From 7efbb7681ea796c74da646b1f1b832525acca926 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Fri, 23 Jun 2017 18:22:49 +0200 Subject: [PATCH] Rockchip default upstream patches --- config/kernel/linux-rockchip-default.config | 4 +- .../rockchip-default/03-patch-4.4.71-72.patch | 3348 +++++++++++++++++ .../rockchip-default/03-patch-4.4.72-73.patch | 2192 +++++++++++ 3 files changed, 5541 insertions(+), 3 deletions(-) create mode 100644 patch/kernel/rockchip-default/03-patch-4.4.71-72.patch create mode 100644 patch/kernel/rockchip-default/03-patch-4.4.72-73.patch diff --git a/config/kernel/linux-rockchip-default.config b/config/kernel/linux-rockchip-default.config index fad3a39851..a33307f08e 100644 --- a/config/kernel/linux-rockchip-default.config +++ b/config/kernel/linux-rockchip-default.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 4.4.67 Kernel Configuration +# Linux/arm 4.4.73 Kernel Configuration # CONFIG_ARM=y CONFIG_ARM_HAS_SG_CHAIN=y @@ -2786,8 +2786,6 @@ CONFIG_ROCK_CHIP_SOC_CAMERA=m # rockchip camera sensor interface driver # # CONFIG_ROCKCHIP_CAMERA_SENSOR_INTERFACE is not set -# CONFIG_RK30_CAMERA_ONEFRAME is not set -# CONFIG_RK30_CAMERA_PINGPONG is not set # # Graphics support diff --git a/patch/kernel/rockchip-default/03-patch-4.4.71-72.patch b/patch/kernel/rockchip-default/03-patch-4.4.71-72.patch new file mode 100644 index 0000000000..db3b356adf --- /dev/null +++ b/patch/kernel/rockchip-default/03-patch-4.4.71-72.patch @@ -0,0 +1,3348 @@ +diff --git a/Makefile b/Makefile +index ad91a79aed51..94d663c935c0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 71 ++SUBLEVEL = 72 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S +index 3988e72d16ff..bfc5aae0c280 100644 +--- a/arch/arm/kvm/init.S ++++ b/arch/arm/kvm/init.S +@@ -110,7 +110,6 @@ __do_hyp_init: + @ - Write permission implies XN: disabled + @ - Instruction cache: enabled + @ - Data/Unified cache: enabled +- @ - Memory alignment checks: enabled + @ - MMU: enabled (this code must be run from an identity mapping) + mrc p15, 4, r0, c1, c0, 0 @ HSCR + ldr r2, =HSCTLR_MASK +@@ -118,8 +117,8 @@ __do_hyp_init: + mrc p15, 0, r1, c1, c0, 0 @ SCTLR + ldr r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C) + and r1, r1, r2 +- ARM( ldr r2, =(HSCTLR_M | HSCTLR_A) ) +- THUMB( ldr r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE) ) ++ ARM( ldr r2, =(HSCTLR_M) ) ++ THUMB( ldr r2, =(HSCTLR_M | HSCTLR_TE) ) + orr r1, r1, r2 + orr r0, r0, r1 + isb +diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c +index 01cf10556081..1f1ff7e7b9cf 100644 +--- a/arch/arm/kvm/mmu.c ++++ b/arch/arm/kvm/mmu.c +@@ -869,6 +869,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache + pmd_t *pmd; + + pud = stage2_get_pud(kvm, cache, addr); ++ if (!pud) ++ return NULL; ++ + if (pud_none(*pud)) { + if (!cache) + return NULL; +diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h +new file mode 100644 +index 000000000000..be2d2347d995 +--- /dev/null ++++ b/arch/arm64/include/asm/asm-uaccess.h +@@ -0,0 +1,13 @@ ++#ifndef __ASM_ASM_UACCESS_H ++#define __ASM_ASM_UACCESS_H ++ ++/* ++ * Remove the address tag from a virtual address, if present. ++ */ ++ .macro clear_address_tag, dst, addr ++ tst \addr, #(1 << 55) ++ bic \dst, \addr, #(0xff << 56) ++ csel \dst, \dst, \addr, eq ++ .endm ++ ++#endif +diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h +index 9622eb48f894..f2d2c0bbe21b 100644 +--- a/arch/arm64/include/asm/barrier.h ++++ b/arch/arm64/include/asm/barrier.h +@@ -41,23 +41,33 @@ + + #define smp_store_release(p, v) \ + do { \ ++ union { typeof(*p) __val; char __c[1]; } __u = \ ++ { .__val = (__force typeof(*p)) (v) }; \ + compiletime_assert_atomic_type(*p); \ + switch (sizeof(*p)) { \ + case 1: \ + asm volatile ("stlrb %w1, %0" \ +- : "=Q" (*p) : "r" (v) : "memory"); \ ++ : "=Q" (*p) \ ++ : "r" (*(__u8 *)__u.__c) \ ++ : "memory"); \ + break; \ + case 2: \ + asm volatile ("stlrh %w1, %0" \ +- : "=Q" (*p) : "r" (v) : "memory"); \ ++ : "=Q" (*p) \ ++ : "r" (*(__u16 *)__u.__c) \ ++ : "memory"); \ + break; \ + case 4: \ + asm volatile ("stlr %w1, %0" \ +- : "=Q" (*p) : "r" (v) : "memory"); \ ++ : "=Q" (*p) \ ++ : "r" (*(__u32 *)__u.__c) \ ++ : "memory"); \ + break; \ + case 8: \ + asm volatile ("stlr %1, %0" \ +- : "=Q" (*p) : "r" (v) : "memory"); \ ++ : "=Q" (*p) \ ++ : "r" (*(__u64 *)__u.__c) \ ++ : "memory"); \ + break; \ + } \ + } while (0) +diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h +index d9ca1f2c0ea8..829fa6d3e561 100644 +--- a/arch/arm64/include/asm/uaccess.h ++++ b/arch/arm64/include/asm/uaccess.h +@@ -21,6 +21,7 @@ + /* + * User space memory access functions + */ ++#include + #include + #include + +@@ -103,6 +104,13 @@ static inline void set_fs(mm_segment_t fs) + flag; \ + }) + ++/* ++ * When dealing with data aborts, watchpoints, or instruction traps we may end ++ * up with a tagged userland pointer. Clear the tag to get a sane pointer to ++ * pass on to access_ok(), for instance. ++ */ ++#define untagged_addr(addr) sign_extend64(addr, 55) ++ + #define access_ok(type, addr, size) __range_ok(addr, size) + #define user_addr_max get_fs + +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index 937f5e58a4d3..478a00b9732b 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -305,7 +305,8 @@ static void register_insn_emulation_sysctl(struct ctl_table *table) + ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \ + CONFIG_ARM64_PAN) \ + : "=&r" (res), "+r" (data), "=&r" (temp) \ +- : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \ ++ : "r" ((unsigned long)addr), "i" (-EAGAIN), \ ++ "i" (-EFAULT) \ + : "memory") + + #define __user_swp_asm(data, addr, res, temp) \ +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index bd14849beb73..dccd0c2e9023 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -316,12 +317,13 @@ el1_da: + /* + * Data abort handling + */ +- mrs x0, far_el1 ++ mrs x3, far_el1 + enable_dbg + // re-enable interrupts if they were enabled in the aborted context + tbnz x23, #7, 1f // PSR_I_BIT + enable_irq + 1: ++ clear_address_tag x0, x3 + mov x2, sp // struct pt_regs + bl do_mem_abort + +@@ -483,7 +485,7 @@ el0_da: + // enable interrupts before calling the main handler + enable_dbg_and_irq + ct_user_exit +- bic x0, x26, #(0xff << 56) ++ clear_address_tag x0, x26 + mov x1, x25 + mov x2, sp + bl do_mem_abort +diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c +index b45c95d34b83..eeebfc315526 100644 +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + /* Breakpoint currently in use for each BRP. */ + static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]); +@@ -690,7 +691,7 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr, + + /* Check if the watchpoint value matches. */ + val = read_wb_reg(AARCH64_DBG_REG_WVR, i); +- if (val != (addr & ~alignment_mask)) ++ if (val != (untagged_addr(addr) & ~alignment_mask)) + goto unlock; + + /* Possible match, check the byte address select to confirm. */ +diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h +index 8b3b46b7b0f2..329771559cbb 100644 +--- a/arch/powerpc/include/asm/topology.h ++++ b/arch/powerpc/include/asm/topology.h +@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void); + extern int sysfs_add_device_to_node(struct device *dev, int nid); + extern void sysfs_remove_device_from_node(struct device *dev, int nid); + ++static inline int early_cpu_to_node(int cpu) ++{ ++ int nid; ++ ++ nid = numa_cpu_lookup_table[cpu]; ++ ++ /* ++ * Fall back to node 0 if nid is unset (it should be, except bugs). ++ * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)). ++ */ ++ return (nid < 0) ? 0 : nid; ++} + #else + ++static inline int early_cpu_to_node(int cpu) { return 0; } ++ + static inline void dump_numa_cpu_topology(void) {} + + static inline int sysfs_add_device_to_node(struct device *dev, int nid) +diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c +index c314db8b798c..9837c98caabe 100644 +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -655,7 +655,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus) + */ + #define MAX_WAIT_FOR_RECOVERY 300 + +-static void eeh_handle_normal_event(struct eeh_pe *pe) ++static bool eeh_handle_normal_event(struct eeh_pe *pe) + { + struct pci_bus *frozen_bus; + int rc = 0; +@@ -665,7 +665,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) + if (!frozen_bus) { + pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n", + __func__, pe->phb->global_number, pe->addr); +- return; ++ return false; + } + + eeh_pe_update_time_stamp(pe); +@@ -790,7 +790,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) + pr_info("EEH: Notify device driver to resume\n"); + eeh_pe_dev_traverse(pe, eeh_report_resume, NULL); + +- return; ++ return false; + + excess_failures: + /* +@@ -831,7 +831,11 @@ perm_error: + pci_lock_rescan_remove(); + pcibios_remove_pci_devices(frozen_bus); + pci_unlock_rescan_remove(); ++ ++ /* The passed PE should no longer be used */ ++ return true; + } ++ return false; + } + + static void eeh_handle_special_event(void) +@@ -897,7 +901,14 @@ static void eeh_handle_special_event(void) + */ + if (rc == EEH_NEXT_ERR_FROZEN_PE || + rc == EEH_NEXT_ERR_FENCED_PHB) { +- eeh_handle_normal_event(pe); ++ /* ++ * eeh_handle_normal_event() can make the PE stale if it ++ * determines that the PE cannot possibly be recovered. ++ * Don't modify the PE state if that's the case. ++ */ ++ if (eeh_handle_normal_event(pe)) ++ continue; ++ + eeh_pe_state_clear(pe, EEH_PE_RECOVERING); + } else { + pci_lock_rescan_remove(); +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index a20823210ac0..fe6e800c1357 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -751,7 +751,7 @@ void __init setup_arch(char **cmdline_p) + + static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align) + { +- return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align, ++ return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align, + __pa(MAX_DMA_ADDRESS)); + } + +@@ -762,7 +762,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size) + + static int pcpu_cpu_distance(unsigned int from, unsigned int to) + { +- if (cpu_to_node(from) == cpu_to_node(to)) ++ if (early_cpu_to_node(from) == early_cpu_to_node(to)) + return LOCAL_DISTANCE; + else + return REMOTE_DISTANCE; +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index e9ff44cd5d86..e8b1027e1b5b 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -110,6 +110,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn) + for (i = 0; i < num_lmbs; i++) { + lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr); + lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index); ++ lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index); + lmbs[i].flags = be32_to_cpu(lmbs[i].flags); + } + +@@ -553,6 +554,7 @@ static void dlpar_update_drconf_property(struct device_node *dn, + for (i = 0; i < num_lmbs; i++) { + lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr); + lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index); ++ lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index); + lmbs[i].flags = cpu_to_be32(lmbs[i].flags); + } + +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index 56442d2d7bbc..eb9487470141 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -182,9 +182,9 @@ config NR_CPUS + int "Maximum number of CPUs" + depends on SMP + range 2 32 if SPARC32 +- range 2 1024 if SPARC64 ++ range 2 4096 if SPARC64 + default 32 if SPARC32 +- default 64 if SPARC64 ++ default 4096 if SPARC64 + + source kernel/Kconfig.hz + +diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h +index f7de0dbc38af..83b36a5371ff 100644 +--- a/arch/sparc/include/asm/mmu_64.h ++++ b/arch/sparc/include/asm/mmu_64.h +@@ -52,7 +52,7 @@ + #define CTX_NR_MASK TAG_CONTEXT_BITS + #define CTX_HW_MASK (CTX_NR_MASK | CTX_PGSZ_MASK) + +-#define CTX_FIRST_VERSION ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL)) ++#define CTX_FIRST_VERSION BIT(CTX_VERSION_SHIFT) + #define CTX_VALID(__ctx) \ + (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK)) + #define CTX_HWBITS(__ctx) ((__ctx.sparc64_ctx_val) & CTX_HW_MASK) +diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h +index b84be675e507..349dd23e2876 100644 +--- a/arch/sparc/include/asm/mmu_context_64.h ++++ b/arch/sparc/include/asm/mmu_context_64.h +@@ -17,13 +17,8 @@ extern spinlock_t ctx_alloc_lock; + extern unsigned long tlb_context_cache; + extern unsigned long mmu_context_bmap[]; + ++DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm); + void get_new_mmu_context(struct mm_struct *mm); +-#ifdef CONFIG_SMP +-void smp_new_mmu_context_version(void); +-#else +-#define smp_new_mmu_context_version() do { } while (0) +-#endif +- + int init_new_context(struct task_struct *tsk, struct mm_struct *mm); + void destroy_context(struct mm_struct *mm); + +@@ -74,8 +69,9 @@ void __flush_tlb_mm(unsigned long, unsigned long); + static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk) + { + unsigned long ctx_valid, flags; +- int cpu; ++ int cpu = smp_processor_id(); + ++ per_cpu(per_cpu_secondary_mm, cpu) = mm; + if (unlikely(mm == &init_mm)) + return; + +@@ -121,7 +117,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str + * for the first time, we must flush that context out of the + * local TLB. + */ +- cpu = smp_processor_id(); + if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) { + cpumask_set_cpu(cpu, mm_cpumask(mm)); + __flush_tlb_mm(CTX_HWBITS(mm->context), +@@ -131,26 +126,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str + } + + #define deactivate_mm(tsk,mm) do { } while (0) +- +-/* Activate a new MM instance for the current task. */ +-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm) +-{ +- unsigned long flags; +- int cpu; +- +- spin_lock_irqsave(&mm->context.lock, flags); +- if (!CTX_VALID(mm->context)) +- get_new_mmu_context(mm); +- cpu = smp_processor_id(); +- if (!cpumask_test_cpu(cpu, mm_cpumask(mm))) +- cpumask_set_cpu(cpu, mm_cpumask(mm)); +- +- load_secondary_context(mm); +- __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT); +- tsb_context_switch(mm); +- spin_unlock_irqrestore(&mm->context.lock, flags); +-} +- ++#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL) + #endif /* !(__ASSEMBLY__) */ + + #endif /* !(__SPARC64_MMU_CONTEXT_H) */ +diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h +index 266937030546..522b43db2ed3 100644 +--- a/arch/sparc/include/asm/pil.h ++++ b/arch/sparc/include/asm/pil.h +@@ -20,7 +20,6 @@ + #define PIL_SMP_CALL_FUNC 1 + #define PIL_SMP_RECEIVE_SIGNAL 2 + #define PIL_SMP_CAPTURE 3 +-#define PIL_SMP_CTX_NEW_VERSION 4 + #define PIL_DEVICE_IRQ 5 + #define PIL_SMP_CALL_FUNC_SNGL 6 + #define PIL_DEFERRED_PCR_WORK 7 +diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h +index 8174f6cdbbbb..9dca7a892978 100644 +--- a/arch/sparc/include/asm/vio.h ++++ b/arch/sparc/include/asm/vio.h +@@ -327,6 +327,7 @@ struct vio_dev { + int compat_len; + + u64 dev_no; ++ u64 id; + + unsigned long channel_id; + +diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c +index e22416ce56ea..bfbde8c4ffb2 100644 +--- a/arch/sparc/kernel/irq_64.c ++++ b/arch/sparc/kernel/irq_64.c +@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb) + { + #ifdef CONFIG_SMP + unsigned long page; ++ void *mondo, *p; + +- BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64)); ++ BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE); ++ ++ /* Make sure mondo block is 64byte aligned */ ++ p = kzalloc(127, GFP_KERNEL); ++ if (!p) { ++ prom_printf("SUN4V: Error, cannot allocate mondo block.\n"); ++ prom_halt(); ++ } ++ mondo = (void *)(((unsigned long)p + 63) & ~0x3f); ++ tb->cpu_mondo_block_pa = __pa(mondo); + + page = get_zeroed_page(GFP_KERNEL); + if (!page) { +- prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n"); ++ prom_printf("SUN4V: Error, cannot allocate cpu list page.\n"); + prom_halt(); + } + +- tb->cpu_mondo_block_pa = __pa(page); +- tb->cpu_list_pa = __pa(page + 64); ++ tb->cpu_list_pa = __pa(page); + #endif + } + +diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h +index e7f652be9e61..44f32dd4477f 100644 +--- a/arch/sparc/kernel/kernel.h ++++ b/arch/sparc/kernel/kernel.h +@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr + /* smp_64.c */ + void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs); + void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs); +-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs); + void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs); + void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs); + +diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c +index 19cd08d18672..95a9fa0d2195 100644 +--- a/arch/sparc/kernel/smp_64.c ++++ b/arch/sparc/kernel/smp_64.c +@@ -959,37 +959,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) + preempt_enable(); + } + +-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs) +-{ +- struct mm_struct *mm; +- unsigned long flags; +- +- clear_softint(1 << irq); +- +- /* See if we need to allocate a new TLB context because +- * the version of the one we are using is now out of date. +- */ +- mm = current->active_mm; +- if (unlikely(!mm || (mm == &init_mm))) +- return; +- +- spin_lock_irqsave(&mm->context.lock, flags); +- +- if (unlikely(!CTX_VALID(mm->context))) +- get_new_mmu_context(mm); +- +- spin_unlock_irqrestore(&mm->context.lock, flags); +- +- load_secondary_context(mm); +- __flush_tlb_mm(CTX_HWBITS(mm->context), +- SECONDARY_CONTEXT); +-} +- +-void smp_new_mmu_context_version(void) +-{ +- smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0); +-} +- + #ifdef CONFIG_KGDB + void kgdb_roundup_cpus(unsigned long flags) + { +diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S +index d568c8207af7..395ec1800530 100644 +--- a/arch/sparc/kernel/tsb.S ++++ b/arch/sparc/kernel/tsb.S +@@ -470,13 +470,16 @@ __tsb_context_switch: + .type copy_tsb,#function + copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size + * %o2=new_tsb_base, %o3=new_tsb_size ++ * %o4=page_size_shift + */ + sethi %uhi(TSB_PASS_BITS), %g7 + srlx %o3, 4, %o3 +- add %o0, %o1, %g1 /* end of old tsb */ ++ add %o0, %o1, %o1 /* end of old tsb */ + sllx %g7, 32, %g7 + sub %o3, 1, %o3 /* %o3 == new tsb hash mask */ + ++ mov %o4, %g1 /* page_size_shift */ ++ + 661: prefetcha [%o0] ASI_N, #one_read + .section .tsb_phys_patch, "ax" + .word 661b +@@ -501,9 +504,9 @@ copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size + /* This can definitely be computed faster... */ + srlx %o0, 4, %o5 /* Build index */ + and %o5, 511, %o5 /* Mask index */ +- sllx %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */ ++ sllx %o5, %g1, %o5 /* Put into vaddr position */ + or %o4, %o5, %o4 /* Full VADDR. */ +- srlx %o4, PAGE_SHIFT, %o4 /* Shift down to create index */ ++ srlx %o4, %g1, %o4 /* Shift down to create index */ + and %o4, %o3, %o4 /* Mask with new_tsb_nents-1 */ + sllx %o4, 4, %o4 /* Shift back up into tsb ent offset */ + TSB_STORE(%o2 + %o4, %g2) /* Store TAG */ +@@ -511,7 +514,7 @@ copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size + TSB_STORE(%o2 + %o4, %g3) /* Store TTE */ + + 80: add %o0, 16, %o0 +- cmp %o0, %g1 ++ cmp %o0, %o1 + bne,pt %xcc, 90b + nop + +diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S +index c6dfdaa29e20..170ead662f2a 100644 +--- a/arch/sparc/kernel/ttable_64.S ++++ b/arch/sparc/kernel/ttable_64.S +@@ -50,7 +50,7 @@ tl0_resv03e: BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40) + tl0_irq1: TRAP_IRQ(smp_call_function_client, 1) + tl0_irq2: TRAP_IRQ(smp_receive_signal_client, 2) + tl0_irq3: TRAP_IRQ(smp_penguin_jailcell, 3) +-tl0_irq4: TRAP_IRQ(smp_new_mmu_context_version_client, 4) ++tl0_irq4: BTRAP(0x44) + #else + tl0_irq1: BTRAP(0x41) + tl0_irq2: BTRAP(0x42) +diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c +index cb5789c9f961..34824ca396f0 100644 +--- a/arch/sparc/kernel/vio.c ++++ b/arch/sparc/kernel/vio.c +@@ -284,13 +284,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp, + if (!id) { + dev_set_name(&vdev->dev, "%s", bus_id_name); + vdev->dev_no = ~(u64)0; ++ vdev->id = ~(u64)0; + } else if (!cfg_handle) { + dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id); + vdev->dev_no = *id; ++ vdev->id = ~(u64)0; + } else { + dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name, + *cfg_handle, *id); + vdev->dev_no = *cfg_handle; ++ vdev->id = *id; + } + + vdev->dev.parent = parent; +@@ -333,27 +336,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node) + (void) vio_create_one(hp, node, &root_vdev->dev); + } + ++struct vio_md_node_query { ++ const char *type; ++ u64 dev_no; ++ u64 id; ++}; ++ + static int vio_md_node_match(struct device *dev, void *arg) + { ++ struct vio_md_node_query *query = (struct vio_md_node_query *) arg; + struct vio_dev *vdev = to_vio_dev(dev); + +- if (vdev->mp == (u64) arg) +- return 1; ++ if (vdev->dev_no != query->dev_no) ++ return 0; ++ if (vdev->id != query->id) ++ return 0; ++ if (strcmp(vdev->type, query->type)) ++ return 0; + +- return 0; ++ return 1; + } + + static void vio_remove(struct mdesc_handle *hp, u64 node) + { ++ const char *type; ++ const u64 *id, *cfg_handle; ++ u64 a; ++ struct vio_md_node_query query; + struct device *dev; + +- dev = device_find_child(&root_vdev->dev, (void *) node, ++ type = mdesc_get_property(hp, node, "device-type", NULL); ++ if (!type) { ++ type = mdesc_get_property(hp, node, "name", NULL); ++ if (!type) ++ type = mdesc_node_name(hp, node); ++ } ++ ++ query.type = type; ++ ++ id = mdesc_get_property(hp, node, "id", NULL); ++ cfg_handle = NULL; ++ mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) { ++ u64 target; ++ ++ target = mdesc_arc_target(hp, a); ++ cfg_handle = mdesc_get_property(hp, target, ++ "cfg-handle", NULL); ++ if (cfg_handle) ++ break; ++ } ++ ++ if (!id) { ++ query.dev_no = ~(u64)0; ++ query.id = ~(u64)0; ++ } else if (!cfg_handle) { ++ query.dev_no = *id; ++ query.id = ~(u64)0; ++ } else { ++ query.dev_no = *cfg_handle; ++ query.id = *id; ++ } ++ ++ dev = device_find_child(&root_vdev->dev, &query, + vio_md_node_match); + if (dev) { + printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev)); + + device_unregister(dev); + put_device(dev); ++ } else { ++ if (!id) ++ printk(KERN_ERR "VIO: Removed unknown %s node.\n", ++ type); ++ else if (!cfg_handle) ++ printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n", ++ type, *id); ++ else ++ printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n", ++ type, *cfg_handle, *id); + } + } + +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index 965655afdbb6..384aba109d7c 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -656,10 +656,58 @@ EXPORT_SYMBOL(__flush_dcache_range); + + /* get_new_mmu_context() uses "cache + 1". */ + DEFINE_SPINLOCK(ctx_alloc_lock); +-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1; ++unsigned long tlb_context_cache = CTX_FIRST_VERSION; + #define MAX_CTX_NR (1UL << CTX_NR_BITS) + #define CTX_BMAP_SLOTS BITS_TO_LONGS(MAX_CTX_NR) + DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR); ++DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0}; ++ ++static void mmu_context_wrap(void) ++{ ++ unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK; ++ unsigned long new_ver, new_ctx, old_ctx; ++ struct mm_struct *mm; ++ int cpu; ++ ++ bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS); ++ ++ /* Reserve kernel context */ ++ set_bit(0, mmu_context_bmap); ++ ++ new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION; ++ if (unlikely(new_ver == 0)) ++ new_ver = CTX_FIRST_VERSION; ++ tlb_context_cache = new_ver; ++ ++ /* ++ * Make sure that any new mm that are added into per_cpu_secondary_mm, ++ * are going to go through get_new_mmu_context() path. ++ */ ++ mb(); ++ ++ /* ++ * Updated versions to current on those CPUs that had valid secondary ++ * contexts ++ */ ++ for_each_online_cpu(cpu) { ++ /* ++ * If a new mm is stored after we took this mm from the array, ++ * it will go into get_new_mmu_context() path, because we ++ * already bumped the version in tlb_context_cache. ++ */ ++ mm = per_cpu(per_cpu_secondary_mm, cpu); ++ ++ if (unlikely(!mm || mm == &init_mm)) ++ continue; ++ ++ old_ctx = mm->context.sparc64_ctx_val; ++ if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) { ++ new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver; ++ set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap); ++ mm->context.sparc64_ctx_val = new_ctx; ++ } ++ } ++} + + /* Caller does TLB context flushing on local CPU if necessary. + * The caller also ensures that CTX_VALID(mm->context) is false. +@@ -675,48 +723,30 @@ void get_new_mmu_context(struct mm_struct *mm) + { + unsigned long ctx, new_ctx; + unsigned long orig_pgsz_bits; +- int new_version; + + spin_lock(&ctx_alloc_lock); ++retry: ++ /* wrap might have happened, test again if our context became valid */ ++ if (unlikely(CTX_VALID(mm->context))) ++ goto out; + orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK); + ctx = (tlb_context_cache + 1) & CTX_NR_MASK; + new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx); +- new_version = 0; + if (new_ctx >= (1 << CTX_NR_BITS)) { + new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1); + if (new_ctx >= ctx) { +- int i; +- new_ctx = (tlb_context_cache & CTX_VERSION_MASK) + +- CTX_FIRST_VERSION; +- if (new_ctx == 1) +- new_ctx = CTX_FIRST_VERSION; +- +- /* Don't call memset, for 16 entries that's just +- * plain silly... +- */ +- mmu_context_bmap[0] = 3; +- mmu_context_bmap[1] = 0; +- mmu_context_bmap[2] = 0; +- mmu_context_bmap[3] = 0; +- for (i = 4; i < CTX_BMAP_SLOTS; i += 4) { +- mmu_context_bmap[i + 0] = 0; +- mmu_context_bmap[i + 1] = 0; +- mmu_context_bmap[i + 2] = 0; +- mmu_context_bmap[i + 3] = 0; +- } +- new_version = 1; +- goto out; ++ mmu_context_wrap(); ++ goto retry; + } + } ++ if (mm->context.sparc64_ctx_val) ++ cpumask_clear(mm_cpumask(mm)); + mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63)); + new_ctx |= (tlb_context_cache & CTX_VERSION_MASK); +-out: + tlb_context_cache = new_ctx; + mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits; ++out: + spin_unlock(&ctx_alloc_lock); +- +- if (unlikely(new_version)) +- smp_new_mmu_context_version(); + } + + static int numa_enabled = 1; +diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c +index 9cdeca0fa955..266411291634 100644 +--- a/arch/sparc/mm/tsb.c ++++ b/arch/sparc/mm/tsb.c +@@ -451,7 +451,8 @@ retry_tsb_alloc: + extern void copy_tsb(unsigned long old_tsb_base, + unsigned long old_tsb_size, + unsigned long new_tsb_base, +- unsigned long new_tsb_size); ++ unsigned long new_tsb_size, ++ unsigned long page_size_shift); + unsigned long old_tsb_base = (unsigned long) old_tsb; + unsigned long new_tsb_base = (unsigned long) new_tsb; + +@@ -459,7 +460,9 @@ retry_tsb_alloc: + old_tsb_base = __pa(old_tsb_base); + new_tsb_base = __pa(new_tsb_base); + } +- copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size); ++ copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size, ++ tsb_index == MM_TSB_BASE ? ++ PAGE_SHIFT : REAL_HPAGE_SHIFT); + } + + mm->context.tsb_block[tsb_index].tsb = new_tsb; +diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S +index 5d2fd6cd3189..fcf4d27a38fb 100644 +--- a/arch/sparc/mm/ultra.S ++++ b/arch/sparc/mm/ultra.S +@@ -971,11 +971,6 @@ xcall_capture: + wr %g0, (1 << PIL_SMP_CAPTURE), %set_softint + retry + +- .globl xcall_new_mmu_context_version +-xcall_new_mmu_context_version: +- wr %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint +- retry +- + #ifdef CONFIG_KGDB + .globl xcall_kgdb_capture + xcall_kgdb_capture: +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index 47190bd399e7..cec49ecf5f31 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -161,8 +161,8 @@ void kvm_async_pf_task_wait(u32 token) + */ + rcu_irq_exit(); + native_safe_halt(); +- rcu_irq_enter(); + local_irq_disable(); ++ rcu_irq_enter(); + } + } + if (!n.halted) +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 642e9c93a097..9357b29de9bc 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -737,18 +737,20 @@ out: + static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i) + { + struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i]; +- int j, nent = vcpu->arch.cpuid_nent; ++ struct kvm_cpuid_entry2 *ej; ++ int j = i; ++ int nent = vcpu->arch.cpuid_nent; + + e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT; + /* when no next entry is found, the current entry[i] is reselected */ +- for (j = i + 1; ; j = (j + 1) % nent) { +- struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j]; +- if (ej->function == e->function) { +- ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; +- return j; +- } +- } +- return 0; /* silence gcc, even though control never reaches here */ ++ do { ++ j = (j + 1) % nent; ++ ej = &vcpu->arch.cpuid_entries[j]; ++ } while (ej->function != e->function); ++ ++ ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; ++ ++ return j; + } + + /* find an entry with matching function, matching index (if needed), and that +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 8eb8a934b531..1049c3c9b877 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3433,12 +3433,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn) + return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch); + } + +-static bool can_do_async_pf(struct kvm_vcpu *vcpu) ++bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu) + { + if (unlikely(!lapic_in_kernel(vcpu) || + kvm_event_needs_reinjection(vcpu))) + return false; + ++ if (is_guest_mode(vcpu)) ++ return false; ++ + return kvm_x86_ops->interrupt_allowed(vcpu); + } + +@@ -3454,7 +3457,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn, + if (!async) + return false; /* *pfn has correct page already */ + +- if (!prefault && can_do_async_pf(vcpu)) { ++ if (!prefault && kvm_can_do_async_pf(vcpu)) { + trace_kvm_try_async_get_page(gva, gfn); + if (kvm_find_async_pf_gfn(vcpu, gfn)) { + trace_kvm_async_pf_doublefault(gva, gfn); +diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h +index 55ffb7b0f95e..e60fc80f8a9c 100644 +--- a/arch/x86/kvm/mmu.h ++++ b/arch/x86/kvm/mmu.h +@@ -74,6 +74,7 @@ enum { + int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct); + void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu); + void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly); ++bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu); + + static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm) + { +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index ae2b9cd358f2..6c82792487e9 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8245,8 +8245,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu) + if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED)) + return true; + else +- return !kvm_event_needs_reinjection(vcpu) && +- kvm_x86_ops->interrupt_allowed(vcpu); ++ return kvm_can_do_async_pf(vcpu); + } + + void kvm_arch_start_assignment(struct kvm *kvm) +diff --git a/crypto/gcm.c b/crypto/gcm.c +index 1238b3c5a321..0a12c09d7cb2 100644 +--- a/crypto/gcm.c ++++ b/crypto/gcm.c +@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key, + + err = crypto_ablkcipher_encrypt(&data->req); + if (err == -EINPROGRESS || err == -EBUSY) { +- err = wait_for_completion_interruptible( +- &data->result.completion); +- if (!err) +- err = data->result.err; ++ wait_for_completion(&data->result.completion); ++ err = data->result.err; + } + + if (err) +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index 0975d23031ea..2898d19fadf5 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -346,7 +346,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma) + phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; + + /* It's illegal to wrap around the end of the physical address space. */ +- if (offset + (phys_addr_t)size < offset) ++ if (offset + (phys_addr_t)size - 1 < offset) + return -EINVAL; + + if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size)) +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 491a4dce13fe..1822472dffab 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1798,13 +1798,15 @@ int random_int_secret_init(void) + return 0; + } + ++static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash) ++ __aligned(sizeof(unsigned long)); ++ + /* + * Get a random word for internal kernel use only. Similar to urandom but + * with the goal of minimal entropy pool depletion. As a result, the random + * value is not cryptographically secure but for several uses the cost of + * depleting entropy is too high + */ +-static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash); + unsigned int get_random_int(void) + { + __u32 *hash; +@@ -1825,6 +1827,28 @@ unsigned int get_random_int(void) + EXPORT_SYMBOL(get_random_int); + + /* ++ * Same as get_random_int(), but returns unsigned long. ++ */ ++unsigned long get_random_long(void) ++{ ++ __u32 *hash; ++ unsigned long ret; ++ ++ if (arch_get_random_long(&ret)) ++ return ret; ++ ++ hash = get_cpu_var(get_random_int_hash); ++ ++ hash[0] += current->pid + jiffies + random_get_entropy(); ++ md5_transform(hash, random_int_secret); ++ ret = *(unsigned long *)hash; ++ put_cpu_var(get_random_int_hash); ++ ++ return ret; ++} ++EXPORT_SYMBOL(get_random_long); ++ ++/* + * randomize_range() returns a start address such that + * + * [...... .....] +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 38b363f4316b..ebed319657e7 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2451,6 +2451,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (!(cpufreq_driver->flags & CPUFREQ_STICKY) && + list_empty(&cpufreq_policy_list)) { + /* if all ->init() calls failed, unregister */ ++ ret = -ENODEV; + pr_debug("%s: No CPU initialized for driver %s\n", __func__, + driver_data->name); + goto err_if_unreg; +diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c +index 57ff46284f15..c97336a2ba92 100644 +--- a/drivers/dma/ep93xx_dma.c ++++ b/drivers/dma/ep93xx_dma.c +@@ -325,6 +325,8 @@ static int m2p_hw_setup(struct ep93xx_dma_chan *edmac) + | M2P_CONTROL_ENABLE; + m2p_set_control(edmac, control); + ++ edmac->buffer = 0; ++ + return 0; + } + +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index b1bc945f008f..56410ea75ac5 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -117,7 +117,7 @@ struct usb_dmac { + #define USB_DMASWR 0x0008 + #define USB_DMASWR_SWR (1 << 0) + #define USB_DMAOR 0x0060 +-#define USB_DMAOR_AE (1 << 2) ++#define USB_DMAOR_AE (1 << 1) + #define USB_DMAOR_DME (1 << 0) + + #define USB_DMASAR 0x0000 +diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c +index 57a2e347f04d..0f0094b58d1f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c +@@ -893,6 +893,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev) + u32 vblank_time = amdgpu_dpm_get_vblank_time(adev); + u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300; + ++ /* disable mclk switching if the refresh is >120Hz, even if the ++ * blanking period would allow it ++ */ ++ if (amdgpu_dpm_get_vrefresh(adev) > 120) ++ return true; ++ + if (vblank_time < switch_limit) + return true; + else +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index b88ce514eb8e..24d45fc7716c 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -986,6 +986,7 @@ static struct drm_driver msm_driver = { + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, + .gem_prime_export = drm_gem_prime_export, + .gem_prime_import = drm_gem_prime_import, ++ .gem_prime_res_obj = msm_gem_prime_res_obj, + .gem_prime_pin = msm_gem_prime_pin, + .gem_prime_unpin = msm_gem_prime_unpin, + .gem_prime_get_sg_table = msm_gem_prime_get_sg_table, +diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h +index 3be7a56b14f1..026e156e519c 100644 +--- a/drivers/gpu/drm/msm/msm_drv.h ++++ b/drivers/gpu/drm/msm/msm_drv.h +@@ -212,6 +212,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj); + void *msm_gem_prime_vmap(struct drm_gem_object *obj); + void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr); + int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); ++struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj); + struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev, + struct dma_buf_attachment *attach, struct sg_table *sg); + int msm_gem_prime_pin(struct drm_gem_object *obj); +diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c +index 121975b07cd4..1fbddc5c7281 100644 +--- a/drivers/gpu/drm/msm/msm_gem_prime.c ++++ b/drivers/gpu/drm/msm/msm_gem_prime.c +@@ -70,3 +70,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj) + if (!obj->import_attach) + msm_gem_put_pages(obj); + } ++ ++struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj) ++{ ++ struct msm_gem_object *msm_obj = to_msm_bo(obj); ++ ++ return msm_obj->resv; ++} +diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h +index 82d3e28918fd..7e4f24ae7de8 100644 +--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h +@@ -4,6 +4,7 @@ + + struct nvkm_alarm { + struct list_head head; ++ struct list_head exec; + u64 timestamp; + void (*func)(struct nvkm_alarm *); + }; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +index 79fcdb43e174..46033909d950 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c +@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr) + /* Move to completed list. We'll drop the lock before + * executing the callback so it can reschedule itself. + */ +- list_move_tail(&alarm->head, &exec); ++ list_del_init(&alarm->head); ++ list_add(&alarm->exec, &exec); + } + + /* Shut down interrupt if no more pending alarms. */ +@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr) + spin_unlock_irqrestore(&tmr->lock, flags); + + /* Execute completed callbacks. */ +- list_for_each_entry_safe(alarm, atemp, &exec, head) { +- list_del_init(&alarm->head); ++ list_for_each_entry_safe(alarm, atemp, &exec, exec) { ++ list_del(&alarm->exec); + alarm->func(alarm); + } + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +index b6a0806b06bf..a1c68e6a689e 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c +@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv, + return fifo_state->static_buffer; + else { + fifo_state->dynamic_buffer = vmalloc(bytes); ++ if (!fifo_state->dynamic_buffer) ++ goto out_err; + return fifo_state->dynamic_buffer; + } + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +index c9c04ccccdd9..027987023400 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -1288,11 +1288,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, + struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; + int ret; + uint32_t size; +- uint32_t backup_handle; ++ uint32_t backup_handle = 0; + + if (req->multisample_count != 0) + return -EINVAL; + ++ if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS) ++ return -EINVAL; ++ + if (unlikely(vmw_user_surface_size == 0)) + vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) + + 128; +@@ -1328,12 +1331,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, + ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle, + &res->backup, + &user_srf->backup_base); +- if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE < +- res->backup_size) { +- DRM_ERROR("Surface backup buffer is too small.\n"); +- vmw_dmabuf_unreference(&res->backup); +- ret = -EINVAL; +- goto out_unlock; ++ if (ret == 0) { ++ if (res->backup->base.num_pages * PAGE_SIZE < ++ res->backup_size) { ++ DRM_ERROR("Surface backup buffer is too small.\n"); ++ vmw_dmabuf_unreference(&res->backup); ++ ret = -EINVAL; ++ goto out_unlock; ++ } else { ++ backup_handle = req->buffer_handle; ++ } + } + } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer) + ret = vmw_user_dmabuf_alloc(dev_priv, tfile, +diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c +index 6bf89d8f3741..b9d1e5c58ec5 100644 +--- a/drivers/iio/light/ltr501.c ++++ b/drivers/iio/light/ltr501.c +@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000}; + static const struct reg_field reg_field_it = + REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4); + static const struct reg_field reg_field_als_intr = +- REG_FIELD(LTR501_INTR, 0, 0); +-static const struct reg_field reg_field_ps_intr = + REG_FIELD(LTR501_INTR, 1, 1); ++static const struct reg_field reg_field_ps_intr = ++ REG_FIELD(LTR501_INTR, 0, 0); + static const struct reg_field reg_field_als_rate = + REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2); + static const struct reg_field reg_field_ps_rate = +diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c +index bf0bd7e03aff..9e6d1cdb7fcd 100644 +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -40,9 +40,9 @@ + #define AS3935_AFE_PWR_BIT BIT(0) + + #define AS3935_INT 0x03 +-#define AS3935_INT_MASK 0x07 ++#define AS3935_INT_MASK 0x0f + #define AS3935_EVENT_INT BIT(3) +-#define AS3935_NOISE_INT BIT(1) ++#define AS3935_NOISE_INT BIT(0) + + #define AS3935_DATA 0x07 + #define AS3935_DATA_MASK 0x3F +diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c +index e6b7556d5221..cbc4216091c9 100644 +--- a/drivers/infiniband/hw/qib/qib_rc.c ++++ b/drivers/infiniband/hw/qib/qib_rc.c +@@ -2088,8 +2088,10 @@ send_last: + ret = qib_get_rwqe(qp, 1); + if (ret < 0) + goto nack_op_err; +- if (!ret) ++ if (!ret) { ++ qib_put_ss(&qp->r_sge); + goto rnr_nak; ++ } + wc.ex.imm_data = ohdr->u.rc.imm_data; + hdrsize += 4; + wc.wc_flags = IB_WC_WITH_IMM; +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 1a2b2620421e..6f4dc0fd2ca3 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1122,8 +1122,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, + * Asus UX32VD 0x361f02 00, 15, 0e clickpad + * Avatar AVIU-145A2 0x361f00 ? clickpad + * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons ++ * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons + * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons + * Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons ++ * Fujitsu LIFEBOOK E557 0x570f01 40, 14, 0c 2 hw buttons + * Fujitsu T725 0x470f01 05, 12, 09 2 hw buttons + * Fujitsu H730 0x570f00 c0, 14, 0c 3 hw buttons (**) + * Gigabyte U2442 0x450f01 58, 17, 0c 2 hw buttons +@@ -1529,6 +1531,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = { + }, + }, + { ++ /* Fujitsu LIFEBOOK E546 does not work with crc_enabled == 0 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"), ++ }, ++ }, ++ { + /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), +@@ -1550,6 +1559,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = { + }, + }, + { ++ /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"), ++ }, ++ }, ++ { + /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), +diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c +index 783337d22f36..10a02934bfc0 100644 +--- a/drivers/misc/cxl/file.c ++++ b/drivers/misc/cxl/file.c +@@ -158,11 +158,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx, + + /* Do this outside the status_mutex to avoid a circular dependency with + * the locking in cxl_mmap_fault() */ +- if (copy_from_user(&work, uwork, +- sizeof(struct cxl_ioctl_start_work))) { +- rc = -EFAULT; +- goto out; +- } ++ if (copy_from_user(&work, uwork, sizeof(work))) ++ return -EFAULT; + + mutex_lock(&ctx->status_mutex); + if (ctx->status != OPENED) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index c82ab87fcbe8..e5911ccb2148 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1949,7 +1949,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, + } + + /* select a non-FCoE queue */ +- return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp); ++ return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos); + } + + void bnx2x_set_num_queues(struct bnx2x *bp) +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 0d147610a06f..090e00650601 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -2714,10 +2714,14 @@ static int cxgb_up(struct adapter *adap) + if (err) + goto irq_err; + } ++ ++ mutex_lock(&uld_mutex); + enable_rx(adap); + t4_sge_start(adap); + t4_intr_enable(adap); + adap->flags |= FULL_INIT_DONE; ++ mutex_unlock(&uld_mutex); ++ + notify_ulds(adap, CXGB4_STATE_UP); + #if IS_ENABLED(CONFIG_IPV6) + update_clip(adap); +diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c +index ff665493ca97..52f2230062e7 100644 +--- a/drivers/net/ethernet/ethoc.c ++++ b/drivers/net/ethernet/ethoc.c +@@ -713,6 +713,8 @@ static int ethoc_open(struct net_device *dev) + if (ret) + return ret; + ++ napi_enable(&priv->napi); ++ + ethoc_init_ring(priv, dev->mem_start); + ethoc_reset(priv); + +@@ -725,7 +727,6 @@ static int ethoc_open(struct net_device *dev) + } + + phy_start(priv->phy); +- napi_enable(&priv->napi); + + if (netif_msg_ifup(priv)) { + dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n", +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 590750ab6564..9a986ccd42e5 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -77,6 +77,8 @@ static const u8 all_zeros_mac[ETH_ALEN]; + + static int vxlan_sock_add(struct vxlan_dev *vxlan); + ++static void vxlan_vs_del_dev(struct vxlan_dev *vxlan); ++ + /* per-network namespace private data for this module */ + struct vxlan_net { + struct list_head vxlan_list; +@@ -1052,6 +1054,8 @@ static void __vxlan_sock_release(struct vxlan_sock *vs) + + static void vxlan_sock_release(struct vxlan_dev *vxlan) + { ++ vxlan_vs_del_dev(vxlan); ++ + __vxlan_sock_release(vxlan->vn4_sock); + #if IS_ENABLED(CONFIG_IPV6) + __vxlan_sock_release(vxlan->vn6_sock); +@@ -2255,6 +2259,15 @@ static void vxlan_cleanup(unsigned long arg) + mod_timer(&vxlan->age_timer, next_timer); + } + ++static void vxlan_vs_del_dev(struct vxlan_dev *vxlan) ++{ ++ struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); ++ ++ spin_lock(&vn->sock_lock); ++ hlist_del_init_rcu(&vxlan->hlist); ++ spin_unlock(&vn->sock_lock); ++} ++ + static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan) + { + struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); +@@ -3028,12 +3041,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev, + static void vxlan_dellink(struct net_device *dev, struct list_head *head) + { + struct vxlan_dev *vxlan = netdev_priv(dev); +- struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); +- +- spin_lock(&vn->sock_lock); +- if (!hlist_unhashed(&vxlan->hlist)) +- hlist_del_rcu(&vxlan->hlist); +- spin_unlock(&vn->sock_lock); + + gro_cells_destroy(&vxlan->gro_cells); + list_del(&vxlan->next); +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 1f445f357da1..888e9cfef51a 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -304,7 +304,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue) + queue->rx_skbs[id] = skb; + + ref = gnttab_claim_grant_reference(&queue->gref_rx_head); +- BUG_ON((signed short)ref < 0); ++ WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); + queue->grant_rx_ref[id] = ref; + + page = skb_frag_page(&skb_shinfo(skb)->frags[0]); +@@ -437,7 +437,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, + id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs); + tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); + ref = gnttab_claim_grant_reference(&queue->gref_tx_head); +- BUG_ON((signed short)ref < 0); ++ WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); + + gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id, + gfn, GNTMAP_readonly); +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 3588a56aabb4..5cbf20ab94aa 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2311,10 +2311,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + + if (mem_only) { + if (pci_enable_device_mem(pdev)) +- goto probe_out; ++ return ret; + } else { + if (pci_enable_device(pdev)) +- goto probe_out; ++ return ret; + } + + /* This may fail but that's ok */ +@@ -2324,7 +2324,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + if (!ha) { + ql_log_pci(ql_log_fatal, pdev, 0x0009, + "Unable to allocate memory for ha.\n"); +- goto probe_out; ++ goto disable_device; + } + ql_dbg_pci(ql_dbg_init, pdev, 0x000a, + "Memory allocated for ha=%p.\n", ha); +@@ -2923,7 +2923,7 @@ iospace_config_failed: + kfree(ha); + ha = NULL; + +-probe_out: ++disable_device: + pci_disable_device(pdev); + return ret; + } +diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c +index 2fb1e974cc70..e11b1001d1f6 100644 +--- a/drivers/staging/lustre/lustre/lov/lov_pack.c ++++ b/drivers/staging/lustre/lustre/lov/lov_pack.c +@@ -399,18 +399,10 @@ int lov_getstripe(struct obd_export *exp, struct lov_stripe_md *lsm, + struct lov_mds_md *lmmk = NULL; + int rc, lmm_size; + int lum_size; +- mm_segment_t seg; + + if (!lsm) + return -ENODATA; + +- /* +- * "Switch to kernel segment" to allow copying from kernel space by +- * copy_{to,from}_user(). +- */ +- seg = get_fs(); +- set_fs(KERNEL_DS); +- + /* we only need the header part from user space to get lmm_magic and + * lmm_stripe_count, (the header part is common to v1 and v3) */ + lum_size = sizeof(struct lov_user_md_v1); +@@ -485,6 +477,5 @@ int lov_getstripe(struct obd_export *exp, struct lov_stripe_md *lsm, + + obd_free_diskmd(exp, &lmmk); + out_set: +- set_fs(seg); + return rc; + } +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index af301414a9f3..60743bf27f37 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1154,15 +1154,28 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size) + if (cmd->unknown_data_length) { + cmd->data_length = size; + } else if (size != cmd->data_length) { +- pr_warn("TARGET_CORE[%s]: Expected Transfer Length:" ++ pr_warn_ratelimited("TARGET_CORE[%s]: Expected Transfer Length:" + " %u does not match SCSI CDB Length: %u for SAM Opcode:" + " 0x%02x\n", cmd->se_tfo->get_fabric_name(), + cmd->data_length, size, cmd->t_task_cdb[0]); + +- if (cmd->data_direction == DMA_TO_DEVICE && +- cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { +- pr_err("Rejecting underflow/overflow WRITE data\n"); +- return TCM_INVALID_CDB_FIELD; ++ if (cmd->data_direction == DMA_TO_DEVICE) { ++ if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { ++ pr_err_ratelimited("Rejecting underflow/overflow" ++ " for WRITE data CDB\n"); ++ return TCM_INVALID_CDB_FIELD; ++ } ++ /* ++ * Some fabric drivers like iscsi-target still expect to ++ * always reject overflow writes. Reject this case until ++ * full fabric driver level support for overflow writes ++ * is introduced tree-wide. ++ */ ++ if (size > cmd->data_length) { ++ pr_err_ratelimited("Rejecting overflow for" ++ " WRITE control CDB\n"); ++ return TCM_INVALID_CDB_FIELD; ++ } + } + /* + * Reject READ_* or WRITE_* with overflow/underflow for +diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c +index 88246f7e435a..0f23dda60011 100644 +--- a/drivers/tty/serial/ifx6x60.c ++++ b/drivers/tty/serial/ifx6x60.c +@@ -1378,9 +1378,9 @@ static struct spi_driver ifx_spi_driver = { + static void __exit ifx_spi_exit(void) + { + /* unregister */ ++ spi_unregister_driver(&ifx_spi_driver); + tty_unregister_driver(tty_drv); + put_tty_driver(tty_drv); +- spi_unregister_driver(&ifx_spi_driver); + unregister_reboot_notifier(&ifx_modem_reboot_notifier_block); + } + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 63a06ab6ba03..235e150d7b81 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1800,11 +1800,13 @@ static int sci_startup(struct uart_port *port) + + dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); + ++ sci_request_dma(port); ++ + ret = sci_request_irq(s); +- if (unlikely(ret < 0)) ++ if (unlikely(ret < 0)) { ++ sci_free_dma(port); + return ret; +- +- sci_request_dma(port); ++ } + + spin_lock_irqsave(&port->lock, flags); + sci_start_tx(port); +@@ -1834,8 +1836,8 @@ static void sci_shutdown(struct uart_port *port) + } + #endif + +- sci_free_dma(port); + sci_free_irq(s); ++ sci_free_dma(port); + } + + static unsigned int sci_scbrr_calc(struct sci_port *s, unsigned int bps, +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 7cef54334b12..1bb629ab8ecc 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2070,13 +2070,12 @@ retry_open: + if (tty) { + mutex_unlock(&tty_mutex); + retval = tty_lock_interruptible(tty); ++ tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */ + if (retval) { + if (retval == -EINTR) + retval = -ERESTARTSYS; + goto err_unref; + } +- /* safe to drop the kref from tty_driver_lookup_tty() */ +- tty_kref_put(tty); + retval = tty_reopen(tty); + if (retval < 0) { + tty_unlock(tty); +diff --git a/drivers/tty/tty_mutex.c b/drivers/tty/tty_mutex.c +index d09293bc0e04..cff304abb619 100644 +--- a/drivers/tty/tty_mutex.c ++++ b/drivers/tty/tty_mutex.c +@@ -24,10 +24,15 @@ EXPORT_SYMBOL(tty_lock); + + int tty_lock_interruptible(struct tty_struct *tty) + { ++ int ret; ++ + if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty)) + return -EIO; + tty_kref_get(tty); +- return mutex_lock_interruptible(&tty->legacy_mutex); ++ ret = mutex_lock_interruptible(&tty->legacy_mutex); ++ if (ret) ++ tty_kref_put(tty); ++ return ret; + } + + void __lockfunc tty_unlock(struct tty_struct *tty) +diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c +index 58c8485a0715..923379972707 100644 +--- a/drivers/usb/chipidea/debug.c ++++ b/drivers/usb/chipidea/debug.c +@@ -295,7 +295,8 @@ static int ci_role_show(struct seq_file *s, void *data) + { + struct ci_hdrc *ci = s->private; + +- seq_printf(s, "%s\n", ci_role(ci)->name); ++ if (ci->role != CI_ROLE_END) ++ seq_printf(s, "%s\n", ci_role(ci)->name); + + return 0; + } +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index d8a045fc1fdb..aff086ca97e4 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1982,6 +1982,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci) + int ci_hdrc_gadget_init(struct ci_hdrc *ci) + { + struct ci_role_driver *rdrv; ++ int ret; + + if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC)) + return -ENXIO; +@@ -1994,7 +1995,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci) + rdrv->stop = udc_id_switch_for_host; + rdrv->irq = udc_irq; + rdrv->name = "gadget"; +- ci->roles[CI_ROLE_GADGET] = rdrv; + +- return udc_start(ci); ++ ret = udc_start(ci); ++ if (!ret) ++ ci->roles[CI_ROLE_GADGET] = rdrv; ++ ++ return ret; + } +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index a4f664062e0c..a069726da72a 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -399,7 +399,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) + /* Caller must hold fsg->lock */ + static void wakeup_thread(struct fsg_common *common) + { +- smp_wmb(); /* ensure the write of bh->state is complete */ ++ /* ++ * Ensure the reading of thread_wakeup_needed ++ * and the writing of bh->state are completed ++ */ ++ smp_mb(); + /* Tell the main thread that something has happened */ + common->thread_wakeup_needed = 1; + if (common->thread_task) +@@ -630,7 +634,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze) + } + __set_current_state(TASK_RUNNING); + common->thread_wakeup_needed = 0; +- smp_rmb(); /* ensure the latest bh->state is visible */ ++ ++ /* ++ * Ensure the writing of thread_wakeup_needed ++ * and the reading of bh->state are completed ++ */ ++ smp_mb(); + return rc; + } + +diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c +index df2e6f783318..527de56f832f 100644 +--- a/drivers/xen/privcmd.c ++++ b/drivers/xen/privcmd.c +@@ -335,8 +335,8 @@ static int mmap_batch_fn(void *data, int nr, void *state) + st->global_error = 1; + } + } +- st->va += PAGE_SIZE * nr; +- st->index += nr; ++ st->va += XEN_PAGE_SIZE * nr; ++ st->index += nr / XEN_PFN_PER_PAGE; + + return 0; + } +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 2a2e370399ba..c36a03fa7678 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3854,6 +3854,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags, + info->space_info_kobj, "%s", + alloc_name(found->flags)); + if (ret) { ++ percpu_counter_destroy(&found->total_bytes_pinned); + kfree(found); + return ret; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 353f4bae658c..d4a6eef31854 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2771,7 +2771,7 @@ static long btrfs_fallocate(struct file *file, int mode, + if (!ret) + ret = btrfs_prealloc_file_range(inode, mode, + range->start, +- range->len, 1 << inode->i_blkbits, ++ range->len, i_blocksize(inode), + offset + len, &alloc_hint); + list_del(&range->list); + kfree(range); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 3cff6523f27d..863fa0f1972b 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -7318,8 +7318,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end) + int found = false; + void **pagep = NULL; + struct page *page = NULL; +- int start_idx; +- int end_idx; ++ unsigned long start_idx; ++ unsigned long end_idx; + + start_idx = start >> PAGE_CACHE_SHIFT; + +diff --git a/fs/buffer.c b/fs/buffer.c +index 4f4cd959da7c..6f7d519a093b 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -2298,7 +2298,7 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, + loff_t pos, loff_t *bytes) + { + struct inode *inode = mapping->host; +- unsigned blocksize = 1 << inode->i_blkbits; ++ unsigned int blocksize = i_blocksize(inode); + struct page *page; + void *fsdata; + pgoff_t index, curidx; +@@ -2378,8 +2378,8 @@ int cont_write_begin(struct file *file, struct address_space *mapping, + get_block_t *get_block, loff_t *bytes) + { + struct inode *inode = mapping->host; +- unsigned blocksize = 1 << inode->i_blkbits; +- unsigned zerofrom; ++ unsigned int blocksize = i_blocksize(inode); ++ unsigned int zerofrom; + int err; + + err = cont_expand_zero(file, mapping, pos, bytes); +@@ -2741,7 +2741,7 @@ int nobh_truncate_page(struct address_space *mapping, + struct buffer_head map_bh; + int err; + +- blocksize = 1 << inode->i_blkbits; ++ blocksize = i_blocksize(inode); + length = offset & (blocksize - 1); + + /* Block boundary? Nothing to do */ +@@ -2819,7 +2819,7 @@ int block_truncate_page(struct address_space *mapping, + struct buffer_head *bh; + int err; + +- blocksize = 1 << inode->i_blkbits; ++ blocksize = i_blocksize(inode); + length = offset & (blocksize - 1); + + /* Block boundary? Nothing to do */ +@@ -2931,7 +2931,7 @@ sector_t generic_block_bmap(struct address_space *mapping, sector_t block, + struct inode *inode = mapping->host; + tmp.b_state = 0; + tmp.b_blocknr = 0; +- tmp.b_size = 1 << inode->i_blkbits; ++ tmp.b_size = i_blocksize(inode); + get_block(inode, block, &tmp, 0); + return tmp.b_blocknr; + } +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index b7d218a168fb..c6a1ec110c01 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -697,7 +697,7 @@ static int ceph_writepages_start(struct address_space *mapping, + struct pagevec pvec; + int done = 0; + int rc = 0; +- unsigned wsize = 1 << inode->i_blkbits; ++ unsigned int wsize = i_blocksize(inode); + struct ceph_osd_request *req = NULL; + int do_sync = 0; + loff_t snap_size, i_size; +diff --git a/fs/direct-io.c b/fs/direct-io.c +index 01171d8a6ee9..c772fdf36cd9 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -575,7 +575,7 @@ static int dio_set_defer_completion(struct dio *dio) + /* + * Call into the fs to map some more disk blocks. We record the current number + * of available blocks at sdio->blocks_available. These are in units of the +- * fs blocksize, (1 << inode->i_blkbits). ++ * fs blocksize, i_blocksize(inode). + * + * The fs is allowed to map lots of blocks at once. If it wants to do that, + * it uses the passed inode-relative block number as the file offset, as usual. +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 8a456f9b8a44..61d5bfc7318c 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4902,6 +4902,8 @@ static long ext4_zero_range(struct file *file, loff_t offset, + + /* Zero out partial block at the edges of the range */ + ret = ext4_zero_partial_blocks(handle, inode, offset, len); ++ if (ret >= 0) ++ ext4_update_inode_fsync_trans(handle, inode, 1); + + if (file->f_flags & O_SYNC) + ext4_handle_sync(handle); +@@ -5597,6 +5599,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + ext4_handle_sync(handle); + inode->i_mtime = inode->i_ctime = ext4_current_time(inode); + ext4_mark_inode_dirty(handle, inode); ++ ext4_update_inode_fsync_trans(handle, inode, 1); + + out_stop: + ext4_journal_stop(handle); +@@ -5770,6 +5773,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) + up_write(&EXT4_I(inode)->i_data_sem); + if (IS_SYNC(inode)) + ext4_handle_sync(handle); ++ if (ret >= 0) ++ ext4_update_inode_fsync_trans(handle, inode, 1); + + out_stop: + ext4_journal_stop(handle); +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index 0d24ebcd7c9e..8772bfc3415b 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -463,47 +463,27 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, + num = min_t(pgoff_t, end - index, PAGEVEC_SIZE); + nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index, + (pgoff_t)num); +- if (nr_pages == 0) { +- if (whence == SEEK_DATA) +- break; +- +- BUG_ON(whence != SEEK_HOLE); +- /* +- * If this is the first time to go into the loop and +- * offset is not beyond the end offset, it will be a +- * hole at this offset +- */ +- if (lastoff == startoff || lastoff < endoff) +- found = 1; ++ if (nr_pages == 0) + break; +- } +- +- /* +- * If this is the first time to go into the loop and +- * offset is smaller than the first page offset, it will be a +- * hole at this offset. +- */ +- if (lastoff == startoff && whence == SEEK_HOLE && +- lastoff < page_offset(pvec.pages[0])) { +- found = 1; +- break; +- } + + for (i = 0; i < nr_pages; i++) { + struct page *page = pvec.pages[i]; + struct buffer_head *bh, *head; + + /* +- * If the current offset is not beyond the end of given +- * range, it will be a hole. ++ * If current offset is smaller than the page offset, ++ * there is a hole at this offset. + */ +- if (lastoff < endoff && whence == SEEK_HOLE && +- page->index > end) { ++ if (whence == SEEK_HOLE && lastoff < endoff && ++ lastoff < page_offset(pvec.pages[i])) { + found = 1; + *offset = lastoff; + goto out; + } + ++ if (page->index > end) ++ goto out; ++ + lock_page(page); + + if (unlikely(page->mapping != inode->i_mapping)) { +@@ -543,20 +523,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, + unlock_page(page); + } + +- /* +- * The no. of pages is less than our desired, that would be a +- * hole in there. +- */ +- if (nr_pages < num && whence == SEEK_HOLE) { +- found = 1; +- *offset = lastoff; ++ /* The no. of pages is less than our desired, we are done. */ ++ if (nr_pages < num) + break; +- } + + index = pvec.pages[i - 1]->index + 1; + pagevec_release(&pvec); + } while (index <= end); + ++ if (whence == SEEK_HOLE && lastoff < endoff) { ++ found = 1; ++ *offset = lastoff; ++ } + out: + pagevec_release(&pvec); + return found; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index ccae64dad40c..1796d1bd9a1d 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2044,7 +2044,7 @@ static int mpage_process_page_bufs(struct mpage_da_data *mpd, + { + struct inode *inode = mpd->inode; + int err; +- ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1) ++ ext4_lblk_t blocks = (i_size_read(inode) + i_blocksize(inode) - 1) + >> inode->i_blkbits; + + do { +@@ -3793,6 +3793,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + + inode->i_mtime = inode->i_ctime = ext4_current_time(inode); + ext4_mark_inode_dirty(handle, inode); ++ if (ret >= 0) ++ ext4_update_inode_fsync_trans(handle, inode, 1); + out_stop: + ext4_journal_stop(handle); + out_dio: +@@ -5162,8 +5164,9 @@ static int ext4_expand_extra_isize(struct inode *inode, + /* No extended attributes present */ + if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) || + header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) { +- memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0, +- new_extra_isize); ++ memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + ++ EXT4_I(inode)->i_extra_isize, 0, ++ new_extra_isize - EXT4_I(inode)->i_extra_isize); + EXT4_I(inode)->i_extra_isize = new_extra_isize; + return 0; + } +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 7861d801b048..05048fcfd602 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -187,7 +187,7 @@ mext_page_mkuptodate(struct page *page, unsigned from, unsigned to) + if (PageUptodate(page)) + return 0; + +- blocksize = 1 << inode->i_blkbits; ++ blocksize = i_blocksize(inode); + if (!page_has_buffers(page)) + create_empty_buffers(page, blocksize, 0); + +diff --git a/fs/jfs/super.c b/fs/jfs/super.c +index 8f9176caf098..c8d58c5ac8ae 100644 +--- a/fs/jfs/super.c ++++ b/fs/jfs/super.c +@@ -758,7 +758,7 @@ static ssize_t jfs_quota_read(struct super_block *sb, int type, char *data, + sb->s_blocksize - offset : toread; + + tmp_bh.b_state = 0; +- tmp_bh.b_size = 1 << inode->i_blkbits; ++ tmp_bh.b_size = i_blocksize(inode); + err = jfs_get_block(inode, blk, &tmp_bh, 0); + if (err) + return err; +@@ -798,7 +798,7 @@ static ssize_t jfs_quota_write(struct super_block *sb, int type, + sb->s_blocksize - offset : towrite; + + tmp_bh.b_state = 0; +- tmp_bh.b_size = 1 << inode->i_blkbits; ++ tmp_bh.b_size = i_blocksize(inode); + err = jfs_get_block(inode, blk, &tmp_bh, 1); + if (err) + goto out; +diff --git a/fs/mpage.c b/fs/mpage.c +index 1480d3a18037..6ade29b19494 100644 +--- a/fs/mpage.c ++++ b/fs/mpage.c +@@ -111,7 +111,7 @@ map_buffer_to_page(struct page *page, struct buffer_head *bh, int page_block) + SetPageUptodate(page); + return; + } +- create_empty_buffers(page, 1 << inode->i_blkbits, 0); ++ create_empty_buffers(page, i_blocksize(inode), 0); + } + head = page_buffers(page); + page_bh = head; +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 52ee0b73ab4a..5b21b1ca2341 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2421,6 +2421,20 @@ int nfs_may_open(struct inode *inode, struct rpc_cred *cred, int openflags) + } + EXPORT_SYMBOL_GPL(nfs_may_open); + ++static int nfs_execute_ok(struct inode *inode, int mask) ++{ ++ struct nfs_server *server = NFS_SERVER(inode); ++ int ret; ++ ++ if (mask & MAY_NOT_BLOCK) ++ ret = nfs_revalidate_inode_rcu(server, inode); ++ else ++ ret = nfs_revalidate_inode(server, inode); ++ if (ret == 0 && !execute_ok(inode)) ++ ret = -EACCES; ++ return ret; ++} ++ + int nfs_permission(struct inode *inode, int mask) + { + struct rpc_cred *cred; +@@ -2438,6 +2452,9 @@ int nfs_permission(struct inode *inode, int mask) + case S_IFLNK: + goto out; + case S_IFREG: ++ if ((mask & MAY_OPEN) && ++ nfs_server_capable(inode, NFS_CAP_ATOMIC_OPEN)) ++ return 0; + break; + case S_IFDIR: + /* +@@ -2470,8 +2487,8 @@ force_lookup: + res = PTR_ERR(cred); + } + out: +- if (!res && (mask & MAY_EXEC) && !execute_ok(inode)) +- res = -EACCES; ++ if (!res && (mask & MAY_EXEC)) ++ res = nfs_execute_ok(inode, mask); + + dfprintk(VFS, "NFS: permission(%s/%lu), mask=0x%x, res=%d\n", + inode->i_sb->s_id, inode->i_ino, mask, res); +diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c +index c29d9421bd5e..0976f8dad4ce 100644 +--- a/fs/nfsd/blocklayout.c ++++ b/fs/nfsd/blocklayout.c +@@ -50,7 +50,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, + { + struct nfsd4_layout_seg *seg = &args->lg_seg; + struct super_block *sb = inode->i_sb; +- u32 block_size = (1 << inode->i_blkbits); ++ u32 block_size = i_blocksize(inode); + struct pnfs_block_extent *bex; + struct iomap iomap; + u32 device_generation = 0; +@@ -151,7 +151,7 @@ nfsd4_block_proc_layoutcommit(struct inode *inode, + int error; + + nr_iomaps = nfsd4_block_decode_layoutupdate(lcp->lc_up_layout, +- lcp->lc_up_len, &iomaps, 1 << inode->i_blkbits); ++ lcp->lc_up_len, &iomaps, i_blocksize(inode)); + if (nr_iomaps < 0) + return nfserrno(nr_iomaps); + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 7d5351cd67fb..209dbfc50cd4 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1690,6 +1690,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + opdesc->op_get_currentstateid(cstate, &op->u); + op->status = opdesc->op_func(rqstp, cstate, &op->u); + ++ /* Only from SEQUENCE */ ++ if (cstate->status == nfserr_replay_cache) { ++ dprintk("%s NFS4.1 replay from cache\n", __func__); ++ status = op->status; ++ goto out; ++ } + if (!op->status) { + if (opdesc->op_set_currentstateid) + opdesc->op_set_currentstateid(cstate, &op->u); +@@ -1700,14 +1706,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + if (need_wrongsec_check(rqstp)) + op->status = check_nfsd_access(current_fh->fh_export, rqstp); + } +- + encode_op: +- /* Only from SEQUENCE */ +- if (cstate->status == nfserr_replay_cache) { +- dprintk("%s NFS4.1 replay from cache\n", __func__); +- status = op->status; +- goto out; +- } + if (op->status == nfserr_replay_me) { + op->replay = &cstate->replay_owner->so_replay; + nfsd4_encode_replay(&resp->xdr, op); +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index c3e1cb481fe0..3f68a25f2169 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2753,9 +2753,16 @@ out_acl: + } + #endif /* CONFIG_NFSD_PNFS */ + if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) { +- status = nfsd4_encode_bitmap(xdr, NFSD_SUPPATTR_EXCLCREAT_WORD0, +- NFSD_SUPPATTR_EXCLCREAT_WORD1, +- NFSD_SUPPATTR_EXCLCREAT_WORD2); ++ u32 supp[3]; ++ ++ supp[0] = nfsd_suppattrs0(minorversion); ++ supp[1] = nfsd_suppattrs1(minorversion); ++ supp[2] = nfsd_suppattrs2(minorversion); ++ supp[0] &= NFSD_SUPPATTR_EXCLCREAT_WORD0; ++ supp[1] &= NFSD_SUPPATTR_EXCLCREAT_WORD1; ++ supp[2] &= NFSD_SUPPATTR_EXCLCREAT_WORD2; ++ ++ status = nfsd4_encode_bitmap(xdr, supp[0], supp[1], supp[2]); + if (status) + goto out; + } +diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c +index a35ae35e6932..cd39b57288c2 100644 +--- a/fs/nilfs2/btnode.c ++++ b/fs/nilfs2/btnode.c +@@ -55,7 +55,7 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr) + brelse(bh); + BUG(); + } +- memset(bh->b_data, 0, 1 << inode->i_blkbits); ++ memset(bh->b_data, 0, i_blocksize(inode)); + bh->b_bdev = inode->i_sb->s_bdev; + bh->b_blocknr = blocknr; + set_buffer_mapped(bh); +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index ac2f64943ff4..00877ef0b120 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -55,7 +55,7 @@ void nilfs_inode_add_blocks(struct inode *inode, int n) + { + struct nilfs_root *root = NILFS_I(inode)->i_root; + +- inode_add_bytes(inode, (1 << inode->i_blkbits) * n); ++ inode_add_bytes(inode, i_blocksize(inode) * n); + if (root) + atomic64_add(n, &root->blocks_count); + } +@@ -64,7 +64,7 @@ void nilfs_inode_sub_blocks(struct inode *inode, int n) + { + struct nilfs_root *root = NILFS_I(inode)->i_root; + +- inode_sub_bytes(inode, (1 << inode->i_blkbits) * n); ++ inode_sub_bytes(inode, i_blocksize(inode) * n); + if (root) + atomic64_sub(n, &root->blocks_count); + } +diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c +index 1125f40233ff..612a2457243d 100644 +--- a/fs/nilfs2/mdt.c ++++ b/fs/nilfs2/mdt.c +@@ -60,7 +60,7 @@ nilfs_mdt_insert_new_block(struct inode *inode, unsigned long block, + set_buffer_mapped(bh); + + kaddr = kmap_atomic(bh->b_page); +- memset(kaddr + bh_offset(bh), 0, 1 << inode->i_blkbits); ++ memset(kaddr + bh_offset(bh), 0, i_blocksize(inode)); + if (init_block) + init_block(inode, bh, kaddr); + flush_dcache_page(bh->b_page); +@@ -503,7 +503,7 @@ void nilfs_mdt_set_entry_size(struct inode *inode, unsigned entry_size, + struct nilfs_mdt_info *mi = NILFS_MDT(inode); + + mi->mi_entry_size = entry_size; +- mi->mi_entries_per_block = (1 << inode->i_blkbits) / entry_size; ++ mi->mi_entries_per_block = i_blocksize(inode) / entry_size; + mi->mi_first_entry_offset = DIV_ROUND_UP(header_size, entry_size); + } + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 3b65adaae7e4..2f27c935bd57 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -719,7 +719,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, + + lock_page(page); + if (!page_has_buffers(page)) +- create_empty_buffers(page, 1 << inode->i_blkbits, 0); ++ create_empty_buffers(page, i_blocksize(inode), 0); + unlock_page(page); + + bh = head = page_buffers(page); +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index e6795c7c76a8..e4184bd2a954 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -1103,7 +1103,7 @@ int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno, + int ret = 0; + struct buffer_head *head, *bh, *wait[2], **wait_bh = wait; + unsigned int block_end, block_start; +- unsigned int bsize = 1 << inode->i_blkbits; ++ unsigned int bsize = i_blocksize(inode); + + if (!page_has_buffers(page)) + create_empty_buffers(page, bsize, 0); +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 56dd3957cc91..1d738723a41a 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -808,7 +808,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from, + /* We know that zero_from is block aligned */ + for (block_start = zero_from; block_start < zero_to; + block_start = block_end) { +- block_end = block_start + (1 << inode->i_blkbits); ++ block_end = block_start + i_blocksize(inode); + + /* + * block_start is block-aligned. Bump it by one to force +diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c +index 8f5ccdf81c25..38187300a2b4 100644 +--- a/fs/reiserfs/file.c ++++ b/fs/reiserfs/file.c +@@ -189,7 +189,7 @@ int reiserfs_commit_page(struct inode *inode, struct page *page, + int ret = 0; + + th.t_trans_id = 0; +- blocksize = 1 << inode->i_blkbits; ++ blocksize = i_blocksize(inode); + + if (logit) { + reiserfs_write_lock(s); +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index 3d8e7e671d5b..60ba35087d12 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -524,7 +524,7 @@ static int reiserfs_get_blocks_direct_io(struct inode *inode, + * referenced in convert_tail_for_hole() that may be called from + * reiserfs_get_block() + */ +- bh_result->b_size = (1 << inode->i_blkbits); ++ bh_result->b_size = i_blocksize(inode); + + ret = reiserfs_get_block(inode, iblock, bh_result, + create | GET_BLOCK_NO_DANGLE); +diff --git a/fs/stat.c b/fs/stat.c +index d4a61d8dc021..004dd77c3b93 100644 +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -31,7 +31,7 @@ void generic_fillattr(struct inode *inode, struct kstat *stat) + stat->atime = inode->i_atime; + stat->mtime = inode->i_mtime; + stat->ctime = inode->i_ctime; +- stat->blksize = (1 << inode->i_blkbits); ++ stat->blksize = i_blocksize(inode); + stat->blocks = inode->i_blocks; + } + +@@ -454,6 +454,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes) + inode->i_bytes -= 512; + } + } ++EXPORT_SYMBOL(__inode_add_bytes); + + void inode_add_bytes(struct inode *inode, loff_t bytes) + { +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 566df9b5a6cb..7be3166ba553 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1206,7 +1206,7 @@ int udf_setsize(struct inode *inode, loff_t newsize) + { + int err; + struct udf_inode_info *iinfo; +- int bsize = 1 << inode->i_blkbits; ++ int bsize = i_blocksize(inode); + + if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) || + S_ISLNK(inode->i_mode))) +diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c +index dc5fae601c24..637e17cb0edd 100644 +--- a/fs/ufs/balloc.c ++++ b/fs/ufs/balloc.c +@@ -81,7 +81,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count) + ufs_error (sb, "ufs_free_fragments", + "bit already cleared for fragment %u", i); + } +- ++ ++ inode_sub_bytes(inode, count << uspi->s_fshift); + fs32_add(sb, &ucg->cg_cs.cs_nffree, count); + uspi->cs_total.cs_nffree += count; + fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count); +@@ -183,6 +184,7 @@ do_more: + ufs_error(sb, "ufs_free_blocks", "freeing free fragment"); + } + ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno); ++ inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift); + if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD) + ufs_clusteracct (sb, ucpi, blkno, 1); + +@@ -494,6 +496,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + return 0; + } + ++static bool try_add_frags(struct inode *inode, unsigned frags) ++{ ++ unsigned size = frags * i_blocksize(inode); ++ spin_lock(&inode->i_lock); ++ __inode_add_bytes(inode, size); ++ if (unlikely((u32)inode->i_blocks != inode->i_blocks)) { ++ __inode_sub_bytes(inode, size); ++ spin_unlock(&inode->i_lock); ++ return false; ++ } ++ spin_unlock(&inode->i_lock); ++ return true; ++} ++ + static u64 ufs_add_fragments(struct inode *inode, u64 fragment, + unsigned oldcount, unsigned newcount) + { +@@ -530,6 +546,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment, + for (i = oldcount; i < newcount; i++) + if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i)) + return 0; ++ ++ if (!try_add_frags(inode, count)) ++ return 0; + /* + * Block can be extended + */ +@@ -647,6 +666,7 @@ cg_found: + ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i); + i = uspi->s_fpb - count; + ++ inode_sub_bytes(inode, i << uspi->s_fshift); + fs32_add(sb, &ucg->cg_cs.cs_nffree, i); + uspi->cs_total.cs_nffree += i; + fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i); +@@ -657,6 +677,8 @@ cg_found: + result = ufs_bitmap_search (sb, ucpi, goal, allocsize); + if (result == INVBLOCK) + return 0; ++ if (!try_add_frags(inode, count)) ++ return 0; + for (i = 0; i < count; i++) + ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i); + +@@ -716,6 +738,8 @@ norot: + return INVBLOCK; + ucpi->c_rotor = result; + gotit: ++ if (!try_add_frags(inode, uspi->s_fpb)) ++ return 0; + blkno = ufs_fragstoblks(result); + ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno); + if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD) +diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c +index a064cf44b143..1f69bb9b1e9d 100644 +--- a/fs/ufs/inode.c ++++ b/fs/ufs/inode.c +@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to, + + p = ufs_get_direct_data_ptr(uspi, ufsi, block); + tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p), +- new_size, err, locked_page); ++ new_size - (lastfrag & uspi->s_fpbmask), err, ++ locked_page); + return tmp != 0; + } + +@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index, + goal += uspi->s_fpb; + } + tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment), +- goal, uspi->s_fpb, err, locked_page); ++ goal, nfrags, err, locked_page); + + if (!tmp) { + *err = -ENOSPC; +@@ -402,7 +403,9 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff + + if (!create) { + phys64 = ufs_frag_map(inode, offsets, depth); +- goto out; ++ if (phys64) ++ map_bh(bh_result, sb, phys64 + frag); ++ return 0; + } + + /* This code entered only while writing ....? */ +diff --git a/fs/ufs/super.c b/fs/ufs/super.c +index f6390eec02ca..10f364490833 100644 +--- a/fs/ufs/super.c ++++ b/fs/ufs/super.c +@@ -746,6 +746,23 @@ static void ufs_put_super(struct super_block *sb) + return; + } + ++static u64 ufs_max_bytes(struct super_block *sb) ++{ ++ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; ++ int bits = uspi->s_apbshift; ++ u64 res; ++ ++ if (bits > 21) ++ res = ~0ULL; ++ else ++ res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) + ++ (1LL << (3*bits)); ++ ++ if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift)) ++ return MAX_LFS_FILESIZE; ++ return res << uspi->s_bshift; ++} ++ + static int ufs_fill_super(struct super_block *sb, void *data, int silent) + { + struct ufs_sb_info * sbi; +@@ -1212,6 +1229,7 @@ magic_found: + "fast symlink size (%u)\n", uspi->s_maxsymlinklen); + uspi->s_maxsymlinklen = maxsymlen; + } ++ sb->s_maxbytes = ufs_max_bytes(sb); + sb->s_max_links = UFS_LINK_MAX; + + inode = ufs_iget(sb, UFS_ROOTINO); +diff --git a/fs/ufs/util.h b/fs/ufs/util.h +index 954175928240..3f9463f8cf2f 100644 +--- a/fs/ufs/util.h ++++ b/fs/ufs/util.h +@@ -473,15 +473,19 @@ static inline unsigned _ubh_find_last_zero_bit_( + static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi, + struct ufs_buffer_head * ubh, unsigned begin, unsigned block) + { ++ u8 mask; + switch (uspi->s_fpb) { + case 8: + return (*ubh_get_addr (ubh, begin + block) == 0xff); + case 4: +- return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2))); ++ mask = 0x0f << ((block & 0x01) << 2); ++ return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask; + case 2: +- return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1))); ++ mask = 0x03 << ((block & 0x03) << 1); ++ return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask; + case 1: +- return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07))); ++ mask = 0x01 << (block & 0x07); ++ return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask; + } + return 0; + } +diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c +index 29e7e5dd5178..187b80267ff9 100644 +--- a/fs/xfs/xfs_aops.c ++++ b/fs/xfs/xfs_aops.c +@@ -288,7 +288,7 @@ xfs_map_blocks( + { + struct xfs_inode *ip = XFS_I(inode); + struct xfs_mount *mp = ip->i_mount; +- ssize_t count = 1 << inode->i_blkbits; ++ ssize_t count = i_blocksize(inode); + xfs_fileoff_t offset_fsb, end_fsb; + int error = 0; + int bmapi_flags = XFS_BMAPI_ENTIRE; +@@ -921,7 +921,7 @@ xfs_aops_discard_page( + break; + } + next_buffer: +- offset += 1 << inode->i_blkbits; ++ offset += i_blocksize(inode); + + } while ((bh = bh->b_this_page) != head); + +@@ -1363,7 +1363,7 @@ xfs_map_trim_size( + offset + mapping_size >= i_size_read(inode)) { + /* limit mapping to block that spans EOF */ + mapping_size = roundup_64(i_size_read(inode) - offset, +- 1 << inode->i_blkbits); ++ i_blocksize(inode)); + } + if (mapping_size > LONG_MAX) + mapping_size = LONG_MAX; +@@ -1395,7 +1395,7 @@ __xfs_get_blocks( + return -EIO; + + offset = (xfs_off_t)iblock << inode->i_blkbits; +- ASSERT(bh_result->b_size >= (1 << inode->i_blkbits)); ++ ASSERT(bh_result->b_size >= i_blocksize(inode)); + size = bh_result->b_size; + + if (!create && direct && offset >= i_size_read(inode)) +@@ -1968,7 +1968,7 @@ xfs_vm_set_page_dirty( + if (offset < end_offset) + set_buffer_dirty(bh); + bh = bh->b_this_page; +- offset += 1 << inode->i_blkbits; ++ offset += i_blocksize(inode); + } while (bh != head); + } + /* +diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c +index ceea444dafb4..3dd47307363f 100644 +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -947,7 +947,7 @@ xfs_file_fallocate( + if (error) + goto out_unlock; + } else if (mode & FALLOC_FL_COLLAPSE_RANGE) { +- unsigned blksize_mask = (1 << inode->i_blkbits) - 1; ++ unsigned int blksize_mask = i_blocksize(inode) - 1; + + if (offset & blksize_mask || len & blksize_mask) { + error = -EINVAL; +@@ -969,7 +969,7 @@ xfs_file_fallocate( + if (error) + goto out_unlock; + } else if (mode & FALLOC_FL_INSERT_RANGE) { +- unsigned blksize_mask = (1 << inode->i_blkbits) - 1; ++ unsigned int blksize_mask = i_blocksize(inode) - 1; + + new_size = i_size_read(inode) + len; + if (offset & blksize_mask || len & blksize_mask) { +diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c +index e6dae28dfa1a..9beaf192b4bb 100644 +--- a/fs/xfs/xfs_xattr.c ++++ b/fs/xfs/xfs_xattr.c +@@ -180,6 +180,7 @@ xfs_xattr_put_listent( + arraytop = context->count + prefix_len + namelen + 1; + if (arraytop > context->firstu) { + context->count = -1; /* insufficient space */ ++ context->seen_enough = 1; + return 0; + } + offset = (char *)context->alist + context->count; +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index ad2bcf647b9a..210ccc4ea44b 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -340,6 +340,26 @@ static inline bool css_tryget_online(struct cgroup_subsys_state *css) + } + + /** ++ * css_is_dying - test whether the specified css is dying ++ * @css: target css ++ * ++ * Test whether @css is in the process of offlining or already offline. In ++ * most cases, ->css_online() and ->css_offline() callbacks should be ++ * enough; however, the actual offline operations are RCU delayed and this ++ * test returns %true also when @css is scheduled to be offlined. ++ * ++ * This is useful, for example, when the use case requires synchronous ++ * behavior with respect to cgroup removal. cgroup removal schedules css ++ * offlining but the css can seem alive while the operation is being ++ * delayed. If the delay affects user visible semantics, this test can be ++ * used to resolve the situation. ++ */ ++static inline bool css_is_dying(struct cgroup_subsys_state *css) ++{ ++ return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt); ++} ++ ++/** + * css_put - put a css reference + * @css: target css + * +diff --git a/include/linux/fs.h b/include/linux/fs.h +index e1a123760dbf..c8decb7075d6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -680,6 +680,11 @@ struct inode { + void *i_private; /* fs or device private pointer */ + }; + ++static inline unsigned int i_blocksize(const struct inode *node) ++{ ++ return (1 << node->i_blkbits); ++} ++ + static inline int inode_unhashed(struct inode *inode) + { + return hlist_unhashed(&inode->i_hash); +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index 24daf8fc4d7c..76b502c6258f 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -408,12 +408,20 @@ static inline void early_memtest(phys_addr_t start, phys_addr_t end) + } + #endif + ++extern unsigned long memblock_reserved_memory_within(phys_addr_t start_addr, ++ phys_addr_t end_addr); + #else + static inline phys_addr_t memblock_alloc(phys_addr_t size, phys_addr_t align) + { + return 0; + } + ++static inline unsigned long memblock_reserved_memory_within(phys_addr_t start_addr, ++ phys_addr_t end_addr) ++{ ++ return 0; ++} ++ + #endif /* CONFIG_HAVE_MEMBLOCK */ + + #endif /* __KERNEL__ */ +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 8f889c3..1822472 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1849,28 +1849,6 @@ unsigned long get_random_long(void) + EXPORT_SYMBOL(get_random_long); + + /* +- * Same as get_random_int(), but returns unsigned long. +- */ +-unsigned long get_random_long(void) +-{ +- __u32 *hash; +- unsigned long ret; +- +- if (arch_get_random_long(&ret)) +- return ret; +- +- hash = get_cpu_var(get_random_int_hash); +- +- hash[0] += current->pid + jiffies + random_get_entropy(); +- md5_transform(hash, random_int_secret); +- ret = *(unsigned long *)hash; +- put_cpu_var(get_random_int_hash); +- +- return ret; +-} +-EXPORT_SYMBOL(get_random_long); +- +-/* + * randomize_range() returns a start address such that + * + * [...... .....] +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index e23a9e704536..5b609a3ce3d7 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -688,6 +688,7 @@ typedef struct pglist_data { + * is the first PFN that needs to be initialised. + */ + unsigned long first_deferred_pfn; ++ unsigned long static_init_size; + #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */ + } pg_data_t; + +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index e13bfdf7f314..81fdf4b8aba4 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -50,7 +50,8 @@ extern int ptrace_request(struct task_struct *child, long request, + unsigned long addr, unsigned long data); + extern void ptrace_notify(int exit_code); + extern void __ptrace_link(struct task_struct *child, +- struct task_struct *new_parent); ++ struct task_struct *new_parent, ++ const struct cred *ptracer_cred); + extern void __ptrace_unlink(struct task_struct *child); + extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); + #define PTRACE_MODE_READ 0x01 +@@ -202,7 +203,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) + + if (unlikely(ptrace) && current->ptrace) { + child->ptrace = current->ptrace; +- __ptrace_link(child, current->parent); ++ __ptrace_link(child, current->parent, current->ptracer_cred); + + if (child->ptrace & PT_SEIZED) + task_set_jobctl_pending(child, JOBCTL_TRAP_STOP); +@@ -211,6 +212,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) + + set_tsk_thread_flag(child, TIF_SIGPENDING); + } ++ else ++ child->ptracer_cred = NULL; + } + + /** +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index d443d9ab0236..3f61c647fc5c 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1084,9 +1084,6 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from) + + static inline void skb_sender_cpu_clear(struct sk_buff *skb) + { +-#ifdef CONFIG_XPS +- skb->sender_cpu = 0; +-#endif + } + + #ifdef NET_SKBUFF_DATA_USES_OFFSET +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 9a5c9f013784..ad1d6039185d 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -958,6 +958,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row, + */ + extern const struct proto_ops inet6_stream_ops; + extern const struct proto_ops inet6_dgram_ops; ++extern const struct proto_ops inet6_sockraw_ops; + + struct group_source_req; + struct group_filter; +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index b271353d5202..3b5e5430f5d0 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -173,9 +173,9 @@ typedef enum { + } cpuset_flagbits_t; + + /* convenient tests for these bits */ +-static inline bool is_cpuset_online(const struct cpuset *cs) ++static inline bool is_cpuset_online(struct cpuset *cs) + { +- return test_bit(CS_ONLINE, &cs->flags); ++ return test_bit(CS_ONLINE, &cs->flags) && !css_is_dying(&cs->css); + } + + static inline int is_cpu_exclusive(const struct cpuset *cs) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 784ab8fe8714..22350b15b4e7 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6410,6 +6410,21 @@ static void perf_log_itrace_start(struct perf_event *event) + perf_output_end(&handle); + } + ++static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs) ++{ ++ /* ++ * Due to interrupt latency (AKA "skid"), we may enter the ++ * kernel before taking an overflow, even if the PMU is only ++ * counting user events. ++ * To avoid leaking information to userspace, we must always ++ * reject kernel samples when exclude_kernel is set. ++ */ ++ if (event->attr.exclude_kernel && !user_mode(regs)) ++ return false; ++ ++ return true; ++} ++ + /* + * Generic event overflow handling, sampling. + */ +@@ -6457,6 +6472,12 @@ static int __perf_event_overflow(struct perf_event *event, + } + + /* ++ * For security, drop the skid kernel samples if necessary. ++ */ ++ if (!sample_is_allowed(event, regs)) ++ return ret; ++ ++ /* + * XXX event_limit might not quite work as expected on inherited + * events + */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 0ee630f3ad4b..68cfda1c1800 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -368,7 +368,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) + set_task_stack_end_magic(tsk); + + #ifdef CONFIG_CC_STACKPROTECTOR +- tsk->stack_canary = get_random_int(); ++ tsk->stack_canary = get_random_long(); + #endif + + /* +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index c7e8ed99c953..5e2cd1030702 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -28,19 +28,25 @@ + #include + + ++void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, ++ const struct cred *ptracer_cred) ++{ ++ BUG_ON(!list_empty(&child->ptrace_entry)); ++ list_add(&child->ptrace_entry, &new_parent->ptraced); ++ child->parent = new_parent; ++ child->ptracer_cred = get_cred(ptracer_cred); ++} ++ + /* + * ptrace a task: make the debugger its new parent and + * move it to the ptrace list. + * + * Must be called with the tasklist lock write-held. + */ +-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) ++static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) + { +- BUG_ON(!list_empty(&child->ptrace_entry)); +- list_add(&child->ptrace_entry, &new_parent->ptraced); +- child->parent = new_parent; + rcu_read_lock(); +- child->ptracer_cred = get_cred(__task_cred(new_parent)); ++ __ptrace_link(child, new_parent, __task_cred(new_parent)); + rcu_read_unlock(); + } + +@@ -353,7 +359,7 @@ static int ptrace_attach(struct task_struct *task, long request, + flags |= PT_SEIZED; + task->ptrace = flags; + +- __ptrace_link(task, current); ++ ptrace_link(task, current); + + /* SEIZE doesn't trap tracee on attach */ + if (!seize) +@@ -420,7 +426,7 @@ static int ptrace_traceme(void) + */ + if (!ret && !(current->real_parent->flags & PF_EXITING)) { + current->ptrace = PT_PTRACED; +- __ptrace_link(current, current->real_parent); ++ ptrace_link(current, current->real_parent); + } + } + write_unlock_irq(&tasklist_lock); +diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c +index 0ecef3e4690e..5e6db6b1e3bd 100644 +--- a/lib/test_user_copy.c ++++ b/lib/test_user_copy.c +@@ -58,7 +58,9 @@ static int __init test_user_copy_init(void) + usermem = (char __user *)user_addr; + bad_usermem = (char *)user_addr; + +- /* Legitimate usage: none of these should fail. */ ++ /* ++ * Legitimate usage: none of these copies should fail. ++ */ + ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), + "legitimate copy_from_user failed"); + ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), +@@ -68,19 +70,33 @@ static int __init test_user_copy_init(void) + ret |= test(put_user(value, (unsigned long __user *)usermem), + "legitimate put_user failed"); + +- /* Invalid usage: none of these should succeed. */ ++ /* ++ * Invalid usage: none of these copies should succeed. ++ */ ++ ++ /* Reject kernel-to-kernel copies through copy_from_user(). */ + ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), + PAGE_SIZE), + "illegal all-kernel copy_from_user passed"); ++ ++#if 0 ++ /* ++ * When running with SMAP/PAN/etc, this will Oops the kernel ++ * due to the zeroing of userspace memory on failure. This needs ++ * to be tested in LKDTM instead, since this test module does not ++ * expect to explode. ++ */ + ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, + PAGE_SIZE), + "illegal reversed copy_from_user passed"); ++#endif + ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, + PAGE_SIZE), + "illegal all-kernel copy_to_user passed"); + ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, + PAGE_SIZE), + "illegal reversed copy_to_user passed"); ++ + ret |= test(!get_user(value, (unsigned long __user *)kmem), + "illegal get_user passed"); + ret |= test(!put_user(value, (unsigned long __user *)kmem), +diff --git a/mm/memblock.c b/mm/memblock.c +index d300f1329814..f8fab45bfdb7 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -1634,6 +1634,30 @@ static void __init_memblock memblock_dump(struct memblock_type *type, char *name + } + } + ++extern unsigned long __init_memblock ++memblock_reserved_memory_within(phys_addr_t start_addr, phys_addr_t end_addr) ++{ ++ struct memblock_type *type = &memblock.reserved; ++ unsigned long size = 0; ++ int idx; ++ ++ for (idx = 0; idx < type->cnt; idx++) { ++ struct memblock_region *rgn = &type->regions[idx]; ++ phys_addr_t start, end; ++ ++ if (rgn->base + rgn->size < start_addr) ++ continue; ++ if (rgn->base > end_addr) ++ continue; ++ ++ start = rgn->base; ++ end = start + rgn->size; ++ size += end - start; ++ } ++ ++ return size; ++} ++ + void __init_memblock __memblock_dump_all(void) + { + pr_info("MEMBLOCK configuration:\n"); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 6f9005dcca2e..bd17a6bdf131 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -269,6 +269,26 @@ int page_group_by_mobility_disabled __read_mostly; + #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT + static inline void reset_deferred_meminit(pg_data_t *pgdat) + { ++ unsigned long max_initialise; ++ unsigned long reserved_lowmem; ++ ++ /* ++ * Initialise at least 2G of a node but also take into account that ++ * two large system hashes that can take up 1GB for 0.25TB/node. ++ */ ++ max_initialise = max(2UL << (30 - PAGE_SHIFT), ++ (pgdat->node_spanned_pages >> 8)); ++ ++ /* ++ * Compensate the all the memblock reservations (e.g. crash kernel) ++ * from the initial estimation to make sure we will initialize enough ++ * memory to boot. ++ */ ++ reserved_lowmem = memblock_reserved_memory_within(pgdat->node_start_pfn, ++ pgdat->node_start_pfn + max_initialise); ++ max_initialise += reserved_lowmem; ++ ++ pgdat->static_init_size = min(max_initialise, pgdat->node_spanned_pages); + pgdat->first_deferred_pfn = ULONG_MAX; + } + +@@ -302,10 +322,9 @@ static inline bool update_defer_init(pg_data_t *pgdat, + /* Always populate low zones for address-contrained allocations */ + if (zone_end < pgdat_end_pfn(pgdat)) + return true; +- + /* Initialise at least 2G of the highest zone */ + (*nr_initialised)++; +- if (*nr_initialised > (2UL << (30 - PAGE_SHIFT)) && ++ if ((*nr_initialised > pgdat->static_init_size) && + (pfn & (PAGES_PER_SECTION - 1)) == 0) { + pgdat->first_deferred_pfn = pfn; + return false; +@@ -5343,7 +5362,6 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size, + /* pg_data_t should be reset to zero when it's allocated */ + WARN_ON(pgdat->nr_zones || pgdat->classzone_idx); + +- reset_deferred_meminit(pgdat); + pgdat->node_id = nid; + pgdat->node_start_pfn = node_start_pfn; + #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP +@@ -5362,6 +5380,7 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size, + (unsigned long)pgdat->node_mem_map); + #endif + ++ reset_deferred_meminit(pgdat); + free_area_init_core(pgdat); + } + +diff --git a/mm/truncate.c b/mm/truncate.c +index 76e35ad97102..f4c8270f7b84 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -732,7 +732,7 @@ EXPORT_SYMBOL(truncate_setsize); + */ + void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) + { +- int bsize = 1 << inode->i_blkbits; ++ int bsize = i_blocksize(inode); + loff_t rounded_from; + struct page *page; + pgoff_t index; +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index 57be733a99bc..bcb4559e735d 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -166,7 +166,8 @@ static void br_stp_start(struct net_bridge *br) + br_debug(br, "using kernel STP\n"); + + /* To start timers on any ports left in blocking */ +- mod_timer(&br->hello_timer, jiffies + br->hello_time); ++ if (br->dev->flags & IFF_UP) ++ mod_timer(&br->hello_timer, jiffies + br->hello_time); + br_port_state_selection(br); + } + +diff --git a/net/core/dev.c b/net/core/dev.c +index 48399d8ce614..87b8754f34ac 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -182,7 +182,7 @@ EXPORT_SYMBOL(dev_base_lock); + /* protects napi_hash addition/deletion and napi_gen_id */ + static DEFINE_SPINLOCK(napi_hash_lock); + +-static unsigned int napi_gen_id; ++static unsigned int napi_gen_id = NR_CPUS; + static DEFINE_HASHTABLE(napi_hash, 8); + + static seqcount_t devnet_rename_seq; +@@ -3049,7 +3049,9 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev, + int queue_index = 0; + + #ifdef CONFIG_XPS +- if (skb->sender_cpu == 0) ++ u32 sender_cpu = skb->sender_cpu - 1; ++ ++ if (sender_cpu >= (u32)NR_CPUS) + skb->sender_cpu = raw_smp_processor_id() + 1; + #endif + +@@ -4726,25 +4728,22 @@ EXPORT_SYMBOL_GPL(napi_by_id); + + void napi_hash_add(struct napi_struct *napi) + { +- if (!test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) { ++ if (test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) ++ return; + +- spin_lock(&napi_hash_lock); ++ spin_lock(&napi_hash_lock); + +- /* 0 is not a valid id, we also skip an id that is taken +- * we expect both events to be extremely rare +- */ +- napi->napi_id = 0; +- while (!napi->napi_id) { +- napi->napi_id = ++napi_gen_id; +- if (napi_by_id(napi->napi_id)) +- napi->napi_id = 0; +- } ++ /* 0..NR_CPUS+1 range is reserved for sender_cpu use */ ++ do { ++ if (unlikely(++napi_gen_id < NR_CPUS + 1)) ++ napi_gen_id = NR_CPUS + 1; ++ } while (napi_by_id(napi_gen_id)); ++ napi->napi_id = napi_gen_id; + +- hlist_add_head_rcu(&napi->napi_hash_node, +- &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]); ++ hlist_add_head_rcu(&napi->napi_hash_node, ++ &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]); + +- spin_unlock(&napi_hash_lock); +- } ++ spin_unlock(&napi_hash_lock); + } + EXPORT_SYMBOL_GPL(napi_hash_add); + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index afc18e9ca94a..967a47ff78a4 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1014,7 +1014,7 @@ static struct inet_protosw inetsw_array[] = + .type = SOCK_DGRAM, + .protocol = IPPROTO_ICMP, + .prot = &ping_prot, +- .ops = &inet_dgram_ops, ++ .ops = &inet_sockraw_ops, + .flags = INET_PROTOSW_REUSE, + }, + +diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c +index 882caa4e72bc..aafe68134763 100644 +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -183,6 +183,7 @@ void tcp_init_congestion_control(struct sock *sk) + { + const struct inet_connection_sock *icsk = inet_csk(sk); + ++ tcp_sk(sk)->prior_ssthresh = 0; + if (icsk->icsk_ca_ops->init) + icsk->icsk_ca_ops->init(sk); + if (tcp_ca_needs_ecn(sk)) +diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c +index 568bc0a52ca1..9e2ea4ae840d 100644 +--- a/net/ipv6/ip6_offload.c ++++ b/net/ipv6/ip6_offload.c +@@ -121,8 +121,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, + + if (udpfrag) { + int err = ip6_find_1stfragopt(skb, &prevhdr); +- if (err < 0) ++ if (err < 0) { ++ kfree_skb_list(segs); + return ERR_PTR(err); ++ } + fptr = (struct frag_hdr *)((u8 *)ipv6h + err); + fptr->frag_off = htons(offset); + if (skb->next) +diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c +index 3e55447b63a4..a830b68e63c9 100644 +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -50,7 +50,7 @@ static struct inet_protosw pingv6_protosw = { + .type = SOCK_DGRAM, + .protocol = IPPROTO_ICMPV6, + .prot = &pingv6_prot, +- .ops = &inet6_dgram_ops, ++ .ops = &inet6_sockraw_ops, + .flags = INET_PROTOSW_REUSE, + }; + +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index c93ede16795d..4d52a0e2f60d 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -1303,7 +1303,7 @@ void raw6_proc_exit(void) + #endif /* CONFIG_PROC_FS */ + + /* Same as inet6_dgram_ops, sans udp_poll. */ +-static const struct proto_ops inet6_sockraw_ops = { ++const struct proto_ops inet6_sockraw_ops = { + .family = PF_INET6, + .owner = THIS_MODULE, + .release = inet6_release, +diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c +index 0e015906f9ca..07d36573f50b 100644 +--- a/net/ipv6/xfrm6_mode_ro.c ++++ b/net/ipv6/xfrm6_mode_ro.c +@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb) + iph = ipv6_hdr(skb); + + hdr_len = x->type->hdr_offset(x, skb, &prevhdr); ++ if (hdr_len < 0) ++ return hdr_len; + skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data); + skb_set_network_header(skb, -x->props.header_len); + skb->transport_header = skb->network_header + hdr_len; +diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c +index 4e344105b3fd..1d3bbe6e1183 100644 +--- a/net/ipv6/xfrm6_mode_transport.c ++++ b/net/ipv6/xfrm6_mode_transport.c +@@ -28,6 +28,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb) + iph = ipv6_hdr(skb); + + hdr_len = x->type->hdr_offset(x, skb, &prevhdr); ++ if (hdr_len < 0) ++ return hdr_len; + skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data); + skb_set_network_header(skb, -x->props.header_len); + skb->transport_header = skb->network_header + hdr_len; +diff --git a/security/keys/key.c b/security/keys/key.c +index 534808915371..09c10b181881 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -934,12 +934,11 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen) + /* the key must be writable */ + ret = key_permission(key_ref, KEY_NEED_WRITE); + if (ret < 0) +- goto error; ++ return ret; + + /* attempt to update it if supported */ +- ret = -EOPNOTSUPP; + if (!key->type->update) +- goto error; ++ return -EOPNOTSUPP; + + memset(&prep, 0, sizeof(prep)); + prep.data = payload; +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index 442e350c209d..671709d8610d 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -97,7 +97,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, + /* pull the payload in if one was supplied */ + payload = NULL; + +- if (_payload) { ++ if (plen) { + ret = -ENOMEM; + payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN); + if (!payload) { +@@ -327,7 +327,7 @@ long keyctl_update_key(key_serial_t id, + + /* pull the payload in if one was supplied */ + payload = NULL; +- if (_payload) { ++ if (plen) { + ret = -ENOMEM; + payload = kmalloc(plen, GFP_KERNEL); + if (!payload) +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 278a332f97bd..48eaccba82a3 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1621,6 +1621,7 @@ static int snd_timer_user_tselect(struct file *file, + if (err < 0) + goto __err; + ++ tu->qhead = tu->qtail = tu->qused = 0; + kfree(tu->queue); + tu->queue = NULL; + kfree(tu->tqueue); +@@ -1958,6 +1959,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + + tu = file->private_data; + unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read); ++ mutex_lock(&tu->ioctl_lock); + spin_lock_irq(&tu->qlock); + while ((long)count - result >= unit) { + while (!tu->qused) { +@@ -1973,7 +1975,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + add_wait_queue(&tu->qchange_sleep, &wait); + + spin_unlock_irq(&tu->qlock); ++ mutex_unlock(&tu->ioctl_lock); + schedule(); ++ mutex_lock(&tu->ioctl_lock); + spin_lock_irq(&tu->qlock); + + remove_wait_queue(&tu->qchange_sleep, &wait); +@@ -1993,7 +1997,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + tu->qused--; + spin_unlock_irq(&tu->qlock); + +- mutex_lock(&tu->ioctl_lock); + if (tu->tread) { + if (copy_to_user(buffer, &tu->tqueue[qhead], + sizeof(struct snd_timer_tread))) +@@ -2003,7 +2006,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + sizeof(struct snd_timer_read))) + err = -EFAULT; + } +- mutex_unlock(&tu->ioctl_lock); + + spin_lock_irq(&tu->qlock); + if (err < 0) +@@ -2013,6 +2015,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + } + _error: + spin_unlock_irq(&tu->qlock); ++ mutex_unlock(&tu->ioctl_lock); + return result > 0 ? result : err; + } + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index a1305f827a98..fa6b74a304a7 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1775,6 +1775,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card) + for (i = 0; i < card->num_aux_devs; i++) + soc_remove_aux_dev(card, i); + ++ /* free the ALSA card at first; this syncs with pending operations */ ++ snd_card_free(card->snd_card); ++ + /* remove and free each DAI */ + soc_remove_dai_links(card); + +@@ -1786,9 +1789,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card) + + snd_soc_dapm_free(&card->dapm); + +- snd_card_free(card->snd_card); + return 0; +- + } + + /* removes a socdev */ diff --git a/patch/kernel/rockchip-default/03-patch-4.4.72-73.patch b/patch/kernel/rockchip-default/03-patch-4.4.72-73.patch new file mode 100644 index 0000000000..43d7eb9c83 --- /dev/null +++ b/patch/kernel/rockchip-default/03-patch-4.4.72-73.patch @@ -0,0 +1,2192 @@ +diff --git a/Makefile b/Makefile +index 94d663c935c0..ba5a70b6e32c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 72 ++SUBLEVEL = 73 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -789,7 +789,7 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) + KBUILD_ARFLAGS := $(call ar-option,D) + + # check for 'asm goto' +-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y) ++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) + KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO + KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO + endif +diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi +index 4b0ec0703825..8ca9217204a0 100644 +--- a/arch/arm/boot/dts/imx6dl.dtsi ++++ b/arch/arm/boot/dts/imx6dl.dtsi +@@ -30,7 +30,7 @@ + /* kHz uV */ + 996000 1250000 + 792000 1175000 +- 396000 1075000 ++ 396000 1150000 + >; + fsl,soc-operating-points = < + /* ARM kHz SOC-PU uV */ +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index 7460df3eec6b..4612ed7ec2e5 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -229,12 +229,17 @@ ENTRY(sie64a) + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce + .Lsie_done: + # some program checks are suppressing. C code (e.g. do_protection_exception) +-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other +-# instructions between sie64a and .Lsie_done should not cause program +-# interrupts. So lets use a nop (47 00 00 00) as a landing pad. ++# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There ++# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable. ++# Other instructions between sie64a and .Lsie_done should not cause program ++# interrupts. So lets use 3 nops as a landing pad for all possible rewinds. + # See also .Lcleanup_sie +-.Lrewind_pad: +- nop 0 ++.Lrewind_pad6: ++ nopr 7 ++.Lrewind_pad4: ++ nopr 7 ++.Lrewind_pad2: ++ nopr 7 + .globl sie_exit + sie_exit: + lg %r14,__SF_EMPTY+8(%r15) # load guest register save area +@@ -247,7 +252,9 @@ sie_exit: + stg %r14,__SF_EMPTY+16(%r15) # set exit reason code + j sie_exit + +- EX_TABLE(.Lrewind_pad,.Lsie_fault) ++ EX_TABLE(.Lrewind_pad6,.Lsie_fault) ++ EX_TABLE(.Lrewind_pad4,.Lsie_fault) ++ EX_TABLE(.Lrewind_pad2,.Lsie_fault) + EX_TABLE(sie_exit,.Lsie_fault) + #endif + +diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c +index ef7d6c8fea66..f354fd84adeb 100644 +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -372,7 +372,7 @@ void __init vmem_map_init(void) + ro_end = (unsigned long)&_eshared & PAGE_MASK; + for_each_memblock(memory, reg) { + start = reg->base; +- end = reg->base + reg->size - 1; ++ end = reg->base + reg->size; + if (start >= ro_end || end <= ro_start) + vmem_add_mem(start, end - start, 0); + else if (start >= ro_start && end <= ro_end) +diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c +index d21cd625c0de..cc97a43268ee 100644 +--- a/arch/sparc/kernel/traps_64.c ++++ b/arch/sparc/kernel/traps_64.c +@@ -85,7 +85,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p) + + void bad_trap(struct pt_regs *regs, long lvl) + { +- char buffer[32]; ++ char buffer[36]; + siginfo_t info; + + if (notify_die(DIE_TRAP, "bad trap", regs, +@@ -116,7 +116,7 @@ void bad_trap(struct pt_regs *regs, long lvl) + + void bad_trap_tl1(struct pt_regs *regs, long lvl) + { +- char buffer[32]; ++ char buffer[36]; + + if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs, + 0, lvl, SIGTRAP) == NOTIFY_STOP) +diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h +index f71f88ea7646..19707db966f1 100644 +--- a/arch/xtensa/include/asm/irq.h ++++ b/arch/xtensa/include/asm/irq.h +@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { } + # define PLATFORM_NR_IRQS 0 + #endif + #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS +-#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS) ++#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1) ++#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1) + + #if VARIANT_NR_IRQS == 0 + static inline void variant_init_irq(void) { } +diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c +index 4ac3d23161cf..441694464b1e 100644 +--- a/arch/xtensa/kernel/irq.c ++++ b/arch/xtensa/kernel/irq.c +@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs) + { + int irq = irq_find_mapping(NULL, hwirq); + +- if (hwirq >= NR_IRQS) { +- printk(KERN_EMERG "%s: cannot handle IRQ %d\n", +- __func__, hwirq); +- } +- + #ifdef CONFIG_DEBUG_STACKOVERFLOW + /* Debugging check for stack overflow: is there less than 1KB free? */ + { +diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h +index dbeea2b440a1..1fda7e20dfcb 100644 +--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h ++++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h +@@ -24,16 +24,18 @@ + + /* Interrupt configuration. */ + +-#define PLATFORM_NR_IRQS 10 ++#define PLATFORM_NR_IRQS 0 + + /* Default assignment of LX60 devices to external interrupts. */ + + #ifdef CONFIG_XTENSA_MX + #define DUART16552_INTNUM XCHAL_EXTINT3_NUM + #define OETH_IRQ XCHAL_EXTINT4_NUM ++#define C67X00_IRQ XCHAL_EXTINT8_NUM + #else + #define DUART16552_INTNUM XCHAL_EXTINT0_NUM + #define OETH_IRQ XCHAL_EXTINT1_NUM ++#define C67X00_IRQ XCHAL_EXTINT5_NUM + #endif + + /* +@@ -63,5 +65,5 @@ + + #define C67X00_PADDR (XCHAL_KIO_PADDR + 0x0D0D0000) + #define C67X00_SIZE 0x10 +-#define C67X00_IRQ 5 ++ + #endif /* __XTENSA_XTAVNET_HARDWARE_H */ +diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c +index e9f65f79cf2e..d1e9439fad45 100644 +--- a/arch/xtensa/platforms/xtfpga/setup.c ++++ b/arch/xtensa/platforms/xtfpga/setup.c +@@ -209,8 +209,8 @@ static struct resource ethoc_res[] = { + .flags = IORESOURCE_MEM, + }, + [2] = { /* IRQ number */ +- .start = OETH_IRQ, +- .end = OETH_IRQ, ++ .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ), ++ .end = XTENSA_PIC_LINUX_IRQ(OETH_IRQ), + .flags = IORESOURCE_IRQ, + }, + }; +@@ -246,8 +246,8 @@ static struct resource c67x00_res[] = { + .flags = IORESOURCE_MEM, + }, + [1] = { /* IRQ number */ +- .start = C67X00_IRQ, +- .end = C67X00_IRQ, ++ .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ), ++ .end = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ), + .flags = IORESOURCE_IRQ, + }, + }; +@@ -280,7 +280,7 @@ static struct resource serial_resource = { + static struct plat_serial8250_port serial_platform_data[] = { + [0] = { + .mapbase = DUART16552_PADDR, +- .irq = DUART16552_INTNUM, ++ .irq = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM), + .flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | + UPF_IOREMAP, + .iotype = UPIO_MEM32, +diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c +index 93e7c1b32edd..5610cd537da7 100644 +--- a/block/partitions/msdos.c ++++ b/block/partitions/msdos.c +@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_partitions *state, + continue; + bsd_start = le32_to_cpu(p->p_offset); + bsd_size = le32_to_cpu(p->p_size); ++ if (memcmp(flavour, "bsd\0", 4) == 0) ++ bsd_start += offset; + if (offset == bsd_start && size == bsd_size) + /* full parent partition, we have it already */ + continue; +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 3252429f96af..3a20dc594338 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -889,13 +889,13 @@ int __pm_runtime_idle(struct device *dev, int rpmflags) + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +- + if (rpmflags & RPM_GET_PUT) { + if (!atomic_dec_and_test(&dev->power.usage_count)) + return 0; + } + ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ + spin_lock_irqsave(&dev->power.lock, flags); + retval = rpm_idle(dev, rpmflags); + spin_unlock_irqrestore(&dev->power.lock, flags); +@@ -921,13 +921,13 @@ int __pm_runtime_suspend(struct device *dev, int rpmflags) + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +- + if (rpmflags & RPM_GET_PUT) { + if (!atomic_dec_and_test(&dev->power.usage_count)) + return 0; + } + ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ + spin_lock_irqsave(&dev->power.lock, flags); + retval = rpm_suspend(dev, rpmflags); + spin_unlock_irqrestore(&dev->power.lock, flags); +@@ -952,7 +952,8 @@ int __pm_runtime_resume(struct device *dev, int rpmflags) + unsigned long flags; + int retval; + +- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); ++ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe && ++ dev->power.runtime_status != RPM_ACTIVE); + + if (rpmflags & RPM_GET_PUT) + atomic_inc(&dev->power.usage_count); +diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h +index 05f6522c0457..b92139e9b9d8 100644 +--- a/drivers/gpu/drm/ast/ast_drv.h ++++ b/drivers/gpu/drm/ast/ast_drv.h +@@ -113,6 +113,7 @@ struct ast_private { + struct ttm_bo_kmap_obj cache_kmap; + int next_cursor; + bool support_wide_screen; ++ bool DisableP2A; + + enum ast_tx_chip tx_chip_type; + u8 dp501_maxclk; +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 9b8f0b975ca6..6c021165ca67 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -124,6 +124,12 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + } else + *need_post = false; + ++ /* Check P2A Access */ ++ ast->DisableP2A = true; ++ data = ast_read32(ast, 0xf004); ++ if (data != 0xFFFFFFFF) ++ ast->DisableP2A = false; ++ + /* Check if we support wide screen */ + switch (ast->chip) { + case AST1180: +@@ -140,15 +146,17 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + ast->support_wide_screen = true; + else { + ast->support_wide_screen = false; +- /* Read SCU7c (silicon revision register) */ +- ast_write32(ast, 0xf004, 0x1e6e0000); +- ast_write32(ast, 0xf000, 0x1); +- data = ast_read32(ast, 0x1207c); +- data &= 0x300; +- if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ +- ast->support_wide_screen = true; +- if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ +- ast->support_wide_screen = true; ++ if (ast->DisableP2A == false) { ++ /* Read SCU7c (silicon revision register) */ ++ ast_write32(ast, 0xf004, 0x1e6e0000); ++ ast_write32(ast, 0xf000, 0x1); ++ data = ast_read32(ast, 0x1207c); ++ data &= 0x300; ++ if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ ++ ast->support_wide_screen = true; ++ if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ ++ ast->support_wide_screen = true; ++ } + } + break; + } +@@ -216,80 +224,81 @@ static int ast_get_dram_info(struct drm_device *dev) + uint32_t data, data2; + uint32_t denum, num, div, ref_pll; + +- ast_write32(ast, 0xf004, 0x1e6e0000); +- ast_write32(ast, 0xf000, 0x1); +- +- +- ast_write32(ast, 0x10000, 0xfc600309); +- +- do { +- if (pci_channel_offline(dev->pdev)) +- return -EIO; +- } while (ast_read32(ast, 0x10000) != 0x01); +- data = ast_read32(ast, 0x10004); +- +- if (data & 0x40) ++ if (ast->DisableP2A) ++ { + ast->dram_bus_width = 16; ++ ast->dram_type = AST_DRAM_1Gx16; ++ ast->mclk = 396; ++ } + else +- ast->dram_bus_width = 32; ++ { ++ ast_write32(ast, 0xf004, 0x1e6e0000); ++ ast_write32(ast, 0xf000, 0x1); ++ data = ast_read32(ast, 0x10004); ++ ++ if (data & 0x40) ++ ast->dram_bus_width = 16; ++ else ++ ast->dram_bus_width = 32; ++ ++ if (ast->chip == AST2300 || ast->chip == AST2400) { ++ switch (data & 0x03) { ++ case 0: ++ ast->dram_type = AST_DRAM_512Mx16; ++ break; ++ default: ++ case 1: ++ ast->dram_type = AST_DRAM_1Gx16; ++ break; ++ case 2: ++ ast->dram_type = AST_DRAM_2Gx16; ++ break; ++ case 3: ++ ast->dram_type = AST_DRAM_4Gx16; ++ break; ++ } ++ } else { ++ switch (data & 0x0c) { ++ case 0: ++ case 4: ++ ast->dram_type = AST_DRAM_512Mx16; ++ break; ++ case 8: ++ if (data & 0x40) ++ ast->dram_type = AST_DRAM_1Gx16; ++ else ++ ast->dram_type = AST_DRAM_512Mx32; ++ break; ++ case 0xc: ++ ast->dram_type = AST_DRAM_1Gx32; ++ break; ++ } ++ } + +- if (ast->chip == AST2300 || ast->chip == AST2400) { +- switch (data & 0x03) { +- case 0: +- ast->dram_type = AST_DRAM_512Mx16; +- break; +- default: +- case 1: +- ast->dram_type = AST_DRAM_1Gx16; +- break; +- case 2: +- ast->dram_type = AST_DRAM_2Gx16; +- break; ++ data = ast_read32(ast, 0x10120); ++ data2 = ast_read32(ast, 0x10170); ++ if (data2 & 0x2000) ++ ref_pll = 14318; ++ else ++ ref_pll = 12000; ++ ++ denum = data & 0x1f; ++ num = (data & 0x3fe0) >> 5; ++ data = (data & 0xc000) >> 14; ++ switch (data) { + case 3: +- ast->dram_type = AST_DRAM_4Gx16; +- break; +- } +- } else { +- switch (data & 0x0c) { +- case 0: +- case 4: +- ast->dram_type = AST_DRAM_512Mx16; ++ div = 0x4; + break; +- case 8: +- if (data & 0x40) +- ast->dram_type = AST_DRAM_1Gx16; +- else +- ast->dram_type = AST_DRAM_512Mx32; ++ case 2: ++ case 1: ++ div = 0x2; + break; +- case 0xc: +- ast->dram_type = AST_DRAM_1Gx32; ++ default: ++ div = 0x1; + break; + } ++ ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); + } +- +- data = ast_read32(ast, 0x10120); +- data2 = ast_read32(ast, 0x10170); +- if (data2 & 0x2000) +- ref_pll = 14318; +- else +- ref_pll = 12000; +- +- denum = data & 0x1f; +- num = (data & 0x3fe0) >> 5; +- data = (data & 0xc000) >> 14; +- switch (data) { +- case 3: +- div = 0x4; +- break; +- case 2: +- case 1: +- div = 0x2; +- break; +- default: +- div = 0x1; +- break; +- } +- ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); + return 0; + } + +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index 30672a3df8a9..270e8fb2803f 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -375,12 +375,20 @@ void ast_post_gpu(struct drm_device *dev) + ast_enable_mmio(dev); + ast_set_def_ext_reg(dev); + +- if (ast->chip == AST2300 || ast->chip == AST2400) +- ast_init_dram_2300(dev); +- else +- ast_init_dram_reg(dev); ++ if (ast->DisableP2A == false) ++ { ++ if (ast->chip == AST2300 || ast->chip == AST2400) ++ ast_init_dram_2300(dev); ++ else ++ ast_init_dram_reg(dev); + +- ast_init_3rdtx(dev); ++ ast_init_3rdtx(dev); ++ } ++ else ++ { ++ if (ast->tx_chip_type != AST_TX_NONE) ++ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x80); /* Enable DVO */ ++ } + } + + /* AST 2300 DRAM settings */ +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c +index 58a3f7cf2fb3..00de1bf81519 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -370,7 +370,8 @@ nouveau_display_init(struct drm_device *dev) + return ret; + + /* enable polling for external displays */ +- drm_kms_helper_poll_enable(dev); ++ if (!dev->mode_config.poll_enabled) ++ drm_kms_helper_poll_enable(dev); + + /* enable hotplug interrupts */ + list_for_each_entry(connector, &dev->mode_config.connector_list, head) { +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index d236fc7c425b..91a61d2cca88 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -743,7 +743,10 @@ nouveau_pmops_runtime_resume(struct device *dev) + pci_set_master(pdev); + + ret = nouveau_do_resume(drm_dev, true); +- drm_kms_helper_poll_enable(drm_dev); ++ ++ if (!drm_dev->mode_config.poll_enabled) ++ drm_kms_helper_poll_enable(drm_dev); ++ + /* do magic */ + nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25)); + vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON); +diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h +index 2e3a62d38fe9..1621c8ae0fa0 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fence.h ++++ b/drivers/gpu/drm/nouveau/nouveau_fence.h +@@ -99,6 +99,7 @@ struct nv84_fence_priv { + struct nouveau_bo *bo; + struct nouveau_bo *bo_gart; + u32 *suspend; ++ struct mutex mutex; + }; + + u64 nv84_fence_crtc(struct nouveau_channel *, int); +diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c +index 6ae1b3494bcd..b7b961233949 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_usif.c ++++ b/drivers/gpu/drm/nouveau/nouveau_usif.c +@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc) + if (nvif_unpack(argv->v0, 0, 0, true)) { + /* block access to objects not created via this interface */ + owner = argv->v0.owner; +- if (argv->v0.object == 0ULL) ++ if (argv->v0.object == 0ULL && ++ argv->v0.type != NVIF_IOCTL_V0_DEL) + argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */ + else + argv->v0.owner = NVDRM_OBJECT_USIF; +diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c +index 412c5be5a9ca..7bc26eceda66 100644 +--- a/drivers/gpu/drm/nouveau/nv84_fence.c ++++ b/drivers/gpu/drm/nouveau/nv84_fence.c +@@ -121,8 +121,10 @@ nv84_fence_context_del(struct nouveau_channel *chan) + } + + nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence); ++ mutex_lock(&priv->mutex); + nouveau_bo_vma_del(priv->bo, &fctx->vma_gart); + nouveau_bo_vma_del(priv->bo, &fctx->vma); ++ mutex_unlock(&priv->mutex); + nouveau_fence_context_del(&fctx->base); + chan->fence = NULL; + nouveau_fence_context_free(&fctx->base); +@@ -148,11 +150,13 @@ nv84_fence_context_new(struct nouveau_channel *chan) + fctx->base.sync32 = nv84_fence_sync32; + fctx->base.sequence = nv84_fence_read(chan); + ++ mutex_lock(&priv->mutex); + ret = nouveau_bo_vma_add(priv->bo, cli->vm, &fctx->vma); + if (ret == 0) { + ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm, + &fctx->vma_gart); + } ++ mutex_unlock(&priv->mutex); + + /* map display semaphore buffers into channel's vm */ + for (i = 0; !ret && i < chan->drm->dev->mode_config.num_crtc; i++) { +@@ -232,6 +236,8 @@ nv84_fence_create(struct nouveau_drm *drm) + priv->base.context_base = fence_context_alloc(priv->base.contexts); + priv->base.uevent = true; + ++ mutex_init(&priv->mutex); ++ + /* Use VRAM if there is any ; otherwise fallback to system memory */ + domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM : + /* +diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c +index 630bce68bf38..b61db9db3ca5 100644 +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -54,7 +54,7 @@ + #define SMBSLVDAT (0xC + piix4_smba) + + /* count for request_region */ +-#define SMBIOSIZE 8 ++#define SMBIOSIZE 9 + + /* PCI Address Constants */ + #define SMBBA 0x090 +diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c +index bb3ac5fe5846..72a391e01011 100644 +--- a/drivers/irqchip/irq-xtensa-mx.c ++++ b/drivers/irqchip/irq-xtensa-mx.c +@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = { + int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent) + { + struct irq_domain *root_domain = +- irq_domain_add_legacy(NULL, NR_IRQS, 0, 0, ++ irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0, + &xtensa_mx_irq_domain_ops, + &xtensa_mx_irq_chip); + irq_set_default_host(root_domain); +diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c +index 472ae1770964..f728755fa292 100644 +--- a/drivers/irqchip/irq-xtensa-pic.c ++++ b/drivers/irqchip/irq-xtensa-pic.c +@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = { + int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent) + { + struct irq_domain *root_domain = +- irq_domain_add_legacy(NULL, NR_IRQS, 0, 0, ++ irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0, + &xtensa_irq_domain_ops, &xtensa_irq_chip); + irq_set_default_host(root_domain); + return 0; +diff --git a/drivers/net/ethernet/adaptec/starfire.c b/drivers/net/ethernet/adaptec/starfire.c +index ac7288240d55..f089fa954f42 100644 +--- a/drivers/net/ethernet/adaptec/starfire.c ++++ b/drivers/net/ethernet/adaptec/starfire.c +@@ -1153,6 +1153,12 @@ static void init_ring(struct net_device *dev) + if (skb == NULL) + break; + np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE); ++ if (pci_dma_mapping_error(np->pci_dev, ++ np->rx_info[i].mapping)) { ++ dev_kfree_skb(skb); ++ np->rx_info[i].skb = NULL; ++ break; ++ } + /* Grrr, we cannot offset to correctly align the IP header. */ + np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | RxDescValid); + } +@@ -1183,8 +1189,9 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) + { + struct netdev_private *np = netdev_priv(dev); + unsigned int entry; ++ unsigned int prev_tx; + u32 status; +- int i; ++ int i, j; + + /* + * be cautious here, wrapping the queue has weird semantics +@@ -1202,6 +1209,7 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) + } + #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */ + ++ prev_tx = np->cur_tx; + entry = np->cur_tx % TX_RING_SIZE; + for (i = 0; i < skb_num_frags(skb); i++) { + int wrap_ring = 0; +@@ -1235,6 +1243,11 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) + skb_frag_size(this_frag), + PCI_DMA_TODEVICE); + } ++ if (pci_dma_mapping_error(np->pci_dev, ++ np->tx_info[entry].mapping)) { ++ dev->stats.tx_dropped++; ++ goto err_out; ++ } + + np->tx_ring[entry].addr = cpu_to_dma(np->tx_info[entry].mapping); + np->tx_ring[entry].status = cpu_to_le32(status); +@@ -1269,8 +1282,30 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) + netif_stop_queue(dev); + + return NETDEV_TX_OK; +-} + ++err_out: ++ entry = prev_tx % TX_RING_SIZE; ++ np->tx_info[entry].skb = NULL; ++ if (i > 0) { ++ pci_unmap_single(np->pci_dev, ++ np->tx_info[entry].mapping, ++ skb_first_frag_len(skb), ++ PCI_DMA_TODEVICE); ++ np->tx_info[entry].mapping = 0; ++ entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE; ++ for (j = 1; j < i; j++) { ++ pci_unmap_single(np->pci_dev, ++ np->tx_info[entry].mapping, ++ skb_frag_size( ++ &skb_shinfo(skb)->frags[j-1]), ++ PCI_DMA_TODEVICE); ++ entry++; ++ } ++ } ++ dev_kfree_skb_any(skb); ++ np->cur_tx = prev_tx; ++ return NETDEV_TX_OK; ++} + + /* The interrupt handler does all of the Rx thread work and cleans up + after the Tx thread. */ +@@ -1570,6 +1605,12 @@ static void refill_rx_ring(struct net_device *dev) + break; /* Better luck next round. */ + np->rx_info[entry].mapping = + pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE); ++ if (pci_dma_mapping_error(np->pci_dev, ++ np->rx_info[entry].mapping)) { ++ dev_kfree_skb(skb); ++ np->rx_info[entry].skb = NULL; ++ break; ++ } + np->rx_ring[entry].rxaddr = + cpu_to_dma(np->rx_info[entry].mapping | RxDescValid); + } +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 3e233d924cce..6a061f17a44f 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1999,8 +1999,8 @@ static void free_skb_rx_queue(struct gfar_priv_rx_q *rx_queue) + if (!rxb->page) + continue; + +- dma_unmap_single(rx_queue->dev, rxb->dma, +- PAGE_SIZE, DMA_FROM_DEVICE); ++ dma_unmap_page(rx_queue->dev, rxb->dma, ++ PAGE_SIZE, DMA_FROM_DEVICE); + __free_page(rxb->page); + + rxb->page = NULL; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 08cef0dfb5db..2fa54b0b0679 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -105,8 +105,8 @@ int hns_nic_net_xmit_hw(struct net_device *ndev, + struct hns_nic_ring_data *ring_data) + { + struct hns_nic_priv *priv = netdev_priv(ndev); +- struct device *dev = priv->dev; + struct hnae_ring *ring = ring_data->ring; ++ struct device *dev = ring_to_dev(ring); + struct netdev_queue *dev_queue; + struct skb_frag_struct *frag; + int buf_num; +diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c +index 715de8affcc9..e203d0c4e5a3 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/catas.c ++++ b/drivers/net/ethernet/mellanox/mlx4/catas.c +@@ -158,7 +158,7 @@ static int mlx4_reset_slave(struct mlx4_dev *dev) + return -ETIMEDOUT; + } + +-static int mlx4_comm_internal_err(u32 slave_read) ++int mlx4_comm_internal_err(u32 slave_read) + { + return (u32)COMM_CHAN_EVENT_INTERNAL_ERR == + (slave_read & (u32)COMM_CHAN_EVENT_INTERNAL_ERR) ? 1 : 0; +diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c +index 0472941af820..1a134e08f010 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/intf.c ++++ b/drivers/net/ethernet/mellanox/mlx4/intf.c +@@ -218,6 +218,18 @@ void mlx4_unregister_device(struct mlx4_dev *dev) + struct mlx4_interface *intf; + + mlx4_stop_catas_poll(dev); ++ if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION && ++ mlx4_is_slave(dev)) { ++ /* In mlx4_remove_one on a VF */ ++ u32 slave_read = ++ swab32(readl(&mlx4_priv(dev)->mfunc.comm->slave_read)); ++ ++ if (mlx4_comm_internal_err(slave_read)) { ++ mlx4_dbg(dev, "%s: comm channel is down, entering error state.\n", ++ __func__); ++ mlx4_enter_error_state(dev->persist); ++ } ++ } + mutex_lock(&intf_mutex); + + list_for_each_entry(intf, &intf_list, list) +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index e1cf9036af22..f5fdbd53d052 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -1205,6 +1205,7 @@ void mlx4_qp_event(struct mlx4_dev *dev, u32 qpn, int event_type); + void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type); + + void mlx4_enter_error_state(struct mlx4_dev_persistent *persist); ++int mlx4_comm_internal_err(u32 slave_read); + + int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port, + enum mlx4_port_type *type); +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 549ad2018e7f..1e61d4da72db 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -171,6 +171,49 @@ static struct mdiobb_ops bb_ops = { + .get_mdio_data = ravb_get_mdio_data, + }; + ++/* Free TX skb function for AVB-IP */ ++static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only) ++{ ++ struct ravb_private *priv = netdev_priv(ndev); ++ struct net_device_stats *stats = &priv->stats[q]; ++ struct ravb_tx_desc *desc; ++ int free_num = 0; ++ int entry; ++ u32 size; ++ ++ for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { ++ bool txed; ++ ++ entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] * ++ NUM_TX_DESC); ++ desc = &priv->tx_ring[q][entry]; ++ txed = desc->die_dt == DT_FEMPTY; ++ if (free_txed_only && !txed) ++ break; ++ /* Descriptor type must be checked before all other reads */ ++ dma_rmb(); ++ size = le16_to_cpu(desc->ds_tagl) & TX_DS; ++ /* Free the original skb. */ ++ if (priv->tx_skb[q][entry / NUM_TX_DESC]) { ++ dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr), ++ size, DMA_TO_DEVICE); ++ /* Last packet descriptor? */ ++ if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) { ++ entry /= NUM_TX_DESC; ++ dev_kfree_skb_any(priv->tx_skb[q][entry]); ++ priv->tx_skb[q][entry] = NULL; ++ if (txed) ++ stats->tx_packets++; ++ } ++ free_num++; ++ } ++ if (txed) ++ stats->tx_bytes += size; ++ desc->die_dt = DT_EEMPTY; ++ } ++ return free_num; ++} ++ + /* Free skb's and DMA buffers for Ethernet AVB */ + static void ravb_ring_free(struct net_device *ndev, int q) + { +@@ -186,19 +229,21 @@ static void ravb_ring_free(struct net_device *ndev, int q) + kfree(priv->rx_skb[q]); + priv->rx_skb[q] = NULL; + +- /* Free TX skb ringbuffer */ +- if (priv->tx_skb[q]) { +- for (i = 0; i < priv->num_tx_ring[q]; i++) +- dev_kfree_skb(priv->tx_skb[q][i]); +- } +- kfree(priv->tx_skb[q]); +- priv->tx_skb[q] = NULL; +- + /* Free aligned TX buffers */ + kfree(priv->tx_align[q]); + priv->tx_align[q] = NULL; + + if (priv->rx_ring[q]) { ++ for (i = 0; i < priv->num_rx_ring[q]; i++) { ++ struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i]; ++ ++ if (!dma_mapping_error(ndev->dev.parent, ++ le32_to_cpu(desc->dptr))) ++ dma_unmap_single(ndev->dev.parent, ++ le32_to_cpu(desc->dptr), ++ PKT_BUF_SZ, ++ DMA_FROM_DEVICE); ++ } + ring_size = sizeof(struct ravb_ex_rx_desc) * + (priv->num_rx_ring[q] + 1); + dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q], +@@ -207,12 +252,20 @@ static void ravb_ring_free(struct net_device *ndev, int q) + } + + if (priv->tx_ring[q]) { ++ ravb_tx_free(ndev, q, false); ++ + ring_size = sizeof(struct ravb_tx_desc) * + (priv->num_tx_ring[q] * NUM_TX_DESC + 1); + dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q], + priv->tx_desc_dma[q]); + priv->tx_ring[q] = NULL; + } ++ ++ /* Free TX skb ringbuffer. ++ * SKBs are freed by ravb_tx_free() call above. ++ */ ++ kfree(priv->tx_skb[q]); ++ priv->tx_skb[q] = NULL; + } + + /* Format skb and descriptor buffer for Ethernet AVB */ +@@ -420,44 +473,6 @@ static int ravb_dmac_init(struct net_device *ndev) + return 0; + } + +-/* Free TX skb function for AVB-IP */ +-static int ravb_tx_free(struct net_device *ndev, int q) +-{ +- struct ravb_private *priv = netdev_priv(ndev); +- struct net_device_stats *stats = &priv->stats[q]; +- struct ravb_tx_desc *desc; +- int free_num = 0; +- int entry; +- u32 size; +- +- for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { +- entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] * +- NUM_TX_DESC); +- desc = &priv->tx_ring[q][entry]; +- if (desc->die_dt != DT_FEMPTY) +- break; +- /* Descriptor type must be checked before all other reads */ +- dma_rmb(); +- size = le16_to_cpu(desc->ds_tagl) & TX_DS; +- /* Free the original skb. */ +- if (priv->tx_skb[q][entry / NUM_TX_DESC]) { +- dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr), +- size, DMA_TO_DEVICE); +- /* Last packet descriptor? */ +- if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) { +- entry /= NUM_TX_DESC; +- dev_kfree_skb_any(priv->tx_skb[q][entry]); +- priv->tx_skb[q][entry] = NULL; +- stats->tx_packets++; +- } +- free_num++; +- } +- stats->tx_bytes += size; +- desc->die_dt = DT_EEMPTY; +- } +- return free_num; +-} +- + static void ravb_get_tx_tstamp(struct net_device *ndev) + { + struct ravb_private *priv = netdev_priv(ndev); +@@ -797,7 +812,7 @@ static int ravb_poll(struct napi_struct *napi, int budget) + spin_lock_irqsave(&priv->lock, flags); + /* Clear TX interrupt */ + ravb_write(ndev, ~mask, TIS); +- ravb_tx_free(ndev, q); ++ ravb_tx_free(ndev, q, true); + netif_wake_subqueue(ndev, q); + mmiowb(); + spin_unlock_irqrestore(&priv->lock, flags); +@@ -1393,7 +1408,8 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) + + priv->cur_tx[q] += NUM_TX_DESC; + if (priv->cur_tx[q] - priv->dirty_tx[q] > +- (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && !ravb_tx_free(ndev, q)) ++ (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && ++ !ravb_tx_free(ndev, q, true)) + netif_stop_subqueue(ndev, q); + + exit: +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index cf468c87ce57..4cb8b85cbf2c 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -100,6 +100,14 @@ + /* BUFFER_ALIGN(adr) calculates the number of bytes to the next alignment. */ + #define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32) adr)) % ALIGNMENT) + ++#ifdef __BIG_ENDIAN ++#define xemaclite_readl ioread32be ++#define xemaclite_writel iowrite32be ++#else ++#define xemaclite_readl ioread32 ++#define xemaclite_writel iowrite32 ++#endif ++ + /** + * struct net_local - Our private per device data + * @ndev: instance of the network device +@@ -158,15 +166,15 @@ static void xemaclite_enable_interrupts(struct net_local *drvdata) + u32 reg_data; + + /* Enable the Tx interrupts for the first Buffer */ +- reg_data = __raw_readl(drvdata->base_addr + XEL_TSR_OFFSET); +- __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK, +- drvdata->base_addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(drvdata->base_addr + XEL_TSR_OFFSET); ++ xemaclite_writel(reg_data | XEL_TSR_XMIT_IE_MASK, ++ drvdata->base_addr + XEL_TSR_OFFSET); + + /* Enable the Rx interrupts for the first buffer */ +- __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET); ++ xemaclite_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET); + + /* Enable the Global Interrupt Enable */ +- __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); ++ xemaclite_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); + } + + /** +@@ -181,17 +189,17 @@ static void xemaclite_disable_interrupts(struct net_local *drvdata) + u32 reg_data; + + /* Disable the Global Interrupt Enable */ +- __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); ++ xemaclite_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); + + /* Disable the Tx interrupts for the first buffer */ +- reg_data = __raw_readl(drvdata->base_addr + XEL_TSR_OFFSET); +- __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK), +- drvdata->base_addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(drvdata->base_addr + XEL_TSR_OFFSET); ++ xemaclite_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK), ++ drvdata->base_addr + XEL_TSR_OFFSET); + + /* Disable the Rx interrupts for the first buffer */ +- reg_data = __raw_readl(drvdata->base_addr + XEL_RSR_OFFSET); +- __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK), +- drvdata->base_addr + XEL_RSR_OFFSET); ++ reg_data = xemaclite_readl(drvdata->base_addr + XEL_RSR_OFFSET); ++ xemaclite_writel(reg_data & (~XEL_RSR_RECV_IE_MASK), ++ drvdata->base_addr + XEL_RSR_OFFSET); + } + + /** +@@ -323,7 +331,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, + byte_count = ETH_FRAME_LEN; + + /* Check if the expected buffer is available */ +- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); + if ((reg_data & (XEL_TSR_XMIT_BUSY_MASK | + XEL_TSR_XMIT_ACTIVE_MASK)) == 0) { + +@@ -336,7 +344,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, + + addr = (void __iomem __force *)((u32 __force)addr ^ + XEL_BUFFER_OFFSET); +- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); + + if ((reg_data & (XEL_TSR_XMIT_BUSY_MASK | + XEL_TSR_XMIT_ACTIVE_MASK)) != 0) +@@ -347,16 +355,16 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, + /* Write the frame to the buffer */ + xemaclite_aligned_write(data, (u32 __force *) addr, byte_count); + +- __raw_writel((byte_count & XEL_TPLR_LENGTH_MASK), +- addr + XEL_TPLR_OFFSET); ++ xemaclite_writel((byte_count & XEL_TPLR_LENGTH_MASK), ++ addr + XEL_TPLR_OFFSET); + + /* Update the Tx Status Register to indicate that there is a + * frame to send. Set the XEL_TSR_XMIT_ACTIVE_MASK flag which + * is used by the interrupt handler to check whether a frame + * has been transmitted */ +- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); + reg_data |= (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_XMIT_ACTIVE_MASK); +- __raw_writel(reg_data, addr + XEL_TSR_OFFSET); ++ xemaclite_writel(reg_data, addr + XEL_TSR_OFFSET); + + return 0; + } +@@ -371,7 +379,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, + * + * Return: Total number of bytes received + */ +-static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) ++static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen) + { + void __iomem *addr; + u16 length, proto_type; +@@ -381,7 +389,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) + addr = (drvdata->base_addr + drvdata->next_rx_buf_to_use); + + /* Verify which buffer has valid data */ +- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); + + if ((reg_data & XEL_RSR_RECV_DONE_MASK) == XEL_RSR_RECV_DONE_MASK) { + if (drvdata->rx_ping_pong != 0) +@@ -398,27 +406,28 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) + return 0; /* No data was available */ + + /* Verify that buffer has valid data */ +- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); + if ((reg_data & XEL_RSR_RECV_DONE_MASK) != + XEL_RSR_RECV_DONE_MASK) + return 0; /* No data was available */ + } + + /* Get the protocol type of the ethernet frame that arrived */ +- proto_type = ((ntohl(__raw_readl(addr + XEL_HEADER_OFFSET + ++ proto_type = ((ntohl(xemaclite_readl(addr + XEL_HEADER_OFFSET + + XEL_RXBUFF_OFFSET)) >> XEL_HEADER_SHIFT) & + XEL_RPLR_LENGTH_MASK); + + /* Check if received ethernet frame is a raw ethernet frame + * or an IP packet or an ARP packet */ +- if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) { ++ if (proto_type > ETH_DATA_LEN) { + + if (proto_type == ETH_P_IP) { +- length = ((ntohl(__raw_readl(addr + ++ length = ((ntohl(xemaclite_readl(addr + + XEL_HEADER_IP_LENGTH_OFFSET + + XEL_RXBUFF_OFFSET)) >> + XEL_HEADER_SHIFT) & + XEL_RPLR_LENGTH_MASK); ++ length = min_t(u16, length, ETH_DATA_LEN); + length += ETH_HLEN + ETH_FCS_LEN; + + } else if (proto_type == ETH_P_ARP) +@@ -431,14 +440,17 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) + /* Use the length in the frame, plus the header and trailer */ + length = proto_type + ETH_HLEN + ETH_FCS_LEN; + ++ if (WARN_ON(length > maxlen)) ++ length = maxlen; ++ + /* Read from the EmacLite device */ + xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET), + data, length); + + /* Acknowledge the frame */ +- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); + reg_data &= ~XEL_RSR_RECV_DONE_MASK; +- __raw_writel(reg_data, addr + XEL_RSR_OFFSET); ++ xemaclite_writel(reg_data, addr + XEL_RSR_OFFSET); + + return length; + } +@@ -465,14 +477,14 @@ static void xemaclite_update_address(struct net_local *drvdata, + + xemaclite_aligned_write(address_ptr, (u32 __force *) addr, ETH_ALEN); + +- __raw_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET); ++ xemaclite_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET); + + /* Update the MAC address in the EmacLite */ +- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); +- __raw_writel(reg_data | XEL_TSR_PROG_MAC_ADDR, addr + XEL_TSR_OFFSET); ++ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); ++ xemaclite_writel(reg_data | XEL_TSR_PROG_MAC_ADDR, addr + XEL_TSR_OFFSET); + + /* Wait for EmacLite to finish with the MAC address update */ +- while ((__raw_readl(addr + XEL_TSR_OFFSET) & ++ while ((xemaclite_readl(addr + XEL_TSR_OFFSET) & + XEL_TSR_PROG_MAC_ADDR) != 0) + ; + } +@@ -605,7 +617,7 @@ static void xemaclite_rx_handler(struct net_device *dev) + + skb_reserve(skb, 2); + +- len = xemaclite_recv_data(lp, (u8 *) skb->data); ++ len = xemaclite_recv_data(lp, (u8 *) skb->data, len); + + if (!len) { + dev->stats.rx_errors++; +@@ -642,32 +654,32 @@ static irqreturn_t xemaclite_interrupt(int irq, void *dev_id) + u32 tx_status; + + /* Check if there is Rx Data available */ +- if ((__raw_readl(base_addr + XEL_RSR_OFFSET) & ++ if ((xemaclite_readl(base_addr + XEL_RSR_OFFSET) & + XEL_RSR_RECV_DONE_MASK) || +- (__raw_readl(base_addr + XEL_BUFFER_OFFSET + XEL_RSR_OFFSET) ++ (xemaclite_readl(base_addr + XEL_BUFFER_OFFSET + XEL_RSR_OFFSET) + & XEL_RSR_RECV_DONE_MASK)) + + xemaclite_rx_handler(dev); + + /* Check if the Transmission for the first buffer is completed */ +- tx_status = __raw_readl(base_addr + XEL_TSR_OFFSET); ++ tx_status = xemaclite_readl(base_addr + XEL_TSR_OFFSET); + if (((tx_status & XEL_TSR_XMIT_BUSY_MASK) == 0) && + (tx_status & XEL_TSR_XMIT_ACTIVE_MASK) != 0) { + + tx_status &= ~XEL_TSR_XMIT_ACTIVE_MASK; +- __raw_writel(tx_status, base_addr + XEL_TSR_OFFSET); ++ xemaclite_writel(tx_status, base_addr + XEL_TSR_OFFSET); + + tx_complete = true; + } + + /* Check if the Transmission for the second buffer is completed */ +- tx_status = __raw_readl(base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); ++ tx_status = xemaclite_readl(base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); + if (((tx_status & XEL_TSR_XMIT_BUSY_MASK) == 0) && + (tx_status & XEL_TSR_XMIT_ACTIVE_MASK) != 0) { + + tx_status &= ~XEL_TSR_XMIT_ACTIVE_MASK; +- __raw_writel(tx_status, base_addr + XEL_BUFFER_OFFSET + +- XEL_TSR_OFFSET); ++ xemaclite_writel(tx_status, base_addr + XEL_BUFFER_OFFSET + ++ XEL_TSR_OFFSET); + + tx_complete = true; + } +@@ -700,7 +712,7 @@ static int xemaclite_mdio_wait(struct net_local *lp) + /* wait for the MDIO interface to not be busy or timeout + after some time. + */ +- while (__raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) & ++ while (xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) & + XEL_MDIOCTRL_MDIOSTS_MASK) { + if (time_before_eq(end, jiffies)) { + WARN_ON(1); +@@ -736,17 +748,17 @@ static int xemaclite_mdio_read(struct mii_bus *bus, int phy_id, int reg) + * MDIO Address register. Set the Status bit in the MDIO Control + * register to start a MDIO read transaction. + */ +- ctrl_reg = __raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); +- __raw_writel(XEL_MDIOADDR_OP_MASK | +- ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), +- lp->base_addr + XEL_MDIOADDR_OFFSET); +- __raw_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, +- lp->base_addr + XEL_MDIOCTRL_OFFSET); ++ ctrl_reg = xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); ++ xemaclite_writel(XEL_MDIOADDR_OP_MASK | ++ ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), ++ lp->base_addr + XEL_MDIOADDR_OFFSET); ++ xemaclite_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, ++ lp->base_addr + XEL_MDIOCTRL_OFFSET); + + if (xemaclite_mdio_wait(lp)) + return -ETIMEDOUT; + +- rc = __raw_readl(lp->base_addr + XEL_MDIORD_OFFSET); ++ rc = xemaclite_readl(lp->base_addr + XEL_MDIORD_OFFSET); + + dev_dbg(&lp->ndev->dev, + "xemaclite_mdio_read(phy_id=%i, reg=%x) == %x\n", +@@ -783,13 +795,13 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg, + * Data register. Finally, set the Status bit in the MDIO Control + * register to start a MDIO write transaction. + */ +- ctrl_reg = __raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); +- __raw_writel(~XEL_MDIOADDR_OP_MASK & +- ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), +- lp->base_addr + XEL_MDIOADDR_OFFSET); +- __raw_writel(val, lp->base_addr + XEL_MDIOWR_OFFSET); +- __raw_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, +- lp->base_addr + XEL_MDIOCTRL_OFFSET); ++ ctrl_reg = xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); ++ xemaclite_writel(~XEL_MDIOADDR_OP_MASK & ++ ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), ++ lp->base_addr + XEL_MDIOADDR_OFFSET); ++ xemaclite_writel(val, lp->base_addr + XEL_MDIOWR_OFFSET); ++ xemaclite_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, ++ lp->base_addr + XEL_MDIOCTRL_OFFSET); + + return 0; + } +@@ -836,8 +848,8 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) + /* Enable the MDIO bus by asserting the enable bit in MDIO Control + * register. + */ +- __raw_writel(XEL_MDIOCTRL_MDIOEN_MASK, +- lp->base_addr + XEL_MDIOCTRL_OFFSET); ++ xemaclite_writel(XEL_MDIOCTRL_MDIOEN_MASK, ++ lp->base_addr + XEL_MDIOCTRL_OFFSET); + + bus = mdiobus_alloc(); + if (!bus) { +@@ -1141,8 +1153,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) + dev_warn(dev, "No MAC address found\n"); + + /* Clear the Tx CSR's in case this is a restart */ +- __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET); +- __raw_writel(0, lp->base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); ++ xemaclite_writel(0, lp->base_addr + XEL_TSR_OFFSET); ++ xemaclite_writel(0, lp->base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); + + /* Set the MAC address in the EmacLite device */ + xemaclite_update_address(lp, ndev->dev_addr); +diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c +index 85828f153445..0758d0816840 100644 +--- a/drivers/net/hamradio/mkiss.c ++++ b/drivers/net/hamradio/mkiss.c +@@ -648,8 +648,8 @@ static void ax_setup(struct net_device *dev) + { + /* Finish setting up the DEVICE info. */ + dev->mtu = AX_MTU; +- dev->hard_header_len = 0; +- dev->addr_len = 0; ++ dev->hard_header_len = AX25_MAX_HEADER_LEN; ++ dev->addr_len = AX25_ADDR_LEN; + dev->type = ARPHRD_AX25; + dev->tx_queue_len = 10; + dev->header_ops = &ax25_header_ops; +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index fbb1867ff25c..1c27e6fb99f9 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -1851,6 +1851,9 @@ static int r8152_poll(struct napi_struct *napi, int budget) + napi_complete(napi); + if (!list_empty(&tp->rx_done)) + napi_schedule(napi); ++ else if (!skb_queue_empty(&tp->tx_queue) && ++ !list_empty(&tp->tx_free)) ++ napi_schedule(napi); + } + + return work_done; +@@ -2990,10 +2993,13 @@ static void set_carrier(struct r8152 *tp) + if (!netif_carrier_ok(netdev)) { + tp->rtl_ops.enable(tp); + set_bit(RTL8152_SET_RX_MODE, &tp->flags); ++ netif_stop_queue(netdev); + napi_disable(&tp->napi); + netif_carrier_on(netdev); + rtl_start_rx(tp); + napi_enable(&tp->napi); ++ netif_wake_queue(netdev); ++ netif_info(tp, link, netdev, "carrier on\n"); + } + } else { + if (netif_carrier_ok(netdev)) { +@@ -3001,6 +3007,7 @@ static void set_carrier(struct r8152 *tp) + napi_disable(&tp->napi); + tp->rtl_ops.disable(tp); + napi_enable(&tp->napi); ++ netif_info(tp, link, netdev, "carrier off\n"); + } + } + } +@@ -3385,12 +3392,12 @@ static int rtl8152_pre_reset(struct usb_interface *intf) + if (!netif_running(netdev)) + return 0; + ++ netif_stop_queue(netdev); + napi_disable(&tp->napi); + clear_bit(WORK_ENABLE, &tp->flags); + usb_kill_urb(tp->intr_urb); + cancel_delayed_work_sync(&tp->schedule); + if (netif_carrier_ok(netdev)) { +- netif_stop_queue(netdev); + mutex_lock(&tp->control); + tp->rtl_ops.disable(tp); + mutex_unlock(&tp->control); +@@ -3415,12 +3422,14 @@ static int rtl8152_post_reset(struct usb_interface *intf) + if (netif_carrier_ok(netdev)) { + mutex_lock(&tp->control); + tp->rtl_ops.enable(tp); ++ rtl_start_rx(tp); + rtl8152_set_rx_mode(netdev); + mutex_unlock(&tp->control); +- netif_wake_queue(netdev); + } + + napi_enable(&tp->napi); ++ netif_wake_queue(netdev); ++ usb_submit_urb(tp->intr_urb, GFP_KERNEL); + + return 0; + } +diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c +index a251588762ec..0b5a84c9022c 100644 +--- a/drivers/net/usb/sierra_net.c ++++ b/drivers/net/usb/sierra_net.c +@@ -73,8 +73,6 @@ static atomic_t iface_counter = ATOMIC_INIT(0); + /* Private data structure */ + struct sierra_net_data { + +- u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */ +- + u16 link_up; /* air link up or down */ + u8 tx_hdr_template[4]; /* part of HIP hdr for tx'd packets */ + +@@ -122,6 +120,7 @@ struct param { + + /* LSI Protocol types */ + #define SIERRA_NET_PROTOCOL_UMTS 0x01 ++#define SIERRA_NET_PROTOCOL_UMTS_DS 0x04 + /* LSI Coverage */ + #define SIERRA_NET_COVERAGE_NONE 0x00 + #define SIERRA_NET_COVERAGE_NOPACKET 0x01 +@@ -129,7 +128,8 @@ struct param { + /* LSI Session */ + #define SIERRA_NET_SESSION_IDLE 0x00 + /* LSI Link types */ +-#define SIERRA_NET_AS_LINK_TYPE_IPv4 0x00 ++#define SIERRA_NET_AS_LINK_TYPE_IPV4 0x00 ++#define SIERRA_NET_AS_LINK_TYPE_IPV6 0x02 + + struct lsi_umts { + u8 protocol; +@@ -137,9 +137,14 @@ struct lsi_umts { + __be16 length; + /* eventually use a union for the rest - assume umts for now */ + u8 coverage; +- u8 unused2[41]; ++ u8 network_len; /* network name len */ ++ u8 network[40]; /* network name (UCS2, bigendian) */ + u8 session_state; + u8 unused3[33]; ++} __packed; ++ ++struct lsi_umts_single { ++ struct lsi_umts lsi; + u8 link_type; + u8 pdp_addr_len; /* NW-supplied PDP address len */ + u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */ +@@ -158,10 +163,31 @@ struct lsi_umts { + u8 reserved[8]; + } __packed; + ++struct lsi_umts_dual { ++ struct lsi_umts lsi; ++ u8 pdp_addr4_len; /* NW-supplied PDP IPv4 address len */ ++ u8 pdp_addr4[4]; /* NW-supplied PDP IPv4 address (bigendian)) */ ++ u8 pdp_addr6_len; /* NW-supplied PDP IPv6 address len */ ++ u8 pdp_addr6[16]; /* NW-supplied PDP IPv6 address (bigendian)) */ ++ u8 unused4[23]; ++ u8 dns1_addr4_len; /* NW-supplied 1st DNS v4 address len (bigendian) */ ++ u8 dns1_addr4[4]; /* NW-supplied 1st DNS v4 address */ ++ u8 dns1_addr6_len; /* NW-supplied 1st DNS v6 address len */ ++ u8 dns1_addr6[16]; /* NW-supplied 1st DNS v6 address (bigendian)*/ ++ u8 dns2_addr4_len; /* NW-supplied 2nd DNS v4 address len (bigendian) */ ++ u8 dns2_addr4[4]; /* NW-supplied 2nd DNS v4 address */ ++ u8 dns2_addr6_len; /* NW-supplied 2nd DNS v6 address len */ ++ u8 dns2_addr6[16]; /* NW-supplied 2nd DNS v6 address (bigendian)*/ ++ u8 unused5[68]; ++} __packed; ++ + #define SIERRA_NET_LSI_COMMON_LEN 4 +-#define SIERRA_NET_LSI_UMTS_LEN (sizeof(struct lsi_umts)) ++#define SIERRA_NET_LSI_UMTS_LEN (sizeof(struct lsi_umts_single)) + #define SIERRA_NET_LSI_UMTS_STATUS_LEN \ + (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN) ++#define SIERRA_NET_LSI_UMTS_DS_LEN (sizeof(struct lsi_umts_dual)) ++#define SIERRA_NET_LSI_UMTS_DS_STATUS_LEN \ ++ (SIERRA_NET_LSI_UMTS_DS_LEN - SIERRA_NET_LSI_COMMON_LEN) + + /* Forward definitions */ + static void sierra_sync_timer(unsigned long syncdata); +@@ -191,10 +217,11 @@ static inline void sierra_net_set_private(struct usbnet *dev, + dev->data[0] = (unsigned long)priv; + } + +-/* is packet IPv4 */ ++/* is packet IPv4/IPv6 */ + static inline int is_ip(struct sk_buff *skb) + { +- return skb->protocol == cpu_to_be16(ETH_P_IP); ++ return skb->protocol == cpu_to_be16(ETH_P_IP) || ++ skb->protocol == cpu_to_be16(ETH_P_IPV6); + } + + /* +@@ -350,49 +377,54 @@ static inline int sierra_net_is_valid_addrlen(u8 len) + static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen) + { + struct lsi_umts *lsi = (struct lsi_umts *)data; ++ u32 expected_length; + +- if (datalen < sizeof(struct lsi_umts)) { +- netdev_err(dev->net, "%s: Data length %d, exp %Zu\n", +- __func__, datalen, +- sizeof(struct lsi_umts)); ++ if (datalen < sizeof(struct lsi_umts_single)) { ++ netdev_err(dev->net, "%s: Data length %d, exp >= %Zu\n", ++ __func__, datalen, sizeof(struct lsi_umts_single)); + return -1; + } + +- if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) { +- netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n", +- __func__, be16_to_cpu(lsi->length), +- (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN); +- return -1; ++ /* Validate the session state */ ++ if (lsi->session_state == SIERRA_NET_SESSION_IDLE) { ++ netdev_err(dev->net, "Session idle, 0x%02x\n", ++ lsi->session_state); ++ return 0; + } + + /* Validate the protocol - only support UMTS for now */ +- if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) { ++ if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS) { ++ struct lsi_umts_single *single = (struct lsi_umts_single *)lsi; ++ ++ /* Validate the link type */ ++ if (single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV4 && ++ single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV6) { ++ netdev_err(dev->net, "Link type unsupported: 0x%02x\n", ++ single->link_type); ++ return -1; ++ } ++ expected_length = SIERRA_NET_LSI_UMTS_STATUS_LEN; ++ } else if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS_DS) { ++ expected_length = SIERRA_NET_LSI_UMTS_DS_STATUS_LEN; ++ } else { + netdev_err(dev->net, "Protocol unsupported, 0x%02x\n", +- lsi->protocol); ++ lsi->protocol); + return -1; + } + +- /* Validate the link type */ +- if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) { +- netdev_err(dev->net, "Link type unsupported: 0x%02x\n", +- lsi->link_type); ++ if (be16_to_cpu(lsi->length) != expected_length) { ++ netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n", ++ __func__, be16_to_cpu(lsi->length), expected_length); + return -1; + } + + /* Validate the coverage */ +- if (lsi->coverage == SIERRA_NET_COVERAGE_NONE +- || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) { ++ if (lsi->coverage == SIERRA_NET_COVERAGE_NONE || ++ lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) { + netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage); + return 0; + } + +- /* Validate the session state */ +- if (lsi->session_state == SIERRA_NET_SESSION_IDLE) { +- netdev_err(dev->net, "Session idle, 0x%02x\n", +- lsi->session_state); +- return 0; +- } +- + /* Set link_sense true */ + return 1; + } +@@ -662,7 +694,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) + u8 numendpoints; + u16 fwattr = 0; + int status; +- struct ethhdr *eth; + struct sierra_net_data *priv; + static const u8 sync_tmplate[sizeof(priv->sync_msg)] = { + 0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00}; +@@ -700,11 +731,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) + dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter); + dev->net->dev_addr[ETH_ALEN-1] = ifacenum; + +- /* we will have to manufacture ethernet headers, prepare template */ +- eth = (struct ethhdr *)priv->ethr_hdr_tmpl; +- memcpy(ð->h_dest, dev->net->dev_addr, ETH_ALEN); +- eth->h_proto = cpu_to_be16(ETH_P_IP); +- + /* prepare shutdown message template */ + memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg)); + /* set context index initially to 0 - prepares tx hdr template */ +@@ -833,9 +859,14 @@ static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + + skb_pull(skb, hh.hdrlen); + +- /* We are going to accept this packet, prepare it */ +- memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl, +- ETH_HLEN); ++ /* We are going to accept this packet, prepare it. ++ * In case protocol is IPv6, keep it, otherwise force IPv4. ++ */ ++ skb_reset_mac_header(skb); ++ if (eth_hdr(skb)->h_proto != cpu_to_be16(ETH_P_IPV6)) ++ eth_hdr(skb)->h_proto = cpu_to_be16(ETH_P_IP); ++ eth_zero_addr(eth_hdr(skb)->h_source); ++ memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN); + + /* Last packet in batch handled by usbnet */ + if (hh.payload_len.word == skb->len) +diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c +index 6e3a60c78873..50f3bb0dd1f1 100644 +--- a/drivers/parport/parport_gsc.c ++++ b/drivers/parport/parport_gsc.c +@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(unsigned long base, + p->irq = PARPORT_IRQ_NONE; + } + if (p->irq != PARPORT_IRQ_NONE) { +- printk(", irq %d", p->irq); ++ pr_cont(", irq %d", p->irq); + + if (p->dma == PARPORT_DMA_AUTO) { + p->dma = PARPORT_DMA_NONE; +@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(unsigned long base, + is mandatory (see above) */ + p->dma = PARPORT_DMA_NONE; + +- printk(" ["); +-#define printmode(x) {if(p->modes&PARPORT_MODE_##x){printk("%s%s",f?",":"",#x);f++;}} ++ pr_cont(" ["); ++#define printmode(x) {if(p->modes&PARPORT_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}} + { + int f = 0; + printmode(PCSPP); +@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(unsigned long base, + // printmode(DMA); + } + #undef printmode +- printk("]\n"); ++ pr_cont("]\n"); + + if (p->irq != PARPORT_IRQ_NONE) { + if (request_irq (p->irq, parport_irq_handler, +diff --git a/drivers/pinctrl/berlin/berlin-bg4ct.c b/drivers/pinctrl/berlin/berlin-bg4ct.c +index 09172043d589..c617ec49e9ed 100644 +--- a/drivers/pinctrl/berlin/berlin-bg4ct.c ++++ b/drivers/pinctrl/berlin/berlin-bg4ct.c +@@ -217,7 +217,7 @@ static const struct berlin_desc_group berlin4ct_soc_pinctrl_groups[] = { + BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15, + BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */ + BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */ +- BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */ ++ BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */ + BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18, + BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */ + BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */ +diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +index 79bf13f5c0d1..7a8ceb961bb6 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c ++++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c +@@ -1185,8 +1185,7 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, + struct cb_desc *cb_desc, struct sk_buff *skb) + { + struct r8192_priv *priv = rtllib_priv(dev); +- dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len, +- PCI_DMA_TODEVICE); ++ dma_addr_t mapping; + struct tx_fwinfo_8190pci *pTxFwInfo = NULL; + + pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data; +@@ -1197,8 +1196,6 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, + pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT, + pTxFwInfo->TxRate, cb_desc); + +- if (pci_dma_mapping_error(priv->pdev, mapping)) +- netdev_err(dev, "%s(): DMA Mapping error\n", __func__); + if (cb_desc->bAMPDUEnable) { + pTxFwInfo->AllowAggregation = 1; + pTxFwInfo->RxMF = cb_desc->ampdu_factor; +@@ -1233,6 +1230,14 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, + } + + memset((u8 *)pdesc, 0, 12); ++ ++ mapping = pci_map_single(priv->pdev, skb->data, skb->len, ++ PCI_DMA_TODEVICE); ++ if (pci_dma_mapping_error(priv->pdev, mapping)) { ++ netdev_err(dev, "%s(): DMA Mapping error\n", __func__); ++ return; ++ } ++ + pdesc->LINIP = 0; + pdesc->CmdInit = 1; + pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 156bc18eac69..53a827c6d8b1 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -412,6 +412,9 @@ cifs_reconnect(struct TCP_Server_Info *server) + } + } while (server->tcpStatus == CifsNeedReconnect); + ++ if (server->tcpStatus == CifsNeedNegotiate) ++ mod_delayed_work(cifsiod_wq, &server->echo, 0); ++ + return rc; + } + +@@ -421,18 +424,27 @@ cifs_echo_request(struct work_struct *work) + int rc; + struct TCP_Server_Info *server = container_of(work, + struct TCP_Server_Info, echo.work); ++ unsigned long echo_interval; ++ ++ /* ++ * If we need to renegotiate, set echo interval to zero to ++ * immediately call echo service where we can renegotiate. ++ */ ++ if (server->tcpStatus == CifsNeedNegotiate) ++ echo_interval = 0; ++ else ++ echo_interval = SMB_ECHO_INTERVAL; + + /* +- * We cannot send an echo if it is disabled or until the +- * NEGOTIATE_PROTOCOL request is done, which is indicated by +- * server->ops->need_neg() == true. Also, no need to ping if +- * we got a response recently. ++ * We cannot send an echo if it is disabled. ++ * Also, no need to ping if we got a response recently. + */ + + if (server->tcpStatus == CifsNeedReconnect || +- server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew || ++ server->tcpStatus == CifsExiting || ++ server->tcpStatus == CifsNew || + (server->ops->can_echo && !server->ops->can_echo(server)) || +- time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ)) ++ time_before(jiffies, server->lstrp + echo_interval - HZ)) + goto requeue_echo; + + rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS; +diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c +index 4304072161aa..40d61077bead 100644 +--- a/fs/fscache/cookie.c ++++ b/fs/fscache/cookie.c +@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate) + hlist_for_each_entry(object, &cookie->backing_objects, cookie_link) { + if (invalidate) + set_bit(FSCACHE_OBJECT_RETIRED, &object->flags); ++ clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags); + fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL); + } + } else { +@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate) + wait_on_atomic_t(&cookie->n_active, fscache_wait_atomic_t, + TASK_UNINTERRUPTIBLE); + ++ /* Make sure any pending writes are cancelled. */ ++ if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX) ++ fscache_invalidate_writes(cookie); ++ + /* Reset the cookie state if it wasn't relinquished */ + if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, &cookie->flags)) { + atomic_inc(&cookie->n_active); +diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c +index 9b28649df3a1..a8aa00be4444 100644 +--- a/fs/fscache/netfs.c ++++ b/fs/fscache/netfs.c +@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fscache_netfs *netfs) + cookie->flags = 1 << FSCACHE_COOKIE_ENABLED; + + spin_lock_init(&cookie->lock); ++ spin_lock_init(&cookie->stores_lock); + INIT_HLIST_HEAD(&cookie->backing_objects); + + /* check the netfs type is not already present */ +diff --git a/fs/fscache/object.c b/fs/fscache/object.c +index 9e792e30f4db..7a182c87f378 100644 +--- a/fs/fscache/object.c ++++ b/fs/fscache/object.c +@@ -30,6 +30,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object + static const struct fscache_state *fscache_object_available(struct fscache_object *, int); + static const struct fscache_state *fscache_parent_ready(struct fscache_object *, int); + static const struct fscache_state *fscache_update_object(struct fscache_object *, int); ++static const struct fscache_state *fscache_object_dead(struct fscache_object *, int); + + #define __STATE_NAME(n) fscache_osm_##n + #define STATE(n) (&__STATE_NAME(n)) +@@ -91,7 +92,7 @@ static WORK_STATE(LOOKUP_FAILURE, "LCFL", fscache_lookup_failure); + static WORK_STATE(KILL_OBJECT, "KILL", fscache_kill_object); + static WORK_STATE(KILL_DEPENDENTS, "KDEP", fscache_kill_dependents); + static WORK_STATE(DROP_OBJECT, "DROP", fscache_drop_object); +-static WORK_STATE(OBJECT_DEAD, "DEAD", (void*)2UL); ++static WORK_STATE(OBJECT_DEAD, "DEAD", fscache_object_dead); + + static WAIT_STATE(WAIT_FOR_INIT, "?INI", + TRANSIT_TO(INIT_OBJECT, 1 << FSCACHE_OBJECT_EV_NEW_CHILD)); +@@ -229,6 +230,10 @@ execute_work_state: + event = -1; + if (new_state == NO_TRANSIT) { + _debug("{OBJ%x} %s notrans", object->debug_id, state->name); ++ if (unlikely(state == STATE(OBJECT_DEAD))) { ++ _leave(" [dead]"); ++ return; ++ } + fscache_enqueue_object(object); + event_mask = object->oob_event_mask; + goto unmask_events; +@@ -239,7 +244,7 @@ execute_work_state: + object->state = state = new_state; + + if (state->work) { +- if (unlikely(state->work == ((void *)2UL))) { ++ if (unlikely(state == STATE(OBJECT_DEAD))) { + _leave(" [dead]"); + return; + } +@@ -645,6 +650,12 @@ static const struct fscache_state *fscache_kill_object(struct fscache_object *ob + fscache_mark_object_dead(object); + object->oob_event_mask = 0; + ++ if (test_bit(FSCACHE_OBJECT_RETIRED, &object->flags)) { ++ /* Reject any new read/write ops and abort any that are pending. */ ++ clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags); ++ fscache_cancel_all_ops(object); ++ } ++ + if (list_empty(&object->dependents) && + object->n_ops == 0 && + object->n_children == 0) +@@ -1077,3 +1088,20 @@ void fscache_object_mark_killed(struct fscache_object *object, + } + } + EXPORT_SYMBOL(fscache_object_mark_killed); ++ ++/* ++ * The object is dead. We can get here if an object gets queued by an event ++ * that would lead to its death (such as EV_KILL) when the dispatcher is ++ * already running (and so can be requeued) but hasn't yet cleared the event ++ * mask. ++ */ ++static const struct fscache_state *fscache_object_dead(struct fscache_object *object, ++ int event) ++{ ++ if (!test_and_set_bit(FSCACHE_OBJECT_RUN_AFTER_DEAD, ++ &object->flags)) ++ return NO_TRANSIT; ++ ++ WARN(true, "FS-Cache object redispatched after death"); ++ return NO_TRANSIT; ++} +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 82dc3035ea45..e8d1d6c5000c 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1072,6 +1072,7 @@ static void nfs_increment_seqid(int status, struct nfs_seqid *seqid) + case -NFS4ERR_BADXDR: + case -NFS4ERR_RESOURCE: + case -NFS4ERR_NOFILEHANDLE: ++ case -NFS4ERR_MOVED: + /* Non-seqid mutating errors */ + return; + }; +diff --git a/fs/proc/base.c b/fs/proc/base.c +index d2b8c754f627..dd732400578e 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -3058,6 +3058,8 @@ int proc_pid_readdir(struct file *file, struct dir_context *ctx) + iter.tgid += 1, iter = next_tgid(ns, iter)) { + char name[PROC_NUMBUF]; + int len; ++ ++ cond_resched(); + if (!has_pid_permissions(ns, iter.task, 2)) + continue; + +diff --git a/fs/romfs/super.c b/fs/romfs/super.c +index 268733cda397..5f4f1882dc7d 100644 +--- a/fs/romfs/super.c ++++ b/fs/romfs/super.c +@@ -74,6 +74,7 @@ + #include + #include + #include ++#include + #include "internal.h" + + static struct kmem_cache *romfs_inode_cachep; +@@ -415,7 +416,22 @@ static void romfs_destroy_inode(struct inode *inode) + static int romfs_statfs(struct dentry *dentry, struct kstatfs *buf) + { + struct super_block *sb = dentry->d_sb; +- u64 id = huge_encode_dev(sb->s_bdev->bd_dev); ++ u64 id = 0; ++ ++ /* When calling huge_encode_dev(), ++ * use sb->s_bdev->bd_dev when, ++ * - CONFIG_ROMFS_ON_BLOCK defined ++ * use sb->s_dev when, ++ * - CONFIG_ROMFS_ON_BLOCK undefined and ++ * - CONFIG_ROMFS_ON_MTD defined ++ * leave id as 0 when, ++ * - CONFIG_ROMFS_ON_BLOCK undefined and ++ * - CONFIG_ROMFS_ON_MTD undefined ++ */ ++ if (sb->s_bdev) ++ id = huge_encode_dev(sb->s_bdev->bd_dev); ++ else if (sb->s_dev) ++ id = huge_encode_dev(sb->s_dev); + + buf->f_type = ROMFS_MAGIC; + buf->f_namelen = ROMFS_MAXFN; +@@ -488,6 +504,11 @@ static int romfs_fill_super(struct super_block *sb, void *data, int silent) + sb->s_flags |= MS_RDONLY | MS_NOATIME; + sb->s_op = &romfs_super_ops; + ++#ifdef CONFIG_ROMFS_ON_MTD ++ /* Use same dev ID from the underlying mtdblock device */ ++ if (sb->s_mtd) ++ sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, sb->s_mtd->index); ++#endif + /* read the image superblock and check it */ + rsb = kmalloc(512, GFP_KERNEL); + if (!rsb) +diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h +index 604e1526cd00..eb19bf2b2a81 100644 +--- a/include/linux/fscache-cache.h ++++ b/include/linux/fscache-cache.h +@@ -360,6 +360,7 @@ struct fscache_object { + #define FSCACHE_OBJECT_IS_AVAILABLE 5 /* T if object has become active */ + #define FSCACHE_OBJECT_RETIRED 6 /* T if object was retired on relinquishment */ + #define FSCACHE_OBJECT_KILLED_BY_CACHE 7 /* T if object was killed by the cache */ ++#define FSCACHE_OBJECT_RUN_AFTER_DEAD 8 /* T if object has been dispatched after death */ + + struct list_head cache_link; /* link in cache->object_list */ + struct hlist_node cookie_link; /* link in cookie->backing_objects */ +diff --git a/include/linux/log2.h b/include/linux/log2.h +index f38fae23bdac..c373295f359f 100644 +--- a/include/linux/log2.h ++++ b/include/linux/log2.h +@@ -194,6 +194,17 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + * ... and so on. + */ + +-#define order_base_2(n) ilog2(roundup_pow_of_two(n)) ++static inline __attribute_const__ ++int __order_base_2(unsigned long n) ++{ ++ return n > 1 ? ilog2(n - 1) + 1 : 0; ++} + ++#define order_base_2(n) \ ++( \ ++ __builtin_constant_p(n) ? ( \ ++ ((n) == 0 || (n) == 1) ? 0 : \ ++ ilog2((n) - 1) + 1) : \ ++ __order_base_2(n) \ ++) + #endif /* _LINUX_LOG2_H */ +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index ad1d6039185d..7a8066b90289 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -744,6 +744,11 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb, + { + u32 hash; + ++ /* @flowlabel may include more than a flow label, eg, the traffic class. ++ * Here we want only the flow label value. ++ */ ++ flowlabel &= IPV6_FLOWLABEL_MASK; ++ + if (flowlabel || + net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF || + (!autolabel && +diff --git a/mm/kasan/report.c b/mm/kasan/report.c +index 12f222d0224b..b4e31f78ae69 100644 +--- a/mm/kasan/report.c ++++ b/mm/kasan/report.c +@@ -13,6 +13,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -251,6 +252,8 @@ void kasan_report(unsigned long addr, size_t size, + if (likely(!kasan_report_enabled())) + return; + ++ disable_trace_on_warning(); ++ + info.access_addr = (void *)addr; + info.access_size = size; + info.is_write = is_write; +diff --git a/net/core/ethtool.c b/net/core/ethtool.c +index 29edf74846fc..b6bca625b0d2 100644 +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -886,9 +886,12 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr) + if (regs.len > reglen) + regs.len = reglen; + +- regbuf = vzalloc(reglen); +- if (reglen && !regbuf) +- return -ENOMEM; ++ regbuf = NULL; ++ if (reglen) { ++ regbuf = vzalloc(reglen); ++ if (!regbuf) ++ return -ENOMEM; ++ } + + ops->get_regs(dev, ®s, regbuf); + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index 59b3e0e8fd51..711b4dfa17c3 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1250,7 +1250,7 @@ void __init arp_init(void) + /* + * ax25 -> ASCII conversion + */ +-static char *ax2asc2(ax25_address *a, char *buf) ++static void ax2asc2(ax25_address *a, char *buf) + { + char c, *s; + int n; +@@ -1272,10 +1272,10 @@ static char *ax2asc2(ax25_address *a, char *buf) + *s++ = n + '0'; + *s++ = '\0'; + +- if (*buf == '\0' || *buf == '-') +- return "*"; +- +- return buf; ++ if (*buf == '\0' || *buf == '-') { ++ buf[0] = '*'; ++ buf[1] = '\0'; ++ } + } + #endif /* CONFIG_AX25 */ + +@@ -1309,7 +1309,7 @@ static void arp_format_neigh_entry(struct seq_file *seq, + } + #endif + sprintf(tbuf, "%pI4", n->primary_key); +- seq_printf(seq, "%-16s 0x%-10x0x%-10x%s * %s\n", ++ seq_printf(seq, "%-16s 0x%-10x0x%-10x%-17s * %s\n", + tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name); + read_unlock(&n->lock); + } +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 7090fef372cc..8cf3fc7c2932 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3211,9 +3211,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + } + + if (idev) { +- if (idev->if_flags & IF_READY) +- /* device is already configured. */ ++ if (idev->if_flags & IF_READY) { ++ /* device is already configured - ++ * but resend MLD reports, we might ++ * have roamed and need to update ++ * multicast snooping switches ++ */ ++ ipv6_mc_up(idev); + break; ++ } + idev->if_flags |= IF_READY; + } + +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 428162155280..cae37bfd12ab 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -76,18 +76,22 @@ static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int a + } + } + +- addr_type = ipv6_addr_type(&usin->sin6_addr); +- +- if (addr_type == IPV6_ADDR_ANY) { ++ if (ipv6_addr_any(&usin->sin6_addr)) { + /* + * connect to self + */ +- usin->sin6_addr.s6_addr[15] = 0x01; ++ if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)) ++ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), ++ &usin->sin6_addr); ++ else ++ usin->sin6_addr = in6addr_loopback; + } + ++ addr_type = ipv6_addr_type(&usin->sin6_addr); ++ + daddr = &usin->sin6_addr; + +- if (addr_type == IPV6_ADDR_MAPPED) { ++ if (addr_type & IPV6_ADDR_MAPPED) { + struct sockaddr_in sin; + + if (__ipv6_only_sock(sk)) { +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 1db17efe36c1..19c0d67ce8c4 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1004,6 +1004,9 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, + } + } + #endif ++ if (ipv6_addr_v4mapped(&fl6->saddr) && ++ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) ++ return -EAFNOSUPPORT; + + return 0; + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 8e958fde6e4b..59c908ff251a 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -149,8 +149,13 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, + * connect() to INADDR_ANY means loopback (BSD'ism). + */ + +- if (ipv6_addr_any(&usin->sin6_addr)) +- usin->sin6_addr.s6_addr[15] = 0x1; ++ if (ipv6_addr_any(&usin->sin6_addr)) { ++ if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)) ++ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), ++ &usin->sin6_addr); ++ else ++ usin->sin6_addr = in6addr_loopback; ++ } + + addr_type = ipv6_addr_type(&usin->sin6_addr); + +@@ -189,7 +194,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, + * TCP over IPv4 + */ + +- if (addr_type == IPV6_ADDR_MAPPED) { ++ if (addr_type & IPV6_ADDR_MAPPED) { + u32 exthdrlen = icsk->icsk_ext_hdr_len; + struct sockaddr_in sin; + +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index dfa85e7264df..6fd4af3b5b79 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1136,6 +1136,10 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (addr_len < SIN6_LEN_RFC2133) + return -EINVAL; + daddr = &sin6->sin6_addr; ++ if (ipv6_addr_any(daddr) && ++ ipv6_addr_v4mapped(&np->saddr)) ++ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), ++ daddr); + break; + case AF_INET: + goto do_udp_sendmsg; +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index c96d666cef29..956141b71619 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk, + sctp_assoc_t id) + { + struct sctp_association *addr_asoc = NULL, *id_asoc = NULL; +- struct sctp_transport *transport; ++ struct sctp_af *af = sctp_get_af_specific(addr->ss_family); + union sctp_addr *laddr = (union sctp_addr *)addr; ++ struct sctp_transport *transport; ++ ++ if (sctp_verify_addr(sk, laddr, af->sockaddr_len)) ++ return NULL; + + addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep, + laddr, +diff --git a/net/tipc/server.c b/net/tipc/server.c +index 922e04a43396..50f5b0ca7b3c 100644 +--- a/net/tipc/server.c ++++ b/net/tipc/server.c +@@ -452,6 +452,11 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid, + if (!con) + return -EINVAL; + ++ if (!test_bit(CF_CONNECTED, &con->flags)) { ++ conn_put(con); ++ return 0; ++ } ++ + e = tipc_alloc_entry(data, len); + if (!e) { + conn_put(con); +@@ -465,12 +470,8 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid, + list_add_tail(&e->list, &con->outqueue); + spin_unlock_bh(&con->outqueue_lock); + +- if (test_bit(CF_CONNECTED, &con->flags)) { +- if (!queue_work(s->send_wq, &con->swork)) +- conn_put(con); +- } else { ++ if (!queue_work(s->send_wq, &con->swork)) + conn_put(con); +- } + return 0; + } + +@@ -494,7 +495,7 @@ static void tipc_send_to_sock(struct tipc_conn *con) + int ret; + + spin_lock_bh(&con->outqueue_lock); +- while (1) { ++ while (test_bit(CF_CONNECTED, &con->flags)) { + e = list_entry(con->outqueue.next, struct outqueue_entry, + list); + if ((struct list_head *) e == &con->outqueue)