12 files changed, 80 insertions, 16 deletions

diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 1e1a03d2d19f..e9f312532526 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -135,7 +135,6 @@ config S390
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_UID16 if 32BIT
         select HAVE_VIRT_CPU_ACCOUNTING
-        select INIT_ALL_POSSIBLE
         select KTIME_SCALAR if 32BIT
         select MODULES_USE_ELF_RELA
         select OLD_SIGACTION
diff --git a/arch/s390/include/asm/smp.h b/arch/s390/include/asm/smp.h
index ac9bed8e103f..160779394096 100644
--- a/arch/s390/include/asm/smp.h
+++ b/arch/s390/include/asm/smp.h
@@ -31,6 +31,7 @@ extern void smp_yield(void);
 extern void smp_stop_cpu(void);
 extern void smp_cpu_set_polarization(int cpu, int val);
 extern int smp_cpu_get_polarization(int cpu);
+extern void smp_fill_possible_mask(void);
 
 #else /* CONFIG_SMP */
 
@@ -50,6 +51,7 @@ static inline int smp_vcpu_scheduled(int cpu) { return 1; }
 static inline void smp_yield_cpu(int cpu) { }
 static inline void smp_yield(void) { }
 static inline void smp_stop_cpu(void) { }
+static inline void smp_fill_possible_mask(void) { }
 
 #endif /* CONFIG_SMP */
 
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 4444875266ee..0f3d44ecbfc6 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -1023,6 +1023,7 @@ void __init setup_arch(char **cmdline_p)
         setup_vmcoreinfo();
         setup_lowcore();
 
+        smp_fill_possible_mask();
         cpu_init();
         s390_init_cpu_topology();
 
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index dc4a53465060..958704798f4a 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -721,18 +721,14 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
         return 0;
 }
 
-static int __init setup_possible_cpus(char *s)
-{
-        int max, cpu;
+static unsigned int setup_possible_cpus __initdata;
 
-        if (kstrtoint(s, 0, &max) < 0)
-                return 0;
-        init_cpu_possible(cpumask_of(0));
-        for (cpu = 1; cpu < max && cpu < nr_cpu_ids; cpu++)
-                set_cpu_possible(cpu, true);
+static int __init _setup_possible_cpus(char *s)
+{
+        get_option(&s, &setup_possible_cpus);
         return 0;
 }
-early_param("possible_cpus", setup_possible_cpus);
+early_param("possible_cpus", _setup_possible_cpus);
 
 #ifdef CONFIG_HOTPLUG_CPU
 
@@ -775,6 +771,17 @@ void __noreturn cpu_die(void)
 
 #endif /* CONFIG_HOTPLUG_CPU */
 
+void __init smp_fill_possible_mask(void)
+{
+        unsigned int possible, cpu;
+
+        possible = setup_possible_cpus;
+        if (!possible)
+                possible = MACHINE_IS_VM ? 64 : nr_cpu_ids;
+        for (cpu = 0; cpu < possible && cpu < nr_cpu_ids; cpu++)
+                set_cpu_possible(cpu, true);
+}
+
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         /* request the 0x1201 emergency signal external interrupt */
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index 800f064b0da7..069607209a30 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -75,6 +75,7 @@ void zpci_event_availability(void *data)
                 if (!zdev || zdev->state == ZPCI_FN_STATE_CONFIGURED)
                         break;
                 zdev->state = ZPCI_FN_STATE_CONFIGURED;
+                zdev->fh = ccdf->fh;
                 ret = zpci_enable_device(zdev);
                 if (ret)
                         break;
@@ -101,6 +102,7 @@ void zpci_event_availability(void *data)
                 if (pdev)
                         pci_stop_and_remove_bus_device(pdev);
 
+                zdev->fh = ccdf->fh;
                 zpci_disable_device(zdev);
                 zdev->state = ZPCI_FN_STATE_STANDBY;
                 break;
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 3f4ca4e09a4c..34629ea913d4 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                 return rc;
         }
 
-        tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
+        tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
         if (IS_ERR(tp->screen)) {
                 rc = PTR_ERR(tp->screen);
                 raw3270_put_view(&tp->view);
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index b7fc035a6943..73f3e4ee4037 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -986,6 +986,7 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
 {
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_mapping->host;
+        struct address_space *mapping = inode->i_mapping;
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_holder gh;
         int rv;
@@ -1006,6 +1007,35 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
         if (rv != 1)
                 goto out; /* dio not valid, fall back to buffered i/o */
 
+        /*
+         * Now since we are holding a deferred (CW) lock at this point, you
+         * might be wondering why this is ever needed. There is a case however
+         * where we've granted a deferred local lock against a cached exclusive
+         * glock. That is ok provided all granted local locks are deferred, but
+         * it also means that it is possible to encounter pages which are
+         * cached and possibly also mapped. So here we check for that and sort
+         * them out ahead of the dio. The glock state machine will take care of
+         * everything else.
+         *
+         * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
+         * the first place, mapping->nr_pages will always be zero.
+         */
+        if (mapping->nrpages) {
+                loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
+                loff_t len = iov_length(iov, nr_segs);
+                loff_t end = PAGE_ALIGN(offset + len) - 1;
+
+                rv = 0;
+                if (len == 0)
+                        goto out;
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
+                rv = filemap_write_and_wait_range(mapping, lstart, end);
+                if (rv)
+                        return rv;
+                truncate_inode_pages_range(mapping, lstart, end);
+        }
+
         rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                   offset, nr_segs, gfs2_get_block_direct,
                                   NULL, NULL, 0);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index c8420f7e4db6..6f7a47c05259 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1655,6 +1655,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
         struct task_struct *gh_owner = NULL;
         char flags_buf[32];
 
+        rcu_read_lock();
         if (gh->gh_owner_pid)
                 gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);
         gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",
@@ -1664,6 +1665,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
                        gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,
                        gh_owner ? gh_owner->comm : "(ended)",
                        (void *)gh->gh_ip);
+        rcu_read_unlock();
         return 0;
 }
 
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index db908f697139..f88dcd925010 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -192,8 +192,11 @@ static void inode_go_sync(struct gfs2_glock *gl)
 
         if (ip && !S_ISREG(ip->i_inode.i_mode))
                 ip = NULL;
-        if (ip && test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
-                unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+        if (ip) {
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+                inode_dio_wait(&ip->i_inode);
+        }
         if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
                 return;
 
@@ -410,6 +413,9 @@ static int inode_go_lock(struct gfs2_holder *gh)
                         return error;
         }
 
+        if (gh->gh_state != LM_ST_DEFERRED)
+                inode_dio_wait(&ip->i_inode);
+
         if ((ip->i_diskflags & GFS2_DIF_TRUNC_IN_PROG) &&
             (gl->gl_state == LM_ST_EXCLUSIVE) &&
             (gh->gh_state == LM_ST_EXCLUSIVE)) {
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 610613fb65b5..9dcb9777a5f8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
         struct buffer_head *bh = bd->bd_bh;
         struct gfs2_glock *gl = bd->bd_gl;
 
-        gfs2_remove_from_ail(bd);
-        bd->bd_bh = NULL;
         bh->b_private = NULL;
         bd->bd_blkno = bh->b_blocknr;
+        gfs2_remove_from_ail(bd); /* drops ref on bh */
+        bd->bd_bh = NULL;
         bd->bd_ops = &gfs2_revoke_lops;
         sdp->sd_log_num_revoke++;
         atomic_inc(&gl->gl_revokes);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 932415050540..52f177be3bf8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
         struct address_space *mapping = bh->b_page->mapping;
         struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct gfs2_bufdata *bd = bh->b_private;
+        int was_pinned = 0;
 
         if (test_clear_buffer_pinned(bh)) {
                 trace_gfs2_pin(bd, 0);
@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
                         tr->tr_num_databuf_rm++;
                 }
                 tr->tr_touched = 1;
+                was_pinned = 1;
                 brelse(bh);
         }
         if (bd) {
                 spin_lock(&sdp->sd_ail_lock);
                 if (bd->bd_tr) {
                         gfs2_trans_add_revoke(sdp, bd);
+                } else if (was_pinned) {
+                        bh->b_private = NULL;
+                        kmem_cache_free(gfs2_bufdata_cachep, bd);
                 }
                 spin_unlock(&sdp->sd_ail_lock);
         }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 82303b474958..52fa88314f5c 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct file_system_type *fs_type, int flags,
         if (IS_ERR(s))
                 goto error_bdev;
 
-        if (s->s_root)
+        if (s->s_root) {
+                /*
+                 * s_umount nests inside bd_mutex during
+                 * __invalidate_device().  blkdev_put() acquires
+                 * bd_mutex and can't be called under s_umount.  Drop
+                 * s_umount temporarily.  This is safe as we're
+                 * holding an active reference.
+                 */
+                up_write(&s->s_umount);
                 blkdev_put(bdev, mode);
+                down_write(&s->s_umount);
+        }
 
         memset(&args, 0, sizeof(args));
         args.ar_quota = GFS2_QUOTA_DEFAULT;