commit: d2a35690ae40f9b1fa3f2e91ab73c25acff4c71e Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Jan 6 14:53:50 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Jan 6 14:53:50 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d2a35690
Linux patch 5.10.5 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1004_linux-5.10.5.patch | 3149 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3153 insertions(+) diff --git a/0000_README b/0000_README index ce1d3f7..53642e2 100644 --- a/0000_README +++ b/0000_README @@ -59,6 +59,10 @@ Patch: 1003_linux-5.10.4.patch From: http://www.kernel.org Desc: Linux 5.10.4 +Patch: 1004_linux-5.10.5.patch +From: http://www.kernel.org +Desc: Linux 5.10.5 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1004_linux-5.10.5.patch b/1004_linux-5.10.5.patch new file mode 100644 index 0000000..1af7e50 --- /dev/null +++ b/1004_linux-5.10.5.patch @@ -0,0 +1,3149 @@ +diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst +index b0ea17da8ff63..654649556306f 100644 +--- a/Documentation/gpu/todo.rst ++++ b/Documentation/gpu/todo.rst +@@ -273,6 +273,24 @@ Contact: Daniel Vetter, Noralf Tronnes + + Level: Advanced + ++Garbage collect fbdev scrolling acceleration ++-------------------------------------------- ++ ++Scroll acceleration is disabled in fbcon by hard-wiring p->scrollmode = ++SCROLL_REDRAW. There's a ton of code this will allow us to remove: ++- lots of code in fbcon.c ++- a bunch of the hooks in fbcon_ops, maybe the remaining hooks could be called ++ directly instead of the function table (with a switch on p->rotate) ++- fb_copyarea is unused after this, and can be deleted from all drivers ++ ++Note that not all acceleration code can be deleted, since clearing and cursor ++support is still accelerated, which might be good candidates for further ++deletion projects. ++ ++Contact: Daniel Vetter ++ ++Level: Intermediate ++ + idr_init_base() + --------------- + +diff --git a/Makefile b/Makefile +index 1e50d6af932ab..bb431fd473d2c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c +index ef12e097f3184..27ca549ff47ed 100644 +--- a/arch/ia64/mm/init.c ++++ b/arch/ia64/mm/init.c +@@ -536,7 +536,7 @@ virtual_memmap_init(u64 start, u64 end, void *arg) + + if (map_start < map_end) + memmap_init_zone((unsigned long)(map_end - map_start), +- args->nid, args->zone, page_to_pfn(map_start), ++ args->nid, args->zone, page_to_pfn(map_start), page_to_pfn(map_end), + MEMINIT_EARLY, NULL, MIGRATE_MOVABLE); + return 0; + } +@@ -546,7 +546,7 @@ memmap_init (unsigned long size, int nid, unsigned long zone, + unsigned long start_pfn) + { + if (!vmem_map) { +- memmap_init_zone(size, nid, zone, start_pfn, ++ memmap_init_zone(size, nid, zone, start_pfn, start_pfn + size, + MEMINIT_EARLY, NULL, MIGRATE_MOVABLE); + } else { + struct page *start; +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 7d0f7682d01df..6b1eca53e36cc 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -102,14 +102,6 @@ static inline notrace unsigned long get_irq_happened(void) + return happened; + } + +-static inline notrace int decrementer_check_overflow(void) +-{ +- u64 now = get_tb(); +- u64 *next_tb = this_cpu_ptr(&decrementers_next_tb); +- +- return now >= *next_tb; +-} +- + #ifdef CONFIG_PPC_BOOK3E + + /* This is called whenever we are re-enabling interrupts +@@ -142,35 +134,6 @@ notrace unsigned int __check_irq_replay(void) + trace_hardirqs_on(); + trace_hardirqs_off(); + +- /* +- * We are always hard disabled here, but PACA_IRQ_HARD_DIS may +- * not be set, which means interrupts have only just been hard +- * disabled as part of the local_irq_restore or interrupt return +- * code. In that case, skip the decrementr check becaus it's +- * expensive to read the TB. +- * +- * HARD_DIS then gets cleared here, but it's reconciled later. +- * Either local_irq_disable will replay the interrupt and that +- * will reconcile state like other hard interrupts. Or interrupt +- * retur will replay the interrupt and in that case it sets +- * PACA_IRQ_HARD_DIS by hand (see comments in entry_64.S). +- */ +- if (happened & PACA_IRQ_HARD_DIS) { +- local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS; +- +- /* +- * We may have missed a decrementer interrupt if hard disabled. +- * Check the decrementer register in case we had a rollover +- * while hard disabled. +- */ +- if (!(happened & PACA_IRQ_DEC)) { +- if (decrementer_check_overflow()) { +- local_paca->irq_happened |= PACA_IRQ_DEC; +- happened |= PACA_IRQ_DEC; +- } +- } +- } +- + if (happened & PACA_IRQ_DEC) { + local_paca->irq_happened &= ~PACA_IRQ_DEC; + return 0x900; +@@ -186,6 +149,9 @@ notrace unsigned int __check_irq_replay(void) + return 0x280; + } + ++ if (happened & PACA_IRQ_HARD_DIS) ++ local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS; ++ + /* There should be nothing left ! */ + BUG_ON(local_paca->irq_happened != 0); + +@@ -229,18 +195,6 @@ again: + if (IS_ENABLED(CONFIG_PPC_IRQ_SOFT_MASK_DEBUG)) + WARN_ON_ONCE(mfmsr() & MSR_EE); + +- if (happened & PACA_IRQ_HARD_DIS) { +- /* +- * We may have missed a decrementer interrupt if hard disabled. +- * Check the decrementer register in case we had a rollover +- * while hard disabled. +- */ +- if (!(happened & PACA_IRQ_DEC)) { +- if (decrementer_check_overflow()) +- happened |= PACA_IRQ_DEC; +- } +- } +- + /* + * Force the delivery of pending soft-disabled interrupts on PS3. + * Any HV call will have this side effect. +@@ -345,6 +299,7 @@ notrace void arch_local_irq_restore(unsigned long mask) + if (IS_ENABLED(CONFIG_PPC_IRQ_SOFT_MASK_DEBUG)) + WARN_ON_ONCE(!(mfmsr() & MSR_EE)); + __hard_irq_disable(); ++ local_paca->irq_happened |= PACA_IRQ_HARD_DIS; + } else { + /* + * We should already be hard disabled here. We had bugs +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 74efe46f55327..7d372ff3504b2 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -552,14 +552,11 @@ void timer_interrupt(struct pt_regs *regs) + struct pt_regs *old_regs; + u64 now; + +- /* Some implementations of hotplug will get timer interrupts while +- * offline, just ignore these and we also need to set +- * decrementers_next_tb as MAX to make sure __check_irq_replay +- * don't replay timer interrupt when return, otherwise we'll trap +- * here infinitely :( ++ /* ++ * Some implementations of hotplug will get timer interrupts while ++ * offline, just ignore these. + */ + if (unlikely(!cpu_online(smp_processor_id()))) { +- *next_tb = ~(u64)0; + set_dec(decrementer_max); + return; + } +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index d95954ad4c0af..c61c3b62c8c62 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -731,7 +731,7 @@ int opal_hmi_exception_early2(struct pt_regs *regs) + return 1; + } + +-/* HMI exception handler called in virtual mode during check_irq_replay. */ ++/* HMI exception handler called in virtual mode when irqs are next enabled. */ + int opal_handle_hmi_exception(struct pt_regs *regs) + { + /* +diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c +index f6b253e2be409..36ec0bdd8b63c 100644 +--- a/arch/powerpc/sysdev/mpic_msgr.c ++++ b/arch/powerpc/sysdev/mpic_msgr.c +@@ -191,7 +191,7 @@ static int mpic_msgr_probe(struct platform_device *dev) + + /* IO map the message register block. */ + of_address_to_resource(np, 0, &rsrc); +- msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc)); ++ msgr_block_addr = devm_ioremap(&dev->dev, rsrc.start, resource_size(&rsrc)); + if (!msgr_block_addr) { + dev_err(&dev->dev, "Failed to iomap MPIC message registers"); + return -EFAULT; +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index 6343dca0dbeb6..71203324ff42b 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -406,6 +406,7 @@ ENTRY(system_call) + mvc __PT_PSW(16,%r11),__LC_SVC_OLD_PSW + mvc __PT_INT_CODE(4,%r11),__LC_SVC_ILC + stg %r14,__PT_FLAGS(%r11) ++ xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + ENABLE_INTS + .Lsysc_do_svc: + # clear user controlled register to prevent speculative use +@@ -422,7 +423,6 @@ ENTRY(system_call) + jnl .Lsysc_nr_ok + slag %r8,%r1,3 + .Lsysc_nr_ok: +- xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + stg %r2,__PT_ORIG_GPR2(%r11) + stg %r7,STACK_FRAME_OVERHEAD(%r15) + lg %r9,0(%r8,%r10) # get system call add. +@@ -712,8 +712,8 @@ ENTRY(pgm_check_handler) + mvc __THREAD_per_address(8,%r14),__LC_PER_ADDRESS + mvc __THREAD_per_cause(2,%r14),__LC_PER_CODE + mvc __THREAD_per_paid(1,%r14),__LC_PER_ACCESS_ID +-6: RESTORE_SM_CLEAR_PER +- xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) ++6: xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) ++ RESTORE_SM_CLEAR_PER + larl %r1,pgm_check_table + llgh %r10,__PT_INT_CODE+2(%r11) + nill %r10,0x007f +@@ -734,8 +734,8 @@ ENTRY(pgm_check_handler) + # PER event in supervisor state, must be kprobes + # + .Lpgm_kprobe: +- RESTORE_SM_CLEAR_PER + xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) ++ RESTORE_SM_CLEAR_PER + lgr %r2,%r11 # pass pointer to pt_regs + brasl %r14,do_per_trap + j .Lpgm_return +@@ -777,10 +777,10 @@ ENTRY(io_int_handler) + stmg %r8,%r9,__PT_PSW(%r11) + mvc __PT_INT_CODE(12,%r11),__LC_SUBCHANNEL_ID + xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) ++ xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ + jo .Lio_restore + TRACE_IRQS_OFF +- xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + .Lio_loop: + lgr %r2,%r11 # pass pointer to pt_regs + lghi %r3,IO_INTERRUPT +@@ -980,10 +980,10 @@ ENTRY(ext_int_handler) + mvc __PT_INT_PARM(4,%r11),__LC_EXT_PARAMS + mvc __PT_INT_PARM_LONG(8,%r11),0(%r1) + xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) ++ xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ + jo .Lio_restore + TRACE_IRQS_OFF +- xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15) + lgr %r2,%r11 # pass pointer to pt_regs + lghi %r3,EXT_INTERRUPT + brasl %r14,do_IRQ +diff --git a/arch/um/drivers/random.c b/arch/um/drivers/random.c +index ce115fce52f02..e4b9b2ce9abf4 100644 +--- a/arch/um/drivers/random.c ++++ b/arch/um/drivers/random.c +@@ -11,6 +11,7 @@ + #include <linux/fs.h> + #include <linux/interrupt.h> + #include <linux/miscdevice.h> ++#include <linux/hw_random.h> + #include <linux/delay.h> + #include <linux/uaccess.h> + #include <init.h> +@@ -18,9 +19,8 @@ + #include <os.h> + + /* +- * core module and version information ++ * core module information + */ +-#define RNG_VERSION "1.0.0" + #define RNG_MODULE_NAME "hw_random" + + /* Changed at init time, in the non-modular case, and at module load +@@ -28,88 +28,36 @@ + * protects against a module being loaded twice at the same time. + */ + static int random_fd = -1; +-static DECLARE_WAIT_QUEUE_HEAD(host_read_wait); ++static struct hwrng hwrng = { 0, }; ++static DECLARE_COMPLETION(have_data); + +-static int rng_dev_open (struct inode *inode, struct file *filp) ++static int rng_dev_read(struct hwrng *rng, void *buf, size_t max, bool block) + { +- /* enforce read-only access to this chrdev */ +- if ((filp->f_mode & FMODE_READ) == 0) +- return -EINVAL; +- if ((filp->f_mode & FMODE_WRITE) != 0) +- return -EINVAL; ++ int ret; + +- return 0; +-} +- +-static atomic_t host_sleep_count = ATOMIC_INIT(0); +- +-static ssize_t rng_dev_read (struct file *filp, char __user *buf, size_t size, +- loff_t *offp) +-{ +- u32 data; +- int n, ret = 0, have_data; +- +- while (size) { +- n = os_read_file(random_fd, &data, sizeof(data)); +- if (n > 0) { +- have_data = n; +- while (have_data && size) { +- if (put_user((u8) data, buf++)) { +- ret = ret ? : -EFAULT; +- break; +- } +- size--; +- ret++; +- have_data--; +- data >>= 8; +- } +- } +- else if (n == -EAGAIN) { +- DECLARE_WAITQUEUE(wait, current); +- +- if (filp->f_flags & O_NONBLOCK) +- return ret ? : -EAGAIN; +- +- atomic_inc(&host_sleep_count); ++ for (;;) { ++ ret = os_read_file(random_fd, buf, max); ++ if (block && ret == -EAGAIN) { + add_sigio_fd(random_fd); + +- add_wait_queue(&host_read_wait, &wait); +- set_current_state(TASK_INTERRUPTIBLE); ++ ret = wait_for_completion_killable(&have_data); + +- schedule(); +- remove_wait_queue(&host_read_wait, &wait); ++ ignore_sigio_fd(random_fd); ++ deactivate_fd(random_fd, RANDOM_IRQ); + +- if (atomic_dec_and_test(&host_sleep_count)) { +- ignore_sigio_fd(random_fd); +- deactivate_fd(random_fd, RANDOM_IRQ); +- } ++ if (ret < 0) ++ break; ++ } else { ++ break; + } +- else +- return n; +- +- if (signal_pending (current)) +- return ret ? : -ERESTARTSYS; + } +- return ret; +-} + +-static const struct file_operations rng_chrdev_ops = { +- .owner = THIS_MODULE, +- .open = rng_dev_open, +- .read = rng_dev_read, +- .llseek = noop_llseek, +-}; +- +-/* rng_init shouldn't be called more than once at boot time */ +-static struct miscdevice rng_miscdev = { +- HWRNG_MINOR, +- RNG_MODULE_NAME, +- &rng_chrdev_ops, +-}; ++ return ret != -EAGAIN ? ret : 0; ++} + + static irqreturn_t random_interrupt(int irq, void *data) + { +- wake_up(&host_read_wait); ++ complete(&have_data); + + return IRQ_HANDLED; + } +@@ -126,18 +74,19 @@ static int __init rng_init (void) + goto out; + + random_fd = err; +- + err = um_request_irq(RANDOM_IRQ, random_fd, IRQ_READ, random_interrupt, + 0, "random", NULL); + if (err) + goto err_out_cleanup_hw; + + sigio_broken(random_fd, 1); ++ hwrng.name = RNG_MODULE_NAME; ++ hwrng.read = rng_dev_read; ++ hwrng.quality = 1024; + +- err = misc_register (&rng_miscdev); ++ err = hwrng_register(&hwrng); + if (err) { +- printk (KERN_ERR RNG_MODULE_NAME ": misc device register " +- "failed\n"); ++ pr_err(RNG_MODULE_NAME " registering failed (%d)\n", err); + goto err_out_cleanup_hw; + } + out: +@@ -161,8 +110,8 @@ static void cleanup(void) + + static void __exit rng_cleanup(void) + { ++ hwrng_unregister(&hwrng); + os_close_file(random_fd); +- misc_deregister (&rng_miscdev); + } + + module_init (rng_init); +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index eae8c83364f71..b12c1b0d3e1d0 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -47,18 +47,25 @@ + /* Max request size is determined by sector mask - 32K */ + #define UBD_MAX_REQUEST (8 * sizeof(long)) + ++struct io_desc { ++ char *buffer; ++ unsigned long length; ++ unsigned long sector_mask; ++ unsigned long long cow_offset; ++ unsigned long bitmap_words[2]; ++}; ++ + struct io_thread_req { + struct request *req; + int fds[2]; + unsigned long offsets[2]; + unsigned long long offset; +- unsigned long length; +- char *buffer; + int sectorsize; +- unsigned long sector_mask; +- unsigned long long cow_offset; +- unsigned long bitmap_words[2]; + int error; ++ ++ int desc_cnt; ++ /* io_desc has to be the last element of the struct */ ++ struct io_desc io_desc[]; + }; + + +@@ -525,12 +532,7 @@ static void ubd_handler(void) + blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); + blk_queue_flag_clear(QUEUE_FLAG_DISCARD, io_req->req->q); + } +- if ((io_req->error) || (io_req->buffer == NULL)) +- blk_mq_end_request(io_req->req, io_req->error); +- else { +- if (!blk_update_request(io_req->req, io_req->error, io_req->length)) +- __blk_mq_end_request(io_req->req, io_req->error); +- } ++ blk_mq_end_request(io_req->req, io_req->error); + kfree(io_req); + } + } +@@ -946,6 +948,7 @@ static int ubd_add(int n, char **error_out) + blk_queue_write_cache(ubd_dev->queue, true, false); + + blk_queue_max_segments(ubd_dev->queue, MAX_SG); ++ blk_queue_segment_boundary(ubd_dev->queue, PAGE_SIZE - 1); + err = ubd_disk_register(UBD_MAJOR, ubd_dev->size, n, &ubd_gendisk[n]); + if(err){ + *error_out = "Failed to register device"; +@@ -1289,37 +1292,74 @@ static void cowify_bitmap(__u64 io_offset, int length, unsigned long *cow_mask, + *cow_offset += bitmap_offset; + } + +-static void cowify_req(struct io_thread_req *req, unsigned long *bitmap, ++static void cowify_req(struct io_thread_req *req, struct io_desc *segment, ++ unsigned long offset, unsigned long *bitmap, + __u64 bitmap_offset, __u64 bitmap_len) + { +- __u64 sector = req->offset >> SECTOR_SHIFT; ++ __u64 sector = offset >> SECTOR_SHIFT; + int i; + +- if (req->length > (sizeof(req->sector_mask) * 8) << SECTOR_SHIFT) ++ if (segment->length > (sizeof(segment->sector_mask) * 8) << SECTOR_SHIFT) + panic("Operation too long"); + + if (req_op(req->req) == REQ_OP_READ) { +- for (i = 0; i < req->length >> SECTOR_SHIFT; i++) { ++ for (i = 0; i < segment->length >> SECTOR_SHIFT; i++) { + if(ubd_test_bit(sector + i, (unsigned char *) bitmap)) + ubd_set_bit(i, (unsigned char *) +- &req->sector_mask); ++ &segment->sector_mask); ++ } ++ } else { ++ cowify_bitmap(offset, segment->length, &segment->sector_mask, ++ &segment->cow_offset, bitmap, bitmap_offset, ++ segment->bitmap_words, bitmap_len); ++ } ++} ++ ++static void ubd_map_req(struct ubd *dev, struct io_thread_req *io_req, ++ struct request *req) ++{ ++ struct bio_vec bvec; ++ struct req_iterator iter; ++ int i = 0; ++ unsigned long byte_offset = io_req->offset; ++ int op = req_op(req); ++ ++ if (op == REQ_OP_WRITE_ZEROES || op == REQ_OP_DISCARD) { ++ io_req->io_desc[0].buffer = NULL; ++ io_req->io_desc[0].length = blk_rq_bytes(req); ++ } else { ++ rq_for_each_segment(bvec, req, iter) { ++ BUG_ON(i >= io_req->desc_cnt); ++ ++ io_req->io_desc[i].buffer = ++ page_address(bvec.bv_page) + bvec.bv_offset; ++ io_req->io_desc[i].length = bvec.bv_len; ++ i++; ++ } ++ } ++ ++ if (dev->cow.file) { ++ for (i = 0; i < io_req->desc_cnt; i++) { ++ cowify_req(io_req, &io_req->io_desc[i], byte_offset, ++ dev->cow.bitmap, dev->cow.bitmap_offset, ++ dev->cow.bitmap_len); ++ byte_offset += io_req->io_desc[i].length; + } ++ + } +- else cowify_bitmap(req->offset, req->length, &req->sector_mask, +- &req->cow_offset, bitmap, bitmap_offset, +- req->bitmap_words, bitmap_len); + } + +-static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req, +- u64 off, struct bio_vec *bvec) ++static struct io_thread_req *ubd_alloc_req(struct ubd *dev, struct request *req, ++ int desc_cnt) + { +- struct ubd *dev = hctx->queue->queuedata; + struct io_thread_req *io_req; +- int ret; ++ int i; + +- io_req = kmalloc(sizeof(struct io_thread_req), GFP_ATOMIC); ++ io_req = kmalloc(sizeof(*io_req) + ++ (desc_cnt * sizeof(struct io_desc)), ++ GFP_ATOMIC); + if (!io_req) +- return -ENOMEM; ++ return NULL; + + io_req->req = req; + if (dev->cow.file) +@@ -1327,26 +1367,41 @@ static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req, + else + io_req->fds[0] = dev->fd; + io_req->error = 0; +- +- if (bvec != NULL) { +- io_req->buffer = page_address(bvec->bv_page) + bvec->bv_offset; +- io_req->length = bvec->bv_len; +- } else { +- io_req->buffer = NULL; +- io_req->length = blk_rq_bytes(req); +- } +- + io_req->sectorsize = SECTOR_SIZE; + io_req->fds[1] = dev->fd; +- io_req->cow_offset = -1; +- io_req->offset = off; +- io_req->sector_mask = 0; ++ io_req->offset = (u64) blk_rq_pos(req) << SECTOR_SHIFT; + io_req->offsets[0] = 0; + io_req->offsets[1] = dev->cow.data_offset; + +- if (dev->cow.file) +- cowify_req(io_req, dev->cow.bitmap, +- dev->cow.bitmap_offset, dev->cow.bitmap_len); ++ for (i = 0 ; i < desc_cnt; i++) { ++ io_req->io_desc[i].sector_mask = 0; ++ io_req->io_desc[i].cow_offset = -1; ++ } ++ ++ return io_req; ++} ++ ++static int ubd_submit_request(struct ubd *dev, struct request *req) ++{ ++ int segs = 0; ++ struct io_thread_req *io_req; ++ int ret; ++ int op = req_op(req); ++ ++ if (op == REQ_OP_FLUSH) ++ segs = 0; ++ else if (op == REQ_OP_WRITE_ZEROES || op == REQ_OP_DISCARD) ++ segs = 1; ++ else ++ segs = blk_rq_nr_phys_segments(req); ++ ++ io_req = ubd_alloc_req(dev, req, segs); ++ if (!io_req) ++ return -ENOMEM; ++ ++ io_req->desc_cnt = segs; ++ if (segs) ++ ubd_map_req(dev, io_req, req); + + ret = os_write_file(thread_fd, &io_req, sizeof(io_req)); + if (ret != sizeof(io_req)) { +@@ -1357,22 +1412,6 @@ static int ubd_queue_one_vec(struct blk_mq_hw_ctx *hctx, struct request *req, + return ret; + } + +-static int queue_rw_req(struct blk_mq_hw_ctx *hctx, struct request *req) +-{ +- struct req_iterator iter; +- struct bio_vec bvec; +- int ret; +- u64 off = (u64)blk_rq_pos(req) << SECTOR_SHIFT; +- +- rq_for_each_segment(bvec, req, iter) { +- ret = ubd_queue_one_vec(hctx, req, off, &bvec); +- if (ret < 0) +- return ret; +- off += bvec.bv_len; +- } +- return 0; +-} +- + static blk_status_t ubd_queue_rq(struct blk_mq_hw_ctx *hctx, + const struct blk_mq_queue_data *bd) + { +@@ -1385,17 +1424,12 @@ static blk_status_t ubd_queue_rq(struct blk_mq_hw_ctx *hctx, + spin_lock_irq(&ubd_dev->lock); + + switch (req_op(req)) { +- /* operations with no lentgth/offset arguments */ + case REQ_OP_FLUSH: +- ret = ubd_queue_one_vec(hctx, req, 0, NULL); +- break; + case REQ_OP_READ: + case REQ_OP_WRITE: +- ret = queue_rw_req(hctx, req); +- break; + case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- ret = ubd_queue_one_vec(hctx, req, (u64)blk_rq_pos(req) << 9, NULL); ++ ret = ubd_submit_request(ubd_dev, req); + break; + default: + WARN_ON_ONCE(1); +@@ -1483,22 +1517,22 @@ static int map_error(int error_code) + * will result in unpredictable behaviour and/or crashes. + */ + +-static int update_bitmap(struct io_thread_req *req) ++static int update_bitmap(struct io_thread_req *req, struct io_desc *segment) + { + int n; + +- if(req->cow_offset == -1) ++ if (segment->cow_offset == -1) + return map_error(0); + +- n = os_pwrite_file(req->fds[1], &req->bitmap_words, +- sizeof(req->bitmap_words), req->cow_offset); +- if (n != sizeof(req->bitmap_words)) ++ n = os_pwrite_file(req->fds[1], &segment->bitmap_words, ++ sizeof(segment->bitmap_words), segment->cow_offset); ++ if (n != sizeof(segment->bitmap_words)) + return map_error(-n); + + return map_error(0); + } + +-static void do_io(struct io_thread_req *req) ++static void do_io(struct io_thread_req *req, struct io_desc *desc) + { + char *buf = NULL; + unsigned long len; +@@ -1513,21 +1547,20 @@ static void do_io(struct io_thread_req *req) + return; + } + +- nsectors = req->length / req->sectorsize; ++ nsectors = desc->length / req->sectorsize; + start = 0; + do { +- bit = ubd_test_bit(start, (unsigned char *) &req->sector_mask); ++ bit = ubd_test_bit(start, (unsigned char *) &desc->sector_mask); + end = start; + while((end < nsectors) && +- (ubd_test_bit(end, (unsigned char *) +- &req->sector_mask) == bit)) ++ (ubd_test_bit(end, (unsigned char *) &desc->sector_mask) == bit)) + end++; + + off = req->offset + req->offsets[bit] + + start * req->sectorsize; + len = (end - start) * req->sectorsize; +- if (req->buffer != NULL) +- buf = &req->buffer[start * req->sectorsize]; ++ if (desc->buffer != NULL) ++ buf = &desc->buffer[start * req->sectorsize]; + + switch (req_op(req->req)) { + case REQ_OP_READ: +@@ -1567,7 +1600,8 @@ static void do_io(struct io_thread_req *req) + start = end; + } while(start < nsectors); + +- req->error = update_bitmap(req); ++ req->offset += len; ++ req->error = update_bitmap(req, desc); + } + + /* Changed in start_io_thread, which is serialized by being called only +@@ -1600,8 +1634,13 @@ int io_thread(void *arg) + } + + for (count = 0; count < n/sizeof(struct io_thread_req *); count++) { ++ struct io_thread_req *req = (*io_req_buffer)[count]; ++ int i; ++ + io_count++; +- do_io((*io_req_buffer)[count]); ++ for (i = 0; !req->error && i < req->desc_cnt; i++) ++ do_io(req, &(req->io_desc[i])); ++ + } + + written = 0; +diff --git a/block/blk-pm.c b/block/blk-pm.c +index b85234d758f7b..17bd020268d42 100644 +--- a/block/blk-pm.c ++++ b/block/blk-pm.c +@@ -67,6 +67,10 @@ int blk_pre_runtime_suspend(struct request_queue *q) + + WARN_ON_ONCE(q->rpm_status != RPM_ACTIVE); + ++ spin_lock_irq(&q->queue_lock); ++ q->rpm_status = RPM_SUSPENDING; ++ spin_unlock_irq(&q->queue_lock); ++ + /* + * Increase the pm_only counter before checking whether any + * non-PM blk_queue_enter() calls are in progress to avoid that any +@@ -89,15 +93,14 @@ int blk_pre_runtime_suspend(struct request_queue *q) + /* Switch q_usage_counter back to per-cpu mode. */ + blk_mq_unfreeze_queue(q); + +- spin_lock_irq(&q->queue_lock); +- if (ret < 0) ++ if (ret < 0) { ++ spin_lock_irq(&q->queue_lock); ++ q->rpm_status = RPM_ACTIVE; + pm_runtime_mark_last_busy(q->dev); +- else +- q->rpm_status = RPM_SUSPENDING; +- spin_unlock_irq(&q->queue_lock); ++ spin_unlock_irq(&q->queue_lock); + +- if (ret) + blk_clear_pm_only(q); ++ } + + return ret; + } +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 78d635f1d1567..376164cdf2ea9 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -251,8 +251,12 @@ static int h5_close(struct hci_uart *hu) + if (h5->vnd && h5->vnd->close) + h5->vnd->close(h5); + +- if (!hu->serdev) +- kfree(h5); ++ if (hu->serdev) ++ serdev_device_close(hu->serdev); ++ ++ kfree_skb(h5->rx_skb); ++ kfree(h5); ++ h5 = NULL; + + return 0; + } +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index e92c4d9469d82..5952210526aaa 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -540,15 +540,15 @@ endif # HW_RANDOM + + config UML_RANDOM + depends on UML +- tristate "Hardware random number generator" ++ select HW_RANDOM ++ tristate "UML Random Number Generator support" + help + This option enables UML's "hardware" random number generator. It + attaches itself to the host's /dev/random, supplying as much entropy + as the host has, rather than the small amount the UML gets from its +- own drivers. It registers itself as a standard hardware random number +- generator, major 10, minor 183, and the canonical device name is +- /dev/hwrng. +- The way to make use of this is to install the rng-tools package +- (check your distro, or download from +- http://sourceforge.net/projects/gkernel/). rngd periodically reads +- /dev/hwrng and injects the entropy into /dev/random. ++ own drivers. It registers itself as a rng-core driver thus providing ++ a device which is usually called /dev/hwrng. This hardware random ++ number generator does feed into the kernel's random number generator ++ entropy pool. ++ ++ If unsure, say Y. +diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c +index 27513d311242e..de7b74505e75e 100644 +--- a/drivers/dax/bus.c ++++ b/drivers/dax/bus.c +@@ -367,19 +367,28 @@ void kill_dev_dax(struct dev_dax *dev_dax) + } + EXPORT_SYMBOL_GPL(kill_dev_dax); + +-static void free_dev_dax_ranges(struct dev_dax *dev_dax) ++static void trim_dev_dax_range(struct dev_dax *dev_dax) + { ++ int i = dev_dax->nr_range - 1; ++ struct range *range = &dev_dax->ranges[i].range; + struct dax_region *dax_region = dev_dax->region; +- int i; + + device_lock_assert(dax_region->dev); +- for (i = 0; i < dev_dax->nr_range; i++) { +- struct range *range = &dev_dax->ranges[i].range; +- +- __release_region(&dax_region->res, range->start, +- range_len(range)); ++ dev_dbg(&dev_dax->dev, "delete range[%d]: %#llx:%#llx\n", i, ++ (unsigned long long)range->start, ++ (unsigned long long)range->end); ++ ++ __release_region(&dax_region->res, range->start, range_len(range)); ++ if (--dev_dax->nr_range == 0) { ++ kfree(dev_dax->ranges); ++ dev_dax->ranges = NULL; + } +- dev_dax->nr_range = 0; ++} ++ ++static void free_dev_dax_ranges(struct dev_dax *dev_dax) ++{ ++ while (dev_dax->nr_range) ++ trim_dev_dax_range(dev_dax); + } + + static void unregister_dev_dax(void *dev) +@@ -804,15 +813,10 @@ static int alloc_dev_dax_range(struct dev_dax *dev_dax, u64 start, + return 0; + + rc = devm_register_dax_mapping(dev_dax, dev_dax->nr_range - 1); +- if (rc) { +- dev_dbg(dev, "delete range[%d]: %pa:%pa\n", dev_dax->nr_range - 1, +- &alloc->start, &alloc->end); +- dev_dax->nr_range--; +- __release_region(res, alloc->start, resource_size(alloc)); +- return rc; +- } ++ if (rc) ++ trim_dev_dax_range(dev_dax); + +- return 0; ++ return rc; + } + + static int adjust_dev_dax_range(struct dev_dax *dev_dax, struct resource *res, resource_size_t size) +@@ -885,12 +889,7 @@ static int dev_dax_shrink(struct dev_dax *dev_dax, resource_size_t size) + if (shrink >= range_len(range)) { + devm_release_action(dax_region->dev, + unregister_dax_mapping, &mapping->dev); +- __release_region(&dax_region->res, range->start, +- range_len(range)); +- dev_dax->nr_range--; +- dev_dbg(dev, "delete range[%d]: %#llx:%#llx\n", i, +- (unsigned long long) range->start, +- (unsigned long long) range->end); ++ trim_dev_dax_range(dev_dax); + to_shrink -= shrink; + if (!to_shrink) + break; +@@ -1274,7 +1273,6 @@ static void dev_dax_release(struct device *dev) + put_dax(dax_dev); + free_dev_dax_id(dev_dax); + dax_region_put(dax_region); +- kfree(dev_dax->ranges); + kfree(dev_dax->pgmap); + kfree(dev_dax); + } +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +index 6b431db146cd9..1c6e401dd4cce 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +@@ -704,24 +704,24 @@ static struct wm_table ddr4_wm_table_rn = { + .wm_inst = WM_B, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.72, +- .sr_exit_time_us = 10.12, +- .sr_enter_plus_exit_time_us = 11.48, ++ .sr_exit_time_us = 11.12, ++ .sr_enter_plus_exit_time_us = 12.48, + .valid = true, + }, + { + .wm_inst = WM_C, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.72, +- .sr_exit_time_us = 10.12, +- .sr_enter_plus_exit_time_us = 11.48, ++ .sr_exit_time_us = 11.12, ++ .sr_enter_plus_exit_time_us = 12.48, + .valid = true, + }, + { + .wm_inst = WM_D, + .wm_type = WM_TYPE_PSTATE_CHG, + .pstate_latency_us = 11.72, +- .sr_exit_time_us = 10.12, +- .sr_enter_plus_exit_time_us = 11.48, ++ .sr_exit_time_us = 11.12, ++ .sr_enter_plus_exit_time_us = 12.48, + .valid = true, + }, + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +index b409f6b2bfd83..210466b2d8631 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +@@ -119,7 +119,8 @@ static const struct link_encoder_funcs dce110_lnk_enc_funcs = { + .disable_hpd = dce110_link_encoder_disable_hpd, + .is_dig_enabled = dce110_is_dig_enabled, + .destroy = dce110_link_encoder_destroy, +- .get_max_link_cap = dce110_link_encoder_get_max_link_cap ++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap, ++ .get_dig_frontend = dce110_get_dig_frontend, + }; + + static enum bp_result link_transmitter_control( +@@ -235,6 +236,44 @@ static void set_link_training_complete( + + } + ++unsigned int dce110_get_dig_frontend(struct link_encoder *enc) ++{ ++ struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc); ++ u32 value; ++ enum engine_id result; ++ ++ REG_GET(DIG_BE_CNTL, DIG_FE_SOURCE_SELECT, &value); ++ ++ switch (value) { ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGA: ++ result = ENGINE_ID_DIGA; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGB: ++ result = ENGINE_ID_DIGB; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGC: ++ result = ENGINE_ID_DIGC; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGD: ++ result = ENGINE_ID_DIGD; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGE: ++ result = ENGINE_ID_DIGE; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGF: ++ result = ENGINE_ID_DIGF; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGG: ++ result = ENGINE_ID_DIGG; ++ break; ++ default: ++ // invalid source select DIG ++ result = ENGINE_ID_UNKNOWN; ++ } ++ ++ return result; ++} ++ + void dce110_link_encoder_set_dp_phy_pattern_training_pattern( + struct link_encoder *enc, + uint32_t index) +@@ -1665,7 +1704,8 @@ static const struct link_encoder_funcs dce60_lnk_enc_funcs = { + .disable_hpd = dce110_link_encoder_disable_hpd, + .is_dig_enabled = dce110_is_dig_enabled, + .destroy = dce110_link_encoder_destroy, +- .get_max_link_cap = dce110_link_encoder_get_max_link_cap ++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap, ++ .get_dig_frontend = dce110_get_dig_frontend + }; + + void dce60_link_encoder_construct( +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h +index cb714a48b171c..fc6ade824c231 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h +@@ -295,6 +295,8 @@ void dce110_link_encoder_connect_dig_be_to_fe( + enum engine_id engine, + bool connect); + ++unsigned int dce110_get_dig_frontend(struct link_encoder *enc); ++ + void dce110_link_encoder_set_dp_phy_pattern_training_pattern( + struct link_encoder *enc, + uint32_t index); +diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c +index 1c6b78ad5ade4..b61bf53ec07af 100644 +--- a/drivers/i3c/master.c ++++ b/drivers/i3c/master.c +@@ -2537,7 +2537,7 @@ int i3c_master_register(struct i3c_master_controller *master, + + ret = i3c_master_bus_init(master); + if (ret) +- goto err_put_dev; ++ goto err_destroy_wq; + + ret = device_add(&master->dev); + if (ret) +@@ -2568,6 +2568,9 @@ err_del_dev: + err_cleanup_bus: + i3c_master_bus_cleanup(master); + ++err_destroy_wq: ++ destroy_workqueue(master->wq); ++ + err_put_dev: + put_device(&master->dev); + +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index f74982dcbea0d..6b8e5bdd8526d 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -537,6 +537,15 @@ static int verity_verify_io(struct dm_verity_io *io) + return 0; + } + ++/* ++ * Skip verity work in response to I/O error when system is shutting down. ++ */ ++static inline bool verity_is_system_shutting_down(void) ++{ ++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF ++ || system_state == SYSTEM_RESTART; ++} ++ + /* + * End one "io" structure with a given error. + */ +@@ -564,7 +573,8 @@ static void verity_end_io(struct bio *bio) + { + struct dm_verity_io *io = bio->bi_private; + +- if (bio->bi_status && !verity_fec_is_enabled(io->v)) { ++ if (bio->bi_status && ++ (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) { + verity_finish_io(io, bio->bi_status); + return; + } +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 3b598a3cb462a..9f9d8b67b5dd1 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1128,7 +1128,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + struct md_rdev *err_rdev = NULL; + gfp_t gfp = GFP_NOIO; + +- if (r10_bio->devs[slot].rdev) { ++ if (slot >= 0 && r10_bio->devs[slot].rdev) { + /* + * This is an error retry, but we cannot + * safely dereference the rdev in the r10_bio, +@@ -1493,6 +1493,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors) + r10_bio->mddev = mddev; + r10_bio->sector = bio->bi_iter.bi_sector; + r10_bio->state = 0; ++ r10_bio->read_slot = -1; + memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->copies); + + if (bio_data_dir(bio) == READ) +diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c +index c07f46f5176ea..b4f661bb56481 100644 +--- a/drivers/media/usb/dvb-usb/gp8psk.c ++++ b/drivers/media/usb/dvb-usb/gp8psk.c +@@ -182,7 +182,7 @@ out_rel_fw: + + static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff) + { +- u8 status, buf; ++ u8 status = 0, buf; + int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct); + + if (onoff) { +diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c +index 16695366ec926..26ff49fdf0f7d 100644 +--- a/drivers/misc/vmw_vmci/vmci_context.c ++++ b/drivers/misc/vmw_vmci/vmci_context.c +@@ -743,7 +743,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context, + return VMCI_ERROR_MORE_DATA; + } + +- dbells = kmalloc(data_size, GFP_ATOMIC); ++ dbells = kzalloc(data_size, GFP_ATOMIC); + if (!dbells) + return VMCI_ERROR_NO_MEM; + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 0e0a5269dc82f..903b465c8568b 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1102,7 +1102,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) + if (IS_ERR(opp_table->clk)) { + ret = PTR_ERR(opp_table->clk); + if (ret == -EPROBE_DEFER) +- goto err; ++ goto remove_opp_dev; + + dev_dbg(dev, "%s: Couldn't find clock: %d\n", __func__, ret); + } +@@ -1111,7 +1111,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) + ret = dev_pm_opp_of_find_icc_paths(dev, opp_table); + if (ret) { + if (ret == -EPROBE_DEFER) +- goto err; ++ goto put_clk; + + dev_warn(dev, "%s: Error finding interconnect paths: %d\n", + __func__, ret); +@@ -1125,6 +1125,11 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) + list_add(&opp_table->node, &opp_tables); + return opp_table; + ++put_clk: ++ if (!IS_ERR(opp_table->clk)) ++ clk_put(opp_table->clk); ++remove_opp_dev: ++ _remove_opp_dev(opp_dev, opp_table); + err: + kfree(opp_table); + return ERR_PTR(ret); +diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c +index c6b89273feba8..d4b2ab7861266 100644 +--- a/drivers/rtc/rtc-pl031.c ++++ b/drivers/rtc/rtc-pl031.c +@@ -361,8 +361,10 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id) + + device_init_wakeup(&adev->dev, true); + ldata->rtc = devm_rtc_allocate_device(&adev->dev); +- if (IS_ERR(ldata->rtc)) +- return PTR_ERR(ldata->rtc); ++ if (IS_ERR(ldata->rtc)) { ++ ret = PTR_ERR(ldata->rtc); ++ goto out; ++ } + + ldata->rtc->ops = ops; + ldata->rtc->range_min = vendor->range_min; +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index e2b8b150bcb44..f2818cdd11d82 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -272,7 +272,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + 300000000); + if (IS_ERR(rtc->int_osc)) { + pr_crit("Couldn't register the internal oscillator\n"); +- return; ++ goto err; + } + + parents[0] = clk_hw_get_name(rtc->int_osc); +@@ -290,7 +290,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + rtc->losc = clk_register(NULL, &rtc->hw); + if (IS_ERR(rtc->losc)) { + pr_crit("Couldn't register the LOSC clock\n"); +- return; ++ goto err_register; + } + + of_property_read_string_index(node, "clock-output-names", 1, +@@ -301,7 +301,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + &rtc->lock); + if (IS_ERR(rtc->ext_losc)) { + pr_crit("Couldn't register the LOSC external gate\n"); +- return; ++ goto err_register; + } + + clk_data->num = 2; +@@ -314,6 +314,8 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, + of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + return; + ++err_register: ++ clk_hw_unregister_fixed_rate(rtc->int_osc); + err: + kfree(clk_data); + } +diff --git a/drivers/scsi/cxgbi/cxgb4i/Kconfig b/drivers/scsi/cxgbi/cxgb4i/Kconfig +index b206e266b4e72..8b0deece9758b 100644 +--- a/drivers/scsi/cxgbi/cxgb4i/Kconfig ++++ b/drivers/scsi/cxgbi/cxgb4i/Kconfig +@@ -4,6 +4,7 @@ config SCSI_CXGB4_ISCSI + depends on PCI && INET && (IPV6 || IPV6=n) + depends on THERMAL || !THERMAL + depends on ETHERNET ++ depends on TLS || TLS=n + select NET_VENDOR_CHELSIO + select CHELSIO_T4 + select CHELSIO_LIB +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 3fd16b7f61507..aadaea052f51d 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -256,6 +256,7 @@ config SPI_DW_BT1 + tristate "Baikal-T1 SPI driver for DW SPI core" + depends on MIPS_BAIKAL_T1 || COMPILE_TEST + select MULTIPLEXER ++ select MUX_MMIO + help + Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI + controllers. Two of them are pretty much normal: with IRQ, DMA, +@@ -269,8 +270,6 @@ config SPI_DW_BT1 + config SPI_DW_BT1_DIRMAP + bool "Directly mapped Baikal-T1 Boot SPI flash support" + depends on SPI_DW_BT1 +- select MULTIPLEXER +- select MUX_MMIO + help + Directly mapped SPI flash memory is an interface specific to the + Baikal-T1 System Boot Controller. It is a 16MB MMIO region, which +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index cef437817b0dc..8d1ae973041ae 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -1033,7 +1033,7 @@ static void fbcon_init(struct vc_data *vc, int init) + struct vc_data *svc = *default_mode; + struct fbcon_display *t, *p = &fb_display[vc->vc_num]; + int logo = 1, new_rows, new_cols, rows, cols, charcnt = 256; +- int cap, ret; ++ int ret; + + if (WARN_ON(info_idx == -1)) + return; +@@ -1042,7 +1042,6 @@ static void fbcon_init(struct vc_data *vc, int init) + con2fb_map[vc->vc_num] = info_idx; + + info = registered_fb[con2fb_map[vc->vc_num]]; +- cap = info->flags; + + if (logo_shown < 0 && console_loglevel <= CONSOLE_LOGLEVEL_QUIET) + logo_shown = FBCON_LOGO_DONTSHOW; +@@ -1147,11 +1146,13 @@ static void fbcon_init(struct vc_data *vc, int init) + + ops->graphics = 0; + +- if ((cap & FBINFO_HWACCEL_COPYAREA) && +- !(cap & FBINFO_HWACCEL_DISABLED)) +- p->scrollmode = SCROLL_MOVE; +- else /* default to something safe */ +- p->scrollmode = SCROLL_REDRAW; ++ /* ++ * No more hw acceleration for fbcon. ++ * ++ * FIXME: Garbage collect all the now dead code after sufficient time ++ * has passed. ++ */ ++ p->scrollmode = SCROLL_REDRAW; + + /* + * ++guenther: console.c:vc_allocate() relies on initializing +@@ -1961,45 +1962,15 @@ static void updatescrollmode(struct fbcon_display *p, + { + struct fbcon_ops *ops = info->fbcon_par; + int fh = vc->vc_font.height; +- int cap = info->flags; +- u16 t = 0; +- int ypan = FBCON_SWAP(ops->rotate, info->fix.ypanstep, +- info->fix.xpanstep); +- int ywrap = FBCON_SWAP(ops->rotate, info->fix.ywrapstep, t); + int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); + int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual, + info->var.xres_virtual); +- int good_pan = (cap & FBINFO_HWACCEL_YPAN) && +- divides(ypan, vc->vc_font.height) && vyres > yres; +- int good_wrap = (cap & FBINFO_HWACCEL_YWRAP) && +- divides(ywrap, vc->vc_font.height) && +- divides(vc->vc_font.height, vyres) && +- divides(vc->vc_font.height, yres); +- int reading_fast = cap & FBINFO_READS_FAST; +- int fast_copyarea = (cap & FBINFO_HWACCEL_COPYAREA) && +- !(cap & FBINFO_HWACCEL_DISABLED); +- int fast_imageblit = (cap & FBINFO_HWACCEL_IMAGEBLIT) && +- !(cap & FBINFO_HWACCEL_DISABLED); + + p->vrows = vyres/fh; + if (yres > (fh * (vc->vc_rows + 1))) + p->vrows -= (yres - (fh * vc->vc_rows)) / fh; + if ((yres % fh) && (vyres % fh < yres % fh)) + p->vrows--; +- +- if (good_wrap || good_pan) { +- if (reading_fast || fast_copyarea) +- p->scrollmode = good_wrap ? +- SCROLL_WRAP_MOVE : SCROLL_PAN_MOVE; +- else +- p->scrollmode = good_wrap ? SCROLL_REDRAW : +- SCROLL_PAN_REDRAW; +- } else { +- if (reading_fast || (fast_copyarea && !fast_imageblit)) +- p->scrollmode = SCROLL_MOVE; +- else +- p->scrollmode = SCROLL_REDRAW; +- } + } + + #define PITCH(w) (((w) + 7) >> 3) +diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c +index 836319cbaca9d..359302f71f7ef 100644 +--- a/drivers/watchdog/rti_wdt.c ++++ b/drivers/watchdog/rti_wdt.c +@@ -227,8 +227,10 @@ static int rti_wdt_probe(struct platform_device *pdev) + + pm_runtime_enable(dev); + ret = pm_runtime_get_sync(dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_noidle(dev); + return dev_err_probe(dev, ret, "runtime pm failed\n"); ++ } + + platform_set_drvdata(pdev, wdt); + +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index 3ac7611ef7ce2..fd691e4815c56 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -350,7 +350,7 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) + + info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE) / sizeof(struct bfs_inode) + BFS_ROOT_INO - 1; + if (info->si_lasti == BFS_MAX_LASTI) +- printf("WARNING: filesystem %s was created with 512 inodes, the real maximum is 511, mounting anyway\n", s->s_id); ++ printf("NOTE: filesystem %s was created with 512 inodes, the real maximum is 511, mounting anyway\n", s->s_id); + else if (info->si_lasti > BFS_MAX_LASTI) { + printf("Impossible last inode number %lu > %d on %s\n", info->si_lasti, BFS_MAX_LASTI, s->s_id); + goto out1; +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 526faf4778ce4..2462a9a84b956 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1335,6 +1335,8 @@ retry_lookup: + in, ceph_vinop(in)); + if (in->i_state & I_NEW) + discard_new_inode(in); ++ else ++ iput(in); + goto done; + } + req->r_target_inode = in; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 37a619bf1ac7c..e67d5de6f28ca 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2395,9 +2395,9 @@ repeat: + + nr = sbi->s_mb_prefetch; + if (ext4_has_feature_flex_bg(sb)) { +- nr = (group / sbi->s_mb_prefetch) * +- sbi->s_mb_prefetch; +- nr = nr + sbi->s_mb_prefetch - group; ++ nr = 1 << sbi->s_log_groups_per_flex; ++ nr -= group & (nr - 1); ++ nr = min(nr, sbi->s_mb_prefetch); + } + prefetch_grp = ext4_mb_prefetch(sb, group, + nr, &prefetch_ios); +@@ -2733,7 +2733,8 @@ static int ext4_mb_init_backend(struct super_block *sb) + + if (ext4_has_feature_flex_bg(sb)) { + /* a single flex group is supposed to be read by a single IO */ +- sbi->s_mb_prefetch = 1 << sbi->s_es->s_log_groups_per_flex; ++ sbi->s_mb_prefetch = min(1 << sbi->s_es->s_log_groups_per_flex, ++ BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits - 9)); + sbi->s_mb_prefetch *= 8; /* 8 prefetch IOs in flight at most */ + } else { + sbi->s_mb_prefetch = 32; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 2b08b162075c3..ea5aefa23a20a 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4186,18 +4186,25 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + */ + sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT; + +- blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); +- +- if (blocksize == PAGE_SIZE) +- set_opt(sb, DIOREAD_NOLOCK); +- +- if (blocksize < EXT4_MIN_BLOCK_SIZE || +- blocksize > EXT4_MAX_BLOCK_SIZE) { ++ if (le32_to_cpu(es->s_log_block_size) > ++ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { + ext4_msg(sb, KERN_ERR, +- "Unsupported filesystem blocksize %d (%d log_block_size)", +- blocksize, le32_to_cpu(es->s_log_block_size)); ++ "Invalid log block size: %u", ++ le32_to_cpu(es->s_log_block_size)); + goto failed_mount; + } ++ if (le32_to_cpu(es->s_log_cluster_size) > ++ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid log cluster size: %u", ++ le32_to_cpu(es->s_log_cluster_size)); ++ goto failed_mount; ++ } ++ ++ blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); ++ ++ if (blocksize == PAGE_SIZE) ++ set_opt(sb, DIOREAD_NOLOCK); + + if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { + sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; +@@ -4416,21 +4423,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + if (!ext4_feature_set_ok(sb, (sb_rdonly(sb)))) + goto failed_mount; + +- if (le32_to_cpu(es->s_log_block_size) > +- (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { +- ext4_msg(sb, KERN_ERR, +- "Invalid log block size: %u", +- le32_to_cpu(es->s_log_block_size)); +- goto failed_mount; +- } +- if (le32_to_cpu(es->s_log_cluster_size) > +- (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { +- ext4_msg(sb, KERN_ERR, +- "Invalid log cluster size: %u", +- le32_to_cpu(es->s_log_cluster_size)); +- goto failed_mount; +- } +- + if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) { + ext4_msg(sb, KERN_ERR, + "Number of reserved GDT blocks insanely large: %d", +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 023462e80e58d..b39bf416d5114 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1600,7 +1600,7 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) + goto out; + } + +- if (NM_I(sbi)->dirty_nat_cnt == 0 && ++ if (NM_I(sbi)->nat_cnt[DIRTY_NAT] == 0 && + SIT_I(sbi)->dirty_sentries == 0 && + prefree_segments(sbi) == 0) { + f2fs_flush_sit_entries(sbi, cpc); +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 14262e0f1cd60..c5fee4d7ea72f 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -798,8 +798,6 @@ destroy_decompress_ctx: + if (cops->destroy_decompress_ctx) + cops->destroy_decompress_ctx(dic); + out_free_dic: +- if (verity) +- atomic_set(&dic->pending_pages, dic->nr_cpages); + if (!verity) + f2fs_decompress_end_io(dic->rpages, dic->cluster_size, + ret, false); +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index be4da52604edc..b29243ee1c3e5 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -202,7 +202,7 @@ static void f2fs_verify_bio(struct bio *bio) + dic = (struct decompress_io_ctx *)page_private(page); + + if (dic) { +- if (atomic_dec_return(&dic->pending_pages)) ++ if (atomic_dec_return(&dic->verity_pages)) + continue; + f2fs_verify_pages(dic->rpages, + dic->cluster_size); +@@ -1027,7 +1027,8 @@ static inline bool f2fs_need_verity(const struct inode *inode, pgoff_t idx) + + static struct bio *f2fs_grab_read_bio(struct inode *inode, block_t blkaddr, + unsigned nr_pages, unsigned op_flag, +- pgoff_t first_idx, bool for_write) ++ pgoff_t first_idx, bool for_write, ++ bool for_verity) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct bio *bio; +@@ -1049,7 +1050,7 @@ static struct bio *f2fs_grab_read_bio(struct inode *inode, block_t blkaddr, + post_read_steps |= 1 << STEP_DECRYPT; + if (f2fs_compressed_file(inode)) + post_read_steps |= 1 << STEP_DECOMPRESS_NOWQ; +- if (f2fs_need_verity(inode, first_idx)) ++ if (for_verity && f2fs_need_verity(inode, first_idx)) + post_read_steps |= 1 << STEP_VERITY; + + if (post_read_steps) { +@@ -1079,7 +1080,7 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page, + struct bio *bio; + + bio = f2fs_grab_read_bio(inode, blkaddr, 1, op_flags, +- page->index, for_write); ++ page->index, for_write, true); + if (IS_ERR(bio)) + return PTR_ERR(bio); + +@@ -2133,7 +2134,7 @@ submit_and_realloc: + if (bio == NULL) { + bio = f2fs_grab_read_bio(inode, block_nr, nr_pages, + is_readahead ? REQ_RAHEAD : 0, page->index, +- false); ++ false, true); + if (IS_ERR(bio)) { + ret = PTR_ERR(bio); + bio = NULL; +@@ -2180,6 +2181,8 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret, + const unsigned blkbits = inode->i_blkbits; + const unsigned blocksize = 1 << blkbits; + struct decompress_io_ctx *dic = NULL; ++ struct bio_post_read_ctx *ctx; ++ bool for_verity = false; + int i; + int ret = 0; + +@@ -2245,10 +2248,29 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret, + goto out_put_dnode; + } + ++ /* ++ * It's possible to enable fsverity on the fly when handling a cluster, ++ * which requires complicated error handling. Instead of adding more ++ * complexity, let's give a rule where end_io post-processes fsverity ++ * per cluster. In order to do that, we need to submit bio, if previous ++ * bio sets a different post-process policy. ++ */ ++ if (fsverity_active(cc->inode)) { ++ atomic_set(&dic->verity_pages, cc->nr_cpages); ++ for_verity = true; ++ ++ if (bio) { ++ ctx = bio->bi_private; ++ if (!(ctx->enabled_steps & (1 << STEP_VERITY))) { ++ __submit_bio(sbi, bio, DATA); ++ bio = NULL; ++ } ++ } ++ } ++ + for (i = 0; i < dic->nr_cpages; i++) { + struct page *page = dic->cpages[i]; + block_t blkaddr; +- struct bio_post_read_ctx *ctx; + + blkaddr = data_blkaddr(dn.inode, dn.node_page, + dn.ofs_in_node + i + 1); +@@ -2264,17 +2286,31 @@ submit_and_realloc: + if (!bio) { + bio = f2fs_grab_read_bio(inode, blkaddr, nr_pages, + is_readahead ? REQ_RAHEAD : 0, +- page->index, for_write); ++ page->index, for_write, for_verity); + if (IS_ERR(bio)) { ++ unsigned int remained = dic->nr_cpages - i; ++ bool release = false; ++ + ret = PTR_ERR(bio); + dic->failed = true; +- if (!atomic_sub_return(dic->nr_cpages - i, +- &dic->pending_pages)) { ++ ++ if (for_verity) { ++ if (!atomic_sub_return(remained, ++ &dic->verity_pages)) ++ release = true; ++ } else { ++ if (!atomic_sub_return(remained, ++ &dic->pending_pages)) ++ release = true; ++ } ++ ++ if (release) { + f2fs_decompress_end_io(dic->rpages, +- cc->cluster_size, true, +- false); ++ cc->cluster_size, true, ++ false); + f2fs_free_dic(dic); + } ++ + f2fs_put_dnode(&dn); + *bio_ret = NULL; + return ret; +diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c +index a8357fd4f5fab..197c914119da8 100644 +--- a/fs/f2fs/debug.c ++++ b/fs/f2fs/debug.c +@@ -145,8 +145,8 @@ static void update_general_status(struct f2fs_sb_info *sbi) + si->node_pages = NODE_MAPPING(sbi)->nrpages; + if (sbi->meta_inode) + si->meta_pages = META_MAPPING(sbi)->nrpages; +- si->nats = NM_I(sbi)->nat_cnt; +- si->dirty_nats = NM_I(sbi)->dirty_nat_cnt; ++ si->nats = NM_I(sbi)->nat_cnt[TOTAL_NAT]; ++ si->dirty_nats = NM_I(sbi)->nat_cnt[DIRTY_NAT]; + si->sits = MAIN_SEGS(sbi); + si->dirty_sits = SIT_I(sbi)->dirty_sentries; + si->free_nids = NM_I(sbi)->nid_cnt[FREE_NID]; +@@ -278,9 +278,10 @@ get_cache: + si->cache_mem += (NM_I(sbi)->nid_cnt[FREE_NID] + + NM_I(sbi)->nid_cnt[PREALLOC_NID]) * + sizeof(struct free_nid); +- si->cache_mem += NM_I(sbi)->nat_cnt * sizeof(struct nat_entry); +- si->cache_mem += NM_I(sbi)->dirty_nat_cnt * +- sizeof(struct nat_entry_set); ++ si->cache_mem += NM_I(sbi)->nat_cnt[TOTAL_NAT] * ++ sizeof(struct nat_entry); ++ si->cache_mem += NM_I(sbi)->nat_cnt[DIRTY_NAT] * ++ sizeof(struct nat_entry_set); + si->cache_mem += si->inmem_pages * sizeof(struct inmem_pages); + for (i = 0; i < MAX_INO_ENTRY; i++) + si->cache_mem += sbi->im[i].ino_num * sizeof(struct ino_entry); +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 9a321c52facec..06e5a6053f3f9 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -894,6 +894,13 @@ enum nid_state { + MAX_NID_STATE, + }; + ++enum nat_state { ++ TOTAL_NAT, ++ DIRTY_NAT, ++ RECLAIMABLE_NAT, ++ MAX_NAT_STATE, ++}; ++ + struct f2fs_nm_info { + block_t nat_blkaddr; /* base disk address of NAT */ + nid_t max_nid; /* maximum possible node ids */ +@@ -909,8 +916,7 @@ struct f2fs_nm_info { + struct rw_semaphore nat_tree_lock; /* protect nat_tree_lock */ + struct list_head nat_entries; /* cached nat entry list (clean) */ + spinlock_t nat_list_lock; /* protect clean nat entry list */ +- unsigned int nat_cnt; /* the # of cached nat entries */ +- unsigned int dirty_nat_cnt; /* total num of nat entries in set */ ++ unsigned int nat_cnt[MAX_NAT_STATE]; /* the # of cached nat entries */ + unsigned int nat_blocks; /* # of nat blocks */ + + /* free node ids management */ +@@ -1404,6 +1410,7 @@ struct decompress_io_ctx { + size_t rlen; /* valid data length in rbuf */ + size_t clen; /* valid data length in cbuf */ + atomic_t pending_pages; /* in-flight compressed page count */ ++ atomic_t verity_pages; /* in-flight page count for verity */ + bool failed; /* indicate IO error during decompression */ + void *private; /* payload buffer for specified decompression algorithm */ + void *private2; /* extra payload buffer */ +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 42394de6c7eb1..e65d73293a3f6 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -62,8 +62,8 @@ bool f2fs_available_free_memory(struct f2fs_sb_info *sbi, int type) + sizeof(struct free_nid)) >> PAGE_SHIFT; + res = mem_size < ((avail_ram * nm_i->ram_thresh / 100) >> 2); + } else if (type == NAT_ENTRIES) { +- mem_size = (nm_i->nat_cnt * sizeof(struct nat_entry)) >> +- PAGE_SHIFT; ++ mem_size = (nm_i->nat_cnt[TOTAL_NAT] * ++ sizeof(struct nat_entry)) >> PAGE_SHIFT; + res = mem_size < ((avail_ram * nm_i->ram_thresh / 100) >> 2); + if (excess_cached_nats(sbi)) + res = false; +@@ -177,7 +177,8 @@ static struct nat_entry *__init_nat_entry(struct f2fs_nm_info *nm_i, + list_add_tail(&ne->list, &nm_i->nat_entries); + spin_unlock(&nm_i->nat_list_lock); + +- nm_i->nat_cnt++; ++ nm_i->nat_cnt[TOTAL_NAT]++; ++ nm_i->nat_cnt[RECLAIMABLE_NAT]++; + return ne; + } + +@@ -207,7 +208,8 @@ static unsigned int __gang_lookup_nat_cache(struct f2fs_nm_info *nm_i, + static void __del_from_nat_cache(struct f2fs_nm_info *nm_i, struct nat_entry *e) + { + radix_tree_delete(&nm_i->nat_root, nat_get_nid(e)); +- nm_i->nat_cnt--; ++ nm_i->nat_cnt[TOTAL_NAT]--; ++ nm_i->nat_cnt[RECLAIMABLE_NAT]--; + __free_nat_entry(e); + } + +@@ -253,7 +255,8 @@ static void __set_nat_cache_dirty(struct f2fs_nm_info *nm_i, + if (get_nat_flag(ne, IS_DIRTY)) + goto refresh_list; + +- nm_i->dirty_nat_cnt++; ++ nm_i->nat_cnt[DIRTY_NAT]++; ++ nm_i->nat_cnt[RECLAIMABLE_NAT]--; + set_nat_flag(ne, IS_DIRTY, true); + refresh_list: + spin_lock(&nm_i->nat_list_lock); +@@ -273,7 +276,8 @@ static void __clear_nat_cache_dirty(struct f2fs_nm_info *nm_i, + + set_nat_flag(ne, IS_DIRTY, false); + set->entry_cnt--; +- nm_i->dirty_nat_cnt--; ++ nm_i->nat_cnt[DIRTY_NAT]--; ++ nm_i->nat_cnt[RECLAIMABLE_NAT]++; + } + + static unsigned int __gang_lookup_nat_set(struct f2fs_nm_info *nm_i, +@@ -2944,14 +2948,17 @@ int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc) + LIST_HEAD(sets); + int err = 0; + +- /* during unmount, let's flush nat_bits before checking dirty_nat_cnt */ ++ /* ++ * during unmount, let's flush nat_bits before checking ++ * nat_cnt[DIRTY_NAT]. ++ */ + if (enabled_nat_bits(sbi, cpc)) { + down_write(&nm_i->nat_tree_lock); + remove_nats_in_journal(sbi); + up_write(&nm_i->nat_tree_lock); + } + +- if (!nm_i->dirty_nat_cnt) ++ if (!nm_i->nat_cnt[DIRTY_NAT]) + return 0; + + down_write(&nm_i->nat_tree_lock); +@@ -2962,7 +2969,8 @@ int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc) + * into nat entry set. + */ + if (enabled_nat_bits(sbi, cpc) || +- !__has_cursum_space(journal, nm_i->dirty_nat_cnt, NAT_JOURNAL)) ++ !__has_cursum_space(journal, ++ nm_i->nat_cnt[DIRTY_NAT], NAT_JOURNAL)) + remove_nats_in_journal(sbi); + + while ((found = __gang_lookup_nat_set(nm_i, +@@ -3086,7 +3094,6 @@ static int init_node_manager(struct f2fs_sb_info *sbi) + F2FS_RESERVED_NODE_NUM; + nm_i->nid_cnt[FREE_NID] = 0; + nm_i->nid_cnt[PREALLOC_NID] = 0; +- nm_i->nat_cnt = 0; + nm_i->ram_thresh = DEF_RAM_THRESHOLD; + nm_i->ra_nid_pages = DEF_RA_NID_PAGES; + nm_i->dirty_nats_ratio = DEF_DIRTY_NAT_RATIO_THRESHOLD; +@@ -3220,7 +3227,7 @@ void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi) + __del_from_nat_cache(nm_i, natvec[idx]); + } + } +- f2fs_bug_on(sbi, nm_i->nat_cnt); ++ f2fs_bug_on(sbi, nm_i->nat_cnt[TOTAL_NAT]); + + /* destroy nat set cache */ + nid = 0; +diff --git a/fs/f2fs/node.h b/fs/f2fs/node.h +index 69e5859e993cf..f84541b57acbb 100644 +--- a/fs/f2fs/node.h ++++ b/fs/f2fs/node.h +@@ -126,13 +126,13 @@ static inline void raw_nat_from_node_info(struct f2fs_nat_entry *raw_ne, + + static inline bool excess_dirty_nats(struct f2fs_sb_info *sbi) + { +- return NM_I(sbi)->dirty_nat_cnt >= NM_I(sbi)->max_nid * ++ return NM_I(sbi)->nat_cnt[DIRTY_NAT] >= NM_I(sbi)->max_nid * + NM_I(sbi)->dirty_nats_ratio / 100; + } + + static inline bool excess_cached_nats(struct f2fs_sb_info *sbi) + { +- return NM_I(sbi)->nat_cnt >= DEF_NAT_CACHE_THRESHOLD; ++ return NM_I(sbi)->nat_cnt[TOTAL_NAT] >= DEF_NAT_CACHE_THRESHOLD; + } + + static inline bool excess_dirty_nodes(struct f2fs_sb_info *sbi) +diff --git a/fs/f2fs/shrinker.c b/fs/f2fs/shrinker.c +index d66de5999a26d..dd3c3c7a90ec8 100644 +--- a/fs/f2fs/shrinker.c ++++ b/fs/f2fs/shrinker.c +@@ -18,9 +18,7 @@ static unsigned int shrinker_run_no; + + static unsigned long __count_nat_entries(struct f2fs_sb_info *sbi) + { +- long count = NM_I(sbi)->nat_cnt - NM_I(sbi)->dirty_nat_cnt; +- +- return count > 0 ? count : 0; ++ return NM_I(sbi)->nat_cnt[RECLAIMABLE_NAT]; + } + + static unsigned long __count_free_nids(struct f2fs_sb_info *sbi) +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index fef22e476c526..aa284ce7ec00d 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2744,7 +2744,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi, + block_t total_sections, blocks_per_seg; + struct f2fs_super_block *raw_super = (struct f2fs_super_block *) + (bh->b_data + F2FS_SUPER_OFFSET); +- unsigned int blocksize; + size_t crc_offset = 0; + __u32 crc = 0; + +@@ -2778,10 +2777,10 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi, + } + + /* Currently, support only 4KB block size */ +- blocksize = 1 << le32_to_cpu(raw_super->log_blocksize); +- if (blocksize != F2FS_BLKSIZE) { +- f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB", +- blocksize); ++ if (le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE_BITS) { ++ f2fs_info(sbi, "Invalid log_blocksize (%u), supports only %u", ++ le32_to_cpu(raw_super->log_blocksize), ++ F2FS_BLKSIZE_BITS); + return -EFSCORRUPTED; + } + +diff --git a/fs/fcntl.c b/fs/fcntl.c +index 19ac5baad50fd..05b36b28f2e87 100644 +--- a/fs/fcntl.c ++++ b/fs/fcntl.c +@@ -781,9 +781,10 @@ void send_sigio(struct fown_struct *fown, int fd, int band) + { + struct task_struct *p; + enum pid_type type; ++ unsigned long flags; + struct pid *pid; + +- read_lock(&fown->lock); ++ read_lock_irqsave(&fown->lock, flags); + + type = fown->pid_type; + pid = fown->pid; +@@ -804,7 +805,7 @@ void send_sigio(struct fown_struct *fown, int fd, int band) + read_unlock(&tasklist_lock); + } + out_unlock_fown: +- read_unlock(&fown->lock); ++ read_unlock_irqrestore(&fown->lock, flags); + } + + static void send_sigurg_to_task(struct task_struct *p, +@@ -819,9 +820,10 @@ int send_sigurg(struct fown_struct *fown) + struct task_struct *p; + enum pid_type type; + struct pid *pid; ++ unsigned long flags; + int ret = 0; + +- read_lock(&fown->lock); ++ read_lock_irqsave(&fown->lock, flags); + + type = fown->pid_type; + pid = fown->pid; +@@ -844,7 +846,7 @@ int send_sigurg(struct fown_struct *fown) + read_unlock(&tasklist_lock); + } + out_unlock_fown: +- read_unlock(&fown->lock); ++ read_unlock_irqrestore(&fown->lock, flags); + return ret; + } + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 0fcd065baa760..1f798c5c4213e 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -941,6 +941,10 @@ enum io_mem_account { + ACCT_PINNED, + }; + ++static void destroy_fixed_file_ref_node(struct fixed_file_ref_node *ref_node); ++static struct fixed_file_ref_node *alloc_fixed_file_ref_node( ++ struct io_ring_ctx *ctx); ++ + static void __io_complete_rw(struct io_kiocb *req, long res, long res2, + struct io_comp_state *cs); + static void io_cqring_fill_event(struct io_kiocb *req, long res); +@@ -1369,6 +1373,13 @@ static bool io_grab_identity(struct io_kiocb *req) + spin_unlock_irq(&ctx->inflight_lock); + req->work.flags |= IO_WQ_WORK_FILES; + } ++ if (!(req->work.flags & IO_WQ_WORK_MM) && ++ (def->work_flags & IO_WQ_WORK_MM)) { ++ if (id->mm != current->mm) ++ return false; ++ mmgrab(id->mm); ++ req->work.flags |= IO_WQ_WORK_MM; ++ } + + return true; + } +@@ -1393,13 +1404,6 @@ static void io_prep_async_work(struct io_kiocb *req) + req->work.flags |= IO_WQ_WORK_UNBOUND; + } + +- /* ->mm can never change on us */ +- if (!(req->work.flags & IO_WQ_WORK_MM) && +- (def->work_flags & IO_WQ_WORK_MM)) { +- mmgrab(id->mm); +- req->work.flags |= IO_WQ_WORK_MM; +- } +- + /* if we fail grabbing identity, we must COW, regrab, and retry */ + if (io_grab_identity(req)) + return; +@@ -1632,8 +1636,6 @@ static bool io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force, + LIST_HEAD(list); + + if (!force) { +- if (list_empty_careful(&ctx->cq_overflow_list)) +- return true; + if ((ctx->cached_cq_tail - READ_ONCE(rings->cq.head) == + rings->cq_ring_entries)) + return false; +@@ -5861,15 +5863,15 @@ static void io_req_drop_files(struct io_kiocb *req) + struct io_ring_ctx *ctx = req->ctx; + unsigned long flags; + ++ put_files_struct(req->work.identity->files); ++ put_nsproxy(req->work.identity->nsproxy); + spin_lock_irqsave(&ctx->inflight_lock, flags); + list_del(&req->inflight_entry); +- if (waitqueue_active(&ctx->inflight_wait)) +- wake_up(&ctx->inflight_wait); + spin_unlock_irqrestore(&ctx->inflight_lock, flags); + req->flags &= ~REQ_F_INFLIGHT; +- put_files_struct(req->work.identity->files); +- put_nsproxy(req->work.identity->nsproxy); + req->work.flags &= ~IO_WQ_WORK_FILES; ++ if (waitqueue_active(&ctx->inflight_wait)) ++ wake_up(&ctx->inflight_wait); + } + + static void __io_clean_op(struct io_kiocb *req) +@@ -6575,8 +6577,7 @@ static int io_submit_sqes(struct io_ring_ctx *ctx, unsigned int nr) + + /* if we have a backlog and couldn't flush it all, return BUSY */ + if (test_bit(0, &ctx->sq_check_overflow)) { +- if (!list_empty(&ctx->cq_overflow_list) && +- !io_cqring_overflow_flush(ctx, false, NULL, NULL)) ++ if (!io_cqring_overflow_flush(ctx, false, NULL, NULL)) + return -EBUSY; + } + +@@ -6798,8 +6799,16 @@ static int io_sq_thread(void *data) + * kthread parking. This synchronizes the thread vs users, + * the users are synchronized on the sqd->ctx_lock. + */ +- if (kthread_should_park()) ++ if (kthread_should_park()) { + kthread_parkme(); ++ /* ++ * When sq thread is unparked, in case the previous park operation ++ * comes from io_put_sq_data(), which means that sq thread is going ++ * to be stopped, so here needs to have a check. ++ */ ++ if (kthread_should_stop()) ++ break; ++ } + + if (unlikely(!list_empty(&sqd->ctx_new_list))) + io_sqd_init_new(sqd); +@@ -6991,18 +7000,32 @@ static void io_file_ref_kill(struct percpu_ref *ref) + complete(&data->done); + } + ++static void io_sqe_files_set_node(struct fixed_file_data *file_data, ++ struct fixed_file_ref_node *ref_node) ++{ ++ spin_lock_bh(&file_data->lock); ++ file_data->node = ref_node; ++ list_add_tail(&ref_node->node, &file_data->ref_list); ++ spin_unlock_bh(&file_data->lock); ++ percpu_ref_get(&file_data->refs); ++} ++ + static int io_sqe_files_unregister(struct io_ring_ctx *ctx) + { + struct fixed_file_data *data = ctx->file_data; +- struct fixed_file_ref_node *ref_node = NULL; ++ struct fixed_file_ref_node *backup_node, *ref_node = NULL; + unsigned nr_tables, i; ++ int ret; + + if (!data) + return -ENXIO; ++ backup_node = alloc_fixed_file_ref_node(ctx); ++ if (!backup_node) ++ return -ENOMEM; + +- spin_lock(&data->lock); ++ spin_lock_bh(&data->lock); + ref_node = data->node; +- spin_unlock(&data->lock); ++ spin_unlock_bh(&data->lock); + if (ref_node) + percpu_ref_kill(&ref_node->refs); + +@@ -7010,7 +7033,18 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) + + /* wait for all refs nodes to complete */ + flush_delayed_work(&ctx->file_put_work); +- wait_for_completion(&data->done); ++ do { ++ ret = wait_for_completion_interruptible(&data->done); ++ if (!ret) ++ break; ++ ret = io_run_task_work_sig(); ++ if (ret < 0) { ++ percpu_ref_resurrect(&data->refs); ++ reinit_completion(&data->done); ++ io_sqe_files_set_node(data, backup_node); ++ return ret; ++ } ++ } while (1); + + __io_sqe_files_unregister(ctx); + nr_tables = DIV_ROUND_UP(ctx->nr_user_files, IORING_MAX_FILES_TABLE); +@@ -7021,6 +7055,7 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) + kfree(data); + ctx->file_data = NULL; + ctx->nr_user_files = 0; ++ destroy_fixed_file_ref_node(backup_node); + return 0; + } + +@@ -7385,7 +7420,7 @@ static void io_file_data_ref_zero(struct percpu_ref *ref) + data = ref_node->file_data; + ctx = data->ctx; + +- spin_lock(&data->lock); ++ spin_lock_bh(&data->lock); + ref_node->done = true; + + while (!list_empty(&data->ref_list)) { +@@ -7397,7 +7432,7 @@ static void io_file_data_ref_zero(struct percpu_ref *ref) + list_del(&ref_node->node); + first_add |= llist_add(&ref_node->llist, &ctx->file_put_llist); + } +- spin_unlock(&data->lock); ++ spin_unlock_bh(&data->lock); + + if (percpu_ref_is_dying(&data->refs)) + delay = 0; +@@ -7519,11 +7554,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg, + return PTR_ERR(ref_node); + } + +- file_data->node = ref_node; +- spin_lock(&file_data->lock); +- list_add_tail(&ref_node->node, &file_data->ref_list); +- spin_unlock(&file_data->lock); +- percpu_ref_get(&file_data->refs); ++ io_sqe_files_set_node(file_data, ref_node); + return ret; + out_fput: + for (i = 0; i < ctx->nr_user_files; i++) { +@@ -7679,11 +7710,7 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, + + if (needs_switch) { + percpu_ref_kill(&data->node->refs); +- spin_lock(&data->lock); +- list_add_tail(&ref_node->node, &data->ref_list); +- data->node = ref_node; +- spin_unlock(&data->lock); +- percpu_ref_get(&ctx->file_data->refs); ++ io_sqe_files_set_node(data, ref_node); + } else + destroy_fixed_file_ref_node(ref_node); + +diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h +index 778275f48a879..5a7091746f68b 100644 +--- a/fs/jffs2/jffs2_fs_sb.h ++++ b/fs/jffs2/jffs2_fs_sb.h +@@ -38,6 +38,7 @@ struct jffs2_mount_opts { + * users. This is implemented simply by means of not allowing the + * latter users to write to the file system if the amount if the + * available space is less then 'rp_size'. */ ++ bool set_rp_size; + unsigned int rp_size; + }; + +diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c +index 4fd297bdf0f3f..81ca58c10b728 100644 +--- a/fs/jffs2/super.c ++++ b/fs/jffs2/super.c +@@ -88,7 +88,7 @@ static int jffs2_show_options(struct seq_file *s, struct dentry *root) + + if (opts->override_compr) + seq_printf(s, ",compr=%s", jffs2_compr_name(opts->compr)); +- if (opts->rp_size) ++ if (opts->set_rp_size) + seq_printf(s, ",rp_size=%u", opts->rp_size / 1024); + + return 0; +@@ -202,11 +202,8 @@ static int jffs2_parse_param(struct fs_context *fc, struct fs_parameter *param) + case Opt_rp_size: + if (result.uint_32 > UINT_MAX / 1024) + return invalf(fc, "jffs2: rp_size unrepresentable"); +- opt = result.uint_32 * 1024; +- if (opt > c->mtd->size) +- return invalf(fc, "jffs2: Too large reserve pool specified, max is %llu KB", +- c->mtd->size / 1024); +- c->mount_opts.rp_size = opt; ++ c->mount_opts.rp_size = result.uint_32 * 1024; ++ c->mount_opts.set_rp_size = true; + break; + default: + return -EINVAL; +@@ -225,8 +222,10 @@ static inline void jffs2_update_mount_opts(struct fs_context *fc) + c->mount_opts.override_compr = new_c->mount_opts.override_compr; + c->mount_opts.compr = new_c->mount_opts.compr; + } +- if (new_c->mount_opts.rp_size) ++ if (new_c->mount_opts.set_rp_size) { ++ c->mount_opts.set_rp_size = new_c->mount_opts.set_rp_size; + c->mount_opts.rp_size = new_c->mount_opts.rp_size; ++ } + mutex_unlock(&c->alloc_sem); + } + +@@ -266,6 +265,10 @@ static int jffs2_fill_super(struct super_block *sb, struct fs_context *fc) + c->mtd = sb->s_mtd; + c->os_priv = sb; + ++ if (c->mount_opts.rp_size > c->mtd->size) ++ return invalf(fc, "jffs2: Too large reserve pool specified, max is %llu KB", ++ c->mtd->size / 1024); ++ + /* Initialize JFFS2 superblock locks, the further initialization will + * be done later */ + mutex_init(&c->alloc_sem); +diff --git a/fs/namespace.c b/fs/namespace.c +index cebaa3e817940..93006abe7946a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -156,10 +156,10 @@ static inline void mnt_add_count(struct mount *mnt, int n) + /* + * vfsmount lock must be held for write + */ +-unsigned int mnt_get_count(struct mount *mnt) ++int mnt_get_count(struct mount *mnt) + { + #ifdef CONFIG_SMP +- unsigned int count = 0; ++ int count = 0; + int cpu; + + for_each_possible_cpu(cpu) { +@@ -1139,6 +1139,7 @@ static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); + static void mntput_no_expire(struct mount *mnt) + { + LIST_HEAD(list); ++ int count; + + rcu_read_lock(); + if (likely(READ_ONCE(mnt->mnt_ns))) { +@@ -1162,7 +1163,9 @@ static void mntput_no_expire(struct mount *mnt) + */ + smp_mb(); + mnt_add_count(mnt, -1); +- if (mnt_get_count(mnt)) { ++ count = mnt_get_count(mnt); ++ if (count != 0) { ++ WARN_ON(count < 0); + rcu_read_unlock(); + unlock_mount_hash(); + return; +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 8432bd6b95f08..c078f88552695 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -1019,29 +1019,24 @@ static int decode_deallocate(struct xdr_stream *xdr, struct nfs42_falloc_res *re + return decode_op_hdr(xdr, OP_DEALLOCATE); + } + +-static int decode_read_plus_data(struct xdr_stream *xdr, struct nfs_pgio_res *res, +- uint32_t *eof) ++static int decode_read_plus_data(struct xdr_stream *xdr, ++ struct nfs_pgio_res *res) + { + uint32_t count, recvd; + uint64_t offset; + __be32 *p; + + p = xdr_inline_decode(xdr, 8 + 4); +- if (unlikely(!p)) +- return -EIO; ++ if (!p) ++ return 1; + + p = xdr_decode_hyper(p, &offset); + count = be32_to_cpup(p); + recvd = xdr_align_data(xdr, res->count, count); + res->count += recvd; + +- if (count > recvd) { +- dprintk("NFS: server cheating in read reply: " +- "count %u > recvd %u\n", count, recvd); +- *eof = 0; ++ if (count > recvd) + return 1; +- } +- + return 0; + } + +@@ -1052,18 +1047,16 @@ static int decode_read_plus_hole(struct xdr_stream *xdr, struct nfs_pgio_res *re + __be32 *p; + + p = xdr_inline_decode(xdr, 8 + 8); +- if (unlikely(!p)) +- return -EIO; ++ if (!p) ++ return 1; + + p = xdr_decode_hyper(p, &offset); + p = xdr_decode_hyper(p, &length); + recvd = xdr_expand_hole(xdr, res->count, length); + res->count += recvd; + +- if (recvd < length) { +- *eof = 0; ++ if (recvd < length) + return 1; +- } + return 0; + } + +@@ -1088,12 +1081,12 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res) + + for (i = 0; i < segments; i++) { + p = xdr_inline_decode(xdr, 4); +- if (unlikely(!p)) +- return -EIO; ++ if (!p) ++ goto early_out; + + type = be32_to_cpup(p++); + if (type == NFS4_CONTENT_DATA) +- status = decode_read_plus_data(xdr, res, &eof); ++ status = decode_read_plus_data(xdr, res); + else if (type == NFS4_CONTENT_HOLE) + status = decode_read_plus_hole(xdr, res, &eof); + else +@@ -1102,12 +1095,17 @@ static int decode_read_plus(struct xdr_stream *xdr, struct nfs_pgio_res *res) + if (status < 0) + return status; + if (status > 0) +- break; ++ goto early_out; + } + + out: + res->eof = eof; + return 0; ++early_out: ++ if (unlikely(!i)) ++ return -EIO; ++ res->eof = 0; ++ return 0; + } + + static int decode_seek(struct xdr_stream *xdr, struct nfs42_seek_res *res) +diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c +index 93f5c1678ec29..984cc42ee54d8 100644 +--- a/fs/nfs/nfs4super.c ++++ b/fs/nfs/nfs4super.c +@@ -67,7 +67,7 @@ static void nfs4_evict_inode(struct inode *inode) + nfs_inode_evict_delegation(inode); + /* Note that above delegreturn would trigger pnfs return-on-close */ + pnfs_return_layout(inode); +- pnfs_destroy_layout(NFS_I(inode)); ++ pnfs_destroy_layout_final(NFS_I(inode)); + /* First call standard NFS clear_inode() code */ + nfs_clear_inode(inode); + nfs4_xattr_cache_zap(inode); +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 0e50b9d45c320..07f59dc8cb2e7 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -294,6 +294,7 @@ void + pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + { + struct inode *inode; ++ unsigned long i_state; + + if (!lo) + return; +@@ -304,8 +305,12 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + if (!list_empty(&lo->plh_segs)) + WARN_ONCE(1, "NFS: BUG unfreed layout segments.\n"); + pnfs_detach_layout_hdr(lo); ++ i_state = inode->i_state; + spin_unlock(&inode->i_lock); + pnfs_free_layout_hdr(lo); ++ /* Notify pnfs_destroy_layout_final() that we're done */ ++ if (i_state & (I_FREEING | I_CLEAR)) ++ wake_up_var(lo); + } + } + +@@ -734,8 +739,7 @@ pnfs_free_lseg_list(struct list_head *free_me) + } + } + +-void +-pnfs_destroy_layout(struct nfs_inode *nfsi) ++static struct pnfs_layout_hdr *__pnfs_destroy_layout(struct nfs_inode *nfsi) + { + struct pnfs_layout_hdr *lo; + LIST_HEAD(tmp_list); +@@ -753,9 +757,34 @@ pnfs_destroy_layout(struct nfs_inode *nfsi) + pnfs_put_layout_hdr(lo); + } else + spin_unlock(&nfsi->vfs_inode.i_lock); ++ return lo; ++} ++ ++void pnfs_destroy_layout(struct nfs_inode *nfsi) ++{ ++ __pnfs_destroy_layout(nfsi); + } + EXPORT_SYMBOL_GPL(pnfs_destroy_layout); + ++static bool pnfs_layout_removed(struct nfs_inode *nfsi, ++ struct pnfs_layout_hdr *lo) ++{ ++ bool ret; ++ ++ spin_lock(&nfsi->vfs_inode.i_lock); ++ ret = nfsi->layout != lo; ++ spin_unlock(&nfsi->vfs_inode.i_lock); ++ return ret; ++} ++ ++void pnfs_destroy_layout_final(struct nfs_inode *nfsi) ++{ ++ struct pnfs_layout_hdr *lo = __pnfs_destroy_layout(nfsi); ++ ++ if (lo) ++ wait_var_event(lo, pnfs_layout_removed(nfsi, lo)); ++} ++ + static bool + pnfs_layout_add_bulk_destroy_list(struct inode *inode, + struct list_head *layout_list) +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 2661c44c62db4..78c3893918486 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -266,6 +266,7 @@ struct pnfs_layout_segment *pnfs_layout_process(struct nfs4_layoutget *lgp); + void pnfs_layoutget_free(struct nfs4_layoutget *lgp); + void pnfs_free_lseg_list(struct list_head *tmp_list); + void pnfs_destroy_layout(struct nfs_inode *); ++void pnfs_destroy_layout_final(struct nfs_inode *); + void pnfs_destroy_all_layouts(struct nfs_client *); + int pnfs_destroy_layouts_byfsid(struct nfs_client *clp, + struct nfs_fsid *fsid, +@@ -710,6 +711,10 @@ static inline void pnfs_destroy_layout(struct nfs_inode *nfsi) + { + } + ++static inline void pnfs_destroy_layout_final(struct nfs_inode *nfsi) ++{ ++} ++ + static inline struct pnfs_layout_segment * + pnfs_get_lseg(struct pnfs_layout_segment *lseg) + { +diff --git a/fs/pnode.h b/fs/pnode.h +index 49a058c73e4c7..26f74e092bd98 100644 +--- a/fs/pnode.h ++++ b/fs/pnode.h +@@ -44,7 +44,7 @@ int propagate_mount_busy(struct mount *, int); + void propagate_mount_unlock(struct mount *); + void mnt_release_group_id(struct mount *); + int get_dominating_id(struct mount *mnt, const struct path *root); +-unsigned int mnt_get_count(struct mount *mnt); ++int mnt_get_count(struct mount *mnt); + void mnt_set_mountpoint(struct mount *, struct mountpoint *, + struct mount *); + void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, +diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c +index a6f856f341dc7..c5562c871c8be 100644 +--- a/fs/quota/quota_tree.c ++++ b/fs/quota/quota_tree.c +@@ -62,7 +62,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) + + memset(buf, 0, info->dqi_usable_bs); + return sb->s_op->quota_read(sb, info->dqi_type, buf, +- info->dqi_usable_bs, blk << info->dqi_blocksize_bits); ++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits); + } + + static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) +@@ -71,7 +71,7 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) + ssize_t ret; + + ret = sb->s_op->quota_write(sb, info->dqi_type, buf, +- info->dqi_usable_bs, blk << info->dqi_blocksize_bits); ++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits); + if (ret != info->dqi_usable_bs) { + quota_error(sb, "dquota write failed"); + if (ret >= 0) +@@ -284,7 +284,7 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, + blk); + goto out_buf; + } +- dquot->dq_off = (blk << info->dqi_blocksize_bits) + ++ dquot->dq_off = ((loff_t)blk << info->dqi_blocksize_bits) + + sizeof(struct qt_disk_dqdbheader) + + i * info->dqi_entry_size; + kfree(buf); +@@ -559,7 +559,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info, + ret = -EIO; + goto out_buf; + } else { +- ret = (blk << info->dqi_blocksize_bits) + sizeof(struct ++ ret = ((loff_t)blk << info->dqi_blocksize_bits) + sizeof(struct + qt_disk_dqdbheader) + i * info->dqi_entry_size; + } + out_buf: +diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c +index 8bf88d690729e..476a7ff494822 100644 +--- a/fs/reiserfs/stree.c ++++ b/fs/reiserfs/stree.c +@@ -454,6 +454,12 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) + "(second one): %h", ih); + return 0; + } ++ if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) { ++ reiserfs_warning(NULL, "reiserfs-5093", ++ "item entry count seems wrong %h", ++ ih); ++ return 0; ++ } + prev_location = ih_location(ih); + } + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index db6ae4d3fb4ed..cd5c313729ea1 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2439,8 +2439,9 @@ extern int __meminit __early_pfn_to_nid(unsigned long pfn, + #endif + + extern void set_dma_reserve(unsigned long new_dma_reserve); +-extern void memmap_init_zone(unsigned long, int, unsigned long, unsigned long, +- enum meminit_context, struct vmem_altmap *, int migratetype); ++extern void memmap_init_zone(unsigned long, int, unsigned long, ++ unsigned long, unsigned long, enum meminit_context, ++ struct vmem_altmap *, int migratetype); + extern void setup_per_zone_wmarks(void); + extern int __meminit init_per_zone_wmark_min(void); + extern void mem_init(void); +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index 5ed721ad5b198..af2a44c08683d 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -28,4 +28,9 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) ++ ++#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) ++ + #endif /* _UAPI_LINUX_CONST_H */ +diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h +index 9ca87bc73c447..cde753bb20935 100644 +--- a/include/uapi/linux/ethtool.h ++++ b/include/uapi/linux/ethtool.h +@@ -14,7 +14,7 @@ + #ifndef _UAPI_LINUX_ETHTOOL_H + #define _UAPI_LINUX_ETHTOOL_H + +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/types.h> + #include <linux/if_ether.h> + +diff --git a/include/uapi/linux/kernel.h b/include/uapi/linux/kernel.h +index 0ff8f7477847c..fadf2db71fe8a 100644 +--- a/include/uapi/linux/kernel.h ++++ b/include/uapi/linux/kernel.h +@@ -3,13 +3,6 @@ + #define _UAPI_LINUX_KERNEL_H + + #include <linux/sysinfo.h> +- +-/* +- * 'kernel.h' contains some often-used function prototypes etc +- */ +-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) +-#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) +- +-#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) ++#include <linux/const.h> + + #endif /* _UAPI_LINUX_KERNEL_H */ +diff --git a/include/uapi/linux/lightnvm.h b/include/uapi/linux/lightnvm.h +index f9a1be7fc6962..ead2e72e5c88e 100644 +--- a/include/uapi/linux/lightnvm.h ++++ b/include/uapi/linux/lightnvm.h +@@ -21,7 +21,7 @@ + #define _UAPI_LINUX_LIGHTNVM_H + + #ifdef __KERNEL__ +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/ioctl.h> + #else /* __KERNEL__ */ + #include <stdio.h> +diff --git a/include/uapi/linux/mroute6.h b/include/uapi/linux/mroute6.h +index c36177a86516e..a1fd6173e2dbe 100644 +--- a/include/uapi/linux/mroute6.h ++++ b/include/uapi/linux/mroute6.h +@@ -2,7 +2,7 @@ + #ifndef _UAPI__LINUX_MROUTE6_H + #define _UAPI__LINUX_MROUTE6_H + +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/types.h> + #include <linux/sockios.h> + #include <linux/in6.h> /* For struct sockaddr_in6. */ +diff --git a/include/uapi/linux/netfilter/x_tables.h b/include/uapi/linux/netfilter/x_tables.h +index a8283f7dbc519..b8c6bb233ac1c 100644 +--- a/include/uapi/linux/netfilter/x_tables.h ++++ b/include/uapi/linux/netfilter/x_tables.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + #ifndef _UAPI_X_TABLES_H + #define _UAPI_X_TABLES_H +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/types.h> + + #define XT_FUNCTION_MAXNAMELEN 30 +diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h +index c3816ff7bfc32..3d94269bbfa87 100644 +--- a/include/uapi/linux/netlink.h ++++ b/include/uapi/linux/netlink.h +@@ -2,7 +2,7 @@ + #ifndef _UAPI__LINUX_NETLINK_H + #define _UAPI__LINUX_NETLINK_H + +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/socket.h> /* for __kernel_sa_family_t */ + #include <linux/types.h> + +diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h +index 27c1ed2822e69..458179df9b271 100644 +--- a/include/uapi/linux/sysctl.h ++++ b/include/uapi/linux/sysctl.h +@@ -23,7 +23,7 @@ + #ifndef _UAPI_LINUX_SYSCTL_H + #define _UAPI_LINUX_SYSCTL_H + +-#include <linux/kernel.h> ++#include <linux/const.h> + #include <linux/types.h> + #include <linux/compiler.h> + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 191c329e482ad..32596fdbcd5b8 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -908,6 +908,8 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) + opt = fs_parse(fc, cgroup1_fs_parameters, param, &result); + if (opt == -ENOPARAM) { + if (strcmp(param->key, "source") == 0) { ++ if (fc->source) ++ return invalf(fc, "Multiple sources not supported"); + fc->source = param->string; + param->string = NULL; + return 0; +diff --git a/kernel/module.c b/kernel/module.c +index a4fa44a652a75..e20499309b2af 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1895,7 +1895,6 @@ static int mod_sysfs_init(struct module *mod) + if (err) + mod_kobject_put(mod); + +- /* delay uevent until full sysfs population */ + out: + return err; + } +@@ -1932,7 +1931,6 @@ static int mod_sysfs_setup(struct module *mod, + add_sect_attrs(mod, info); + add_notes_attrs(mod, info); + +- kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); + return 0; + + out_unreg_modinfo_attrs: +@@ -3639,6 +3637,9 @@ static noinline int do_init_module(struct module *mod) + blocking_notifier_call_chain(&module_notify_list, + MODULE_STATE_LIVE, mod); + ++ /* Delay uevent until module has finished its init routine */ ++ kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); ++ + /* + * We need to finish all async code before the module init sequence + * is done. This has potential to deadlock. For example, a newly +@@ -3991,6 +3992,7 @@ static int load_module(struct load_info *info, const char __user *uargs, + MODULE_STATE_GOING, mod); + klp_module_going(mod); + bug_cleanup: ++ mod->state = MODULE_STATE_GOING; + /* module_bug_cleanup needs module_mutex protection */ + mutex_lock(&module_mutex); + module_bug_cleanup(mod); +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 81632cd5e3b72..e8d351b7f9b03 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -941,13 +941,6 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts) + */ + if (tick_do_timer_cpu == cpu) + return false; +- /* +- * Boot safety: make sure the timekeeping duty has been +- * assigned before entering dyntick-idle mode, +- * tick_do_timer_cpu is TICK_DO_TIMER_BOOT +- */ +- if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_BOOT)) +- return false; + + /* Should not happen for nohz-full */ + if (WARN_ON_ONCE(tick_do_timer_cpu == TICK_DO_TIMER_NONE)) +diff --git a/lib/zlib_dfltcc/Makefile b/lib/zlib_dfltcc/Makefile +index 8e4d5afbbb109..66e1c96387c40 100644 +--- a/lib/zlib_dfltcc/Makefile ++++ b/lib/zlib_dfltcc/Makefile +@@ -8,4 +8,4 @@ + + obj-$(CONFIG_ZLIB_DFLTCC) += zlib_dfltcc.o + +-zlib_dfltcc-objs := dfltcc.o dfltcc_deflate.o dfltcc_inflate.o dfltcc_syms.o ++zlib_dfltcc-objs := dfltcc.o dfltcc_deflate.o dfltcc_inflate.o +diff --git a/lib/zlib_dfltcc/dfltcc.c b/lib/zlib_dfltcc/dfltcc.c +index c30de430b30ca..782f76e9d4dab 100644 +--- a/lib/zlib_dfltcc/dfltcc.c ++++ b/lib/zlib_dfltcc/dfltcc.c +@@ -1,7 +1,8 @@ + // SPDX-License-Identifier: Zlib + /* dfltcc.c - SystemZ DEFLATE CONVERSION CALL support. */ + +-#include <linux/zutil.h> ++#include <linux/export.h> ++#include <linux/module.h> + #include "dfltcc_util.h" + #include "dfltcc.h" + +@@ -53,3 +54,6 @@ void dfltcc_reset( + dfltcc_state->dht_threshold = DFLTCC_DHT_MIN_SAMPLE_SIZE; + dfltcc_state->param.ribm = DFLTCC_RIBM; + } ++EXPORT_SYMBOL(dfltcc_reset); ++ ++MODULE_LICENSE("GPL"); +diff --git a/lib/zlib_dfltcc/dfltcc_deflate.c b/lib/zlib_dfltcc/dfltcc_deflate.c +index 00c185101c6d1..6c946e8532eec 100644 +--- a/lib/zlib_dfltcc/dfltcc_deflate.c ++++ b/lib/zlib_dfltcc/dfltcc_deflate.c +@@ -4,6 +4,7 @@ + #include "dfltcc_util.h" + #include "dfltcc.h" + #include <asm/setup.h> ++#include <linux/export.h> + #include <linux/zutil.h> + + /* +@@ -34,6 +35,7 @@ int dfltcc_can_deflate( + + return 1; + } ++EXPORT_SYMBOL(dfltcc_can_deflate); + + static void dfltcc_gdht( + z_streamp strm +@@ -277,3 +279,4 @@ again: + goto again; /* deflate() must use all input or all output */ + return 1; + } ++EXPORT_SYMBOL(dfltcc_deflate); +diff --git a/lib/zlib_dfltcc/dfltcc_inflate.c b/lib/zlib_dfltcc/dfltcc_inflate.c +index db107016d29b3..fb60b5a6a1cb6 100644 +--- a/lib/zlib_dfltcc/dfltcc_inflate.c ++++ b/lib/zlib_dfltcc/dfltcc_inflate.c +@@ -125,7 +125,7 @@ dfltcc_inflate_action dfltcc_inflate( + param->ho = (state->write - state->whave) & ((1 << HB_BITS) - 1); + if (param->hl) + param->nt = 0; /* Honor history for the first block */ +- param->cv = state->flags ? REVERSE(state->check) : state->check; ++ param->cv = state->check; + + /* Inflate */ + do { +@@ -138,7 +138,7 @@ dfltcc_inflate_action dfltcc_inflate( + state->bits = param->sbb; + state->whave = param->hl; + state->write = (param->ho + param->hl) & ((1 << HB_BITS) - 1); +- state->check = state->flags ? REVERSE(param->cv) : param->cv; ++ state->check = param->cv; + if (cc == DFLTCC_CC_OP2_CORRUPT && param->oesc != 0) { + /* Report an error if stream is corrupted */ + state->mode = BAD; +diff --git a/lib/zlib_dfltcc/dfltcc_syms.c b/lib/zlib_dfltcc/dfltcc_syms.c +deleted file mode 100644 +index 6f23481804c1d..0000000000000 +--- a/lib/zlib_dfltcc/dfltcc_syms.c ++++ /dev/null +@@ -1,17 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only +-/* +- * linux/lib/zlib_dfltcc/dfltcc_syms.c +- * +- * Exported symbols for the s390 zlib dfltcc support. +- * +- */ +- +-#include <linux/init.h> +-#include <linux/module.h> +-#include <linux/zlib.h> +-#include "dfltcc.h" +- +-EXPORT_SYMBOL(dfltcc_can_deflate); +-EXPORT_SYMBOL(dfltcc_deflate); +-EXPORT_SYMBOL(dfltcc_reset); +-MODULE_LICENSE("GPL"); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 3b38ea958e954..1fd11f96a707a 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4106,10 +4106,30 @@ retry_avoidcopy: + * may get SIGKILLed if it later faults. + */ + if (outside_reserve) { ++ struct address_space *mapping = vma->vm_file->f_mapping; ++ pgoff_t idx; ++ u32 hash; ++ + put_page(old_page); + BUG_ON(huge_pte_none(pte)); ++ /* ++ * Drop hugetlb_fault_mutex and i_mmap_rwsem before ++ * unmapping. unmapping needs to hold i_mmap_rwsem ++ * in write mode. Dropping i_mmap_rwsem in read mode ++ * here is OK as COW mappings do not interact with ++ * PMD sharing. ++ * ++ * Reacquire both after unmap operation. ++ */ ++ idx = vma_hugecache_offset(h, vma, haddr); ++ hash = hugetlb_fault_mutex_hash(mapping, idx); ++ mutex_unlock(&hugetlb_fault_mutex_table[hash]); ++ i_mmap_unlock_read(mapping); ++ + unmap_ref_private(mm, vma, old_page, haddr); +- BUG_ON(huge_pte_none(pte)); ++ ++ i_mmap_lock_read(mapping); ++ mutex_lock(&hugetlb_fault_mutex_table[hash]); + spin_lock(ptl); + ptep = huge_pte_offset(mm, haddr, huge_page_size(h)); + if (likely(ptep && +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 0f855deea4b2d..aa453a4331437 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -714,7 +714,7 @@ void __ref move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn, + * expects the zone spans the pfn range. All the pages in the range + * are reserved so nobody should be touching them so we should be safe + */ +- memmap_init_zone(nr_pages, nid, zone_idx(zone), start_pfn, ++ memmap_init_zone(nr_pages, nid, zone_idx(zone), start_pfn, 0, + MEMINIT_HOTPLUG, altmap, migratetype); + + set_zone_contiguous(zone); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 32f783ddb5c3a..14b9e83ff9da2 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -448,6 +448,8 @@ defer_init(int nid, unsigned long pfn, unsigned long end_pfn) + if (end_pfn < pgdat_end_pfn(NODE_DATA(nid))) + return false; + ++ if (NODE_DATA(nid)->first_deferred_pfn != ULONG_MAX) ++ return true; + /* + * We start only with one section of pages, more pages are added as + * needed until the rest of deferred pages are initialized. +@@ -6050,7 +6052,7 @@ overlap_memmap_init(unsigned long zone, unsigned long *pfn) + * zone stats (e.g., nr_isolate_pageblock) are touched. + */ + void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone, +- unsigned long start_pfn, ++ unsigned long start_pfn, unsigned long zone_end_pfn, + enum meminit_context context, + struct vmem_altmap *altmap, int migratetype) + { +@@ -6086,7 +6088,7 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone, + if (context == MEMINIT_EARLY) { + if (overlap_memmap_init(zone, &pfn)) + continue; +- if (defer_init(nid, pfn, end_pfn)) ++ if (defer_init(nid, pfn, zone_end_pfn)) + break; + } + +@@ -6200,7 +6202,7 @@ void __meminit __weak memmap_init(unsigned long size, int nid, + + if (end_pfn > start_pfn) { + size = end_pfn - start_pfn; +- memmap_init_zone(size, nid, zone, start_pfn, ++ memmap_init_zone(size, nid, zone, start_pfn, range_end_pfn, + MEMINIT_EARLY, NULL, MIGRATE_MOVABLE); + } + } +diff --git a/net/ethtool/channels.c b/net/ethtool/channels.c +index 5635604cb9ba1..25a9e566ef5cd 100644 +--- a/net/ethtool/channels.c ++++ b/net/ethtool/channels.c +@@ -194,8 +194,9 @@ int ethnl_set_channels(struct sk_buff *skb, struct genl_info *info) + if (netif_is_rxfh_configured(dev) && + !ethtool_get_max_rxfh_channel(dev, &max_rx_in_use) && + (channels.combined_count + channels.rx_count) <= max_rx_in_use) { ++ ret = -EINVAL; + GENL_SET_ERR_MSG(info, "requested channel counts are too low for existing indirection table settings"); +- return -EINVAL; ++ goto out_ops; + } + + /* Disabling channels, query zero-copy AF_XDP sockets */ +@@ -203,8 +204,9 @@ int ethnl_set_channels(struct sk_buff *skb, struct genl_info *info) + min(channels.rx_count, channels.tx_count); + for (i = from_channel; i < old_total; i++) + if (xsk_get_pool_from_qid(dev, i)) { ++ ret = -EINVAL; + GENL_SET_ERR_MSG(info, "requested channel counts are too low for existing zerocopy AF_XDP sockets"); +- return -EINVAL; ++ goto out_ops; + } + + ret = dev->ethtool_ops->set_channels(dev, &channels); +diff --git a/net/ethtool/strset.c b/net/ethtool/strset.c +index 0baad0ce18328..c3a5489964cde 100644 +--- a/net/ethtool/strset.c ++++ b/net/ethtool/strset.c +@@ -182,7 +182,7 @@ static int strset_parse_request(struct ethnl_req_info *req_base, + ret = strset_get_id(attr, &id, extack); + if (ret < 0) + return ret; +- if (ret >= ETH_SS_COUNT) { ++ if (id >= ETH_SS_COUNT) { + NL_SET_ERR_MSG_ATTR(extack, attr, + "unknown string set id"); + return -EOPNOTSUPP; +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 88f2a7a0ccb86..967ce9ccfc0da 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2081,6 +2081,8 @@ struct sock *mptcp_sk_clone(const struct sock *sk, + sock_reset_flag(nsk, SOCK_RCU_FREE); + /* will be fully established after successful MPC subflow creation */ + inet_sk_state_store(nsk, TCP_SYN_RECV); ++ ++ security_inet_csk_clone(nsk, req); + bh_unlock_sock(nsk); + + /* keep a single reference */ +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index b0ad7687ee2c8..c6653ee7f701b 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1596,6 +1596,21 @@ free_sched: + return err; + } + ++static void taprio_reset(struct Qdisc *sch) ++{ ++ struct taprio_sched *q = qdisc_priv(sch); ++ struct net_device *dev = qdisc_dev(sch); ++ int i; ++ ++ hrtimer_cancel(&q->advance_timer); ++ if (q->qdiscs) { ++ for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) ++ qdisc_reset(q->qdiscs[i]); ++ } ++ sch->qstats.backlog = 0; ++ sch->q.qlen = 0; ++} ++ + static void taprio_destroy(struct Qdisc *sch) + { + struct taprio_sched *q = qdisc_priv(sch); +@@ -1606,7 +1621,6 @@ static void taprio_destroy(struct Qdisc *sch) + list_del(&q->taprio_list); + spin_unlock(&taprio_list_lock); + +- hrtimer_cancel(&q->advance_timer); + + taprio_disable_offload(dev, q, NULL); + +@@ -1953,6 +1967,7 @@ static struct Qdisc_ops taprio_qdisc_ops __read_mostly = { + .init = taprio_init, + .change = taprio_change, + .destroy = taprio_destroy, ++ .reset = taprio_reset, + .peek = taprio_peek, + .dequeue = taprio_dequeue, + .enqueue = taprio_enqueue, +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 47b155a49226f..9f3f8e953ff04 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -755,8 +755,13 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + runtime->boundary *= 2; + + /* clear the buffer for avoiding possible kernel info leaks */ +- if (runtime->dma_area && !substream->ops->copy_user) +- memset(runtime->dma_area, 0, runtime->dma_bytes); ++ if (runtime->dma_area && !substream->ops->copy_user) { ++ size_t size = runtime->dma_bytes; ++ ++ if (runtime->info & SNDRV_PCM_INFO_MMAP) ++ size = PAGE_ALIGN(size); ++ memset(runtime->dma_area, 0, size); ++ } + + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index c78720a3299c4..257ad5206240f 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -95,11 +95,21 @@ static inline unsigned short snd_rawmidi_file_flags(struct file *file) + } + } + +-static inline int snd_rawmidi_ready(struct snd_rawmidi_substream *substream) ++static inline bool __snd_rawmidi_ready(struct snd_rawmidi_runtime *runtime) ++{ ++ return runtime->avail >= runtime->avail_min; ++} ++ ++static bool snd_rawmidi_ready(struct snd_rawmidi_substream *substream) + { + struct snd_rawmidi_runtime *runtime = substream->runtime; ++ unsigned long flags; ++ bool ready; + +- return runtime->avail >= runtime->avail_min; ++ spin_lock_irqsave(&runtime->lock, flags); ++ ready = __snd_rawmidi_ready(runtime); ++ spin_unlock_irqrestore(&runtime->lock, flags); ++ return ready; + } + + static inline int snd_rawmidi_ready_append(struct snd_rawmidi_substream *substream, +@@ -1019,7 +1029,7 @@ int snd_rawmidi_receive(struct snd_rawmidi_substream *substream, + if (result > 0) { + if (runtime->event) + schedule_work(&runtime->event_work); +- else if (snd_rawmidi_ready(substream)) ++ else if (__snd_rawmidi_ready(runtime)) + wake_up(&runtime->sleep); + } + spin_unlock_irqrestore(&runtime->lock, flags); +@@ -1098,7 +1108,7 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun + result = 0; + while (count > 0) { + spin_lock_irq(&runtime->lock); +- while (!snd_rawmidi_ready(substream)) { ++ while (!__snd_rawmidi_ready(runtime)) { + wait_queue_entry_t wait; + + if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) { +@@ -1115,9 +1125,11 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun + return -ENODEV; + if (signal_pending(current)) + return result > 0 ? result : -ERESTARTSYS; +- if (!runtime->avail) +- return result > 0 ? result : -EIO; + spin_lock_irq(&runtime->lock); ++ if (!runtime->avail) { ++ spin_unlock_irq(&runtime->lock); ++ return result > 0 ? result : -EIO; ++ } + } + spin_unlock_irq(&runtime->lock); + count1 = snd_rawmidi_kernel_read1(substream, +@@ -1255,7 +1267,7 @@ int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int coun + runtime->avail += count; + substream->bytes += count; + if (count > 0) { +- if (runtime->drain || snd_rawmidi_ready(substream)) ++ if (runtime->drain || __snd_rawmidi_ready(runtime)) + wake_up(&runtime->sleep); + } + return count; +@@ -1444,9 +1456,11 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf, + return -ENODEV; + if (signal_pending(current)) + return result > 0 ? result : -ERESTARTSYS; +- if (!runtime->avail && !timeout) +- return result > 0 ? result : -EIO; + spin_lock_irq(&runtime->lock); ++ if (!runtime->avail && !timeout) { ++ spin_unlock_irq(&runtime->lock); ++ return result > 0 ? result : -EIO; ++ } + } + spin_unlock_irq(&runtime->lock); + count1 = snd_rawmidi_kernel_write1(substream, buf, NULL, count); +@@ -1526,6 +1540,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry, + struct snd_rawmidi *rmidi; + struct snd_rawmidi_substream *substream; + struct snd_rawmidi_runtime *runtime; ++ unsigned long buffer_size, avail, xruns; + + rmidi = entry->private_data; + snd_iprintf(buffer, "%s\n\n", rmidi->name); +@@ -1544,13 +1559,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry, + " Owner PID : %d\n", + pid_vnr(substream->pid)); + runtime = substream->runtime; ++ spin_lock_irq(&runtime->lock); ++ buffer_size = runtime->buffer_size; ++ avail = runtime->avail; ++ spin_unlock_irq(&runtime->lock); + snd_iprintf(buffer, + " Mode : %s\n" + " Buffer size : %lu\n" + " Avail : %lu\n", + runtime->oss ? "OSS compatible" : "native", +- (unsigned long) runtime->buffer_size, +- (unsigned long) runtime->avail); ++ buffer_size, avail); + } + } + } +@@ -1568,13 +1586,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry, + " Owner PID : %d\n", + pid_vnr(substream->pid)); + runtime = substream->runtime; ++ spin_lock_irq(&runtime->lock); ++ buffer_size = runtime->buffer_size; ++ avail = runtime->avail; ++ xruns = runtime->xruns; ++ spin_unlock_irq(&runtime->lock); + snd_iprintf(buffer, + " Buffer size : %lu\n" + " Avail : %lu\n" + " Overruns : %lu\n", +- (unsigned long) runtime->buffer_size, +- (unsigned long) runtime->avail, +- (unsigned long) runtime->xruns); ++ buffer_size, avail, xruns); + } + } + } +diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h +index 9254c8dbe5e37..25d2d6b610079 100644 +--- a/sound/core/seq/seq_queue.h ++++ b/sound/core/seq/seq_queue.h +@@ -26,10 +26,10 @@ struct snd_seq_queue { + + struct snd_seq_timer *timer; /* time keeper for this queue */ + int owner; /* client that 'owns' the timer */ +- unsigned int locked:1, /* timer is only accesibble by owner if set */ +- klocked:1, /* kernel lock (after START) */ +- check_again:1, +- check_blocked:1; ++ bool locked; /* timer is only accesibble by owner if set */ ++ bool klocked; /* kernel lock (after START) */ ++ bool check_again; /* concurrent access happened during check */ ++ bool check_blocked; /* queue being checked */ + + unsigned int flags; /* status flags */ + unsigned int info_flags; /* info for sync */ +diff --git a/tools/include/uapi/linux/const.h b/tools/include/uapi/linux/const.h +index 5ed721ad5b198..af2a44c08683d 100644 +--- a/tools/include/uapi/linux/const.h ++++ b/tools/include/uapi/linux/const.h +@@ -28,4 +28,9 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) ++ ++#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) ++ + #endif /* _UAPI_LINUX_CONST_H */
