long freq) - if (ret < 0) - goto out; - -+ if (devfreq->profile->freq_table -+ && (devfreq_update_status(devfreq, freq))) -+ dev_err(&devfreq->dev, -+ "Couldn't update frequency transition information.\n"); -+ - devfreq->previous_freq = freq; - - out: -@@ -179,6 +184,7 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq, - - static struct devfreq_governor devfreq_passive = { - .name = "passive", -+ .immutable = 1, - .get_target_freq = devfreq_passive_get_target_freq, - .event_handler = devfreq_passive_event_handler, - }; -diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c -index dd184b5..2846278 100644 ---- a/drivers/dma/ipu/ipu_irq.c -+++ b/drivers/dma/ipu/ipu_irq.c -@@ -272,7 +272,7 @@ static void ipu_irq_handler(struct irq_desc *desc) - u32 status; - int i, line; - -- for (i = IPU_IRQ_NR_FN_BANKS; i < IPU_IRQ_NR_BANKS; i++) { -+ for (i = 0; i < IPU_IRQ_NR_BANKS; i++) { - struct ipu_irq_bank *bank = irq_bank + i; - - raw_spin_lock(&bank_lock); -diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 5fb4c6d..be34547 100644 ---- a/drivers/hv/channel.c -+++ b/drivers/hv/channel.c -@@ -157,6 +157,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - } - - init_completion(&open_info->waitevent); -+ open_info->waiting_channel = newchannel; - - open_msg = (struct vmbus_channel_open_channel *)open_info->msg; - open_msg->header.msgtype = CHANNELMSG_OPENCHANNEL; -@@ -181,7 +182,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - - ret = vmbus_post_msg(open_msg, -- sizeof(struct vmbus_channel_open_channel)); -+ sizeof(struct vmbus_channel_open_channel), true); - - if (ret != 0) { - err = ret; -@@ -194,6 +195,11 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - list_del(&open_info->msglistentry); - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - -+ if (newchannel->rescind) { -+ err = -ENODEV; -+ goto error_free_gpadl; -+ } -+ - if (open_info->response.open_result.status) { - err = -EAGAIN; - goto error_free_gpadl; -@@ -233,7 +239,7 @@ int vmbus_send_tl_connect_request(const uuid_le *shv_guest_servie_id, - conn_msg.guest_endpoint_id = *shv_guest_servie_id; - conn_msg.host_service_id = *shv_host_servie_id; - -- return vmbus_post_msg(&conn_msg, sizeof(conn_msg)); -+ return vmbus_post_msg(&conn_msg, sizeof(conn_msg), true); - } - EXPORT_SYMBOL_GPL(vmbus_send_tl_connect_request); - -@@ -405,6 +411,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, - return ret; - - init_completion(&msginfo->waitevent); -+ msginfo->waiting_channel = channel; - - gpadlmsg = (struct vmbus_channel_gpadl_header *)msginfo->msg; - gpadlmsg->header.msgtype = CHANNELMSG_GPADL_HEADER; -@@ -419,7 +426,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - - ret = vmbus_post_msg(gpadlmsg, msginfo->msgsize - -- sizeof(*msginfo)); -+ sizeof(*msginfo), true); - if (ret != 0) - goto cleanup; - -@@ -433,14 +440,19 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, - gpadl_body->gpadl = next_gpadl_handle; - - ret = vmbus_post_msg(gpadl_body, -- submsginfo->msgsize - -- sizeof(*submsginfo)); -+ submsginfo->msgsize - sizeof(*submsginfo), -+ true); - if (ret != 0) - goto cleanup; - - } - wait_for_completion(&msginfo->waitevent); - -+ if (channel->rescind) { -+ ret = -ENODEV; -+ goto cleanup; -+ } -+ - /* At this point, we received the gpadl created msg */ - *gpadl_handle = gpadlmsg->gpadl; - -@@ -474,6 +486,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) - return -ENOMEM; - - init_completion(&info->waitevent); -+ info->waiting_channel = channel; - - msg = (struct vmbus_channel_gpadl_teardown *)info->msg; - -@@ -485,14 +498,19 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle) - list_add_tail(&info->msglistentry, - &vmbus_connection.chn_msg_list); - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); -- ret = vmbus_post_msg(msg, -- sizeof(struct vmbus_channel_gpadl_teardown)); -+ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_gpadl_teardown), -+ true); - - if (ret) - goto post_msg_err; - - wait_for_completion(&info->waitevent); - -+ if (channel->rescind) { -+ ret = -ENODEV; -+ goto post_msg_err; -+ } -+ - post_msg_err: - spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); - list_del(&info->msglistentry); -@@ -557,7 +575,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel) - msg->header.msgtype = CHANNELMSG_CLOSECHANNEL; - msg->child_relid = channel->offermsg.child_relid; - -- ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel)); -+ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel), -+ true); - - if (ret) { - pr_err("Close failed: close post msg return is %d\n", ret); -diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c -index caf3418..cb95315 100644 ---- a/drivers/hv/channel_mgmt.c -+++ b/drivers/hv/channel_mgmt.c -@@ -147,6 +147,29 @@ static const struct { - { HV_RDV_GUID }, - }; - -+/* -+ * The rescinded channel may be blocked waiting for a response from the host; -+ * take care of that. -+ */ -+static void vmbus_rescind_cleanup(struct vmbus_channel *channel) -+{ -+ struct vmbus_channel_msginfo *msginfo; -+ unsigned long flags; -+ -+ -+ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); -+ -+ list_for_each_entry(msginfo, &vmbus_connection.chn_msg_list, -+ msglistentry) { -+ -+ if (msginfo->waiting_channel == channel) { -+ complete(&msginfo->waitevent); -+ break; -+ } -+ } -+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); -+} -+ - static bool is_unsupported_vmbus_devs(const uuid_le *guid) - { - int i; -@@ -321,7 +344,8 @@ static void vmbus_release_relid(u32 relid) - memset(&msg, 0, sizeof(struct vmbus_channel_relid_released)); - msg.child_relid = relid; - msg.header.msgtype = CHANNELMSG_RELID_RELEASED; -- vmbus_post_msg(&msg, sizeof(struct vmbus_channel_relid_released)); -+ vmbus_post_msg(&msg, sizeof(struct vmbus_channel_relid_released), -+ true); - } - - void hv_event_tasklet_disable(struct vmbus_channel *channel) -@@ -728,7 +752,8 @@ void vmbus_initiate_unload(bool crash) - init_completion(&vmbus_connection.unload_event); - memset(&hdr, 0, sizeof(struct vmbus_channel_message_header)); - hdr.msgtype = CHANNELMSG_UNLOAD; -- vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header)); -+ vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header), -+ !crash); - - /* - * vmbus_initiate_unload() is also called on crash and the crash can be -@@ -823,6 +848,8 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) - channel->rescind = true; - spin_unlock_irqrestore(&channel->lock, flags); - -+ vmbus_rescind_cleanup(channel); -+ - if (channel->device_obj) { - if (channel->chn_rescind_callback) { - channel->chn_rescind_callback(channel); -@@ -1116,8 +1143,8 @@ int vmbus_request_offers(void) - msg->msgtype = CHANNELMSG_REQUESTOFFERS; - - -- ret = vmbus_post_msg(msg, -- sizeof(struct vmbus_channel_message_header)); -+ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_message_header), -+ true); - if (ret != 0) { - pr_err("Unable to request offers - %d\n", ret); - -diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c -index 78e6368..840b6db 100644 ---- a/drivers/hv/connection.c -+++ b/drivers/hv/connection.c -@@ -110,7 +110,8 @@ static int vmbus_negotiate_version(struct vmbus_channel_msginfo *msginfo, - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - - ret = vmbus_post_msg(msg, -- sizeof(struct vmbus_channel_initiate_contact)); -+ sizeof(struct vmbus_channel_initiate_contact), -+ true); - if (ret != 0) { - spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); - list_del(&msginfo->msglistentry); -@@ -434,7 +435,7 @@ void vmbus_on_event(unsigned long data) - /* - * vmbus_post_msg - Send a msg on the vmbus's message connection - */ --int vmbus_post_msg(void *buffer, size_t buflen) -+int vmbus_post_msg(void *buffer, size_t buflen, bool can_sleep) - { - union hv_connection_id conn_id; - int ret = 0; -@@ -449,7 +450,7 @@ int vmbus_post_msg(void *buffer, size_t buflen) - * insufficient resources. Retry the operation a couple of - * times before giving up. - */ -- while (retries < 20) { -+ while (retries < 100) { - ret = hv_post_message(conn_id, 1, buffer, buflen); - - switch (ret) { -@@ -472,8 +473,14 @@ int vmbus_post_msg(void *buffer, size_t buflen) - } - - retries++; -- udelay(usec); -- if (usec < 2048) -+ if (can_sleep && usec > 1000) -+ msleep(usec / 1000); -+ else if (usec < MAX_UDELAY_MS * 1000) -+ udelay(usec); -+ else -+ mdelay(usec / 1000); -+ -+ if (usec < 256000) - usec *= 2; - } - return ret; -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 60dbd6c..6e49a4d 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -309,9 +309,10 @@ void hv_cleanup(bool crash) - - hypercall_msr.as_uint64 = 0; - wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64); -- if (!crash) -+ if (!crash) { - vfree(hv_context.tsc_page); -- hv_context.tsc_page = NULL; -+ hv_context.tsc_page = NULL; -+ } - } - #endif - } -@@ -411,7 +412,7 @@ int hv_synic_alloc(void) - goto err; - } - -- for_each_online_cpu(cpu) { -+ for_each_present_cpu(cpu) { - hv_context.event_dpc[cpu] = kmalloc(size, GFP_ATOMIC); - if (hv_context.event_dpc[cpu] == NULL) { - pr_err("Unable to allocate event dpc\n"); -@@ -457,6 +458,8 @@ int hv_synic_alloc(void) - pr_err("Unable to allocate post msg page\n"); - goto err; - } -+ -+ INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); - } - - return 0; -@@ -482,7 +485,7 @@ void hv_synic_free(void) - int cpu; - - kfree(hv_context.hv_numa_map); -- for_each_online_cpu(cpu) -+ for_each_present_cpu(cpu) - hv_synic_free_cpu(cpu); - } - -@@ -552,8 +555,6 @@ void hv_synic_init(void *arg) - rdmsrl(HV_X64_MSR_VP_INDEX, vp_index); - hv_context.vp_index[cpu] = (u32)vp_index; - -- INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); -- - /* - * Register the per-cpu clockevent source. - */ -diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c -index 8b2ba98..e47d8c9 100644 ---- a/drivers/hv/hv_fcopy.c -+++ b/drivers/hv/hv_fcopy.c -@@ -61,6 +61,7 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data); - static const char fcopy_devname[] = "vmbus/hv_fcopy"; - static u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - /* - * This state maintains the version number registered by the daemon. - */ -@@ -317,6 +318,7 @@ static void fcopy_on_reset(void) - - if (cancel_delayed_work_sync(&fcopy_timeout_work)) - fcopy_respond_to_host(HV_E_FAIL); -+ complete(&release_event); - } - - int hv_fcopy_init(struct hv_util_service *srv) -@@ -324,6 +326,7 @@ int hv_fcopy_init(struct hv_util_service *srv) - recv_buffer = srv->recv_buffer; - fcopy_transaction.recv_channel = srv->channel; - -+ init_completion(&release_event); - /* - * When this driver loads, the user level daemon that - * processes the host requests may not yet be running. -@@ -345,4 +348,5 @@ void hv_fcopy_deinit(void) - fcopy_transaction.state = HVUTIL_DEVICE_DYING; - cancel_delayed_work_sync(&fcopy_timeout_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c -index 5e1fdc8..3abfc59 100644 ---- a/drivers/hv/hv_kvp.c -+++ b/drivers/hv/hv_kvp.c -@@ -88,6 +88,7 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key); - static const char kvp_devname[] = "vmbus/hv_kvp"; - static u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - /* - * Register the kernel component with the user-level daemon. - * As part of this registration, pass the LIC version number. -@@ -716,6 +717,7 @@ static void kvp_on_reset(void) - if (cancel_delayed_work_sync(&kvp_timeout_work)) - kvp_respond_to_host(NULL, HV_E_FAIL); - kvp_transaction.state = HVUTIL_DEVICE_INIT; -+ complete(&release_event); - } - - int -@@ -724,6 +726,7 @@ hv_kvp_init(struct hv_util_service *srv) - recv_buffer = srv->recv_buffer; - kvp_transaction.recv_channel = srv->channel; - -+ init_completion(&release_event); - /* - * When this driver loads, the user level daemon that - * processes the host requests may not yet be running. -@@ -747,4 +750,5 @@ void hv_kvp_deinit(void) - cancel_delayed_work_sync(&kvp_timeout_work); - cancel_work_sync(&kvp_sendkey_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c -index a670713..a76e3db 100644 ---- a/drivers/hv/hv_snapshot.c -+++ b/drivers/hv/hv_snapshot.c -@@ -66,6 +66,7 @@ static int dm_reg_value; - static const char vss_devname[] = "vmbus/hv_vss"; - static __u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - - static void vss_timeout_func(struct work_struct *dummy); - static void vss_handle_request(struct work_struct *dummy); -@@ -330,11 +331,13 @@ static void vss_on_reset(void) - if (cancel_delayed_work_sync(&vss_timeout_work)) - vss_respond_to_host(HV_E_FAIL); - vss_transaction.state = HVUTIL_DEVICE_INIT; -+ complete(&release_event); - } - - int - hv_vss_init(struct hv_util_service *srv) - { -+ init_completion(&release_event); - if (vmbus_proto_version < VERSION_WIN8_1) { - pr_warn("Integration service 'Backup (volume snapshot)'" - " not supported on this host version.\n"); -@@ -365,4 +368,5 @@ void hv_vss_deinit(void) - cancel_delayed_work_sync(&vss_timeout_work); - cancel_work_sync(&vss_handle_request_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index 2b13f2a..8d7f865 100644 ---- a/drivers/hv/hyperv_vmbus.h -+++ b/drivers/hv/hyperv_vmbus.h -@@ -683,7 +683,7 @@ void vmbus_free_channels(void); - int vmbus_connect(void); - void vmbus_disconnect(void); - --int vmbus_post_msg(void *buffer, size_t buflen); -+int vmbus_post_msg(void *buffer, size_t buflen, bool can_sleep); - - void vmbus_on_event(unsigned long data); - void vmbus_on_msg_dpc(unsigned long data); -diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c -index 308dbda..e94ed1c 100644 ---- a/drivers/hv/ring_buffer.c -+++ b/drivers/hv/ring_buffer.c -@@ -298,6 +298,9 @@ int hv_ringbuffer_write(struct vmbus_channel *channel, - unsigned long flags = 0; - struct hv_ring_buffer_info *outring_info = &channel->outbound; - -+ if (channel->rescind) -+ return -ENODEV; -+ - for (i = 0; i < kv_count; i++) - totalbytes_towrite += kv_list[i].iov_len; - -@@ -350,6 +353,10 @@ int hv_ringbuffer_write(struct vmbus_channel *channel, - spin_unlock_irqrestore(&outring_info->ring_lock, flags); - - hv_signal_on_write(old_write, channel, kick_q); -+ -+ if (channel->rescind) -+ return -ENODEV; -+ - return 0; - } - -diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c -index ad82cb2..4314616 100644 ---- a/drivers/hwmon/it87.c -+++ b/drivers/hwmon/it87.c -@@ -1300,25 +1300,35 @@ static ssize_t set_pwm_enable(struct device *dev, struct device_attribute *attr, - it87_write_value(data, IT87_REG_FAN_MAIN_CTRL, - data->fan_main_ctrl); - } else { -+ u8 ctrl; -+ - /* No on/off mode, set maximum pwm value */ - data->pwm_duty[nr] = pwm_to_reg(data, 0xff); - it87_write_value(data, IT87_REG_PWM_DUTY[nr], - data->pwm_duty[nr]); - /* and set manual mode */ -- data->pwm_ctrl[nr] = has_newer_autopwm(data) ? -- data->pwm_temp_map[nr] : -- data->pwm_duty[nr]; -- it87_write_value(data, IT87_REG_PWM[nr], -- data->pwm_ctrl[nr]); -+ if (has_newer_autopwm(data)) { -+ ctrl = (data->pwm_ctrl[nr] & 0x7c) | -+ data->pwm_temp_map[nr]; -+ } else { -+ ctrl = data->pwm_duty[nr]; -+ } -+ data->pwm_ctrl[nr] = ctrl; -+ it87_write_value(data, IT87_REG_PWM[nr], ctrl); - } - } else { -- if (val == 1) /* Manual mode */ -- data->pwm_ctrl[nr] = has_newer_autopwm(data) ? -- data->pwm_temp_map[nr] : -- data->pwm_duty[nr]; -- else /* Automatic mode */ -- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr]; -- it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]); -+ u8 ctrl; -+ -+ if (has_newer_autopwm(data)) { -+ ctrl = (data->pwm_ctrl[nr] & 0x7c) | -+ data->pwm_temp_map[nr]; -+ if (val != 1) -+ ctrl |= 0x80; -+ } else { -+ ctrl = (val == 1 ? data->pwm_duty[nr] : 0x80); -+ } -+ data->pwm_ctrl[nr] = ctrl; -+ it87_write_value(data, IT87_REG_PWM[nr], ctrl); - - if (data->type != it8603 && nr < 3) { - /* set SmartGuardian mode */ -@@ -1344,6 +1354,7 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr, - return -EINVAL; - - mutex_lock(&data->update_lock); -+ it87_update_pwm_ctrl(data, nr); - if (has_newer_autopwm(data)) { - /* - * If we are in automatic mode, the PWM duty cycle register -@@ -1456,13 +1467,15 @@ static ssize_t set_pwm_temp_map(struct device *dev, - } - - mutex_lock(&data->update_lock); -+ it87_update_pwm_ctrl(data, nr); - data->pwm_temp_map[nr] = reg; - /* - * If we are in automatic mode, write the temp mapping immediately; - * otherwise, just store it for later use. - */ - if (data->pwm_ctrl[nr] & 0x80) { -- data->pwm_ctrl[nr] = 0x80 | data->pwm_temp_map[nr]; -+ data->pwm_ctrl[nr] = (data->pwm_ctrl[nr] & 0xfc) | -+ data->pwm_temp_map[nr]; - it87_write_value(data, IT87_REG_PWM[nr], data->pwm_ctrl[nr]); - } - mutex_unlock(&data->update_lock); -diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c -index 49e0f1b..8e79056 100644 ---- a/drivers/hwtracing/coresight/coresight-stm.c -+++ b/drivers/hwtracing/coresight/coresight-stm.c -@@ -356,7 +356,7 @@ static void stm_generic_unlink(struct stm_data *stm_data, - if (!drvdata || !drvdata->csdev) - return; - -- stm_disable(drvdata->csdev, NULL); -+ coresight_disable(drvdata->csdev); - } - - static phys_addr_t -diff --git a/drivers/iio/pressure/mpl115.c b/drivers/iio/pressure/mpl115.c -index 73f2f0c..8f2bce2 100644 ---- a/drivers/iio/pressure/mpl115.c -+++ b/drivers/iio/pressure/mpl115.c -@@ -137,6 +137,7 @@ static const struct iio_chan_spec mpl115_channels[] = { - { - .type = IIO_TEMP, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -+ .info_mask_shared_by_type = - BIT(IIO_CHAN_INFO_OFFSET) | BIT(IIO_CHAN_INFO_SCALE), - }, - }; -diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c -index 6392d7b..eb87948 100644 ---- a/drivers/iio/pressure/mpl3115.c -+++ b/drivers/iio/pressure/mpl3115.c -@@ -182,7 +182,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { - { - .type = IIO_PRESSURE, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- BIT(IIO_CHAN_INFO_SCALE), -+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .scan_index = 0, - .scan_type = { - .sign = 'u', -@@ -195,7 +195,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { - { - .type = IIO_TEMP, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- BIT(IIO_CHAN_INFO_SCALE), -+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .scan_index = 1, - .scan_type = { - .sign = 's', -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index c25768c..f2d40c0 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -3540,6 +3540,9 @@ static int cma_accept_iw(struct rdma_id_private *id_priv, - struct iw_cm_conn_param iw_param; - int ret; - -+ if (!conn_param) -+ return -EINVAL; -+ - ret = cma_modify_qp_rtr(id_priv, conn_param); - if (ret) - return ret; -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index d82637a..34be95e 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -3325,13 +3325,14 @@ static int __init init_dmars(void) - iommu_identity_mapping |= IDENTMAP_GFX; - #endif - -+ check_tylersburg_isoch(); -+ - if (iommu_identity_mapping) { - ret = si_domain_init(hw_pass_through); - if (ret) - goto free_iommu; - } - -- check_tylersburg_isoch(); - - /* - * If we copied translations from a previous kernel in the kdump -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index 59b2c50..c817627 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -248,7 +248,7 @@ struct cache { - /* - * Fields for converting from sectors to blocks. - */ -- uint32_t sectors_per_block; -+ sector_t sectors_per_block; - int sectors_per_block_shift; - - spinlock_t lock; -@@ -3546,11 +3546,11 @@ static void cache_status(struct dm_target *ti, status_type_t type, - - residency = policy_residency(cache->policy); - -- DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ", -+ DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ", - (unsigned)DM_CACHE_METADATA_BLOCK_SIZE, - (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata), - (unsigned long long)nr_blocks_metadata, -- cache->sectors_per_block, -+ (unsigned long long)cache->sectors_per_block, - (unsigned long long) from_cblock(residency), - (unsigned long long) from_cblock(cache->cache_size), - (unsigned) atomic_read(&cache->stats.read_hit), -diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c -index af2d79b..15daa36 100644 ---- a/drivers/md/dm-raid.c -+++ b/drivers/md/dm-raid.c -@@ -3621,6 +3621,8 @@ static int raid_preresume(struct dm_target *ti) - return r; - } - -+#define RESUME_STAY_FROZEN_FLAGS (CTR_FLAG_DELTA_DISKS | CTR_FLAG_DATA_OFFSET) -+ - static void raid_resume(struct dm_target *ti) - { - struct raid_set *rs = ti->private; -@@ -3638,7 +3640,15 @@ static void raid_resume(struct dm_target *ti) - mddev->ro = 0; - mddev->in_sync = 0; - -- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); -+ /* -+ * Keep the RAID set frozen if reshape/rebuild flags are set. -+ * The RAID set is unfrozen once the next table load/resume, -+ * which clears the reshape/rebuild flags, occurs. -+ * This ensures that the constructor for the inactive table -+ * retrieves an up-to-date reshape_position. -+ */ -+ if (!(rs->ctr_flags & RESUME_STAY_FROZEN_FLAGS)) -+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); - - if (mddev->suspended) - mddev_resume(mddev); -diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c -index 6c25213..bdbb7e6 100644 ---- a/drivers/md/dm-round-robin.c -+++ b/drivers/md/dm-round-robin.c -@@ -17,8 +17,8 @@ - #include <linux/module.h> - - #define DM_MSG_PREFIX "multipath round-robin" --#define RR_MIN_IO 1000 --#define RR_VERSION "1.1.0" -+#define RR_MIN_IO 1 -+#define RR_VERSION "1.2.0" - - /*----------------------------------------------------------------- - * Path-handling code, paths are held in lists -@@ -47,44 +47,19 @@ struct selector { - struct list_head valid_paths; - struct list_head invalid_paths; - spinlock_t lock; -- struct dm_path * __percpu *current_path; -- struct percpu_counter repeat_count; - }; - --static void set_percpu_current_path(struct selector *s, struct dm_path *path) --{ -- int cpu; -- -- for_each_possible_cpu(cpu) -- *per_cpu_ptr(s->current_path, cpu) = path; --} -- - static struct selector *alloc_selector(void) - { - struct selector *s = kmalloc(sizeof(*s), GFP_KERNEL); - -- if (!s) -- return NULL; -- -- INIT_LIST_HEAD(&s->valid_paths); -- INIT_LIST_HEAD(&s->invalid_paths); -- spin_lock_init(&s->lock); -- -- s->current_path = alloc_percpu(struct dm_path *); -- if (!s->current_path) -- goto out_current_path; -- set_percpu_current_path(s, NULL); -- -- if (percpu_counter_init(&s->repeat_count, 0, GFP_KERNEL)) -- goto out_repeat_count; -+ if (s) { -+ INIT_LIST_HEAD(&s->valid_paths); -+ INIT_LIST_HEAD(&s->invalid_paths); -+ spin_lock_init(&s->lock); -+ } - - return s; -- --out_repeat_count: -- free_percpu(s->current_path); --out_current_path: -- kfree(s); -- return NULL;; - } - - static int rr_create(struct path_selector *ps, unsigned argc, char **argv) -@@ -105,8 +80,6 @@ static void rr_destroy(struct path_selector *ps) - - free_paths(&s->valid_paths); - free_paths(&s->invalid_paths); -- free_percpu(s->current_path); -- percpu_counter_destroy(&s->repeat_count); - kfree(s); - ps->context = NULL; - } -@@ -157,6 +130,11 @@ static int rr_add_path(struct path_selector *ps, struct dm_path *path, - return -EINVAL; - } - -+ if (repeat_count > 1) { -+ DMWARN_LIMIT("repeat_count > 1 is deprecated, using 1 instead"); -+ repeat_count = 1; -+ } -+ - /* allocate the path */ - pi = kmalloc(sizeof(*pi), GFP_KERNEL); - if (!pi) { -@@ -183,9 +161,6 @@ static void rr_fail_path(struct path_selector *ps, struct dm_path *p) - struct path_info *pi = p->pscontext; - - spin_lock_irqsave(&s->lock, flags); -- if (p == *this_cpu_ptr(s->current_path)) -- set_percpu_current_path(s, NULL); -- - list_move(&pi->list, &s->invalid_paths); - spin_unlock_irqrestore(&s->lock, flags); - } -@@ -208,29 +183,15 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes) - unsigned long flags; - struct selector *s = ps->context; - struct path_info *pi = NULL; -- struct dm_path *current_path = NULL; -- -- local_irq_save(flags); -- current_path = *this_cpu_ptr(s->current_path); -- if (current_path) { -- percpu_counter_dec(&s->repeat_count); -- if (percpu_counter_read_positive(&s->repeat_count) > 0) { -- local_irq_restore(flags); -- return current_path; -- } -- } - -- spin_lock(&s->lock); -+ spin_lock_irqsave(&s->lock, flags); - if (!list_empty(&s->valid_paths)) { - pi = list_entry(s->valid_paths.next, struct path_info, list); - list_move_tail(&pi->list, &s->valid_paths); -- percpu_counter_set(&s->repeat_count, pi->repeat_count); -- set_percpu_current_path(s, pi->path); -- current_path = pi->path; - } - spin_unlock_irqrestore(&s->lock, flags); - -- return current_path; -+ return pi ? pi->path : NULL; - } - - static struct path_selector_type rr_ps = { -diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index 38b05f2..0250e7e 100644 ---- a/drivers/md/dm-stats.c -+++ b/drivers/md/dm-stats.c -@@ -175,6 +175,7 @@ static void dm_stat_free(struct rcu_head *head) - int cpu; - struct dm_stat *s = container_of(head, struct dm_stat, rcu_head); - -+ kfree(s->histogram_boundaries); - kfree(s->program_id); - kfree(s->aux_data); - for_each_possible_cpu(cpu) { -diff --git a/drivers/md/linear.c b/drivers/md/linear.c -index 86f5d43..b0c0aef 100644 ---- a/drivers/md/linear.c -+++ b/drivers/md/linear.c -@@ -52,18 +52,26 @@ static inline struct dev_info *which_dev(struct mddev *mddev, sector_t sector) - return conf->disks + lo; - } - -+/* -+ * In linear_congested() conf->raid_disks is used as a copy of -+ * mddev->raid_disks to iterate conf->disks[], because conf->raid_disks -+ * and conf->disks[] are created in linear_conf(), they are always -+ * consitent with each other, but mddev->raid_disks does not. -+ */ - static int linear_congested(struct mddev *mddev, int bits) - { - struct linear_conf *conf; - int i, ret = 0; - -- conf = mddev->private; -+ rcu_read_lock(); -+ conf = rcu_dereference(mddev->private); - -- for (i = 0; i < mddev->raid_disks && !ret ; i++) { -+ for (i = 0; i < conf->raid_disks && !ret ; i++) { - struct request_queue *q = bdev_get_queue(conf->disks[i].rdev->bdev); - ret |= bdi_congested(&q->backing_dev_info, bits); - } - -+ rcu_read_unlock(); - return ret; - } - -@@ -143,6 +151,19 @@ static struct linear_conf *linear_conf(struct mddev *mddev, int raid_disks) - conf->disks[i-1].end_sector + - conf->disks[i].rdev->sectors; - -+ /* -+ * conf->raid_disks is copy of mddev->raid_disks. The reason to -+ * keep a copy of mddev->raid_disks in struct linear_conf is, -+ * mddev->raid_disks may not be consistent with pointers number of -+ * conf->disks[] when it is updated in linear_add() and used to -+ * iterate old conf->disks[] earray in linear_congested(). -+ * Here conf->raid_disks is always consitent with number of -+ * pointers in conf->disks[] array, and mddev->private is updated -+ * with rcu_assign_pointer() in linear_addr(), such race can be -+ * avoided. -+ */ -+ conf->raid_disks = raid_disks; -+ - return conf; - - out: -@@ -195,15 +216,23 @@ static int linear_add(struct mddev *mddev, struct md_rdev *rdev) - if (!newconf) - return -ENOMEM; - -+ /* newconf->raid_disks already keeps a copy of * the increased -+ * value of mddev->raid_disks, WARN_ONCE() is just used to make -+ * sure of this. It is possible that oldconf is still referenced -+ * in linear_congested(), therefore kfree_rcu() is used to free -+ * oldconf until no one uses it anymore. -+ */ - mddev_suspend(mddev); -- oldconf = mddev->private; -+ oldconf = rcu_dereference(mddev->private); - mddev->raid_disks++; -- mddev->private = newconf; -+ WARN_ONCE(mddev->raid_disks != newconf->raid_disks, -+ "copied raid_disks doesn't match mddev->raid_disks"); -+ rcu_assign_pointer(mddev->private, newconf); - md_set_array_sectors(mddev, linear_size(mddev, 0, 0)); - set_capacity(mddev->gendisk, mddev->array_sectors); - mddev_resume(mddev); - revalidate_disk(mddev->gendisk); -- kfree(oldconf); -+ kfree_rcu(oldconf, rcu); - return 0; - } - -diff --git a/drivers/md/linear.h b/drivers/md/linear.h -index b685ddd..8d392e6 100644 ---- a/drivers/md/linear.h -+++ b/drivers/md/linear.h -@@ -10,6 +10,7 @@ struct linear_conf - { - struct rcu_head rcu; - sector_t array_sectors; -+ int raid_disks; /* a copy of mddev->raid_disks */ - struct dev_info disks[0]; - }; - #endif -diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c -index 95267c6..f6ebbb4 100644 ---- a/drivers/media/dvb-frontends/cxd2820r_core.c -+++ b/drivers/media/dvb-frontends/cxd2820r_core.c -@@ -615,6 +615,7 @@ static int cxd2820r_probe(struct i2c_client *client, - } - - priv->client[0] = client; -+ priv->fe.demodulator_priv = priv; - priv->i2c = client->adapter; - priv->ts_mode = pdata->ts_mode; - priv->ts_clk_inv = pdata->ts_clk_inv; -@@ -697,7 +698,6 @@ static int cxd2820r_probe(struct i2c_client *client, - memcpy(&priv->fe.ops, &cxd2820r_ops, sizeof(priv->fe.ops)); - if (!pdata->attach_in_use) - priv->fe.ops.release = NULL; -- priv->fe.demodulator_priv = priv; - i2c_set_clientdata(client, priv); - - /* Setup callbacks */ -diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c -index 2783531..4462d8c 100644 ---- a/drivers/media/media-device.c -+++ b/drivers/media/media-device.c -@@ -130,7 +130,7 @@ static long media_device_enum_entities(struct media_device *mdev, - * old range. - */ - if (ent->function < MEDIA_ENT_F_OLD_BASE || -- ent->function > MEDIA_ENT_T_DEVNODE_UNKNOWN) { -+ ent->function > MEDIA_ENT_F_TUNER) { - if (is_media_entity_v4l2_subdev(ent)) - entd->type = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN; - else if (ent->function != MEDIA_ENT_F_IO_V4L) -diff --git a/drivers/media/pci/dm1105/Kconfig b/drivers/media/pci/dm1105/Kconfig -index 173daf0..14fa7e4 100644 ---- a/drivers/media/pci/dm1105/Kconfig -+++ b/drivers/media/pci/dm1105/Kconfig -@@ -1,6 +1,6 @@ - config DVB_DM1105 - tristate "SDMC DM1105 based PCI cards" -- depends on DVB_CORE && PCI && I2C -+ depends on DVB_CORE && PCI && I2C && I2C_ALGOBIT - select DVB_PLL if MEDIA_SUBDRV_AUTOSELECT - select DVB_STV0299 if MEDIA_SUBDRV_AUTOSELECT - select DVB_STV0288 if MEDIA_SUBDRV_AUTOSELECT -diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c -index b33b9e3..05489a4 100644 ---- a/drivers/media/platform/am437x/am437x-vpfe.c -+++ b/drivers/media/platform/am437x/am437x-vpfe.c -@@ -1576,7 +1576,7 @@ static int vpfe_s_fmt(struct file *file, void *priv, - return -EBUSY; - } - -- ret = vpfe_try_fmt(file, priv, &format); -+ ret = __vpfe_get_format(vpfe, &format, &bpp); - if (ret) - return ret; - -diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c -index 91f9bb8..6ebe895 100644 ---- a/drivers/media/rc/lirc_dev.c -+++ b/drivers/media/rc/lirc_dev.c -@@ -589,7 +589,7 @@ long lirc_dev_fop_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - result = put_user(ir->d.features, (__u32 __user *)arg); - break; - case LIRC_GET_REC_MODE: -- if (LIRC_CAN_REC(ir->d.features)) { -+ if (!LIRC_CAN_REC(ir->d.features)) { - result = -ENOTTY; - break; - } -@@ -599,7 +599,7 @@ long lirc_dev_fop_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - (__u32 __user *)arg); - break; - case LIRC_SET_REC_MODE: -- if (LIRC_CAN_REC(ir->d.features)) { -+ if (!LIRC_CAN_REC(ir->d.features)) { - result = -ENOTTY; - break; - } -diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c -index 77edd20..40e5a6b 100644 ---- a/drivers/media/usb/uvc/uvc_queue.c -+++ b/drivers/media/usb/uvc/uvc_queue.c -@@ -412,7 +412,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue, - nextbuf = NULL; - spin_unlock_irqrestore(&queue->irqlock, flags); - -- buf->state = buf->error ? VB2_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; -+ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; - vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); - vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); - -diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c -index fa50635..41f3186 100644 ---- a/drivers/misc/mei/main.c -+++ b/drivers/misc/mei/main.c -@@ -182,32 +182,36 @@ static ssize_t mei_read(struct file *file, char __user *ubuf, - goto out; - } - -- if (rets == -EBUSY && -- !mei_cl_enqueue_ctrl_wr_cb(cl, length, MEI_FOP_READ, file)) { -- rets = -ENOMEM; -- goto out; -- } - -- do { -- mutex_unlock(&dev->device_lock); -- -- if (wait_event_interruptible(cl->rx_wait, -- (!list_empty(&cl->rd_completed)) || -- (!mei_cl_is_connected(cl)))) { -+again: -+ mutex_unlock(&dev->device_lock); -+ if (wait_event_interruptible(cl->rx_wait, -+ !list_empty(&cl->rd_completed) || -+ !mei_cl_is_connected(cl))) { -+ if (signal_pending(current)) -+ return -EINTR; -+ return -ERESTARTSYS; -+ } -+ mutex_lock(&dev->device_lock); - -- if (signal_pending(current)) -- return -EINTR; -- return -ERESTARTSYS; -- } -+ if (!mei_cl_is_connected(cl)) { -+ rets = -ENODEV; -+ goto out; -+ } - -- mutex_lock(&dev->device_lock); -- if (!mei_cl_is_connected(cl)) { -- rets = -ENODEV; -- goto out; -- } -+ cb = mei_cl_read_cb(cl, file); -+ if (!cb) { -+ /* -+ * For amthif all the waiters are woken up, -+ * but only fp with matching cb->fp get the cb, -+ * the others have to return to wait on read. -+ */ -+ if (cl == &dev->iamthif_cl) -+ goto again; - -- cb = mei_cl_read_cb(cl, file); -- } while (!cb); -+ rets = 0; -+ goto out; -+ } - - copy_buffer: - /* now copy the data to user space */ -diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c -index fddd0be..80918ab 100644 ---- a/drivers/mmc/host/sdhci-acpi.c -+++ b/drivers/mmc/host/sdhci-acpi.c -@@ -466,7 +466,10 @@ static int sdhci_acpi_probe(struct platform_device *pdev) - if (sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD)) { - bool v = sdhci_acpi_flag(c, SDHCI_ACPI_SD_CD_OVERRIDE_LEVEL); - -- if (mmc_gpiod_request_cd(host->mmc, NULL, 0, v, 0, NULL)) { -+ err = mmc_gpiod_request_cd(host->mmc, NULL, 0, v, 0, NULL); -+ if (err) { -+ if (err == -EPROBE_DEFER) -+ goto err_free; - dev_warn(dev, "failed to setup card detect gpio\n"); - c->use_runtime_pm = false; - } -diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c -index 0a177b1..d1570f5 100644 ---- a/drivers/mtd/nand/fsl_ifc_nand.c -+++ b/drivers/mtd/nand/fsl_ifc_nand.c -@@ -258,9 +258,15 @@ static void fsl_ifc_run_command(struct mtd_info *mtd) - int bufnum = nctrl->page & priv->bufnum_mask; - int sector = bufnum * chip->ecc.steps; - int sector_end = sector + chip->ecc.steps - 1; -+ __be32 *eccstat_regs; -+ -+ if (ctrl->version >= FSL_IFC_VERSION_2_0_0) -+ eccstat_regs = ifc->ifc_nand.v2_nand_eccstat; -+ else -+ eccstat_regs = ifc->ifc_nand.v1_nand_eccstat; - - for (i = sector / 4; i <= sector_end / 4; i++) -- eccstat[i] = ifc_in32(&ifc->ifc_nand.nand_eccstat[i]); -+ eccstat[i] = ifc_in32(&eccstat_regs[i]); - - for (i = sector; i <= sector_end; i++) { - errors = check_read_ecc(mtd, ctrl, eccstat, i); -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index 77e3cc0..a0dabd4 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -908,10 +908,14 @@ static int gs_usb_probe(struct usb_interface *intf, - struct gs_usb *dev; - int rc = -ENOMEM; - unsigned int icount, i; -- struct gs_host_config hconf = { -- .byte_order = 0x0000beef, -- }; -- struct gs_device_config dconf; -+ struct gs_host_config *hconf; -+ struct gs_device_config *dconf; -+ -+ hconf = kmalloc(sizeof(*hconf), GFP_KERNEL); -+ if (!hconf) -+ return -ENOMEM; -+ -+ hconf->byte_order = 0x0000beef; - - /* send host config */ - rc = usb_control_msg(interface_to_usbdev(intf), -@@ -920,16 +924,22 @@ static int gs_usb_probe(struct usb_interface *intf, - USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, - 1, - intf->altsetting[0].desc.bInterfaceNumber, -- &hconf, -- sizeof(hconf), -+ hconf, -+ sizeof(*hconf), - 1000); - -+ kfree(hconf); -+ - if (rc < 0) { - dev_err(&intf->dev, "Couldn't send data format (err=%d)\n", - rc); - return rc; - } - -+ dconf = kmalloc(sizeof(*dconf), GFP_KERNEL); -+ if (!dconf) -+ return -ENOMEM; -+ - /* read device config */ - rc = usb_control_msg(interface_to_usbdev(intf), - usb_rcvctrlpipe(interface_to_usbdev(intf), 0), -@@ -937,28 +947,33 @@ static int gs_usb_probe(struct usb_interface *intf, - USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, - 1, - intf->altsetting[0].desc.bInterfaceNumber, -- &dconf, -- sizeof(dconf), -+ dconf, -+ sizeof(*dconf), - 1000); - if (rc < 0) { - dev_err(&intf->dev, "Couldn't get device config: (err=%d)\n", - rc); -+ kfree(dconf); - return rc; - } - -- icount = dconf.icount + 1; -+ icount = dconf->icount + 1; - dev_info(&intf->dev, "Configuring for %d interfaces\n", icount); - - if (icount > GS_MAX_INTF) { - dev_err(&intf->dev, - "Driver cannot handle more that %d CAN interfaces\n", - GS_MAX_INTF); -+ kfree(dconf); - return -EINVAL; - } - - dev = kzalloc(sizeof(*dev), GFP_KERNEL); -- if (!dev) -+ if (!dev) { -+ kfree(dconf); - return -ENOMEM; -+ } -+ - init_usb_anchor(&dev->rx_submitted); - - atomic_set(&dev->active_channels, 0); -@@ -967,7 +982,7 @@ static int gs_usb_probe(struct usb_interface *intf, - dev->udev = interface_to_usbdev(intf); - - for (i = 0; i < icount; i++) { -- dev->canch[i] = gs_make_candev(i, intf, &dconf); -+ dev->canch[i] = gs_make_candev(i, intf, dconf); - if (IS_ERR_OR_NULL(dev->canch[i])) { - /* save error code to return later */ - rc = PTR_ERR(dev->canch[i]); -@@ -978,12 +993,15 @@ static int gs_usb_probe(struct usb_interface *intf, - gs_destroy_candev(dev->canch[i]); - - usb_kill_anchored_urbs(&dev->rx_submitted); -+ kfree(dconf); - kfree(dev); - return rc; - } - dev->canch[i]->parent = dev; - } - -+ kfree(dconf); -+ - return 0; - } - -diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c -index 108a30e..d000cb6 100644 ---- a/drivers/net/can/usb/usb_8dev.c -+++ b/drivers/net/can/usb/usb_8dev.c -@@ -951,8 +951,8 @@ static int usb_8dev_probe(struct usb_interface *intf, - for (i = 0; i < MAX_TX_URBS; i++) - priv->tx_contexts[i].echo_index = MAX_TX_URBS; - -- priv->cmd_msg_buffer = kzalloc(sizeof(struct usb_8dev_cmd_msg), -- GFP_KERNEL); -+ priv->cmd_msg_buffer = devm_kzalloc(&intf->dev, sizeof(struct usb_8dev_cmd_msg), -+ GFP_KERNEL); - if (!priv->cmd_msg_buffer) - goto cleanup_candev; - -@@ -966,7 +966,7 @@ static int usb_8dev_probe(struct usb_interface *intf, - if (err) { - netdev_err(netdev, - "couldn't register CAN device: %d\n", err); -- goto cleanup_cmd_msg_buffer; -+ goto cleanup_candev; - } - - err = usb_8dev_cmd_version(priv, &version); -@@ -987,9 +987,6 @@ static int usb_8dev_probe(struct usb_interface *intf, - cleanup_unregister_candev: - unregister_netdev(priv->netdev); - --cleanup_cmd_msg_buffer: -- kfree(priv->cmd_msg_buffer); -- - cleanup_candev: - free_candev(netdev); - -diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c -index 0c45322..972b5e2 100644 ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -1901,7 +1901,8 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode, - ath10k_dbg(ar, ATH10K_DBG_BOOT, "firmware %s booted\n", - ar->hw->wiphy->fw_version); - -- if (test_bit(WMI_SERVICE_EXT_RES_CFG_SUPPORT, ar->wmi.svc_map)) { -+ if (test_bit(WMI_SERVICE_EXT_RES_CFG_SUPPORT, ar->wmi.svc_map) && -+ mode == ATH10K_FIRMWARE_MODE_NORMAL) { - val = 0; - if (ath10k_peer_stats_enabled(ar)) - val = WMI_10_4_PEER_STATS; -@@ -1954,10 +1955,13 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode, - * possible to implicitly make it correct by creating a dummy vdev and - * then deleting it. - */ -- status = ath10k_core_reset_rx_filter(ar); -- if (status) { -- ath10k_err(ar, "failed to reset rx filter: %d\n", status); -- goto err_hif_stop; -+ if (mode == ATH10K_FIRMWARE_MODE_NORMAL) { -+ status = ath10k_core_reset_rx_filter(ar); -+ if (status) { -+ ath10k_err(ar, -+ "failed to reset rx filter: %d\n", status); -+ goto err_hif_stop; -+ } - } - - /* If firmware indicates Full Rx Reorder support it must be used in a -diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -index dc44cfe..16e052d 100644 ---- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c -+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -@@ -502,8 +502,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - break; - return -EOPNOTSUPP; - default: -- WARN_ON(1); -- return -EINVAL; -+ return -EOPNOTSUPP; - } - - mutex_lock(&ah->lock); -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -index 107bcfb..cb37bf0 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -@@ -73,13 +73,13 @@ - #define AR9300_OTP_BASE \ - ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000) - #define AR9300_OTP_STATUS \ -- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18) -+ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x31018 : 0x15f18) - #define AR9300_OTP_STATUS_TYPE 0x7 - #define AR9300_OTP_STATUS_VALID 0x4 - #define AR9300_OTP_STATUS_ACCESS_BUSY 0x2 - #define AR9300_OTP_STATUS_SM_BUSY 0x1 - #define AR9300_OTP_READ_DATA \ -- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c) -+ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3101c : 0x15f1c) - - enum targetPowerHTRates { - HT_TARGET_RATE_0_8_16, -diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h -index 26fc8ec..a731671 100644 ---- a/drivers/net/wireless/ath/ath9k/ath9k.h -+++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -959,6 +959,7 @@ struct ath_softc { - struct survey_info *cur_survey; - struct survey_info survey[ATH9K_NUM_CHANNELS]; - -+ spinlock_t intr_lock; - struct tasklet_struct intr_tq; - struct tasklet_struct bcon_tasklet; - struct ath_hw *sc_ah; -diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c -index cfa3fe8..297d4bb 100644 ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -626,6 +626,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, - common->bt_ant_diversity = 1; - - spin_lock_init(&common->cc_lock); -+ spin_lock_init(&sc->intr_lock); - spin_lock_init(&sc->sc_serial_rw); - spin_lock_init(&sc->sc_pm_lock); - spin_lock_init(&sc->chan_lock); -diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c -index bba85d1..d937c39 100644 ---- a/drivers/net/wireless/ath/ath9k/mac.c -+++ b/drivers/net/wireless/ath/ath9k/mac.c -@@ -805,21 +805,12 @@ void ath9k_hw_disable_interrupts(struct ath_hw *ah) - } - EXPORT_SYMBOL(ath9k_hw_disable_interrupts); - --void ath9k_hw_enable_interrupts(struct ath_hw *ah) -+static void __ath9k_hw_enable_interrupts(struct ath_hw *ah) - { - struct ath_common *common = ath9k_hw_common(ah); - u32 sync_default = AR_INTR_SYNC_DEFAULT; - u32 async_mask; - -- if (!(ah->imask & ATH9K_INT_GLOBAL)) -- return; -- -- if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { -- ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -- atomic_read(&ah->intr_ref_cnt)); -- return; -- } -- - if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) || - AR_SREV_9561(ah)) - sync_default &= ~AR_INTR_SYNC_HOST1_FATAL; -@@ -841,6 +832,39 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah) - ath_dbg(common, INTERRUPT, "AR_IMR 0x%x IER 0x%x\n", - REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER)); - } -+ -+void ath9k_hw_resume_interrupts(struct ath_hw *ah) -+{ -+ struct ath_common *common = ath9k_hw_common(ah); -+ -+ if (!(ah->imask & ATH9K_INT_GLOBAL)) -+ return; -+ -+ if (atomic_read(&ah->intr_ref_cnt) != 0) { -+ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -+ atomic_read(&ah->intr_ref_cnt)); -+ return; -+ } -+ -+ __ath9k_hw_enable_interrupts(ah); -+} -+EXPORT_SYMBOL(ath9k_hw_resume_interrupts); -+ -+void ath9k_hw_enable_interrupts(struct ath_hw *ah) -+{ -+ struct ath_common *common = ath9k_hw_common(ah); -+ -+ if (!(ah->imask & ATH9K_INT_GLOBAL)) -+ return; -+ -+ if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { -+ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -+ atomic_read(&ah->intr_ref_cnt)); -+ return; -+ } -+ -+ __ath9k_hw_enable_interrupts(ah); -+} - EXPORT_SYMBOL(ath9k_hw_enable_interrupts); - - void ath9k_hw_set_interrupts(struct ath_hw *ah) -diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h -index 3bab014..770fc11 100644 ---- a/drivers/net/wireless/ath/ath9k/mac.h -+++ b/drivers/net/wireless/ath/ath9k/mac.h -@@ -744,6 +744,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah); - void ath9k_hw_enable_interrupts(struct ath_hw *ah); - void ath9k_hw_disable_interrupts(struct ath_hw *ah); - void ath9k_hw_kill_interrupts(struct ath_hw *ah); -+void ath9k_hw_resume_interrupts(struct ath_hw *ah); - - void ar9002_hw_attach_mac_ops(struct ath_hw *ah); - -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index e9f32b5..b868f02 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -373,21 +373,20 @@ void ath9k_tasklet(unsigned long data) - struct ath_common *common = ath9k_hw_common(ah); - enum ath_reset_type type; - unsigned long flags; -- u32 status = sc->intrstatus; -+ u32 status; - u32 rxmask; - -+ spin_lock_irqsave(&sc->intr_lock, flags); -+ status = sc->intrstatus; -+ sc->intrstatus = 0; -+ spin_unlock_irqrestore(&sc->intr_lock, flags); -+ - ath9k_ps_wakeup(sc); - spin_lock(&sc->sc_pcu_lock); - - if (status & ATH9K_INT_FATAL) { - type = RESET_TYPE_FATAL_INT; - ath9k_queue_reset(sc, type); -- -- /* -- * Increment the ref. counter here so that -- * interrupts are enabled in the reset routine. -- */ -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, "FATAL: Skipping interrupts\n"); - goto out; - } -@@ -403,11 +402,6 @@ void ath9k_tasklet(unsigned long data) - type = RESET_TYPE_BB_WATCHDOG; - ath9k_queue_reset(sc, type); - -- /* -- * Increment the ref. counter here so that -- * interrupts are enabled in the reset routine. -- */ -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, - "BB_WATCHDOG: Skipping interrupts\n"); - goto out; -@@ -420,7 +414,6 @@ void ath9k_tasklet(unsigned long data) - if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) { - type = RESET_TYPE_TX_GTT; - ath9k_queue_reset(sc, type); -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, - "GTT: Skipping interrupts\n"); - goto out; -@@ -477,7 +470,7 @@ void ath9k_tasklet(unsigned long data) - ath9k_btcoex_handle_interrupt(sc, status); - - /* re-enable hardware interrupt */ -- ath9k_hw_enable_interrupts(ah); -+ ath9k_hw_resume_interrupts(ah); - out: - spin_unlock(&sc->sc_pcu_lock); - ath9k_ps_restore(sc); -@@ -541,7 +534,9 @@ irqreturn_t ath_isr(int irq, void *dev) - return IRQ_NONE; - - /* Cache the status */ -- sc->intrstatus = status; -+ spin_lock(&sc->intr_lock); -+ sc->intrstatus |= status; -+ spin_unlock(&sc->intr_lock); - - if (status & SCHED_INTR) - sched = true; -@@ -587,7 +582,7 @@ irqreturn_t ath_isr(int irq, void *dev) - - if (sched) { - /* turn off every interrupt */ -- ath9k_hw_disable_interrupts(ah); -+ ath9k_hw_kill_interrupts(ah); - tasklet_schedule(&sc->intr_tq); - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h -index b951eba..d2f4dd4 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.h -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h -@@ -275,10 +275,10 @@ struct mp_adapter { - }; - - struct rtl_pci_priv { -+ struct bt_coexist_info bt_coexist; -+ struct rtl_led_ctl ledctl; - struct rtl_pci dev; - struct mp_adapter ndis_adapter; -- struct rtl_led_ctl ledctl; -- struct bt_coexist_info bt_coexist; - }; - - #define rtl_pcipriv(hw) (((struct rtl_pci_priv *)(rtl_priv(hw))->priv)) -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -index ebf663e..cab4601 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -@@ -1006,7 +1006,7 @@ static void _rtl92ee_hw_configure(struct ieee80211_hw *hw) - rtl_write_word(rtlpriv, REG_SIFS_TRX, 0x100a); - - /* Note Data sheet don't define */ -- rtl_write_word(rtlpriv, 0x4C7, 0x80); -+ rtl_write_byte(rtlpriv, 0x4C7, 0x80); - - rtl_write_byte(rtlpriv, REG_RX_PKT_LIMIT, 0x20); - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index 1281ebe..2cbef96 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -1128,7 +1128,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) - } - if (0 == tmp) { - read_addr = REG_DBI_RDATA + addr % 4; -- ret = rtl_read_word(rtlpriv, read_addr); -+ ret = rtl_read_byte(rtlpriv, read_addr); - } - return ret; - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.h b/drivers/net/wireless/realtek/rtlwifi/usb.h -index 685273c..441c441 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.h -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.h -@@ -150,8 +150,9 @@ struct rtl_usb { - }; - - struct rtl_usb_priv { -- struct rtl_usb dev; -+ struct bt_coexist_info bt_coexist; - struct rtl_led_ctl ledctl; -+ struct rtl_usb dev; - }; - - #define rtl_usbpriv(hw) (((struct rtl_usb_priv *)(rtl_priv(hw))->priv)) -diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c -index 763ff87..61fc349 100644 ---- a/drivers/pci/host/pci-hyperv.c -+++ b/drivers/pci/host/pci-hyperv.c -@@ -130,7 +130,8 @@ union pci_version { - */ - union win_slot_encoding { - struct { -- u32 func:8; -+ u32 dev:5; -+ u32 func:3; - u32 reserved:24; - } bits; - u32 slot; -@@ -483,7 +484,8 @@ static u32 devfn_to_wslot(int devfn) - union win_slot_encoding wslot; - - wslot.slot = 0; -- wslot.bits.func = PCI_SLOT(devfn) | (PCI_FUNC(devfn) << 5); -+ wslot.bits.dev = PCI_SLOT(devfn); -+ wslot.bits.func = PCI_FUNC(devfn); - - return wslot.slot; - } -@@ -501,7 +503,7 @@ static int wslot_to_devfn(u32 wslot) - union win_slot_encoding slot_no; - - slot_no.slot = wslot; -- return PCI_DEVFN(0, slot_no.bits.func); -+ return PCI_DEVFN(slot_no.bits.dev, slot_no.bits.func); - } - - /* -diff --git a/drivers/pci/host/pcie-altera.c b/drivers/pci/host/pcie-altera.c -index b0ac4df..f2907e7 100644 ---- a/drivers/pci/host/pcie-altera.c -+++ b/drivers/pci/host/pcie-altera.c -@@ -57,10 +57,14 @@ - #define TLP_WRITE_TAG 0x10 - #define RP_DEVFN 0 - #define TLP_REQ_ID(bus, devfn) (((bus) << 8) | (devfn)) --#define TLP_CFG_DW0(pcie, bus) \ -+#define TLP_CFGRD_DW0(pcie, bus) \ - ((((bus == pcie->root_bus_nr) ? TLP_FMTTYPE_CFGRD0 \ - : TLP_FMTTYPE_CFGRD1) << 24) | \ - TLP_PAYLOAD_SIZE) -+#define TLP_CFGWR_DW0(pcie, bus) \ -+ ((((bus == pcie->root_bus_nr) ? TLP_FMTTYPE_CFGWR0 \ -+ : TLP_FMTTYPE_CFGWR1) << 24) | \ -+ TLP_PAYLOAD_SIZE) - #define TLP_CFG_DW1(pcie, tag, be) \ - (((TLP_REQ_ID(pcie->root_bus_nr, RP_DEVFN)) << 16) | (tag << 8) | (be)) - #define TLP_CFG_DW2(bus, devfn, offset) \ -@@ -222,7 +226,7 @@ static int tlp_cfg_dword_read(struct altera_pcie *pcie, u8 bus, u32 devfn, - { - u32 headers[TLP_HDR_SIZE]; - -- headers[0] = TLP_CFG_DW0(pcie, bus); -+ headers[0] = TLP_CFGRD_DW0(pcie, bus); - headers[1] = TLP_CFG_DW1(pcie, TLP_READ_TAG, byte_en); - headers[2] = TLP_CFG_DW2(bus, devfn, where); - -@@ -237,7 +241,7 @@ static int tlp_cfg_dword_write(struct altera_pcie *pcie, u8 bus, u32 devfn, - u32 headers[TLP_HDR_SIZE]; - int ret; - -- headers[0] = TLP_CFG_DW0(pcie, bus); -+ headers[0] = TLP_CFGWR_DW0(pcie, bus); - headers[1] = TLP_CFG_DW1(pcie, TLP_WRITE_TAG, byte_en); - headers[2] = TLP_CFG_DW2(bus, devfn, where); - -diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c -index 56efaf7..acb2be0 100644 ---- a/drivers/pci/hotplug/pnv_php.c -+++ b/drivers/pci/hotplug/pnv_php.c -@@ -35,9 +35,11 @@ static void pnv_php_register(struct device_node *dn); - static void pnv_php_unregister_one(struct device_node *dn); - static void pnv_php_unregister(struct device_node *dn); - --static void pnv_php_disable_irq(struct pnv_php_slot *php_slot) -+static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, -+ bool disable_device) - { - struct pci_dev *pdev = php_slot->pdev; -+ int irq = php_slot->irq; - u16 ctrl; - - if (php_slot->irq > 0) { -@@ -56,10 +58,14 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot) - php_slot->wq = NULL; - } - -- if (pdev->msix_enabled) -- pci_disable_msix(pdev); -- else if (pdev->msi_enabled) -- pci_disable_msi(pdev); -+ if (disable_device || irq > 0) { -+ if (pdev->msix_enabled) -+ pci_disable_msix(pdev); -+ else if (pdev->msi_enabled) -+ pci_disable_msi(pdev); -+ -+ pci_disable_device(pdev); -+ } - } - - static void pnv_php_free_slot(struct kref *kref) -@@ -68,7 +74,7 @@ static void pnv_php_free_slot(struct kref *kref) - struct pnv_php_slot, kref); - - WARN_ON(!list_empty(&php_slot->children)); -- pnv_php_disable_irq(php_slot); -+ pnv_php_disable_irq(php_slot, false); - kfree(php_slot->name); - kfree(php_slot); - } -@@ -759,7 +765,7 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) - php_slot->wq = alloc_workqueue("pciehp-%s", 0, 0, php_slot->name); - if (!php_slot->wq) { - dev_warn(&pdev->dev, "Cannot alloc workqueue\n"); -- pnv_php_disable_irq(php_slot); -+ pnv_php_disable_irq(php_slot, true); - return; - } - -@@ -772,7 +778,7 @@ static void pnv_php_init_irq(struct pnv_php_slot *php_slot, int irq) - ret = request_irq(irq, pnv_php_interrupt, IRQF_SHARED, - php_slot->name, php_slot); - if (ret) { -- pnv_php_disable_irq(php_slot); -+ pnv_php_disable_irq(php_slot, true); - dev_warn(&pdev->dev, "Error %d enabling IRQ %d\n", ret, irq); - return; - } -diff --git a/drivers/power/reset/Kconfig b/drivers/power/reset/Kconfig -index c74c3f6..02e46bb 100644 ---- a/drivers/power/reset/Kconfig -+++ b/drivers/power/reset/Kconfig -@@ -32,7 +32,7 @@ config POWER_RESET_AT91_RESET - - config POWER_RESET_AT91_SAMA5D2_SHDWC - tristate "Atmel AT91 SAMA5D2-Compatible shutdown controller driver" -- depends on ARCH_AT91 || COMPILE_TEST -+ depends on ARCH_AT91 - default SOC_SAMA5 - help - This driver supports the alternate shutdown controller for some Atmel -diff --git a/drivers/power/reset/at91-poweroff.c b/drivers/power/reset/at91-poweroff.c -index e9e24df..2579f02 100644 ---- a/drivers/power/reset/at91-poweroff.c -+++ b/drivers/power/reset/at91-poweroff.c -@@ -14,9 +14,12 @@ - #include <linux/io.h> - #include <linux/module.h> - #include <linux/of.h> -+#include <linux/of_address.h> - #include <linux/platform_device.h> - #include <linux/printk.h> - -+#include <soc/at91/at91sam9_ddrsdr.h> -+ - #define AT91_SHDW_CR 0x00 /* Shut Down Control Register */ - #define AT91_SHDW_SHDW BIT(0) /* Shut Down command */ - #define AT91_SHDW_KEY (0xa5 << 24) /* KEY Password */ -@@ -50,6 +53,7 @@ static const char *shdwc_wakeup_modes[] = { - - static void __iomem *at91_shdwc_base; - static struct clk *sclk; -+static void __iomem *mpddrc_base; - - static void __init at91_wakeup_status(void) - { -@@ -73,6 +77,29 @@ static void at91_poweroff(void) - writel(AT91_SHDW_KEY | AT91_SHDW_SHDW, at91_shdwc_base + AT91_SHDW_CR); - } - -+static void at91_lpddr_poweroff(void) -+{ -+ asm volatile( -+ /* Align to cache lines */ -+ ".balign 32\n\t" -+ -+ /* Ensure AT91_SHDW_CR is in the TLB by reading it */ -+ " ldr r6, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ /* Power down SDRAM0 */ -+ " str %1, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t" -+ /* Shutdown CPU */ -+ " str %3, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ " b .\n\t" -+ : -+ : "r" (mpddrc_base), -+ "r" cpu_to_le32(AT91_DDRSDRC_LPDDR2_PWOFF), -+ "r" (at91_shdwc_base), -+ "r" cpu_to_le32(AT91_SHDW_KEY | AT91_SHDW_SHDW) -+ : "r0"); -+} -+ - static int at91_poweroff_get_wakeup_mode(struct device_node *np) - { - const char *pm; -@@ -124,6 +151,8 @@ static void at91_poweroff_dt_set_wakeup_mode(struct platform_device *pdev) - static int __init at91_poweroff_probe(struct platform_device *pdev) - { - struct resource *res; -+ struct device_node *np; -+ u32 ddr_type; - int ret; - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -@@ -150,12 +179,30 @@ static int __init at91_poweroff_probe(struct platform_device *pdev) - - pm_power_off = at91_poweroff; - -+ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d3-ddramc"); -+ if (!np) -+ return 0; -+ -+ mpddrc_base = of_iomap(np, 0); -+ of_node_put(np); -+ -+ if (!mpddrc_base) -+ return 0; -+ -+ ddr_type = readl(mpddrc_base + AT91_DDRSDRC_MDR) & AT91_DDRSDRC_MD; -+ if ((ddr_type == AT91_DDRSDRC_MD_LPDDR2) || -+ (ddr_type == AT91_DDRSDRC_MD_LPDDR3)) -+ pm_power_off = at91_lpddr_poweroff; -+ else -+ iounmap(mpddrc_base); -+ - return 0; - } - - static int __exit at91_poweroff_remove(struct platform_device *pdev) - { -- if (pm_power_off == at91_poweroff) -+ if (pm_power_off == at91_poweroff || -+ pm_power_off == at91_lpddr_poweroff) - pm_power_off = NULL; - - clk_disable_unprepare(sclk); -@@ -163,6 +210,11 @@ static int __exit at91_poweroff_remove(struct platform_device *pdev) - return 0; - } - -+static const struct of_device_id at91_ramc_of_match[] = { -+ { .compatible = "atmel,sama5d3-ddramc", }, -+ { /* sentinel */ } -+}; -+ - static const struct of_device_id at91_poweroff_of_match[] = { - { .compatible = "atmel,at91sam9260-shdwc", }, - { .compatible = "atmel,at91sam9rl-shdwc", }, -diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c -index 8a5ac97..90b0b5a 100644 ---- a/drivers/power/reset/at91-sama5d2_shdwc.c -+++ b/drivers/power/reset/at91-sama5d2_shdwc.c -@@ -22,9 +22,12 @@ - #include <linux/io.h> - #include <linux/module.h> - #include <linux/of.h> -+#include <linux/of_address.h> - #include <linux/platform_device.h> - #include <linux/printk.h> - -+#include <soc/at91/at91sam9_ddrsdr.h> -+ - #define SLOW_CLOCK_FREQ 32768 - - #define AT91_SHDW_CR 0x00 /* Shut Down Control Register */ -@@ -75,6 +78,7 @@ struct shdwc { - */ - static struct shdwc *at91_shdwc; - static struct clk *sclk; -+static void __iomem *mpddrc_base; - - static const unsigned long long sdwc_dbc_period[] = { - 0, 3, 32, 512, 4096, 32768, -@@ -108,6 +112,29 @@ static void at91_poweroff(void) - at91_shdwc->at91_shdwc_base + AT91_SHDW_CR); - } - -+static void at91_lpddr_poweroff(void) -+{ -+ asm volatile( -+ /* Align to cache lines */ -+ ".balign 32\n\t" -+ -+ /* Ensure AT91_SHDW_CR is in the TLB by reading it */ -+ " ldr r6, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ /* Power down SDRAM0 */ -+ " str %1, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t" -+ /* Shutdown CPU */ -+ " str %3, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ " b .\n\t" -+ : -+ : "r" (mpddrc_base), -+ "r" cpu_to_le32(AT91_DDRSDRC_LPDDR2_PWOFF), -+ "r" (at91_shdwc->at91_shdwc_base), -+ "r" cpu_to_le32(AT91_SHDW_KEY | AT91_SHDW_SHDW) -+ : "r0"); -+} -+ - static u32 at91_shdwc_debouncer_value(struct platform_device *pdev, - u32 in_period_us) - { -@@ -212,6 +239,8 @@ static int __init at91_shdwc_probe(struct platform_device *pdev) - { - struct resource *res; - const struct of_device_id *match; -+ struct device_node *np; -+ u32 ddr_type; - int ret; - - if (!pdev->dev.of_node) -@@ -249,6 +278,23 @@ static int __init at91_shdwc_probe(struct platform_device *pdev) - - pm_power_off = at91_poweroff; - -+ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d3-ddramc"); -+ if (!np) -+ return 0; -+ -+ mpddrc_base = of_iomap(np, 0); -+ of_node_put(np); -+ -+ if (!mpddrc_base) -+ return 0; -+ -+ ddr_type = readl(mpddrc_base + AT91_DDRSDRC_MDR) & AT91_DDRSDRC_MD; -+ if ((ddr_type == AT91_DDRSDRC_MD_LPDDR2) || -+ (ddr_type == AT91_DDRSDRC_MD_LPDDR3)) -+ pm_power_off = at91_lpddr_poweroff; -+ else -+ iounmap(mpddrc_base); -+ - return 0; - } - -@@ -256,7 +302,8 @@ static int __exit at91_shdwc_remove(struct platform_device *pdev) - { - struct shdwc *shdw = platform_get_drvdata(pdev); - -- if (pm_power_off == at91_poweroff) -+ if (pm_power_off == at91_poweroff || -+ pm_power_off == at91_lpddr_poweroff) - pm_power_off = NULL; - - /* Reset values to disable wake-up features */ -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 5c1519b..9faccfc 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4357,12 +4357,13 @@ static void regulator_summary_show_subtree(struct seq_file *s, - seq_puts(s, "\n"); - - list_for_each_entry(consumer, &rdev->consumer_list, list) { -- if (consumer->dev->class == ®ulator_class) -+ if (consumer->dev && consumer->dev->class == ®ulator_class) - continue; - - seq_printf(s, "%*s%-*s ", - (level + 1) * 3 + 1, "", -- 30 - (level + 1) * 3, dev_name(consumer->dev)); -+ 30 - (level + 1) * 3, -+ consumer->dev ? dev_name(consumer->dev) : "deviceless"); - - switch (rdev->desc->type) { - case REGULATOR_VOLTAGE: -diff --git a/drivers/remoteproc/qcom_mdt_loader.c b/drivers/remoteproc/qcom_mdt_loader.c -index 114e8e4..04db02d 100644 ---- a/drivers/remoteproc/qcom_mdt_loader.c -+++ b/drivers/remoteproc/qcom_mdt_loader.c -@@ -115,6 +115,7 @@ int qcom_mdt_load(struct rproc *rproc, - const struct elf32_phdr *phdrs; - const struct elf32_phdr *phdr; - const struct elf32_hdr *ehdr; -+ const struct firmware *seg_fw; - size_t fw_name_len; - char *fw_name; - void *ptr; -@@ -153,16 +154,16 @@ int qcom_mdt_load(struct rproc *rproc, - - if (phdr->p_filesz) { - sprintf(fw_name + fw_name_len - 3, "b%02d", i); -- ret = request_firmware(&fw, fw_name, &rproc->dev); -+ ret = request_firmware(&seg_fw, fw_name, &rproc->dev); - if (ret) { - dev_err(&rproc->dev, "failed to load %s\n", - fw_name); - break; - } - -- memcpy(ptr, fw->data, fw->size); -+ memcpy(ptr, seg_fw->data, seg_fw->size); - -- release_firmware(fw); -+ release_firmware(seg_fw); - } - - if (phdr->p_memsz > phdr->p_filesz) -diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig -index e859d14..0723c97 100644 ---- a/drivers/rtc/Kconfig -+++ b/drivers/rtc/Kconfig -@@ -1432,7 +1432,7 @@ config RTC_DRV_SUN4V - based RTC on SUN4V systems. - - config RTC_DRV_SUN6I -- tristate "Allwinner A31 RTC" -+ bool "Allwinner A31 RTC" - default MACH_SUN6I || MACH_SUN8I || COMPILE_TEST - depends on ARCH_SUNXI - help -diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c -index c169a2c..b0d45d2 100644 ---- a/drivers/rtc/rtc-sun6i.c -+++ b/drivers/rtc/rtc-sun6i.c -@@ -37,9 +37,11 @@ - - /* Control register */ - #define SUN6I_LOSC_CTRL 0x0000 -+#define SUN6I_LOSC_CTRL_KEY (0x16aa << 16) - #define SUN6I_LOSC_CTRL_ALM_DHMS_ACC BIT(9) - #define SUN6I_LOSC_CTRL_RTC_HMS_ACC BIT(8) - #define SUN6I_LOSC_CTRL_RTC_YMD_ACC BIT(7) -+#define SUN6I_LOSC_CTRL_EXT_OSC BIT(0) - #define SUN6I_LOSC_CTRL_ACC_MASK GENMASK(9, 7) - - /* RTC */ -@@ -114,13 +116,17 @@ struct sun6i_rtc_dev { - void __iomem *base; - int irq; - unsigned long alarm; -+ -+ spinlock_t lock; - }; - - static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) - { - struct sun6i_rtc_dev *chip = (struct sun6i_rtc_dev *) id; -+ irqreturn_t ret = IRQ_NONE; - u32 val; - -+ spin_lock(&chip->lock); - val = readl(chip->base + SUN6I_ALRM_IRQ_STA); - - if (val & SUN6I_ALRM_IRQ_STA_CNT_IRQ_PEND) { -@@ -129,10 +135,11 @@ static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) - - rtc_update_irq(chip->rtc, 1, RTC_AF | RTC_IRQF); - -- return IRQ_HANDLED; -+ ret = IRQ_HANDLED; - } -+ spin_unlock(&chip->lock); - -- return IRQ_NONE; -+ return ret; - } - - static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) -@@ -140,6 +147,7 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) - u32 alrm_val = 0; - u32 alrm_irq_val = 0; - u32 alrm_wake_val = 0; -+ unsigned long flags; - - if (to) { - alrm_val = SUN6I_ALRM_EN_CNT_EN; -@@ -150,9 +158,11 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) - chip->base + SUN6I_ALRM_IRQ_STA); - } - -+ spin_lock_irqsave(&chip->lock, flags); - writel(alrm_val, chip->base + SUN6I_ALRM_EN); - writel(alrm_irq_val, chip->base + SUN6I_ALRM_IRQ_EN); - writel(alrm_wake_val, chip->base + SUN6I_ALARM_CONFIG); -+ spin_unlock_irqrestore(&chip->lock, flags); - } - - static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) -@@ -191,11 +201,15 @@ static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) - static int sun6i_rtc_getalarm(struct device *dev, struct rtc_wkalrm *wkalrm) - { - struct sun6i_rtc_dev *chip = dev_get_drvdata(dev); -+ unsigned long flags; - u32 alrm_st; - u32 alrm_en; - -+ spin_lock_irqsave(&chip->lock, flags); - alrm_en = readl(chip->base + SUN6I_ALRM_IRQ_EN); - alrm_st = readl(chip->base + SUN6I_ALRM_IRQ_STA); -+ spin_unlock_irqrestore(&chip->lock, flags); -+ - wkalrm->enabled = !!(alrm_en & SUN6I_ALRM_EN_CNT_EN); - wkalrm->pending = !!(alrm_st & SUN6I_ALRM_EN_CNT_EN); - rtc_time_to_tm(chip->alarm, &wkalrm->time); -@@ -356,6 +370,7 @@ static int sun6i_rtc_probe(struct platform_device *pdev) - chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); - if (!chip) - return -ENOMEM; -+ spin_lock_init(&chip->lock); - - platform_set_drvdata(pdev, chip); - chip->dev = &pdev->dev; -@@ -404,6 +419,10 @@ static int sun6i_rtc_probe(struct platform_device *pdev) - /* disable alarm wakeup */ - writel(0, chip->base + SUN6I_ALARM_CONFIG); - -+ /* switch to the external, more precise, oscillator */ -+ writel(SUN6I_LOSC_CTRL_KEY | SUN6I_LOSC_CTRL_EXT_OSC, -+ chip->base + SUN6I_LOSC_CTRL); -+ - chip->rtc = rtc_device_register("rtc-sun6i", &pdev->dev, - &sun6i_rtc_ops, THIS_MODULE); - if (IS_ERR(chip->rtc)) { -@@ -439,9 +458,4 @@ static struct platform_driver sun6i_rtc_driver = { - .of_match_table = sun6i_rtc_dt_ids, - }, - }; -- --module_platform_driver(sun6i_rtc_driver); -- --MODULE_DESCRIPTION("sun6i RTC driver"); --MODULE_AUTHOR("Chen-Yu Tsai <wens@csie.org>"); --MODULE_LICENSE("GPL"); -+builtin_platform_driver(sun6i_rtc_driver); -diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c -index 0c45388..7b178d7 100644 ---- a/drivers/scsi/aacraid/src.c -+++ b/drivers/scsi/aacraid/src.c -@@ -414,16 +414,23 @@ static int aac_src_check_health(struct aac_dev *dev) - u32 status = src_readl(dev, MUnit.OMR); - - /* -+ * Check to see if the board panic'd. -+ */ -+ if (unlikely(status & KERNEL_PANIC)) -+ goto err_blink; -+ -+ /* - * Check to see if the board failed any self tests. - */ - if (unlikely(status & SELF_TEST_FAILED)) -- return -1; -+ goto err_out; - - /* -- * Check to see if the board panic'd. -+ * Check to see if the board failed any self tests. - */ -- if (unlikely(status & KERNEL_PANIC)) -- return (status >> 16) & 0xFF; -+ if (unlikely(status & MONITOR_PANIC)) -+ goto err_out; -+ - /* - * Wait for the adapter to be up and running. - */ -@@ -433,6 +440,12 @@ static int aac_src_check_health(struct aac_dev *dev) - * Everything is OK - */ - return 0; -+ -+err_out: -+ return -1; -+ -+err_blink: -+ return (status > 16) & 0xFF; - } - - /** -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index ee802273..55faa94 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1185,6 +1185,7 @@ struct lpfc_mbx_wq_create { - #define lpfc_mbx_wq_create_page_size_SHIFT 0 - #define lpfc_mbx_wq_create_page_size_MASK 0x000000FF - #define lpfc_mbx_wq_create_page_size_WORD word1 -+#define LPFC_WQ_PAGE_SIZE_4096 0x1 - #define lpfc_mbx_wq_create_wqe_size_SHIFT 8 - #define lpfc_mbx_wq_create_wqe_size_MASK 0x0000000F - #define lpfc_mbx_wq_create_wqe_size_WORD word1 -@@ -1256,6 +1257,7 @@ struct rq_context { - #define lpfc_rq_context_page_size_SHIFT 0 /* Version 1 Only */ - #define lpfc_rq_context_page_size_MASK 0x000000FF - #define lpfc_rq_context_page_size_WORD word0 -+#define LPFC_RQ_PAGE_SIZE_4096 0x1 - uint32_t reserved1; - uint32_t word2; - #define lpfc_rq_context_cq_id_SHIFT 16 -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index f4f77c5..49b4c79 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -13678,7 +13678,7 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, - LPFC_WQ_WQE_SIZE_128); - bf_set(lpfc_mbx_wq_create_page_size, - &wq_create->u.request_1, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ LPFC_WQ_PAGE_SIZE_4096); - page = wq_create->u.request_1.page; - break; - } -@@ -13704,8 +13704,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, - LPFC_WQ_WQE_SIZE_128); - break; - } -- bf_set(lpfc_mbx_wq_create_page_size, &wq_create->u.request_1, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ bf_set(lpfc_mbx_wq_create_page_size, -+ &wq_create->u.request_1, -+ LPFC_WQ_PAGE_SIZE_4096); - page = wq_create->u.request_1.page; - break; - default: -@@ -13891,7 +13892,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq, - LPFC_RQE_SIZE_8); - bf_set(lpfc_rq_context_page_size, - &rq_create->u.request.context, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ LPFC_RQ_PAGE_SIZE_4096); - } else { - switch (hrq->entry_count) { - default: -diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c -index b8d3b97..84addee 100644 ---- a/drivers/scsi/scsi_dh.c -+++ b/drivers/scsi/scsi_dh.c -@@ -219,20 +219,6 @@ int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh) - } - EXPORT_SYMBOL_GPL(scsi_unregister_device_handler); - --static struct scsi_device *get_sdev_from_queue(struct request_queue *q) --{ -- struct scsi_device *sdev; -- unsigned long flags; -- -- spin_lock_irqsave(q->queue_lock, flags); -- sdev = q->queuedata; -- if (!sdev || !get_device(&sdev->sdev_gendev)) -- sdev = NULL; -- spin_unlock_irqrestore(q->queue_lock, flags); -- -- return sdev; --} -- - /* - * scsi_dh_activate - activate the path associated with the scsi_device - * corresponding to the given request queue. -@@ -251,7 +237,7 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data) - struct scsi_device *sdev; - int err = SCSI_DH_NOSYS; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) { - if (fn) - fn(data, err); -@@ -298,7 +284,7 @@ int scsi_dh_set_params(struct request_queue *q, const char *params) - struct scsi_device *sdev; - int err = -SCSI_DH_NOSYS; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return err; - -@@ -321,7 +307,7 @@ int scsi_dh_attach(struct request_queue *q, const char *name) - struct scsi_device_handler *scsi_dh; - int err = 0; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return -ENODEV; - -@@ -359,7 +345,7 @@ const char *scsi_dh_attached_handler_name(struct request_queue *q, gfp_t gfp) - struct scsi_device *sdev; - const char *handler_name = NULL; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return NULL; - -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index e64eae4..d8099c7 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -2127,6 +2127,29 @@ void scsi_mq_destroy_tags(struct Scsi_Host *shost) - blk_mq_free_tag_set(&shost->tag_set); - } - -+/** -+ * scsi_device_from_queue - return sdev associated with a request_queue -+ * @q: The request queue to return the sdev from -+ * -+ * Return the sdev associated with a request queue or NULL if the -+ * request_queue does not reference a SCSI device. -+ */ -+struct scsi_device *scsi_device_from_queue(struct request_queue *q) -+{ -+ struct scsi_device *sdev = NULL; -+ -+ if (q->mq_ops) { -+ if (q->mq_ops == &scsi_mq_ops) -+ sdev = q->queuedata; -+ } else if (q->request_fn == scsi_request_fn) -+ sdev = q->queuedata; -+ if (!sdev || !get_device(&sdev->sdev_gendev)) -+ sdev = NULL; -+ -+ return sdev; -+} -+EXPORT_SYMBOL_GPL(scsi_device_from_queue); -+ - /* - * Function: scsi_block_requests() - * -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 8ccfc9e..3f218f5 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -136,6 +136,8 @@ struct hv_fc_wwn_packet { - #define SRB_FLAGS_PORT_DRIVER_RESERVED 0x0F000000 - #define SRB_FLAGS_CLASS_DRIVER_RESERVED 0xF0000000 - -+#define SP_UNTAGGED ((unsigned char) ~0) -+#define SRB_SIMPLE_TAG_REQUEST 0x20 - - /* - * Platform neutral description of a scsi request - -@@ -375,6 +377,7 @@ enum storvsc_request_type { - #define SRB_STATUS_SUCCESS 0x01 - #define SRB_STATUS_ABORTED 0x02 - #define SRB_STATUS_ERROR 0x04 -+#define SRB_STATUS_DATA_OVERRUN 0x12 - - #define SRB_STATUS(status) \ - (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN)) -@@ -889,6 +892,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, - switch (SRB_STATUS(vm_srb->srb_status)) { - case SRB_STATUS_ERROR: - /* -+ * Let upper layer deal with error when -+ * sense message is present. -+ */ -+ -+ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) -+ break; -+ /* - * If there is an error; offline the device since all - * error recovery strategies would have already been - * deployed on the host side. However, if the command -@@ -953,6 +963,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, - struct scsi_cmnd *scmnd = cmd_request->cmd; - struct scsi_sense_hdr sense_hdr; - struct vmscsi_request *vm_srb; -+ u32 data_transfer_length; - struct Scsi_Host *host; - u32 payload_sz = cmd_request->payload_sz; - void *payload = cmd_request->payload; -@@ -960,6 +971,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, - host = stor_dev->host; - - vm_srb = &cmd_request->vstor_packet.vm_srb; -+ data_transfer_length = vm_srb->data_transfer_length; - - scmnd->result = vm_srb->scsi_status; - -@@ -973,13 +985,20 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, - &sense_hdr); - } - -- if (vm_srb->srb_status != SRB_STATUS_SUCCESS) -+ if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { - storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, - sense_hdr.ascq); -+ /* -+ * The Windows driver set data_transfer_length on -+ * SRB_STATUS_DATA_OVERRUN. On other errors, this value -+ * is untouched. In these cases we set it to 0. -+ */ -+ if (vm_srb->srb_status != SRB_STATUS_DATA_OVERRUN) -+ data_transfer_length = 0; -+ } - - scsi_set_resid(scmnd, -- cmd_request->payload->range.len - -- vm_srb->data_transfer_length); -+ cmd_request->payload->range.len - data_transfer_length); - - scmnd->scsi_done(scmnd); - -@@ -1451,6 +1470,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - vm_srb->win8_extension.srb_flags |= - SRB_FLAGS_DISABLE_SYNCH_TRANSFER; - -+ if (scmnd->device->tagged_supported) { -+ vm_srb->win8_extension.srb_flags |= -+ (SRB_FLAGS_QUEUE_ACTION_ENABLE | SRB_FLAGS_NO_QUEUE_FREEZE); -+ vm_srb->win8_extension.queue_tag = SP_UNTAGGED; -+ vm_srb->win8_extension.queue_action = SRB_SIMPLE_TAG_REQUEST; -+ } -+ - /* Build the SRB */ - switch (scmnd->sc_data_direction) { - case DMA_TO_DEVICE: -diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c -index 3c09e94..186342b 100644 ---- a/drivers/spi/spi-s3c64xx.c -+++ b/drivers/spi/spi-s3c64xx.c -@@ -1003,7 +1003,7 @@ static struct s3c64xx_spi_info *s3c64xx_spi_parse_dt(struct device *dev) - sci->num_cs = temp; - } - -- sci->no_cs = of_property_read_bool(dev->of_node, "broken-cs"); -+ sci->no_cs = of_property_read_bool(dev->of_node, "no-cs-readback"); - - return sci; - } -diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c -index 7882306..29dc249 100644 ---- a/drivers/staging/greybus/loopback.c -+++ b/drivers/staging/greybus/loopback.c -@@ -1051,8 +1051,13 @@ static int gb_loopback_fn(void *data) - gb_loopback_calculate_stats(gb, !!error); - } - gb->send_count++; -- if (us_wait) -- udelay(us_wait); -+ -+ if (us_wait) { -+ if (us_wait < 20000) -+ usleep_range(us_wait, us_wait + 100); -+ else -+ msleep(us_wait / 1000); -+ } - } - - gb_pm_runtime_put_autosuspend(bundle); -diff --git a/drivers/staging/lustre/lnet/selftest/rpc.c b/drivers/staging/lustre/lnet/selftest/rpc.c -index f5619d8..0256d65 100644 ---- a/drivers/staging/lustre/lnet/selftest/rpc.c -+++ b/drivers/staging/lustre/lnet/selftest/rpc.c -@@ -252,7 +252,7 @@ srpc_service_init(struct srpc_service *svc) - svc->sv_shuttingdown = 0; - - svc->sv_cpt_data = cfs_percpt_alloc(lnet_cpt_table(), -- sizeof(*svc->sv_cpt_data)); -+ sizeof(**svc->sv_cpt_data)); - if (!svc->sv_cpt_data) - return -ENOMEM; - -diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c -index b87cbbb..b39fd1e 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_recv.c -+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c -@@ -1383,6 +1383,9 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) - ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); - } - -+ if (!ptr) -+ return _FAIL; -+ - memcpy(ptr, pattrib->dst, ETH_ALEN); - memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); - -diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c -index cbd2e51..cedf25b 100644 ---- a/drivers/staging/rtl8712/rtl871x_recv.c -+++ b/drivers/staging/rtl8712/rtl871x_recv.c -@@ -643,11 +643,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) - /* append rx status for mp test packets */ - ptr = recvframe_pull(precvframe, (rmv_len - - sizeof(struct ethhdr) + 2) - 24); -+ if (!ptr) -+ return _FAIL; - memcpy(ptr, get_rxmem(precvframe), 24); - ptr += 24; -- } else -+ } else { - ptr = recvframe_pull(precvframe, (rmv_len - - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); -+ if (!ptr) -+ return _FAIL; -+ } - - memcpy(ptr, pattrib->dst, ETH_ALEN); - memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index d2b860e..5dc6bfc 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1234,6 +1234,9 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) - unsigned transfer_in_flight; - unsigned started; - -+ if (dep->flags & DWC3_EP_STALL) -+ return 0; -+ - if (dep->number > 1) - trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue); - else -@@ -1258,6 +1261,8 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol) - else - dep->flags |= DWC3_EP_STALL; - } else { -+ if (!(dep->flags & DWC3_EP_STALL)) -+ return 0; - - ret = dwc3_send_clear_stall_ep_cmd(dep); - if (ret) -diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c -index e2966f8..b0f7195 100644 ---- a/drivers/usb/gadget/function/f_hid.c -+++ b/drivers/usb/gadget/function/f_hid.c -@@ -50,12 +50,12 @@ struct f_hidg { - - /* recv report */ - struct list_head completed_out_req; -- spinlock_t spinlock; -+ spinlock_t read_spinlock; - wait_queue_head_t read_queue; - unsigned int qlen; - - /* send report */ -- struct mutex lock; -+ spinlock_t write_spinlock; - bool write_pending; - wait_queue_head_t write_queue; - struct usb_request *req; -@@ -204,28 +204,35 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, - if (!access_ok(VERIFY_WRITE, buffer, count)) - return -EFAULT; - -- spin_lock_irqsave(&hidg->spinlock, flags); -+ spin_lock_irqsave(&hidg->read_spinlock, flags); - - #define READ_COND (!list_empty(&hidg->completed_out_req)) - - /* wait for at least one buffer to complete */ - while (!READ_COND) { -- spin_unlock_irqrestore(&hidg->spinlock, flags); -+ spin_unlock_irqrestore(&hidg->read_spinlock, flags); - if (file->f_flags & O_NONBLOCK) - return -EAGAIN; - - if (wait_event_interruptible(hidg->read_queue, READ_COND)) - return -ERESTARTSYS; - -- spin_lock_irqsave(&hidg->spinlock, flags); -+ spin_lock_irqsave(&hidg->read_spinlock, flags); - } - - /* pick the first one */ - list = list_first_entry(&hidg->completed_out_req, - struct f_hidg_req_list, list); -+ -+ /* -+ * Remove this from list to protect it from beign free() -+ * while host disables our function -+ */ -+ list_del(&list->list); -+ - req = list->req; - count = min_t(unsigned int, count, req->actual - list->pos); -- spin_unlock_irqrestore(&hidg->spinlock, flags); -+ spin_unlock_irqrestore(&hidg->read_spinlock, flags); - - /* copy to user outside spinlock */ - count -= copy_to_user(buffer, req->buf + list->pos, count); -@@ -238,15 +245,20 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, - * call, taking into account its current read position. - */ - if (list->pos == req->actual) { -- spin_lock_irqsave(&hidg->spinlock, flags); -- list_del(&list->list); - kfree(list); -- spin_unlock_irqrestore(&hidg->spinlock, flags); - - req->length = hidg->report_length; - ret = usb_ep_queue(hidg->out_ep, req, GFP_KERNEL); -- if (ret < 0) -+ if (ret < 0) { -+ free_ep_req(hidg->out_ep, req); - return ret; -+ } -+ } else { -+ spin_lock_irqsave(&hidg->read_spinlock, flags); -+ list_add(&list->list, &hidg->completed_out_req); -+ spin_unlock_irqrestore(&hidg->read_spinlock, flags); -+ -+ wake_up(&hidg->read_queue); - } - - return count; -@@ -255,13 +267,16 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, - static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req) - { - struct f_hidg *hidg = (struct f_hidg *)ep->driver_data; -+ unsigned long flags; - - if (req->status != 0) { - ERROR(hidg->func.config->cdev, - "End Point Request ERROR: %d\n", req->status); - } - -+ spin_lock_irqsave(&hidg->write_spinlock, flags); - hidg->write_pending = 0; -+ spin_unlock_irqrestore(&hidg->write_spinlock, flags); - wake_up(&hidg->write_queue); - } - -@@ -269,18 +284,19 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, - size_t count, loff_t *offp) - { - struct f_hidg *hidg = file->private_data; -+ unsigned long flags; - ssize_t status = -ENOMEM; - - if (!access_ok(VERIFY_READ, buffer, count)) - return -EFAULT; - -- mutex_lock(&hidg->lock); -+ spin_lock_irqsave(&hidg->write_spinlock, flags); - - #define WRITE_COND (!hidg->write_pending) - - /* write queue */ - while (!WRITE_COND) { -- mutex_unlock(&hidg->lock); -+ spin_unlock_irqrestore(&hidg->write_spinlock, flags); - if (file->f_flags & O_NONBLOCK) - return -EAGAIN; - -@@ -288,17 +304,20 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, - hidg->write_queue, WRITE_COND)) - return -ERESTARTSYS; - -- mutex_lock(&hidg->lock); -+ spin_lock_irqsave(&hidg->write_spinlock, flags); - } - -+ hidg->write_pending = 1; - count = min_t(unsigned, count, hidg->report_length); -+ -+ spin_unlock_irqrestore(&hidg->write_spinlock, flags); - status = copy_from_user(hidg->req->buf, buffer, count); - - if (status != 0) { - ERROR(hidg->func.config->cdev, - "copy_from_user error\n"); -- mutex_unlock(&hidg->lock); -- return -EINVAL; -+ status = -EINVAL; -+ goto release_write_pending; - } - - hidg->req->status = 0; -@@ -306,19 +325,23 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, - hidg->req->length = count; - hidg->req->complete = f_hidg_req_complete; - hidg->req->context = hidg; -- hidg->write_pending = 1; - - status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC); - if (status < 0) { - ERROR(hidg->func.config->cdev, - "usb_ep_queue error on int endpoint %zd\n", status); -- hidg->write_pending = 0; -- wake_up(&hidg->write_queue); -+ goto release_write_pending; - } else { - status = count; - } - -- mutex_unlock(&hidg->lock); -+ return status; -+release_write_pending: -+ spin_lock_irqsave(&hidg->write_spinlock, flags); -+ hidg->write_pending = 0; -+ spin_unlock_irqrestore(&hidg->write_spinlock, flags); -+ -+ wake_up(&hidg->write_queue); - - return status; - } -@@ -371,20 +394,36 @@ static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep, - static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req) - { - struct f_hidg *hidg = (struct f_hidg *) req->context; -+ struct usb_composite_dev *cdev = hidg->func.config->cdev; - struct f_hidg_req_list *req_list; - unsigned long flags; - -- req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC); -- if (!req_list) -- return; -+ switch (req->status) { -+ case 0: -+ req_list = kzalloc(sizeof(*req_list), GFP_ATOMIC); -+ if (!req_list) { -+ ERROR(cdev, "Unable to allocate mem for req_list\n"); -+ goto free_req; -+ } - -- req_list->req = req; -+ req_list->req = req; - -- spin_lock_irqsave(&hidg->spinlock, flags); -- list_add_tail(&req_list->list, &hidg->completed_out_req); -- spin_unlock_irqrestore(&hidg->spinlock, flags); -+ spin_lock_irqsave(&hidg->read_spinlock, flags); -+ list_add_tail(&req_list->list, &hidg->completed_out_req); -+ spin_unlock_irqrestore(&hidg->read_spinlock, flags); - -- wake_up(&hidg->read_queue); -+ wake_up(&hidg->read_queue); -+ break; -+ default: -+ ERROR(cdev, "Set report failed %d\n", req->status); -+ /* FALLTHROUGH */ -+ case -ECONNABORTED: /* hardware forced ep reset */ -+ case -ECONNRESET: /* request dequeued */ -+ case -ESHUTDOWN: /* disconnect from host */ -+free_req: -+ free_ep_req(ep, req); -+ return; -+ } - } - - static int hidg_setup(struct usb_function *f, -@@ -490,14 +529,18 @@ static void hidg_disable(struct usb_function *f) - { - struct f_hidg *hidg = func_to_hidg(f); - struct f_hidg_req_list *list, *next; -+ unsigned long flags; - - usb_ep_disable(hidg->in_ep); - usb_ep_disable(hidg->out_ep); - -+ spin_lock_irqsave(&hidg->read_spinlock, flags); - list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { -+ free_ep_req(hidg->out_ep, list->req); - list_del(&list->list); - kfree(list); - } -+ spin_unlock_irqrestore(&hidg->read_spinlock, flags); - } - - static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) -@@ -646,8 +689,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) - if (status) - goto fail; - -- mutex_init(&hidg->lock); -- spin_lock_init(&hidg->spinlock); -+ spin_lock_init(&hidg->write_spinlock); -+ spin_lock_init(&hidg->read_spinlock); - init_waitqueue_head(&hidg->write_queue); - init_waitqueue_head(&hidg->read_queue); - INIT_LIST_HEAD(&hidg->completed_out_req); -diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c -index 0402177..d685d82 100644 ---- a/drivers/usb/gadget/udc/core.c -+++ b/drivers/usb/gadget/udc/core.c -@@ -1080,6 +1080,24 @@ static void usb_udc_nop_release(struct device *dev) - dev_vdbg(dev, "%s\n", __func__); - } - -+/* should be called with udc_lock held */ -+static int check_pending_gadget_drivers(struct usb_udc *udc) -+{ -+ struct usb_gadget_driver *driver; -+ int ret = 0; -+ -+ list_for_each_entry(driver, &gadget_driver_pending_list, pending) -+ if (!driver->udc_name || strcmp(driver->udc_name, -+ dev_name(&udc->dev)) == 0) { -+ ret = udc_bind_to_driver(udc, driver); -+ if (ret != -EPROBE_DEFER) -+ list_del(&driver->pending); -+ break; -+ } -+ -+ return ret; -+} -+ - /** - * usb_add_gadget_udc_release - adds a new gadget to the udc class driver list - * @parent: the parent device to this udc. Usually the controller driver's -@@ -1093,7 +1111,6 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget, - void (*release)(struct device *dev)) - { - struct usb_udc *udc; -- struct usb_gadget_driver *driver; - int ret = -ENOMEM; - - udc = kzalloc(sizeof(*udc), GFP_KERNEL); -@@ -1136,17 +1153,9 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget, - udc->vbus = true; - - /* pick up one of pending gadget drivers */ -- list_for_each_entry(driver, &gadget_driver_pending_list, pending) { -- if (!driver->udc_name || strcmp(driver->udc_name, -- dev_name(&udc->dev)) == 0) { -- ret = udc_bind_to_driver(udc, driver); -- if (ret != -EPROBE_DEFER) -- list_del(&driver->pending); -- if (ret) -- goto err5; -- break; -- } -- } -+ ret = check_pending_gadget_drivers(udc); -+ if (ret) -+ goto err5; - - mutex_unlock(&udc_lock); - -@@ -1356,14 +1365,22 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver) - return -EINVAL; - - mutex_lock(&udc_lock); -- list_for_each_entry(udc, &udc_list, list) -+ list_for_each_entry(udc, &udc_list, list) { - if (udc->driver == driver) { - usb_gadget_remove_driver(udc); - usb_gadget_set_state(udc->gadget, -- USB_STATE_NOTATTACHED); -+ USB_STATE_NOTATTACHED); -+ -+ /* Maybe there is someone waiting for this UDC? */ -+ check_pending_gadget_drivers(udc); -+ /* -+ * For now we ignore bind errors as probably it's -+ * not a valid reason to fail other's gadget unbind -+ */ - ret = 0; - break; - } -+ } - - if (ret) { - list_del(&driver->pending); -diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c -index aab5221..aac0ce8 100644 ---- a/drivers/usb/gadget/udc/fsl_udc_core.c -+++ b/drivers/usb/gadget/udc/fsl_udc_core.c -@@ -1249,6 +1249,12 @@ static const struct usb_gadget_ops fsl_gadget_ops = { - .udc_stop = fsl_udc_stop, - }; - -+/* -+ * Empty complete function used by this driver to fill in the req->complete -+ * field when creating a request since the complete field is mandatory. -+ */ -+static void fsl_noop_complete(struct usb_ep *ep, struct usb_request *req) { } -+ - /* Set protocol stall on ep0, protocol stall will automatically be cleared - on new transaction */ - static void ep0stall(struct fsl_udc *udc) -@@ -1283,7 +1289,7 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction) - req->req.length = 0; - req->req.status = -EINPROGRESS; - req->req.actual = 0; -- req->req.complete = NULL; -+ req->req.complete = fsl_noop_complete; - req->dtd_count = 0; - - ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); -@@ -1366,7 +1372,7 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value, - req->req.length = 2; - req->req.status = -EINPROGRESS; - req->req.actual = 0; -- req->req.complete = NULL; -+ req->req.complete = fsl_noop_complete; - req->dtd_count = 0; - - ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index ed56bf9..abe3606 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -223,9 +223,6 @@ static int xhci_plat_probe(struct platform_device *pdev) - if (device_property_read_bool(&pdev->dev, "usb3-lpm-capable")) - xhci->quirks |= XHCI_LPM_SUPPORT; - -- if (HCC_MAX_PSA(xhci->hcc_params) >= 4) -- xhci->shared_hcd->can_do_streams = 1; -- - hcd->usb_phy = devm_usb_get_phy_by_phandle(&pdev->dev, "usb-phy", 0); - if (IS_ERR(hcd->usb_phy)) { - ret = PTR_ERR(hcd->usb_phy); -@@ -242,6 +239,9 @@ static int xhci_plat_probe(struct platform_device *pdev) - if (ret) - goto disable_usb_phy; - -+ if (HCC_MAX_PSA(xhci->hcc_params) >= 4) -+ xhci->shared_hcd->can_do_streams = 1; -+ - ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); - if (ret) - goto dealloc_usb2_hcd; -diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c -index 2440f88..bacee0f 100644 ---- a/drivers/usb/musb/da8xx.c -+++ b/drivers/usb/musb/da8xx.c -@@ -434,15 +434,11 @@ static int da8xx_musb_exit(struct musb *musb) - } - - static const struct musb_platform_ops da8xx_ops = { -- .quirks = MUSB_DMA_CPPI | MUSB_INDEXED_EP, -+ .quirks = MUSB_INDEXED_EP, - .init = da8xx_musb_init, - .exit = da8xx_musb_exit, - - .fifo_mode = 2, --#ifdef CONFIG_USB_TI_CPPI_DMA -- .dma_init = cppi_dma_controller_create, -- .dma_exit = cppi_dma_controller_destroy, --#endif - .enable = da8xx_musb_enable, - .disable = da8xx_musb_disable, - -diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c -index 181793f..9d2738e 100644 ---- a/drivers/virtio/virtio_balloon.c -+++ b/drivers/virtio/virtio_balloon.c -@@ -615,8 +615,12 @@ static void virtballoon_remove(struct virtio_device *vdev) - cancel_work_sync(&vb->update_balloon_stats_work); - - remove_common(vb); -+#ifdef CONFIG_BALLOON_COMPACTION - if (vb->vb_dev_info.inode) - iput(vb->vb_dev_info.inode); -+ -+ kern_unmount(balloon_mnt); -+#endif - kfree(vb); - } - -diff --git a/drivers/vme/vme.c b/drivers/vme/vme.c -index bdbadaa..0035cf7 100644 ---- a/drivers/vme/vme.c -+++ b/drivers/vme/vme.c -@@ -1625,10 +1625,25 @@ static int vme_bus_probe(struct device *dev) - return retval; - } - -+static int vme_bus_remove(struct device *dev) -+{ -+ int retval = -ENODEV; -+ struct vme_driver *driver; -+ struct vme_dev *vdev = dev_to_vme_dev(dev); -+ -+ driver = dev->platform_data; -+ -+ if (driver->remove != NULL) -+ retval = driver->remove(vdev); -+ -+ return retval; -+} -+ - struct bus_type vme_bus_type = { - .name = "vme", - .match = vme_bus_match, - .probe = vme_bus_probe, -+ .remove = vme_bus_remove, - }; - EXPORT_SYMBOL(vme_bus_type); - -diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c -index 049a884..59d74d1 100644 ---- a/drivers/w1/masters/ds2490.c -+++ b/drivers/w1/masters/ds2490.c -@@ -153,6 +153,9 @@ struct ds_device - */ - u16 spu_bit; - -+ u8 st_buf[ST_SIZE]; -+ u8 byte_buf; -+ - struct w1_bus_master master; - }; - -@@ -174,7 +177,6 @@ struct ds_status - u8 data_in_buffer_status; - u8 reserved1; - u8 reserved2; -- - }; - - static struct usb_device_id ds_id_table [] = { -@@ -244,28 +246,6 @@ static int ds_send_control(struct ds_device *dev, u16 value, u16 index) - return err; - } - --static int ds_recv_status_nodump(struct ds_device *dev, struct ds_status *st, -- unsigned char *buf, int size) --{ -- int count, err; -- -- memset(st, 0, sizeof(*st)); -- -- count = 0; -- err = usb_interrupt_msg(dev->udev, usb_rcvintpipe(dev->udev, -- dev->ep[EP_STATUS]), buf, size, &count, 1000); -- if (err < 0) { -- pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", -- dev->ep[EP_STATUS], err); -- return err; -- } -- -- if (count >= sizeof(*st)) -- memcpy(st, buf, sizeof(*st)); -- -- return count; --} -- - static inline void ds_print_msg(unsigned char *buf, unsigned char *str, int off) - { - pr_info("%45s: %8x\n", str, buf[off]); -@@ -324,6 +304,35 @@ static void ds_dump_status(struct ds_device *dev, unsigned char *buf, int count) - } - } - -+static int ds_recv_status(struct ds_device *dev, struct ds_status *st, -+ bool dump) -+{ -+ int count, err; -+ -+ if (st) -+ memset(st, 0, sizeof(*st)); -+ -+ count = 0; -+ err = usb_interrupt_msg(dev->udev, -+ usb_rcvintpipe(dev->udev, -+ dev->ep[EP_STATUS]), -+ dev->st_buf, sizeof(dev->st_buf), -+ &count, 1000); -+ if (err < 0) { -+ pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", -+ dev->ep[EP_STATUS], err); -+ return err; -+ } -+ -+ if (dump) -+ ds_dump_status(dev, dev->st_buf, count); -+ -+ if (st && count >= sizeof(*st)) -+ memcpy(st, dev->st_buf, sizeof(*st)); -+ -+ return count; -+} -+ - static void ds_reset_device(struct ds_device *dev) - { - ds_send_control_cmd(dev, CTL_RESET_DEVICE, 0); -@@ -344,7 +353,6 @@ static void ds_reset_device(struct ds_device *dev) - static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) - { - int count, err; -- struct ds_status st; - - /* Careful on size. If size is less than what is available in - * the input buffer, the device fails the bulk transfer and -@@ -359,14 +367,9 @@ static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) - err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN]), - buf, size, &count, 1000); - if (err < 0) { -- u8 buf[ST_SIZE]; -- int count; -- - pr_info("Clearing ep0x%x.\n", dev->ep[EP_DATA_IN]); - usb_clear_halt(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN])); -- -- count = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); -- ds_dump_status(dev, buf, count); -+ ds_recv_status(dev, NULL, true); - return err; - } - -@@ -404,7 +407,6 @@ int ds_stop_pulse(struct ds_device *dev, int limit) - { - struct ds_status st; - int count = 0, err = 0; -- u8 buf[ST_SIZE]; - - do { - err = ds_send_control(dev, CTL_HALT_EXE_IDLE, 0); -@@ -413,7 +415,7 @@ int ds_stop_pulse(struct ds_device *dev, int limit) - err = ds_send_control(dev, CTL_RESUME_EXE, 0); - if (err) - break; -- err = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); -+ err = ds_recv_status(dev, &st, false); - if (err) - break; - -@@ -456,18 +458,17 @@ int ds_detect(struct ds_device *dev, struct ds_status *st) - - static int ds_wait_status(struct ds_device *dev, struct ds_status *st) - { -- u8 buf[ST_SIZE]; - int err, count = 0; - - do { - st->status = 0; -- err = ds_recv_status_nodump(dev, st, buf, sizeof(buf)); -+ err = ds_recv_status(dev, st, false); - #if 0 - if (err >= 0) { - int i; - printk("0x%x: count=%d, status: ", dev->ep[EP_STATUS], err); - for (i=0; i<err; ++i) -- printk("%02x ", buf[i]); -+ printk("%02x ", dev->st_buf[i]); - printk("\n"); - } - #endif -@@ -485,7 +486,7 @@ static int ds_wait_status(struct ds_device *dev, struct ds_status *st) - * can do something with it). - */ - if (err > 16 || count >= 100 || err < 0) -- ds_dump_status(dev, buf, err); -+ ds_dump_status(dev, dev->st_buf, err); - - /* Extended data isn't an error. Well, a short is, but the dump - * would have already told the user that and we can't do anything -@@ -608,7 +609,6 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) - { - int err; - struct ds_status st; -- u8 rbyte; - - err = ds_send_control(dev, COMM_BYTE_IO | COMM_IM | dev->spu_bit, byte); - if (err) -@@ -621,11 +621,11 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) - if (err) - return err; - -- err = ds_recv_data(dev, &rbyte, sizeof(rbyte)); -+ err = ds_recv_data(dev, &dev->byte_buf, 1); - if (err < 0) - return err; - -- return !(byte == rbyte); -+ return !(byte == dev->byte_buf); - } - - static int ds_read_byte(struct ds_device *dev, u8 *byte) -@@ -712,7 +712,6 @@ static void ds9490r_search(void *data, struct w1_master *master, - int err; - u16 value, index; - struct ds_status st; -- u8 st_buf[ST_SIZE]; - int search_limit; - int found = 0; - int i; -@@ -724,7 +723,12 @@ static void ds9490r_search(void *data, struct w1_master *master, - /* FIFO 128 bytes, bulk packet size 64, read a multiple of the - * packet size. - */ -- u64 buf[2*64/8]; -+ const size_t bufsize = 2 * 64; -+ u64 *buf; -+ -+ buf = kmalloc(bufsize, GFP_KERNEL); -+ if (!buf) -+ return; - - mutex_lock(&master->bus_mutex); - -@@ -745,10 +749,9 @@ static void ds9490r_search(void *data, struct w1_master *master, - do { - schedule_timeout(jtime); - -- if (ds_recv_status_nodump(dev, &st, st_buf, sizeof(st_buf)) < -- sizeof(st)) { -+ err = ds_recv_status(dev, &st, false); -+ if (err < 0 || err < sizeof(st)) - break; -- } - - if (st.data_in_buffer_status) { - /* Bulk in can receive partial ids, but when it does -@@ -758,7 +761,7 @@ static void ds9490r_search(void *data, struct w1_master *master, - * bulk without first checking if status says there - * is data to read. - */ -- err = ds_recv_data(dev, (u8 *)buf, sizeof(buf)); -+ err = ds_recv_data(dev, (u8 *)buf, bufsize); - if (err < 0) - break; - for (i = 0; i < err/8; ++i) { -@@ -794,9 +797,14 @@ static void ds9490r_search(void *data, struct w1_master *master, - } - search_out: - mutex_unlock(&master->bus_mutex); -+ kfree(buf); - } - - #if 0 -+/* -+ * FIXME: if this disabled code is ever used in the future all ds_send_data() -+ * calls must be changed to use a DMAable buffer. -+ */ - static int ds_match_access(struct ds_device *dev, u64 init) - { - int err; -@@ -845,13 +853,12 @@ static int ds_set_path(struct ds_device *dev, u64 init) - - static u8 ds9490r_touch_bit(void *data, u8 bit) - { -- u8 ret; - struct ds_device *dev = data; - -- if (ds_touch_bit(dev, bit, &ret)) -+ if (ds_touch_bit(dev, bit, &dev->byte_buf)) - return 0; - -- return ret; -+ return dev->byte_buf; - } - - #if 0 -@@ -866,13 +873,12 @@ static u8 ds9490r_read_bit(void *data) - { - struct ds_device *dev = data; - int err; -- u8 bit = 0; - -- err = ds_touch_bit(dev, 1, &bit); -+ err = ds_touch_bit(dev, 1, &dev->byte_buf); - if (err) - return 0; - -- return bit & 1; -+ return dev->byte_buf & 1; - } - #endif - -@@ -887,32 +893,52 @@ static u8 ds9490r_read_byte(void *data) - { - struct ds_device *dev = data; - int err; -- u8 byte = 0; - -- err = ds_read_byte(dev, &byte); -+ err = ds_read_byte(dev, &dev->byte_buf); - if (err) - return 0; - -- return byte; -+ return dev->byte_buf; - } - - static void ds9490r_write_block(void *data, const u8 *buf, int len) - { - struct ds_device *dev = data; -+ u8 *tbuf; -+ -+ if (len <= 0) -+ return; -+ -+ tbuf = kmalloc(len, GFP_KERNEL); -+ if (!tbuf) -+ return; - -- ds_write_block(dev, (u8 *)buf, len); -+ memcpy(tbuf, buf, len); -+ ds_write_block(dev, tbuf, len); -+ -+ kfree(tbuf); - } - - static u8 ds9490r_read_block(void *data, u8 *buf, int len) - { - struct ds_device *dev = data; - int err; -+ u8 *tbuf; - -- err = ds_read_block(dev, buf, len); -- if (err < 0) -+ if (len <= 0) -+ return 0; -+ -+ tbuf = kmalloc(len, GFP_KERNEL); -+ if (!tbuf) - return 0; - -- return len; -+ err = ds_read_block(dev, tbuf, len); -+ if (err >= 0) -+ memcpy(buf, tbuf, len); -+ -+ kfree(tbuf); -+ -+ return err >= 0 ? len : 0; - } - - static u8 ds9490r_reset(void *data) -diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c -index e213c67..ab0931e 100644 ---- a/drivers/w1/w1.c -+++ b/drivers/w1/w1.c -@@ -763,6 +763,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn) - dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__, - sl->name); - w1_family_put(sl->family); -+ atomic_dec(&sl->master->refcnt); - kfree(sl); - return err; - } -diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c -index ef3ebd7..1e643c7 100644 ---- a/fs/ceph/addr.c -+++ b/fs/ceph/addr.c -@@ -363,6 +363,7 @@ static int start_read(struct inode *inode, struct list_head *page_list, int max) - nr_pages = i; - if (nr_pages > 0) { - len = nr_pages << PAGE_SHIFT; -+ osd_req_op_extent_update(req, 0, len); - break; - } - goto out_pages; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 18a1e1d..1cd0e2e 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2884,7 +2884,15 @@ cifs_readdata_to_iov(struct cifs_readdata *rdata, struct iov_iter *iter) - for (i = 0; i < rdata->nr_pages; i++) { - struct page *page = rdata->pages[i]; - size_t copy = min_t(size_t, remaining, PAGE_SIZE); -- size_t written = copy_page_to_iter(page, 0, copy, iter); -+ size_t written; -+ -+ if (unlikely(iter->type & ITER_PIPE)) { -+ void *addr = kmap_atomic(page); -+ -+ written = copy_to_iter(addr, copy, iter); -+ kunmap_atomic(addr); -+ } else -+ written = copy_page_to_iter(page, 0, copy, iter); - remaining -= written; - if (written < copy && iov_iter_count(iter) > 0) - break; -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index c930a01..9fbf92c 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -5344,7 +5344,8 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - ext4_lblk_t stop, *iterator, ex_start, ex_end; - - /* Let path point to the last extent */ -- path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, 0); -+ path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - -@@ -5353,15 +5354,15 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - if (!extent) - goto out; - -- stop = le32_to_cpu(extent->ee_block) + -- ext4_ext_get_actual_len(extent); -+ stop = le32_to_cpu(extent->ee_block); - - /* - * In case of left shift, Don't start shifting extents until we make - * sure the hole is big enough to accommodate the shift. - */ - if (SHIFT == SHIFT_LEFT) { -- path = ext4_find_extent(inode, start - 1, &path, 0); -+ path = ext4_find_extent(inode, start - 1, &path, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - depth = path->p_depth; -@@ -5393,9 +5394,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - else - iterator = &stop; - -- /* Its safe to start updating extents */ -- while (start < stop) { -- path = ext4_find_extent(inode, *iterator, &path, 0); -+ /* -+ * Its safe to start updating extents. Start and stop are unsigned, so -+ * in case of right shift if extent with 0 block is reached, iterator -+ * becomes NULL to indicate the end of the loop. -+ */ -+ while (iterator && start <= stop) { -+ path = ext4_find_extent(inode, *iterator, &path, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - depth = path->p_depth; -@@ -5422,8 +5428,11 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - ext4_ext_get_actual_len(extent); - } else { - extent = EXT_FIRST_EXTENT(path[depth].p_hdr); -- *iterator = le32_to_cpu(extent->ee_block) > 0 ? -- le32_to_cpu(extent->ee_block) - 1 : 0; -+ if (le32_to_cpu(extent->ee_block) > 0) -+ *iterator = le32_to_cpu(extent->ee_block) - 1; -+ else -+ /* Beginning is reached, end of the loop */ -+ iterator = NULL; - /* Update path extent in case we need to stop */ - while (le32_to_cpu(extent->ee_block) < start) - extent++; -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index d8ca4b9..37b521e 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -376,7 +376,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, - static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, - unsigned int len) - { -- int ret, size; -+ int ret, size, no_expand; - struct ext4_inode_info *ei = EXT4_I(inode); - - if (!ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) -@@ -386,15 +386,14 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, - if (size < len) - return -ENOSPC; - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - - if (ei->i_inline_off) - ret = ext4_update_inline_data(handle, inode, len); - else - ret = ext4_create_inline_data(handle, inode, len); - -- up_write(&EXT4_I(inode)->xattr_sem); -- -+ ext4_write_unlock_xattr(inode, &no_expand); - return ret; - } - -@@ -523,7 +522,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, - struct inode *inode, - unsigned flags) - { -- int ret, needed_blocks; -+ int ret, needed_blocks, no_expand; - handle_t *handle = NULL; - int retries = 0, sem_held = 0; - struct page *page = NULL; -@@ -563,7 +562,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, - goto out; - } - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - sem_held = 1; - /* If some one has already done this for us, just exit. */ - if (!ext4_has_inline_data(inode)) { -@@ -600,7 +599,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, - put_page(page); - page = NULL; - ext4_orphan_add(handle, inode); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - sem_held = 0; - ext4_journal_stop(handle); - handle = NULL; -@@ -626,7 +625,7 @@ static int ext4_convert_inline_data_to_extent(struct address_space *mapping, - put_page(page); - } - if (sem_held) -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - if (handle) - ext4_journal_stop(handle); - brelse(iloc.bh); -@@ -719,7 +718,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping, - int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, - unsigned copied, struct page *page) - { -- int ret; -+ int ret, no_expand; - void *kaddr; - struct ext4_iloc iloc; - -@@ -737,7 +736,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, - goto out; - } - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - BUG_ON(!ext4_has_inline_data(inode)); - - kaddr = kmap_atomic(page); -@@ -747,7 +746,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, - /* clear page dirty so that writepages wouldn't work for us. */ - ClearPageDirty(page); - -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - brelse(iloc.bh); - out: - return copied; -@@ -758,7 +757,7 @@ ext4_journalled_write_inline_data(struct inode *inode, - unsigned len, - struct page *page) - { -- int ret; -+ int ret, no_expand; - void *kaddr; - struct ext4_iloc iloc; - -@@ -768,11 +767,11 @@ ext4_journalled_write_inline_data(struct inode *inode, - return NULL; - } - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - kaddr = kmap_atomic(page); - ext4_write_inline_data(inode, &iloc, kaddr, 0, len); - kunmap_atomic(kaddr); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - - return iloc.bh; - } -@@ -934,8 +933,15 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, - struct page *page) - { - int i_size_changed = 0; -+ int ret; - -- copied = ext4_write_inline_data_end(inode, pos, len, copied, page); -+ ret = ext4_write_inline_data_end(inode, pos, len, copied, page); -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); -+ return ret; -+ } -+ copied = ret; - - /* - * No need to use i_size_read() here, the i_size -@@ -1249,7 +1255,7 @@ static int ext4_convert_inline_data_nolock(handle_t *handle, - int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, - struct inode *dir, struct inode *inode) - { -- int ret, inline_size; -+ int ret, inline_size, no_expand; - void *inline_start; - struct ext4_iloc iloc; - -@@ -1257,7 +1263,7 @@ int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, - if (ret) - return ret; - -- down_write(&EXT4_I(dir)->xattr_sem); -+ ext4_write_lock_xattr(dir, &no_expand); - if (!ext4_has_inline_data(dir)) - goto out; - -@@ -1303,7 +1309,7 @@ int ext4_try_add_inline_entry(handle_t *handle, struct ext4_filename *fname, - - out: - ext4_mark_inode_dirty(handle, dir); -- up_write(&EXT4_I(dir)->xattr_sem); -+ ext4_write_unlock_xattr(dir, &no_expand); - brelse(iloc.bh); - return ret; - } -@@ -1663,7 +1669,7 @@ int ext4_delete_inline_entry(handle_t *handle, - struct buffer_head *bh, - int *has_inline_data) - { -- int err, inline_size; -+ int err, inline_size, no_expand; - struct ext4_iloc iloc; - void *inline_start; - -@@ -1671,7 +1677,7 @@ int ext4_delete_inline_entry(handle_t *handle, - if (err) - return err; - -- down_write(&EXT4_I(dir)->xattr_sem); -+ ext4_write_lock_xattr(dir, &no_expand); - if (!ext4_has_inline_data(dir)) { - *has_inline_data = 0; - goto out; -@@ -1705,7 +1711,7 @@ int ext4_delete_inline_entry(handle_t *handle, - - ext4_show_inline_dir(dir, iloc.bh, inline_start, inline_size); - out: -- up_write(&EXT4_I(dir)->xattr_sem); -+ ext4_write_unlock_xattr(dir, &no_expand); - brelse(iloc.bh); - if (err != -ENOENT) - ext4_std_error(dir->i_sb, err); -@@ -1804,11 +1810,11 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) - - int ext4_destroy_inline_data(handle_t *handle, struct inode *inode) - { -- int ret; -+ int ret, no_expand; - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - ret = ext4_destroy_inline_data_nolock(handle, inode); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - - return ret; - } -@@ -1893,7 +1899,7 @@ int ext4_try_to_evict_inline_data(handle_t *handle, - void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - { - handle_t *handle; -- int inline_size, value_len, needed_blocks; -+ int inline_size, value_len, needed_blocks, no_expand; - size_t i_size; - void *value = NULL; - struct ext4_xattr_ibody_find is = { -@@ -1910,7 +1916,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - if (IS_ERR(handle)) - return; - -- down_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_lock_xattr(inode, &no_expand); - if (!ext4_has_inline_data(inode)) { - *has_inline = 0; - ext4_journal_stop(handle); -@@ -1968,7 +1974,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - up_write(&EXT4_I(inode)->i_data_sem); - out: - brelse(is.iloc.bh); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - kfree(value); - if (inode->i_nlink) - ext4_orphan_del(handle, inode); -@@ -1984,7 +1990,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) - - int ext4_convert_inline_data(struct inode *inode) - { -- int error, needed_blocks; -+ int error, needed_blocks, no_expand; - handle_t *handle; - struct ext4_iloc iloc; - -@@ -2006,15 +2012,10 @@ int ext4_convert_inline_data(struct inode *inode) - goto out_free; - } - -- down_write(&EXT4_I(inode)->xattr_sem); -- if (!ext4_has_inline_data(inode)) { -- up_write(&EXT4_I(inode)->xattr_sem); -- goto out; -- } -- -- error = ext4_convert_inline_data_nolock(handle, inode, &iloc); -- up_write(&EXT4_I(inode)->xattr_sem); --out: -+ ext4_write_lock_xattr(inode, &no_expand); -+ if (ext4_has_inline_data(inode)) -+ error = ext4_convert_inline_data_nolock(handle, inode, &iloc); -+ ext4_write_unlock_xattr(inode, &no_expand); - ext4_journal_stop(handle); - out_free: - brelse(iloc.bh); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 33a509c..1d4f5fa 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1324,8 +1324,11 @@ static int ext4_write_end(struct file *file, - if (ext4_has_inline_data(inode)) { - ret = ext4_write_inline_data_end(inode, pos, len, - copied, page); -- if (ret < 0) -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); - goto errout; -+ } - copied = ret; - } else - copied = block_write_end(file, mapping, pos, -@@ -1379,7 +1382,9 @@ static int ext4_write_end(struct file *file, - * set the buffer to be dirty, since in data=journalled mode we need - * to call ext4_handle_dirty_metadata() instead. - */ --static void zero_new_buffers(struct page *page, unsigned from, unsigned to) -+static void ext4_journalled_zero_new_buffers(handle_t *handle, -+ struct page *page, -+ unsigned from, unsigned to) - { - unsigned int block_start = 0, block_end; - struct buffer_head *head, *bh; -@@ -1396,7 +1401,7 @@ static void zero_new_buffers(struct page *page, unsigned from, unsigned to) - size = min(to, block_end) - start; - - zero_user(page, start, size); -- set_buffer_uptodate(bh); -+ write_end_fn(handle, bh); - } - clear_buffer_new(bh); - } -@@ -1425,18 +1430,25 @@ static int ext4_journalled_write_end(struct file *file, - - BUG_ON(!ext4_handle_valid(handle)); - -- if (ext4_has_inline_data(inode)) -- copied = ext4_write_inline_data_end(inode, pos, len, -- copied, page); -- else { -- if (copied < len) { -- if (!PageUptodate(page)) -- copied = 0; -- zero_new_buffers(page, from+copied, to); -+ if (ext4_has_inline_data(inode)) { -+ ret = ext4_write_inline_data_end(inode, pos, len, -+ copied, page); -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); -+ goto errout; - } -- -+ copied = ret; -+ } else if (unlikely(copied < len) && !PageUptodate(page)) { -+ copied = 0; -+ ext4_journalled_zero_new_buffers(handle, page, from, to); -+ } else { -+ if (unlikely(copied < len)) -+ ext4_journalled_zero_new_buffers(handle, page, -+ from + copied, to); - ret = ext4_walk_page_buffers(handle, page_buffers(page), from, -- to, &partial, write_end_fn); -+ from + copied, &partial, -+ write_end_fn); - if (!partial) - SetPageUptodate(page); - } -@@ -1462,6 +1474,7 @@ static int ext4_journalled_write_end(struct file *file, - */ - ext4_orphan_add(handle, inode); - -+errout: - ret2 = ext4_journal_stop(handle); - if (!ret) - ret = ret2; -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 7ae43c5..2e9fc7a 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -3123,6 +3123,13 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, - if (ar->pright && start + size - 1 >= ar->lright) - size -= start + size - ar->lright; - -+ /* -+ * Trim allocation request for filesystems with artificially small -+ * groups. -+ */ -+ if (size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb)) -+ size = EXT4_BLOCKS_PER_GROUP(ac->ac_sb); -+ - end = start + size; - - /* check we don't cross already preallocated blocks */ -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 104f8bf..c4a389a 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1616,13 +1616,15 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi - !fscrypt_has_permitted_context(dir, inode)) { - int nokey = ext4_encrypted_inode(inode) && - !fscrypt_has_encryption_key(inode); -- iput(inode); -- if (nokey) -+ if (nokey) { -+ iput(inode); - return ERR_PTR(-ENOKEY); -+ } - ext4_warning(inode->i_sb, - "Inconsistent encryption contexts: %lu/%lu", - (unsigned long) dir->i_ino, - (unsigned long) inode->i_ino); -+ iput(inode); - return ERR_PTR(-EPERM); - } - } -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index bbc316d..afe29ba 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -825,6 +825,7 @@ static void ext4_put_super(struct super_block *sb) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; -+ int aborted = 0; - int i, err; - - ext4_unregister_li_request(sb); -@@ -834,9 +835,10 @@ static void ext4_put_super(struct super_block *sb) - destroy_workqueue(sbi->rsv_conversion_wq); - - if (sbi->s_journal) { -+ aborted = is_journal_aborted(sbi->s_journal); - err = jbd2_journal_destroy(sbi->s_journal); - sbi->s_journal = NULL; -- if (err < 0) -+ if ((err < 0) && !aborted) - ext4_abort(sb, "Couldn't clean up the journal"); - } - -@@ -847,7 +849,7 @@ static void ext4_put_super(struct super_block *sb) - ext4_mb_release(sb); - ext4_ext_release(sb); - -- if (!(sb->s_flags & MS_RDONLY)) { -+ if (!(sb->s_flags & MS_RDONLY) && !aborted) { - ext4_clear_feature_journal_needs_recovery(sb); - es->s_state = cpu_to_le16(sbi->s_mount_state); - } -@@ -3911,7 +3913,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - * root first: it may be modified in the journal! - */ - if (!test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) { -- if (ext4_load_journal(sb, es, journal_devnum)) -+ err = ext4_load_journal(sb, es, journal_devnum); -+ if (err) - goto failed_mount3a; - } else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) && - ext4_has_feature_journal_needs_recovery(sb)) { -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index d77be9e..4448ed3 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -1174,16 +1174,14 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, - struct ext4_xattr_block_find bs = { - .s = { .not_found = -ENODATA, }, - }; -- unsigned long no_expand; -+ int no_expand; - int error; - - if (!name) - return -EINVAL; - if (strlen(name) > 255) - return -ERANGE; -- down_write(&EXT4_I(inode)->xattr_sem); -- no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); -- ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ ext4_write_lock_xattr(inode, &no_expand); - - error = ext4_reserve_inode_write(handle, inode, &is.iloc); - if (error) -@@ -1251,7 +1249,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, - ext4_xattr_update_super_block(handle, inode->i_sb); - inode->i_ctime = ext4_current_time(inode); - if (!value) -- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ no_expand = 0; - error = ext4_mark_iloc_dirty(handle, inode, &is.iloc); - /* - * The bh is consumed by ext4_mark_iloc_dirty, even with -@@ -1265,9 +1263,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index, - cleanup: - brelse(is.iloc.bh); - brelse(bs.bh); -- if (no_expand == 0) -- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - return error; - } - -@@ -1484,12 +1480,11 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, - int error = 0, tried_min_extra_isize = 0; - int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); - int isize_diff; /* How much do we need to grow i_extra_isize */ -+ int no_expand; -+ -+ if (ext4_write_trylock_xattr(inode, &no_expand) == 0) -+ return 0; - -- down_write(&EXT4_I(inode)->xattr_sem); -- /* -- * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty -- */ -- ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); - retry: - isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize; - if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) -@@ -1571,17 +1566,16 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, - EXT4_I(inode)->i_extra_isize = new_extra_isize; - brelse(bh); - out: -- ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); -- up_write(&EXT4_I(inode)->xattr_sem); -+ ext4_write_unlock_xattr(inode, &no_expand); - return 0; - - cleanup: - brelse(bh); - /* -- * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode -- * size expansion failed. -+ * Inode size expansion failed; don't try again - */ -- up_write(&EXT4_I(inode)->xattr_sem); -+ no_expand = 1; -+ ext4_write_unlock_xattr(inode, &no_expand); - return error; - } - -diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h -index a92e783..099c8b6 100644 ---- a/fs/ext4/xattr.h -+++ b/fs/ext4/xattr.h -@@ -102,6 +102,38 @@ extern const struct xattr_handler ext4_xattr_security_handler; - - #define EXT4_XATTR_NAME_ENCRYPTION_CONTEXT "c" - -+/* -+ * The EXT4_STATE_NO_EXPAND is overloaded and used for two purposes. -+ * The first is to signal that there the inline xattrs and data are -+ * taking up so much space that we might as well not keep trying to -+ * expand it. The second is that xattr_sem is taken for writing, so -+ * we shouldn't try to recurse into the inode expansion. For this -+ * second case, we need to make sure that we take save and restore the -+ * NO_EXPAND state flag appropriately. -+ */ -+static inline void ext4_write_lock_xattr(struct inode *inode, int *save) -+{ -+ down_write(&EXT4_I(inode)->xattr_sem); -+ *save = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); -+} -+ -+static inline int ext4_write_trylock_xattr(struct inode *inode, int *save) -+{ -+ if (down_write_trylock(&EXT4_I(inode)->xattr_sem) == 0) -+ return 0; -+ *save = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ return 1; -+} -+ -+static inline void ext4_write_unlock_xattr(struct inode *inode, int *save) -+{ -+ if (*save == 0) -+ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); -+ up_write(&EXT4_I(inode)->xattr_sem); -+} -+ - extern ssize_t ext4_listxattr(struct dentry *, char *, size_t); - - extern int ext4_xattr_get(struct inode *, int, const char *, void *, size_t); -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index 369f451..ebdc90f 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -207,9 +207,13 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, - f2fs_put_page(dentry_page, 0); - } - -- if (!de && room && F2FS_I(dir)->chash != namehash) { -- F2FS_I(dir)->chash = namehash; -- F2FS_I(dir)->clevel = level; -+ /* This is to increase the speed of f2fs_create */ -+ if (!de && room) { -+ F2FS_I(dir)->task = current; -+ if (F2FS_I(dir)->chash != namehash) { -+ F2FS_I(dir)->chash = namehash; -+ F2FS_I(dir)->clevel = level; -+ } - } - - return de; -@@ -643,14 +647,34 @@ int __f2fs_add_link(struct inode *dir, const struct qstr *name, - struct inode *inode, nid_t ino, umode_t mode) - { - struct fscrypt_name fname; -+ struct page *page = NULL; -+ struct f2fs_dir_entry *de = NULL; - int err; - - err = fscrypt_setup_filename(dir, name, 0, &fname); - if (err) - return err; - -- err = __f2fs_do_add_link(dir, &fname, inode, ino, mode); -- -+ /* -+ * An immature stakable filesystem shows a race condition between lookup -+ * and create. If we have same task when doing lookup and create, it's -+ * definitely fine as expected by VFS normally. Otherwise, let's just -+ * verify on-disk dentry one more time, which guarantees filesystem -+ * consistency more. -+ */ -+ if (current != F2FS_I(dir)->task) { -+ de = __f2fs_find_entry(dir, &fname, &page); -+ F2FS_I(dir)->task = NULL; -+ } -+ if (de) { -+ f2fs_dentry_kunmap(dir, page); -+ f2fs_put_page(page, 0); -+ err = -EEXIST; -+ } else if (IS_ERR(page)) { -+ err = PTR_ERR(page); -+ } else { -+ err = __f2fs_do_add_link(dir, &fname, inode, ino, mode); -+ } - fscrypt_free_filename(&fname); - return err; - } -diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c -index 2b06d4f..7b32ce9 100644 ---- a/fs/f2fs/extent_cache.c -+++ b/fs/f2fs/extent_cache.c -@@ -352,11 +352,12 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode, - } - - if (next_ex && __is_front_mergeable(ei, &next_ex->ei)) { -- if (en) -- __release_extent_node(sbi, et, prev_ex); - next_ex->ei.fofs = ei->fofs; - next_ex->ei.blk = ei->blk; - next_ex->ei.len += ei->len; -+ if (en) -+ __release_extent_node(sbi, et, prev_ex); -+ - en = next_ex; - } - -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 506af45..3a1640b 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -431,6 +431,7 @@ struct f2fs_inode_info { - atomic_t dirty_pages; /* # of dirty pages */ - f2fs_hash_t chash; /* hash value of given file name */ - unsigned int clevel; /* maximum level of given file name */ -+ struct task_struct *task; /* lookup and create consistency */ - nid_t i_xattr_nid; /* node id that contains xattrs */ - unsigned long long xattr_ver; /* cp version of xattr modification */ - loff_t last_disk_size; /* lastly written file size */ -@@ -833,6 +834,9 @@ struct f2fs_sb_info { - struct f2fs_gc_kthread *gc_thread; /* GC thread */ - unsigned int cur_victim_sec; /* current victim section num */ - -+ /* threshold for converting bg victims for fg */ -+ u64 fggc_threshold; -+ - /* maximum # of trials to find a victim segment for SSR and GC */ - unsigned int max_victim_search; - -diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c -index 6f14ee9..34a69e7 100644 ---- a/fs/f2fs/gc.c -+++ b/fs/f2fs/gc.c -@@ -166,7 +166,8 @@ static void select_policy(struct f2fs_sb_info *sbi, int gc_type, - p->ofs_unit = sbi->segs_per_sec; - } - -- if (p->max_search > sbi->max_victim_search) -+ /* we need to check every dirty segments in the FG_GC case */ -+ if (gc_type != FG_GC && p->max_search > sbi->max_victim_search) - p->max_search = sbi->max_victim_search; - - p->offset = sbi->last_victim[p->gc_mode]; -@@ -199,6 +200,10 @@ static unsigned int check_bg_victims(struct f2fs_sb_info *sbi) - for_each_set_bit(secno, dirty_i->victim_secmap, MAIN_SECS(sbi)) { - if (sec_usage_check(sbi, secno)) - continue; -+ -+ if (no_fggc_candidate(sbi, secno)) -+ continue; -+ - clear_bit(secno, dirty_i->victim_secmap); - return secno * sbi->segs_per_sec; - } -@@ -322,13 +327,15 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, - nsearched++; - } - -- - secno = GET_SECNO(sbi, segno); - - if (sec_usage_check(sbi, secno)) - goto next; - if (gc_type == BG_GC && test_bit(secno, dirty_i->victim_secmap)) - goto next; -+ if (gc_type == FG_GC && p.alloc_mode == LFS && -+ no_fggc_candidate(sbi, secno)) -+ goto next; - - cost = get_gc_cost(sbi, segno, &p); - -@@ -972,5 +979,16 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync) - - void build_gc_manager(struct f2fs_sb_info *sbi) - { -+ u64 main_count, resv_count, ovp_count, blocks_per_sec; -+ - DIRTY_I(sbi)->v_ops = &default_v_ops; -+ -+ /* threshold of # of valid blocks in a section for victims of FG_GC */ -+ main_count = SM_I(sbi)->main_segments << sbi->log_blocks_per_seg; -+ resv_count = SM_I(sbi)->reserved_segments << sbi->log_blocks_per_seg; -+ ovp_count = SM_I(sbi)->ovp_segments << sbi->log_blocks_per_seg; -+ blocks_per_sec = sbi->blocks_per_seg * sbi->segs_per_sec; -+ -+ sbi->fggc_threshold = div_u64((main_count - ovp_count) * blocks_per_sec, -+ (main_count - resv_count)); - } -diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c -index fc886f0..a7943f86 100644 ---- a/fs/f2fs/segment.c -+++ b/fs/f2fs/segment.c -@@ -813,6 +813,8 @@ void clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc) - start = start_segno + sbi->segs_per_sec; - if (start < end) - goto next; -+ else -+ end = start - 1; - } - mutex_unlock(&dirty_i->seglist_lock); - -diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h -index fecb856..b164f83 100644 ---- a/fs/f2fs/segment.h -+++ b/fs/f2fs/segment.h -@@ -688,6 +688,15 @@ static inline block_t sum_blk_addr(struct f2fs_sb_info *sbi, int base, int type) - - (base + 1) + type; - } - -+static inline bool no_fggc_candidate(struct f2fs_sb_info *sbi, -+ unsigned int secno) -+{ -+ if (get_valid_blocks(sbi, secno, sbi->segs_per_sec) >= -+ sbi->fggc_threshold) -+ return true; -+ return false; -+} -+ - static inline bool sec_usage_check(struct f2fs_sb_info *sbi, unsigned int secno) - { - if (IS_CURSEC(sbi, secno) || (sbi->cur_victim_sec == secno)) -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 2401c5d..5ec5870 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -100,6 +100,7 @@ static void fuse_file_put(struct fuse_file *ff, bool sync) - iput(req->misc.release.inode); - fuse_put_request(ff->fc, req); - } else if (sync) { -+ __set_bit(FR_FORCE, &req->flags); - __clear_bit(FR_BACKGROUND, &req->flags); - fuse_request_send(ff->fc, req); - iput(req->misc.release.inode); -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 14cbf60..133f322 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -658,9 +658,11 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, - struct kmem_cache *cachep; - int ret, tries = 0; - -+ rcu_read_lock(); - gl = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); - if (gl && !lockref_get_not_dead(&gl->gl_lockref)) - gl = NULL; -+ rcu_read_unlock(); - - *glp = gl; - if (gl) -@@ -728,15 +730,18 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, - - if (ret == -EEXIST) { - ret = 0; -+ rcu_read_lock(); - tmp = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); - if (tmp == NULL || !lockref_get_not_dead(&tmp->gl_lockref)) { - if (++tries < 100) { -+ rcu_read_unlock(); - cond_resched(); - goto again; - } - tmp = NULL; - ret = -ENOMEM; - } -+ rcu_read_unlock(); - } else { - WARN_ON_ONCE(ret); - } -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index e165266..5e659ee 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1863,7 +1863,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) - - __blist_del_buffer(list, jh); - jh->b_jlist = BJ_None; -- if (test_clear_buffer_jbddirty(bh)) -+ if (transaction && is_journal_aborted(transaction->t_journal)) -+ clear_buffer_jbddirty(bh); -+ else if (test_clear_buffer_jbddirty(bh)) - mark_buffer_dirty(bh); /* Expose it to the VM */ - } - -diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index a5c3888..13abd60 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayout.c -+++ b/fs/nfs/flexfilelayout/flexfilelayout.c -@@ -1073,9 +1073,6 @@ static int ff_layout_async_handle_error_v4(struct rpc_task *task, - struct nfs_client *mds_client = mds_server->nfs_client; - struct nfs4_slot_table *tbl = &clp->cl_session->fc_slot_table; - -- if (task->tk_status >= 0) -- return 0; -- - switch (task->tk_status) { - /* MDS state errors */ - case -NFS4ERR_DELEG_REVOKED: -@@ -1176,9 +1173,6 @@ static int ff_layout_async_handle_error_v3(struct rpc_task *task, - { - struct nfs4_deviceid_node *devid = FF_LAYOUT_DEVID_NODE(lseg, idx); - -- if (task->tk_status >= 0) -- return 0; -- - switch (task->tk_status) { - /* File access problems. Don't mark the device as unavailable */ - case -EACCES: -@@ -1213,6 +1207,13 @@ static int ff_layout_async_handle_error(struct rpc_task *task, - { - int vers = clp->cl_nfs_mod->rpc_vers->number; - -+ if (task->tk_status >= 0) -+ return 0; -+ -+ /* Handle the case of an invalid layout segment */ -+ if (!pnfs_is_valid_lseg(lseg)) -+ return -NFS4ERR_RESET_TO_PNFS; -+ - switch (vers) { - case 3: - return ff_layout_async_handle_error_v3(task, lseg, idx); -diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c -index 6085019..5cda392 100644 ---- a/fs/nfs/nfs42proc.c -+++ b/fs/nfs/nfs42proc.c -@@ -128,30 +128,26 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len) - return err; - } - --static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, -+static ssize_t _nfs42_proc_copy(struct file *src, - struct nfs_lock_context *src_lock, -- struct file *dst, loff_t pos_dst, -+ struct file *dst, - struct nfs_lock_context *dst_lock, -- size_t count) -+ struct nfs42_copy_args *args, -+ struct nfs42_copy_res *res) - { -- struct nfs42_copy_args args = { -- .src_fh = NFS_FH(file_inode(src)), -- .src_pos = pos_src, -- .dst_fh = NFS_FH(file_inode(dst)), -- .dst_pos = pos_dst, -- .count = count, -- }; -- struct nfs42_copy_res res; - struct rpc_message msg = { - .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COPY], -- .rpc_argp = &args, -- .rpc_resp = &res, -+ .rpc_argp = args, -+ .rpc_resp = res, - }; - struct inode *dst_inode = file_inode(dst); - struct nfs_server *server = NFS_SERVER(dst_inode); -+ loff_t pos_src = args->src_pos; -+ loff_t pos_dst = args->dst_pos; -+ size_t count = args->count; - int status; - -- status = nfs4_set_rw_stateid(&args.src_stateid, src_lock->open_context, -+ status = nfs4_set_rw_stateid(&args->src_stateid, src_lock->open_context, - src_lock, FMODE_READ); - if (status) - return status; -@@ -161,7 +157,7 @@ static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, - if (status) - return status; - -- status = nfs4_set_rw_stateid(&args.dst_stateid, dst_lock->open_context, -+ status = nfs4_set_rw_stateid(&args->dst_stateid, dst_lock->open_context, - dst_lock, FMODE_WRITE); - if (status) - return status; -@@ -171,22 +167,22 @@ static ssize_t _nfs42_proc_copy(struct file *src, loff_t pos_src, - return status; - - status = nfs4_call_sync(server->client, server, &msg, -- &args.seq_args, &res.seq_res, 0); -+ &args->seq_args, &res->seq_res, 0); - if (status == -ENOTSUPP) - server->caps &= ~NFS_CAP_COPY; - if (status) - return status; - -- if (res.write_res.verifier.committed != NFS_FILE_SYNC) { -- status = nfs_commit_file(dst, &res.write_res.verifier.verifier); -+ if (res->write_res.verifier.committed != NFS_FILE_SYNC) { -+ status = nfs_commit_file(dst, &res->write_res.verifier.verifier); - if (status) - return status; - } - - truncate_pagecache_range(dst_inode, pos_dst, -- pos_dst + res.write_res.count); -+ pos_dst + res->write_res.count); - -- return res.write_res.count; -+ return res->write_res.count; - } - - ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, -@@ -196,8 +192,22 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, - struct nfs_server *server = NFS_SERVER(file_inode(dst)); - struct nfs_lock_context *src_lock; - struct nfs_lock_context *dst_lock; -- struct nfs4_exception src_exception = { }; -- struct nfs4_exception dst_exception = { }; -+ struct nfs42_copy_args args = { -+ .src_fh = NFS_FH(file_inode(src)), -+ .src_pos = pos_src, -+ .dst_fh = NFS_FH(file_inode(dst)), -+ .dst_pos = pos_dst, -+ .count = count, -+ }; -+ struct nfs42_copy_res res; -+ struct nfs4_exception src_exception = { -+ .inode = file_inode(src), -+ .stateid = &args.src_stateid, -+ }; -+ struct nfs4_exception dst_exception = { -+ .inode = file_inode(dst), -+ .stateid = &args.dst_stateid, -+ }; - ssize_t err, err2; - - if (!nfs_server_capable(file_inode(dst), NFS_CAP_COPY)) -@@ -207,7 +217,6 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, - if (IS_ERR(src_lock)) - return PTR_ERR(src_lock); - -- src_exception.inode = file_inode(src); - src_exception.state = src_lock->open_context->state; - - dst_lock = nfs_get_lock_context(nfs_file_open_context(dst)); -@@ -216,15 +225,17 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src, - goto out_put_src_lock; - } - -- dst_exception.inode = file_inode(dst); - dst_exception.state = dst_lock->open_context->state; - - do { - inode_lock(file_inode(dst)); -- err = _nfs42_proc_copy(src, pos_src, src_lock, -- dst, pos_dst, dst_lock, count); -+ err = _nfs42_proc_copy(src, src_lock, -+ dst, dst_lock, -+ &args, &res); - inode_unlock(file_inode(dst)); - -+ if (err >= 0) -+ break; - if (err == -ENOTSUPP) { - err = -EOPNOTSUPP; - break; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 78ff8b6..609840d 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -2708,6 +2708,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, - ret = PTR_ERR(state); - if (IS_ERR(state)) - goto out; -+ ctx->state = state; - if (server->caps & NFS_CAP_POSIX_LOCK) - set_bit(NFS_STATE_POSIX_LOCKS, &state->flags); - if (opendata->o_res.rflags & NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK) -@@ -2733,7 +2734,6 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, - if (ret != 0) - goto out; - -- ctx->state = state; - if (d_inode(dentry) == state->inode) { - nfs_inode_attach_open_context(ctx); - if (read_seqcount_retry(&sp->so_reclaim_seqcount, seq)) -@@ -4990,7 +4990,7 @@ static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size - */ - static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen) - { -- struct page *pages[NFS4ACL_MAXPAGES] = {NULL, }; -+ struct page *pages[NFS4ACL_MAXPAGES + 1] = {NULL, }; - struct nfs_getaclargs args = { - .fh = NFS_FH(inode), - .acl_pages = pages, -@@ -5004,13 +5004,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu - .rpc_argp = &args, - .rpc_resp = &res, - }; -- unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); -+ unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE) + 1; - int ret = -ENOMEM, i; - -- /* As long as we're doing a round trip to the server anyway, -- * let's be prepared for a page of acl data. */ -- if (npages == 0) -- npages = 1; - if (npages > ARRAY_SIZE(pages)) - return -ERANGE; - -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index fc89e5e..c9c4d985 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -2492,7 +2492,7 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr, - encode_compound_hdr(xdr, req, &hdr); - encode_sequence(xdr, &args->seq_args, &hdr); - encode_putfh(xdr, args->fh, &hdr); -- replen = hdr.replen + op_decode_hdr_maxsz + 1; -+ replen = hdr.replen + op_decode_hdr_maxsz; - encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr); - - xdr_inline_pages(&req->rq_rcv_buf, replen << 2, -diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index 8ca642f..b829cc9 100644 ---- a/fs/nfsd/vfs.c -+++ b/fs/nfsd/vfs.c -@@ -377,7 +377,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - __be32 err; - int host_err; - bool get_write_count; -- int size_change = 0; -+ bool size_change = (iap->ia_valid & ATTR_SIZE); - - if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) - accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; -@@ -390,11 +390,11 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - /* Get inode */ - err = fh_verify(rqstp, fhp, ftype, accmode); - if (err) -- goto out; -+ return err; - if (get_write_count) { - host_err = fh_want_write(fhp); - if (host_err) -- return nfserrno(host_err); -+ goto out; - } - - dentry = fhp->fh_dentry; -@@ -405,20 +405,28 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - iap->ia_valid &= ~ATTR_MODE; - - if (!iap->ia_valid) -- goto out; -+ return 0; - - nfsd_sanitize_attrs(inode, iap); - -+ if (check_guard && guardtime != inode->i_ctime.tv_sec) -+ return nfserr_notsync; -+ - /* - * The size case is special, it changes the file in addition to the -- * attributes. -+ * attributes, and file systems don't expect it to be mixed with -+ * "random" attribute changes. We thus split out the size change -+ * into a separate call to ->setattr, and do the rest as a separate -+ * setattr call. - */ -- if (iap->ia_valid & ATTR_SIZE) { -+ if (size_change) { - err = nfsd_get_write_access(rqstp, fhp, iap); - if (err) -- goto out; -- size_change = 1; -+ return err; -+ } - -+ fh_lock(fhp); -+ if (size_change) { - /* - * RFC5661, Section 18.30.4: - * Changing the size of a file with SETATTR indirectly -@@ -426,29 +434,36 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - * - * (and similar for the older RFCs) - */ -- if (iap->ia_size != i_size_read(inode)) -- iap->ia_valid |= ATTR_MTIME; -- } -+ struct iattr size_attr = { -+ .ia_valid = ATTR_SIZE | ATTR_CTIME | ATTR_MTIME, -+ .ia_size = iap->ia_size, -+ }; - -- iap->ia_valid |= ATTR_CTIME; -+ host_err = notify_change(dentry, &size_attr, NULL); -+ if (host_err) -+ goto out_unlock; -+ iap->ia_valid &= ~ATTR_SIZE; - -- if (check_guard && guardtime != inode->i_ctime.tv_sec) { -- err = nfserr_notsync; -- goto out_put_write_access; -+ /* -+ * Avoid the additional setattr call below if the only other -+ * attribute that the client sends is the mtime, as we update -+ * it as part of the size change above. -+ */ -+ if ((iap->ia_valid & ~ATTR_MTIME) == 0) -+ goto out_unlock; - } - -- fh_lock(fhp); -+ iap->ia_valid |= ATTR_CTIME; - host_err = notify_change(dentry, iap, NULL); -- fh_unlock(fhp); -- err = nfserrno(host_err); - --out_put_write_access: -+out_unlock: -+ fh_unlock(fhp); - if (size_change) - put_write_access(inode); -- if (!err) -- err = nfserrno(commit_metadata(fhp)); - out: -- return err; -+ if (!host_err) -+ host_err = commit_metadata(fhp); -+ return nfserrno(host_err); - } - - #if defined(CONFIG_NFSD_V4) -diff --git a/include/linux/compat.h b/include/linux/compat.h -index 6360939..d8535a4 100644 ---- a/include/linux/compat.h -+++ b/include/linux/compat.h -@@ -711,8 +711,10 @@ int __compat_save_altstack(compat_stack_t __user *, unsigned long); - compat_stack_t __user *__uss = uss; \ - struct task_struct *t = current; \ - put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \ -- put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \ -+ put_user_ex(t->sas_ss_flags, &__uss->ss_flags); \ - put_user_ex(t->sas_ss_size, &__uss->ss_size); \ -+ if (t->sas_ss_flags & SS_AUTODISARM) \ -+ sas_ss_reset(t); \ - } while (0); - - asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid, -diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h -index 2de4e2e..e0acb0e 100644 ---- a/include/linux/devfreq.h -+++ b/include/linux/devfreq.h -@@ -104,6 +104,8 @@ struct devfreq_dev_profile { - * struct devfreq_governor - Devfreq policy governor - * @node: list node - contains registered devfreq governors - * @name: Governor's name -+ * @immutable: Immutable flag for governor. If the value is 1, -+ * this govenror is never changeable to other governor. - * @get_target_freq: Returns desired operating frequency for the device. - * Basically, get_target_freq will run - * devfreq_dev_profile.get_dev_status() to get the -@@ -121,6 +123,7 @@ struct devfreq_governor { - struct list_head node; - - const char name[DEVFREQ_NAME_LEN]; -+ const unsigned int immutable; - int (*get_target_freq)(struct devfreq *this, unsigned long *freq); - int (*event_handler)(struct devfreq *devfreq, - unsigned int event, void *data); -diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h -index 3f9778c..c332f0a 100644 ---- a/include/linux/fsl_ifc.h -+++ b/include/linux/fsl_ifc.h -@@ -733,8 +733,12 @@ struct fsl_ifc_nand { - __be32 nand_erattr1; - u32 res19[0x10]; - __be32 nand_fsr; -- u32 res20[0x3]; -- __be32 nand_eccstat[6]; -+ u32 res20; -+ /* The V1 nand_eccstat is actually 4 words that overlaps the -+ * V2 nand_eccstat. -+ */ -+ __be32 v1_nand_eccstat[2]; -+ __be32 v2_nand_eccstat[6]; - u32 res21[0x1c]; - __be32 nanndcr; - u32 res22[0x2]; -diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h -index c92a083..192eef2f 100644 ---- a/include/linux/hyperv.h -+++ b/include/linux/hyperv.h -@@ -641,6 +641,7 @@ struct vmbus_channel_msginfo { - - /* Synchronize the request/response if needed */ - struct completion waitevent; -+ struct vmbus_channel *waiting_channel; - union { - struct vmbus_channel_version_supported version_supported; - struct vmbus_channel_open_result open_result; -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index d49e26c..23e129e 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -153,8 +153,8 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) - #define DMA_TLB_GLOBAL_FLUSH (((u64)1) << 60) - #define DMA_TLB_DSI_FLUSH (((u64)2) << 60) - #define DMA_TLB_PSI_FLUSH (((u64)3) << 60) --#define DMA_TLB_IIRG(type) ((type >> 60) & 7) --#define DMA_TLB_IAIG(val) (((val) >> 57) & 7) -+#define DMA_TLB_IIRG(type) ((type >> 60) & 3) -+#define DMA_TLB_IAIG(val) (((val) >> 57) & 3) - #define DMA_TLB_READ_DRAIN (((u64)1) << 49) - #define DMA_TLB_WRITE_DRAIN (((u64)1) << 48) - #define DMA_TLB_DID(id) (((u64)((id) & 0xffff)) << 32) -@@ -164,9 +164,9 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) - - /* INVALID_DESC */ - #define DMA_CCMD_INVL_GRANU_OFFSET 61 --#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 3) --#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 3) --#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 3) -+#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 4) -+#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 4) -+#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 4) - #define DMA_ID_TLB_READ_DRAIN (((u64)1) << 7) - #define DMA_ID_TLB_WRITE_DRAIN (((u64)1) << 6) - #define DMA_ID_TLB_DID(id) (((u64)((id & 0xffff) << 16))) -@@ -316,8 +316,8 @@ enum { - #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) - #define QI_DEV_EIOTLB_GLOB(g) ((u64)g) - #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) --#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32) --#define QI_DEV_EIOTLB_QDEP(qd) (((qd) & 0x1f) << 16) -+#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) -+#define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) - #define QI_DEV_EIOTLB_MAX_INVS 32 - - #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55) -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index f99c993..7e273e2 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -779,7 +779,7 @@ static inline struct pglist_data *lruvec_pgdat(struct lruvec *lruvec) - #endif - } - --extern unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru); -+extern unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone_idx); - - #ifdef CONFIG_HAVE_MEMORY_PRESENT - void memory_present(int nid, unsigned long start, unsigned long end); -diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h -index 5ee7aab..fd0e532 100644 ---- a/include/rdma/ib_sa.h -+++ b/include/rdma/ib_sa.h -@@ -153,12 +153,12 @@ struct ib_sa_path_rec { - union ib_gid sgid; - __be16 dlid; - __be16 slid; -- int raw_traffic; -+ u8 raw_traffic; - /* reserved */ - __be32 flow_label; - u8 hop_limit; - u8 traffic_class; -- int reversible; -+ u8 reversible; - u8 numb_path; - __be16 pkey; - __be16 qos_class; -@@ -220,7 +220,7 @@ struct ib_sa_mcmember_rec { - u8 hop_limit; - u8 scope; - u8 join_state; -- int proxy_join; -+ u8 proxy_join; - }; - - /* Service Record Component Mask Sec 15.2.5.14 Ver 1.1 */ -diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h -index 8a95631..b9ec493 100644 ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -315,6 +315,7 @@ extern void scsi_remove_device(struct scsi_device *); - extern int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh); - void scsi_attach_vpd(struct scsi_device *sdev); - -+extern struct scsi_device *scsi_device_from_queue(struct request_queue *q); - extern int scsi_device_get(struct scsi_device *); - extern void scsi_device_put(struct scsi_device *); - extern struct scsi_device *scsi_device_lookup(struct Scsi_Host *, -diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h -index dc10c52..393362b 100644 ---- a/include/soc/at91/at91sam9_ddrsdr.h -+++ b/include/soc/at91/at91sam9_ddrsdr.h -@@ -81,6 +81,7 @@ - #define AT91_DDRSDRC_LPCB_POWER_DOWN 2 - #define AT91_DDRSDRC_LPCB_DEEP_POWER_DOWN 3 - #define AT91_DDRSDRC_CLKFR (1 << 2) /* Clock Frozen */ -+#define AT91_DDRSDRC_LPDDR2_PWOFF (1 << 3) /* LPDDR Power Off */ - #define AT91_DDRSDRC_PASR (7 << 4) /* Partial Array Self Refresh */ - #define AT91_DDRSDRC_TCSR (3 << 8) /* Temperature Compensated Self Refresh */ - #define AT91_DDRSDRC_DS (3 << 10) /* Drive Strength */ -@@ -96,7 +97,9 @@ - #define AT91_DDRSDRC_MD_SDR 0 - #define AT91_DDRSDRC_MD_LOW_POWER_SDR 1 - #define AT91_DDRSDRC_MD_LOW_POWER_DDR 3 -+#define AT91_DDRSDRC_MD_LPDDR3 5 - #define AT91_DDRSDRC_MD_DDR2 6 /* [SAM9 Only] */ -+#define AT91_DDRSDRC_MD_LPDDR2 7 - #define AT91_DDRSDRC_DBW (1 << 4) /* Data Bus Width */ - #define AT91_DDRSDRC_DBW_32BITS (0 << 4) - #define AT91_DDRSDRC_DBW_16BITS (1 << 4) -diff --git a/ipc/shm.c b/ipc/shm.c -index dbac886..e2072ae 100644 ---- a/ipc/shm.c -+++ b/ipc/shm.c -@@ -1085,8 +1085,8 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) - * "raddr" thing points to kernel space, and there has to be a wrapper around - * this. - */ --long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, -- unsigned long shmlba) -+long do_shmat(int shmid, char __user *shmaddr, int shmflg, -+ ulong *raddr, unsigned long shmlba) - { - struct shmid_kernel *shp; - unsigned long addr; -@@ -1107,8 +1107,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, - goto out; - else if ((addr = (ulong)shmaddr)) { - if (addr & (shmlba - 1)) { -- if (shmflg & SHM_RND) -- addr &= ~(shmlba - 1); /* round down */ -+ /* -+ * Round down to the nearest multiple of shmlba. -+ * For sane do_mmap_pgoff() parameters, avoid -+ * round downs that trigger nil-page and MAP_FIXED. -+ */ -+ if ((shmflg & SHM_RND) && addr >= shmlba) -+ addr &= ~(shmlba - 1); - else - #ifndef __ARCH_FORCE_SHMLBA - if (addr & ~PAGE_MASK) -diff --git a/kernel/membarrier.c b/kernel/membarrier.c -index 536c727..9f9284f 100644 ---- a/kernel/membarrier.c -+++ b/kernel/membarrier.c -@@ -16,6 +16,7 @@ - - #include <linux/syscalls.h> - #include <linux/membarrier.h> -+#include <linux/tick.h> - - /* - * Bitmask made from a "or" of all commands within enum membarrier_cmd, -@@ -51,6 +52,9 @@ - */ - SYSCALL_DEFINE2(membarrier, int, cmd, int, flags) - { -+ /* MEMBARRIER_CMD_SHARED is not compatible with nohz_full. */ -+ if (tick_nohz_full_enabled()) -+ return -ENOSYS; - if (unlikely(flags)) - return -EINVAL; - switch (cmd) { -diff --git a/kernel/memremap.c b/kernel/memremap.c -index 9ecedc2..0612323 100644 ---- a/kernel/memremap.c -+++ b/kernel/memremap.c -@@ -246,9 +246,13 @@ static void devm_memremap_pages_release(struct device *dev, void *data) - /* pages are dead and unused, undo the arch mapping */ - align_start = res->start & ~(SECTION_SIZE - 1); - align_size = ALIGN(resource_size(res), SECTION_SIZE); -+ -+ lock_device_hotplug(); - mem_hotplug_begin(); - arch_remove_memory(align_start, align_size); - mem_hotplug_done(); -+ unlock_device_hotplug(); -+ - untrack_pfn(NULL, PHYS_PFN(align_start), align_size); - pgmap_radix_release(res); - dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc, -@@ -360,9 +364,11 @@ void *devm_memremap_pages(struct device *dev, struct resource *res, - if (error) - goto err_pfn_remap; - -+ lock_device_hotplug(); - mem_hotplug_begin(); - error = arch_add_memory(nid, align_start, align_size, true); - mem_hotplug_done(); -+ unlock_device_hotplug(); - if (error) - goto err_add_memory; - -diff --git a/kernel/signal.c b/kernel/signal.c -index 75761ac..0b14157 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -3226,10 +3226,17 @@ int compat_restore_altstack(const compat_stack_t __user *uss) - - int __compat_save_altstack(compat_stack_t __user *uss, unsigned long sp) - { -+ int err; - struct task_struct *t = current; -- return __put_user(ptr_to_compat((void __user *)t->sas_ss_sp), &uss->ss_sp) | -- __put_user(sas_ss_flags(sp), &uss->ss_flags) | -+ err = __put_user(ptr_to_compat((void __user *)t->sas_ss_sp), -+ &uss->ss_sp) | -+ __put_user(t->sas_ss_flags, &uss->ss_flags) | - __put_user(t->sas_ss_size, &uss->ss_size); -+ if (err) -+ return err; -+ if (t->sas_ss_flags & SS_AUTODISARM) -+ sas_ss_reset(t); -+ return 0; - } - #endif - -diff --git a/mm/filemap.c b/mm/filemap.c -index d8d7df8..edfb90e 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -910,9 +910,12 @@ void page_endio(struct page *page, bool is_write, int err) - unlock_page(page); - } else { - if (err) { -+ struct address_space *mapping; -+ - SetPageError(page); -- if (page->mapping) -- mapping_set_error(page->mapping, err); -+ mapping = page_mapping(page); -+ if (mapping) -+ mapping_set_error(mapping, err); - } - end_page_writeback(page); - } -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index f4a02e2..1460e6a 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2858,7 +2858,7 @@ bool zone_watermark_ok_safe(struct zone *z, unsigned int order, - #ifdef CONFIG_NUMA - static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone) - { -- return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) < -+ return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <= - RECLAIM_DISTANCE; - } - #else /* CONFIG_NUMA */ -diff --git a/mm/vmpressure.c b/mm/vmpressure.c -index 149fdf6..6063581 100644 ---- a/mm/vmpressure.c -+++ b/mm/vmpressure.c -@@ -112,9 +112,16 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, - unsigned long reclaimed) - { - unsigned long scale = scanned + reclaimed; -- unsigned long pressure; -+ unsigned long pressure = 0; - - /* -+ * reclaimed can be greater than scanned in cases -+ * like THP, where the scanned is 1 and reclaimed -+ * could be 512 -+ */ -+ if (reclaimed >= scanned) -+ goto out; -+ /* - * We calculate the ratio (in percents) of how many pages were - * scanned vs. reclaimed in a given time frame (window). Note that - * time is in VM reclaimer's "ticks", i.e. number of pages -@@ -124,6 +131,7 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, - pressure = scale - (reclaimed * scale / scanned); - pressure = pressure * 100 / scale; - -+out: - pr_debug("%s: %3lu (s: %lu r: %lu)\n", __func__, pressure, - scanned, reclaimed); - -diff --git a/mm/vmscan.c b/mm/vmscan.c -index fa30010..30a88b9 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -234,22 +234,39 @@ bool pgdat_reclaimable(struct pglist_data *pgdat) - pgdat_reclaimable_pages(pgdat) * 6; - } - --unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru) -+/** -+ * lruvec_lru_size - Returns the number of pages on the given LRU list. -+ * @lruvec: lru vector -+ * @lru: lru to use -+ * @zone_idx: zones to consider (use MAX_NR_ZONES for the whole LRU list) -+ */ -+unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone_idx) - { -+ unsigned long lru_size; -+ int zid; -+ - if (!mem_cgroup_disabled()) -- return mem_cgroup_get_lru_size(lruvec, lru); -+ lru_size = mem_cgroup_get_lru_size(lruvec, lru); -+ else -+ lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); - -- return node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); --} -+ for (zid = zone_idx + 1; zid < MAX_NR_ZONES; zid++) { -+ struct zone *zone = &lruvec_pgdat(lruvec)->node_zones[zid]; -+ unsigned long size; - --unsigned long lruvec_zone_lru_size(struct lruvec *lruvec, enum lru_list lru, -- int zone_idx) --{ -- if (!mem_cgroup_disabled()) -- return mem_cgroup_get_zone_lru_size(lruvec, lru, zone_idx); -+ if (!managed_zone(zone)) -+ continue; -+ -+ if (!mem_cgroup_disabled()) -+ size = mem_cgroup_get_zone_lru_size(lruvec, lru, zid); -+ else -+ size = zone_page_state(&lruvec_pgdat(lruvec)->node_zones[zid], -+ NR_ZONE_LRU_BASE + lru); -+ lru_size -= min(size, lru_size); -+ } -+ -+ return lru_size; - -- return zone_page_state(&lruvec_pgdat(lruvec)->node_zones[zone_idx], -- NR_ZONE_LRU_BASE + lru); - } - - /* -@@ -2028,11 +2045,10 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, - struct scan_control *sc) - { - unsigned long inactive_ratio; -- unsigned long inactive; -- unsigned long active; -+ unsigned long inactive, active; -+ enum lru_list inactive_lru = file * LRU_FILE; -+ enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE; - unsigned long gb; -- struct pglist_data *pgdat = lruvec_pgdat(lruvec); -- int zid; - - /* - * If we don't have swap space, anonymous page deactivation -@@ -2041,27 +2057,8 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file, - if (!file && !total_swap_pages) - return false; - -- inactive = lruvec_lru_size(lruvec, file * LRU_FILE); -- active = lruvec_lru_size(lruvec, file * LRU_FILE + LRU_ACTIVE); -- -- /* -- * For zone-constrained allocations, it is necessary to check if -- * deactivations are required for lowmem to be reclaimed. This -- * calculates the inactive/active pages available in eligible zones. -- */ -- for (zid = sc->reclaim_idx + 1; zid < MAX_NR_ZONES; zid++) { -- struct zone *zone = &pgdat->node_zones[zid]; -- unsigned long inactive_zone, active_zone; -- -- if (!managed_zone(zone)) -- continue; -- -- inactive_zone = lruvec_zone_lru_size(lruvec, file * LRU_FILE, zid); -- active_zone = lruvec_zone_lru_size(lruvec, (file * LRU_FILE) + LRU_ACTIVE, zid); -- -- inactive -= min(inactive, inactive_zone); -- active -= min(active, active_zone); -- } -+ inactive = lruvec_lru_size(lruvec, inactive_lru, sc->reclaim_idx); -+ active = lruvec_lru_size(lruvec, active_lru, sc->reclaim_idx); - - gb = (inactive + active) >> (30 - PAGE_SHIFT); - if (gb) -@@ -2208,7 +2205,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, - * system is under heavy pressure. - */ - if (!inactive_list_is_low(lruvec, true, sc) && -- lruvec_lru_size(lruvec, LRU_INACTIVE_FILE) >> sc->priority) { -+ lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) >> sc->priority) { - scan_balance = SCAN_FILE; - goto out; - } -@@ -2234,10 +2231,10 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, - * anon in [0], file in [1] - */ - -- anon = lruvec_lru_size(lruvec, LRU_ACTIVE_ANON) + -- lruvec_lru_size(lruvec, LRU_INACTIVE_ANON); -- file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE) + -- lruvec_lru_size(lruvec, LRU_INACTIVE_FILE); -+ anon = lruvec_lru_size(lruvec, LRU_ACTIVE_ANON, MAX_NR_ZONES) + -+ lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, MAX_NR_ZONES); -+ file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, MAX_NR_ZONES) + -+ lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, MAX_NR_ZONES); - - spin_lock_irq(&pgdat->lru_lock); - if (unlikely(reclaim_stat->recent_scanned[0] > anon / 4)) { -@@ -2275,7 +2272,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg, - unsigned long size; - unsigned long scan; - -- size = lruvec_lru_size(lruvec, lru); -+ size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); - scan = size >> sc->priority; - - if (!scan && pass && force_scan) -diff --git a/mm/workingset.c b/mm/workingset.c -index fb1f918..33f6f4d 100644 ---- a/mm/workingset.c -+++ b/mm/workingset.c -@@ -266,7 +266,7 @@ bool workingset_refault(void *shadow) - } - lruvec = mem_cgroup_lruvec(pgdat, memcg); - refault = atomic_long_read(&lruvec->inactive_age); -- active_file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE); -+ active_file = lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, MAX_NR_ZONES); - rcu_read_unlock(); - - /* -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index e6ae15b..0ffeb60 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -672,7 +672,8 @@ void osd_req_op_extent_update(struct ceph_osd_request *osd_req, - BUG_ON(length > previous); - - op->extent.length = length; -- op->indata_len -= previous - length; -+ if (op->op == CEPH_OSD_OP_WRITE || op->op == CEPH_OSD_OP_WRITEFULL) -+ op->indata_len -= previous - length; - } - EXPORT_SYMBOL(osd_req_op_extent_update); - -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 0f87e5d..6bd1508 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -85,11 +85,11 @@ static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock); - static __read_mostly bool nf_conntrack_locks_all; - - /* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */ --#define GC_MAX_BUCKETS_DIV 64u --/* upper bound of scan intervals */ --#define GC_INTERVAL_MAX (2 * HZ) --/* maximum conntracks to evict per gc run */ --#define GC_MAX_EVICTS 256u -+#define GC_MAX_BUCKETS_DIV 128u -+/* upper bound of full table scan */ -+#define GC_MAX_SCAN_JIFFIES (16u * HZ) -+/* desired ratio of entries found to be expired */ -+#define GC_EVICT_RATIO 50u - - static struct conntrack_gc_work conntrack_gc_work; - -@@ -938,6 +938,7 @@ static noinline int early_drop(struct net *net, unsigned int _hash) - - static void gc_worker(struct work_struct *work) - { -+ unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); - unsigned int i, goal, buckets = 0, expired_count = 0; - struct conntrack_gc_work *gc_work; - unsigned int ratio, scanned = 0; -@@ -979,8 +980,7 @@ static void gc_worker(struct work_struct *work) - */ - rcu_read_unlock(); - cond_resched_rcu_qs(); -- } while (++buckets < goal && -- expired_count < GC_MAX_EVICTS); -+ } while (++buckets < goal); - - if (gc_work->exiting) - return; -@@ -997,27 +997,25 @@ static void gc_worker(struct work_struct *work) - * 1. Minimize time until we notice a stale entry - * 2. Maximize scan intervals to not waste cycles - * -- * Normally, expired_count will be 0, this increases the next_run time -- * to priorize 2) above. -+ * Normally, expire ratio will be close to 0. - * -- * As soon as a timed-out entry is found, move towards 1) and increase -- * the scan frequency. -- * In case we have lots of evictions next scan is done immediately. -+ * As soon as a sizeable fraction of the entries have expired -+ * increase scan frequency. - */ - ratio = scanned ? expired_count * 100 / scanned : 0; -- if (ratio >= 90 || expired_count == GC_MAX_EVICTS) { -- gc_work->next_gc_run = 0; -- next_run = 0; -- } else if (expired_count) { -- gc_work->next_gc_run /= 2U; -- next_run = msecs_to_jiffies(1); -+ if (ratio > GC_EVICT_RATIO) { -+ gc_work->next_gc_run = min_interval; - } else { -- if (gc_work->next_gc_run < GC_INTERVAL_MAX) -- gc_work->next_gc_run += msecs_to_jiffies(1); -+ unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV; - -- next_run = gc_work->next_gc_run; -+ BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0); -+ -+ gc_work->next_gc_run += min_interval; -+ if (gc_work->next_gc_run > max) -+ gc_work->next_gc_run = max; - } - -+ next_run = gc_work->next_gc_run; - gc_work->last_bucket = i; - queue_delayed_work(system_long_wq, &gc_work->dwork, next_run); - } -@@ -1025,7 +1023,7 @@ static void gc_worker(struct work_struct *work) - static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work) - { - INIT_DELAYED_WORK(&gc_work->dwork, gc_worker); -- gc_work->next_gc_run = GC_INTERVAL_MAX; -+ gc_work->next_gc_run = HZ; - gc_work->exiting = false; - } - -@@ -1918,7 +1916,7 @@ int nf_conntrack_init_start(void) - nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED); - - conntrack_gc_work_init(&conntrack_gc_work); -- queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, GC_INTERVAL_MAX); -+ queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, HZ); - - return 0; - -diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c -index d987c2d..f57c9f0 100644 ---- a/net/sunrpc/xprtrdma/rpc_rdma.c -+++ b/net/sunrpc/xprtrdma/rpc_rdma.c -@@ -125,14 +125,34 @@ void rpcrdma_set_max_header_sizes(struct rpcrdma_xprt *r_xprt) - /* The client can send a request inline as long as the RPCRDMA header - * plus the RPC call fit under the transport's inline limit. If the - * combined call message size exceeds that limit, the client must use -- * the read chunk list for this operation. -+ * a Read chunk for this operation. -+ * -+ * A Read chunk is also required if sending the RPC call inline would -+ * exceed this device's max_sge limit. - */ - static bool rpcrdma_args_inline(struct rpcrdma_xprt *r_xprt, - struct rpc_rqst *rqst) - { -- struct rpcrdma_ia *ia = &r_xprt->rx_ia; -+ struct xdr_buf *xdr = &rqst->rq_snd_buf; -+ unsigned int count, remaining, offset; -+ -+ if (xdr->len > r_xprt->rx_ia.ri_max_inline_write) -+ return false; -+ -+ if (xdr->page_len) { -+ remaining = xdr->page_len; -+ offset = xdr->page_base & ~PAGE_MASK; -+ count = 0; -+ while (remaining) { -+ remaining -= min_t(unsigned int, -+ PAGE_SIZE - offset, remaining); -+ offset = 0; -+ if (++count > r_xprt->rx_ia.ri_max_send_sges) -+ return false; -+ } -+ } - -- return rqst->rq_snd_buf.len <= ia->ri_max_inline_write; -+ return true; - } - - /* The client can't know how large the actual reply will be. Thus it -@@ -186,9 +206,9 @@ rpcrdma_convert_kvec(struct kvec *vec, struct rpcrdma_mr_seg *seg, int n) - */ - - static int --rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos, -- enum rpcrdma_chunktype type, struct rpcrdma_mr_seg *seg, -- bool reminv_expected) -+rpcrdma_convert_iovs(struct rpcrdma_xprt *r_xprt, struct xdr_buf *xdrbuf, -+ unsigned int pos, enum rpcrdma_chunktype type, -+ struct rpcrdma_mr_seg *seg) - { - int len, n, p, page_base; - struct page **ppages; -@@ -226,22 +246,21 @@ rpcrdma_convert_iovs(struct xdr_buf *xdrbuf, unsigned int pos, - if (len && n == RPCRDMA_MAX_SEGS) - goto out_overflow; - -- /* When encoding the read list, the tail is always sent inline */ -- if (type == rpcrdma_readch) -+ /* When encoding a Read chunk, the tail iovec contains an -+ * XDR pad and may be omitted. -+ */ -+ if (type == rpcrdma_readch && r_xprt->rx_ia.ri_implicit_roundup) - return n; - -- /* When encoding the Write list, some servers need to see an extra -- * segment for odd-length Write chunks. The upper layer provides -- * space in the tail iovec for this purpose. -+ /* When encoding a Write chunk, some servers need to see an -+ * extra segment for non-XDR-aligned Write chunks. The upper -+ * layer provides space in the tail iovec that may be used -+ * for this purpose. - */ -- if (type == rpcrdma_writech && reminv_expected) -+ if (type == rpcrdma_writech && r_xprt->rx_ia.ri_implicit_roundup) - return n; - - if (xdrbuf->tail[0].iov_len) { -- /* the rpcrdma protocol allows us to omit any trailing -- * xdr pad bytes, saving the server an RDMA operation. */ -- if (xdrbuf->tail[0].iov_len < 4 && xprt_rdma_pad_optimize) -- return n; - n = rpcrdma_convert_kvec(&xdrbuf->tail[0], seg, n); - if (n == RPCRDMA_MAX_SEGS) - goto out_overflow; -@@ -293,7 +312,8 @@ rpcrdma_encode_read_list(struct rpcrdma_xprt *r_xprt, - if (rtype == rpcrdma_areadch) - pos = 0; - seg = req->rl_segments; -- nsegs = rpcrdma_convert_iovs(&rqst->rq_snd_buf, pos, rtype, seg, false); -+ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_snd_buf, pos, -+ rtype, seg); - if (nsegs < 0) - return ERR_PTR(nsegs); - -@@ -355,10 +375,9 @@ rpcrdma_encode_write_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req, - } - - seg = req->rl_segments; -- nsegs = rpcrdma_convert_iovs(&rqst->rq_rcv_buf, -+ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_rcv_buf, - rqst->rq_rcv_buf.head[0].iov_len, -- wtype, seg, -- r_xprt->rx_ia.ri_reminv_expected); -+ wtype, seg); - if (nsegs < 0) - return ERR_PTR(nsegs); - -@@ -423,8 +442,7 @@ rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt, - } - - seg = req->rl_segments; -- nsegs = rpcrdma_convert_iovs(&rqst->rq_rcv_buf, 0, wtype, seg, -- r_xprt->rx_ia.ri_reminv_expected); -+ nsegs = rpcrdma_convert_iovs(r_xprt, &rqst->rq_rcv_buf, 0, wtype, seg); - if (nsegs < 0) - return ERR_PTR(nsegs); - -diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c -index ed5e285..fa324fe 100644 ---- a/net/sunrpc/xprtrdma/transport.c -+++ b/net/sunrpc/xprtrdma/transport.c -@@ -67,7 +67,7 @@ unsigned int xprt_rdma_max_inline_read = RPCRDMA_DEF_INLINE; - static unsigned int xprt_rdma_max_inline_write = RPCRDMA_DEF_INLINE; - static unsigned int xprt_rdma_inline_write_padding; - static unsigned int xprt_rdma_memreg_strategy = RPCRDMA_FRMR; -- int xprt_rdma_pad_optimize = 1; -+ int xprt_rdma_pad_optimize = 0; - - #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) - -diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c -index 8da7f6a..e2c37061 100644 ---- a/net/sunrpc/xprtrdma/verbs.c -+++ b/net/sunrpc/xprtrdma/verbs.c -@@ -208,6 +208,7 @@ rpcrdma_update_connect_private(struct rpcrdma_xprt *r_xprt, - - /* Default settings for RPC-over-RDMA Version One */ - r_xprt->rx_ia.ri_reminv_expected = false; -+ r_xprt->rx_ia.ri_implicit_roundup = xprt_rdma_pad_optimize; - rsize = RPCRDMA_V1_DEF_INLINE_SIZE; - wsize = RPCRDMA_V1_DEF_INLINE_SIZE; - -@@ -215,6 +216,7 @@ rpcrdma_update_connect_private(struct rpcrdma_xprt *r_xprt, - pmsg->cp_magic == rpcrdma_cmp_magic && - pmsg->cp_version == RPCRDMA_CMP_VERSION) { - r_xprt->rx_ia.ri_reminv_expected = true; -+ r_xprt->rx_ia.ri_implicit_roundup = true; - rsize = rpcrdma_decode_buffer_size(pmsg->cp_send_size); - wsize = rpcrdma_decode_buffer_size(pmsg->cp_recv_size); - } -@@ -477,18 +479,19 @@ rpcrdma_ia_close(struct rpcrdma_ia *ia) - */ - int - rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, -- struct rpcrdma_create_data_internal *cdata) -+ struct rpcrdma_create_data_internal *cdata) - { - struct rpcrdma_connect_private *pmsg = &ep->rep_cm_private; -+ unsigned int max_qp_wr, max_sge; - struct ib_cq *sendcq, *recvcq; -- unsigned int max_qp_wr; - int rc; - -- if (ia->ri_device->attrs.max_sge < RPCRDMA_MAX_SEND_SGES) { -- dprintk("RPC: %s: insufficient sge's available\n", -- __func__); -+ max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES); -+ if (max_sge < RPCRDMA_MIN_SEND_SGES) { -+ pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge); - return -ENOMEM; - } -+ ia->ri_max_send_sges = max_sge - RPCRDMA_MIN_SEND_SGES; - - if (ia->ri_device->attrs.max_qp_wr <= RPCRDMA_BACKWARD_WRS) { - dprintk("RPC: %s: insufficient wqe's available\n", -@@ -513,7 +516,7 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia, - ep->rep_attr.cap.max_recv_wr = cdata->max_requests; - ep->rep_attr.cap.max_recv_wr += RPCRDMA_BACKWARD_WRS; - ep->rep_attr.cap.max_recv_wr += 1; /* drain cqe */ -- ep->rep_attr.cap.max_send_sge = RPCRDMA_MAX_SEND_SGES; -+ ep->rep_attr.cap.max_send_sge = max_sge; - ep->rep_attr.cap.max_recv_sge = 1; - ep->rep_attr.cap.max_inline_data = 0; - ep->rep_attr.sq_sig_type = IB_SIGNAL_REQ_WR; -diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h -index f6ae1b2..48989d5 100644 ---- a/net/sunrpc/xprtrdma/xprt_rdma.h -+++ b/net/sunrpc/xprtrdma/xprt_rdma.h -@@ -74,7 +74,9 @@ struct rpcrdma_ia { - unsigned int ri_max_frmr_depth; - unsigned int ri_max_inline_write; - unsigned int ri_max_inline_read; -+ unsigned int ri_max_send_sges; - bool ri_reminv_expected; -+ bool ri_implicit_roundup; - struct ib_qp_attr ri_qp_attr; - struct ib_qp_init_attr ri_qp_init_attr; - }; -@@ -309,6 +311,7 @@ struct rpcrdma_mr_seg { /* chunk descriptors */ - * - xdr_buf tail iovec - */ - enum { -+ RPCRDMA_MIN_SEND_SGES = 3, - RPCRDMA_MAX_SEND_PAGES = PAGE_SIZE + RPCRDMA_MAX_INLINE - 1, - RPCRDMA_MAX_PAGE_SGES = (RPCRDMA_MAX_SEND_PAGES >> PAGE_SHIFT) + 1, - RPCRDMA_MAX_SEND_SGES = 1 + 1 + RPCRDMA_MAX_PAGE_SGES + 1, -diff --git a/samples/seccomp/bpf-helper.h b/samples/seccomp/bpf-helper.h -index 38ee70f..1d8de9e 100644 ---- a/samples/seccomp/bpf-helper.h -+++ b/samples/seccomp/bpf-helper.h -@@ -138,7 +138,7 @@ union arg64 { - #define ARG_32(idx) \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)) - --/* Loads hi into A and lo in X */ -+/* Loads lo into M[0] and hi into M[1] and A */ - #define ARG_64(idx) \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)), \ - BPF_STMT(BPF_ST, 0), /* lo -> M[0] */ \ -@@ -153,88 +153,107 @@ union arg64 { - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 1, 0), \ - jt - --/* Checks the lo, then swaps to check the hi. A=lo,X=hi */ -+#define JA32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JGE32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JGT32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JLE32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ -+ jt -+ -+#define JLT32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ -+ jt -+ -+/* -+ * All the JXX64 checks assume lo is saved in M[0] and hi is saved in both -+ * A and M[1]. This invariant is kept by restoring A if necessary. -+ */ - #define JEQ64(lo, hi, jt) \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ - BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (lo != arg.lo) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JNE64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 5, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (hi != arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo != arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -- --#define JA32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ -- jt -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JA64(lo, hi, jt) \ -+ /* if (hi & arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (hi), 3, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo & arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - --#define JGE32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ -- jt -- --#define JLT32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ -- jt -- --/* Shortcut checking if hi > arg.hi. */ - #define JGE64(lo, hi, jt) \ -+ /* if (hi > arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo >= arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -- jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -- --#define JLT64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - --#define JGT32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ -- jt -- --#define JLE32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ -- jt -- --/* Check hi > args.hi first, then do the GE checking */ - #define JGT64(lo, hi, jt) \ -+ /* if (hi > arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo > arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JLE64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 6, 0), \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (hi < arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo <= arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ -+ jt, \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) -+ -+#define JLT64(lo, hi, jt) \ -+ /* if (hi < arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo < arg.lo) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 2, 0), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define LOAD_SYSCALL_NR \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \ -diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index db25f54..df7834a 100644 ---- a/security/integrity/ima/ima.h -+++ b/security/integrity/ima/ima.h -@@ -173,7 +173,7 @@ int ima_store_template(struct ima_template_entry *entry, int violation, - struct inode *inode, - const unsigned char *filename, int pcr); - void ima_free_template_entry(struct ima_template_entry *entry); --const char *ima_d_path(const struct path *path, char **pathbuf); -+const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); - - /* IMA policy related functions */ - int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, -diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c -index 9df26a2..d01a52f 100644 ---- a/security/integrity/ima/ima_api.c -+++ b/security/integrity/ima/ima_api.c -@@ -318,7 +318,17 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, - iint->flags |= IMA_AUDITED; - } - --const char *ima_d_path(const struct path *path, char **pathbuf) -+/* -+ * ima_d_path - return a pointer to the full pathname -+ * -+ * Attempt to return a pointer to the full pathname for use in the -+ * IMA measurement list, IMA audit records, and auditing logs. -+ * -+ * On failure, return a pointer to a copy of the filename, not dname. -+ * Returning a pointer to dname, could result in using the pointer -+ * after the memory has been freed. -+ */ -+const char *ima_d_path(const struct path *path, char **pathbuf, char *namebuf) - { - char *pathname = NULL; - -@@ -331,5 +341,11 @@ const char *ima_d_path(const struct path *path, char **pathbuf) - pathname = NULL; - } - } -- return pathname ?: (const char *)path->dentry->d_name.name; -+ -+ if (!pathname) { -+ strlcpy(namebuf, path->dentry->d_name.name, NAME_MAX); -+ pathname = namebuf; -+ } -+ -+ return pathname; - } -diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c -index 423d111..0e87629 100644 ---- a/security/integrity/ima/ima_main.c -+++ b/security/integrity/ima/ima_main.c -@@ -83,6 +83,7 @@ static void ima_rdwr_violation_check(struct file *file, - const char **pathname) - { - struct inode *inode = file_inode(file); -+ char filename[NAME_MAX]; - fmode_t mode = file->f_mode; - bool send_tomtou = false, send_writers = false; - -@@ -102,7 +103,7 @@ static void ima_rdwr_violation_check(struct file *file, - if (!send_tomtou && !send_writers) - return; - -- *pathname = ima_d_path(&file->f_path, pathbuf); -+ *pathname = ima_d_path(&file->f_path, pathbuf, filename); - - if (send_tomtou) - ima_add_violation(file, *pathname, iint, -@@ -161,6 +162,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, - struct integrity_iint_cache *iint = NULL; - struct ima_template_desc *template_desc; - char *pathbuf = NULL; -+ char filename[NAME_MAX]; - const char *pathname = NULL; - int rc = -ENOMEM, action, must_appraise; - int pcr = CONFIG_IMA_MEASURE_PCR_IDX; -@@ -239,8 +241,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size, - goto out_digsig; - } - -- if (!pathname) /* ima_rdwr_violation possibly pre-fetched */ -- pathname = ima_d_path(&file->f_path, &pathbuf); -+ if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */ -+ pathname = ima_d_path(&file->f_path, &pathbuf, filename); - - if (action & IMA_MEASURE) - ima_store_measurement(iint, file, pathname, -diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c -index 1d5acbe..86240d0 100644 ---- a/sound/core/seq/seq_fifo.c -+++ b/sound/core/seq/seq_fifo.c -@@ -135,6 +135,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, - f->tail = cell; - if (f->head == NULL) - f->head = cell; -+ cell->next = NULL; - f->cells++; - spin_unlock_irqrestore(&f->lock, flags); - -@@ -214,6 +215,8 @@ void snd_seq_fifo_cell_putback(struct snd_seq_fifo *f, - spin_lock_irqsave(&f->lock, flags); - cell->next = f->head; - f->head = cell; -+ if (!f->tail) -+ f->tail = cell; - f->cells++; - spin_unlock_irqrestore(&f->lock, flags); - } -diff --git a/sound/core/timer.c b/sound/core/timer.c -index fc144f4..ad15314 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -1702,9 +1702,21 @@ static int snd_timer_user_params(struct file *file, - return -EBADFD; - if (copy_from_user(¶ms, _params, sizeof(params))) - return -EFAULT; -- if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) { -- err = -EINVAL; -- goto _end; -+ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) { -+ u64 resolution; -+ -+ if (params.ticks < 1) { -+ err = -EINVAL; -+ goto _end; -+ } -+ -+ /* Don't allow resolution less than 1ms */ -+ resolution = snd_timer_resolution(tu->timeri); -+ resolution *= params.ticks; -+ if (resolution < 1000000) { -+ err = -EINVAL; -+ goto _end; -+ } - } - if (params.queue_size > 0 && - (params.queue_size < 32 || params.queue_size > 1024)) { -diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c -index 9667cbf..ab4cdab 100644 ---- a/sound/pci/ctxfi/cthw20k1.c -+++ b/sound/pci/ctxfi/cthw20k1.c -@@ -27,12 +27,6 @@ - #include "cthw20k1.h" - #include "ct20k1reg.h" - --#if BITS_PER_LONG == 32 --#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ --#else --#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ --#endif -- - struct hw20k1 { - struct hw hw; - spinlock_t reg_20k1_lock; -@@ -1904,19 +1898,18 @@ static int hw_card_start(struct hw *hw) - { - int err; - struct pci_dev *pci = hw->pci; -+ const unsigned int dma_bits = BITS_PER_LONG; - - err = pci_enable_device(pci); - if (err < 0) - return err; - - /* Set DMA transfer mask */ -- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || -- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { -- dev_err(hw->card->dev, -- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", -- CT_XFI_DMA_MASK); -- err = -ENXIO; -- goto error1; -+ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); -+ } else { -+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); - } - - if (!hw->io_base) { -diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c -index 6414ecf..18ee776 100644 ---- a/sound/pci/ctxfi/cthw20k2.c -+++ b/sound/pci/ctxfi/cthw20k2.c -@@ -26,12 +26,6 @@ - #include "cthw20k2.h" - #include "ct20k2reg.h" - --#if BITS_PER_LONG == 32 --#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ --#else --#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ --#endif -- - struct hw20k2 { - struct hw hw; - /* for i2c */ -@@ -2029,19 +2023,18 @@ static int hw_card_start(struct hw *hw) - int err = 0; - struct pci_dev *pci = hw->pci; - unsigned int gctl; -+ const unsigned int dma_bits = BITS_PER_LONG; - - err = pci_enable_device(pci); - if (err < 0) - return err; - - /* Set DMA transfer mask */ -- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || -- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { -- dev_err(hw->card->dev, -- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", -- CT_XFI_DMA_MASK); -- err = -ENXIO; -- goto error1; -+ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); -+ } else { -+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); - } - - if (!hw->io_base) { -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index c64d986..bc44626 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2197,9 +2197,9 @@ static const struct pci_device_id azx_ids[] = { - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, - /* Lewisburg */ - { PCI_DEVICE(0x8086, 0xa1f0), -- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, - { PCI_DEVICE(0x8086, 0xa270), -- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, - /* Lynx Point-LP */ - { PCI_DEVICE(0x8086, 0x9c20), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 758ac86..0c62b1d 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5577,6 +5577,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), -+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), - SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), -@@ -5692,6 +5693,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), - SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), -+ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), - SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), - SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), -@@ -6065,6 +6067,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC298_STANDARD_PINS, - {0x17, 0x90170150}), -+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_SPK_VOLUME, -+ {0x12, 0xb7a60140}, -+ {0x13, 0xb7a60150}, -+ {0x17, 0x90170110}, -+ {0x1a, 0x03011020}, -+ {0x21, 0x03211030}), - {} - }; - -diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c -index ae58b49..ecf6236 100644 ---- a/tools/perf/util/callchain.c -+++ b/tools/perf/util/callchain.c -@@ -437,7 +437,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor) - } - call->ip = cursor_node->ip; - call->ms.sym = cursor_node->sym; -- call->ms.map = cursor_node->map; -+ call->ms.map = map__get(cursor_node->map); - list_add_tail(&call->list, &node->val); - - callchain_cursor_advance(cursor); -@@ -462,6 +462,7 @@ add_child(struct callchain_node *parent, - - list_for_each_entry_safe(call, tmp, &new->val, list) { - list_del(&call->list); -+ map__zput(call->ms.map); - free(call); - } - free(new); -@@ -730,6 +731,7 @@ merge_chain_branch(struct callchain_cursor *cursor, - callchain_cursor_append(cursor, list->ip, - list->ms.map, list->ms.sym); - list_del(&list->list); -+ map__zput(list->ms.map); - free(list); - } - -@@ -778,7 +780,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor, - } - - node->ip = ip; -- node->map = map; -+ map__zput(node->map); -+ node->map = map__get(map); - node->sym = sym; - - cursor->nr++; -@@ -945,11 +948,13 @@ static void free_callchain_node(struct callchain_node *node) - - list_for_each_entry_safe(list, tmp, &node->parent_val, list) { - list_del(&list->list); -+ map__zput(list->ms.map); - free(list); - } - - list_for_each_entry_safe(list, tmp, &node->val, list) { - list_del(&list->list); -+ map__zput(list->ms.map); - free(list); - } - -@@ -1013,6 +1018,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) - goto out; - *new = *chain; - new->has_children = false; -+ map__get(new->ms.map); - list_add_tail(&new->list, &head); - } - parent = parent->parent; -@@ -1033,6 +1039,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) - out: - list_for_each_entry_safe(chain, new, &head, list) { - list_del(&chain->list); -+ map__zput(chain->ms.map); - free(chain); - } - return -ENOMEM; -diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h -index 47cfd10..b7cbabb 100644 ---- a/tools/perf/util/callchain.h -+++ b/tools/perf/util/callchain.h -@@ -5,6 +5,7 @@ - #include <linux/list.h> - #include <linux/rbtree.h> - #include "event.h" -+#include "map.h" - #include "symbol.h" - - #define HELP_PAD "\t\t\t\t" -@@ -174,8 +175,13 @@ int callchain_merge(struct callchain_cursor *cursor, - */ - static inline void callchain_cursor_reset(struct callchain_cursor *cursor) - { -+ struct callchain_cursor_node *node; -+ - cursor->nr = 0; - cursor->last = &cursor->first; -+ -+ for (node = cursor->first; node != NULL; node = node->next) -+ map__zput(node->map); - } - - int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip, -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index a69f027..10849a0 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -1,6 +1,7 @@ - #include "util.h" - #include "build-id.h" - #include "hist.h" -+#include "map.h" - #include "session.h" - #include "sort.h" - #include "evlist.h" -@@ -1019,6 +1020,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, - int max_stack_depth, void *arg) - { - int err, err2; -+ struct map *alm = NULL; -+ -+ if (al && al->map) -+ alm = map__get(al->map); - - err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, - iter->evsel, al, max_stack_depth); -@@ -1058,6 +1063,8 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, - if (!err) - err = err2; - -+ map__put(alm); -+ - return err; - } - -diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c -index d918dcf..f138ed2 100644 ---- a/virt/kvm/arm/vgic/vgic-irqfd.c -+++ b/virt/kvm/arm/vgic/vgic-irqfd.c -@@ -99,6 +99,9 @@ int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e, - if (!vgic_has_its(kvm)) - return -ENODEV; - -+ if (!level) -+ return -1; -+ - return vgic_its_inject_msi(kvm, &msi); - } - |