commit: 3594f6ef73513ee5c6adefc2a074b8b310dc4de3 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Jul 10 23:33:38 2015 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Jul 10 23:33:38 2015 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3594f6ef
Linux patch 4.0.8 0000_README | 4 + 1007_linux-4.0.8.patch | 2139 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2143 insertions(+) diff --git a/0000_README b/0000_README index 32ebe25..6a1359e 100644 --- a/0000_README +++ b/0000_README @@ -71,6 +71,10 @@ Patch: 1006_linux-4.0.7.patch From: http://www.kernel.org Desc: Linux 4.0.7 +Patch: 1007_linux-4.0.8.patch +From: http://www.kernel.org +Desc: Linux 4.0.8 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1007_linux-4.0.8.patch b/1007_linux-4.0.8.patch new file mode 100644 index 0000000..88c73a0 --- /dev/null +++ b/1007_linux-4.0.8.patch @@ -0,0 +1,2139 @@ +diff --git a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt +index 750d577e8083..f5a8ca29aff0 100644 +--- a/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt ++++ b/Documentation/devicetree/bindings/net/marvell-armada-370-neta.txt +@@ -1,7 +1,7 @@ + * Marvell Armada 370 / Armada XP Ethernet Controller (NETA) + + Required properties: +-- compatible: should be "marvell,armada-370-neta". ++- compatible: "marvell,armada-370-neta" or "marvell,armada-xp-neta". + - reg: address and length of the register set for the device. + - interrupts: interrupt for the device + - phy: See ethernet.txt file in the same directory. +diff --git a/Makefile b/Makefile +index bd76a8e94395..0e315d6e1a41 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 0 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Hurr durr I'ma sheep + +diff --git a/arch/arm/boot/dts/armada-370-xp.dtsi b/arch/arm/boot/dts/armada-370-xp.dtsi +index 8a322ad57e5f..a038c201ffba 100644 +--- a/arch/arm/boot/dts/armada-370-xp.dtsi ++++ b/arch/arm/boot/dts/armada-370-xp.dtsi +@@ -265,7 +265,6 @@ + }; + + eth0: ethernet@70000 { +- compatible = "marvell,armada-370-neta"; + reg = <0x70000 0x4000>; + interrupts = <8>; + clocks = <&gateclk 4>; +@@ -281,7 +280,6 @@ + }; + + eth1: ethernet@74000 { +- compatible = "marvell,armada-370-neta"; + reg = <0x74000 0x4000>; + interrupts = <10>; + clocks = <&gateclk 3>; +diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi +index 27397f151def..37730254e667 100644 +--- a/arch/arm/boot/dts/armada-370.dtsi ++++ b/arch/arm/boot/dts/armada-370.dtsi +@@ -306,6 +306,14 @@ + dmacap,memset; + }; + }; ++ ++ ethernet@70000 { ++ compatible = "marvell,armada-370-neta"; ++ }; ++ ++ ethernet@74000 { ++ compatible = "marvell,armada-370-neta"; ++ }; + }; + }; + }; +diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi +index 4a7cbed79b07..1676d30e9be2 100644 +--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi ++++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi +@@ -319,7 +319,7 @@ + }; + + eth3: ethernet@34000 { +- compatible = "marvell,armada-370-neta"; ++ compatible = "marvell,armada-xp-neta"; + reg = <0x34000 0x4000>; + interrupts = <14>; + clocks = <&gateclk 1>; +diff --git a/arch/arm/boot/dts/armada-xp-mv78460.dtsi b/arch/arm/boot/dts/armada-xp-mv78460.dtsi +index 36ce63a96cc9..d41fe88ffea4 100644 +--- a/arch/arm/boot/dts/armada-xp-mv78460.dtsi ++++ b/arch/arm/boot/dts/armada-xp-mv78460.dtsi +@@ -357,7 +357,7 @@ + }; + + eth3: ethernet@34000 { +- compatible = "marvell,armada-370-neta"; ++ compatible = "marvell,armada-xp-neta"; + reg = <0x34000 0x4000>; + interrupts = <14>; + clocks = <&gateclk 1>; +diff --git a/arch/arm/boot/dts/armada-xp.dtsi b/arch/arm/boot/dts/armada-xp.dtsi +index 82917236a2fb..9ce7d5fd8a34 100644 +--- a/arch/arm/boot/dts/armada-xp.dtsi ++++ b/arch/arm/boot/dts/armada-xp.dtsi +@@ -175,7 +175,7 @@ + }; + + eth2: ethernet@30000 { +- compatible = "marvell,armada-370-neta"; ++ compatible = "marvell,armada-xp-neta"; + reg = <0x30000 0x4000>; + interrupts = <12>; + clocks = <&gateclk 2>; +@@ -218,6 +218,14 @@ + }; + }; + ++ ethernet@70000 { ++ compatible = "marvell,armada-xp-neta"; ++ }; ++ ++ ethernet@74000 { ++ compatible = "marvell,armada-xp-neta"; ++ }; ++ + xor@f0900 { + compatible = "marvell,orion-xor"; + reg = <0xF0900 0x100 +diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S +index 79caf79b304a..f7db3a5d80e3 100644 +--- a/arch/arm/kvm/interrupts.S ++++ b/arch/arm/kvm/interrupts.S +@@ -170,13 +170,9 @@ __kvm_vcpu_return: + @ Don't trap coprocessor accesses for host kernel + set_hstr vmexit + set_hdcr vmexit +- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)) ++ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore + + #ifdef CONFIG_VFPv3 +- @ Save floating point registers we if let guest use them. +- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11)) +- bne after_vfp_restore +- + @ Switch VFP/NEON hardware state to the host's + add r7, vcpu, #VCPU_VFP_GUEST + store_vfp_state r7 +@@ -188,6 +184,8 @@ after_vfp_restore: + @ Restore FPEXC_EN which we clobbered on entry + pop {r2} + VFPFMXR FPEXC, r2 ++#else ++after_vfp_restore: + #endif + + @ Reset Hyp-role +@@ -483,7 +481,7 @@ switch_to_guest_vfp: + push {r3-r7} + + @ NEON/VFP used. Turn on VFP access. +- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11)) ++ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11)) + + @ Switch VFP/NEON hardware state to the guest's + add r7, r0, #VCPU_VFP_HOST +diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S +index 14d488388480..f6f14812d106 100644 +--- a/arch/arm/kvm/interrupts_head.S ++++ b/arch/arm/kvm/interrupts_head.S +@@ -599,8 +599,13 @@ ARM_BE8(rev r6, r6 ) + .endm + + /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return +- * (hardware reset value is 0). Keep previous value in r2. */ +-.macro set_hcptr operation, mask ++ * (hardware reset value is 0). Keep previous value in r2. ++ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if ++ * VFP wasn't already enabled (always executed on vmtrap). ++ * If a label is specified with vmexit, it is branched to if VFP wasn't ++ * enabled. ++ */ ++.macro set_hcptr operation, mask, label = none + mrc p15, 4, r2, c1, c1, 2 + ldr r3, =\mask + .if \operation == vmentry +@@ -609,6 +614,17 @@ ARM_BE8(rev r6, r6 ) + bic r3, r2, r3 @ Don't trap defined coproc-accesses + .endif + mcr p15, 4, r3, c1, c1, 2 ++ .if \operation != vmentry ++ .if \operation == vmexit ++ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11)) ++ beq 1f ++ .endif ++ isb ++ .if \label != none ++ b \label ++ .endif ++1: ++ .endif + .endm + + /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return +diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c +index 02fa8eff6ae1..531e922486b2 100644 +--- a/arch/arm/kvm/psci.c ++++ b/arch/arm/kvm/psci.c +@@ -230,10 +230,6 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + case PSCI_0_2_FN64_AFFINITY_INFO: + val = kvm_psci_vcpu_affinity_info(vcpu); + break; +- case PSCI_0_2_FN_MIGRATE: +- case PSCI_0_2_FN64_MIGRATE: +- val = PSCI_RET_NOT_SUPPORTED; +- break; + case PSCI_0_2_FN_MIGRATE_INFO_TYPE: + /* + * Trusted OS is MP hence does not require migration +@@ -242,10 +238,6 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + */ + val = PSCI_0_2_TOS_MP; + break; +- case PSCI_0_2_FN_MIGRATE_INFO_UP_CPU: +- case PSCI_0_2_FN64_MIGRATE_INFO_UP_CPU: +- val = PSCI_RET_NOT_SUPPORTED; +- break; + case PSCI_0_2_FN_SYSTEM_OFF: + kvm_psci_system_off(vcpu); + /* +@@ -271,7 +263,8 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) + ret = 0; + break; + default: +- return -EINVAL; ++ val = PSCI_RET_NOT_SUPPORTED; ++ break; + } + + *vcpu_reg(vcpu, 0) = val; +@@ -291,12 +284,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) + case KVM_PSCI_FN_CPU_ON: + val = kvm_psci_vcpu_on(vcpu); + break; +- case KVM_PSCI_FN_CPU_SUSPEND: +- case KVM_PSCI_FN_MIGRATE: ++ default: + val = PSCI_RET_NOT_SUPPORTED; + break; +- default: +- return -EINVAL; + } + + *vcpu_reg(vcpu, 0) = val; +diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c +index d04a430607b8..3a3f88c04e8f 100644 +--- a/arch/arm/mach-imx/clk-imx6q.c ++++ b/arch/arm/mach-imx/clk-imx6q.c +@@ -439,7 +439,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + clk[IMX6QDL_CLK_GPMI_IO] = imx_clk_gate2("gpmi_io", "enfc", base + 0x78, 28); + clk[IMX6QDL_CLK_GPMI_APB] = imx_clk_gate2("gpmi_apb", "usdhc3", base + 0x78, 30); + clk[IMX6QDL_CLK_ROM] = imx_clk_gate2("rom", "ahb", base + 0x7c, 0); +- clk[IMX6QDL_CLK_SATA] = imx_clk_gate2("sata", "ipg", base + 0x7c, 4); ++ clk[IMX6QDL_CLK_SATA] = imx_clk_gate2("sata", "ahb", base + 0x7c, 4); + clk[IMX6QDL_CLK_SDMA] = imx_clk_gate2("sdma", "ahb", base + 0x7c, 6); + clk[IMX6QDL_CLK_SPBA] = imx_clk_gate2("spba", "ipg", base + 0x7c, 12); + clk[IMX6QDL_CLK_SPDIF] = imx_clk_gate2("spdif", "spdif_podf", base + 0x7c, 14); +diff --git a/arch/arm/mach-mvebu/pm-board.c b/arch/arm/mach-mvebu/pm-board.c +index 6dfd4ab97b2a..301ab38d38ba 100644 +--- a/arch/arm/mach-mvebu/pm-board.c ++++ b/arch/arm/mach-mvebu/pm-board.c +@@ -43,6 +43,9 @@ static void mvebu_armada_xp_gp_pm_enter(void __iomem *sdram_reg, u32 srcmd) + for (i = 0; i < ARMADA_XP_GP_PIC_NR_GPIOS; i++) + ackcmd |= BIT(pic_raw_gpios[i]); + ++ srcmd = cpu_to_le32(srcmd); ++ ackcmd = cpu_to_le32(ackcmd); ++ + /* + * Wait a while, the PIC needs quite a bit of time between the + * two GPIO commands. +diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c +index 4f25a7c7ca0f..a351eff089f3 100644 +--- a/arch/arm/mach-tegra/cpuidle-tegra20.c ++++ b/arch/arm/mach-tegra/cpuidle-tegra20.c +@@ -35,6 +35,7 @@ + #include "iomap.h" + #include "irq.h" + #include "pm.h" ++#include "reset.h" + #include "sleep.h" + + #ifdef CONFIG_PM_SLEEP +@@ -71,15 +72,13 @@ static struct cpuidle_driver tegra_idle_driver = { + + #ifdef CONFIG_PM_SLEEP + #ifdef CONFIG_SMP +-static void __iomem *pmc = IO_ADDRESS(TEGRA_PMC_BASE); +- + static int tegra20_reset_sleeping_cpu_1(void) + { + int ret = 0; + + tegra_pen_lock(); + +- if (readl(pmc + PMC_SCRATCH41) == CPU_RESETTABLE) ++ if (readb(tegra20_cpu1_resettable_status) == CPU_RESETTABLE) + tegra20_cpu_shutdown(1); + else + ret = -EINVAL; +diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S +index 71be4af5e975..e3070fdab80b 100644 +--- a/arch/arm/mach-tegra/reset-handler.S ++++ b/arch/arm/mach-tegra/reset-handler.S +@@ -169,10 +169,10 @@ after_errata: + cmp r6, #TEGRA20 + bne 1f + /* If not CPU0, don't let CPU0 reset CPU1 now that CPU1 is coming up. */ +- mov32 r5, TEGRA_PMC_BASE +- mov r0, #0 ++ mov32 r5, TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET ++ mov r0, #CPU_NOT_RESETTABLE + cmp r10, #0 +- strne r0, [r5, #PMC_SCRATCH41] ++ strneb r0, [r5, #__tegra20_cpu1_resettable_status_offset] + 1: + #endif + +@@ -281,6 +281,10 @@ __tegra_cpu_reset_handler_data: + .rept TEGRA_RESET_DATA_SIZE + .long 0 + .endr ++ .globl __tegra20_cpu1_resettable_status_offset ++ .equ __tegra20_cpu1_resettable_status_offset, \ ++ . - __tegra_cpu_reset_handler_start ++ .byte 0 + .align L1_CACHE_SHIFT + + ENTRY(__tegra_cpu_reset_handler_end) +diff --git a/arch/arm/mach-tegra/reset.h b/arch/arm/mach-tegra/reset.h +index 76a93434c6ee..29c3dec0126a 100644 +--- a/arch/arm/mach-tegra/reset.h ++++ b/arch/arm/mach-tegra/reset.h +@@ -35,6 +35,7 @@ extern unsigned long __tegra_cpu_reset_handler_data[TEGRA_RESET_DATA_SIZE]; + + void __tegra_cpu_reset_handler_start(void); + void __tegra_cpu_reset_handler(void); ++void __tegra20_cpu1_resettable_status_offset(void); + void __tegra_cpu_reset_handler_end(void); + void tegra_secondary_startup(void); + +@@ -47,6 +48,9 @@ void tegra_secondary_startup(void); + (IO_ADDRESS(TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET + \ + ((u32)&__tegra_cpu_reset_handler_data[TEGRA_RESET_MASK_LP2] - \ + (u32)__tegra_cpu_reset_handler_start))) ++#define tegra20_cpu1_resettable_status \ ++ (IO_ADDRESS(TEGRA_IRAM_BASE + TEGRA_IRAM_RESET_HANDLER_OFFSET + \ ++ (u32)__tegra20_cpu1_resettable_status_offset)) + #endif + + #define tegra_cpu_reset_handler_offset \ +diff --git a/arch/arm/mach-tegra/sleep-tegra20.S b/arch/arm/mach-tegra/sleep-tegra20.S +index be4bc5f853f5..e6b684e14322 100644 +--- a/arch/arm/mach-tegra/sleep-tegra20.S ++++ b/arch/arm/mach-tegra/sleep-tegra20.S +@@ -97,9 +97,10 @@ ENDPROC(tegra20_hotplug_shutdown) + ENTRY(tegra20_cpu_shutdown) + cmp r0, #0 + reteq lr @ must not be called for CPU 0 +- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41 ++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r2, =__tegra20_cpu1_resettable_status_offset + mov r12, #CPU_RESETTABLE +- str r12, [r1] ++ strb r12, [r1, r2] + + cpu_to_halt_reg r1, r0 + ldr r3, =TEGRA_FLOW_CTRL_VIRT +@@ -182,38 +183,41 @@ ENDPROC(tegra_pen_unlock) + /* + * tegra20_cpu_clear_resettable(void) + * +- * Called to clear the "resettable soon" flag in PMC_SCRATCH41 when ++ * Called to clear the "resettable soon" flag in IRAM variable when + * it is expected that the secondary CPU will be idle soon. + */ + ENTRY(tegra20_cpu_clear_resettable) +- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41 ++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r2, =__tegra20_cpu1_resettable_status_offset + mov r12, #CPU_NOT_RESETTABLE +- str r12, [r1] ++ strb r12, [r1, r2] + ret lr + ENDPROC(tegra20_cpu_clear_resettable) + + /* + * tegra20_cpu_set_resettable_soon(void) + * +- * Called to set the "resettable soon" flag in PMC_SCRATCH41 when ++ * Called to set the "resettable soon" flag in IRAM variable when + * it is expected that the secondary CPU will be idle soon. + */ + ENTRY(tegra20_cpu_set_resettable_soon) +- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41 ++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r2, =__tegra20_cpu1_resettable_status_offset + mov r12, #CPU_RESETTABLE_SOON +- str r12, [r1] ++ strb r12, [r1, r2] + ret lr + ENDPROC(tegra20_cpu_set_resettable_soon) + + /* + * tegra20_cpu_is_resettable_soon(void) + * +- * Returns true if the "resettable soon" flag in PMC_SCRATCH41 has been ++ * Returns true if the "resettable soon" flag in IRAM variable has been + * set because it is expected that the secondary CPU will be idle soon. + */ + ENTRY(tegra20_cpu_is_resettable_soon) +- mov32 r1, TEGRA_PMC_VIRT + PMC_SCRATCH41 +- ldr r12, [r1] ++ mov32 r1, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r2, =__tegra20_cpu1_resettable_status_offset ++ ldrb r12, [r1, r2] + cmp r12, #CPU_RESETTABLE_SOON + moveq r0, #1 + movne r0, #0 +@@ -256,9 +260,10 @@ ENTRY(tegra20_sleep_cpu_secondary_finish) + mov r0, #TEGRA_FLUSH_CACHE_LOUIS + bl tegra_disable_clean_inv_dcache + +- mov32 r0, TEGRA_PMC_VIRT + PMC_SCRATCH41 ++ mov32 r0, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r4, =__tegra20_cpu1_resettable_status_offset + mov r3, #CPU_RESETTABLE +- str r3, [r0] ++ strb r3, [r0, r4] + + bl tegra_cpu_do_idle + +@@ -274,10 +279,10 @@ ENTRY(tegra20_sleep_cpu_secondary_finish) + + bl tegra_pen_lock + +- mov32 r3, TEGRA_PMC_VIRT +- add r0, r3, #PMC_SCRATCH41 ++ mov32 r0, TEGRA_IRAM_RESET_BASE_VIRT ++ ldr r4, =__tegra20_cpu1_resettable_status_offset + mov r3, #CPU_NOT_RESETTABLE +- str r3, [r0] ++ strb r3, [r0, r4] + + bl tegra_pen_unlock + +diff --git a/arch/arm/mach-tegra/sleep.h b/arch/arm/mach-tegra/sleep.h +index 92d46ec1361a..0d59360d891d 100644 +--- a/arch/arm/mach-tegra/sleep.h ++++ b/arch/arm/mach-tegra/sleep.h +@@ -18,6 +18,7 @@ + #define __MACH_TEGRA_SLEEP_H + + #include "iomap.h" ++#include "irammap.h" + + #define TEGRA_ARM_PERIF_VIRT (TEGRA_ARM_PERIF_BASE - IO_CPU_PHYS \ + + IO_CPU_VIRT) +@@ -29,6 +30,9 @@ + + IO_APB_VIRT) + #define TEGRA_PMC_VIRT (TEGRA_PMC_BASE - IO_APB_PHYS + IO_APB_VIRT) + ++#define TEGRA_IRAM_RESET_BASE_VIRT (IO_IRAM_VIRT + \ ++ TEGRA_IRAM_RESET_HANDLER_OFFSET) ++ + /* PMC_SCRATCH37-39 and 41 are used for tegra_pen_lock and idle */ + #define PMC_SCRATCH37 0x130 + #define PMC_SCRATCH38 0x134 +diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h +index 9488fa5f8866..afc96ecb9004 100644 +--- a/arch/mips/include/asm/mach-generic/spaces.h ++++ b/arch/mips/include/asm/mach-generic/spaces.h +@@ -94,7 +94,11 @@ + #endif + + #ifndef FIXADDR_TOP ++#ifdef CONFIG_KVM_GUEST ++#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000) ++#else + #define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000) + #endif ++#endif + + #endif /* __ASM_MACH_GENERIC_SPACES_H */ +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index f5e7ddab02f7..adf38868b006 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -785,7 +785,7 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, struct kvm_dirty_log *log) + + /* If nothing is dirty, don't bother messing with page tables. */ + if (is_dirty) { +- memslot = &kvm->memslots->memslots[log->slot]; ++ memslot = id_to_memslot(kvm->memslots, log->slot); + + ga = memslot->base_gfn << PAGE_SHIFT; + ga_end = ga + (memslot->npages << PAGE_SHIFT); +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 7c4f6690533a..3cb25fdbc468 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -131,7 +131,16 @@ static void pmao_restore_workaround(bool ebb) { } + + static bool regs_use_siar(struct pt_regs *regs) + { +- return !!regs->result; ++ /* ++ * When we take a performance monitor exception the regs are setup ++ * using perf_read_regs() which overloads some fields, in particular ++ * regs->result to tell us whether to use SIAR. ++ * ++ * However if the regs are from another exception, eg. a syscall, then ++ * they have not been setup using perf_read_regs() and so regs->result ++ * is something random. ++ */ ++ return ((TRAP(regs) == 0xf00) && regs->result); + } + + /* +diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c +index 9f73c8059022..49b74454d7ee 100644 +--- a/arch/s390/kernel/crash_dump.c ++++ b/arch/s390/kernel/crash_dump.c +@@ -415,7 +415,7 @@ static void *nt_s390_vx_low(void *ptr, __vector128 *vx_regs) + ptr += len; + /* Copy lower halves of SIMD registers 0-15 */ + for (i = 0; i < 16; i++) { +- memcpy(ptr, &vx_regs[i], 8); ++ memcpy(ptr, &vx_regs[i].u[2], 8); + ptr += 8; + } + return ptr; +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index e7bc2fdb6f67..b2b7ddfe864c 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -1037,7 +1037,7 @@ static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq) + if (sclp_has_sigpif()) + return __inject_extcall_sigpif(vcpu, src_id); + +- if (!test_and_set_bit(IRQ_PEND_EXT_EXTERNAL, &li->pending_irqs)) ++ if (test_and_set_bit(IRQ_PEND_EXT_EXTERNAL, &li->pending_irqs)) + return -EBUSY; + *extcall = irq->u.extcall; + atomic_set_mask(CPUSTAT_EXT_INT, li->cpuflags); +diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c +index 274a9f59d95c..591f119fcd99 100644 +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -2313,7 +2313,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len, + if (len & (8UL - 1)) + return ERR_PTR(-EINVAL); + +- buf = kzalloc(len, GFP_KERNEL); ++ buf = kzalloc(len, GFP_ATOMIC); + if (!buf) + return ERR_PTR(-ENOMEM); + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index b7d31ca55187..570c71dd4b63 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -177,7 +177,7 @@ config SBUS + + config NEED_DMA_MAP_STATE + def_bool y +- depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG ++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB + + config NEED_SG_DMA_LENGTH + def_bool y +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 1c0fb570b5c2..e02589dd215a 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -583,7 +583,7 @@ struct kvm_arch { + struct kvm_pic *vpic; + struct kvm_ioapic *vioapic; + struct kvm_pit *vpit; +- int vapics_in_nmi_mode; ++ atomic_t vapics_in_nmi_mode; + struct mutex apic_map_lock; + struct kvm_apic_map *apic_map; + +diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c +index 298781d4cfb4..1406ffde3e35 100644 +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work) + * LVT0 to NMI delivery. Other PIC interrupts are just sent to + * VCPU0, and only if its LVT0 is in EXTINT mode. + */ +- if (kvm->arch.vapics_in_nmi_mode > 0) ++ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0) + kvm_for_each_vcpu(i, vcpu, kvm) + kvm_apic_nmi_wd_deliver(vcpu); + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 3cb2b58fa26b..8ee4aa7f567d 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1224,10 +1224,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val) + if (!nmi_wd_enabled) { + apic_debug("Receive NMI setting on APIC_LVT0 " + "for cpu %d\n", apic->vcpu->vcpu_id); +- apic->vcpu->kvm->arch.vapics_in_nmi_mode++; ++ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + } else if (nmi_wd_enabled) +- apic->vcpu->kvm->arch.vapics_in_nmi_mode--; ++ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode); + } + + static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val) +@@ -1784,6 +1784,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu, + apic_update_ppr(apic); + hrtimer_cancel(&apic->lapic_timer.timer); + apic_update_lvtt(apic); ++ apic_manage_nmi_watchdog(apic, kvm_apic_get_reg(apic, APIC_LVT0)); + update_divide_count(apic); + start_apic_timer(apic); + apic->irr_pending = true; +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index a4e62fcfabcb..1b32e2979de9 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -511,8 +511,10 @@ static void skip_emulated_instruction(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +- if (svm->vmcb->control.next_rip != 0) ++ if (svm->vmcb->control.next_rip != 0) { ++ WARN_ON(!static_cpu_has(X86_FEATURE_NRIPS)); + svm->next_rip = svm->vmcb->control.next_rip; ++ } + + if (!svm->next_rip) { + if (emulate_instruction(vcpu, EMULTYPE_SKIP) != +@@ -4310,7 +4312,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, + break; + } + +- vmcb->control.next_rip = info->next_rip; ++ /* TODO: Advertise NRIPS to guest hypervisor unconditionally */ ++ if (static_cpu_has(X86_FEATURE_NRIPS)) ++ vmcb->control.next_rip = info->next_rip; + vmcb->control.exit_code = icpt_info.exit_code; + vmexit = nested_svm_exit_handled(svm); + +diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c +index d93963340c3c..b33615f1efc5 100644 +--- a/arch/x86/pci/acpi.c ++++ b/arch/x86/pci/acpi.c +@@ -81,6 +81,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = { + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), + }, + }, ++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */ ++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */ ++ { ++ .callback = set_use_crs, ++ .ident = "Foxconn K8M890-8237A", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"), ++ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"), ++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), ++ }, ++ }, + + /* Now for the blacklist.. */ + +@@ -121,8 +132,10 @@ void __init pci_acpi_crs_quirks(void) + { + int year; + +- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) +- pci_use_crs = false; ++ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) { ++ if (iomem_resource.end <= 0xffffffff) ++ pci_use_crs = false; ++ } + + dmi_check_system(pci_crs_quirks); + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 872c5772c5d3..2c867a6a1b1a 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -534,7 +534,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate) + + val |= vid; + +- wrmsrl(MSR_IA32_PERF_CTL, val); ++ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val); + } + + #define BYT_BCLK_FREQS 5 +diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c +index 59372077ec7c..3442764a5293 100644 +--- a/drivers/cpuidle/cpuidle-powernv.c ++++ b/drivers/cpuidle/cpuidle-powernv.c +@@ -60,6 +60,8 @@ static int nap_loop(struct cpuidle_device *dev, + return index; + } + ++/* Register for fastsleep only in oneshot mode of broadcast */ ++#ifdef CONFIG_TICK_ONESHOT + static int fastsleep_loop(struct cpuidle_device *dev, + struct cpuidle_driver *drv, + int index) +@@ -83,7 +85,7 @@ static int fastsleep_loop(struct cpuidle_device *dev, + + return index; + } +- ++#endif + /* + * States for dedicated partition case. + */ +@@ -209,7 +211,14 @@ static int powernv_add_idle_states(void) + powernv_states[nr_idle_states].flags = 0; + powernv_states[nr_idle_states].target_residency = 100; + powernv_states[nr_idle_states].enter = &nap_loop; +- } else if (flags[i] & OPAL_PM_SLEEP_ENABLED || ++ } ++ ++ /* ++ * All cpuidle states with CPUIDLE_FLAG_TIMER_STOP set must come ++ * within this config dependency check. ++ */ ++#ifdef CONFIG_TICK_ONESHOT ++ if (flags[i] & OPAL_PM_SLEEP_ENABLED || + flags[i] & OPAL_PM_SLEEP_ENABLED_ER1) { + /* Add FASTSLEEP state */ + strcpy(powernv_states[nr_idle_states].name, "FastSleep"); +@@ -218,7 +227,7 @@ static int powernv_add_idle_states(void) + powernv_states[nr_idle_states].target_residency = 300000; + powernv_states[nr_idle_states].enter = &fastsleep_loop; + } +- ++#endif + powernv_states[nr_idle_states].exit_latency = + ((unsigned int)latency_ns[i]) / 1000; + +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index ebbae8d3ce0d..9f7333abb821 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count, + sg_count--; + link_tbl_ptr--; + } +- be16_add_cpu(&link_tbl_ptr->len, cryptlen); ++ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len) ++ + cryptlen); + + /* tag end of link table */ + link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN; +@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, + break; + default: + dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type); ++ kfree(t_alg); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 48882c126245..13cfbf470925 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1870,9 +1870,15 @@ static void free_pt_##LVL (unsigned long __pt) \ + pt = (u64 *)__pt; \ + \ + for (i = 0; i < 512; ++i) { \ ++ /* PTE present? */ \ + if (!IOMMU_PTE_PRESENT(pt[i])) \ + continue; \ + \ ++ /* Large PTE? */ \ ++ if (PM_PTE_LEVEL(pt[i]) == 0 || \ ++ PM_PTE_LEVEL(pt[i]) == 7) \ ++ continue; \ ++ \ + p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \ + FN(p); \ + } \ +diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c +index bd6252b01510..2d1b203280d0 100644 +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -1533,7 +1533,7 @@ static int arm_smmu_device_cfg_probe(struct arm_smmu_device *smmu) + return -ENODEV; + } + +- if ((id & ID0_S1TS) && ((smmu->version == 1) || (id & ID0_ATOSNS))) { ++ if ((id & ID0_S1TS) && ((smmu->version == 1) || !(id & ID0_ATOSNS))) { + smmu->features |= ARM_SMMU_FEAT_TRANS_OPS; + dev_notice(smmu->dev, "\taddress translation ops\n"); + } +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 0ad412a4876f..d3a7bff4d230 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -846,7 +846,7 @@ static void sdhci_prepare_data(struct sdhci_host *host, struct mmc_command *cmd) + int sg_cnt; + + sg_cnt = sdhci_pre_dma_transfer(host, data, NULL); +- if (sg_cnt == 0) { ++ if (sg_cnt <= 0) { + /* + * This only happens when someone fed + * us an invalid request. +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c +index d81fc6bd4759..5c92fb71b37e 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c +@@ -263,7 +263,7 @@ static int xgbe_alloc_pages(struct xgbe_prv_data *pdata, + int ret; + + /* Try to obtain pages, decreasing order if necessary */ +- gfp |= __GFP_COLD | __GFP_COMP; ++ gfp |= __GFP_COLD | __GFP_COMP | __GFP_NOWARN; + while (order >= 0) { + pages = alloc_pages(gfp, order); + if (pages) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 1ec635f54994..196474fc54c0 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9323,7 +9323,8 @@ unload_error: + * function stop ramrod is sent, since as part of this ramrod FW access + * PTP registers. + */ +- bnx2x_stop_ptp(bp); ++ if (bp->flags & PTP_SUPPORTED) ++ bnx2x_stop_ptp(bp); + + /* Disable HW interrupts, NAPI */ + bnx2x_netif_stop(bp, 1); +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index d20fc8ed11f1..c3657652b631 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -540,8 +540,8 @@ static int igb_ptp_feature_enable_i210(struct ptp_clock_info *ptp, + igb->perout[i].start.tv_nsec = rq->perout.start.nsec; + igb->perout[i].period.tv_sec = ts.tv_sec; + igb->perout[i].period.tv_nsec = ts.tv_nsec; +- wr32(trgttiml, rq->perout.start.sec); +- wr32(trgttimh, rq->perout.start.nsec); ++ wr32(trgttimh, rq->perout.start.sec); ++ wr32(trgttiml, rq->perout.start.nsec); + tsauxc |= tsauxc_mask; + tsim |= tsim_mask; + } else { +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 2db653225a0e..87c7f52c3419 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -304,6 +304,7 @@ struct mvneta_port { + unsigned int link; + unsigned int duplex; + unsigned int speed; ++ unsigned int tx_csum_limit; + }; + + /* The mvneta_tx_desc and mvneta_rx_desc structures describe the +@@ -2441,8 +2442,10 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + + dev->mtu = mtu; + +- if (!netif_running(dev)) ++ if (!netif_running(dev)) { ++ netdev_update_features(dev); + return 0; ++ } + + /* The interface is running, so we have to force a + * reallocation of the queues +@@ -2471,9 +2474,26 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu) + mvneta_start_dev(pp); + mvneta_port_up(pp); + ++ netdev_update_features(dev); ++ + return 0; + } + ++static netdev_features_t mvneta_fix_features(struct net_device *dev, ++ netdev_features_t features) ++{ ++ struct mvneta_port *pp = netdev_priv(dev); ++ ++ if (pp->tx_csum_limit && dev->mtu > pp->tx_csum_limit) { ++ features &= ~(NETIF_F_IP_CSUM | NETIF_F_TSO); ++ netdev_info(dev, ++ "Disable IP checksum for MTU greater than %dB\n", ++ pp->tx_csum_limit); ++ } ++ ++ return features; ++} ++ + /* Get mac address */ + static void mvneta_get_mac_addr(struct mvneta_port *pp, unsigned char *addr) + { +@@ -2785,6 +2805,7 @@ static const struct net_device_ops mvneta_netdev_ops = { + .ndo_set_rx_mode = mvneta_set_rx_mode, + .ndo_set_mac_address = mvneta_set_mac_addr, + .ndo_change_mtu = mvneta_change_mtu, ++ .ndo_fix_features = mvneta_fix_features, + .ndo_get_stats64 = mvneta_get_stats64, + .ndo_do_ioctl = mvneta_ioctl, + }; +@@ -3023,6 +3044,9 @@ static int mvneta_probe(struct platform_device *pdev) + } + } + ++ if (of_device_is_compatible(dn, "marvell,armada-370-neta")) ++ pp->tx_csum_limit = 1600; ++ + pp->tx_ring_size = MVNETA_MAX_TXD; + pp->rx_ring_size = MVNETA_MAX_RXD; + +@@ -3095,6 +3119,7 @@ static int mvneta_remove(struct platform_device *pdev) + + static const struct of_device_id mvneta_match[] = { + { .compatible = "marvell,armada-370-neta" }, ++ { .compatible = "marvell,armada-xp-neta" }, + { } + }; + MODULE_DEVICE_TABLE(of, mvneta_match); +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 2f1324bed7b3..f30c32241580 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1971,10 +1971,6 @@ void mlx4_en_free_resources(struct mlx4_en_priv *priv) + mlx4_en_destroy_cq(priv, &priv->rx_cq[i]); + } + +- if (priv->base_tx_qpn) { +- mlx4_qp_release_range(priv->mdev->dev, priv->base_tx_qpn, priv->tx_ring_num); +- priv->base_tx_qpn = 0; +- } + } + + int mlx4_en_alloc_resources(struct mlx4_en_priv *priv) +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +index 05ec5e151ded..3478c87f10e7 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +@@ -723,7 +723,7 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb, + } + #endif + static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va, +- int hwtstamp_rx_filter) ++ netdev_features_t dev_features) + { + __wsum hw_checksum = 0; + +@@ -731,14 +731,8 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va, + + hw_checksum = csum_unfold((__force __sum16)cqe->checksum); + +- if (((struct ethhdr *)va)->h_proto == htons(ETH_P_8021Q) && +- hwtstamp_rx_filter != HWTSTAMP_FILTER_NONE) { +- /* next protocol non IPv4 or IPv6 */ +- if (((struct vlan_hdr *)hdr)->h_vlan_encapsulated_proto +- != htons(ETH_P_IP) && +- ((struct vlan_hdr *)hdr)->h_vlan_encapsulated_proto +- != htons(ETH_P_IPV6)) +- return -1; ++ if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_VLAN_PRESENT_MASK) && ++ !(dev_features & NETIF_F_HW_VLAN_CTAG_RX)) { + hw_checksum = get_fixed_vlan_csum(hw_checksum, hdr); + hdr += sizeof(struct vlan_hdr); + } +@@ -901,7 +895,8 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud + + if (ip_summed == CHECKSUM_COMPLETE) { + void *va = skb_frag_address(skb_shinfo(gro_skb)->frags); +- if (check_csum(cqe, gro_skb, va, ring->hwtstamp_rx_filter)) { ++ if (check_csum(cqe, gro_skb, va, ++ dev->features)) { + ip_summed = CHECKSUM_NONE; + ring->csum_none++; + ring->csum_complete--; +@@ -956,7 +951,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud + } + + if (ip_summed == CHECKSUM_COMPLETE) { +- if (check_csum(cqe, skb, skb->data, ring->hwtstamp_rx_filter)) { ++ if (check_csum(cqe, skb, skb->data, dev->features)) { + ip_summed = CHECKSUM_NONE; + ring->csum_complete--; + ring->csum_none++; +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +index 8c234ec1d8aa..35dd887447d6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c +@@ -66,6 +66,7 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv, + ring->size = size; + ring->size_mask = size - 1; + ring->stride = stride; ++ ring->full_size = ring->size - HEADROOM - MAX_DESC_TXBBS; + + tmp = size * sizeof(struct mlx4_en_tx_info); + ring->tx_info = kmalloc_node(tmp, GFP_KERNEL | __GFP_NOWARN, node); +@@ -180,6 +181,7 @@ void mlx4_en_destroy_tx_ring(struct mlx4_en_priv *priv, + mlx4_bf_free(mdev->dev, &ring->bf); + mlx4_qp_remove(mdev->dev, &ring->qp); + mlx4_qp_free(mdev->dev, &ring->qp); ++ mlx4_qp_release_range(priv->mdev->dev, ring->qpn, 1); + mlx4_en_unmap_buffer(&ring->wqres.buf); + mlx4_free_hwq_res(mdev->dev, &ring->wqres, ring->buf_size); + kfree(ring->bounce_buf); +@@ -231,6 +233,11 @@ void mlx4_en_deactivate_tx_ring(struct mlx4_en_priv *priv, + MLX4_QP_STATE_RST, NULL, 0, 0, &ring->qp); + } + ++static inline bool mlx4_en_is_tx_ring_full(struct mlx4_en_tx_ring *ring) ++{ ++ return ring->prod - ring->cons > ring->full_size; ++} ++ + static void mlx4_en_stamp_wqe(struct mlx4_en_priv *priv, + struct mlx4_en_tx_ring *ring, int index, + u8 owner) +@@ -473,11 +480,10 @@ static bool mlx4_en_process_tx_cq(struct net_device *dev, + + netdev_tx_completed_queue(ring->tx_queue, packets, bytes); + +- /* +- * Wakeup Tx queue if this stopped, and at least 1 packet +- * was completed ++ /* Wakeup Tx queue if this stopped, and ring is not full. + */ +- if (netif_tx_queue_stopped(ring->tx_queue) && txbbs_skipped > 0) { ++ if (netif_tx_queue_stopped(ring->tx_queue) && ++ !mlx4_en_is_tx_ring_full(ring)) { + netif_tx_wake_queue(ring->tx_queue); + ring->wake_queue++; + } +@@ -921,8 +927,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev) + skb_tx_timestamp(skb); + + /* Check available TXBBs And 2K spare for prefetch */ +- stop_queue = (int)(ring->prod - ring_cons) > +- ring->size - HEADROOM - MAX_DESC_TXBBS; ++ stop_queue = mlx4_en_is_tx_ring_full(ring); + if (unlikely(stop_queue)) { + netif_tx_stop_queue(ring->tx_queue); + ring->queue_stopped++; +@@ -991,8 +996,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev) + smp_rmb(); + + ring_cons = ACCESS_ONCE(ring->cons); +- if (unlikely(((int)(ring->prod - ring_cons)) <= +- ring->size - HEADROOM - MAX_DESC_TXBBS)) { ++ if (unlikely(!mlx4_en_is_tx_ring_full(ring))) { + netif_tx_wake_queue(ring->tx_queue); + ring->wake_queue++; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c +index 6fce58718837..0d80aed59043 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/intf.c ++++ b/drivers/net/ethernet/mellanox/mlx4/intf.c +@@ -93,8 +93,14 @@ int mlx4_register_interface(struct mlx4_interface *intf) + mutex_lock(&intf_mutex); + + list_add_tail(&intf->list, &intf_list); +- list_for_each_entry(priv, &dev_list, dev_list) ++ list_for_each_entry(priv, &dev_list, dev_list) { ++ if (mlx4_is_mfunc(&priv->dev) && (intf->flags & MLX4_INTFF_BONDING)) { ++ mlx4_dbg(&priv->dev, ++ "SRIOV, disabling HA mode for intf proto %d\n", intf->protocol); ++ intf->flags &= ~MLX4_INTFF_BONDING; ++ } + mlx4_add_device(intf, priv); ++ } + + mutex_unlock(&intf_mutex); + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index 8687c8d54227..0bf0fdd5d2b5 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -280,6 +280,7 @@ struct mlx4_en_tx_ring { + u32 size; /* number of TXBBs */ + u32 size_mask; + u16 stride; ++ u32 full_size; + u16 cqn; /* index of port CQ associated with this ring */ + u32 buf_size; + __be32 doorbell_qpn; +@@ -601,7 +602,6 @@ struct mlx4_en_priv { + int vids[128]; + bool wol; + struct device *ddev; +- int base_tx_qpn; + struct hlist_head mac_hash[MLX4_EN_MAC_HASH_SIZE]; + struct hwtstamp_config hwtstamp_config; + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index bdfe51fc3a65..d551df62e61a 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -796,10 +796,11 @@ static int genphy_config_advert(struct phy_device *phydev) + if (phydev->supported & (SUPPORTED_1000baseT_Half | + SUPPORTED_1000baseT_Full)) { + adv |= ethtool_adv_to_mii_ctrl1000_t(advertise); +- if (adv != oldadv) +- changed = 1; + } + ++ if (adv != oldadv) ++ changed = 1; ++ + err = phy_write(phydev, MII_CTRL1000, adv); + if (err < 0) + return err; +diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c +index 71d7802aa8b4..57171173739f 100644 +--- a/drivers/s390/kvm/virtio_ccw.c ++++ b/drivers/s390/kvm/virtio_ccw.c +@@ -65,6 +65,7 @@ struct virtio_ccw_device { + bool is_thinint; + bool going_away; + bool device_lost; ++ unsigned int config_ready; + void *airq_info; + }; + +@@ -833,8 +834,11 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, + if (ret) + goto out_free; + +- memcpy(vcdev->config, config_area, sizeof(vcdev->config)); +- memcpy(buf, &vcdev->config[offset], len); ++ memcpy(vcdev->config, config_area, offset + len); ++ if (buf) ++ memcpy(buf, &vcdev->config[offset], len); ++ if (vcdev->config_ready < offset + len) ++ vcdev->config_ready = offset + len; + + out_free: + kfree(config_area); +@@ -857,6 +861,9 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, + if (!config_area) + goto out_free; + ++ /* Make sure we don't overwrite fields. */ ++ if (vcdev->config_ready < offset) ++ virtio_ccw_get_config(vdev, 0, NULL, offset); + memcpy(&vcdev->config[offset], buf, len); + /* Write the config area to the host. */ + memcpy(config_area, vcdev->config, sizeof(vcdev->config)); +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 175c9956cbe3..ce3b40734a86 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -845,7 +845,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) + ret = ep->status; + if (io_data->read && ret > 0) { + ret = copy_to_iter(data, ret, &io_data->data); +- if (unlikely(iov_iter_count(&io_data->data))) ++ if (!ret) + ret = -EFAULT; + } + } +@@ -3433,6 +3433,7 @@ done: + static void ffs_closed(struct ffs_data *ffs) + { + struct ffs_dev *ffs_obj; ++ struct f_fs_opts *opts; + + ENTER(); + ffs_dev_lock(); +@@ -3446,8 +3447,13 @@ static void ffs_closed(struct ffs_data *ffs) + if (ffs_obj->ffs_closed_callback) + ffs_obj->ffs_closed_callback(ffs); + +- if (!ffs_obj->opts || ffs_obj->opts->no_configfs +- || !ffs_obj->opts->func_inst.group.cg_item.ci_parent) ++ if (ffs_obj->opts) ++ opts = ffs_obj->opts; ++ else ++ goto done; ++ ++ if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent ++ || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) + goto done; + + unregister_gadget_item(ffs_obj->opts-> +diff --git a/fs/dcache.c b/fs/dcache.c +index 922f23ef6041..b05c557d0422 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -2896,17 +2896,6 @@ restart: + vfsmnt = &mnt->mnt; + continue; + } +- /* +- * Filesystems needing to implement special "root names" +- * should do so with ->d_dname() +- */ +- if (IS_ROOT(dentry) && +- (dentry->d_name.len != 1 || +- dentry->d_name.name[0] != '/')) { +- WARN(1, "Root dentry has weird name <%.*s>\n", +- (int) dentry->d_name.len, +- dentry->d_name.name); +- } + if (!error) + error = is_mounted(vfsmnt) ? 1 : 2; + break; +diff --git a/fs/inode.c b/fs/inode.c +index f00b16f45507..c60671d556bc 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -1693,8 +1693,8 @@ int file_remove_suid(struct file *file) + error = security_inode_killpriv(dentry); + if (!error && killsuid) + error = __remove_suid(dentry, killsuid); +- if (!error && (inode->i_sb->s_flags & MS_NOSEC)) +- inode->i_flags |= S_NOSEC; ++ if (!error) ++ inode_has_no_xattr(inode); + + return error; + } +diff --git a/fs/namespace.c b/fs/namespace.c +index 13b0f7bfc096..f07c7691ace1 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -3187,11 +3187,15 @@ bool fs_fully_visible(struct file_system_type *type) + if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) + continue; + +- /* This mount is not fully visible if there are any child mounts +- * that cover anything except for empty directories. ++ /* This mount is not fully visible if there are any ++ * locked child mounts that cover anything except for ++ * empty directories. + */ + list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { + struct inode *inode = child->mnt_mountpoint->d_inode; ++ /* Only worry about locked mounts */ ++ if (!(mnt->mnt.mnt_flags & MNT_LOCKED)) ++ continue; + if (!S_ISDIR(inode->i_mode)) + goto next; + if (inode->i_nlink > 2) +diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c +index 2c1036080d52..a7106eda5024 100644 +--- a/fs/ufs/balloc.c ++++ b/fs/ufs/balloc.c +@@ -51,8 +51,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count) + + if (ufs_fragnum(fragment) + count > uspi->s_fpg) + ufs_error (sb, "ufs_free_fragments", "internal error"); +- +- lock_ufs(sb); ++ ++ mutex_lock(&UFS_SB(sb)->s_lock); + + cgno = ufs_dtog(uspi, fragment); + bit = ufs_dtogd(uspi, fragment); +@@ -115,13 +115,13 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count) + if (sb->s_flags & MS_SYNCHRONOUS) + ubh_sync_block(UCPI_UBH(ucpi)); + ufs_mark_sb_dirty(sb); +- +- unlock_ufs(sb); ++ ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT\n"); + return; + + failed: +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT (FAILED)\n"); + return; + } +@@ -151,7 +151,7 @@ void ufs_free_blocks(struct inode *inode, u64 fragment, unsigned count) + goto failed; + } + +- lock_ufs(sb); ++ mutex_lock(&UFS_SB(sb)->s_lock); + + do_more: + overflow = 0; +@@ -211,12 +211,12 @@ do_more: + } + + ufs_mark_sb_dirty(sb); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT\n"); + return; + + failed_unlock: +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + failed: + UFSD("EXIT (FAILED)\n"); + return; +@@ -357,7 +357,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + usb1 = ubh_get_usb_first(uspi); + *err = -ENOSPC; + +- lock_ufs(sb); ++ mutex_lock(&UFS_SB(sb)->s_lock); + tmp = ufs_data_ptr_to_cpu(sb, p); + + if (count + ufs_fragnum(fragment) > uspi->s_fpb) { +@@ -378,19 +378,19 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + "fragment %llu, tmp %llu\n", + (unsigned long long)fragment, + (unsigned long long)tmp); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + return INVBLOCK; + } + if (fragment < UFS_I(inode)->i_lastfrag) { + UFSD("EXIT (ALREADY ALLOCATED)\n"); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + return 0; + } + } + else { + if (tmp) { + UFSD("EXIT (ALREADY ALLOCATED)\n"); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + return 0; + } + } +@@ -399,7 +399,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + * There is not enough space for user on the device + */ + if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) { +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT (FAILED)\n"); + return 0; + } +@@ -424,7 +424,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + ufs_clear_frags(inode, result + oldcount, + newcount - oldcount, locked_page != NULL); + } +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT, result %llu\n", (unsigned long long)result); + return result; + } +@@ -439,7 +439,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + fragment + count); + ufs_clear_frags(inode, result + oldcount, newcount - oldcount, + locked_page != NULL); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT, result %llu\n", (unsigned long long)result); + return result; + } +@@ -477,7 +477,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + *err = 0; + UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag, + fragment + count); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + if (newcount < request) + ufs_free_fragments (inode, result + newcount, request - newcount); + ufs_free_fragments (inode, tmp, oldcount); +@@ -485,7 +485,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, + return result; + } + +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT (FAILED)\n"); + return 0; + } +diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c +index 7caa01652888..fd0203ce1f7f 100644 +--- a/fs/ufs/ialloc.c ++++ b/fs/ufs/ialloc.c +@@ -69,11 +69,11 @@ void ufs_free_inode (struct inode * inode) + + ino = inode->i_ino; + +- lock_ufs(sb); ++ mutex_lock(&UFS_SB(sb)->s_lock); + + if (!((ino > 1) && (ino < (uspi->s_ncg * uspi->s_ipg )))) { + ufs_warning(sb, "ufs_free_inode", "reserved inode or nonexistent inode %u\n", ino); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + return; + } + +@@ -81,7 +81,7 @@ void ufs_free_inode (struct inode * inode) + bit = ufs_inotocgoff (ino); + ucpi = ufs_load_cylinder (sb, cg); + if (!ucpi) { +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + return; + } + ucg = ubh_get_ucg(UCPI_UBH(ucpi)); +@@ -115,7 +115,7 @@ void ufs_free_inode (struct inode * inode) + ubh_sync_block(UCPI_UBH(ucpi)); + + ufs_mark_sb_dirty(sb); +- unlock_ufs(sb); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + UFSD("EXIT\n"); + } + +@@ -193,7 +193,7 @@ struct inode *ufs_new_inode(struct inode *dir, umode_t mode) + sbi = UFS_SB(sb); + uspi = sbi->s_uspi; + +- lock_ufs(sb); ++ mutex_lock(&sbi->s_lock); + + /* + * Try to place the inode in its parent directory +@@ -331,21 +331,21 @@ cg_found: + sync_dirty_buffer(bh); + brelse(bh); + } +- unlock_ufs(sb); ++ mutex_unlock(&sbi->s_lock); + + UFSD("allocating inode %lu\n", inode->i_ino); + UFSD("EXIT\n"); + return inode; + + fail_remove_inode: +- unlock_ufs(sb); ++ mutex_unlock(&sbi->s_lock); + clear_nlink(inode); + unlock_new_inode(inode); + iput(inode); + UFSD("EXIT (FAILED): err %d\n", err); + return ERR_PTR(err); + failed: +- unlock_ufs(sb); ++ mutex_unlock(&sbi->s_lock); + make_bad_inode(inode); + iput (inode); + UFSD("EXIT (FAILED): err %d\n", err); +diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c +index be7d42c7d938..2d93ab07da8a 100644 +--- a/fs/ufs/inode.c ++++ b/fs/ufs/inode.c +@@ -902,6 +902,9 @@ void ufs_evict_inode(struct inode * inode) + invalidate_inode_buffers(inode); + clear_inode(inode); + +- if (want_delete) ++ if (want_delete) { ++ lock_ufs(inode->i_sb); + ufs_free_inode(inode); ++ unlock_ufs(inode->i_sb); ++ } + } +diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c +index fd65deb4b5f0..e8ee2985b068 100644 +--- a/fs/ufs/namei.c ++++ b/fs/ufs/namei.c +@@ -128,12 +128,12 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry, + if (l > sb->s_blocksize) + goto out_notlocked; + ++ lock_ufs(dir->i_sb); + inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO); + err = PTR_ERR(inode); + if (IS_ERR(inode)) +- goto out_notlocked; ++ goto out; + +- lock_ufs(dir->i_sb); + if (l > UFS_SB(sb)->s_uspi->s_maxsymlinklen) { + /* slow symlink */ + inode->i_op = &ufs_symlink_inode_operations; +@@ -174,7 +174,12 @@ static int ufs_link (struct dentry * old_dentry, struct inode * dir, + inode_inc_link_count(inode); + ihold(inode); + +- error = ufs_add_nondir(dentry, inode); ++ error = ufs_add_link(dentry, inode); ++ if (error) { ++ inode_dec_link_count(inode); ++ iput(inode); ++ } else ++ d_instantiate(dentry, inode); + unlock_ufs(dir->i_sb); + return error; + } +@@ -184,9 +189,13 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) + struct inode * inode; + int err; + ++ lock_ufs(dir->i_sb); ++ inode_inc_link_count(dir); ++ + inode = ufs_new_inode(dir, S_IFDIR|mode); ++ err = PTR_ERR(inode); + if (IS_ERR(inode)) +- return PTR_ERR(inode); ++ goto out_dir; + + inode->i_op = &ufs_dir_inode_operations; + inode->i_fop = &ufs_dir_operations; +@@ -194,9 +203,6 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) + + inode_inc_link_count(inode); + +- lock_ufs(dir->i_sb); +- inode_inc_link_count(dir); +- + err = ufs_make_empty(inode, dir); + if (err) + goto out_fail; +@@ -206,6 +212,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) + goto out_fail; + unlock_ufs(dir->i_sb); + ++ unlock_new_inode(inode); + d_instantiate(dentry, inode); + out: + return err; +@@ -215,6 +222,7 @@ out_fail: + inode_dec_link_count(inode); + unlock_new_inode(inode); + iput (inode); ++out_dir: + inode_dec_link_count(dir); + unlock_ufs(dir->i_sb); + goto out; +diff --git a/fs/ufs/super.c b/fs/ufs/super.c +index 8092d3759a5e..eb1679176cbc 100644 +--- a/fs/ufs/super.c ++++ b/fs/ufs/super.c +@@ -694,6 +694,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait) + unsigned flags; + + lock_ufs(sb); ++ mutex_lock(&UFS_SB(sb)->s_lock); + + UFSD("ENTER\n"); + +@@ -711,6 +712,7 @@ static int ufs_sync_fs(struct super_block *sb, int wait) + ufs_put_cstotal(sb); + + UFSD("EXIT\n"); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + + return 0; +@@ -799,6 +801,7 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent) + UFSD("flag %u\n", (int)(sb->s_flags & MS_RDONLY)); + + mutex_init(&sbi->mutex); ++ mutex_init(&sbi->s_lock); + spin_lock_init(&sbi->work_lock); + INIT_DELAYED_WORK(&sbi->sync_work, delayed_sync_fs); + /* +@@ -1277,6 +1280,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + + sync_filesystem(sb); + lock_ufs(sb); ++ mutex_lock(&UFS_SB(sb)->s_lock); + uspi = UFS_SB(sb)->s_uspi; + flags = UFS_SB(sb)->s_flags; + usb1 = ubh_get_usb_first(uspi); +@@ -1290,6 +1294,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + new_mount_opt = 0; + ufs_set_opt (new_mount_opt, ONERROR_LOCK); + if (!ufs_parse_options (data, &new_mount_opt)) { ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return -EINVAL; + } +@@ -1297,12 +1302,14 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + new_mount_opt |= ufstype; + } else if ((new_mount_opt & UFS_MOUNT_UFSTYPE) != ufstype) { + pr_err("ufstype can't be changed during remount\n"); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return -EINVAL; + } + + if ((*mount_flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) { + UFS_SB(sb)->s_mount_opt = new_mount_opt; ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return 0; + } +@@ -1326,6 +1333,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + */ + #ifndef CONFIG_UFS_FS_WRITE + pr_err("ufs was compiled with read-only support, can't be mounted as read-write\n"); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return -EINVAL; + #else +@@ -1335,11 +1343,13 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + ufstype != UFS_MOUNT_UFSTYPE_SUNx86 && + ufstype != UFS_MOUNT_UFSTYPE_UFS2) { + pr_err("this ufstype is read-only supported\n"); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return -EINVAL; + } + if (!ufs_read_cylinder_structures(sb)) { + pr_err("failed during remounting\n"); ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return -EPERM; + } +@@ -1347,6 +1357,7 @@ static int ufs_remount (struct super_block *sb, int *mount_flags, char *data) + #endif + } + UFS_SB(sb)->s_mount_opt = new_mount_opt; ++ mutex_unlock(&UFS_SB(sb)->s_lock); + unlock_ufs(sb); + return 0; + } +diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h +index 2a07396d5f9e..cf6368d42d4a 100644 +--- a/fs/ufs/ufs.h ++++ b/fs/ufs/ufs.h +@@ -30,6 +30,7 @@ struct ufs_sb_info { + int work_queued; /* non-zero if the delayed work is queued */ + struct delayed_work sync_work; /* FS sync delayed work */ + spinlock_t work_lock; /* protects sync_work and work_queued */ ++ struct mutex s_lock; + }; + + struct ufs_inode_info { +diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h +index 3573a81815ad..8ba379f9e467 100644 +--- a/include/net/netns/sctp.h ++++ b/include/net/netns/sctp.h +@@ -31,6 +31,7 @@ struct netns_sctp { + struct list_head addr_waitq; + struct timer_list addr_wq_timer; + struct list_head auto_asconf_splist; ++ /* Lock that protects both addr_waitq and auto_asconf_splist */ + spinlock_t addr_wq_lock; + + /* Lock that protects the local_addr_list writers */ +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index 2bb2fcf5b11f..495c87e367b3 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -223,6 +223,10 @@ struct sctp_sock { + atomic_t pd_mode; + /* Receive to here while partial delivery is in effect. */ + struct sk_buff_head pd_lobby; ++ ++ /* These must be the last fields, as they will skipped on copies, ++ * like on accept and peeloff operations ++ */ + struct list_head auto_asconf_list; + int do_auto_asconf; + }; +diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c +index a9a4a1b7863d..8d423bc649b9 100644 +--- a/net/bridge/br_ioctl.c ++++ b/net/bridge/br_ioctl.c +@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) + if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN)) + return -EPERM; + +- spin_lock_bh(&br->lock); + br_stp_set_bridge_priority(br, args[1]); +- spin_unlock_bh(&br->lock); + return 0; + + case BRCTL_SET_PORT_PRIORITY: +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index b0aee78dba41..c08f510fce30 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1166,6 +1166,9 @@ static void br_multicast_add_router(struct net_bridge *br, + struct net_bridge_port *p; + struct hlist_node *slot = NULL; + ++ if (!hlist_unhashed(&port->rlist)) ++ return; ++ + hlist_for_each_entry(p, &br->router_list, rlist) { + if ((unsigned long) port >= (unsigned long) p) + break; +@@ -1193,12 +1196,8 @@ static void br_multicast_mark_router(struct net_bridge *br, + if (port->multicast_router != 1) + return; + +- if (!hlist_unhashed(&port->rlist)) +- goto timer; +- + br_multicast_add_router(br, port); + +-timer: + mod_timer(&port->multicast_router_timer, + now + br->multicast_querier_interval); + } +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index 41146872c1b4..7832d07f48f6 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br) + return true; + } + +-/* called under bridge lock */ ++/* Acquires and releases bridge lock */ + void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + { + struct net_bridge_port *p; + int wasroot; + ++ spin_lock_bh(&br->lock); + wasroot = br_is_root_bridge(br); + + list_for_each_entry(p, &br->port_list, list) { +@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio) + br_port_state_selection(br); + if (br_is_root_bridge(br) && !wasroot) + br_become_root_bridge(br); ++ spin_unlock_bh(&br->lock); + } + + /* called under bridge lock */ +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 70fe9e10ac86..d0e5d6613b1b 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -971,6 +971,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) + rc = 0; + if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE)) + goto out_unlock_bh; ++ if (neigh->dead) ++ goto out_dead; + + if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) { + if (NEIGH_VAR(neigh->parms, MCAST_PROBES) + +@@ -1027,6 +1029,13 @@ out_unlock_bh: + write_unlock(&neigh->lock); + local_bh_enable(); + return rc; ++ ++out_dead: ++ if (neigh->nud_state & NUD_STALE) ++ goto out_unlock_bh; ++ write_unlock_bh(&neigh->lock); ++ kfree_skb(skb); ++ return 1; + } + EXPORT_SYMBOL(__neigh_event_send); + +@@ -1090,6 +1099,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + if (!(flags & NEIGH_UPDATE_F_ADMIN) && + (old & (NUD_NOARP | NUD_PERMANENT))) + goto out; ++ if (neigh->dead) ++ goto out; + + if (!(new & NUD_VALID)) { + neigh_del_timer(neigh); +@@ -1239,6 +1250,8 @@ EXPORT_SYMBOL(neigh_update); + */ + void __neigh_set_probe_once(struct neighbour *neigh) + { ++ if (neigh->dead) ++ return; + neigh->updated = jiffies; + if (!(neigh->nud_state & NUD_FAILED)) + return; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index e9f9a15fce4e..1e3abb8ac2ef 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4443,7 +4443,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len, + + while (order) { + if (npages >= 1 << order) { +- page = alloc_pages(gfp_mask | ++ page = alloc_pages((gfp_mask & ~__GFP_WAIT) | + __GFP_COMP | + __GFP_NOWARN | + __GFP_NORETRY, +diff --git a/net/core/sock.c b/net/core/sock.c +index 71e3e5f1eaa0..c77d5d21a85f 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1895,7 +1895,7 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t gfp) + + pfrag->offset = 0; + if (SKB_FRAG_PAGE_ORDER) { +- pfrag->page = alloc_pages(gfp | __GFP_COMP | ++ pfrag->page = alloc_pages((gfp & ~__GFP_WAIT) | __GFP_COMP | + __GFP_NOWARN | __GFP_NORETRY, + SKB_FRAG_PAGE_ORDER); + if (likely(pfrag->page)) { +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index d2e49baaff63..61edc496b7d0 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog) + err = 0; + if (err) + goto out; ++ ++ tcp_fastopen_init_key_once(true); + } + err = inet_csk_listen_start(sk, backlog); + if (err) +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 5cd99271d3a6..d9e8ff31aba0 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -432,6 +432,15 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf + kfree_skb(skb); + } + ++/* For some errors we have valid addr_offset even with zero payload and ++ * zero port. Also, addr_offset should be supported if port is set. ++ */ ++static inline bool ipv4_datagram_support_addr(struct sock_exterr_skb *serr) ++{ ++ return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP || ++ serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port; ++} ++ + /* IPv4 supports cmsg on all imcp errors and some timestamps + * + * Timestamp code paths do not initialize the fields expected by cmsg: +@@ -498,7 +507,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + + serr = SKB_EXT_ERR(skb); + +- if (sin && serr->port) { ++ if (sin && ipv4_datagram_support_addr(serr)) { + sin->sin_family = AF_INET; + sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) + + serr->addr_offset); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 995a2259bcfc..d03a344210aa 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2541,10 +2541,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level, + + case TCP_FASTOPEN: + if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE | +- TCPF_LISTEN))) ++ TCPF_LISTEN))) { ++ tcp_fastopen_init_key_once(true); ++ + err = fastopen_init_queue(sk, val); +- else ++ } else { + err = -EINVAL; ++ } + break; + case TCP_TIMESTAMP: + if (!tp->repair) +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index ea82fd492c1b..9c371815092a 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -78,8 +78,6 @@ static bool __tcp_fastopen_cookie_gen(const void *path, + struct tcp_fastopen_context *ctx; + bool ok = false; + +- tcp_fastopen_init_key_once(true); +- + rcu_read_lock(); + ctx = rcu_dereference(tcp_fastopen_ctx); + if (ctx) { +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index ace8daca5c83..d174b914fc77 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -325,6 +325,16 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu) + kfree_skb(skb); + } + ++/* For some errors we have valid addr_offset even with zero payload and ++ * zero port. Also, addr_offset should be supported if port is set. ++ */ ++static inline bool ipv6_datagram_support_addr(struct sock_exterr_skb *serr) ++{ ++ return serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6 || ++ serr->ee.ee_origin == SO_EE_ORIGIN_ICMP || ++ serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL || serr->port; ++} ++ + /* IPv6 supports cmsg on all origins aside from SO_EE_ORIGIN_LOCAL. + * + * At one point, excluding local errors was a quick test to identify icmp/icmp6 +@@ -389,7 +399,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + + serr = SKB_EXT_ERR(skb); + +- if (sin && serr->port) { ++ if (sin && ipv6_datagram_support_addr(serr)) { + const unsigned char *nh = skb_network_header(skb); + sin->sin6_family = AF_INET6; + sin->sin6_flowinfo = 0; +diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c +index 46214f245665..2c75361077f7 100644 +--- a/net/netfilter/nft_rbtree.c ++++ b/net/netfilter/nft_rbtree.c +@@ -37,10 +37,11 @@ static bool nft_rbtree_lookup(const struct nft_set *set, + { + const struct nft_rbtree *priv = nft_set_priv(set); + const struct nft_rbtree_elem *rbe, *interval = NULL; +- const struct rb_node *parent = priv->root.rb_node; ++ const struct rb_node *parent; + int d; + + spin_lock_bh(&nft_rbtree_lock); ++ parent = priv->root.rb_node; + while (parent != NULL) { + rbe = rb_entry(parent, struct nft_rbtree_elem, node); + +@@ -158,7 +159,6 @@ static int nft_rbtree_get(const struct nft_set *set, struct nft_set_elem *elem) + struct nft_rbtree_elem *rbe; + int d; + +- spin_lock_bh(&nft_rbtree_lock); + while (parent != NULL) { + rbe = rb_entry(parent, struct nft_rbtree_elem, node); + +@@ -173,11 +173,9 @@ static int nft_rbtree_get(const struct nft_set *set, struct nft_set_elem *elem) + !(rbe->flags & NFT_SET_ELEM_INTERVAL_END)) + nft_data_copy(&elem->data, rbe->data); + elem->flags = rbe->flags; +- spin_unlock_bh(&nft_rbtree_lock); + return 0; + } + } +- spin_unlock_bh(&nft_rbtree_lock); + return -ENOENT; + } + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index f8db7064d81c..bfe5c6916dac 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1266,16 +1266,6 @@ static void packet_sock_destruct(struct sock *sk) + sk_refcnt_debug_dec(sk); + } + +-static int fanout_rr_next(struct packet_fanout *f, unsigned int num) +-{ +- int x = atomic_read(&f->rr_cur) + 1; +- +- if (x >= num) +- x = 0; +- +- return x; +-} +- + static unsigned int fanout_demux_hash(struct packet_fanout *f, + struct sk_buff *skb, + unsigned int num) +@@ -1287,13 +1277,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f, + struct sk_buff *skb, + unsigned int num) + { +- int cur, old; ++ unsigned int val = atomic_inc_return(&f->rr_cur); + +- cur = atomic_read(&f->rr_cur); +- while ((old = atomic_cmpxchg(&f->rr_cur, cur, +- fanout_rr_next(f, num))) != cur) +- cur = old; +- return cur; ++ return val % num; + } + + static unsigned int fanout_demux_cpu(struct packet_fanout *f, +@@ -1347,7 +1333,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev, + struct packet_type *pt, struct net_device *orig_dev) + { + struct packet_fanout *f = pt->af_packet_priv; +- unsigned int num = f->num_members; ++ unsigned int num = READ_ONCE(f->num_members); + struct packet_sock *po; + unsigned int idx; + +diff --git a/net/sctp/output.c b/net/sctp/output.c +index fc5e45b8a832..abe7c2db2412 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -599,7 +599,9 @@ out: + return err; + no_route: + kfree_skb(nskb); +- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); ++ ++ if (asoc) ++ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); + + /* FIXME: Returning the 'err' will effect all the associations + * associated with a socket, although only one of the paths of the +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index aafe94bf292e..4e565715d016 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1533,8 +1533,10 @@ static void sctp_close(struct sock *sk, long timeout) + + /* Supposedly, no process has access to the socket, but + * the net layers still may. ++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock ++ * held and that should be grabbed before socket lock. + */ +- local_bh_disable(); ++ spin_lock_bh(&net->sctp.addr_wq_lock); + bh_lock_sock(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() +@@ -1544,7 +1546,7 @@ static void sctp_close(struct sock *sk, long timeout) + sk_common_release(sk); + + bh_unlock_sock(sk); +- local_bh_enable(); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + + sock_put(sk); + +@@ -3587,6 +3589,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf)) + return 0; + ++ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock); + if (val == 0 && sp->do_auto_asconf) { + list_del(&sp->auto_asconf_list); + sp->do_auto_asconf = 0; +@@ -3595,6 +3598,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval, + &sock_net(sk)->sctp.auto_asconf_splist); + sp->do_auto_asconf = 1; + } ++ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock); + return 0; + } + +@@ -4128,18 +4132,28 @@ static int sctp_init_sock(struct sock *sk) + local_bh_disable(); + percpu_counter_inc(&sctp_sockets_allocated); + sock_prot_inuse_add(net, sk->sk_prot, 1); ++ ++ /* Nothing can fail after this block, otherwise ++ * sctp_destroy_sock() will be called without addr_wq_lock held ++ */ + if (net->sctp.default_auto_asconf) { ++ spin_lock(&sock_net(sk)->sctp.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, + &net->sctp.auto_asconf_splist); + sp->do_auto_asconf = 1; +- } else ++ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock); ++ } else { + sp->do_auto_asconf = 0; ++ } ++ + local_bh_enable(); + + return 0; + } + +-/* Cleanup any SCTP per socket resources. */ ++/* Cleanup any SCTP per socket resources. Must be called with ++ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true ++ */ + static void sctp_destroy_sock(struct sock *sk) + { + struct sctp_sock *sp; +@@ -7202,6 +7216,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk, + newinet->mc_list = NULL; + } + ++static inline void sctp_copy_descendant(struct sock *sk_to, ++ const struct sock *sk_from) ++{ ++ int ancestor_size = sizeof(struct inet_sock) + ++ sizeof(struct sctp_sock) - ++ offsetof(struct sctp_sock, auto_asconf_list); ++ ++ if (sk_from->sk_family == PF_INET6) ++ ancestor_size += sizeof(struct ipv6_pinfo); ++ ++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size); ++} ++ + /* Populate the fields of the newsk from the oldsk and migrate the assoc + * and its messages to the newsk. + */ +@@ -7216,7 +7243,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + struct sk_buff *skb, *tmp; + struct sctp_ulpevent *event; + struct sctp_bind_hashbucket *head; +- struct list_head tmplist; + + /* Migrate socket buffer sizes and all the socket level options to the + * new socket. +@@ -7224,12 +7250,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + newsk->sk_sndbuf = oldsk->sk_sndbuf; + newsk->sk_rcvbuf = oldsk->sk_rcvbuf; + /* Brute force copy old sctp opt. */ +- if (oldsp->do_auto_asconf) { +- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist)); +- inet_sk_copy_descendant(newsk, oldsk); +- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist)); +- } else +- inet_sk_copy_descendant(newsk, oldsk); ++ sctp_copy_descendant(newsk, oldsk); + + /* Restore the ep value that was overwritten with the above structure + * copy. +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 4d1a54190388..2588e083c202 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -404,6 +404,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) + return sbsec->behavior == SECURITY_FS_USE_XATTR || + sbsec->behavior == SECURITY_FS_USE_TRANS || + sbsec->behavior == SECURITY_FS_USE_TASK || ++ sbsec->behavior == SECURITY_FS_USE_NATIVE || + /* Special handling. Genfs but also in-core setxattr handler */ + !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "pstore") ||
