Merge android-4.4@a8935c9 (v4.4.87) into msm-4.4

* refs/heads/tmp-a8935c9:
  Linux 4.4.87
  crypto: algif_skcipher - only call put_page on referenced and used pages
  epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
  kvm: arm/arm64: Force reading uncached stage2 PGD
  kvm: arm/arm64: Fix race in resetting stage2 PGD
  drm/ttm: Fix accounting error when fail to get pages for pool
  xfrm: policy: check policy direction value
  wl1251: add a missing spin_lock_init()
  CIFS: remove endian related sparse warning
  CIFS: Fix maximum SMB2 header size
  alpha: uapi: Add support for __SANE_USERSPACE_TYPES__
  cpuset: Fix incorrect memory_pressure control file mapping
  cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
  ceph: fix readpage from fscache
  i2c: ismt: Return EMSGSIZE for block reads with bogus length
  i2c: ismt: Don't duplicate the receive length for block reads
  irqchip: mips-gic: SYNC after enabling GIC region
  ANDROID: cpufreq-dt: Set sane defaults for schedutil rate limits
  BACKPORT: cpufreq: schedutil: Use policy-dependent transition delays
  FROMLIST: binder: fix an ret value override
  FROMLIST: binder: fix memory corruption in binder_transaction binder
  Linux 4.4.86
  drm/i915: fix compiler warning in drivers/gpu/drm/i915/intel_uncore.c
  scsi: sg: reset 'res_in_use' after unlinking reserved array
  scsi: sg: protect accesses to 'reserved' page array
  arm64: fpsimd: Prevent registers leaking across exec
  x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl
  arm64: mm: abort uaccess retries upon fatal signal
  lpfc: Fix Device discovery failures during switch reboot test.
  p54: memset(0) whole array
  lightnvm: initialize ppa_addr in dev_to_generic_addr()
  gcov: support GCC 7.1
  gcov: add support for gcc version >= 6
  i2c: jz4780: drop superfluous init
  btrfs: remove duplicate const specifier
  ALSA: au88x0: Fix zero clear of stream->resources
  scsi: isci: avoid array subscript warning
  sched: WALT: fix window mis-alignment
  sched: EAS: kill incorrect nohz idle cpu kick
  sched: EAS: fix incorrect energy delta calculation due to rounding error
  sched: EAS/WALT: take into account of waking task's load
  cpufreq: sched: WALT: don't apply capacity margin twice
  sched: WALT: fix potential overflow
  sched: EAS: schedfreq: fix CPU util over estimation
  sched: EAS/WALT: use cr_avg instead of prev_runnable_sum
  sched: WALT: fix broken cumulative runnable average accounting
  sched: deadline: WALT: account cumulative runnable avg
  FROMLIST: android: binder: Add page usage in binder stats
  FROMLIST: android: binder: Add shrinker tracepoints
  FROMLIST: android: binder: Add global lru shrinker to binder
  FROMLIST: android: binder: Move buffer out of area shared with user space
  FROMLIST: android: binder: Add allocator selftest
  FROMLIST: android: binder: Refactor prev and next buffer into a helper function
  android: android-base.config: enable IP6_NF_MATCH_RPFILTER
  UPSTREAM: cpufreq: schedutil: Use unsigned int for iowait boost
  UPSTREAM: cpufreq: schedutil: Make iowait boost more energy efficient

Conflicts:
	drivers/cpufreq/cpufreq-dt.c
	kernel/sched/deadline.c
	kernel/sched/fair.c
	kernel/sched/sched.h

Change-Id: Iee31db3fd1a0d1650ebf3d6de307a4e4637120b4
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

6 files changed, 32 insertions, 16 deletions

diff --git a/arch/alpha/include/asm/types.h b/arch/alpha/include/asm/types.h
index 4cb4b6d3452c..0bc66e1d3a7e 100644
--- a/arch/alpha/include/asm/types.h
+++ b/arch/alpha/include/asm/types.h
@@ -1,6 +1,6 @@
 #ifndef _ALPHA_TYPES_H
 #define _ALPHA_TYPES_H
 
-#include <asm-generic/int-ll64.h>
+#include <uapi/asm/types.h>
 
 #endif /* _ALPHA_TYPES_H */
diff --git a/arch/alpha/include/uapi/asm/types.h b/arch/alpha/include/uapi/asm/types.h
index 9fd3cd459777..8d1024d7be05 100644
--- a/arch/alpha/include/uapi/asm/types.h
+++ b/arch/alpha/include/uapi/asm/types.h
@@ -9,8 +9,18 @@
  * need to be careful to avoid a name clashes.
  */
 
-#ifndef __KERNEL__
+/*
+ * This is here because we used to use l64 for alpha
+ * and we don't want to impact user mode with our change to ll64
+ * in the kernel.
+ *
+ * However, some user programs are fine with this.  They can
+ * flag __SANE_USERSPACE_TYPES__ to get int-ll64.h here.
+ */
+#if !defined(__SANE_USERSPACE_TYPES__) && !defined(__KERNEL__)
 #include <asm-generic/int-l64.h>
+#else
+#include <asm-generic/int-ll64.h>
 #endif
 
 #endif /* _UAPI_ALPHA_TYPES_H */
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 360cea172b06..4c055a63c9c6 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -831,24 +831,25 @@ void stage2_unmap_vm(struct kvm *kvm)
  * Walks the level-1 page table pointed to by kvm->arch.pgd and frees all
  * underlying level-2 and level-3 tables before freeing the actual level-1 table
  * and setting the struct pointer to NULL.
- *
- * Note we don't need locking here as this is only called when the VM is
- * destroyed, which can only be done once.
  */
 void kvm_free_stage2_pgd(struct kvm *kvm)
 {
-	if (kvm->arch.pgd == NULL)
-		return;
+	void *pgd = NULL;
+	void *hwpgd = NULL;
 
 	spin_lock(&kvm->mmu_lock);
-	unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+	if (kvm->arch.pgd) {
+		unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+		pgd = READ_ONCE(kvm->arch.pgd);
+		hwpgd = kvm_get_hwpgd(kvm);
+		kvm->arch.pgd = NULL;
+	}
 	spin_unlock(&kvm->mmu_lock);
 
-	kvm_free_hwpgd(kvm_get_hwpgd(kvm));
-	if (KVM_PREALLOC_LEVEL > 0)
-		kfree(kvm->arch.pgd);
-
-	kvm->arch.pgd = NULL;
+	if (hwpgd)
+		kvm_free_hwpgd(hwpgd);
+	if (KVM_PREALLOC_LEVEL > 0 && pgd)
+		kfree(pgd);
 }
 
 static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 790d27e3b997..7950df171d86 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -202,9 +202,11 @@ void fpsimd_thread_switch(struct task_struct *next)
 
 void fpsimd_flush_thread(void)
 {
+	preempt_disable();
 	memset(&current->thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
 	fpsimd_flush_task_state(current);
 	set_thread_flag(TIF_FOREIGN_FPSTATE);
+	preempt_enable();
 }
 
 /*
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 2720d47da366..1f9a2620c692 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -370,8 +370,11 @@ retry:
 	 * signal first. We do not need to release the mmap_sem because it
 	 * would already be released in __lock_page_or_retry in mm/filemap.c.
 	 */
-	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) {
+		if (!user_mode(regs))
+			goto no_context;
 		return 0;
+	}
 
 	/*
 	 * Major/minor page fault accounting is only done on the initial
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index de25aad07853..9016b4b70375 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -304,13 +304,13 @@ static inline unsigned type in##bwl##_p(int port)			\
 static inline void outs##bwl(int port, const void *addr, unsigned long count) \
 {									\
 	asm volatile("rep; outs" #bwl					\
-		     : "+S"(addr), "+c"(count) : "d"(port));		\
+		     : "+S"(addr), "+c"(count) : "d"(port) : "memory");	\
 }									\
 									\
 static inline void ins##bwl(int port, void *addr, unsigned long count)	\
 {									\
 	asm volatile("rep; ins" #bwl					\
-		     : "+D"(addr), "+c"(count) : "d"(port));		\
+		     : "+D"(addr), "+c"(count) : "d"(port) : "memory");	\
 }
 
 BUILDIO(b, b, char)