diff --git a/patch/kernel/mvebu-default/patch-4.4.30-31.patch b/patch/kernel/mvebu-default/patch-4.4.30-31.patch deleted file mode 100644 index 4308f75f6..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.30-31.patch +++ /dev/null @@ -1,1716 +0,0 @@ -diff --git a/Makefile b/Makefile -index 98239d56924c..7c6f28e7a2f6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 30 -+SUBLEVEL = 31 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -617,6 +617,7 @@ include arch/$(SRCARCH)/Makefile - - KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) - KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) -+KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) - - ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE - KBUILD_CFLAGS += -Os -diff --git a/arch/arm/include/asm/floppy.h b/arch/arm/include/asm/floppy.h -index f4882553fbb0..85a34cc8316a 100644 ---- a/arch/arm/include/asm/floppy.h -+++ b/arch/arm/include/asm/floppy.h -@@ -17,7 +17,7 @@ - - #define fd_outb(val,port) \ - do { \ -- if ((port) == FD_DOR) \ -+ if ((port) == (u32)FD_DOR) \ - fd_setdor((val)); \ - else \ - outb((val),(port)); \ -diff --git a/arch/h8300/include/asm/thread_info.h b/arch/h8300/include/asm/thread_info.h -index b408fe660cf8..3cef06875f5c 100644 ---- a/arch/h8300/include/asm/thread_info.h -+++ b/arch/h8300/include/asm/thread_info.h -@@ -31,7 +31,6 @@ struct thread_info { - int cpu; /* cpu we're on */ - int preempt_count; /* 0 => preemptable, <0 => BUG */ - mm_segment_t addr_limit; -- struct restart_block restart_block; - }; - - /* -@@ -44,9 +43,6 @@ struct thread_info { - .cpu = 0, \ - .preempt_count = INIT_PREEMPT_COUNT, \ - .addr_limit = KERNEL_DS, \ -- .restart_block = { \ -- .fn = do_no_restart_syscall, \ -- }, \ - } - - #define init_thread_info (init_thread_union.thread_info) -diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c -index 380fffd081b2..036ad04edd2d 100644 ---- a/arch/h8300/kernel/signal.c -+++ b/arch/h8300/kernel/signal.c -@@ -79,7 +79,7 @@ restore_sigcontext(struct sigcontext *usc, int *pd0) - unsigned int er0; - - /* Always make any pending restarted system calls return -EINTR */ -- current_thread_info()->restart_block.fn = do_no_restart_syscall; -+ current->restart_block.fn = do_no_restart_syscall; - - /* restore passed registers */ - #define COPY(r) do { err |= get_user(regs->r, &usc->sc_##r); } while (0) -diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c -index 3251b206e55a..bbe56871245c 100644 ---- a/arch/mips/kvm/emulate.c -+++ b/arch/mips/kvm/emulate.c -@@ -752,15 +752,15 @@ enum emulation_result kvm_mips_emul_eret(struct kvm_vcpu *vcpu) - struct mips_coproc *cop0 = vcpu->arch.cop0; - enum emulation_result er = EMULATE_DONE; - -- if (kvm_read_c0_guest_status(cop0) & ST0_EXL) { -+ if (kvm_read_c0_guest_status(cop0) & ST0_ERL) { -+ kvm_clear_c0_guest_status(cop0, ST0_ERL); -+ vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0); -+ } else if (kvm_read_c0_guest_status(cop0) & ST0_EXL) { - kvm_debug("[%#lx] ERET to %#lx\n", vcpu->arch.pc, - kvm_read_c0_guest_epc(cop0)); - kvm_clear_c0_guest_status(cop0, ST0_EXL); - vcpu->arch.pc = kvm_read_c0_guest_epc(cop0); - -- } else if (kvm_read_c0_guest_status(cop0) & ST0_ERL) { -- kvm_clear_c0_guest_status(cop0, ST0_ERL); -- vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0); - } else { - kvm_err("[%#lx] ERET when MIPS_SR_EXL|MIPS_SR_ERL == 0\n", - vcpu->arch.pc); -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index fbafa0d0e2bf..a86b19fccb63 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -106,8 +106,6 @@ linux_gateway_entry: - mtsp %r0,%sr4 /* get kernel space into sr4 */ - mtsp %r0,%sr5 /* get kernel space into sr5 */ - mtsp %r0,%sr6 /* get kernel space into sr6 */ -- mfsp %sr7,%r1 /* save user sr7 */ -- mtsp %r1,%sr3 /* and store it in sr3 */ - - #ifdef CONFIG_64BIT - /* for now we can *always* set the W bit on entry to the syscall -@@ -133,6 +131,14 @@ linux_gateway_entry: - depdi 0, 31, 32, %r21 - 1: - #endif -+ -+ /* We use a rsm/ssm pair to prevent sr3 from being clobbered -+ * by external interrupts. -+ */ -+ mfsp %sr7,%r1 /* save user sr7 */ -+ rsm PSW_SM_I, %r0 /* disable interrupts */ -+ mtsp %r1,%sr3 /* and store it in sr3 */ -+ - mfctl %cr30,%r1 - xor %r1,%r30,%r30 /* ye olde xor trick */ - xor %r1,%r30,%r1 -@@ -147,6 +153,7 @@ linux_gateway_entry: - */ - - mtsp %r0,%sr7 /* get kernel space into sr7 */ -+ ssm PSW_SM_I, %r0 /* enable interrupts */ - STREGM %r1,FRAME_SIZE(%r30) /* save r1 (usp) here for now */ - mfctl %cr30,%r1 /* get task ptr in %r1 */ - LDREG TI_TASK(%r1),%r1 -diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c -index 737c0d0b53ac..b38fd081b222 100644 ---- a/arch/powerpc/kernel/ptrace.c -+++ b/arch/powerpc/kernel/ptrace.c -@@ -376,7 +376,7 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset, - - #else - BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) != -- offsetof(struct thread_fp_state, fpr[32][0])); -+ offsetof(struct thread_fp_state, fpr[32])); - - return user_regset_copyout(&pos, &count, &kbuf, &ubuf, - &target->thread.fp_state, 0, -1); -@@ -404,7 +404,7 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset, - return 0; - #else - BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) != -- offsetof(struct thread_fp_state, fpr[32][0])); -+ offsetof(struct thread_fp_state, fpr[32])); - - return user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &target->thread.fp_state, 0, -1); -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index 09b1b0ab94b7..b8c75f3aade8 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -332,7 +332,7 @@ do { \ - #define __get_user_asm_u64(x, ptr, retval, errret) \ - __get_user_asm(x, ptr, retval, "q", "", "=r", errret) - #define __get_user_asm_ex_u64(x, ptr) \ -- __get_user_asm_ex(x, ptr, "q", "", "=r") -+ __get_user_asm_ex(x, ptr, "q", "", "=&r") - #endif - - #define __get_user_size(x, ptr, size, retval, errret) \ -@@ -375,13 +375,13 @@ do { \ - __chk_user_ptr(ptr); \ - switch (size) { \ - case 1: \ -- __get_user_asm_ex(x, ptr, "b", "b", "=q"); \ -+ __get_user_asm_ex(x, ptr, "b", "b", "=&q"); \ - break; \ - case 2: \ -- __get_user_asm_ex(x, ptr, "w", "w", "=r"); \ -+ __get_user_asm_ex(x, ptr, "w", "w", "=&r"); \ - break; \ - case 4: \ -- __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ -+ __get_user_asm_ex(x, ptr, "l", "k", "=&r"); \ - break; \ - case 8: \ - __get_user_asm_ex_u64(x, ptr); \ -@@ -395,7 +395,7 @@ do { \ - asm volatile("1: mov"itype" %1,%"rtype"0\n" \ - "2:\n" \ - _ASM_EXTABLE_EX(1b, 2b) \ -- : ltype(x) : "m" (__m(addr))) -+ : ltype(x) : "m" (__m(addr)), "0" (0)) - - #define __put_user_nocheck(x, ptr, size) \ - ({ \ -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index b9b09fec173b..5fa652c16a50 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -5033,7 +5033,7 @@ done_prefixes: - /* Decode and fetch the destination operand: register or memory. */ - rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask); - -- if (ctxt->rip_relative) -+ if (ctxt->rip_relative && likely(ctxt->memopp)) - ctxt->memopp->addr.mem.ea = address_mask(ctxt, - ctxt->memopp->addr.mem.ea + ctxt->_eip); - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index d7cb9577fa31..685ef431a41d 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7252,10 +7252,12 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) - - void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu) - { -+ void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask; -+ - kvmclock_reset(vcpu); - -- free_cpumask_var(vcpu->arch.wbinvd_dirty_mask); - kvm_x86_ops->vcpu_free(vcpu); -+ free_cpumask_var(wbinvd_dirty_mask); - } - - struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, -diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index cb5e266a8bf7..1e56ff583459 100644 ---- a/arch/x86/xen/mmu.c -+++ b/arch/x86/xen/mmu.c -@@ -1113,7 +1113,7 @@ static void __init xen_cleanhighmap(unsigned long vaddr, - - /* NOTE: The loop is more greedy than the cleanup_highmap variant. - * We include the PMD passed in on _both_ boundaries. */ -- for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE)); -+ for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD)); - pmd++, vaddr += PMD_SIZE) { - if (pmd_none(*pmd)) - continue; -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 7d00b7a015ea..47ddfefe2443 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -1003,7 +1003,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal) - - - static struct binder_ref *binder_get_ref(struct binder_proc *proc, -- uint32_t desc) -+ u32 desc, bool need_strong_ref) - { - struct rb_node *n = proc->refs_by_desc.rb_node; - struct binder_ref *ref; -@@ -1011,12 +1011,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc, - while (n) { - ref = rb_entry(n, struct binder_ref, rb_node_desc); - -- if (desc < ref->desc) -+ if (desc < ref->desc) { - n = n->rb_left; -- else if (desc > ref->desc) -+ } else if (desc > ref->desc) { - n = n->rb_right; -- else -+ } else if (need_strong_ref && !ref->strong) { -+ binder_user_error("tried to use weak ref as strong ref\n"); -+ return NULL; -+ } else { - return ref; -+ } - } - return NULL; - } -@@ -1286,7 +1290,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, - } break; - case BINDER_TYPE_HANDLE: - case BINDER_TYPE_WEAK_HANDLE: { -- struct binder_ref *ref = binder_get_ref(proc, fp->handle); -+ struct binder_ref *ref; -+ -+ ref = binder_get_ref(proc, fp->handle, -+ fp->type == BINDER_TYPE_HANDLE); - - if (ref == NULL) { - pr_err("transaction release %d bad handle %d\n", -@@ -1380,7 +1387,7 @@ static void binder_transaction(struct binder_proc *proc, - if (tr->target.handle) { - struct binder_ref *ref; - -- ref = binder_get_ref(proc, tr->target.handle); -+ ref = binder_get_ref(proc, tr->target.handle, true); - if (ref == NULL) { - binder_user_error("%d:%d got transaction to invalid handle\n", - proc->pid, thread->pid); -@@ -1571,7 +1578,9 @@ static void binder_transaction(struct binder_proc *proc, - fp->type = BINDER_TYPE_HANDLE; - else - fp->type = BINDER_TYPE_WEAK_HANDLE; -+ fp->binder = 0; - fp->handle = ref->desc; -+ fp->cookie = 0; - binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, - &thread->todo); - -@@ -1583,7 +1592,10 @@ static void binder_transaction(struct binder_proc *proc, - } break; - case BINDER_TYPE_HANDLE: - case BINDER_TYPE_WEAK_HANDLE: { -- struct binder_ref *ref = binder_get_ref(proc, fp->handle); -+ struct binder_ref *ref; -+ -+ ref = binder_get_ref(proc, fp->handle, -+ fp->type == BINDER_TYPE_HANDLE); - - if (ref == NULL) { - binder_user_error("%d:%d got transaction with invalid handle, %d\n", -@@ -1618,7 +1630,9 @@ static void binder_transaction(struct binder_proc *proc, - return_error = BR_FAILED_REPLY; - goto err_binder_get_ref_for_node_failed; - } -+ fp->binder = 0; - fp->handle = new_ref->desc; -+ fp->cookie = 0; - binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); - trace_binder_transaction_ref_to_ref(t, ref, - new_ref); -@@ -1672,6 +1686,7 @@ static void binder_transaction(struct binder_proc *proc, - binder_debug(BINDER_DEBUG_TRANSACTION, - " fd %d -> %d\n", fp->handle, target_fd); - /* TODO: fput? */ -+ fp->binder = 0; - fp->handle = target_fd; - } break; - -@@ -1794,7 +1809,9 @@ static int binder_thread_write(struct binder_proc *proc, - ref->desc); - } - } else -- ref = binder_get_ref(proc, target); -+ ref = binder_get_ref(proc, target, -+ cmd == BC_ACQUIRE || -+ cmd == BC_RELEASE); - if (ref == NULL) { - binder_user_error("%d:%d refcount change on invalid ref %d\n", - proc->pid, thread->pid, target); -@@ -1990,7 +2007,7 @@ static int binder_thread_write(struct binder_proc *proc, - if (get_user(cookie, (binder_uintptr_t __user *)ptr)) - return -EFAULT; - ptr += sizeof(binder_uintptr_t); -- ref = binder_get_ref(proc, target); -+ ref = binder_get_ref(proc, target, false); - if (ref == NULL) { - binder_user_error("%d:%d %s invalid ref %d\n", - proc->pid, thread->pid, -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index d2406fe25533..090183f812be 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1533,19 +1533,29 @@ static void remove_port_data(struct port *port) - spin_lock_irq(&port->inbuf_lock); - /* Remove unused data this port might have received. */ - discard_port_data(port); -+ spin_unlock_irq(&port->inbuf_lock); - - /* Remove buffers we queued up for the Host to send us data in. */ -- while ((buf = virtqueue_detach_unused_buf(port->in_vq))) -- free_buf(buf, true); -- spin_unlock_irq(&port->inbuf_lock); -+ do { -+ spin_lock_irq(&port->inbuf_lock); -+ buf = virtqueue_detach_unused_buf(port->in_vq); -+ spin_unlock_irq(&port->inbuf_lock); -+ if (buf) -+ free_buf(buf, true); -+ } while (buf); - - spin_lock_irq(&port->outvq_lock); - reclaim_consumed_buffers(port); -+ spin_unlock_irq(&port->outvq_lock); - - /* Free pending buffers from the out-queue. */ -- while ((buf = virtqueue_detach_unused_buf(port->out_vq))) -- free_buf(buf, true); -- spin_unlock_irq(&port->outvq_lock); -+ do { -+ spin_lock_irq(&port->outvq_lock); -+ buf = virtqueue_detach_unused_buf(port->out_vq); -+ spin_unlock_irq(&port->outvq_lock); -+ if (buf) -+ free_buf(buf, true); -+ } while (buf); - } - - /* -diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c -index f4ea80d602f7..b9d2f76a0cf7 100644 ---- a/drivers/firewire/net.c -+++ b/drivers/firewire/net.c -@@ -73,13 +73,13 @@ struct rfc2734_header { - - #define fwnet_get_hdr_lf(h) (((h)->w0 & 0xc0000000) >> 30) - #define fwnet_get_hdr_ether_type(h) (((h)->w0 & 0x0000ffff)) --#define fwnet_get_hdr_dg_size(h) (((h)->w0 & 0x0fff0000) >> 16) -+#define fwnet_get_hdr_dg_size(h) ((((h)->w0 & 0x0fff0000) >> 16) + 1) - #define fwnet_get_hdr_fg_off(h) (((h)->w0 & 0x00000fff)) - #define fwnet_get_hdr_dgl(h) (((h)->w1 & 0xffff0000) >> 16) - --#define fwnet_set_hdr_lf(lf) ((lf) << 30) -+#define fwnet_set_hdr_lf(lf) ((lf) << 30) - #define fwnet_set_hdr_ether_type(et) (et) --#define fwnet_set_hdr_dg_size(dgs) ((dgs) << 16) -+#define fwnet_set_hdr_dg_size(dgs) (((dgs) - 1) << 16) - #define fwnet_set_hdr_fg_off(fgo) (fgo) - - #define fwnet_set_hdr_dgl(dgl) ((dgl) << 16) -@@ -578,6 +578,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len, - int retval; - u16 ether_type; - -+ if (len <= RFC2374_UNFRAG_HDR_SIZE) -+ return 0; -+ - hdr.w0 = be32_to_cpu(buf[0]); - lf = fwnet_get_hdr_lf(&hdr); - if (lf == RFC2374_HDR_UNFRAG) { -@@ -602,7 +605,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len, - return fwnet_finish_incoming_packet(net, skb, source_node_id, - is_broadcast, ether_type); - } -+ - /* A datagram fragment has been received, now the fun begins. */ -+ -+ if (len <= RFC2374_FRAG_HDR_SIZE) -+ return 0; -+ - hdr.w1 = ntohl(buf[1]); - buf += 2; - len -= RFC2374_FRAG_HDR_SIZE; -@@ -614,7 +622,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len, - fg_off = fwnet_get_hdr_fg_off(&hdr); - } - datagram_label = fwnet_get_hdr_dgl(&hdr); -- dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */ -+ dg_size = fwnet_get_hdr_dg_size(&hdr); -+ -+ if (fg_off + len > dg_size) -+ return 0; - - spin_lock_irqsave(&dev->lock, flags); - -@@ -722,6 +733,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r, - fw_send_response(card, r, rcode); - } - -+static int gasp_source_id(__be32 *p) -+{ -+ return be32_to_cpu(p[0]) >> 16; -+} -+ -+static u32 gasp_specifier_id(__be32 *p) -+{ -+ return (be32_to_cpu(p[0]) & 0xffff) << 8 | -+ (be32_to_cpu(p[1]) & 0xff000000) >> 24; -+} -+ -+static u32 gasp_version(__be32 *p) -+{ -+ return be32_to_cpu(p[1]) & 0xffffff; -+} -+ - static void fwnet_receive_broadcast(struct fw_iso_context *context, - u32 cycle, size_t header_length, void *header, void *data) - { -@@ -731,9 +758,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context, - __be32 *buf_ptr; - int retval; - u32 length; -- u16 source_node_id; -- u32 specifier_id; -- u32 ver; - unsigned long offset; - unsigned long flags; - -@@ -750,22 +774,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context, - - spin_unlock_irqrestore(&dev->lock, flags); - -- specifier_id = (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8 -- | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24; -- ver = be32_to_cpu(buf_ptr[1]) & 0xffffff; -- source_node_id = be32_to_cpu(buf_ptr[0]) >> 16; -- -- if (specifier_id == IANA_SPECIFIER_ID && -- (ver == RFC2734_SW_VERSION -+ if (length > IEEE1394_GASP_HDR_SIZE && -+ gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID && -+ (gasp_version(buf_ptr) == RFC2734_SW_VERSION - #if IS_ENABLED(CONFIG_IPV6) -- || ver == RFC3146_SW_VERSION -+ || gasp_version(buf_ptr) == RFC3146_SW_VERSION - #endif -- )) { -- buf_ptr += 2; -- length -= IEEE1394_GASP_HDR_SIZE; -- fwnet_incoming_packet(dev, buf_ptr, length, source_node_id, -+ )) -+ fwnet_incoming_packet(dev, buf_ptr + 2, -+ length - IEEE1394_GASP_HDR_SIZE, -+ gasp_source_id(buf_ptr), - context->card->generation, true); -- } - - packet.payload_length = dev->rcv_buffer_size; - packet.interrupt = 1; -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 2485fb652716..7cb2815e815e 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -909,6 +909,7 @@ static void drm_dp_destroy_port(struct kref *kref) - /* no need to clean up vcpi - * as if we have no connector we never setup a vcpi */ - drm_dp_port_teardown_pdt(port, port->pdt); -+ port->pdt = DP_PEER_DEVICE_NONE; - } - kfree(port); - } -@@ -1154,7 +1155,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb, - drm_dp_put_port(port); - goto out; - } -- if (port->port_num >= DP_MST_LOGICAL_PORT_0) { -+ if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV || -+ port->pdt == DP_PEER_DEVICE_SST_SINK) && -+ port->port_num >= DP_MST_LOGICAL_PORT_0) { - port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc); - drm_mode_connector_set_tile_property(port->connector); - } -@@ -2872,6 +2875,7 @@ static void drm_dp_destroy_connector_work(struct work_struct *work) - mgr->cbs->destroy_connector(mgr, port->connector); - - drm_dp_port_teardown_pdt(port, port->pdt); -+ port->pdt = DP_PEER_DEVICE_NONE; - - if (!port->input && port->vcpi.vcpi > 0) { - drm_dp_mst_reset_vcpi_slots(mgr, port); -diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c -index 7f55ba6771c6..011211e4167d 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_core.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c -@@ -101,7 +101,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file) - return 0; - - err: -- list_for_each_entry_reverse(subdrv, &subdrv->list, list) { -+ list_for_each_entry_continue_reverse(subdrv, &exynos_drm_subdrv_list, list) { - if (subdrv->close) - subdrv->close(dev, subdrv->dev, file); - } -diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c -index 158872eb78e4..a3a321208fd8 100644 ---- a/drivers/gpu/drm/radeon/ni.c -+++ b/drivers/gpu/drm/radeon/ni.c -@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev) - void cayman_cp_int_cntl_setup(struct radeon_device *rdev, - int ring, u32 cp_int_cntl) - { -- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3; -- -- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3)); -+ WREG32(SRBM_GFX_CNTL, RINGID(ring)); - WREG32(CP_INT_CNTL, cp_int_cntl); - } - -diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c -index db64e0062689..3b0c229d7dcd 100644 ---- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c -+++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c -@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg - - tmp &= AUX_HPD_SEL(0x7); - tmp |= AUX_HPD_SEL(chan->rec.hpd); -- tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1); -+ tmp |= AUX_EN | AUX_LS_READ_EN; - - WREG32(AUX_CONTROL + aux_offset[instance], tmp); - -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index 472e0771832e..10191b935937 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - int i; - struct si_dpm_quirk *p = si_dpm_quirk_list; - -+ /* limit all SI kickers */ -+ if (rdev->family == CHIP_PITCAIRN) { -+ if ((rdev->pdev->revision == 0x81) || -+ (rdev->pdev->device == 0x6810) || -+ (rdev->pdev->device == 0x6811) || -+ (rdev->pdev->device == 0x6816) || -+ (rdev->pdev->device == 0x6817) || -+ (rdev->pdev->device == 0x6806)) -+ max_mclk = 120000; -+ } else if (rdev->family == CHIP_VERDE) { -+ if ((rdev->pdev->revision == 0x81) || -+ (rdev->pdev->revision == 0x83) || -+ (rdev->pdev->revision == 0x87) || -+ (rdev->pdev->device == 0x6820) || -+ (rdev->pdev->device == 0x6821) || -+ (rdev->pdev->device == 0x6822) || -+ (rdev->pdev->device == 0x6823) || -+ (rdev->pdev->device == 0x682A) || -+ (rdev->pdev->device == 0x682B)) { -+ max_sclk = 75000; -+ max_mclk = 80000; -+ } -+ } else if (rdev->family == CHIP_OLAND) { -+ if ((rdev->pdev->revision == 0xC7) || -+ (rdev->pdev->revision == 0x80) || -+ (rdev->pdev->revision == 0x81) || -+ (rdev->pdev->revision == 0x83) || -+ (rdev->pdev->device == 0x6604) || -+ (rdev->pdev->device == 0x6605)) { -+ max_sclk = 75000; -+ max_mclk = 80000; -+ } -+ } else if (rdev->family == CHIP_HAINAN) { -+ if ((rdev->pdev->revision == 0x81) || -+ (rdev->pdev->revision == 0x83) || -+ (rdev->pdev->revision == 0xC3) || -+ (rdev->pdev->device == 0x6664) || -+ (rdev->pdev->device == 0x6665) || -+ (rdev->pdev->device == 0x6667)) { -+ max_sclk = 75000; -+ max_mclk = 80000; -+ } -+ } - /* Apply dpm quirks */ - while (p && p->chip_device != 0) { - if (rdev->pdev->vendor == p->chip_vendor && -@@ -3011,16 +3054,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - } - ++p; - } -- /* limit mclk on all R7 370 parts for stability */ -- if (rdev->pdev->device == 0x6811 && -- rdev->pdev->revision == 0x81) -- max_mclk = 120000; -- /* limit sclk/mclk on Jet parts for stability */ -- if (rdev->pdev->device == 0x6665 && -- rdev->pdev->revision == 0xc3) { -- max_sclk = 75000; -- max_mclk = 80000; -- } - - if (rps->vce_active) { - rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 909ab0176ef2..e37030624165 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -168,6 +168,7 @@ - #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205 - #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208 - #define USB_DEVICE_ID_ATEN_CS682 0x2213 -+#define USB_DEVICE_ID_ATEN_CS692 0x8021 - - #define USB_VENDOR_ID_ATMEL 0x03eb - #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index dc8e6adf95a4..6ca6ab00fa93 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -61,6 +61,7 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET }, -+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET }, -diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c -index 7994ec2e4151..41f5896224bd 100644 ---- a/drivers/hv/hv_util.c -+++ b/drivers/hv/hv_util.c -@@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback(void *context) - u8 *hbeat_txf_buf = util_heartbeat.recv_buffer; - struct icmsg_negotiate *negop = NULL; - -- vmbus_recvpacket(channel, hbeat_txf_buf, -- PAGE_SIZE, &recvlen, &requestid); -+ while (1) { -+ -+ vmbus_recvpacket(channel, hbeat_txf_buf, -+ PAGE_SIZE, &recvlen, &requestid); -+ -+ if (!recvlen) -+ break; - -- if (recvlen > 0) { - icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[ - sizeof(struct vmbuspipe_hdr)]; - -diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c -index 4233f5695352..3c38029e3fe9 100644 ---- a/drivers/i2c/busses/i2c-xgene-slimpro.c -+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c -@@ -105,7 +105,7 @@ struct slimpro_i2c_dev { - struct mbox_chan *mbox_chan; - struct mbox_client mbox_client; - struct completion rd_complete; -- u8 dma_buffer[I2C_SMBUS_BLOCK_MAX]; -+ u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */ - u32 *resp_msg; - }; - -diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c -index ba8eb087f224..d625167357cc 100644 ---- a/drivers/i2c/i2c-core.c -+++ b/drivers/i2c/i2c-core.c -@@ -1876,6 +1876,7 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver) - /* add the driver to the list of i2c drivers in the driver core */ - driver->driver.owner = owner; - driver->driver.bus = &i2c_bus_type; -+ INIT_LIST_HEAD(&driver->clients); - - /* When registration returns, the driver core - * will have called probe() for all matching-but-unbound devices. -@@ -1886,7 +1887,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver) - - pr_debug("i2c-core: driver [%s] registered\n", driver->driver.name); - -- INIT_LIST_HEAD(&driver->clients); - /* Walk the adapters that are already present */ - i2c_for_each_dev(driver, __process_new_driver); - -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index f4bfb4b2d50a..073246c7d163 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -877,6 +877,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "P34"), - }, - }, -+ { -+ /* Schenker XMG C504 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "XMG"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "C504"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c -index f2a363a89629..115bd3846c3f 100644 ---- a/drivers/md/dm-raid1.c -+++ b/drivers/md/dm-raid1.c -@@ -1288,6 +1288,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error) - - dm_bio_restore(bd, bio); - bio_record->details.bi_bdev = NULL; -+ bio->bi_error = 0; - - queue_bio(ms, bio, rw); - return DM_ENDIO_INCOMPLETE; -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 84aa8b1d0480..3384a3eef917 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -2260,8 +2260,6 @@ static void cleanup_mapped_device(struct mapped_device *md) - if (md->bs) - bioset_free(md->bs); - -- cleanup_srcu_struct(&md->io_barrier); -- - if (md->disk) { - spin_lock(&_minor_lock); - md->disk->private_data = NULL; -@@ -2273,6 +2271,8 @@ static void cleanup_mapped_device(struct mapped_device *md) - if (md->queue) - blk_cleanup_queue(md->queue); - -+ cleanup_srcu_struct(&md->io_barrier); -+ - if (md->bdev) { - bdput(md->bdev); - md->bdev = NULL; -diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c -index 222367cc8c81..524660510599 100644 ---- a/drivers/misc/genwqe/card_utils.c -+++ b/drivers/misc/genwqe/card_utils.c -@@ -352,17 +352,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, - if (copy_from_user(sgl->lpage, user_addr + user_size - - sgl->lpage_size, sgl->lpage_size)) { - rc = -EFAULT; -- goto err_out1; -+ goto err_out2; - } - } - return 0; - -+ err_out2: -+ __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage, -+ sgl->lpage_dma_addr); -+ sgl->lpage = NULL; -+ sgl->lpage_dma_addr = 0; - err_out1: - __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage, - sgl->fpage_dma_addr); -+ sgl->fpage = NULL; -+ sgl->fpage_dma_addr = 0; - err_out: - __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl, - sgl->sgl_dma_addr); -+ sgl->sgl = NULL; -+ sgl->sgl_dma_addr = 0; -+ sgl->sgl_size = 0; - return -ENOMEM; - } - -diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c -index bae680c648ff..396d75d9fb11 100644 ---- a/drivers/misc/mei/hw-txe.c -+++ b/drivers/misc/mei/hw-txe.c -@@ -972,11 +972,13 @@ static bool mei_txe_check_and_ack_intrs(struct mei_device *dev, bool do_ack) - hisr = mei_txe_br_reg_read(hw, HISR_REG); - - aliveness = mei_txe_aliveness_get(dev); -- if (hhisr & IPC_HHIER_SEC && aliveness) -+ if (hhisr & IPC_HHIER_SEC && aliveness) { - ipc_isr = mei_txe_sec_reg_read_silent(hw, - SEC_IPC_HOST_INT_STATUS_REG); -- else -+ } else { - ipc_isr = 0; -+ hhisr &= ~IPC_HHIER_SEC; -+ } - - generated = generated || - (hisr & HISR_INT_STS_MSK) || -diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c -index 81bdeeb05a4d..7dcfb1d5034f 100644 ---- a/drivers/mmc/host/dw_mmc-pltfm.c -+++ b/drivers/mmc/host/dw_mmc-pltfm.c -@@ -59,12 +59,13 @@ int dw_mci_pltfm_register(struct platform_device *pdev, - host->pdata = pdev->dev.platform_data; - - regs = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- /* Get registers' physical base address */ -- host->phy_regs = regs->start; - host->regs = devm_ioremap_resource(&pdev->dev, regs); - if (IS_ERR(host->regs)) - return PTR_ERR(host->regs); - -+ /* Get registers' physical base address */ -+ host->phy_regs = regs->start; -+ - platform_set_drvdata(pdev, host); - return dw_mci_probe(host); - } -diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c -index 990898b9dc72..bba7dd1b5ebf 100644 ---- a/drivers/mtd/ubi/fastmap.c -+++ b/drivers/mtd/ubi/fastmap.c -@@ -513,10 +513,11 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, - unsigned long long ec = be64_to_cpu(ech->ec); - unmap_peb(ai, pnum); - dbg_bld("Adding PEB to free: %i", pnum); -+ - if (err == UBI_IO_FF_BITFLIPS) -- add_aeb(ai, free, pnum, ec, 1); -- else -- add_aeb(ai, free, pnum, ec, 0); -+ scrub = 1; -+ -+ add_aeb(ai, free, pnum, ec, scrub); - continue; - } else if (err == 0 || err == UBI_IO_BITFLIPS) { - dbg_bld("Found non empty PEB:%i in pool", pnum); -@@ -748,11 +749,11 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, - fmvhdr->vol_type, - be32_to_cpu(fmvhdr->last_eb_bytes)); - -- if (!av) -- goto fail_bad; -- if (PTR_ERR(av) == -EINVAL) { -- ubi_err(ubi, "volume (ID %i) already exists", -- fmvhdr->vol_id); -+ if (IS_ERR(av)) { -+ if (PTR_ERR(av) == -EEXIST) -+ ubi_err(ubi, "volume (ID %i) already exists", -+ fmvhdr->vol_id); -+ - goto fail_bad; - } - -diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c -index 8c44cf6ff7a2..23a038810083 100644 ---- a/drivers/net/ethernet/smsc/smc91x.c -+++ b/drivers/net/ethernet/smsc/smc91x.c -@@ -540,7 +540,7 @@ static inline void smc_rcv(struct net_device *dev) - #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags) - #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags) - #else --#define smc_special_trylock(lock, flags) (flags == flags) -+#define smc_special_trylock(lock, flags) ((void)flags, true) - #define smc_special_lock(lock, flags) do { flags = 0; } while (0) - #define smc_special_unlock(lock, flags) do { flags = 0; } while (0) - #endif -diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c -index 7831bc6b51dd..ec84ff8ad1b4 100644 ---- a/drivers/pwm/core.c -+++ b/drivers/pwm/core.c -@@ -321,6 +321,8 @@ int pwmchip_remove(struct pwm_chip *chip) - unsigned int i; - int ret = 0; - -+ pwmchip_sysfs_unexport_children(chip); -+ - mutex_lock(&pwm_lock); - - for (i = 0; i < chip->npwm; i++) { -diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c -index 9c90886f4123..c20163b92991 100644 ---- a/drivers/pwm/sysfs.c -+++ b/drivers/pwm/sysfs.c -@@ -350,6 +350,24 @@ void pwmchip_sysfs_unexport(struct pwm_chip *chip) - } - } - -+void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) -+{ -+ struct device *parent; -+ unsigned int i; -+ -+ parent = class_find_device(&pwm_class, NULL, chip, -+ pwmchip_sysfs_match); -+ if (!parent) -+ return; -+ -+ for (i = 0; i < chip->npwm; i++) { -+ struct pwm_device *pwm = &chip->pwms[i]; -+ -+ if (test_bit(PWMF_EXPORTED, &pwm->flags)) -+ pwm_unexport_child(parent, pwm); -+ } -+} -+ - static int __init pwm_sysfs_init(void) - { - return class_register(&pwm_class); -diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c -index 8db9f3a5844d..7aa01c1960ea 100644 ---- a/drivers/scsi/arcmsr/arcmsr_hba.c -+++ b/drivers/scsi/arcmsr/arcmsr_hba.c -@@ -2545,18 +2545,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd, - struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata; - struct CommandControlBlock *ccb; - int target = cmd->device->id; -- int lun = cmd->device->lun; -- uint8_t scsicmd = cmd->cmnd[0]; - cmd->scsi_done = done; - cmd->host_scribble = NULL; - cmd->result = 0; -- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){ -- if(acb->devstate[target][lun] == ARECA_RAID_GONE) { -- cmd->result = (DID_NO_CONNECT << 16); -- } -- cmd->scsi_done(cmd); -- return 0; -- } - if (target == 16) { - /* virtual device for iop message transfer */ - arcmsr_handle_virtual_command(acb, cmd); -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 278e10cd771f..17c440b9d086 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -1688,16 +1688,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) - goto out_done; - } - -- switch (scmd->cmnd[0]) { -- case SYNCHRONIZE_CACHE: -- /* -- * FW takes care of flush cache on its own -- * No need to send it down -- */ -+ /* -+ * FW takes care of flush cache on its own for Virtual Disk. -+ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW. -+ */ -+ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) { - scmd->result = DID_OK << 16; - goto out_done; -- default: -- break; - } - - if (instance->instancet->build_and_issue_cmd(instance, scmd)) { -diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c -index d09d60293c27..e357a393d56e 100644 ---- a/drivers/scsi/scsi_debug.c -+++ b/drivers/scsi/scsi_debug.c -@@ -4981,6 +4981,7 @@ static void __exit scsi_debug_exit(void) - bus_unregister(&pseudo_lld_bus); - root_device_unregister(pseudo_primary); - -+ vfree(map_storep); - vfree(dif_storep); - vfree(fake_storep); - } -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 136ebaaa9cc0..5ab54ef4f304 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -872,10 +872,15 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) - return 0; - -+ if (new_screen_size > (4 << 20)) -+ return -EINVAL; - newscreen = kmalloc(new_screen_size, GFP_USER); - if (!newscreen) - return -ENOMEM; - -+ if (vc == sel_cons) -+ clear_selection(); -+ - old_rows = vc->vc_rows; - old_row_size = vc->vc_size_row; - -@@ -1173,7 +1178,7 @@ static void csi_J(struct vc_data *vc, int vpar) - break; - case 3: /* erase scroll-back buffer (and whole display) */ - scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char, -- vc->vc_screenbuf_size >> 1); -+ vc->vc_screenbuf_size); - set_origin(vc); - if (CON_IS_VISIBLE(vc)) - update_screen(vc); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index fb79dca9484b..5ae2b7d3a74a 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -2845,7 +2845,7 @@ err3: - kfree(dwc->setup_buf); - - err2: -- dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb), -+ dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2, - dwc->ep0_trb, dwc->ep0_trb_addr); - - err1: -@@ -2869,7 +2869,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc) - - kfree(dwc->setup_buf); - -- dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb), -+ dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2, - dwc->ep0_trb, dwc->ep0_trb_addr); - - dma_free_coherent(dwc->dev, sizeof(*dwc->ctrl_req), -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 6554322af2c1..b644248f4b8e 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -596,8 +596,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, - - /* throttle high/super speed IRQ rate back slightly */ - if (gadget_is_dualspeed(dev->gadget)) -- req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH || -- dev->gadget->speed == USB_SPEED_SUPER) -+ req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH || -+ dev->gadget->speed == USB_SPEED_SUPER)) && -+ !list_empty(&dev->tx_reqs)) - ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0) - : 0; - -diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c -index 760cb57e954e..9d1192aea9d0 100644 ---- a/drivers/usb/host/ohci-hcd.c -+++ b/drivers/usb/host/ohci-hcd.c -@@ -72,7 +72,7 @@ - static const char hcd_name [] = "ohci_hcd"; - - #define STATECHANGE_DELAY msecs_to_jiffies(300) --#define IO_WATCHDOG_DELAY msecs_to_jiffies(250) -+#define IO_WATCHDOG_DELAY msecs_to_jiffies(275) - - #include "ohci.h" - #include "pci-quirks.h" -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 1da876605e4d..b9d6940479da 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -1157,7 +1157,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_RESUME); - spin_unlock_irqrestore(&xhci->lock, flags); -- msleep(20); -+ msleep(USB_RESUME_TIMEOUT); - spin_lock_irqsave(&xhci->lock, flags); - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_U0); -@@ -1401,7 +1401,7 @@ int xhci_bus_resume(struct usb_hcd *hcd) - - if (need_usb2_u3_exit) { - spin_unlock_irqrestore(&xhci->lock, flags); -- msleep(20); -+ msleep(USB_RESUME_TIMEOUT); - spin_lock_irqsave(&xhci->lock, flags); - } - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 963867c2c1d5..cf147ccac7d3 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -45,6 +45,7 @@ - - #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31 - #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 -+#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1 - #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5 - #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f - #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f -@@ -154,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - xhci->quirks |= XHCI_SPURIOUS_REBOOT; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && -- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { -+ (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) { - xhci->quirks |= XHCI_SPURIOUS_REBOOT; - xhci->quirks |= XHCI_SPURIOUS_WAKEUP; - } -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 6eccded3bc33..976195e748a3 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -845,7 +845,9 @@ static int cp210x_tiocmget(struct tty_struct *tty) - unsigned int control; - int result; - -- cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1); -+ result = cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1); -+ if (result) -+ return result; - - result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0) - |((control & CONTROL_RTS) ? TIOCM_RTS : 0) -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8c48c9d83d48..494167fe6a2c 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = { - /* ekey Devices */ - { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) }, - /* Infineon Devices */ -- { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) }, - /* GE Healthcare devices */ - { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) }, - /* Active Research (Actisense) devices */ -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index f87a938cf005..21011c0a4c64 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -626,8 +626,9 @@ - /* - * Infineon Technologies - */ --#define INFINEON_VID 0x058b --#define INFINEON_TRIBOARD_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */ -+#define INFINEON_VID 0x058b -+#define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */ -+#define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */ - - /* - * Acton Research Corp. -diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c -index a0ca291bc07f..e7e29c797824 100644 ---- a/drivers/usb/serial/usb-serial.c -+++ b/drivers/usb/serial/usb-serial.c -@@ -1077,7 +1077,8 @@ static int usb_serial_probe(struct usb_interface *interface, - - serial->disconnected = 0; - -- usb_serial_console_init(serial->port[0]->minor); -+ if (num_ports > 0) -+ usb_serial_console_init(serial->port[0]->minor); - exit: - module_put(type->driver.owner); - return 0; -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index dc2b94142f53..a01a41a41269 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -548,7 +548,8 @@ void virtqueue_disable_cb(struct virtqueue *_vq) - - if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) { - vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT; -- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); -+ if (!vq->event) -+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); - } - - } -@@ -580,7 +581,8 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq) - * entry. Always do both to keep code simple. */ - if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) { - vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT; -- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); -+ if (!vq->event) -+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); - } - vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx); - END_USE(vq); -@@ -648,10 +650,11 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq) - * more to do. */ - /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to - * either clear the flags bit or point the event index at the next -- * entry. Always do both to keep code simple. */ -+ * entry. Always update the event index to keep code simple. */ - if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) { - vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT; -- vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); -+ if (!vq->event) -+ vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow); - } - /* TODO: tune this threshold */ - bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4; -@@ -770,7 +773,8 @@ struct virtqueue *vring_new_virtqueue(unsigned int index, - /* No callback? Tell other side not to bother us. */ - if (!callback) { - vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT; -- vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow); -+ if (!vq->event) -+ vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow); - } - - /* Put everything in free lists. */ -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 1415f6d58633..f7441193bf35 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -2696,14 +2696,12 @@ static inline void btrfs_remove_all_log_ctxs(struct btrfs_root *root, - int index, int error) - { - struct btrfs_log_ctx *ctx; -+ struct btrfs_log_ctx *safe; - -- if (!error) { -- INIT_LIST_HEAD(&root->log_ctxs[index]); -- return; -- } -- -- list_for_each_entry(ctx, &root->log_ctxs[index], list) -+ list_for_each_entry_safe(ctx, safe, &root->log_ctxs[index], list) { -+ list_del_init(&ctx->list); - ctx->log_ret = error; -+ } - - INIT_LIST_HEAD(&root->log_ctxs[index]); - } -@@ -2944,13 +2942,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, - mutex_unlock(&root->log_mutex); - - out_wake_log_root: -- /* -- * We needn't get log_mutex here because we are sure all -- * the other tasks are blocked. -- */ -+ mutex_lock(&log_root_tree->log_mutex); - btrfs_remove_all_log_ctxs(log_root_tree, index2, ret); - -- mutex_lock(&log_root_tree->log_mutex); - log_root_tree->log_transid_committed++; - atomic_set(&log_root_tree->log_commit[index2], 0); - mutex_unlock(&log_root_tree->log_mutex); -@@ -2961,10 +2955,8 @@ out_wake_log_root: - if (waitqueue_active(&log_root_tree->log_commit_wait[index2])) - wake_up(&log_root_tree->log_commit_wait[index2]); - out: -- /* See above. */ -- btrfs_remove_all_log_ctxs(root, index1, ret); -- - mutex_lock(&root->log_mutex); -+ btrfs_remove_all_log_ctxs(root, index1, ret); - root->log_transid_committed++; - atomic_set(&root->log_commit[index1], 0); - mutex_unlock(&root->log_mutex); -diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index ea0dd9ee138d..63a0d0ba36de 100644 ---- a/fs/overlayfs/copy_up.c -+++ b/fs/overlayfs/copy_up.c -@@ -139,6 +139,8 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len) - len -= bytes; - } - -+ if (!error) -+ error = vfs_fsync(new_file, 0); - fput(new_file); - out_fput: - fput(old_file); -diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c -index e49bd2808bf3..f5d5ee43ae6e 100644 ---- a/fs/ubifs/dir.c -+++ b/fs/ubifs/dir.c -@@ -350,7 +350,7 @@ static unsigned int vfs_dent_type(uint8_t type) - */ - static int ubifs_readdir(struct file *file, struct dir_context *ctx) - { -- int err; -+ int err = 0; - struct qstr nm; - union ubifs_key key; - struct ubifs_dent_node *dent; -@@ -452,14 +452,20 @@ out: - kfree(file->private_data); - file->private_data = NULL; - -- if (err != -ENOENT) { -+ if (err != -ENOENT) - ubifs_err(c, "cannot find next direntry, error %d", err); -- return err; -- } -+ else -+ /* -+ * -ENOENT is a non-fatal error in this context, the TNC uses -+ * it to indicate that the cursor moved past the current directory -+ * and readdir() has to stop. -+ */ -+ err = 0; -+ - - /* 2 is a special value indicating that there are no more direntries */ - ctx->pos = 2; -- return 0; -+ return err; - } - - /* Free saved readdir() state when the directory is closed */ -diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c -index 3cc3cf767474..ac9a003dd29a 100644 ---- a/fs/xfs/libxfs/xfs_dquot_buf.c -+++ b/fs/xfs/libxfs/xfs_dquot_buf.c -@@ -191,8 +191,7 @@ xfs_dquot_buf_verify_crc( - if (mp->m_quotainfo) - ndquots = mp->m_quotainfo->qi_dqperchunk; - else -- ndquots = xfs_calc_dquots_per_chunk( -- XFS_BB_TO_FSB(mp, bp->b_length)); -+ ndquots = xfs_calc_dquots_per_chunk(bp->b_length); - - for (i = 0; i < ndquots; i++, d++) { - if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk), -diff --git a/include/linux/pwm.h b/include/linux/pwm.h -index cfc3ed46cad2..aa8736d5b2f3 100644 ---- a/include/linux/pwm.h -+++ b/include/linux/pwm.h -@@ -331,6 +331,7 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num) - #ifdef CONFIG_PWM_SYSFS - void pwmchip_sysfs_export(struct pwm_chip *chip); - void pwmchip_sysfs_unexport(struct pwm_chip *chip); -+void pwmchip_sysfs_unexport_children(struct pwm_chip *chip); - #else - static inline void pwmchip_sysfs_export(struct pwm_chip *chip) - { -@@ -339,6 +340,10 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip) - static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip) - { - } -+ -+static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) -+{ -+} - #endif /* CONFIG_PWM_SYSFS */ - - #endif /* __LINUX_PWM_H */ -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index a3424f28aaf4..127c63e02d52 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -236,6 +236,9 @@ static int cgroup_addrm_files(struct cgroup_subsys_state *css, - */ - static bool cgroup_ssid_enabled(int ssid) - { -+ if (CGROUP_SUBSYS_COUNT == 0) -+ return false; -+ - return static_key_enabled(cgroup_subsys_enabled_key[ssid]); - } - -diff --git a/mm/cma.c b/mm/cma.c -index ea506eb18cd6..bd0e1412475e 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -183,7 +183,8 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, - return -EINVAL; - - /* ensure minimal alignment required by mm core */ -- alignment = PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order); -+ alignment = PAGE_SIZE << -+ max_t(unsigned long, MAX_ORDER - 1, pageblock_order); - - /* alignment should be aligned with order_per_bit */ - if (!IS_ALIGNED(alignment >> PAGE_SHIFT, 1 << order_per_bit)) -@@ -266,8 +267,8 @@ int __init cma_declare_contiguous(phys_addr_t base, - * migratetype page by page allocator's buddy algorithm. In the case, - * you couldn't get a contiguous memory, which is not what we want. - */ -- alignment = max(alignment, -- (phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order)); -+ alignment = max(alignment, (phys_addr_t)PAGE_SIZE << -+ max_t(unsigned long, MAX_ORDER - 1, pageblock_order)); - base = ALIGN(base, alignment); - size = ALIGN(size, alignment); - limit &= ~(alignment - 1); -diff --git a/mm/list_lru.c b/mm/list_lru.c -index afc71ea9a381..5d8dffd5b57c 100644 ---- a/mm/list_lru.c -+++ b/mm/list_lru.c -@@ -554,6 +554,8 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, - err = memcg_init_list_lru(lru, memcg_aware); - if (err) { - kfree(lru->node); -+ /* Do this so a list_lru_destroy() doesn't crash: */ -+ lru->node = NULL; - goto out; - } - -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 6b90d184e9c0..5d9c8a3136bc 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -2055,6 +2055,15 @@ retry: - current->flags & PF_EXITING)) - goto force; - -+ /* -+ * Prevent unbounded recursion when reclaim operations need to -+ * allocate memory. This might exceed the limits temporarily, -+ * but we prefer facilitating memory reclaim and getting back -+ * under the limit over triggering OOM kills in these cases. -+ */ -+ if (unlikely(current->flags & PF_MEMALLOC)) -+ goto force; -+ - if (unlikely(task_in_memcg_oom(current))) - goto nomem; - -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 0838e9f02b11..de1c59d8daa3 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -2910,7 +2910,9 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, - sc.may_writepage, - sc.gfp_mask); - -+ current->flags |= PF_MEMALLOC; - nr_reclaimed = do_try_to_free_pages(zonelist, &sc); -+ current->flags &= ~PF_MEMALLOC; - - trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed); - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index a3bb8f7f5fc5..2b528389409f 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -2203,16 +2203,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) - if (!(status->rx_flags & IEEE80211_RX_AMSDU)) - return RX_CONTINUE; - -- if (ieee80211_has_a4(hdr->frame_control) && -- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && -- !rx->sdata->u.vlan.sta) -- return RX_DROP_UNUSABLE; -+ if (unlikely(ieee80211_has_a4(hdr->frame_control))) { -+ switch (rx->sdata->vif.type) { -+ case NL80211_IFTYPE_AP_VLAN: -+ if (!rx->sdata->u.vlan.sta) -+ return RX_DROP_UNUSABLE; -+ break; -+ case NL80211_IFTYPE_STATION: -+ if (!rx->sdata->u.mgd.use_4addr) -+ return RX_DROP_UNUSABLE; -+ break; -+ default: -+ return RX_DROP_UNUSABLE; -+ } -+ } - -- if (is_multicast_ether_addr(hdr->addr1) && -- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && -- rx->sdata->u.vlan.sta) || -- (rx->sdata->vif.type == NL80211_IFTYPE_STATION && -- rx->sdata->u.mgd.use_4addr))) -+ if (is_multicast_ether_addr(hdr->addr1)) - return RX_DROP_UNUSABLE; - - skb->dev = dev; -diff --git a/security/keys/proc.c b/security/keys/proc.c -index f0611a6368cd..b9f531c9e4fa 100644 ---- a/security/keys/proc.c -+++ b/security/keys/proc.c -@@ -181,7 +181,7 @@ static int proc_keys_show(struct seq_file *m, void *v) - struct timespec now; - unsigned long timo; - key_ref_t key_ref, skey_ref; -- char xbuf[12]; -+ char xbuf[16]; - int rc; - - struct keyring_search_context ctx = { -diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c -index 22dbfa563919..5baf8b56b6e7 100644 ---- a/sound/pci/hda/hda_controller.c -+++ b/sound/pci/hda/hda_controller.c -@@ -956,7 +956,7 @@ irqreturn_t azx_interrupt(int irq, void *dev_id) - status = azx_readb(chip, RIRBSTS); - if (status & RIRB_INT_MASK) { - if (status & RIRB_INT_RESPONSE) { -- if (chip->driver_caps & AZX_DCAPS_RIRB_PRE_DELAY) -+ if (chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND) - udelay(80); - snd_hdac_bus_update_rirb(bus); - } -@@ -1055,11 +1055,6 @@ int azx_bus_init(struct azx *chip, const char *model, - if (chip->driver_caps & AZX_DCAPS_CORBRP_SELF_CLEAR) - bus->core.corbrp_self_clear = true; - -- if (chip->driver_caps & AZX_DCAPS_RIRB_DELAY) { -- dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n"); -- bus->needs_damn_long_delay = 1; -- } -- - if (chip->driver_caps & AZX_DCAPS_4K_BDLE_BOUNDARY) - bus->core.align_bdle_4k = true; - -diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h -index 7b635d68cfe1..b17539537b2e 100644 ---- a/sound/pci/hda/hda_controller.h -+++ b/sound/pci/hda/hda_controller.h -@@ -32,8 +32,8 @@ - #define AZX_DCAPS_NO_MSI (1 << 9) /* No MSI support */ - #define AZX_DCAPS_SNOOP_MASK (3 << 10) /* snoop type mask */ - #define AZX_DCAPS_SNOOP_OFF (1 << 12) /* snoop default off */ --#define AZX_DCAPS_RIRB_DELAY (1 << 13) /* Long delay in read loop */ --#define AZX_DCAPS_RIRB_PRE_DELAY (1 << 14) /* Put a delay before read */ -+/* 13 unused */ -+/* 14 unused */ - #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */ - #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */ - #define AZX_DCAPS_POSFIX_VIA (1 << 17) /* Use VIACOMBO as default */ -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index d4671973d889..ad4a1e9a3ae1 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -334,8 +334,7 @@ enum { - - /* quirks for Nvidia */ - #define AZX_DCAPS_PRESET_NVIDIA \ -- (AZX_DCAPS_RIRB_DELAY | AZX_DCAPS_NO_MSI | /*AZX_DCAPS_ALIGN_BUFSIZE |*/ \ -- AZX_DCAPS_NO_64BIT | AZX_DCAPS_CORBRP_SELF_CLEAR |\ -+ (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\ - AZX_DCAPS_SNOOP_TYPE(NVIDIA)) - - #define AZX_DCAPS_PRESET_CTHDA \ -@@ -1637,6 +1636,11 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, - return err; - } - -+ if (chip->driver_type == AZX_DRIVER_NVIDIA) { -+ dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n"); -+ chip->bus.needs_damn_long_delay = 1; -+ } -+ - err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); - if (err < 0) { - dev_err(card->dev, "Error creating device [card]!\n"); -@@ -1720,6 +1724,10 @@ static int azx_first_init(struct azx *chip) - } - } - -+ /* NVidia hardware normally only supports up to 40 bits of DMA */ -+ if (chip->pci->vendor == PCI_VENDOR_ID_NVIDIA) -+ dma_bits = 40; -+ - /* disable 64bit DMA address on some devices */ - if (chip->driver_caps & AZX_DCAPS_NO_64BIT) { - dev_dbg(card->dev, "Disabling 64bit DMA\n"); -@@ -2406,14 +2414,12 @@ static const struct pci_device_id azx_ids[] = { - .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8, - .class_mask = 0xffffff, - .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND | -- AZX_DCAPS_NO_64BIT | -- AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB }, -+ AZX_DCAPS_NO_64BIT | AZX_DCAPS_POSFIX_LPIB }, - #else - /* this entry seems still valid -- i.e. without emu20kx chip */ - { PCI_DEVICE(0x1102, 0x0009), - .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND | -- AZX_DCAPS_NO_64BIT | -- AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB }, -+ AZX_DCAPS_NO_64BIT | AZX_DCAPS_POSFIX_LPIB }, - #endif - /* CM8888 */ - { PCI_DEVICE(0x13f6, 0x5011), -diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c -index 58c0aad37284..17fd81736d3d 100644 ---- a/sound/pci/hda/hda_tegra.c -+++ b/sound/pci/hda/hda_tegra.c -@@ -464,6 +464,8 @@ static int hda_tegra_create(struct snd_card *card, - if (err < 0) - return err; - -+ chip->bus.needs_damn_long_delay = 1; -+ - err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); - if (err < 0) { - dev_err(card->dev, "Error creating device\n"); -@@ -481,8 +483,7 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match); - - static int hda_tegra_probe(struct platform_device *pdev) - { -- const unsigned int driver_flags = AZX_DCAPS_RIRB_DELAY | -- AZX_DCAPS_CORBRP_SELF_CLEAR; -+ const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR; - struct snd_card *card; - struct azx *chip; - struct hda_tegra *hda; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index b1fa50aed888..f0986cac82f1 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5793,8 +5793,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - #define ALC295_STANDARD_PINS \ - {0x12, 0xb7a60130}, \ - {0x14, 0x90170110}, \ -- {0x17, 0x21014020}, \ -- {0x18, 0x21a19030}, \ - {0x21, 0x04211020} - - #define ALC298_STANDARD_PINS \ -@@ -5841,11 +5839,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - {0x1b, 0x02011020}, - {0x21, 0x0221101f}), - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x14, 0x90170110}, -+ {0x1b, 0x01011020}, -+ {0x21, 0x0221101f}), -+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - {0x14, 0x90170130}, - {0x1b, 0x01014020}, - {0x21, 0x0221103f}), - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - {0x14, 0x90170130}, -+ {0x1b, 0x01011020}, -+ {0x21, 0x0221103f}), -+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x14, 0x90170130}, - {0x1b, 0x02011020}, - {0x21, 0x0221103f}), - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -@@ -6021,7 +6027,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - ALC292_STANDARD_PINS, - {0x13, 0x90a60140}), - SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, -- ALC295_STANDARD_PINS), -+ ALC295_STANDARD_PINS, -+ {0x17, 0x21014020}, -+ {0x18, 0x21a19030}), -+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, -+ ALC295_STANDARD_PINS, -+ {0x17, 0x21014040}, -+ {0x18, 0x21a19050}), - SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC298_STANDARD_PINS, - {0x17, 0x90170110}), -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index c60a776e815d..8a59d4782a0f 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2907,6 +2907,23 @@ AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"), - AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"), - AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - -+/* Syntek STK1160 */ -+{ -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -+ USB_DEVICE_ID_MATCH_INT_CLASS | -+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, -+ .idVendor = 0x05e1, -+ .idProduct = 0x0408, -+ .bInterfaceClass = USB_CLASS_AUDIO, -+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .vendor_name = "Syntek", -+ .product_name = "STK1160", -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_AUDIO_ALIGN_TRANSFER -+ } -+}, -+ - /* Digidesign Mbox */ - { - /* Thanks to Clemens Ladisch */ -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index 0d19d5447d6c..929a32ba15f5 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -420,7 +420,7 @@ $(LIBTRACEEVENT)-clean: - $(call QUIET_CLEAN, libtraceevent) - $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) O=$(OUTPUT) clean >/dev/null - --install-traceevent-plugins: $(LIBTRACEEVENT) -+install-traceevent-plugins: libtraceevent_plugins - $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) $(LIBTRACEEVENT_FLAGS) O=$(OUTPUT) install_plugins - - $(LIBAPI): fixdep FORCE diff --git a/patch/kernel/mvebu-default/patch-4.4.31-32.patch b/patch/kernel/mvebu-default/patch-4.4.31-32.patch deleted file mode 100644 index 7b16c507c..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.31-32.patch +++ /dev/null @@ -1,1382 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7c6f28e7a2f6..fba9b09a1330 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 31 -+SUBLEVEL = 32 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c -index bbe56871245c..4298aeb1e20f 100644 ---- a/arch/mips/kvm/emulate.c -+++ b/arch/mips/kvm/emulate.c -@@ -822,7 +822,7 @@ static void kvm_mips_invalidate_guest_tlb(struct kvm_vcpu *vcpu, - bool user; - - /* No need to flush for entries which are already invalid */ -- if (!((tlb->tlb_lo[0] | tlb->tlb_lo[1]) & ENTRYLO_V)) -+ if (!((tlb->tlb_lo0 | tlb->tlb_lo1) & MIPS3_PG_V)) - return; - /* User address space doesn't need flushing for KSeg2/3 changes */ - user = tlb->tlb_hi < KVM_GUEST_KSEG0; -diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -index 21aacc1f45c1..7f85c2c1d681 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -+++ b/drivers/gpu/drm/amd/amdgpu/atombios_dp.c -@@ -265,15 +265,27 @@ static int amdgpu_atombios_dp_get_dp_link_config(struct drm_connector *connector - unsigned max_lane_num = drm_dp_max_lane_count(dpcd); - unsigned lane_num, i, max_pix_clock; - -- for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -- for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -- max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; -+ if (amdgpu_connector_encoder_get_dp_bridge_encoder_id(connector) == -+ ENCODER_OBJECT_ID_NUTMEG) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -+ max_pix_clock = (lane_num * 270000 * 8) / bpp; - if (max_pix_clock >= pix_clock) { - *dp_lanes = lane_num; -- *dp_rate = link_rates[i]; -+ *dp_rate = 270000; - return 0; - } - } -+ } else { -+ for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -+ max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; -+ if (max_pix_clock >= pix_clock) { -+ *dp_lanes = lane_num; -+ *dp_rate = link_rates[i]; -+ return 0; -+ } -+ } -+ } - } - - return -EINVAL; -diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c -index 44ee72e04df9..b5760851195c 100644 ---- a/drivers/gpu/drm/radeon/atombios_dp.c -+++ b/drivers/gpu/drm/radeon/atombios_dp.c -@@ -315,15 +315,27 @@ int radeon_dp_get_dp_link_config(struct drm_connector *connector, - unsigned max_lane_num = drm_dp_max_lane_count(dpcd); - unsigned lane_num, i, max_pix_clock; - -- for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -- for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -- max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; -+ if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) == -+ ENCODER_OBJECT_ID_NUTMEG) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -+ max_pix_clock = (lane_num * 270000 * 8) / bpp; - if (max_pix_clock >= pix_clock) { - *dp_lanes = lane_num; -- *dp_rate = link_rates[i]; -+ *dp_rate = 270000; - return 0; - } - } -+ } else { -+ for (i = 0; i < ARRAY_SIZE(link_rates) && link_rates[i] <= max_link_rate; i++) { -+ for (lane_num = 1; lane_num <= max_lane_num; lane_num <<= 1) { -+ max_pix_clock = (lane_num * link_rates[i] * 8) / bpp; -+ if (max_pix_clock >= pix_clock) { -+ *dp_lanes = lane_num; -+ *dp_rate = link_rates[i]; -+ return 0; -+ } -+ } -+ } - } - - return -EINVAL; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index ca5ac5d6f4e6..49056c33be74 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -18142,14 +18142,14 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, - - rtnl_lock(); - -- /* We needn't recover from permanent error */ -- if (state == pci_channel_io_frozen) -- tp->pcierr_recovery = true; -- - /* We probably don't have netdev yet */ - if (!netdev || !netif_running(netdev)) - goto done; - -+ /* We needn't recover from permanent error */ -+ if (state == pci_channel_io_frozen) -+ tp->pcierr_recovery = true; -+ - tg3_phy_stop(tp); - - tg3_netif_stop(tp); -@@ -18246,7 +18246,7 @@ static void tg3_io_resume(struct pci_dev *pdev) - - rtnl_lock(); - -- if (!netif_running(netdev)) -+ if (!netdev || !netif_running(netdev)) - goto done; - - tg3_full_lock(tp, 0); -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index f6147ffc7fbc..ab716042bdd2 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -944,11 +944,11 @@ fec_restart(struct net_device *ndev) - * enet-mac reset will reset mac address registers too, - * so need to reconfigure it. - */ -- if (fep->quirks & FEC_QUIRK_ENET_MAC) { -- memcpy(&temp_mac, ndev->dev_addr, ETH_ALEN); -- writel(cpu_to_be32(temp_mac[0]), fep->hwp + FEC_ADDR_LOW); -- writel(cpu_to_be32(temp_mac[1]), fep->hwp + FEC_ADDR_HIGH); -- } -+ memcpy(&temp_mac, ndev->dev_addr, ETH_ALEN); -+ writel((__force u32)cpu_to_be32(temp_mac[0]), -+ fep->hwp + FEC_ADDR_LOW); -+ writel((__force u32)cpu_to_be32(temp_mac[1]), -+ fep->hwp + FEC_ADDR_HIGH); - - /* Clear any outstanding interrupt. */ - writel(0xffffffff, fep->hwp + FEC_IEVENT); -diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c -index 69e31e2a68fc..4827c6987ac3 100644 ---- a/drivers/net/geneve.c -+++ b/drivers/net/geneve.c -@@ -440,7 +440,7 @@ static struct sk_buff **geneve_gro_receive(struct sk_buff **head, - - skb_gro_pull(skb, gh_len); - skb_gro_postpull_rcsum(skb, gh, gh_len); -- pp = ptype->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 003780901628..6fa8e165878e 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -593,7 +593,7 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head, - } - } - -- pp = eth_gro_receive(head, skb); -+ pp = call_gro_receive(eth_gro_receive, head, skb); - - out: - skb_gro_remcsum_cleanup(skb, &grc); -diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c -index ed01c0172e4a..07dd81586c52 100644 ---- a/drivers/of/of_reserved_mem.c -+++ b/drivers/of/of_reserved_mem.c -@@ -127,8 +127,12 @@ static int __init __reserved_mem_alloc_size(unsigned long node, - } - - /* Need adjust the alignment to satisfy the CMA requirement */ -- if (IS_ENABLED(CONFIG_CMA) && of_flat_dt_is_compatible(node, "shared-dma-pool")) -- align = max(align, (phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order)); -+ if (IS_ENABLED(CONFIG_CMA) && of_flat_dt_is_compatible(node, "shared-dma-pool")) { -+ unsigned long order = -+ max_t(unsigned long, MAX_ORDER - 1, pageblock_order); -+ -+ align = max(align, (phys_addr_t)PAGE_SIZE << order); -+ } - - prop = of_get_flat_dt_prop(node, "alloc-ranges", &len); - if (prop) { -diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h -index ef4ff03242ea..aaf7da07a358 100644 ---- a/drivers/scsi/megaraid/megaraid_sas.h -+++ b/drivers/scsi/megaraid/megaraid_sas.h -@@ -1923,7 +1923,7 @@ struct megasas_instance_template { - }; - - #define MEGASAS_IS_LOGICAL(scp) \ -- (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1 -+ ((scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1) - - #define MEGASAS_DEV_INDEX(scp) \ - (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \ -diff --git a/include/linux/mroute.h b/include/linux/mroute.h -index 79aaa9fc1a15..d5277fc3ce2e 100644 ---- a/include/linux/mroute.h -+++ b/include/linux/mroute.h -@@ -103,5 +103,5 @@ struct mfc_cache { - struct rtmsg; - extern int ipmr_get_route(struct net *net, struct sk_buff *skb, - __be32 saddr, __be32 daddr, -- struct rtmsg *rtm, int nowait); -+ struct rtmsg *rtm, int nowait, u32 portid); - #endif -diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h -index 66982e764051..f831155dc7d1 100644 ---- a/include/linux/mroute6.h -+++ b/include/linux/mroute6.h -@@ -115,7 +115,7 @@ struct mfc6_cache { - - struct rtmsg; - extern int ip6mr_get_route(struct net *net, struct sk_buff *skb, -- struct rtmsg *rtm, int nowait); -+ struct rtmsg *rtm, int nowait, u32 portid); - - #ifdef CONFIG_IPV6_MROUTE - extern struct sock *mroute6_socket(struct net *net, struct sk_buff *skb); -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 12b4d54a8ffa..9d6025703f73 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2003,7 +2003,10 @@ struct napi_gro_cb { - /* Used in foo-over-udp, set in udp[46]_gro_receive */ - u8 is_ipv6:1; - -- /* 7 bit hole */ -+ /* Number of gro_receive callbacks this packet already went through */ -+ u8 recursion_counter:4; -+ -+ /* 3 bit hole */ - - /* used to support CHECKSUM_COMPLETE for tunneling protocols */ - __wsum csum; -@@ -2014,6 +2017,25 @@ struct napi_gro_cb { - - #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb) - -+#define GRO_RECURSION_LIMIT 15 -+static inline int gro_recursion_inc_test(struct sk_buff *skb) -+{ -+ return ++NAPI_GRO_CB(skb)->recursion_counter == GRO_RECURSION_LIMIT; -+} -+ -+typedef struct sk_buff **(*gro_receive_t)(struct sk_buff **, struct sk_buff *); -+static inline struct sk_buff **call_gro_receive(gro_receive_t cb, -+ struct sk_buff **head, -+ struct sk_buff *skb) -+{ -+ if (unlikely(gro_recursion_inc_test(skb))) { -+ NAPI_GRO_CB(skb)->flush |= 1; -+ return NULL; -+ } -+ -+ return cb(head, skb); -+} -+ - struct packet_type { - __be16 type; /* This is really htons(ether_type). */ - struct net_device *dev; /* NULL is wildcarded here */ -@@ -2059,6 +2081,22 @@ struct udp_offload { - struct udp_offload_callbacks callbacks; - }; - -+typedef struct sk_buff **(*gro_receive_udp_t)(struct sk_buff **, -+ struct sk_buff *, -+ struct udp_offload *); -+static inline struct sk_buff **call_gro_receive_udp(gro_receive_udp_t cb, -+ struct sk_buff **head, -+ struct sk_buff *skb, -+ struct udp_offload *uoff) -+{ -+ if (unlikely(gro_recursion_inc_test(skb))) { -+ NAPI_GRO_CB(skb)->flush |= 1; -+ return NULL; -+ } -+ -+ return cb(head, skb, uoff); -+} -+ - /* often modified stats are per cpu, other are shared (netdev->stats) */ - struct pcpu_sw_netstats { - u64 rx_packets; -diff --git a/include/net/ip.h b/include/net/ip.h -index 1a98f1ca1638..b450d8653b30 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -553,7 +553,7 @@ int ip_options_rcv_srr(struct sk_buff *skb); - */ - - void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb); --void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset); -+void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int tlen, int offset); - int ip_cmsg_send(struct net *net, struct msghdr *msg, - struct ipcm_cookie *ipc, bool allow_ipv6); - int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval, -@@ -575,7 +575,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport, - - static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb) - { -- ip_cmsg_recv_offset(msg, skb, 0); -+ ip_cmsg_recv_offset(msg, skb, 0, 0); - } - - bool icmp_global_allow(void); -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 86df0835f6b5..e5bba897d206 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -408,6 +408,15 @@ bool tcf_destroy(struct tcf_proto *tp, bool force); - void tcf_destroy_chain(struct tcf_proto __rcu **fl); - int skb_do_redirect(struct sk_buff *); - -+static inline bool skb_at_tc_ingress(const struct sk_buff *skb) -+{ -+#ifdef CONFIG_NET_CLS_ACT -+ return G_TC_AT(skb->tc_verd) & AT_INGRESS; -+#else -+ return false; -+#endif -+} -+ - /* Reset all TX qdiscs greater then index of a device. */ - static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i) - { -diff --git a/include/net/sock.h b/include/net/sock.h -index 14d3c0734007..3d5ff7436f41 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1425,6 +1425,16 @@ static inline void sk_mem_uncharge(struct sock *sk, int size) - if (!sk_has_account(sk)) - return; - sk->sk_forward_alloc += size; -+ -+ /* Avoid a possible overflow. -+ * TCP send queues can make this happen, if sk_mem_reclaim() -+ * is not called and more than 2 GBytes are released at once. -+ * -+ * If we reach 2 MBytes, reclaim 1 MBytes right now, there is -+ * no need to hold that much forward allocation anyway. -+ */ -+ if (unlikely(sk->sk_forward_alloc >= 1 << 21)) -+ __sk_mem_reclaim(sk, 1 << 20); - } - - static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb) -diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h -index 123a5af4e8bb..fa3b34365560 100644 ---- a/include/uapi/linux/rtnetlink.h -+++ b/include/uapi/linux/rtnetlink.h -@@ -343,7 +343,7 @@ struct rtnexthop { - #define RTNH_F_OFFLOAD 8 /* offloaded route */ - #define RTNH_F_LINKDOWN 16 /* carrier-down on nexthop */ - --#define RTNH_COMPARE_MASK (RTNH_F_DEAD | RTNH_F_LINKDOWN) -+#define RTNH_COMPARE_MASK (RTNH_F_DEAD | RTNH_F_LINKDOWN | RTNH_F_OFFLOAD) - - /* Macros to handle hexthops */ - -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index d2cd9de4b724..ad8d6e6b87ca 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -659,7 +659,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head, - - skb_gro_pull(skb, sizeof(*vhdr)); - skb_gro_postpull_rcsum(skb, vhdr, sizeof(*vhdr)); -- pp = ptype->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c -index 9542e84a9455..d80c15d028fe 100644 ---- a/net/bridge/br_multicast.c -+++ b/net/bridge/br_multicast.c -@@ -951,13 +951,12 @@ static void br_multicast_enable(struct bridge_mcast_own_query *query) - mod_timer(&query->timer, jiffies); - } - --void br_multicast_enable_port(struct net_bridge_port *port) -+static void __br_multicast_enable_port(struct net_bridge_port *port) - { - struct net_bridge *br = port->br; - -- spin_lock(&br->multicast_lock); - if (br->multicast_disabled || !netif_running(br->dev)) -- goto out; -+ return; - - br_multicast_enable(&port->ip4_own_query); - #if IS_ENABLED(CONFIG_IPV6) -@@ -965,8 +964,14 @@ void br_multicast_enable_port(struct net_bridge_port *port) - #endif - if (port->multicast_router == 2 && hlist_unhashed(&port->rlist)) - br_multicast_add_router(br, port); -+} - --out: -+void br_multicast_enable_port(struct net_bridge_port *port) -+{ -+ struct net_bridge *br = port->br; -+ -+ spin_lock(&br->multicast_lock); -+ __br_multicast_enable_port(port); - spin_unlock(&br->multicast_lock); - } - -@@ -1905,8 +1910,9 @@ static void br_multicast_start_querier(struct net_bridge *br, - - int br_multicast_toggle(struct net_bridge *br, unsigned long val) - { -- int err = 0; - struct net_bridge_mdb_htable *mdb; -+ struct net_bridge_port *port; -+ int err = 0; - - spin_lock_bh(&br->multicast_lock); - if (br->multicast_disabled == !val) -@@ -1934,10 +1940,9 @@ rollback: - goto rollback; - } - -- br_multicast_start_querier(br, &br->ip4_own_query); --#if IS_ENABLED(CONFIG_IPV6) -- br_multicast_start_querier(br, &br->ip6_own_query); --#endif -+ br_multicast_open(br); -+ list_for_each_entry(port, &br->port_list, list) -+ __br_multicast_enable_port(port); - - unlock: - spin_unlock_bh(&br->multicast_lock); -diff --git a/net/core/dev.c b/net/core/dev.c -index 0989fea88c44..b3fa4b86ab4c 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2836,6 +2836,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d - } - return head; - } -+EXPORT_SYMBOL_GPL(validate_xmit_skb_list); - - static void qdisc_pkt_len_init(struct sk_buff *skb) - { -@@ -4240,6 +4241,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff - NAPI_GRO_CB(skb)->flush = 0; - NAPI_GRO_CB(skb)->free = 0; - NAPI_GRO_CB(skb)->encap_mark = 0; -+ NAPI_GRO_CB(skb)->recursion_counter = 0; - NAPI_GRO_CB(skb)->gro_remcsum_start = 0; - - /* Setup for GRO checksum validation */ -@@ -5204,6 +5206,7 @@ static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev, - - static int __netdev_adjacent_dev_insert(struct net_device *dev, - struct net_device *adj_dev, -+ u16 ref_nr, - struct list_head *dev_list, - void *private, bool master) - { -@@ -5213,7 +5216,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, - adj = __netdev_find_adj(adj_dev, dev_list); - - if (adj) { -- adj->ref_nr++; -+ adj->ref_nr += ref_nr; - return 0; - } - -@@ -5223,7 +5226,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, - - adj->dev = adj_dev; - adj->master = master; -- adj->ref_nr = 1; -+ adj->ref_nr = ref_nr; - adj->private = private; - dev_hold(adj_dev); - -@@ -5262,6 +5265,7 @@ free_adj: - - static void __netdev_adjacent_dev_remove(struct net_device *dev, - struct net_device *adj_dev, -+ u16 ref_nr, - struct list_head *dev_list) - { - struct netdev_adjacent *adj; -@@ -5274,10 +5278,10 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, - BUG(); - } - -- if (adj->ref_nr > 1) { -- pr_debug("%s to %s ref_nr-- = %d\n", dev->name, adj_dev->name, -- adj->ref_nr-1); -- adj->ref_nr--; -+ if (adj->ref_nr > ref_nr) { -+ pr_debug("%s to %s ref_nr-%d = %d\n", dev->name, adj_dev->name, -+ ref_nr, adj->ref_nr-ref_nr); -+ adj->ref_nr -= ref_nr; - return; - } - -@@ -5296,21 +5300,22 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, - - static int __netdev_adjacent_dev_link_lists(struct net_device *dev, - struct net_device *upper_dev, -+ u16 ref_nr, - struct list_head *up_list, - struct list_head *down_list, - void *private, bool master) - { - int ret; - -- ret = __netdev_adjacent_dev_insert(dev, upper_dev, up_list, private, -- master); -+ ret = __netdev_adjacent_dev_insert(dev, upper_dev, ref_nr, up_list, -+ private, master); - if (ret) - return ret; - -- ret = __netdev_adjacent_dev_insert(upper_dev, dev, down_list, private, -- false); -+ ret = __netdev_adjacent_dev_insert(upper_dev, dev, ref_nr, down_list, -+ private, false); - if (ret) { -- __netdev_adjacent_dev_remove(dev, upper_dev, up_list); -+ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list); - return ret; - } - -@@ -5318,9 +5323,10 @@ static int __netdev_adjacent_dev_link_lists(struct net_device *dev, - } - - static int __netdev_adjacent_dev_link(struct net_device *dev, -- struct net_device *upper_dev) -+ struct net_device *upper_dev, -+ u16 ref_nr) - { -- return __netdev_adjacent_dev_link_lists(dev, upper_dev, -+ return __netdev_adjacent_dev_link_lists(dev, upper_dev, ref_nr, - &dev->all_adj_list.upper, - &upper_dev->all_adj_list.lower, - NULL, false); -@@ -5328,17 +5334,19 @@ static int __netdev_adjacent_dev_link(struct net_device *dev, - - static void __netdev_adjacent_dev_unlink_lists(struct net_device *dev, - struct net_device *upper_dev, -+ u16 ref_nr, - struct list_head *up_list, - struct list_head *down_list) - { -- __netdev_adjacent_dev_remove(dev, upper_dev, up_list); -- __netdev_adjacent_dev_remove(upper_dev, dev, down_list); -+ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list); -+ __netdev_adjacent_dev_remove(upper_dev, dev, ref_nr, down_list); - } - - static void __netdev_adjacent_dev_unlink(struct net_device *dev, -- struct net_device *upper_dev) -+ struct net_device *upper_dev, -+ u16 ref_nr) - { -- __netdev_adjacent_dev_unlink_lists(dev, upper_dev, -+ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ref_nr, - &dev->all_adj_list.upper, - &upper_dev->all_adj_list.lower); - } -@@ -5347,17 +5355,17 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev, - struct net_device *upper_dev, - void *private, bool master) - { -- int ret = __netdev_adjacent_dev_link(dev, upper_dev); -+ int ret = __netdev_adjacent_dev_link(dev, upper_dev, 1); - - if (ret) - return ret; - -- ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, -+ ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, 1, - &dev->adj_list.upper, - &upper_dev->adj_list.lower, - private, master); - if (ret) { -- __netdev_adjacent_dev_unlink(dev, upper_dev); -+ __netdev_adjacent_dev_unlink(dev, upper_dev, 1); - return ret; - } - -@@ -5367,8 +5375,8 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev, - static void __netdev_adjacent_dev_unlink_neighbour(struct net_device *dev, - struct net_device *upper_dev) - { -- __netdev_adjacent_dev_unlink(dev, upper_dev); -- __netdev_adjacent_dev_unlink_lists(dev, upper_dev, -+ __netdev_adjacent_dev_unlink(dev, upper_dev, 1); -+ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, 1, - &dev->adj_list.upper, - &upper_dev->adj_list.lower); - } -@@ -5420,7 +5428,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, - list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) { - pr_debug("Interlinking %s with %s, non-neighbour\n", - i->dev->name, j->dev->name); -- ret = __netdev_adjacent_dev_link(i->dev, j->dev); -+ ret = __netdev_adjacent_dev_link(i->dev, j->dev, i->ref_nr); - if (ret) - goto rollback_mesh; - } -@@ -5430,7 +5438,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, - list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) { - pr_debug("linking %s's upper device %s with %s\n", - upper_dev->name, i->dev->name, dev->name); -- ret = __netdev_adjacent_dev_link(dev, i->dev); -+ ret = __netdev_adjacent_dev_link(dev, i->dev, i->ref_nr); - if (ret) - goto rollback_upper_mesh; - } -@@ -5439,7 +5447,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, - list_for_each_entry(i, &dev->all_adj_list.lower, list) { - pr_debug("linking %s's lower device %s with %s\n", dev->name, - i->dev->name, upper_dev->name); -- ret = __netdev_adjacent_dev_link(i->dev, upper_dev); -+ ret = __netdev_adjacent_dev_link(i->dev, upper_dev, i->ref_nr); - if (ret) - goto rollback_lower_mesh; - } -@@ -5453,7 +5461,7 @@ rollback_lower_mesh: - list_for_each_entry(i, &dev->all_adj_list.lower, list) { - if (i == to_i) - break; -- __netdev_adjacent_dev_unlink(i->dev, upper_dev); -+ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr); - } - - i = NULL; -@@ -5463,7 +5471,7 @@ rollback_upper_mesh: - list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) { - if (i == to_i) - break; -- __netdev_adjacent_dev_unlink(dev, i->dev); -+ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr); - } - - i = j = NULL; -@@ -5475,7 +5483,7 @@ rollback_mesh: - list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) { - if (i == to_i && j == to_j) - break; -- __netdev_adjacent_dev_unlink(i->dev, j->dev); -+ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr); - } - if (i == to_i) - break; -@@ -5559,16 +5567,16 @@ void netdev_upper_dev_unlink(struct net_device *dev, - */ - list_for_each_entry(i, &dev->all_adj_list.lower, list) - list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) -- __netdev_adjacent_dev_unlink(i->dev, j->dev); -+ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr); - - /* remove also the devices itself from lower/upper device - * list - */ - list_for_each_entry(i, &dev->all_adj_list.lower, list) -- __netdev_adjacent_dev_unlink(i->dev, upper_dev); -+ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr); - - list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) -- __netdev_adjacent_dev_unlink(dev, i->dev); -+ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr); - - call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev, - &changeupper_info.info); -diff --git a/net/core/pktgen.c b/net/core/pktgen.c -index 4da4d51a2ccf..b6327601f979 100644 ---- a/net/core/pktgen.c -+++ b/net/core/pktgen.c -@@ -215,8 +215,8 @@ - #define M_NETIF_RECEIVE 1 /* Inject packets into stack */ - - /* If lock -- protects updating of if_list */ --#define if_lock(t) spin_lock(&(t->if_lock)); --#define if_unlock(t) spin_unlock(&(t->if_lock)); -+#define if_lock(t) mutex_lock(&(t->if_lock)); -+#define if_unlock(t) mutex_unlock(&(t->if_lock)); - - /* Used to help with determining the pkts on receive */ - #define PKTGEN_MAGIC 0xbe9be955 -@@ -422,7 +422,7 @@ struct pktgen_net { - }; - - struct pktgen_thread { -- spinlock_t if_lock; /* for list of devices */ -+ struct mutex if_lock; /* for list of devices */ - struct list_head if_list; /* All device here */ - struct list_head th_list; - struct task_struct *tsk; -@@ -2002,11 +2002,13 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d - { - struct pktgen_thread *t; - -+ mutex_lock(&pktgen_thread_lock); -+ - list_for_each_entry(t, &pn->pktgen_threads, th_list) { - struct pktgen_dev *pkt_dev; - -- rcu_read_lock(); -- list_for_each_entry_rcu(pkt_dev, &t->if_list, list) { -+ if_lock(t); -+ list_for_each_entry(pkt_dev, &t->if_list, list) { - if (pkt_dev->odev != dev) - continue; - -@@ -2021,8 +2023,9 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d - dev->name); - break; - } -- rcu_read_unlock(); -+ if_unlock(t); - } -+ mutex_unlock(&pktgen_thread_lock); - } - - static int pktgen_device_event(struct notifier_block *unused, -@@ -2278,7 +2281,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until) - - static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev) - { -- pkt_dev->pkt_overhead = LL_RESERVED_SPACE(pkt_dev->odev); -+ pkt_dev->pkt_overhead = 0; - pkt_dev->pkt_overhead += pkt_dev->nr_labels*sizeof(u32); - pkt_dev->pkt_overhead += VLAN_TAG_SIZE(pkt_dev); - pkt_dev->pkt_overhead += SVLAN_TAG_SIZE(pkt_dev); -@@ -2769,13 +2772,13 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb, - } - - static struct sk_buff *pktgen_alloc_skb(struct net_device *dev, -- struct pktgen_dev *pkt_dev, -- unsigned int extralen) -+ struct pktgen_dev *pkt_dev) - { -+ unsigned int extralen = LL_RESERVED_SPACE(dev); - struct sk_buff *skb = NULL; -- unsigned int size = pkt_dev->cur_pkt_size + 64 + extralen + -- pkt_dev->pkt_overhead; -+ unsigned int size; - -+ size = pkt_dev->cur_pkt_size + 64 + extralen + pkt_dev->pkt_overhead; - if (pkt_dev->flags & F_NODE) { - int node = pkt_dev->node >= 0 ? pkt_dev->node : numa_node_id(); - -@@ -2788,8 +2791,9 @@ static struct sk_buff *pktgen_alloc_skb(struct net_device *dev, - skb = __netdev_alloc_skb(dev, size, GFP_NOWAIT); - } - -+ /* the caller pre-fetches from skb->data and reserves for the mac hdr */ - if (likely(skb)) -- skb_reserve(skb, LL_RESERVED_SPACE(dev)); -+ skb_reserve(skb, extralen - 16); - - return skb; - } -@@ -2822,16 +2826,14 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev, - mod_cur_headers(pkt_dev); - queue_map = pkt_dev->cur_queue_map; - -- datalen = (odev->hard_header_len + 16) & ~0xf; -- -- skb = pktgen_alloc_skb(odev, pkt_dev, datalen); -+ skb = pktgen_alloc_skb(odev, pkt_dev); - if (!skb) { - sprintf(pkt_dev->result, "No memory"); - return NULL; - } - - prefetchw(skb->data); -- skb_reserve(skb, datalen); -+ skb_reserve(skb, 16); - - /* Reserve for ethernet and IP header */ - eth = (__u8 *) skb_push(skb, 14); -@@ -2951,7 +2953,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev, - mod_cur_headers(pkt_dev); - queue_map = pkt_dev->cur_queue_map; - -- skb = pktgen_alloc_skb(odev, pkt_dev, 16); -+ skb = pktgen_alloc_skb(odev, pkt_dev); - if (!skb) { - sprintf(pkt_dev->result, "No memory"); - return NULL; -@@ -3727,7 +3729,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn) - return -ENOMEM; - } - -- spin_lock_init(&t->if_lock); -+ mutex_init(&t->if_lock); - t->cpu = cpu; - - INIT_LIST_HEAD(&t->if_list); -diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c -index 9e63f252a89e..de85d4e1cf43 100644 ---- a/net/ethernet/eth.c -+++ b/net/ethernet/eth.c -@@ -436,7 +436,7 @@ struct sk_buff **eth_gro_receive(struct sk_buff **head, - - skb_gro_pull(skb, sizeof(*eh)); - skb_gro_postpull_rcsum(skb, eh, sizeof(*eh)); -- pp = ptype->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index 1a5c1ca3ad3c..afc18e9ca94a 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1372,7 +1372,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head, - skb_gro_pull(skb, sizeof(*iph)); - skb_set_transport_header(skb, skb_gro_offset(skb)); - -- pp = ops->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c -index 08d7de55e57e..08d8ee124538 100644 ---- a/net/ipv4/fou.c -+++ b/net/ipv4/fou.c -@@ -201,7 +201,7 @@ static struct sk_buff **fou_gro_receive(struct sk_buff **head, - if (!ops || !ops->callbacks.gro_receive) - goto out_unlock; - -- pp = ops->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -@@ -360,7 +360,7 @@ static struct sk_buff **gue_gro_receive(struct sk_buff **head, - if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive)) - goto out_unlock; - -- pp = ops->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c -index e603004c1af8..79ae0d7becbf 100644 ---- a/net/ipv4/gre_offload.c -+++ b/net/ipv4/gre_offload.c -@@ -219,7 +219,7 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head, - /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/ - skb_gro_postpull_rcsum(skb, greh, grehlen); - -- pp = ptype->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index a50124260f5a..9ce202549e7a 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -98,7 +98,7 @@ static void ip_cmsg_recv_retopts(struct msghdr *msg, struct sk_buff *skb) - } - - static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, -- int offset) -+ int tlen, int offset) - { - __wsum csum = skb->csum; - -@@ -106,7 +106,9 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, - return; - - if (offset != 0) -- csum = csum_sub(csum, csum_partial(skb->data, offset, 0)); -+ csum = csum_sub(csum, -+ csum_partial(skb->data + tlen, -+ offset, 0)); - - put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum); - } -@@ -152,7 +154,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) - } - - void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, -- int offset) -+ int tlen, int offset) - { - struct inet_sock *inet = inet_sk(skb->sk); - unsigned int flags = inet->cmsg_flags; -@@ -215,7 +217,7 @@ void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, - } - - if (flags & IP_CMSG_CHECKSUM) -- ip_cmsg_recv_checksum(msg, skb, offset); -+ ip_cmsg_recv_checksum(msg, skb, tlen, offset); - } - EXPORT_SYMBOL(ip_cmsg_recv_offset); - -diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c -index 9d1e555496e3..8e77786549c6 100644 ---- a/net/ipv4/ipmr.c -+++ b/net/ipv4/ipmr.c -@@ -2192,7 +2192,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, - - int ipmr_get_route(struct net *net, struct sk_buff *skb, - __be32 saddr, __be32 daddr, -- struct rtmsg *rtm, int nowait) -+ struct rtmsg *rtm, int nowait, u32 portid) - { - struct mfc_cache *cache; - struct mr_table *mrt; -@@ -2237,6 +2237,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb, - return -ENOMEM; - } - -+ NETLINK_CB(skb2).portid = portid; - skb_push(skb2, sizeof(struct iphdr)); - skb_reset_network_header(skb2); - iph = ip_hdr(skb2); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index b050cf980a57..8533a75a9328 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2492,7 +2492,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id, - IPV4_DEVCONF_ALL(net, MC_FORWARDING)) { - int err = ipmr_get_route(net, skb, - fl4->saddr, fl4->daddr, -- r, nowait); -+ r, nowait, portid); -+ - if (err <= 0) { - if (!nowait) { - if (err == 0) -diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c -index a0bd7a55193e..70fb352e317f 100644 ---- a/net/ipv4/sysctl_net_ipv4.c -+++ b/net/ipv4/sysctl_net_ipv4.c -@@ -97,11 +97,11 @@ static void inet_get_ping_group_range_table(struct ctl_table *table, kgid_t *low - container_of(table->data, struct net, ipv4.ping_group_range.range); - unsigned int seq; - do { -- seq = read_seqbegin(&net->ipv4.ip_local_ports.lock); -+ seq = read_seqbegin(&net->ipv4.ping_group_range.lock); - - *low = data[0]; - *high = data[1]; -- } while (read_seqretry(&net->ipv4.ip_local_ports.lock, seq)); -+ } while (read_seqretry(&net->ipv4.ping_group_range.lock, seq)); - } - - /* Update system visible IP port range */ -@@ -110,10 +110,10 @@ static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t hig - kgid_t *data = table->data; - struct net *net = - container_of(table->data, struct net, ipv4.ping_group_range.range); -- write_seqlock(&net->ipv4.ip_local_ports.lock); -+ write_seqlock(&net->ipv4.ping_group_range.lock); - data[0] = low; - data[1] = high; -- write_sequnlock(&net->ipv4.ip_local_ports.lock); -+ write_sequnlock(&net->ipv4.ping_group_range.lock); - } - - /* Validate changes from /proc interface. */ -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 12b98e257c5f..7cc0f8aac28f 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -2324,10 +2324,9 @@ static void DBGUNDO(struct sock *sk, const char *msg) - } - #if IS_ENABLED(CONFIG_IPV6) - else if (sk->sk_family == AF_INET6) { -- struct ipv6_pinfo *np = inet6_sk(sk); - pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n", - msg, -- &np->daddr, ntohs(inet->inet_dport), -+ &sk->sk_v6_daddr, ntohs(inet->inet_dport), - tp->snd_cwnd, tcp_left_out(tp), - tp->snd_ssthresh, tp->prior_ssthresh, - tp->packets_out); -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 660c967ba84a..0795647e94c6 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1950,12 +1950,14 @@ static int tcp_mtu_probe(struct sock *sk) - len = 0; - tcp_for_write_queue_from_safe(skb, next, sk) { - copy = min_t(int, skb->len, probe_size - len); -- if (nskb->ip_summed) -+ if (nskb->ip_summed) { - skb_copy_bits(skb, 0, skb_put(nskb, copy), copy); -- else -- nskb->csum = skb_copy_and_csum_bits(skb, 0, -- skb_put(nskb, copy), -- copy, nskb->csum); -+ } else { -+ __wsum csum = skb_copy_and_csum_bits(skb, 0, -+ skb_put(nskb, copy), -+ copy, 0); -+ nskb->csum = csum_block_add(nskb->csum, csum, len); -+ } - - if (skb->len <= copy) { - /* We've eaten all the data from this skb. -@@ -2569,7 +2571,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) - * copying overhead: fragmentation, tunneling, mangling etc. - */ - if (atomic_read(&sk->sk_wmem_alloc) > -- min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf)) -+ min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), -+ sk->sk_sndbuf)) - return -EAGAIN; - - if (skb_still_in_host_queue(sk, skb)) -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 0b1ea5abcc04..e9513e397c4f 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1342,7 +1342,7 @@ try_again: - *addr_len = sizeof(*sin); - } - if (inet->cmsg_flags) -- ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr)); -+ ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr), off); - - err = copied; - if (flags & MSG_TRUNC) -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 0e36e56dfd22..6396f1c80ae9 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -339,8 +339,8 @@ unflush: - skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */ - skb_gro_postpull_rcsum(skb, uh, sizeof(struct udphdr)); - NAPI_GRO_CB(skb)->proto = uo_priv->offload->ipproto; -- pp = uo_priv->offload->callbacks.gro_receive(head, skb, -- uo_priv->offload); -+ pp = call_gro_receive_udp(uo_priv->offload->callbacks.gro_receive, -+ head, skb, uo_priv->offload); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 036b39eb1220..cb8bb5988c03 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -2916,7 +2916,7 @@ static void init_loopback(struct net_device *dev) - * lo device down, release this obsolete dst and - * reallocate a new router for ifa. - */ -- if (sp_ifa->rt->dst.obsolete > 0) { -+ if (!atomic_read(&sp_ifa->rt->rt6i_ref)) { - ip6_rt_put(sp_ifa->rt); - sp_ifa->rt = NULL; - } else { -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 4650c6824783..17430f341073 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -886,7 +886,6 @@ static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev) - encap_limit = t->parms.encap_limit; - - memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6)); -- fl6.flowi6_proto = skb->protocol; - - err = ip6gre_xmit2(skb, dev, 0, &fl6, encap_limit, &mtu); - -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 82e9f3076028..efe6268b8bc3 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -247,7 +247,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head, - - skb_gro_postpull_rcsum(skb, iph, nlen); - -- pp = ops->callbacks.gro_receive(head, skb); -+ pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); - - out_unlock: - rcu_read_unlock(); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 3991b21e24ad..e8878886eba4 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -246,6 +246,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_ - hash = HASH(&any, local); - for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) { - if (ipv6_addr_equal(local, &t->parms.laddr) && -+ ipv6_addr_any(&t->parms.raddr) && - (t->dev->flags & IFF_UP)) - return t; - } -@@ -253,6 +254,7 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_ - hash = HASH(remote, &any); - for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) { - if (ipv6_addr_equal(remote, &t->parms.raddr) && -+ ipv6_addr_any(&t->parms.laddr) && - (t->dev->flags & IFF_UP)) - return t; - } -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index e207cb2468da..d9843e5a667f 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -2276,8 +2276,8 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb, - return 1; - } - --int ip6mr_get_route(struct net *net, -- struct sk_buff *skb, struct rtmsg *rtm, int nowait) -+int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm, -+ int nowait, u32 portid) - { - int err; - struct mr6_table *mrt; -@@ -2322,6 +2322,7 @@ int ip6mr_get_route(struct net *net, - return -ENOMEM; - } - -+ NETLINK_CB(skb2).portid = portid; - skb_reset_transport_header(skb2); - - skb_put(skb2, sizeof(struct ipv6hdr)); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 5af2cca0a46d..dbffc9de184b 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3140,7 +3140,9 @@ static int rt6_fill_node(struct net *net, - if (iif) { - #ifdef CONFIG_IPV6_MROUTE - if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) { -- int err = ip6mr_get_route(net, skb, rtm, nowait); -+ int err = ip6mr_get_route(net, skb, rtm, nowait, -+ portid); -+ - if (err <= 0) { - if (!nowait) { - if (err == 0) -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 2d81e2f33ef2..fbd521fdae53 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1179,6 +1179,16 @@ out: - return NULL; - } - -+static void tcp_v6_restore_cb(struct sk_buff *skb) -+{ -+ /* We need to move header back to the beginning if xfrm6_policy_check() -+ * and tcp_v6_fill_cb() are going to be called again. -+ * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there. -+ */ -+ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, -+ sizeof(struct inet6_skb_parm)); -+} -+ - /* The socket must have it's spinlock held when we get - * here, unless it is a TCP_LISTEN socket. - * -@@ -1308,6 +1318,7 @@ ipv6_pktoptions: - np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb)); - if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) { - skb_set_owner_r(opt_skb, sk); -+ tcp_v6_restore_cb(opt_skb); - opt_skb = xchg(&np->pktoptions, opt_skb); - } else { - __kfree_skb(opt_skb); -@@ -1341,15 +1352,6 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr, - TCP_SKB_CB(skb)->sacked = 0; - } - --static void tcp_v6_restore_cb(struct sk_buff *skb) --{ -- /* We need to move header back to the beginning if xfrm6_policy_check() -- * and tcp_v6_fill_cb() are going to be called again. -- */ -- memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, -- sizeof(struct inet6_skb_parm)); --} -- - static int tcp_v6_rcv(struct sk_buff *skb) - { - const struct tcphdr *th; -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index e6092bd72ee2..dfa85e7264df 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -498,7 +498,8 @@ try_again: - - if (is_udp4) { - if (inet->cmsg_flags) -- ip_cmsg_recv(msg, skb); -+ ip_cmsg_recv_offset(msg, skb, -+ sizeof(struct udphdr), off); - } else { - if (np->rxopt.all) - ip6_datagram_recv_specific_ctl(sk, msg, skb); -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 7a5fa0c98377..28fc283c1ec1 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2557,7 +2557,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - /* Record the max length of recvmsg() calls for future allocations */ - nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); - nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, -- 16384); -+ SKB_WITH_OVERHEAD(32768)); - - copied = data_skb->len; - if (len < copied) { -@@ -2810,14 +2810,13 @@ static int netlink_dump(struct sock *sk) - if (alloc_min_size < nlk->max_recvmsg_len) { - alloc_size = nlk->max_recvmsg_len; - skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, -- GFP_KERNEL | -- __GFP_NOWARN | -- __GFP_NORETRY); -+ (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM) | -+ __GFP_NOWARN | __GFP_NORETRY); - } - if (!skb) { - alloc_size = alloc_min_size; - skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, -- GFP_KERNEL); -+ (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM)); - } - if (!skb) - goto errout_skb; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index a86f26d05bc2..34e4fcfd240b 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -249,7 +249,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po); - static int packet_direct_xmit(struct sk_buff *skb) - { - struct net_device *dev = skb->dev; -- netdev_features_t features; -+ struct sk_buff *orig_skb = skb; - struct netdev_queue *txq; - int ret = NETDEV_TX_BUSY; - -@@ -257,9 +257,8 @@ static int packet_direct_xmit(struct sk_buff *skb) - !netif_carrier_ok(dev))) - goto drop; - -- features = netif_skb_features(skb); -- if (skb_needs_linearize(skb, features) && -- __skb_linearize(skb)) -+ skb = validate_xmit_skb_list(skb, dev); -+ if (skb != orig_skb) - goto drop; - - txq = skb_get_tx_queue(dev, skb); -@@ -279,7 +278,7 @@ static int packet_direct_xmit(struct sk_buff *skb) - return ret; - drop: - atomic_long_inc(&dev->tx_dropped); -- kfree_skb(skb); -+ kfree_skb_list(skb); - return NET_XMIT_DROP; - } - -@@ -3855,6 +3854,7 @@ static int packet_notifier(struct notifier_block *this, - } - if (msg == NETDEV_UNREGISTER) { - packet_cached_dev_reset(po); -+ fanout_release(sk); - po->ifindex = -1; - if (po->prot_hook.dev) - dev_put(po->prot_hook.dev); -diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c -index 796785e0bf96..d7edba4536bd 100644 ---- a/net/sched/act_vlan.c -+++ b/net/sched/act_vlan.c -@@ -33,6 +33,12 @@ static int tcf_vlan(struct sk_buff *skb, const struct tc_action *a, - bstats_update(&v->tcf_bstats, skb); - action = v->tcf_action; - -+ /* Ensure 'data' points at mac_header prior calling vlan manipulating -+ * functions. -+ */ -+ if (skb_at_tc_ingress(skb)) -+ skb_push_rcsum(skb, skb->mac_len); -+ - switch (v->tcfv_action) { - case TCA_VLAN_ACT_POP: - err = skb_vlan_pop(skb); -@@ -54,6 +60,9 @@ drop: - action = TC_ACT_SHOT; - v->tcf_qstats.drops++; - unlock: -+ if (skb_at_tc_ingress(skb)) -+ skb_pull_rcsum(skb, skb->mac_len); -+ - spin_unlock(&v->tcf_lock); - return action; - } -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index a75864d93142..ecc1904e454f 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -315,7 +315,8 @@ replay: - if (err == 0) { - struct tcf_proto *next = rtnl_dereference(tp->next); - -- tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER); -+ tfilter_notify(net, skb, n, tp, -+ t->tcm_handle, RTM_DELTFILTER); - if (tcf_destroy(tp, false)) - RCU_INIT_POINTER(*back, next); - } -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 22c2bf367d7e..29c7c43de108 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -3426,6 +3426,12 @@ sctp_disposition_t sctp_sf_ootb(struct net *net, - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, - commands); - -+ /* Report violation if chunk len overflows */ -+ ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); -+ if (ch_end > skb_tail_pointer(skb)) -+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -+ commands); -+ - /* Now that we know we at least have a chunk header, - * do things that are type appropriate. - */ -@@ -3457,12 +3463,6 @@ sctp_disposition_t sctp_sf_ootb(struct net *net, - } - } - -- /* Report violation if chunk len overflows */ -- ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); -- if (ch_end > skb_tail_pointer(skb)) -- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -- commands); -- - ch = (sctp_chunkhdr_t *) ch_end; - } while (ch_end < skb_tail_pointer(skb)); - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index be1489fc3234..402817be3873 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4371,7 +4371,7 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len, - static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval, - int __user *optlen) - { -- if (len <= 0) -+ if (len == 0) - return -EINVAL; - if (len > sizeof(struct sctp_event_subscribe)) - len = sizeof(struct sctp_event_subscribe); -@@ -5972,6 +5972,9 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname, - if (get_user(len, optlen)) - return -EFAULT; - -+ if (len < 0) -+ return -EINVAL; -+ - lock_sock(sk); - - switch (optname) { diff --git a/patch/kernel/mvebu-default/patch-4.4.32-33.patch b/patch/kernel/mvebu-default/patch-4.4.32-33.patch deleted file mode 100644 index 4a02c8081..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.32-33.patch +++ /dev/null @@ -1,1230 +0,0 @@ -diff --git a/Makefile b/Makefile -index fba9b09a1330..a513c045c8de 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 32 -+SUBLEVEL = 33 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c -index dfad287f1db1..dbedc576e4ca 100644 ---- a/arch/arc/kernel/time.c -+++ b/arch/arc/kernel/time.c -@@ -130,14 +130,17 @@ static cycle_t arc_counter_read(struct clocksource *cs) - cycle_t full; - } stamp; - -- -- __asm__ __volatile( -- "1: \n" -- " lr %0, [AUX_RTC_LOW] \n" -- " lr %1, [AUX_RTC_HIGH] \n" -- " lr %2, [AUX_RTC_CTRL] \n" -- " bbit0.nt %2, 31, 1b \n" -- : "=r" (stamp.low), "=r" (stamp.high), "=r" (status)); -+ /* -+ * hardware has an internal state machine which tracks readout of -+ * low/high and updates the CTRL.status if -+ * - interrupt/exception taken between the two reads -+ * - high increments after low has been read -+ */ -+ do { -+ stamp.low = read_aux_reg(AUX_RTC_LOW); -+ stamp.high = read_aux_reg(AUX_RTC_HIGH); -+ status = read_aux_reg(AUX_RTC_CTRL); -+ } while (!(status & _BITUL(31))); - - return stamp.full; - } -diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h -index dd7cee795709..c8c04a1f1c9f 100644 ---- a/arch/mips/include/asm/kvm_host.h -+++ b/arch/mips/include/asm/kvm_host.h -@@ -400,7 +400,10 @@ struct kvm_vcpu_arch { - /* Host KSEG0 address of the EI/DI offset */ - void *kseg0_commpage; - -- u32 io_gpr; /* GPR used as IO source/target */ -+ /* Resume PC after MMIO completion */ -+ unsigned long io_pc; -+ /* GPR used as IO source/target */ -+ u32 io_gpr; - - struct hrtimer comparecount_timer; - /* Count timer control KVM register */ -@@ -422,8 +425,6 @@ struct kvm_vcpu_arch { - /* Bitmask of pending exceptions to be cleared */ - unsigned long pending_exceptions_clr; - -- unsigned long pending_load_cause; -- - /* Save/Restore the entryhi register when are are preempted/scheduled back in */ - unsigned long preempt_entryhi; - -diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c -index 4298aeb1e20f..4c85ab808f99 100644 ---- a/arch/mips/kvm/emulate.c -+++ b/arch/mips/kvm/emulate.c -@@ -1473,6 +1473,7 @@ enum emulation_result kvm_mips_emulate_load(uint32_t inst, uint32_t cause, - struct kvm_vcpu *vcpu) - { - enum emulation_result er = EMULATE_DO_MMIO; -+ unsigned long curr_pc; - int32_t op, base, rt, offset; - uint32_t bytes; - -@@ -1481,7 +1482,18 @@ enum emulation_result kvm_mips_emulate_load(uint32_t inst, uint32_t cause, - offset = inst & 0xffff; - op = (inst >> 26) & 0x3f; - -- vcpu->arch.pending_load_cause = cause; -+ /* -+ * Find the resume PC now while we have safe and easy access to the -+ * prior branch instruction, and save it for -+ * kvm_mips_complete_mmio_load() to restore later. -+ */ -+ curr_pc = vcpu->arch.pc; -+ er = update_pc(vcpu, cause); -+ if (er == EMULATE_FAIL) -+ return er; -+ vcpu->arch.io_pc = vcpu->arch.pc; -+ vcpu->arch.pc = curr_pc; -+ - vcpu->arch.io_gpr = rt; - - switch (op) { -@@ -2461,9 +2473,8 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, - goto done; - } - -- er = update_pc(vcpu, vcpu->arch.pending_load_cause); -- if (er == EMULATE_FAIL) -- return er; -+ /* Restore saved resume PC */ -+ vcpu->arch.pc = vcpu->arch.io_pc; - - switch (run->mmio.len) { - case 4: -@@ -2485,11 +2496,6 @@ enum emulation_result kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, - break; - } - -- if (vcpu->arch.pending_load_cause & CAUSEF_BD) -- kvm_debug("[%#lx] Completing %d byte BD Load to gpr %d (0x%08lx) type %d\n", -- vcpu->arch.pc, run->mmio.len, vcpu->arch.io_gpr, *gpr, -- vcpu->mmio_needed); -- - done: - return er; - } -diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c -index 045035796ca7..b63b9a42af70 100644 ---- a/arch/s390/hypfs/hypfs_diag.c -+++ b/arch/s390/hypfs/hypfs_diag.c -@@ -525,11 +525,11 @@ static int diag224(void *ptr) - static int diag224_get_name_table(void) - { - /* memory must be below 2GB */ -- diag224_cpu_names = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA); -+ diag224_cpu_names = (char *) __get_free_page(GFP_KERNEL | GFP_DMA); - if (!diag224_cpu_names) - return -ENOMEM; - if (diag224(diag224_cpu_names)) { -- kfree(diag224_cpu_names); -+ free_page((unsigned long) diag224_cpu_names); - return -EOPNOTSUPP; - } - EBCASC(diag224_cpu_names + 16, (*diag224_cpu_names + 1) * 16); -@@ -538,7 +538,7 @@ static int diag224_get_name_table(void) - - static void diag224_delete_name_table(void) - { -- kfree(diag224_cpu_names); -+ free_page((unsigned long) diag224_cpu_names); - } - - static int diag224_idx2name(int index, char *name) -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index 3dd9c462d22a..8f8da9f92090 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -657,7 +657,7 @@ static int ghes_proc(struct ghes *ghes) - ghes_do_proc(ghes, ghes->estatus); - out: - ghes_clear_estatus(ghes); -- return 0; -+ return rc; - } - - static void ghes_add_timer(struct ghes *ghes) -diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c -index 74d97f4bac34..1d58854c4a9f 100644 ---- a/drivers/block/drbd/drbd_main.c -+++ b/drivers/block/drbd/drbd_main.c -@@ -1802,7 +1802,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock, - * do we need to block DRBD_SIG if sock == &meta.socket ?? - * otherwise wake_asender() might interrupt some send_*Ack ! - */ -- rv = kernel_sendmsg(sock, &msg, &iov, 1, size); -+ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len); - if (rv == -EAGAIN) { - if (we_should_drop_the_connection(connection, sock)) - break; -diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c -index 6f497aa1b276..cf25020576fa 100644 ---- a/drivers/char/hw_random/core.c -+++ b/drivers/char/hw_random/core.c -@@ -84,14 +84,14 @@ static size_t rng_buffer_size(void) - - static void add_early_randomness(struct hwrng *rng) - { -- unsigned char bytes[16]; - int bytes_read; -+ size_t size = min_t(size_t, 16, rng_buffer_size()); - - mutex_lock(&reading_mutex); -- bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1); -+ bytes_read = rng_get_data(rng, rng_buffer, size, 1); - mutex_unlock(&reading_mutex); - if (bytes_read > 0) -- add_device_randomness(bytes, bytes_read); -+ add_device_randomness(rng_buffer, bytes_read); - } - - static inline void cleanup_rng(struct kref *kref) -diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c -index 8b77abb6bc22..a5070f9cb0d4 100644 ---- a/drivers/clk/clk-qoriq.c -+++ b/drivers/clk/clk-qoriq.c -@@ -700,6 +700,7 @@ static struct clk * __init create_mux_common(struct clockgen *cg, - struct mux_hwclock *hwc, - const struct clk_ops *ops, - unsigned long min_rate, -+ unsigned long max_rate, - unsigned long pct80_rate, - const char *fmt, int idx) - { -@@ -728,6 +729,8 @@ static struct clk * __init create_mux_common(struct clockgen *cg, - continue; - if (rate < min_rate) - continue; -+ if (rate > max_rate) -+ continue; - - parent_names[j] = div->name; - hwc->parent_to_clksel[j] = i; -@@ -759,7 +762,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx) - struct mux_hwclock *hwc; - const struct clockgen_pll_div *div; - unsigned long plat_rate, min_rate; -- u64 pct80_rate; -+ u64 max_rate, pct80_rate; - u32 clksel; - - hwc = kzalloc(sizeof(*hwc), GFP_KERNEL); -@@ -787,8 +790,8 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx) - return NULL; - } - -- pct80_rate = clk_get_rate(div->clk); -- pct80_rate *= 8; -+ max_rate = clk_get_rate(div->clk); -+ pct80_rate = max_rate * 8; - do_div(pct80_rate, 10); - - plat_rate = clk_get_rate(cg->pll[PLATFORM_PLL].div[PLL_DIV1].clk); -@@ -798,7 +801,7 @@ static struct clk * __init create_one_cmux(struct clockgen *cg, int idx) - else - min_rate = plat_rate / 2; - -- return create_mux_common(cg, hwc, &cmux_ops, min_rate, -+ return create_mux_common(cg, hwc, &cmux_ops, min_rate, max_rate, - pct80_rate, "cg-cmux%d", idx); - } - -@@ -813,7 +816,7 @@ static struct clk * __init create_one_hwaccel(struct clockgen *cg, int idx) - hwc->reg = cg->regs + 0x20 * idx + 0x10; - hwc->info = cg->info.hwaccel[idx]; - -- return create_mux_common(cg, hwc, &hwaccel_ops, 0, 0, -+ return create_mux_common(cg, hwc, &hwaccel_ops, 0, ULONG_MAX, 0, - "cg-hwaccel%d", idx); - } - -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index 9d05d7dbcfa9..66c073fc8afc 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -864,8 +864,12 @@ at_xdmac_interleaved_queue_desc(struct dma_chan *chan, - * access. Hopefully we can access DDR through both ports (at least on - * SAMA5D4x), so we can use the same interface for source and dest, - * that solves the fact we don't know the direction. -+ * ERRATA: Even if useless for memory transfers, the PERID has to not -+ * match the one of another channel. If not, it could lead to spurious -+ * flag status. - */ -- u32 chan_cc = AT_XDMAC_CC_DIF(0) -+ u32 chan_cc = AT_XDMAC_CC_PERID(0x3f) -+ | AT_XDMAC_CC_DIF(0) - | AT_XDMAC_CC_SIF(0) - | AT_XDMAC_CC_MBSIZE_SIXTEEN - | AT_XDMAC_CC_TYPE_MEM_TRAN; -@@ -1042,8 +1046,12 @@ at_xdmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src, - * access DDR through both ports (at least on SAMA5D4x), so we can use - * the same interface for source and dest, that solves the fact we - * don't know the direction. -+ * ERRATA: Even if useless for memory transfers, the PERID has to not -+ * match the one of another channel. If not, it could lead to spurious -+ * flag status. - */ -- u32 chan_cc = AT_XDMAC_CC_DAM_INCREMENTED_AM -+ u32 chan_cc = AT_XDMAC_CC_PERID(0x3f) -+ | AT_XDMAC_CC_DAM_INCREMENTED_AM - | AT_XDMAC_CC_SAM_INCREMENTED_AM - | AT_XDMAC_CC_DIF(0) - | AT_XDMAC_CC_SIF(0) -@@ -1144,8 +1152,12 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan, - * access. Hopefully we can access DDR through both ports (at least on - * SAMA5D4x), so we can use the same interface for source and dest, - * that solves the fact we don't know the direction. -+ * ERRATA: Even if useless for memory transfers, the PERID has to not -+ * match the one of another channel. If not, it could lead to spurious -+ * flag status. - */ -- u32 chan_cc = AT_XDMAC_CC_DAM_UBS_AM -+ u32 chan_cc = AT_XDMAC_CC_PERID(0x3f) -+ | AT_XDMAC_CC_DAM_UBS_AM - | AT_XDMAC_CC_SAM_INCREMENTED_AM - | AT_XDMAC_CC_DIF(0) - | AT_XDMAC_CC_SIF(0) -diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c -index 3b92cad8bef2..1ea8532f5ab2 100644 ---- a/drivers/gpu/drm/i915/intel_hdmi.c -+++ b/drivers/gpu/drm/i915/intel_hdmi.c -@@ -1997,6 +1997,50 @@ intel_hdmi_add_properties(struct intel_hdmi *intel_hdmi, struct drm_connector *c - intel_hdmi->aspect_ratio = HDMI_PICTURE_ASPECT_NONE; - } - -+static u8 intel_hdmi_ddc_pin(struct drm_i915_private *dev_priv, -+ enum port port) -+{ -+ const struct ddi_vbt_port_info *info = -+ &dev_priv->vbt.ddi_port_info[port]; -+ u8 ddc_pin; -+ -+ if (info->alternate_ddc_pin) { -+ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (VBT)\n", -+ info->alternate_ddc_pin, port_name(port)); -+ return info->alternate_ddc_pin; -+ } -+ -+ switch (port) { -+ case PORT_B: -+ if (IS_BROXTON(dev_priv)) -+ ddc_pin = GMBUS_PIN_1_BXT; -+ else -+ ddc_pin = GMBUS_PIN_DPB; -+ break; -+ case PORT_C: -+ if (IS_BROXTON(dev_priv)) -+ ddc_pin = GMBUS_PIN_2_BXT; -+ else -+ ddc_pin = GMBUS_PIN_DPC; -+ break; -+ case PORT_D: -+ if (IS_CHERRYVIEW(dev_priv)) -+ ddc_pin = GMBUS_PIN_DPD_CHV; -+ else -+ ddc_pin = GMBUS_PIN_DPD; -+ break; -+ default: -+ MISSING_CASE(port); -+ ddc_pin = GMBUS_PIN_DPB; -+ break; -+ } -+ -+ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (platform default)\n", -+ ddc_pin, port_name(port)); -+ -+ return ddc_pin; -+} -+ - void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port, - struct intel_connector *intel_connector) - { -@@ -2006,7 +2050,6 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port, - struct drm_device *dev = intel_encoder->base.dev; - struct drm_i915_private *dev_priv = dev->dev_private; - enum port port = intel_dig_port->port; -- uint8_t alternate_ddc_pin; - - DRM_DEBUG_KMS("Adding HDMI connector on port %c\n", - port_name(port)); -@@ -2019,12 +2062,10 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port, - connector->doublescan_allowed = 0; - connector->stereo_allowed = 1; - -+ intel_hdmi->ddc_bus = intel_hdmi_ddc_pin(dev_priv, port); -+ - switch (port) { - case PORT_B: -- if (IS_BROXTON(dev_priv)) -- intel_hdmi->ddc_bus = GMBUS_PIN_1_BXT; -- else -- intel_hdmi->ddc_bus = GMBUS_PIN_DPB; - /* - * On BXT A0/A1, sw needs to activate DDIA HPD logic and - * interrupts to check the external panel connection. -@@ -2035,46 +2076,17 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port, - intel_encoder->hpd_pin = HPD_PORT_B; - break; - case PORT_C: -- if (IS_BROXTON(dev_priv)) -- intel_hdmi->ddc_bus = GMBUS_PIN_2_BXT; -- else -- intel_hdmi->ddc_bus = GMBUS_PIN_DPC; - intel_encoder->hpd_pin = HPD_PORT_C; - break; - case PORT_D: -- if (WARN_ON(IS_BROXTON(dev_priv))) -- intel_hdmi->ddc_bus = GMBUS_PIN_DISABLED; -- else if (IS_CHERRYVIEW(dev_priv)) -- intel_hdmi->ddc_bus = GMBUS_PIN_DPD_CHV; -- else -- intel_hdmi->ddc_bus = GMBUS_PIN_DPD; - intel_encoder->hpd_pin = HPD_PORT_D; - break; - case PORT_E: -- /* On SKL PORT E doesn't have seperate GMBUS pin -- * We rely on VBT to set a proper alternate GMBUS pin. */ -- alternate_ddc_pin = -- dev_priv->vbt.ddi_port_info[PORT_E].alternate_ddc_pin; -- switch (alternate_ddc_pin) { -- case DDC_PIN_B: -- intel_hdmi->ddc_bus = GMBUS_PIN_DPB; -- break; -- case DDC_PIN_C: -- intel_hdmi->ddc_bus = GMBUS_PIN_DPC; -- break; -- case DDC_PIN_D: -- intel_hdmi->ddc_bus = GMBUS_PIN_DPD; -- break; -- default: -- MISSING_CASE(alternate_ddc_pin); -- } - intel_encoder->hpd_pin = HPD_PORT_E; - break; -- case PORT_A: -- intel_encoder->hpd_pin = HPD_PORT_A; -- /* Internal port only for eDP. */ - default: -- BUG(); -+ MISSING_CASE(port); -+ return; - } - - if (IS_VALLEYVIEW(dev)) { -diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c -index dc33c1dd5191..b5beea53d6f6 100644 ---- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c -+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c -@@ -30,26 +30,26 @@ static struct { - u32 usage_id; - int unit; /* 0 for default others from HID sensor spec */ - int scale_val0; /* scale, whole number */ -- int scale_val1; /* scale, fraction in micros */ -+ int scale_val1; /* scale, fraction in nanos */ - } unit_conversion[] = { -- {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650}, -+ {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650000}, - {HID_USAGE_SENSOR_ACCEL_3D, - HID_USAGE_SENSOR_UNITS_METERS_PER_SEC_SQRD, 1, 0}, - {HID_USAGE_SENSOR_ACCEL_3D, -- HID_USAGE_SENSOR_UNITS_G, 9, 806650}, -+ HID_USAGE_SENSOR_UNITS_G, 9, 806650000}, - -- {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453}, -+ {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453293}, - {HID_USAGE_SENSOR_GYRO_3D, - HID_USAGE_SENSOR_UNITS_RADIANS_PER_SECOND, 1, 0}, - {HID_USAGE_SENSOR_GYRO_3D, -- HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453}, -+ HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453293}, - -- {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000}, -+ {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000000}, - {HID_USAGE_SENSOR_COMPASS_3D, HID_USAGE_SENSOR_UNITS_GAUSS, 1, 0}, - -- {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453}, -+ {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453293}, - {HID_USAGE_SENSOR_INCLINOMETER_3D, -- HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453}, -+ HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453293}, - {HID_USAGE_SENSOR_INCLINOMETER_3D, - HID_USAGE_SENSOR_UNITS_RADIANS, 1, 0}, - -@@ -57,7 +57,7 @@ static struct { - {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0}, - - {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0}, -- {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000}, -+ {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000000}, - }; - - static int pow_10(unsigned power) -@@ -266,15 +266,15 @@ EXPORT_SYMBOL(hid_sensor_write_raw_hyst_value); - /* - * This fuction applies the unit exponent to the scale. - * For example: -- * 9.806650 ->exp:2-> val0[980]val1[665000] -- * 9.000806 ->exp:2-> val0[900]val1[80600] -- * 0.174535 ->exp:2-> val0[17]val1[453500] -- * 1.001745 ->exp:0-> val0[1]val1[1745] -- * 1.001745 ->exp:2-> val0[100]val1[174500] -- * 1.001745 ->exp:4-> val0[10017]val1[450000] -- * 9.806650 ->exp:-2-> val0[0]val1[98066] -+ * 9.806650000 ->exp:2-> val0[980]val1[665000000] -+ * 9.000806000 ->exp:2-> val0[900]val1[80600000] -+ * 0.174535293 ->exp:2-> val0[17]val1[453529300] -+ * 1.001745329 ->exp:0-> val0[1]val1[1745329] -+ * 1.001745329 ->exp:2-> val0[100]val1[174532900] -+ * 1.001745329 ->exp:4-> val0[10017]val1[453290000] -+ * 9.806650000 ->exp:-2-> val0[0]val1[98066500] - */ --static void adjust_exponent_micro(int *val0, int *val1, int scale0, -+static void adjust_exponent_nano(int *val0, int *val1, int scale0, - int scale1, int exp) - { - int i; -@@ -285,32 +285,32 @@ static void adjust_exponent_micro(int *val0, int *val1, int scale0, - if (exp > 0) { - *val0 = scale0 * pow_10(exp); - res = 0; -- if (exp > 6) { -+ if (exp > 9) { - *val1 = 0; - return; - } - for (i = 0; i < exp; ++i) { -- x = scale1 / pow_10(5 - i); -+ x = scale1 / pow_10(8 - i); - res += (pow_10(exp - 1 - i) * x); -- scale1 = scale1 % pow_10(5 - i); -+ scale1 = scale1 % pow_10(8 - i); - } - *val0 += res; - *val1 = scale1 * pow_10(exp); - } else if (exp < 0) { - exp = abs(exp); -- if (exp > 6) { -+ if (exp > 9) { - *val0 = *val1 = 0; - return; - } - *val0 = scale0 / pow_10(exp); - rem = scale0 % pow_10(exp); - res = 0; -- for (i = 0; i < (6 - exp); ++i) { -- x = scale1 / pow_10(5 - i); -- res += (pow_10(5 - exp - i) * x); -- scale1 = scale1 % pow_10(5 - i); -+ for (i = 0; i < (9 - exp); ++i) { -+ x = scale1 / pow_10(8 - i); -+ res += (pow_10(8 - exp - i) * x); -+ scale1 = scale1 % pow_10(8 - i); - } -- *val1 = rem * pow_10(6 - exp) + res; -+ *val1 = rem * pow_10(9 - exp) + res; - } else { - *val0 = scale0; - *val1 = scale1; -@@ -332,14 +332,14 @@ int hid_sensor_format_scale(u32 usage_id, - unit_conversion[i].unit == attr_info->units) { - exp = hid_sensor_convert_exponent( - attr_info->unit_expo); -- adjust_exponent_micro(val0, val1, -+ adjust_exponent_nano(val0, val1, - unit_conversion[i].scale_val0, - unit_conversion[i].scale_val1, exp); - break; - } - } - -- return IIO_VAL_INT_PLUS_MICRO; -+ return IIO_VAL_INT_PLUS_NANO; - } - EXPORT_SYMBOL(hid_sensor_format_scale); - -diff --git a/drivers/iio/orientation/hid-sensor-rotation.c b/drivers/iio/orientation/hid-sensor-rotation.c -index b98b9d94d184..a97e802ca523 100644 ---- a/drivers/iio/orientation/hid-sensor-rotation.c -+++ b/drivers/iio/orientation/hid-sensor-rotation.c -@@ -335,6 +335,7 @@ static struct platform_driver hid_dev_rot_platform_driver = { - .id_table = hid_dev_rot_ids, - .driver = { - .name = KBUILD_MODNAME, -+ .pm = &hid_sensor_pm_ops, - }, - .probe = hid_dev_rot_probe, - .remove = hid_dev_rot_remove, -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 0397985a2601..5975d76ce755 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -1833,6 +1833,9 @@ static void dma_ops_domain_free(struct dma_ops_domain *dom) - kfree(dom->aperture[i]); - } - -+ if (dom->domain.id) -+ domain_id_free(dom->domain.id); -+ - kfree(dom); - } - -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index b7f852d824a3..5baa830ce49f 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -1672,6 +1672,7 @@ static void disable_dmar_iommu(struct intel_iommu *iommu) - if (!iommu->domains || !iommu->domain_ids) - return; - -+again: - spin_lock_irqsave(&device_domain_lock, flags); - list_for_each_entry_safe(info, tmp, &device_domain_list, global) { - struct dmar_domain *domain; -@@ -1684,10 +1685,19 @@ static void disable_dmar_iommu(struct intel_iommu *iommu) - - domain = info->domain; - -- dmar_remove_one_dev_info(domain, info->dev); -+ __dmar_remove_one_dev_info(info); - -- if (!domain_type_is_vm_or_si(domain)) -+ if (!domain_type_is_vm_or_si(domain)) { -+ /* -+ * The domain_exit() function can't be called under -+ * device_domain_lock, as it takes this lock itself. -+ * So release the lock here and re-run the loop -+ * afterwards. -+ */ -+ spin_unlock_irqrestore(&device_domain_lock, flags); - domain_exit(domain); -+ goto again; -+ } - } - spin_unlock_irqrestore(&device_domain_lock, flags); - -diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c -index 0d248ce02a9b..ab58f0b9da5c 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_core.c -+++ b/drivers/media/usb/dvb-usb/dib0700_core.c -@@ -677,7 +677,7 @@ static void dib0700_rc_urb_completion(struct urb *purb) - struct dvb_usb_device *d = purb->context; - struct dib0700_rc_response *poll_reply; - enum rc_type protocol; -- u32 uninitialized_var(keycode); -+ u32 keycode; - u8 toggle; - - deb_info("%s()\n", __func__); -@@ -719,7 +719,8 @@ static void dib0700_rc_urb_completion(struct urb *purb) - poll_reply->nec.data == 0x00 && - poll_reply->nec.not_data == 0xff) { - poll_reply->data_state = 2; -- break; -+ rc_repeat(d->rc_dev); -+ goto resubmit; - } - - if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) { -diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c -index 020de5919c21..bdc7fcd80eca 100644 ---- a/drivers/misc/mei/bus-fixup.c -+++ b/drivers/misc/mei/bus-fixup.c -@@ -151,7 +151,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, - - ret = 0; - bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); -- if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) { -+ if (bytes_recv < if_version_length) { - dev_err(bus->dev, "Could not read IF version\n"); - ret = -EIO; - goto err; -diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c -index d839147e591d..44ecebd1ea8c 100644 ---- a/drivers/mmc/host/mxs-mmc.c -+++ b/drivers/mmc/host/mxs-mmc.c -@@ -661,13 +661,13 @@ static int mxs_mmc_probe(struct platform_device *pdev) - - platform_set_drvdata(pdev, mmc); - -+ spin_lock_init(&host->lock); -+ - ret = devm_request_irq(&pdev->dev, irq_err, mxs_mmc_irq_handler, 0, - dev_name(&pdev->dev), host); - if (ret) - goto out_free_dma; - -- spin_lock_init(&host->lock); -- - ret = mmc_add_host(mmc); - if (ret) - goto out_free_dma; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 979cc024bca7..4edbab6ca7ef 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -8595,7 +8595,7 @@ static int i40e_ndo_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq, - return 0; - - return ndo_dflt_bridge_getlink(skb, pid, seq, dev, veb->bridge_mode, -- nlflags, 0, 0, filter_mask, NULL); -+ 0, 0, nlflags, filter_mask, NULL); - } - - #define I40E_MAX_TUNNEL_HDR_LEN 80 -diff --git a/drivers/nfc/mei_phy.c b/drivers/nfc/mei_phy.c -index 83deda4bb4d6..6f9563a96488 100644 ---- a/drivers/nfc/mei_phy.c -+++ b/drivers/nfc/mei_phy.c -@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc_mei_phy *phy) - return -ENOMEM; - - bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length); -- if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) { -+ if (bytes_recv < 0 || bytes_recv < if_version_length) { - pr_err("Could not read IF version\n"); - r = -EIO; - goto err; -diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c -index 4e377599d266..a009ae34c5ef 100644 ---- a/drivers/pinctrl/intel/pinctrl-cherryview.c -+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c -@@ -1564,12 +1564,15 @@ static int chv_pinctrl_remove(struct platform_device *pdev) - } - - #ifdef CONFIG_PM_SLEEP --static int chv_pinctrl_suspend(struct device *dev) -+static int chv_pinctrl_suspend_noirq(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); -+ unsigned long flags; - int i; - -+ raw_spin_lock_irqsave(&chv_lock, flags); -+ - pctrl->saved_intmask = readl(pctrl->regs + CHV_INTMASK); - - for (i = 0; i < pctrl->community->npins; i++) { -@@ -1590,15 +1593,20 @@ static int chv_pinctrl_suspend(struct device *dev) - ctx->padctrl1 = readl(reg); - } - -+ raw_spin_unlock_irqrestore(&chv_lock, flags); -+ - return 0; - } - --static int chv_pinctrl_resume(struct device *dev) -+static int chv_pinctrl_resume_noirq(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); -+ unsigned long flags; - int i; - -+ raw_spin_lock_irqsave(&chv_lock, flags); -+ - /* - * Mask all interrupts before restoring per-pin configuration - * registers because we don't know in which state BIOS left them -@@ -1643,12 +1651,15 @@ static int chv_pinctrl_resume(struct device *dev) - chv_writel(0xffff, pctrl->regs + CHV_INTSTAT); - chv_writel(pctrl->saved_intmask, pctrl->regs + CHV_INTMASK); - -+ raw_spin_unlock_irqrestore(&chv_lock, flags); -+ - return 0; - } - #endif - - static const struct dev_pm_ops chv_pinctrl_pm_ops = { -- SET_LATE_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend, chv_pinctrl_resume) -+ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend_noirq, -+ chv_pinctrl_resume_noirq) - }; - - static const struct acpi_device_id chv_pinctrl_acpi_match[] = { -diff --git a/drivers/platform/x86/toshiba-wmi.c b/drivers/platform/x86/toshiba-wmi.c -index feac4576b837..2df07ee8f3c3 100644 ---- a/drivers/platform/x86/toshiba-wmi.c -+++ b/drivers/platform/x86/toshiba-wmi.c -@@ -24,14 +24,15 @@ - #include - #include - #include -+#include - - MODULE_AUTHOR("Azael Avalos"); - MODULE_DESCRIPTION("Toshiba WMI Hotkey Driver"); - MODULE_LICENSE("GPL"); - --#define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100" -+#define WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100" - --MODULE_ALIAS("wmi:"TOSHIBA_WMI_EVENT_GUID); -+MODULE_ALIAS("wmi:"WMI_EVENT_GUID); - - static struct input_dev *toshiba_wmi_input_dev; - -@@ -63,6 +64,16 @@ static void toshiba_wmi_notify(u32 value, void *context) - kfree(response.pointer); - } - -+static struct dmi_system_id toshiba_wmi_dmi_table[] __initdata = { -+ { -+ .ident = "Toshiba laptop", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), -+ }, -+ }, -+ {} -+}; -+ - static int __init toshiba_wmi_input_setup(void) - { - acpi_status status; -@@ -81,7 +92,7 @@ static int __init toshiba_wmi_input_setup(void) - if (err) - goto err_free_dev; - -- status = wmi_install_notify_handler(TOSHIBA_WMI_EVENT_GUID, -+ status = wmi_install_notify_handler(WMI_EVENT_GUID, - toshiba_wmi_notify, NULL); - if (ACPI_FAILURE(status)) { - err = -EIO; -@@ -95,7 +106,7 @@ static int __init toshiba_wmi_input_setup(void) - return 0; - - err_remove_notifier: -- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID); -+ wmi_remove_notify_handler(WMI_EVENT_GUID); - err_free_keymap: - sparse_keymap_free(toshiba_wmi_input_dev); - err_free_dev: -@@ -105,7 +116,7 @@ static int __init toshiba_wmi_input_setup(void) - - static void toshiba_wmi_input_destroy(void) - { -- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID); -+ wmi_remove_notify_handler(WMI_EVENT_GUID); - sparse_keymap_free(toshiba_wmi_input_dev); - input_unregister_device(toshiba_wmi_input_dev); - } -@@ -114,7 +125,8 @@ static int __init toshiba_wmi_init(void) - { - int ret; - -- if (!wmi_has_guid(TOSHIBA_WMI_EVENT_GUID)) -+ if (!wmi_has_guid(WMI_EVENT_GUID) || -+ !dmi_check_system(toshiba_wmi_dmi_table)) - return -ENODEV; - - ret = toshiba_wmi_input_setup(); -@@ -130,7 +142,7 @@ static int __init toshiba_wmi_init(void) - - static void __exit toshiba_wmi_exit(void) - { -- if (wmi_has_guid(TOSHIBA_WMI_EVENT_GUID)) -+ if (wmi_has_guid(WMI_EVENT_GUID)) - toshiba_wmi_input_destroy(); - } - -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 0969cea1089a..2d867c5bfd9f 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -1275,9 +1275,9 @@ scsih_target_alloc(struct scsi_target *starget) - sas_target_priv_data->handle = raid_device->handle; - sas_target_priv_data->sas_address = raid_device->wwid; - sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME; -- sas_target_priv_data->raid_device = raid_device; - if (ioc->is_warpdrive) -- raid_device->starget = starget; -+ sas_target_priv_data->raid_device = raid_device; -+ raid_device->starget = starget; - } - spin_unlock_irqrestore(&ioc->raid_device_lock, flags); - return 0; -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index fc6674db4f2d..c44cbf46221c 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2257,6 +2257,8 @@ qla2xxx_scan_finished(struct Scsi_Host *shost, unsigned long time) - { - scsi_qla_host_t *vha = shost_priv(shost); - -+ if (test_bit(UNLOADING, &vha->dpc_flags)) -+ return 1; - if (!vha->host) - return 1; - if (time > vha->hw->loop_reset_delay * HZ) -diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c -index 10c43dda0f5a..196da09e20a1 100644 ---- a/drivers/staging/iio/impedance-analyzer/ad5933.c -+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c -@@ -647,6 +647,7 @@ static void ad5933_work(struct work_struct *work) - __be16 buf[2]; - int val[2]; - unsigned char status; -+ int ret; - - mutex_lock(&indio_dev->mlock); - if (st->state == AD5933_CTRL_INIT_START_FREQ) { -@@ -654,19 +655,22 @@ static void ad5933_work(struct work_struct *work) - ad5933_cmd(st, AD5933_CTRL_START_SWEEP); - st->state = AD5933_CTRL_START_SWEEP; - schedule_delayed_work(&st->work, st->poll_time_jiffies); -- mutex_unlock(&indio_dev->mlock); -- return; -+ goto out; - } - -- ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); -+ ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); -+ if (ret) -+ goto out; - - if (status & AD5933_STAT_DATA_VALID) { - int scan_count = bitmap_weight(indio_dev->active_scan_mask, - indio_dev->masklength); -- ad5933_i2c_read(st->client, -+ ret = ad5933_i2c_read(st->client, - test_bit(1, indio_dev->active_scan_mask) ? - AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA, - scan_count * 2, (u8 *)buf); -+ if (ret) -+ goto out; - - if (scan_count == 2) { - val[0] = be16_to_cpu(buf[0]); -@@ -678,8 +682,7 @@ static void ad5933_work(struct work_struct *work) - } else { - /* no data available - try again later */ - schedule_delayed_work(&st->work, st->poll_time_jiffies); -- mutex_unlock(&indio_dev->mlock); -- return; -+ goto out; - } - - if (status & AD5933_STAT_SWEEP_DONE) { -@@ -691,7 +694,7 @@ static void ad5933_work(struct work_struct *work) - ad5933_cmd(st, AD5933_CTRL_INC_FREQ); - schedule_delayed_work(&st->work, st->poll_time_jiffies); - } -- -+out: - mutex_unlock(&indio_dev->mlock); - } - -diff --git a/drivers/staging/nvec/nvec_ps2.c b/drivers/staging/nvec/nvec_ps2.c -index 0922dd3a08d3..196f6b0a288f 100644 ---- a/drivers/staging/nvec/nvec_ps2.c -+++ b/drivers/staging/nvec/nvec_ps2.c -@@ -106,13 +106,12 @@ static int nvec_mouse_probe(struct platform_device *pdev) - { - struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent); - struct serio *ser_dev; -- char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 }; - -- ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL); -+ ser_dev = kzalloc(sizeof(struct serio), GFP_KERNEL); - if (!ser_dev) - return -ENOMEM; - -- ser_dev->id.type = SERIO_PS_PSTHRU; -+ ser_dev->id.type = SERIO_8042; - ser_dev->write = ps2_sendcommand; - ser_dev->start = ps2_startstreaming; - ser_dev->stop = ps2_stopstreaming; -@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platform_device *pdev) - - serio_register_port(ser_dev); - -- /* mouse reset */ -- nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset)); -- - return 0; - } - -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 7b5462eb8388..e0b89b961e1b 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -2075,6 +2075,7 @@ static void atmel_serial_pm(struct uart_port *port, unsigned int state, - static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - struct ktermios *old) - { -+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); - unsigned long flags; - unsigned int old_mode, mode, imr, quot, baud; - -@@ -2178,11 +2179,29 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - mode |= ATMEL_US_USMODE_RS485; - } else if (termios->c_cflag & CRTSCTS) { - /* RS232 with hardware handshake (RTS/CTS) */ -- if (atmel_use_dma_rx(port) && !atmel_use_fifo(port)) { -- dev_info(port->dev, "not enabling hardware flow control because DMA is used"); -- termios->c_cflag &= ~CRTSCTS; -- } else { -+ if (atmel_use_fifo(port) && -+ !mctrl_gpio_to_gpiod(atmel_port->gpios, UART_GPIO_CTS)) { -+ /* -+ * with ATMEL_US_USMODE_HWHS set, the controller will -+ * be able to drive the RTS pin high/low when the RX -+ * FIFO is above RXFTHRES/below RXFTHRES2. -+ * It will also disable the transmitter when the CTS -+ * pin is high. -+ * This mode is not activated if CTS pin is a GPIO -+ * because in this case, the transmitter is always -+ * disabled (there must be an internal pull-up -+ * responsible for this behaviour). -+ * If the RTS pin is a GPIO, the controller won't be -+ * able to drive it according to the FIFO thresholds, -+ * but it will be handled by the driver. -+ */ - mode |= ATMEL_US_USMODE_HWHS; -+ } else { -+ /* -+ * For platforms without FIFO, the flow control is -+ * handled by the driver. -+ */ -+ mode |= ATMEL_US_USMODE_NORMAL; - } - } else { - /* RS232 without hadware handshake */ -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 7f374369e539..4d77745f439f 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -877,8 +877,6 @@ static int wait_serial_change(struct acm *acm, unsigned long arg) - DECLARE_WAITQUEUE(wait, current); - struct async_icount old, new; - -- if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD )) -- return -EINVAL; - do { - spin_lock_irq(&acm->read_lock); - old = acm->oldcount; -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index b644248f4b8e..7413f89660f7 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -594,14 +594,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, - - req->length = length; - -- /* throttle high/super speed IRQ rate back slightly */ -- if (gadget_is_dualspeed(dev->gadget)) -- req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH || -- dev->gadget->speed == USB_SPEED_SUPER)) && -- !list_empty(&dev->tx_reqs)) -- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0) -- : 0; -- - retval = usb_ep_queue(in, req, GFP_ATOMIC); - switch (retval) { - default: -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 4bc9dbf29a73..3cff6523f27d 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -8691,9 +8691,14 @@ static void btrfs_invalidatepage(struct page *page, unsigned int offset, - * So even we call qgroup_free_data(), it won't decrease reserved - * space. - * 2) Not written to disk -- * This means the reserved space should be freed here. -+ * This means the reserved space should be freed here. However, -+ * if a truncate invalidates the page (by clearing PageDirty) -+ * and the page is accounted for while allocating extent -+ * in btrfs_check_data_free_space() we let delayed_ref to -+ * free the entire extent. - */ -- btrfs_qgroup_free_data(inode, page_start, PAGE_CACHE_SIZE); -+ if (PageDirty(page)) -+ btrfs_qgroup_free_data(inode, page_start, PAGE_SIZE); - if (!inode_evicting) { - clear_extent_bit(tree, page_start, page_end, - EXTENT_LOCKED | EXTENT_DIRTY | -diff --git a/fs/coredump.c b/fs/coredump.c -index dfc87c5f5a54..5d15c4975ba1 100644 ---- a/fs/coredump.c -+++ b/fs/coredump.c -@@ -1,6 +1,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -399,7 +400,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state) - if (core_waiters > 0) { - struct core_thread *ptr; - -+ freezer_do_not_count(); - wait_for_completion(&core_state->startup); -+ freezer_count(); - /* - * Wait for all the threads to become inactive, so that - * all the thread context (extended register state, like -diff --git a/lib/genalloc.c b/lib/genalloc.c -index 116a166b096f..27aa9c629d13 100644 ---- a/lib/genalloc.c -+++ b/lib/genalloc.c -@@ -273,7 +273,7 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size) - struct gen_pool_chunk *chunk; - unsigned long addr = 0; - int order = pool->min_alloc_order; -- int nbits, start_bit = 0, end_bit, remain; -+ int nbits, start_bit, end_bit, remain; - - #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG - BUG_ON(in_nmi()); -@@ -288,6 +288,7 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size) - if (size > atomic_read(&chunk->avail)) - continue; - -+ start_bit = 0; - end_bit = chunk_size(chunk) >> order; - retry: - start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits, -diff --git a/mm/swapfile.c b/mm/swapfile.c -index 58877312cf6b..c1a0f3dea8b5 100644 ---- a/mm/swapfile.c -+++ b/mm/swapfile.c -@@ -2225,6 +2225,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p, - swab32s(&swap_header->info.version); - swab32s(&swap_header->info.last_page); - swab32s(&swap_header->info.nr_badpages); -+ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) -+ return 0; - for (i = 0; i < swap_header->info.nr_badpages; i++) - swab32s(&swap_header->info.badpages[i]); - } -diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c -index a5d41dfa9f05..2c89f90cd7bc 100644 ---- a/net/netfilter/nf_log.c -+++ b/net/netfilter/nf_log.c -@@ -401,7 +401,7 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write, - size_t size = *lenp; - int r = 0; - int tindex = (unsigned long)table->extra1; -- struct net *net = current->nsproxy->net_ns; -+ struct net *net = table->extra2; - - if (write) { - if (size > sizeof(buf)) -@@ -453,7 +453,6 @@ static int netfilter_log_sysctl_init(struct net *net) - 3, "%d", i); - nf_log_sysctl_table[i].procname = - nf_log_sysctl_fnames[i]; -- nf_log_sysctl_table[i].data = NULL; - nf_log_sysctl_table[i].maxlen = NFLOGGER_NAME_LEN; - nf_log_sysctl_table[i].mode = 0644; - nf_log_sysctl_table[i].proc_handler = -@@ -463,6 +462,9 @@ static int netfilter_log_sysctl_init(struct net *net) - } - } - -+ for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) -+ table[i].extra2 = net; -+ - net->nf.nf_log_dir_header = register_net_sysctl(net, - "net/netfilter/nf_log", - table); -diff --git a/sound/core/info.c b/sound/core/info.c -index 895362a696c9..8ab72e0f5932 100644 ---- a/sound/core/info.c -+++ b/sound/core/info.c -@@ -325,10 +325,15 @@ static ssize_t snd_info_text_entry_write(struct file *file, - size_t next; - int err = 0; - -+ if (!entry->c.text.write) -+ return -EIO; - pos = *offset; - if (!valid_pos(pos, count)) - return -EIO; - next = pos + count; -+ /* don't handle too large text inputs */ -+ if (next > 16 * 1024) -+ return -EIO; - mutex_lock(&entry->access); - buf = data->wbuffer; - if (!buf) { -@@ -366,7 +371,9 @@ static int snd_info_seq_show(struct seq_file *seq, void *p) - struct snd_info_private_data *data = seq->private; - struct snd_info_entry *entry = data->entry; - -- if (entry->c.text.read) { -+ if (!entry->c.text.read) { -+ return -EIO; -+ } else { - data->rbuffer->buffer = (char *)seq; /* XXX hack! */ - entry->c.text.read(entry, data->rbuffer); - } -diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c -index e07807d96b68..3670086b9227 100644 ---- a/sound/soc/codecs/cs4270.c -+++ b/sound/soc/codecs/cs4270.c -@@ -148,11 +148,11 @@ SND_SOC_DAPM_OUTPUT("AOUTR"), - }; - - static const struct snd_soc_dapm_route cs4270_dapm_routes[] = { -- { "Capture", NULL, "AINA" }, -- { "Capture", NULL, "AINB" }, -+ { "Capture", NULL, "AINL" }, -+ { "Capture", NULL, "AINR" }, - -- { "AOUTA", NULL, "Playback" }, -- { "AOUTB", NULL, "Playback" }, -+ { "AOUTL", NULL, "Playback" }, -+ { "AOUTR", NULL, "Playback" }, - }; - - /** -diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c -index 1bb896d78d09..1a4999f9d56f 100644 ---- a/sound/soc/sunxi/sun4i-codec.c -+++ b/sound/soc/sunxi/sun4i-codec.c -@@ -575,11 +575,11 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev) - - card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL); - if (!card) -- return NULL; -+ return ERR_PTR(-ENOMEM); - - card->dai_link = sun4i_codec_create_link(dev, &card->num_links); - if (!card->dai_link) -- return NULL; -+ return ERR_PTR(-ENOMEM); - - card->dev = dev; - card->name = "sun4i-codec"; -@@ -661,7 +661,8 @@ static int sun4i_codec_probe(struct platform_device *pdev) - } - - card = sun4i_codec_create_card(&pdev->dev); -- if (!card) { -+ if (IS_ERR(card)) { -+ ret = PTR_ERR(card); - dev_err(&pdev->dev, "Failed to create our card\n"); - goto err_unregister_codec; - } diff --git a/patch/kernel/mvebu-default/patch-4.4.33-34.patch b/patch/kernel/mvebu-default/patch-4.4.33-34.patch deleted file mode 100644 index 5f52fbe10..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.33-34.patch +++ /dev/null @@ -1,4509 +0,0 @@ -diff --git a/Makefile b/Makefile -index a513c045c8de..30924aabf1b4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 33 -+SUBLEVEL = 34 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h -index 70067ce184b1..f7de0dbc38af 100644 ---- a/arch/sparc/include/asm/mmu_64.h -+++ b/arch/sparc/include/asm/mmu_64.h -@@ -92,7 +92,8 @@ struct tsb_config { - typedef struct { - spinlock_t lock; - unsigned long sparc64_ctx_val; -- unsigned long huge_pte_count; -+ unsigned long hugetlb_pte_count; -+ unsigned long thp_pte_count; - struct tsb_config tsb_block[MM_NUM_TSBS]; - struct hv_tsb_descr tsb_descr[MM_NUM_TSBS]; - } mm_context_t; -diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h -index ea6e9a20f3ff..f428512481f9 100644 ---- a/arch/sparc/include/asm/uaccess_64.h -+++ b/arch/sparc/include/asm/uaccess_64.h -@@ -98,7 +98,6 @@ struct exception_table_entry { - unsigned int insn, fixup; - }; - --void __ret_efault(void); - void __retl_efault(void); - - /* Uh, these should become the main single-value transfer routines.. -@@ -179,20 +178,6 @@ int __put_user_bad(void); - __gu_ret; \ - }) - --#define __get_user_nocheck_ret(data, addr, size, type, retval) ({ \ -- register unsigned long __gu_val __asm__ ("l1"); \ -- switch (size) { \ -- case 1: __get_user_asm_ret(__gu_val, ub, addr, retval); break; \ -- case 2: __get_user_asm_ret(__gu_val, uh, addr, retval); break; \ -- case 4: __get_user_asm_ret(__gu_val, uw, addr, retval); break; \ -- case 8: __get_user_asm_ret(__gu_val, x, addr, retval); break; \ -- default: \ -- if (__get_user_bad()) \ -- return retval; \ -- } \ -- data = (__force type) __gu_val; \ --}) -- - #define __get_user_asm(x, size, addr, ret) \ - __asm__ __volatile__( \ - "/* Get user asm, inline. */\n" \ -@@ -214,80 +199,35 @@ __asm__ __volatile__( \ - : "=r" (ret), "=r" (x) : "r" (__m(addr)), \ - "i" (-EFAULT)) - --#define __get_user_asm_ret(x, size, addr, retval) \ --if (__builtin_constant_p(retval) && retval == -EFAULT) \ -- __asm__ __volatile__( \ -- "/* Get user asm ret, inline. */\n" \ -- "1:\t" "ld"#size "a [%1] %%asi, %0\n\n\t" \ -- ".section __ex_table,\"a\"\n\t" \ -- ".align 4\n\t" \ -- ".word 1b,__ret_efault\n\n\t" \ -- ".previous\n\t" \ -- : "=r" (x) : "r" (__m(addr))); \ --else \ -- __asm__ __volatile__( \ -- "/* Get user asm ret, inline. */\n" \ -- "1:\t" "ld"#size "a [%1] %%asi, %0\n\n\t" \ -- ".section .fixup,#alloc,#execinstr\n\t" \ -- ".align 4\n" \ -- "3:\n\t" \ -- "ret\n\t" \ -- " restore %%g0, %2, %%o0\n\n\t" \ -- ".previous\n\t" \ -- ".section __ex_table,\"a\"\n\t" \ -- ".align 4\n\t" \ -- ".word 1b, 3b\n\n\t" \ -- ".previous\n\t" \ -- : "=r" (x) : "r" (__m(addr)), "i" (retval)) -- - int __get_user_bad(void); - - unsigned long __must_check ___copy_from_user(void *to, - const void __user *from, - unsigned long size); --unsigned long copy_from_user_fixup(void *to, const void __user *from, -- unsigned long size); - static inline unsigned long __must_check - copy_from_user(void *to, const void __user *from, unsigned long size) - { -- unsigned long ret = ___copy_from_user(to, from, size); -- -- if (unlikely(ret)) -- ret = copy_from_user_fixup(to, from, size); -- -- return ret; -+ return ___copy_from_user(to, from, size); - } - #define __copy_from_user copy_from_user - - unsigned long __must_check ___copy_to_user(void __user *to, - const void *from, - unsigned long size); --unsigned long copy_to_user_fixup(void __user *to, const void *from, -- unsigned long size); - static inline unsigned long __must_check - copy_to_user(void __user *to, const void *from, unsigned long size) - { -- unsigned long ret = ___copy_to_user(to, from, size); -- -- if (unlikely(ret)) -- ret = copy_to_user_fixup(to, from, size); -- return ret; -+ return ___copy_to_user(to, from, size); - } - #define __copy_to_user copy_to_user - - unsigned long __must_check ___copy_in_user(void __user *to, - const void __user *from, - unsigned long size); --unsigned long copy_in_user_fixup(void __user *to, void __user *from, -- unsigned long size); - static inline unsigned long __must_check - copy_in_user(void __user *to, void __user *from, unsigned long size) - { -- unsigned long ret = ___copy_in_user(to, from, size); -- -- if (unlikely(ret)) -- ret = copy_in_user_fixup(to, from, size); -- return ret; -+ return ___copy_in_user(to, from, size); - } - #define __copy_in_user copy_in_user - -diff --git a/arch/sparc/kernel/dtlb_prot.S b/arch/sparc/kernel/dtlb_prot.S -index d668ca149e64..4087a62f96b0 100644 ---- a/arch/sparc/kernel/dtlb_prot.S -+++ b/arch/sparc/kernel/dtlb_prot.S -@@ -25,13 +25,13 @@ - - /* PROT ** ICACHE line 2: More real fault processing */ - ldxa [%g4] ASI_DMMU, %g5 ! Put tagaccess in %g5 -+ srlx %g5, PAGE_SHIFT, %g5 -+ sllx %g5, PAGE_SHIFT, %g5 ! Clear context ID bits - bgu,pn %xcc, winfix_trampoline ! Yes, perform winfixup - mov FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4 - ba,pt %xcc, sparc64_realfault_common ! Nope, normal fault - nop - nop -- nop -- nop - - /* PROT ** ICACHE line 3: Unused... */ - nop -diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S -index 51faf92ace00..7eeeb1d5a410 100644 ---- a/arch/sparc/kernel/head_64.S -+++ b/arch/sparc/kernel/head_64.S -@@ -922,47 +922,11 @@ prom_tba: .xword 0 - tlb_type: .word 0 /* Must NOT end up in BSS */ - .section ".fixup",#alloc,#execinstr - -- .globl __ret_efault, __retl_efault, __ret_one, __retl_one --ENTRY(__ret_efault) -- ret -- restore %g0, -EFAULT, %o0 --ENDPROC(__ret_efault) -- - ENTRY(__retl_efault) - retl - mov -EFAULT, %o0 - ENDPROC(__retl_efault) - --ENTRY(__retl_one) -- retl -- mov 1, %o0 --ENDPROC(__retl_one) -- --ENTRY(__retl_one_fp) -- VISExitHalf -- retl -- mov 1, %o0 --ENDPROC(__retl_one_fp) -- --ENTRY(__ret_one_asi) -- wr %g0, ASI_AIUS, %asi -- ret -- restore %g0, 1, %o0 --ENDPROC(__ret_one_asi) -- --ENTRY(__retl_one_asi) -- wr %g0, ASI_AIUS, %asi -- retl -- mov 1, %o0 --ENDPROC(__retl_one_asi) -- --ENTRY(__retl_one_asi_fp) -- wr %g0, ASI_AIUS, %asi -- VISExitHalf -- retl -- mov 1, %o0 --ENDPROC(__retl_one_asi_fp) -- - ENTRY(__retl_o1) - retl - mov %o1, %o0 -diff --git a/arch/sparc/kernel/jump_label.c b/arch/sparc/kernel/jump_label.c -index 59bbeff55024..07933b9e9ce0 100644 ---- a/arch/sparc/kernel/jump_label.c -+++ b/arch/sparc/kernel/jump_label.c -@@ -13,19 +13,30 @@ - void arch_jump_label_transform(struct jump_entry *entry, - enum jump_label_type type) - { -- u32 val; - u32 *insn = (u32 *) (unsigned long) entry->code; -+ u32 val; - - if (type == JUMP_LABEL_JMP) { - s32 off = (s32)entry->target - (s32)entry->code; -+ bool use_v9_branch = false; -+ -+ BUG_ON(off & 3); - - #ifdef CONFIG_SPARC64 -- /* ba,pt %xcc, . + (off << 2) */ -- val = 0x10680000 | ((u32) off >> 2); --#else -- /* ba . + (off << 2) */ -- val = 0x10800000 | ((u32) off >> 2); -+ if (off <= 0xfffff && off >= -0x100000) -+ use_v9_branch = true; - #endif -+ if (use_v9_branch) { -+ /* WDISP19 - target is . + immed << 2 */ -+ /* ba,pt %xcc, . + off */ -+ val = 0x10680000 | (((u32) off >> 2) & 0x7ffff); -+ } else { -+ /* WDISP22 - target is . + immed << 2 */ -+ BUG_ON(off > 0x7fffff); -+ BUG_ON(off < -0x800000); -+ /* ba . + off */ -+ val = 0x10800000 | (((u32) off >> 2) & 0x3fffff); -+ } - } else { - val = 0x01000000; - } -diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S -index ef0d8e9e1210..f22bec0db645 100644 ---- a/arch/sparc/kernel/ktlb.S -+++ b/arch/sparc/kernel/ktlb.S -@@ -20,6 +20,10 @@ kvmap_itlb: - mov TLB_TAG_ACCESS, %g4 - ldxa [%g4] ASI_IMMU, %g4 - -+ /* The kernel executes in context zero, therefore we do not -+ * need to clear the context ID bits out of %g4 here. -+ */ -+ - /* sun4v_itlb_miss branches here with the missing virtual - * address already loaded into %g4 - */ -@@ -128,6 +132,10 @@ kvmap_dtlb: - mov TLB_TAG_ACCESS, %g4 - ldxa [%g4] ASI_DMMU, %g4 - -+ /* The kernel executes in context zero, therefore we do not -+ * need to clear the context ID bits out of %g4 here. -+ */ -+ - /* sun4v_dtlb_miss branches here with the missing virtual - * address already loaded into %g4 - */ -@@ -251,6 +259,10 @@ kvmap_dtlb_longpath: - nop - .previous - -+ /* The kernel executes in context zero, therefore we do not -+ * need to clear the context ID bits out of %g5 here. -+ */ -+ - be,pt %xcc, sparc64_realfault_common - mov FAULT_CODE_DTLB, %g4 - ba,pt %xcc, winfix_trampoline -diff --git a/arch/sparc/kernel/sparc_ksyms_64.c b/arch/sparc/kernel/sparc_ksyms_64.c -index a92d5d2c46a3..51b25325a961 100644 ---- a/arch/sparc/kernel/sparc_ksyms_64.c -+++ b/arch/sparc/kernel/sparc_ksyms_64.c -@@ -27,7 +27,6 @@ EXPORT_SYMBOL(__flushw_user); - EXPORT_SYMBOL_GPL(real_hard_smp_processor_id); - - /* from head_64.S */ --EXPORT_SYMBOL(__ret_efault); - EXPORT_SYMBOL(tlb_type); - EXPORT_SYMBOL(sun4v_chip_type); - EXPORT_SYMBOL(prom_root_node); -diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S -index be98685c14c6..d568c8207af7 100644 ---- a/arch/sparc/kernel/tsb.S -+++ b/arch/sparc/kernel/tsb.S -@@ -29,13 +29,17 @@ - */ - tsb_miss_dtlb: - mov TLB_TAG_ACCESS, %g4 -+ ldxa [%g4] ASI_DMMU, %g4 -+ srlx %g4, PAGE_SHIFT, %g4 - ba,pt %xcc, tsb_miss_page_table_walk -- ldxa [%g4] ASI_DMMU, %g4 -+ sllx %g4, PAGE_SHIFT, %g4 - - tsb_miss_itlb: - mov TLB_TAG_ACCESS, %g4 -+ ldxa [%g4] ASI_IMMU, %g4 -+ srlx %g4, PAGE_SHIFT, %g4 - ba,pt %xcc, tsb_miss_page_table_walk -- ldxa [%g4] ASI_IMMU, %g4 -+ sllx %g4, PAGE_SHIFT, %g4 - - /* At this point we have: - * %g1 -- PAGE_SIZE TSB entry address -@@ -284,6 +288,10 @@ tsb_do_dtlb_fault: - nop - .previous - -+ /* Clear context ID bits. */ -+ srlx %g5, PAGE_SHIFT, %g5 -+ sllx %g5, PAGE_SHIFT, %g5 -+ - be,pt %xcc, sparc64_realfault_common - mov FAULT_CODE_DTLB, %g4 - ba,pt %xcc, winfix_trampoline -diff --git a/arch/sparc/lib/GENcopy_from_user.S b/arch/sparc/lib/GENcopy_from_user.S -index b7d0bd6b1406..69a439fa2fc1 100644 ---- a/arch/sparc/lib/GENcopy_from_user.S -+++ b/arch/sparc/lib/GENcopy_from_user.S -@@ -3,11 +3,11 @@ - * Copyright (C) 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_LD(x) \ -+#define EX_LD(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/GENcopy_to_user.S b/arch/sparc/lib/GENcopy_to_user.S -index 780550e1afc7..9947427ce354 100644 ---- a/arch/sparc/lib/GENcopy_to_user.S -+++ b/arch/sparc/lib/GENcopy_to_user.S -@@ -3,11 +3,11 @@ - * Copyright (C) 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/GENmemcpy.S b/arch/sparc/lib/GENmemcpy.S -index 89358ee94851..059ea24ad73d 100644 ---- a/arch/sparc/lib/GENmemcpy.S -+++ b/arch/sparc/lib/GENmemcpy.S -@@ -4,21 +4,18 @@ - */ - - #ifdef __KERNEL__ -+#include - #define GLOBAL_SPARE %g7 - #else - #define GLOBAL_SPARE %g5 - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x --#endif -- --#ifndef EX_RETVAL --#define EX_RETVAL(x) x -+#define EX_ST(x,y) x - #endif - - #ifndef LOAD -@@ -45,6 +42,29 @@ - .register %g3,#scratch - - .text -+ -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+ENTRY(GEN_retl_o4_1) -+ add %o4, %o2, %o4 -+ retl -+ add %o4, 1, %o0 -+ENDPROC(GEN_retl_o4_1) -+ENTRY(GEN_retl_g1_8) -+ add %g1, %o2, %g1 -+ retl -+ add %g1, 8, %o0 -+ENDPROC(GEN_retl_g1_8) -+ENTRY(GEN_retl_o2_4) -+ retl -+ add %o2, 4, %o0 -+ENDPROC(GEN_retl_o2_4) -+ENTRY(GEN_retl_o2_1) -+ retl -+ add %o2, 1, %o0 -+ENDPROC(GEN_retl_o2_1) -+#endif -+ - .align 64 - - .globl FUNC_NAME -@@ -73,8 +93,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %g0, %o4, %o4 - sub %o2, %o4, %o2 - 1: subcc %o4, 1, %o4 -- EX_LD(LOAD(ldub, %o1, %g1)) -- EX_ST(STORE(stb, %g1, %o0)) -+ EX_LD(LOAD(ldub, %o1, %g1),GEN_retl_o4_1) -+ EX_ST(STORE(stb, %g1, %o0),GEN_retl_o4_1) - add %o1, 1, %o1 - bne,pt %XCC, 1b - add %o0, 1, %o0 -@@ -82,8 +102,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andn %o2, 0x7, %g1 - sub %o2, %g1, %o2 - 1: subcc %g1, 0x8, %g1 -- EX_LD(LOAD(ldx, %o1, %g2)) -- EX_ST(STORE(stx, %g2, %o0)) -+ EX_LD(LOAD(ldx, %o1, %g2),GEN_retl_g1_8) -+ EX_ST(STORE(stx, %g2, %o0),GEN_retl_g1_8) - add %o1, 0x8, %o1 - bne,pt %XCC, 1b - add %o0, 0x8, %o0 -@@ -100,8 +120,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 1: - subcc %o2, 4, %o2 -- EX_LD(LOAD(lduw, %o1, %g1)) -- EX_ST(STORE(stw, %g1, %o1 + %o3)) -+ EX_LD(LOAD(lduw, %o1, %g1),GEN_retl_o2_4) -+ EX_ST(STORE(stw, %g1, %o1 + %o3),GEN_retl_o2_4) - bgu,pt %XCC, 1b - add %o1, 4, %o1 - -@@ -111,8 +131,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - .align 32 - 90: - subcc %o2, 1, %o2 -- EX_LD(LOAD(ldub, %o1, %g1)) -- EX_ST(STORE(stb, %g1, %o1 + %o3)) -+ EX_LD(LOAD(ldub, %o1, %g1),GEN_retl_o2_1) -+ EX_ST(STORE(stb, %g1, %o1 + %o3),GEN_retl_o2_1) - bgu,pt %XCC, 90b - add %o1, 1, %o1 - retl -diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile -index 3269b0234093..4f2384a4286a 100644 ---- a/arch/sparc/lib/Makefile -+++ b/arch/sparc/lib/Makefile -@@ -38,7 +38,7 @@ lib-$(CONFIG_SPARC64) += NG4patch.o NG4copy_page.o NG4clear_page.o NG4memset.o - lib-$(CONFIG_SPARC64) += GENmemcpy.o GENcopy_from_user.o GENcopy_to_user.o - lib-$(CONFIG_SPARC64) += GENpatch.o GENpage.o GENbzero.o - --lib-$(CONFIG_SPARC64) += copy_in_user.o user_fixup.o memmove.o -+lib-$(CONFIG_SPARC64) += copy_in_user.o memmove.o - lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o - - obj-$(CONFIG_SPARC64) += iomap.o -diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S -index d5242b8c4f94..b79a6998d87c 100644 ---- a/arch/sparc/lib/NG2copy_from_user.S -+++ b/arch/sparc/lib/NG2copy_from_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_LD(x) \ -+#define EX_LD(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_LD_FP(x) \ -+#define EX_LD_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S -index 4e962d993b10..dcec55f254ab 100644 ---- a/arch/sparc/lib/NG2copy_to_user.S -+++ b/arch/sparc/lib/NG2copy_to_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_ST_FP(x) \ -+#define EX_ST_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S -index d5f585df2f3f..c629dbd121b6 100644 ---- a/arch/sparc/lib/NG2memcpy.S -+++ b/arch/sparc/lib/NG2memcpy.S -@@ -4,6 +4,7 @@ - */ - - #ifdef __KERNEL__ -+#include - #include - #include - #define GLOBAL_SPARE %g7 -@@ -32,21 +33,17 @@ - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - #ifndef EX_LD_FP --#define EX_LD_FP(x) x -+#define EX_LD_FP(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x -+#define EX_ST(x,y) x - #endif - #ifndef EX_ST_FP --#define EX_ST_FP(x) x --#endif -- --#ifndef EX_RETVAL --#define EX_RETVAL(x) x -+#define EX_ST_FP(x,y) x - #endif - - #ifndef LOAD -@@ -140,45 +137,110 @@ - fsrc2 %x6, %f12; \ - fsrc2 %x7, %f14; - #define FREG_LOAD_1(base, x0) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)) -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1) - #define FREG_LOAD_2(base, x0, x1) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); - #define FREG_LOAD_3(base, x0, x1, x2) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \ -- EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); - #define FREG_LOAD_4(base, x0, x1, x2, x3) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \ -- EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \ -- EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); - #define FREG_LOAD_5(base, x0, x1, x2, x3, x4) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \ -- EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \ -- EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \ -- EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1); - #define FREG_LOAD_6(base, x0, x1, x2, x3, x4, x5) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \ -- EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \ -- EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \ -- EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \ -- EX_LD_FP(LOAD(ldd, base + 0x28, %x5)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x28, %x5), NG2_retl_o2_plus_g1); - #define FREG_LOAD_7(base, x0, x1, x2, x3, x4, x5, x6) \ -- EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \ -- EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \ -- EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \ -- EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \ -- EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \ -- EX_LD_FP(LOAD(ldd, base + 0x28, %x5)); \ -- EX_LD_FP(LOAD(ldd, base + 0x30, %x6)); -+ EX_LD_FP(LOAD(ldd, base + 0x00, %x0), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x08, %x1), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x10, %x2), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x18, %x3), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x20, %x4), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x28, %x5), NG2_retl_o2_plus_g1); \ -+ EX_LD_FP(LOAD(ldd, base + 0x30, %x6), NG2_retl_o2_plus_g1); - - .register %g2,#scratch - .register %g3,#scratch - - .text -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+__restore_fp: -+ VISExitHalf -+__restore_asi: -+ retl -+ wr %g0, ASI_AIUS, %asi -+ENTRY(NG2_retl_o2) -+ ba,pt %xcc, __restore_asi -+ mov %o2, %o0 -+ENDPROC(NG2_retl_o2) -+ENTRY(NG2_retl_o2_plus_1) -+ ba,pt %xcc, __restore_asi -+ add %o2, 1, %o0 -+ENDPROC(NG2_retl_o2_plus_1) -+ENTRY(NG2_retl_o2_plus_4) -+ ba,pt %xcc, __restore_asi -+ add %o2, 4, %o0 -+ENDPROC(NG2_retl_o2_plus_4) -+ENTRY(NG2_retl_o2_plus_8) -+ ba,pt %xcc, __restore_asi -+ add %o2, 8, %o0 -+ENDPROC(NG2_retl_o2_plus_8) -+ENTRY(NG2_retl_o2_plus_o4_plus_1) -+ add %o4, 1, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG2_retl_o2_plus_o4_plus_1) -+ENTRY(NG2_retl_o2_plus_o4_plus_8) -+ add %o4, 8, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG2_retl_o2_plus_o4_plus_8) -+ENTRY(NG2_retl_o2_plus_o4_plus_16) -+ add %o4, 16, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG2_retl_o2_plus_o4_plus_16) -+ENTRY(NG2_retl_o2_plus_g1_fp) -+ ba,pt %xcc, __restore_fp -+ add %o2, %g1, %o0 -+ENDPROC(NG2_retl_o2_plus_g1_fp) -+ENTRY(NG2_retl_o2_plus_g1_plus_64_fp) -+ add %g1, 64, %g1 -+ ba,pt %xcc, __restore_fp -+ add %o2, %g1, %o0 -+ENDPROC(NG2_retl_o2_plus_g1_plus_64_fp) -+ENTRY(NG2_retl_o2_plus_g1_plus_1) -+ add %g1, 1, %g1 -+ ba,pt %xcc, __restore_asi -+ add %o2, %g1, %o0 -+ENDPROC(NG2_retl_o2_plus_g1_plus_1) -+ENTRY(NG2_retl_o2_and_7_plus_o4) -+ and %o2, 7, %o2 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG2_retl_o2_and_7_plus_o4) -+ENTRY(NG2_retl_o2_and_7_plus_o4_plus_8) -+ and %o2, 7, %o2 -+ add %o4, 8, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG2_retl_o2_and_7_plus_o4_plus_8) -+#endif -+ - .align 64 - - .globl FUNC_NAME -@@ -230,8 +292,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %g0, %o4, %o4 ! bytes to align dst - sub %o2, %o4, %o2 - 1: subcc %o4, 1, %o4 -- EX_LD(LOAD(ldub, %o1, %g1)) -- EX_ST(STORE(stb, %g1, %o0)) -+ EX_LD(LOAD(ldub, %o1, %g1), NG2_retl_o2_plus_o4_plus_1) -+ EX_ST(STORE(stb, %g1, %o0), NG2_retl_o2_plus_o4_plus_1) - add %o1, 1, %o1 - bne,pt %XCC, 1b - add %o0, 1, %o0 -@@ -281,11 +343,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - nop - /* fall through for 0 < low bits < 8 */ - 110: sub %o4, 64, %g2 -- EX_LD_FP(LOAD_BLK(%g2, %f0)) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+ EX_LD_FP(LOAD_BLK(%g2, %f0), NG2_retl_o2_plus_g1) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f14, f16) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_8(f16, f18, f20, f22, f24, f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -296,10 +358,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 120: sub %o4, 56, %g2 - FREG_LOAD_7(%g2, f0, f2, f4, f6, f8, f10, f12) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f16, f18) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_7(f18, f20, f22, f24, f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -310,10 +372,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 130: sub %o4, 48, %g2 - FREG_LOAD_6(%g2, f0, f2, f4, f6, f8, f10) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f6, f8, f10, f16, f18, f20) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_6(f20, f22, f24, f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -324,10 +386,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 140: sub %o4, 40, %g2 - FREG_LOAD_5(%g2, f0, f2, f4, f6, f8) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f6, f8, f16, f18, f20, f22) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_5(f22, f24, f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -338,10 +400,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 150: sub %o4, 32, %g2 - FREG_LOAD_4(%g2, f0, f2, f4, f6) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f6, f16, f18, f20, f22, f24) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_4(f24, f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -352,10 +414,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 160: sub %o4, 24, %g2 - FREG_LOAD_3(%g2, f0, f2, f4) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f4, f16, f18, f20, f22, f24, f26) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_3(f26, f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -366,10 +428,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 170: sub %o4, 16, %g2 - FREG_LOAD_2(%g2, f0, f2) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f2, f16, f18, f20, f22, f24, f26, f28) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_2(f28, f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -380,10 +442,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 180: sub %o4, 8, %g2 - FREG_LOAD_1(%g2, f0) --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -- EX_LD_FP(LOAD_BLK(%o4, %f16)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) -+ EX_LD_FP(LOAD_BLK(%o4, %f16), NG2_retl_o2_plus_g1) - FREG_FROB(f0, f16, f18, f20, f22, f24, f26, f28, f30) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1) - FREG_MOVE_1(f30) - subcc %g1, 64, %g1 - add %o4, 64, %o4 -@@ -393,10 +455,10 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - nop - - 190: --1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3)) -+1: EX_ST_FP(STORE_INIT(%g0, %o4 + %g3), NG2_retl_o2_plus_g1) - subcc %g1, 64, %g1 -- EX_LD_FP(LOAD_BLK(%o4, %f0)) -- EX_ST_FP(STORE_BLK(%f0, %o4 + %g3)) -+ EX_LD_FP(LOAD_BLK(%o4, %f0), NG2_retl_o2_plus_g1_plus_64) -+ EX_ST_FP(STORE_BLK(%f0, %o4 + %g3), NG2_retl_o2_plus_g1_plus_64) - add %o4, 64, %o4 - bne,pt %xcc, 1b - LOAD(prefetch, %o4 + 64, #one_read) -@@ -423,28 +485,28 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andn %o2, 0xf, %o4 - and %o2, 0xf, %o2 - 1: subcc %o4, 0x10, %o4 -- EX_LD(LOAD(ldx, %o1, %o5)) -+ EX_LD(LOAD(ldx, %o1, %o5), NG2_retl_o2_plus_o4_plus_16) - add %o1, 0x08, %o1 -- EX_LD(LOAD(ldx, %o1, %g1)) -+ EX_LD(LOAD(ldx, %o1, %g1), NG2_retl_o2_plus_o4_plus_16) - sub %o1, 0x08, %o1 -- EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE)) -+ EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_o4_plus_16) - add %o1, 0x8, %o1 -- EX_ST(STORE(stx, %g1, %o1 + GLOBAL_SPARE)) -+ EX_ST(STORE(stx, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_o4_plus_8) - bgu,pt %XCC, 1b - add %o1, 0x8, %o1 - 73: andcc %o2, 0x8, %g0 - be,pt %XCC, 1f - nop - sub %o2, 0x8, %o2 -- EX_LD(LOAD(ldx, %o1, %o5)) -- EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE)) -+ EX_LD(LOAD(ldx, %o1, %o5), NG2_retl_o2_plus_8) -+ EX_ST(STORE(stx, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_8) - add %o1, 0x8, %o1 - 1: andcc %o2, 0x4, %g0 - be,pt %XCC, 1f - nop - sub %o2, 0x4, %o2 -- EX_LD(LOAD(lduw, %o1, %o5)) -- EX_ST(STORE(stw, %o5, %o1 + GLOBAL_SPARE)) -+ EX_LD(LOAD(lduw, %o1, %o5), NG2_retl_o2_plus_4) -+ EX_ST(STORE(stw, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_4) - add %o1, 0x4, %o1 - 1: cmp %o2, 0 - be,pt %XCC, 85f -@@ -460,8 +522,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %o2, %g1, %o2 - - 1: subcc %g1, 1, %g1 -- EX_LD(LOAD(ldub, %o1, %o5)) -- EX_ST(STORE(stb, %o5, %o1 + GLOBAL_SPARE)) -+ EX_LD(LOAD(ldub, %o1, %o5), NG2_retl_o2_plus_g1_plus_1) -+ EX_ST(STORE(stb, %o5, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_g1_plus_1) - bgu,pt %icc, 1b - add %o1, 1, %o1 - -@@ -477,16 +539,16 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 8: mov 64, GLOBAL_SPARE - andn %o1, 0x7, %o1 -- EX_LD(LOAD(ldx, %o1, %g2)) -+ EX_LD(LOAD(ldx, %o1, %g2), NG2_retl_o2) - sub GLOBAL_SPARE, %g1, GLOBAL_SPARE - andn %o2, 0x7, %o4 - sllx %g2, %g1, %g2 - 1: add %o1, 0x8, %o1 -- EX_LD(LOAD(ldx, %o1, %g3)) -+ EX_LD(LOAD(ldx, %o1, %g3), NG2_retl_o2_and_7_plus_o4) - subcc %o4, 0x8, %o4 - srlx %g3, GLOBAL_SPARE, %o5 - or %o5, %g2, %o5 -- EX_ST(STORE(stx, %o5, %o0)) -+ EX_ST(STORE(stx, %o5, %o0), NG2_retl_o2_and_7_plus_o4_plus_8) - add %o0, 0x8, %o0 - bgu,pt %icc, 1b - sllx %g3, %g1, %g2 -@@ -506,8 +568,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 1: - subcc %o2, 4, %o2 -- EX_LD(LOAD(lduw, %o1, %g1)) -- EX_ST(STORE(stw, %g1, %o1 + GLOBAL_SPARE)) -+ EX_LD(LOAD(lduw, %o1, %g1), NG2_retl_o2_plus_4) -+ EX_ST(STORE(stw, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_4) - bgu,pt %XCC, 1b - add %o1, 4, %o1 - -@@ -517,8 +579,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - .align 32 - 90: - subcc %o2, 1, %o2 -- EX_LD(LOAD(ldub, %o1, %g1)) -- EX_ST(STORE(stb, %g1, %o1 + GLOBAL_SPARE)) -+ EX_LD(LOAD(ldub, %o1, %g1), NG2_retl_o2_plus_1) -+ EX_ST(STORE(stb, %g1, %o1 + GLOBAL_SPARE), NG2_retl_o2_plus_1) - bgu,pt %XCC, 90b - add %o1, 1, %o1 - retl -diff --git a/arch/sparc/lib/NG4copy_from_user.S b/arch/sparc/lib/NG4copy_from_user.S -index 2e8ee7ad07a9..16a286c1a528 100644 ---- a/arch/sparc/lib/NG4copy_from_user.S -+++ b/arch/sparc/lib/NG4copy_from_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 2012 David S. Miller (davem@davemloft.net) - */ - --#define EX_LD(x) \ -+#define EX_LD(x, y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_LD_FP(x) \ -+#define EX_LD_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NG4copy_to_user.S b/arch/sparc/lib/NG4copy_to_user.S -index be0bf4590df8..6b0276ffc858 100644 ---- a/arch/sparc/lib/NG4copy_to_user.S -+++ b/arch/sparc/lib/NG4copy_to_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 2012 David S. Miller (davem@davemloft.net) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_ST_FP(x) \ -+#define EX_ST_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_asi_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S -index 8e13ee1f4454..75bb93b1437f 100644 ---- a/arch/sparc/lib/NG4memcpy.S -+++ b/arch/sparc/lib/NG4memcpy.S -@@ -4,6 +4,7 @@ - */ - - #ifdef __KERNEL__ -+#include - #include - #include - #define GLOBAL_SPARE %g7 -@@ -46,22 +47,19 @@ - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - #ifndef EX_LD_FP --#define EX_LD_FP(x) x -+#define EX_LD_FP(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x -+#define EX_ST(x,y) x - #endif - #ifndef EX_ST_FP --#define EX_ST_FP(x) x -+#define EX_ST_FP(x,y) x - #endif - --#ifndef EX_RETVAL --#define EX_RETVAL(x) x --#endif - - #ifndef LOAD - #define LOAD(type,addr,dest) type [addr], dest -@@ -94,6 +92,158 @@ - .register %g3,#scratch - - .text -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+__restore_asi_fp: -+ VISExitHalf -+__restore_asi: -+ retl -+ wr %g0, ASI_AIUS, %asi -+ -+ENTRY(NG4_retl_o2) -+ ba,pt %xcc, __restore_asi -+ mov %o2, %o0 -+ENDPROC(NG4_retl_o2) -+ENTRY(NG4_retl_o2_plus_1) -+ ba,pt %xcc, __restore_asi -+ add %o2, 1, %o0 -+ENDPROC(NG4_retl_o2_plus_1) -+ENTRY(NG4_retl_o2_plus_4) -+ ba,pt %xcc, __restore_asi -+ add %o2, 4, %o0 -+ENDPROC(NG4_retl_o2_plus_4) -+ENTRY(NG4_retl_o2_plus_o5) -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5) -+ENTRY(NG4_retl_o2_plus_o5_plus_4) -+ add %o5, 4, %o5 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5_plus_4) -+ENTRY(NG4_retl_o2_plus_o5_plus_8) -+ add %o5, 8, %o5 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5_plus_8) -+ENTRY(NG4_retl_o2_plus_o5_plus_16) -+ add %o5, 16, %o5 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5_plus_16) -+ENTRY(NG4_retl_o2_plus_o5_plus_24) -+ add %o5, 24, %o5 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5_plus_24) -+ENTRY(NG4_retl_o2_plus_o5_plus_32) -+ add %o5, 32, %o5 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o5, %o0 -+ENDPROC(NG4_retl_o2_plus_o5_plus_32) -+ENTRY(NG4_retl_o2_plus_g1) -+ ba,pt %xcc, __restore_asi -+ add %o2, %g1, %o0 -+ENDPROC(NG4_retl_o2_plus_g1) -+ENTRY(NG4_retl_o2_plus_g1_plus_1) -+ add %g1, 1, %g1 -+ ba,pt %xcc, __restore_asi -+ add %o2, %g1, %o0 -+ENDPROC(NG4_retl_o2_plus_g1_plus_1) -+ENTRY(NG4_retl_o2_plus_g1_plus_8) -+ add %g1, 8, %g1 -+ ba,pt %xcc, __restore_asi -+ add %o2, %g1, %o0 -+ENDPROC(NG4_retl_o2_plus_g1_plus_8) -+ENTRY(NG4_retl_o2_plus_o4) -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4) -+ENTRY(NG4_retl_o2_plus_o4_plus_8) -+ add %o4, 8, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_8) -+ENTRY(NG4_retl_o2_plus_o4_plus_16) -+ add %o4, 16, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_16) -+ENTRY(NG4_retl_o2_plus_o4_plus_24) -+ add %o4, 24, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_24) -+ENTRY(NG4_retl_o2_plus_o4_plus_32) -+ add %o4, 32, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_32) -+ENTRY(NG4_retl_o2_plus_o4_plus_40) -+ add %o4, 40, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_40) -+ENTRY(NG4_retl_o2_plus_o4_plus_48) -+ add %o4, 48, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_48) -+ENTRY(NG4_retl_o2_plus_o4_plus_56) -+ add %o4, 56, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_56) -+ENTRY(NG4_retl_o2_plus_o4_plus_64) -+ add %o4, 64, %o4 -+ ba,pt %xcc, __restore_asi -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_64) -+ENTRY(NG4_retl_o2_plus_o4_fp) -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_8_fp) -+ add %o4, 8, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_8_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_16_fp) -+ add %o4, 16, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_16_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_24_fp) -+ add %o4, 24, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_24_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_32_fp) -+ add %o4, 32, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_32_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_40_fp) -+ add %o4, 40, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_40_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_48_fp) -+ add %o4, 48, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_48_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_56_fp) -+ add %o4, 56, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_56_fp) -+ENTRY(NG4_retl_o2_plus_o4_plus_64_fp) -+ add %o4, 64, %o4 -+ ba,pt %xcc, __restore_asi_fp -+ add %o2, %o4, %o0 -+ENDPROC(NG4_retl_o2_plus_o4_plus_64_fp) -+#endif - .align 64 - - .globl FUNC_NAME -@@ -124,12 +274,13 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - brz,pt %g1, 51f - sub %o2, %g1, %o2 - --1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2)) -+ -+1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1) - add %o1, 1, %o1 - subcc %g1, 1, %g1 - add %o0, 1, %o0 - bne,pt %icc, 1b -- EX_ST(STORE(stb, %g2, %o0 - 0x01)) -+ EX_ST(STORE(stb, %g2, %o0 - 0x01), NG4_retl_o2_plus_g1_plus_1) - - 51: LOAD(prefetch, %o1 + 0x040, #n_reads_strong) - LOAD(prefetch, %o1 + 0x080, #n_reads_strong) -@@ -154,43 +305,43 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - brz,pt %g1, .Llarge_aligned - sub %o2, %g1, %o2 - --1: EX_LD(LOAD(ldx, %o1 + 0x00, %g2)) -+1: EX_LD(LOAD(ldx, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1) - add %o1, 8, %o1 - subcc %g1, 8, %g1 - add %o0, 8, %o0 - bne,pt %icc, 1b -- EX_ST(STORE(stx, %g2, %o0 - 0x08)) -+ EX_ST(STORE(stx, %g2, %o0 - 0x08), NG4_retl_o2_plus_g1_plus_8) - - .Llarge_aligned: - /* len >= 0x80 && src 8-byte aligned && dest 8-byte aligned */ - andn %o2, 0x3f, %o4 - sub %o2, %o4, %o2 - --1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1)) -+1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o4) - add %o1, 0x40, %o1 -- EX_LD(LOAD(ldx, %o1 - 0x38, %g2)) -+ EX_LD(LOAD(ldx, %o1 - 0x38, %g2), NG4_retl_o2_plus_o4) - subcc %o4, 0x40, %o4 -- EX_LD(LOAD(ldx, %o1 - 0x30, %g3)) -- EX_LD(LOAD(ldx, %o1 - 0x28, GLOBAL_SPARE)) -- EX_LD(LOAD(ldx, %o1 - 0x20, %o5)) -- EX_ST(STORE_INIT(%g1, %o0)) -+ EX_LD(LOAD(ldx, %o1 - 0x30, %g3), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD(LOAD(ldx, %o1 - 0x28, GLOBAL_SPARE), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD(LOAD(ldx, %o1 - 0x20, %o5), NG4_retl_o2_plus_o4_plus_64) -+ EX_ST(STORE_INIT(%g1, %o0), NG4_retl_o2_plus_o4_plus_64) - add %o0, 0x08, %o0 -- EX_ST(STORE_INIT(%g2, %o0)) -+ EX_ST(STORE_INIT(%g2, %o0), NG4_retl_o2_plus_o4_plus_56) - add %o0, 0x08, %o0 -- EX_LD(LOAD(ldx, %o1 - 0x18, %g2)) -- EX_ST(STORE_INIT(%g3, %o0)) -+ EX_LD(LOAD(ldx, %o1 - 0x18, %g2), NG4_retl_o2_plus_o4_plus_48) -+ EX_ST(STORE_INIT(%g3, %o0), NG4_retl_o2_plus_o4_plus_48) - add %o0, 0x08, %o0 -- EX_LD(LOAD(ldx, %o1 - 0x10, %g3)) -- EX_ST(STORE_INIT(GLOBAL_SPARE, %o0)) -+ EX_LD(LOAD(ldx, %o1 - 0x10, %g3), NG4_retl_o2_plus_o4_plus_40) -+ EX_ST(STORE_INIT(GLOBAL_SPARE, %o0), NG4_retl_o2_plus_o4_plus_40) - add %o0, 0x08, %o0 -- EX_LD(LOAD(ldx, %o1 - 0x08, GLOBAL_SPARE)) -- EX_ST(STORE_INIT(%o5, %o0)) -+ EX_LD(LOAD(ldx, %o1 - 0x08, GLOBAL_SPARE), NG4_retl_o2_plus_o4_plus_32) -+ EX_ST(STORE_INIT(%o5, %o0), NG4_retl_o2_plus_o4_plus_32) - add %o0, 0x08, %o0 -- EX_ST(STORE_INIT(%g2, %o0)) -+ EX_ST(STORE_INIT(%g2, %o0), NG4_retl_o2_plus_o4_plus_24) - add %o0, 0x08, %o0 -- EX_ST(STORE_INIT(%g3, %o0)) -+ EX_ST(STORE_INIT(%g3, %o0), NG4_retl_o2_plus_o4_plus_16) - add %o0, 0x08, %o0 -- EX_ST(STORE_INIT(GLOBAL_SPARE, %o0)) -+ EX_ST(STORE_INIT(GLOBAL_SPARE, %o0), NG4_retl_o2_plus_o4_plus_8) - add %o0, 0x08, %o0 - bne,pt %icc, 1b - LOAD(prefetch, %o1 + 0x200, #n_reads_strong) -@@ -216,17 +367,17 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %o2, %o4, %o2 - alignaddr %o1, %g0, %g1 - add %o1, %o4, %o1 -- EX_LD_FP(LOAD(ldd, %g1 + 0x00, %f0)) --1: EX_LD_FP(LOAD(ldd, %g1 + 0x08, %f2)) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x00, %f0), NG4_retl_o2_plus_o4) -+1: EX_LD_FP(LOAD(ldd, %g1 + 0x08, %f2), NG4_retl_o2_plus_o4) - subcc %o4, 0x40, %o4 -- EX_LD_FP(LOAD(ldd, %g1 + 0x10, %f4)) -- EX_LD_FP(LOAD(ldd, %g1 + 0x18, %f6)) -- EX_LD_FP(LOAD(ldd, %g1 + 0x20, %f8)) -- EX_LD_FP(LOAD(ldd, %g1 + 0x28, %f10)) -- EX_LD_FP(LOAD(ldd, %g1 + 0x30, %f12)) -- EX_LD_FP(LOAD(ldd, %g1 + 0x38, %f14)) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x10, %f4), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x18, %f6), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x20, %f8), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x28, %f10), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x30, %f12), NG4_retl_o2_plus_o4_plus_64) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x38, %f14), NG4_retl_o2_plus_o4_plus_64) - faligndata %f0, %f2, %f16 -- EX_LD_FP(LOAD(ldd, %g1 + 0x40, %f0)) -+ EX_LD_FP(LOAD(ldd, %g1 + 0x40, %f0), NG4_retl_o2_plus_o4_plus_64) - faligndata %f2, %f4, %f18 - add %g1, 0x40, %g1 - faligndata %f4, %f6, %f20 -@@ -235,14 +386,14 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - faligndata %f10, %f12, %f26 - faligndata %f12, %f14, %f28 - faligndata %f14, %f0, %f30 -- EX_ST_FP(STORE(std, %f16, %o0 + 0x00)) -- EX_ST_FP(STORE(std, %f18, %o0 + 0x08)) -- EX_ST_FP(STORE(std, %f20, %o0 + 0x10)) -- EX_ST_FP(STORE(std, %f22, %o0 + 0x18)) -- EX_ST_FP(STORE(std, %f24, %o0 + 0x20)) -- EX_ST_FP(STORE(std, %f26, %o0 + 0x28)) -- EX_ST_FP(STORE(std, %f28, %o0 + 0x30)) -- EX_ST_FP(STORE(std, %f30, %o0 + 0x38)) -+ EX_ST_FP(STORE(std, %f16, %o0 + 0x00), NG4_retl_o2_plus_o4_plus_64) -+ EX_ST_FP(STORE(std, %f18, %o0 + 0x08), NG4_retl_o2_plus_o4_plus_56) -+ EX_ST_FP(STORE(std, %f20, %o0 + 0x10), NG4_retl_o2_plus_o4_plus_48) -+ EX_ST_FP(STORE(std, %f22, %o0 + 0x18), NG4_retl_o2_plus_o4_plus_40) -+ EX_ST_FP(STORE(std, %f24, %o0 + 0x20), NG4_retl_o2_plus_o4_plus_32) -+ EX_ST_FP(STORE(std, %f26, %o0 + 0x28), NG4_retl_o2_plus_o4_plus_24) -+ EX_ST_FP(STORE(std, %f28, %o0 + 0x30), NG4_retl_o2_plus_o4_plus_16) -+ EX_ST_FP(STORE(std, %f30, %o0 + 0x38), NG4_retl_o2_plus_o4_plus_8) - add %o0, 0x40, %o0 - bne,pt %icc, 1b - LOAD(prefetch, %g1 + 0x200, #n_reads_strong) -@@ -270,37 +421,38 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andncc %o2, 0x20 - 1, %o5 - be,pn %icc, 2f - sub %o2, %o5, %o2 --1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1)) -- EX_LD(LOAD(ldx, %o1 + 0x08, %g2)) -- EX_LD(LOAD(ldx, %o1 + 0x10, GLOBAL_SPARE)) -- EX_LD(LOAD(ldx, %o1 + 0x18, %o4)) -+1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5) -+ EX_LD(LOAD(ldx, %o1 + 0x08, %g2), NG4_retl_o2_plus_o5) -+ EX_LD(LOAD(ldx, %o1 + 0x10, GLOBAL_SPARE), NG4_retl_o2_plus_o5) -+ EX_LD(LOAD(ldx, %o1 + 0x18, %o4), NG4_retl_o2_plus_o5) - add %o1, 0x20, %o1 - subcc %o5, 0x20, %o5 -- EX_ST(STORE(stx, %g1, %o0 + 0x00)) -- EX_ST(STORE(stx, %g2, %o0 + 0x08)) -- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10)) -- EX_ST(STORE(stx, %o4, %o0 + 0x18)) -+ EX_ST(STORE(stx, %g1, %o0 + 0x00), NG4_retl_o2_plus_o5_plus_32) -+ EX_ST(STORE(stx, %g2, %o0 + 0x08), NG4_retl_o2_plus_o5_plus_24) -+ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), NG4_retl_o2_plus_o5_plus_24) -+ EX_ST(STORE(stx, %o4, %o0 + 0x18), NG4_retl_o2_plus_o5_plus_8) - bne,pt %icc, 1b - add %o0, 0x20, %o0 - 2: andcc %o2, 0x18, %o5 - be,pt %icc, 3f - sub %o2, %o5, %o2 --1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1)) -+ -+1: EX_LD(LOAD(ldx, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5) - add %o1, 0x08, %o1 - add %o0, 0x08, %o0 - subcc %o5, 0x08, %o5 - bne,pt %icc, 1b -- EX_ST(STORE(stx, %g1, %o0 - 0x08)) -+ EX_ST(STORE(stx, %g1, %o0 - 0x08), NG4_retl_o2_plus_o5_plus_8) - 3: brz,pt %o2, .Lexit - cmp %o2, 0x04 - bl,pn %icc, .Ltiny - nop -- EX_LD(LOAD(lduw, %o1 + 0x00, %g1)) -+ EX_LD(LOAD(lduw, %o1 + 0x00, %g1), NG4_retl_o2) - add %o1, 0x04, %o1 - add %o0, 0x04, %o0 - subcc %o2, 0x04, %o2 - bne,pn %icc, .Ltiny -- EX_ST(STORE(stw, %g1, %o0 - 0x04)) -+ EX_ST(STORE(stw, %g1, %o0 - 0x04), NG4_retl_o2_plus_4) - ba,a,pt %icc, .Lexit - .Lmedium_unaligned: - /* First get dest 8 byte aligned. */ -@@ -309,12 +461,12 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - brz,pt %g1, 2f - sub %o2, %g1, %o2 - --1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2)) -+1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), NG4_retl_o2_plus_g1) - add %o1, 1, %o1 - subcc %g1, 1, %g1 - add %o0, 1, %o0 - bne,pt %icc, 1b -- EX_ST(STORE(stb, %g2, %o0 - 0x01)) -+ EX_ST(STORE(stb, %g2, %o0 - 0x01), NG4_retl_o2_plus_g1_plus_1) - 2: - and %o1, 0x7, %g1 - brz,pn %g1, .Lmedium_noprefetch -@@ -322,16 +474,16 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - mov 64, %g2 - sub %g2, %g1, %g2 - andn %o1, 0x7, %o1 -- EX_LD(LOAD(ldx, %o1 + 0x00, %o4)) -+ EX_LD(LOAD(ldx, %o1 + 0x00, %o4), NG4_retl_o2) - sllx %o4, %g1, %o4 - andn %o2, 0x08 - 1, %o5 - sub %o2, %o5, %o2 --1: EX_LD(LOAD(ldx, %o1 + 0x08, %g3)) -+1: EX_LD(LOAD(ldx, %o1 + 0x08, %g3), NG4_retl_o2_plus_o5) - add %o1, 0x08, %o1 - subcc %o5, 0x08, %o5 - srlx %g3, %g2, GLOBAL_SPARE - or GLOBAL_SPARE, %o4, GLOBAL_SPARE -- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x00)) -+ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x00), NG4_retl_o2_plus_o5_plus_8) - add %o0, 0x08, %o0 - bne,pt %icc, 1b - sllx %g3, %g1, %o4 -@@ -342,17 +494,17 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - ba,pt %icc, .Lsmall_unaligned - - .Ltiny: -- EX_LD(LOAD(ldub, %o1 + 0x00, %g1)) -+ EX_LD(LOAD(ldub, %o1 + 0x00, %g1), NG4_retl_o2) - subcc %o2, 1, %o2 - be,pn %icc, .Lexit -- EX_ST(STORE(stb, %g1, %o0 + 0x00)) -- EX_LD(LOAD(ldub, %o1 + 0x01, %g1)) -+ EX_ST(STORE(stb, %g1, %o0 + 0x00), NG4_retl_o2_plus_1) -+ EX_LD(LOAD(ldub, %o1 + 0x01, %g1), NG4_retl_o2) - subcc %o2, 1, %o2 - be,pn %icc, .Lexit -- EX_ST(STORE(stb, %g1, %o0 + 0x01)) -- EX_LD(LOAD(ldub, %o1 + 0x02, %g1)) -+ EX_ST(STORE(stb, %g1, %o0 + 0x01), NG4_retl_o2_plus_1) -+ EX_LD(LOAD(ldub, %o1 + 0x02, %g1), NG4_retl_o2) - ba,pt %icc, .Lexit -- EX_ST(STORE(stb, %g1, %o0 + 0x02)) -+ EX_ST(STORE(stb, %g1, %o0 + 0x02), NG4_retl_o2) - - .Lsmall: - andcc %g2, 0x3, %g0 -@@ -360,22 +512,22 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andn %o2, 0x4 - 1, %o5 - sub %o2, %o5, %o2 - 1: -- EX_LD(LOAD(lduw, %o1 + 0x00, %g1)) -+ EX_LD(LOAD(lduw, %o1 + 0x00, %g1), NG4_retl_o2_plus_o5) - add %o1, 0x04, %o1 - subcc %o5, 0x04, %o5 - add %o0, 0x04, %o0 - bne,pt %icc, 1b -- EX_ST(STORE(stw, %g1, %o0 - 0x04)) -+ EX_ST(STORE(stw, %g1, %o0 - 0x04), NG4_retl_o2_plus_o5_plus_4) - brz,pt %o2, .Lexit - nop - ba,a,pt %icc, .Ltiny - - .Lsmall_unaligned: --1: EX_LD(LOAD(ldub, %o1 + 0x00, %g1)) -+1: EX_LD(LOAD(ldub, %o1 + 0x00, %g1), NG4_retl_o2) - add %o1, 1, %o1 - add %o0, 1, %o0 - subcc %o2, 1, %o2 - bne,pt %icc, 1b -- EX_ST(STORE(stb, %g1, %o0 - 0x01)) -+ EX_ST(STORE(stb, %g1, %o0 - 0x01), NG4_retl_o2_plus_1) - ba,a,pt %icc, .Lexit - .size FUNC_NAME, .-FUNC_NAME -diff --git a/arch/sparc/lib/NGcopy_from_user.S b/arch/sparc/lib/NGcopy_from_user.S -index 5d1e4d1ac21e..9cd42fcbc781 100644 ---- a/arch/sparc/lib/NGcopy_from_user.S -+++ b/arch/sparc/lib/NGcopy_from_user.S -@@ -3,11 +3,11 @@ - * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_LD(x) \ -+#define EX_LD(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __ret_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NGcopy_to_user.S b/arch/sparc/lib/NGcopy_to_user.S -index ff630dcb273c..5c358afd464e 100644 ---- a/arch/sparc/lib/NGcopy_to_user.S -+++ b/arch/sparc/lib/NGcopy_to_user.S -@@ -3,11 +3,11 @@ - * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __ret_one_asi;\ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S -index 96a14caf6966..d88c4ed50a00 100644 ---- a/arch/sparc/lib/NGmemcpy.S -+++ b/arch/sparc/lib/NGmemcpy.S -@@ -4,6 +4,7 @@ - */ - - #ifdef __KERNEL__ -+#include - #include - #include - #define GLOBAL_SPARE %g7 -@@ -27,15 +28,11 @@ - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x --#endif -- --#ifndef EX_RETVAL --#define EX_RETVAL(x) x -+#define EX_ST(x,y) x - #endif - - #ifndef LOAD -@@ -79,6 +76,92 @@ - .register %g3,#scratch - - .text -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+__restore_asi: -+ ret -+ wr %g0, ASI_AIUS, %asi -+ restore -+ENTRY(NG_ret_i2_plus_i4_plus_1) -+ ba,pt %xcc, __restore_asi -+ add %i2, %i5, %i0 -+ENDPROC(NG_ret_i2_plus_i4_plus_1) -+ENTRY(NG_ret_i2_plus_g1) -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1) -+ENTRY(NG_ret_i2_plus_g1_minus_8) -+ sub %g1, 8, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_8) -+ENTRY(NG_ret_i2_plus_g1_minus_16) -+ sub %g1, 16, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_16) -+ENTRY(NG_ret_i2_plus_g1_minus_24) -+ sub %g1, 24, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_24) -+ENTRY(NG_ret_i2_plus_g1_minus_32) -+ sub %g1, 32, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_32) -+ENTRY(NG_ret_i2_plus_g1_minus_40) -+ sub %g1, 40, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_40) -+ENTRY(NG_ret_i2_plus_g1_minus_48) -+ sub %g1, 48, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_48) -+ENTRY(NG_ret_i2_plus_g1_minus_56) -+ sub %g1, 56, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_minus_56) -+ENTRY(NG_ret_i2_plus_i4) -+ ba,pt %xcc, __restore_asi -+ add %i2, %i4, %i0 -+ENDPROC(NG_ret_i2_plus_i4) -+ENTRY(NG_ret_i2_plus_i4_minus_8) -+ sub %i4, 8, %i4 -+ ba,pt %xcc, __restore_asi -+ add %i2, %i4, %i0 -+ENDPROC(NG_ret_i2_plus_i4_minus_8) -+ENTRY(NG_ret_i2_plus_8) -+ ba,pt %xcc, __restore_asi -+ add %i2, 8, %i0 -+ENDPROC(NG_ret_i2_plus_8) -+ENTRY(NG_ret_i2_plus_4) -+ ba,pt %xcc, __restore_asi -+ add %i2, 4, %i0 -+ENDPROC(NG_ret_i2_plus_4) -+ENTRY(NG_ret_i2_plus_1) -+ ba,pt %xcc, __restore_asi -+ add %i2, 1, %i0 -+ENDPROC(NG_ret_i2_plus_1) -+ENTRY(NG_ret_i2_plus_g1_plus_1) -+ add %g1, 1, %g1 -+ ba,pt %xcc, __restore_asi -+ add %i2, %g1, %i0 -+ENDPROC(NG_ret_i2_plus_g1_plus_1) -+ENTRY(NG_ret_i2) -+ ba,pt %xcc, __restore_asi -+ mov %i2, %i0 -+ENDPROC(NG_ret_i2) -+ENTRY(NG_ret_i2_and_7_plus_i4) -+ and %i2, 7, %i2 -+ ba,pt %xcc, __restore_asi -+ add %i2, %i4, %i0 -+ENDPROC(NG_ret_i2_and_7_plus_i4) -+#endif -+ - .align 64 - - .globl FUNC_NAME -@@ -126,8 +209,8 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - sub %g0, %i4, %i4 ! bytes to align dst - sub %i2, %i4, %i2 - 1: subcc %i4, 1, %i4 -- EX_LD(LOAD(ldub, %i1, %g1)) -- EX_ST(STORE(stb, %g1, %o0)) -+ EX_LD(LOAD(ldub, %i1, %g1), NG_ret_i2_plus_i4_plus_1) -+ EX_ST(STORE(stb, %g1, %o0), NG_ret_i2_plus_i4_plus_1) - add %i1, 1, %i1 - bne,pt %XCC, 1b - add %o0, 1, %o0 -@@ -160,7 +243,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - and %i4, 0x7, GLOBAL_SPARE - sll GLOBAL_SPARE, 3, GLOBAL_SPARE - mov 64, %i5 -- EX_LD(LOAD_TWIN(%i1, %g2, %g3)) -+ EX_LD(LOAD_TWIN(%i1, %g2, %g3), NG_ret_i2_plus_g1) - sub %i5, GLOBAL_SPARE, %i5 - mov 16, %o4 - mov 32, %o5 -@@ -178,31 +261,31 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - srlx WORD3, PRE_SHIFT, TMP; \ - or WORD2, TMP, WORD2; - --8: EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3)) -+8: EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3), NG_ret_i2_plus_g1) - MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1) - LOAD(prefetch, %i1 + %i3, #one_read) - -- EX_ST(STORE_INIT(%g2, %o0 + 0x00)) -- EX_ST(STORE_INIT(%g3, %o0 + 0x08)) -+ EX_ST(STORE_INIT(%g2, %o0 + 0x00), NG_ret_i2_plus_g1) -+ EX_ST(STORE_INIT(%g3, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8) - -- EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3)) -+ EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3), NG_ret_i2_plus_g1_minus_16) - MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%o2, %o0 + 0x10)) -- EX_ST(STORE_INIT(%o3, %o0 + 0x18)) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24) - -- EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3)) -+ EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1_minus_32) - MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%g2, %o0 + 0x20)) -- EX_ST(STORE_INIT(%g3, %o0 + 0x28)) -+ EX_ST(STORE_INIT(%g2, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32) -+ EX_ST(STORE_INIT(%g3, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40) - -- EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3)) -+ EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3), NG_ret_i2_plus_g1_minus_48) - add %i1, 64, %i1 - MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%o2, %o0 + 0x30)) -- EX_ST(STORE_INIT(%o3, %o0 + 0x38)) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56) - - subcc %g1, 64, %g1 - bne,pt %XCC, 8b -@@ -211,31 +294,31 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - ba,pt %XCC, 60f - add %i1, %i4, %i1 - --9: EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3)) -+9: EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3), NG_ret_i2_plus_g1) - MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1) - LOAD(prefetch, %i1 + %i3, #one_read) - -- EX_ST(STORE_INIT(%g3, %o0 + 0x00)) -- EX_ST(STORE_INIT(%o2, %o0 + 0x08)) -+ EX_ST(STORE_INIT(%g3, %o0 + 0x00), NG_ret_i2_plus_g1) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8) - -- EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3)) -+ EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3), NG_ret_i2_plus_g1_minus_16) - MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%o3, %o0 + 0x10)) -- EX_ST(STORE_INIT(%g2, %o0 + 0x18)) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%g2, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24) - -- EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3)) -+ EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1_minus_32) - MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%g3, %o0 + 0x20)) -- EX_ST(STORE_INIT(%o2, %o0 + 0x28)) -+ EX_ST(STORE_INIT(%g3, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40) - -- EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3)) -+ EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3), NG_ret_i2_plus_g1_minus_48) - add %i1, 64, %i1 - MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1) - -- EX_ST(STORE_INIT(%o3, %o0 + 0x30)) -- EX_ST(STORE_INIT(%g2, %o0 + 0x38)) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48) -+ EX_ST(STORE_INIT(%g2, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56) - - subcc %g1, 64, %g1 - bne,pt %XCC, 9b -@@ -249,25 +332,25 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - * one twin load ahead, then add 8 back into source when - * we finish the loop. - */ -- EX_LD(LOAD_TWIN(%i1, %o4, %o5)) -+ EX_LD(LOAD_TWIN(%i1, %o4, %o5), NG_ret_i2_plus_g1) - mov 16, %o7 - mov 32, %g2 - mov 48, %g3 - mov 64, %o1 --1: EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3)) -+1: EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1) - LOAD(prefetch, %i1 + %o1, #one_read) -- EX_ST(STORE_INIT(%o5, %o0 + 0x00)) ! initializes cache line -- EX_ST(STORE_INIT(%o2, %o0 + 0x08)) -- EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5)) -- EX_ST(STORE_INIT(%o3, %o0 + 0x10)) -- EX_ST(STORE_INIT(%o4, %o0 + 0x18)) -- EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3)) -- EX_ST(STORE_INIT(%o5, %o0 + 0x20)) -- EX_ST(STORE_INIT(%o2, %o0 + 0x28)) -- EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5)) -+ EX_ST(STORE_INIT(%o5, %o0 + 0x00), NG_ret_i2_plus_g1) ! initializes cache line -+ EX_ST(STORE_INIT(%o2, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8) -+ EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%o4, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24) -+ EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3), NG_ret_i2_plus_g1_minus_32) -+ EX_ST(STORE_INIT(%o5, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40) -+ EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5), NG_ret_i2_plus_g1_minus_48) - add %i1, 64, %i1 -- EX_ST(STORE_INIT(%o3, %o0 + 0x30)) -- EX_ST(STORE_INIT(%o4, %o0 + 0x38)) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48) -+ EX_ST(STORE_INIT(%o4, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56) - subcc %g1, 64, %g1 - bne,pt %XCC, 1b - add %o0, 64, %o0 -@@ -282,20 +365,20 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - mov 32, %g2 - mov 48, %g3 - mov 64, %o1 --1: EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5)) -- EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3)) -+1: EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5), NG_ret_i2_plus_g1) -+ EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3), NG_ret_i2_plus_g1) - LOAD(prefetch, %i1 + %o1, #one_read) -- EX_ST(STORE_INIT(%o4, %o0 + 0x00)) ! initializes cache line -- EX_ST(STORE_INIT(%o5, %o0 + 0x08)) -- EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5)) -- EX_ST(STORE_INIT(%o2, %o0 + 0x10)) -- EX_ST(STORE_INIT(%o3, %o0 + 0x18)) -- EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3)) -+ EX_ST(STORE_INIT(%o4, %o0 + 0x00), NG_ret_i2_plus_g1) ! initializes cache line -+ EX_ST(STORE_INIT(%o5, %o0 + 0x08), NG_ret_i2_plus_g1_minus_8) -+ EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x10), NG_ret_i2_plus_g1_minus_16) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x18), NG_ret_i2_plus_g1_minus_24) -+ EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3), NG_ret_i2_plus_g1_minus_32) - add %i1, 64, %i1 -- EX_ST(STORE_INIT(%o4, %o0 + 0x20)) -- EX_ST(STORE_INIT(%o5, %o0 + 0x28)) -- EX_ST(STORE_INIT(%o2, %o0 + 0x30)) -- EX_ST(STORE_INIT(%o3, %o0 + 0x38)) -+ EX_ST(STORE_INIT(%o4, %o0 + 0x20), NG_ret_i2_plus_g1_minus_32) -+ EX_ST(STORE_INIT(%o5, %o0 + 0x28), NG_ret_i2_plus_g1_minus_40) -+ EX_ST(STORE_INIT(%o2, %o0 + 0x30), NG_ret_i2_plus_g1_minus_48) -+ EX_ST(STORE_INIT(%o3, %o0 + 0x38), NG_ret_i2_plus_g1_minus_56) - subcc %g1, 64, %g1 - bne,pt %XCC, 1b - add %o0, 64, %o0 -@@ -321,28 +404,28 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - andn %i2, 0xf, %i4 - and %i2, 0xf, %i2 - 1: subcc %i4, 0x10, %i4 -- EX_LD(LOAD(ldx, %i1, %o4)) -+ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4) - add %i1, 0x08, %i1 -- EX_LD(LOAD(ldx, %i1, %g1)) -+ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4) - sub %i1, 0x08, %i1 -- EX_ST(STORE(stx, %o4, %i1 + %i3)) -+ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4) - add %i1, 0x8, %i1 -- EX_ST(STORE(stx, %g1, %i1 + %i3)) -+ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8) - bgu,pt %XCC, 1b - add %i1, 0x8, %i1 - 73: andcc %i2, 0x8, %g0 - be,pt %XCC, 1f - nop - sub %i2, 0x8, %i2 -- EX_LD(LOAD(ldx, %i1, %o4)) -- EX_ST(STORE(stx, %o4, %i1 + %i3)) -+ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_8) -+ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_8) - add %i1, 0x8, %i1 - 1: andcc %i2, 0x4, %g0 - be,pt %XCC, 1f - nop - sub %i2, 0x4, %i2 -- EX_LD(LOAD(lduw, %i1, %i5)) -- EX_ST(STORE(stw, %i5, %i1 + %i3)) -+ EX_LD(LOAD(lduw, %i1, %i5), NG_ret_i2_plus_4) -+ EX_ST(STORE(stw, %i5, %i1 + %i3), NG_ret_i2_plus_4) - add %i1, 0x4, %i1 - 1: cmp %i2, 0 - be,pt %XCC, 85f -@@ -358,8 +441,8 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - sub %i2, %g1, %i2 - - 1: subcc %g1, 1, %g1 -- EX_LD(LOAD(ldub, %i1, %i5)) -- EX_ST(STORE(stb, %i5, %i1 + %i3)) -+ EX_LD(LOAD(ldub, %i1, %i5), NG_ret_i2_plus_g1_plus_1) -+ EX_ST(STORE(stb, %i5, %i1 + %i3), NG_ret_i2_plus_g1_plus_1) - bgu,pt %icc, 1b - add %i1, 1, %i1 - -@@ -375,16 +458,16 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - - 8: mov 64, %i3 - andn %i1, 0x7, %i1 -- EX_LD(LOAD(ldx, %i1, %g2)) -+ EX_LD(LOAD(ldx, %i1, %g2), NG_ret_i2) - sub %i3, %g1, %i3 - andn %i2, 0x7, %i4 - sllx %g2, %g1, %g2 - 1: add %i1, 0x8, %i1 -- EX_LD(LOAD(ldx, %i1, %g3)) -+ EX_LD(LOAD(ldx, %i1, %g3), NG_ret_i2_and_7_plus_i4) - subcc %i4, 0x8, %i4 - srlx %g3, %i3, %i5 - or %i5, %g2, %i5 -- EX_ST(STORE(stx, %i5, %o0)) -+ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4) - add %o0, 0x8, %o0 - bgu,pt %icc, 1b - sllx %g3, %g1, %g2 -@@ -404,8 +487,8 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - - 1: - subcc %i2, 4, %i2 -- EX_LD(LOAD(lduw, %i1, %g1)) -- EX_ST(STORE(stw, %g1, %i1 + %i3)) -+ EX_LD(LOAD(lduw, %i1, %g1), NG_ret_i2_plus_4) -+ EX_ST(STORE(stw, %g1, %i1 + %i3), NG_ret_i2_plus_4) - bgu,pt %XCC, 1b - add %i1, 4, %i1 - -@@ -415,8 +498,8 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */ - .align 32 - 90: - subcc %i2, 1, %i2 -- EX_LD(LOAD(ldub, %i1, %g1)) -- EX_ST(STORE(stb, %g1, %i1 + %i3)) -+ EX_LD(LOAD(ldub, %i1, %g1), NG_ret_i2_plus_1) -+ EX_ST(STORE(stb, %g1, %i1 + %i3), NG_ret_i2_plus_1) - bgu,pt %XCC, 90b - add %i1, 1, %i1 - ret -diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S -index ecc5692fa2b4..bb6ff73229e3 100644 ---- a/arch/sparc/lib/U1copy_from_user.S -+++ b/arch/sparc/lib/U1copy_from_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com) - */ - --#define EX_LD(x) \ -+#define EX_LD(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_LD_FP(x) \ -+#define EX_LD_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_fp;\ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S -index 9eea392e44d4..ed92ce739558 100644 ---- a/arch/sparc/lib/U1copy_to_user.S -+++ b/arch/sparc/lib/U1copy_to_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_ST_FP(x) \ -+#define EX_ST_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_fp;\ -+ .word 98b, y; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S -index 3e6209ebb7d7..f30d2ab2c371 100644 ---- a/arch/sparc/lib/U1memcpy.S -+++ b/arch/sparc/lib/U1memcpy.S -@@ -5,6 +5,7 @@ - */ - - #ifdef __KERNEL__ -+#include - #include - #include - #define GLOBAL_SPARE g7 -@@ -23,21 +24,17 @@ - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - #ifndef EX_LD_FP --#define EX_LD_FP(x) x -+#define EX_LD_FP(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x -+#define EX_ST(x,y) x - #endif - #ifndef EX_ST_FP --#define EX_ST_FP(x) x --#endif -- --#ifndef EX_RETVAL --#define EX_RETVAL(x) x -+#define EX_ST_FP(x,y) x - #endif - - #ifndef LOAD -@@ -78,53 +75,169 @@ - faligndata %f7, %f8, %f60; \ - faligndata %f8, %f9, %f62; - --#define MAIN_LOOP_CHUNK(src, dest, fdest, fsrc, len, jmptgt) \ -- EX_LD_FP(LOAD_BLK(%src, %fdest)); \ -- EX_ST_FP(STORE_BLK(%fsrc, %dest)); \ -- add %src, 0x40, %src; \ -- subcc %len, 0x40, %len; \ -- be,pn %xcc, jmptgt; \ -- add %dest, 0x40, %dest; \ -- --#define LOOP_CHUNK1(src, dest, len, branch_dest) \ -- MAIN_LOOP_CHUNK(src, dest, f0, f48, len, branch_dest) --#define LOOP_CHUNK2(src, dest, len, branch_dest) \ -- MAIN_LOOP_CHUNK(src, dest, f16, f48, len, branch_dest) --#define LOOP_CHUNK3(src, dest, len, branch_dest) \ -- MAIN_LOOP_CHUNK(src, dest, f32, f48, len, branch_dest) -+#define MAIN_LOOP_CHUNK(src, dest, fdest, fsrc, jmptgt) \ -+ EX_LD_FP(LOAD_BLK(%src, %fdest), U1_gs_80_fp); \ -+ EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_80_fp); \ -+ add %src, 0x40, %src; \ -+ subcc %GLOBAL_SPARE, 0x40, %GLOBAL_SPARE; \ -+ be,pn %xcc, jmptgt; \ -+ add %dest, 0x40, %dest; \ -+ -+#define LOOP_CHUNK1(src, dest, branch_dest) \ -+ MAIN_LOOP_CHUNK(src, dest, f0, f48, branch_dest) -+#define LOOP_CHUNK2(src, dest, branch_dest) \ -+ MAIN_LOOP_CHUNK(src, dest, f16, f48, branch_dest) -+#define LOOP_CHUNK3(src, dest, branch_dest) \ -+ MAIN_LOOP_CHUNK(src, dest, f32, f48, branch_dest) - - #define DO_SYNC membar #Sync; - #define STORE_SYNC(dest, fsrc) \ -- EX_ST_FP(STORE_BLK(%fsrc, %dest)); \ -+ EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_80_fp); \ - add %dest, 0x40, %dest; \ - DO_SYNC - - #define STORE_JUMP(dest, fsrc, target) \ -- EX_ST_FP(STORE_BLK(%fsrc, %dest)); \ -+ EX_ST_FP(STORE_BLK(%fsrc, %dest), U1_gs_40_fp); \ - add %dest, 0x40, %dest; \ - ba,pt %xcc, target; \ - nop; - --#define FINISH_VISCHUNK(dest, f0, f1, left) \ -- subcc %left, 8, %left;\ -- bl,pn %xcc, 95f; \ -- faligndata %f0, %f1, %f48; \ -- EX_ST_FP(STORE(std, %f48, %dest)); \ -+#define FINISH_VISCHUNK(dest, f0, f1) \ -+ subcc %g3, 8, %g3; \ -+ bl,pn %xcc, 95f; \ -+ faligndata %f0, %f1, %f48; \ -+ EX_ST_FP(STORE(std, %f48, %dest), U1_g3_8_fp); \ - add %dest, 8, %dest; - --#define UNEVEN_VISCHUNK_LAST(dest, f0, f1, left) \ -- subcc %left, 8, %left; \ -- bl,pn %xcc, 95f; \ -+#define UNEVEN_VISCHUNK_LAST(dest, f0, f1) \ -+ subcc %g3, 8, %g3; \ -+ bl,pn %xcc, 95f; \ - fsrc2 %f0, %f1; - --#define UNEVEN_VISCHUNK(dest, f0, f1, left) \ -- UNEVEN_VISCHUNK_LAST(dest, f0, f1, left) \ -+#define UNEVEN_VISCHUNK(dest, f0, f1) \ -+ UNEVEN_VISCHUNK_LAST(dest, f0, f1) \ - ba,a,pt %xcc, 93f; - - .register %g2,#scratch - .register %g3,#scratch - - .text -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+ENTRY(U1_g1_1_fp) -+ VISExitHalf -+ add %g1, 1, %g1 -+ add %g1, %g2, %g1 -+ retl -+ add %g1, %o2, %o0 -+ENDPROC(U1_g1_1_fp) -+ENTRY(U1_g2_0_fp) -+ VISExitHalf -+ retl -+ add %g2, %o2, %o0 -+ENDPROC(U1_g2_0_fp) -+ENTRY(U1_g2_8_fp) -+ VISExitHalf -+ add %g2, 8, %g2 -+ retl -+ add %g2, %o2, %o0 -+ENDPROC(U1_g2_8_fp) -+ENTRY(U1_gs_0_fp) -+ VISExitHalf -+ add %GLOBAL_SPARE, %g3, %o0 -+ retl -+ add %o0, %o2, %o0 -+ENDPROC(U1_gs_0_fp) -+ENTRY(U1_gs_80_fp) -+ VISExitHalf -+ add %GLOBAL_SPARE, 0x80, %GLOBAL_SPARE -+ add %GLOBAL_SPARE, %g3, %o0 -+ retl -+ add %o0, %o2, %o0 -+ENDPROC(U1_gs_80_fp) -+ENTRY(U1_gs_40_fp) -+ VISExitHalf -+ add %GLOBAL_SPARE, 0x40, %GLOBAL_SPARE -+ add %GLOBAL_SPARE, %g3, %o0 -+ retl -+ add %o0, %o2, %o0 -+ENDPROC(U1_gs_40_fp) -+ENTRY(U1_g3_0_fp) -+ VISExitHalf -+ retl -+ add %g3, %o2, %o0 -+ENDPROC(U1_g3_0_fp) -+ENTRY(U1_g3_8_fp) -+ VISExitHalf -+ add %g3, 8, %g3 -+ retl -+ add %g3, %o2, %o0 -+ENDPROC(U1_g3_8_fp) -+ENTRY(U1_o2_0_fp) -+ VISExitHalf -+ retl -+ mov %o2, %o0 -+ENDPROC(U1_o2_0_fp) -+ENTRY(U1_o2_1_fp) -+ VISExitHalf -+ retl -+ add %o2, 1, %o0 -+ENDPROC(U1_o2_1_fp) -+ENTRY(U1_gs_0) -+ VISExitHalf -+ retl -+ add %GLOBAL_SPARE, %o2, %o0 -+ENDPROC(U1_gs_0) -+ENTRY(U1_gs_8) -+ VISExitHalf -+ add %GLOBAL_SPARE, %o2, %GLOBAL_SPARE -+ retl -+ add %GLOBAL_SPARE, 0x8, %o0 -+ENDPROC(U1_gs_8) -+ENTRY(U1_gs_10) -+ VISExitHalf -+ add %GLOBAL_SPARE, %o2, %GLOBAL_SPARE -+ retl -+ add %GLOBAL_SPARE, 0x10, %o0 -+ENDPROC(U1_gs_10) -+ENTRY(U1_o2_0) -+ retl -+ mov %o2, %o0 -+ENDPROC(U1_o2_0) -+ENTRY(U1_o2_8) -+ retl -+ add %o2, 8, %o0 -+ENDPROC(U1_o2_8) -+ENTRY(U1_o2_4) -+ retl -+ add %o2, 4, %o0 -+ENDPROC(U1_o2_4) -+ENTRY(U1_o2_1) -+ retl -+ add %o2, 1, %o0 -+ENDPROC(U1_o2_1) -+ENTRY(U1_g1_0) -+ retl -+ add %g1, %o2, %o0 -+ENDPROC(U1_g1_0) -+ENTRY(U1_g1_1) -+ add %g1, 1, %g1 -+ retl -+ add %g1, %o2, %o0 -+ENDPROC(U1_g1_1) -+ENTRY(U1_gs_0_o2_adj) -+ and %o2, 7, %o2 -+ retl -+ add %GLOBAL_SPARE, %o2, %o0 -+ENDPROC(U1_gs_0_o2_adj) -+ENTRY(U1_gs_8_o2_adj) -+ and %o2, 7, %o2 -+ add %GLOBAL_SPARE, 8, %GLOBAL_SPARE -+ retl -+ add %GLOBAL_SPARE, %o2, %o0 -+ENDPROC(U1_gs_8_o2_adj) -+#endif -+ - .align 64 - - .globl FUNC_NAME -@@ -166,8 +279,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - and %g2, 0x38, %g2 - - 1: subcc %g1, 0x1, %g1 -- EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3)) -- EX_ST_FP(STORE(stb, %o3, %o1 + %GLOBAL_SPARE)) -+ EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3), U1_g1_1_fp) -+ EX_ST_FP(STORE(stb, %o3, %o1 + %GLOBAL_SPARE), U1_g1_1_fp) - bgu,pt %XCC, 1b - add %o1, 0x1, %o1 - -@@ -178,20 +291,20 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - be,pt %icc, 3f - alignaddr %o1, %g0, %o1 - -- EX_LD_FP(LOAD(ldd, %o1, %f4)) --1: EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6)) -+ EX_LD_FP(LOAD(ldd, %o1, %f4), U1_g2_0_fp) -+1: EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6), U1_g2_0_fp) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f4, %f6, %f0 -- EX_ST_FP(STORE(std, %f0, %o0)) -+ EX_ST_FP(STORE(std, %f0, %o0), U1_g2_8_fp) - be,pn %icc, 3f - add %o0, 0x8, %o0 - -- EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4), U1_g2_0_fp) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f6, %f4, %f0 -- EX_ST_FP(STORE(std, %f0, %o0)) -+ EX_ST_FP(STORE(std, %f0, %o0), U1_g2_8_fp) - bne,pt %icc, 1b - add %o0, 0x8, %o0 - -@@ -214,13 +327,13 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - add %g1, %GLOBAL_SPARE, %g1 - subcc %o2, %g3, %o2 - -- EX_LD_FP(LOAD_BLK(%o1, %f0)) -+ EX_LD_FP(LOAD_BLK(%o1, %f0), U1_gs_0_fp) - add %o1, 0x40, %o1 - add %g1, %g3, %g1 -- EX_LD_FP(LOAD_BLK(%o1, %f16)) -+ EX_LD_FP(LOAD_BLK(%o1, %f16), U1_gs_0_fp) - add %o1, 0x40, %o1 - sub %GLOBAL_SPARE, 0x80, %GLOBAL_SPARE -- EX_LD_FP(LOAD_BLK(%o1, %f32)) -+ EX_LD_FP(LOAD_BLK(%o1, %f32), U1_gs_80_fp) - add %o1, 0x40, %o1 - - /* There are 8 instances of the unrolled loop, -@@ -240,11 +353,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - .align 64 - 1: FREG_FROB(f0, f2, f4, f6, f8, f10,f12,f14,f16) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f16,f18,f20,f22,f24,f26,f28,f30,f32) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f32,f34,f36,f38,f40,f42,f44,f46,f0) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f0, %f2, %f48 - 1: FREG_FROB(f16,f18,f20,f22,f24,f26,f28,f30,f32) -@@ -261,11 +374,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 56f) - - 1: FREG_FROB(f2, f4, f6, f8, f10,f12,f14,f16,f18) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f18,f20,f22,f24,f26,f28,f30,f32,f34) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f34,f36,f38,f40,f42,f44,f46,f0, f2) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f2, %f4, %f48 - 1: FREG_FROB(f18,f20,f22,f24,f26,f28,f30,f32,f34) -@@ -282,11 +395,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 57f) - - 1: FREG_FROB(f4, f6, f8, f10,f12,f14,f16,f18,f20) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f20,f22,f24,f26,f28,f30,f32,f34,f36) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f36,f38,f40,f42,f44,f46,f0, f2, f4) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f4, %f6, %f48 - 1: FREG_FROB(f20,f22,f24,f26,f28,f30,f32,f34,f36) -@@ -303,11 +416,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 58f) - - 1: FREG_FROB(f6, f8, f10,f12,f14,f16,f18,f20,f22) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f22,f24,f26,f28,f30,f32,f34,f36,f38) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f38,f40,f42,f44,f46,f0, f2, f4, f6) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f6, %f8, %f48 - 1: FREG_FROB(f22,f24,f26,f28,f30,f32,f34,f36,f38) -@@ -324,11 +437,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 59f) - - 1: FREG_FROB(f8, f10,f12,f14,f16,f18,f20,f22,f24) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f24,f26,f28,f30,f32,f34,f36,f38,f40) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f40,f42,f44,f46,f0, f2, f4, f6, f8) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f8, %f10, %f48 - 1: FREG_FROB(f24,f26,f28,f30,f32,f34,f36,f38,f40) -@@ -345,11 +458,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 60f) - - 1: FREG_FROB(f10,f12,f14,f16,f18,f20,f22,f24,f26) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f26,f28,f30,f32,f34,f36,f38,f40,f42) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f42,f44,f46,f0, f2, f4, f6, f8, f10) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f10, %f12, %f48 - 1: FREG_FROB(f26,f28,f30,f32,f34,f36,f38,f40,f42) -@@ -366,11 +479,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 61f) - - 1: FREG_FROB(f12,f14,f16,f18,f20,f22,f24,f26,f28) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f28,f30,f32,f34,f36,f38,f40,f42,f44) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f44,f46,f0, f2, f4, f6, f8, f10,f12) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f12, %f14, %f48 - 1: FREG_FROB(f28,f30,f32,f34,f36,f38,f40,f42,f44) -@@ -387,11 +500,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - STORE_JUMP(o0, f48, 62f) - - 1: FREG_FROB(f14,f16,f18,f20,f22,f24,f26,f28,f30) -- LOOP_CHUNK1(o1, o0, GLOBAL_SPARE, 1f) -+ LOOP_CHUNK1(o1, o0, 1f) - FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46) -- LOOP_CHUNK2(o1, o0, GLOBAL_SPARE, 2f) -+ LOOP_CHUNK2(o1, o0, 2f) - FREG_FROB(f46,f0, f2, f4, f6, f8, f10,f12,f14) -- LOOP_CHUNK3(o1, o0, GLOBAL_SPARE, 3f) -+ LOOP_CHUNK3(o1, o0, 3f) - ba,pt %xcc, 1b+4 - faligndata %f14, %f16, %f48 - 1: FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46) -@@ -407,53 +520,53 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - FREG_FROB(f30,f32,f34,f36,f38,f40,f42,f44,f46) - STORE_JUMP(o0, f48, 63f) - --40: FINISH_VISCHUNK(o0, f0, f2, g3) --41: FINISH_VISCHUNK(o0, f2, f4, g3) --42: FINISH_VISCHUNK(o0, f4, f6, g3) --43: FINISH_VISCHUNK(o0, f6, f8, g3) --44: FINISH_VISCHUNK(o0, f8, f10, g3) --45: FINISH_VISCHUNK(o0, f10, f12, g3) --46: FINISH_VISCHUNK(o0, f12, f14, g3) --47: UNEVEN_VISCHUNK(o0, f14, f0, g3) --48: FINISH_VISCHUNK(o0, f16, f18, g3) --49: FINISH_VISCHUNK(o0, f18, f20, g3) --50: FINISH_VISCHUNK(o0, f20, f22, g3) --51: FINISH_VISCHUNK(o0, f22, f24, g3) --52: FINISH_VISCHUNK(o0, f24, f26, g3) --53: FINISH_VISCHUNK(o0, f26, f28, g3) --54: FINISH_VISCHUNK(o0, f28, f30, g3) --55: UNEVEN_VISCHUNK(o0, f30, f0, g3) --56: FINISH_VISCHUNK(o0, f32, f34, g3) --57: FINISH_VISCHUNK(o0, f34, f36, g3) --58: FINISH_VISCHUNK(o0, f36, f38, g3) --59: FINISH_VISCHUNK(o0, f38, f40, g3) --60: FINISH_VISCHUNK(o0, f40, f42, g3) --61: FINISH_VISCHUNK(o0, f42, f44, g3) --62: FINISH_VISCHUNK(o0, f44, f46, g3) --63: UNEVEN_VISCHUNK_LAST(o0, f46, f0, g3) -- --93: EX_LD_FP(LOAD(ldd, %o1, %f2)) -+40: FINISH_VISCHUNK(o0, f0, f2) -+41: FINISH_VISCHUNK(o0, f2, f4) -+42: FINISH_VISCHUNK(o0, f4, f6) -+43: FINISH_VISCHUNK(o0, f6, f8) -+44: FINISH_VISCHUNK(o0, f8, f10) -+45: FINISH_VISCHUNK(o0, f10, f12) -+46: FINISH_VISCHUNK(o0, f12, f14) -+47: UNEVEN_VISCHUNK(o0, f14, f0) -+48: FINISH_VISCHUNK(o0, f16, f18) -+49: FINISH_VISCHUNK(o0, f18, f20) -+50: FINISH_VISCHUNK(o0, f20, f22) -+51: FINISH_VISCHUNK(o0, f22, f24) -+52: FINISH_VISCHUNK(o0, f24, f26) -+53: FINISH_VISCHUNK(o0, f26, f28) -+54: FINISH_VISCHUNK(o0, f28, f30) -+55: UNEVEN_VISCHUNK(o0, f30, f0) -+56: FINISH_VISCHUNK(o0, f32, f34) -+57: FINISH_VISCHUNK(o0, f34, f36) -+58: FINISH_VISCHUNK(o0, f36, f38) -+59: FINISH_VISCHUNK(o0, f38, f40) -+60: FINISH_VISCHUNK(o0, f40, f42) -+61: FINISH_VISCHUNK(o0, f42, f44) -+62: FINISH_VISCHUNK(o0, f44, f46) -+63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) -+ -+93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) - add %o1, 8, %o1 - subcc %g3, 8, %g3 - faligndata %f0, %f2, %f8 -- EX_ST_FP(STORE(std, %f8, %o0)) -+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) - bl,pn %xcc, 95f - add %o0, 8, %o0 -- EX_LD_FP(LOAD(ldd, %o1, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) - add %o1, 8, %o1 - subcc %g3, 8, %g3 - faligndata %f2, %f0, %f8 -- EX_ST_FP(STORE(std, %f8, %o0)) -+ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) - bge,pt %xcc, 93b - add %o0, 8, %o0 - - 95: brz,pt %o2, 2f - mov %g1, %o1 - --1: EX_LD_FP(LOAD(ldub, %o1, %o3)) -+1: EX_LD_FP(LOAD(ldub, %o1, %o3), U1_o2_0_fp) - add %o1, 1, %o1 - subcc %o2, 1, %o2 -- EX_ST_FP(STORE(stb, %o3, %o0)) -+ EX_ST_FP(STORE(stb, %o3, %o0), U1_o2_1_fp) - bne,pt %xcc, 1b - add %o0, 1, %o0 - -@@ -469,27 +582,27 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 72: andn %o2, 0xf, %GLOBAL_SPARE - and %o2, 0xf, %o2 --1: EX_LD(LOAD(ldx, %o1 + 0x00, %o5)) -- EX_LD(LOAD(ldx, %o1 + 0x08, %g1)) -+1: EX_LD(LOAD(ldx, %o1 + 0x00, %o5), U1_gs_0) -+ EX_LD(LOAD(ldx, %o1 + 0x08, %g1), U1_gs_0) - subcc %GLOBAL_SPARE, 0x10, %GLOBAL_SPARE -- EX_ST(STORE(stx, %o5, %o1 + %o3)) -+ EX_ST(STORE(stx, %o5, %o1 + %o3), U1_gs_10) - add %o1, 0x8, %o1 -- EX_ST(STORE(stx, %g1, %o1 + %o3)) -+ EX_ST(STORE(stx, %g1, %o1 + %o3), U1_gs_8) - bgu,pt %XCC, 1b - add %o1, 0x8, %o1 - 73: andcc %o2, 0x8, %g0 - be,pt %XCC, 1f - nop -- EX_LD(LOAD(ldx, %o1, %o5)) -+ EX_LD(LOAD(ldx, %o1, %o5), U1_o2_0) - sub %o2, 0x8, %o2 -- EX_ST(STORE(stx, %o5, %o1 + %o3)) -+ EX_ST(STORE(stx, %o5, %o1 + %o3), U1_o2_8) - add %o1, 0x8, %o1 - 1: andcc %o2, 0x4, %g0 - be,pt %XCC, 1f - nop -- EX_LD(LOAD(lduw, %o1, %o5)) -+ EX_LD(LOAD(lduw, %o1, %o5), U1_o2_0) - sub %o2, 0x4, %o2 -- EX_ST(STORE(stw, %o5, %o1 + %o3)) -+ EX_ST(STORE(stw, %o5, %o1 + %o3), U1_o2_4) - add %o1, 0x4, %o1 - 1: cmp %o2, 0 - be,pt %XCC, 85f -@@ -503,9 +616,9 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %g0, %g1, %g1 - sub %o2, %g1, %o2 - --1: EX_LD(LOAD(ldub, %o1, %o5)) -+1: EX_LD(LOAD(ldub, %o1, %o5), U1_g1_0) - subcc %g1, 1, %g1 -- EX_ST(STORE(stb, %o5, %o1 + %o3)) -+ EX_ST(STORE(stb, %o5, %o1 + %o3), U1_g1_1) - bgu,pt %icc, 1b - add %o1, 1, %o1 - -@@ -521,16 +634,16 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 8: mov 64, %o3 - andn %o1, 0x7, %o1 -- EX_LD(LOAD(ldx, %o1, %g2)) -+ EX_LD(LOAD(ldx, %o1, %g2), U1_o2_0) - sub %o3, %g1, %o3 - andn %o2, 0x7, %GLOBAL_SPARE - sllx %g2, %g1, %g2 --1: EX_LD(LOAD(ldx, %o1 + 0x8, %g3)) -+1: EX_LD(LOAD(ldx, %o1 + 0x8, %g3), U1_gs_0_o2_adj) - subcc %GLOBAL_SPARE, 0x8, %GLOBAL_SPARE - add %o1, 0x8, %o1 - srlx %g3, %o3, %o5 - or %o5, %g2, %o5 -- EX_ST(STORE(stx, %o5, %o0)) -+ EX_ST(STORE(stx, %o5, %o0), U1_gs_8_o2_adj) - add %o0, 0x8, %o0 - bgu,pt %icc, 1b - sllx %g3, %g1, %g2 -@@ -548,9 +661,9 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - bne,pn %XCC, 90f - sub %o0, %o1, %o3 - --1: EX_LD(LOAD(lduw, %o1, %g1)) -+1: EX_LD(LOAD(lduw, %o1, %g1), U1_o2_0) - subcc %o2, 4, %o2 -- EX_ST(STORE(stw, %g1, %o1 + %o3)) -+ EX_ST(STORE(stw, %g1, %o1 + %o3), U1_o2_4) - bgu,pt %XCC, 1b - add %o1, 4, %o1 - -@@ -558,9 +671,9 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - mov EX_RETVAL(%o4), %o0 - - .align 32 --90: EX_LD(LOAD(ldub, %o1, %g1)) -+90: EX_LD(LOAD(ldub, %o1, %g1), U1_o2_0) - subcc %o2, 1, %o2 -- EX_ST(STORE(stb, %g1, %o1 + %o3)) -+ EX_ST(STORE(stb, %g1, %o1 + %o3), U1_o2_1) - bgu,pt %XCC, 90b - add %o1, 1, %o1 - retl -diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S -index 88ad73d86fe4..db73010a1af8 100644 ---- a/arch/sparc/lib/U3copy_from_user.S -+++ b/arch/sparc/lib/U3copy_from_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com) - */ - --#define EX_LD(x) \ -+#define EX_LD(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_LD_FP(x) \ -+#define EX_LD_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S -index 845139d75537..c4ee858e352a 100644 ---- a/arch/sparc/lib/U3copy_to_user.S -+++ b/arch/sparc/lib/U3copy_to_user.S -@@ -3,19 +3,19 @@ - * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com) - */ - --#define EX_ST(x) \ -+#define EX_ST(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, y; \ - .text; \ - .align 4; - --#define EX_ST_FP(x) \ -+#define EX_ST_FP(x,y) \ - 98: x; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one_fp;\ -+ .word 98b, y##_fp; \ - .text; \ - .align 4; - -diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S -index 491ee69e4995..54f98706b03b 100644 ---- a/arch/sparc/lib/U3memcpy.S -+++ b/arch/sparc/lib/U3memcpy.S -@@ -4,6 +4,7 @@ - */ - - #ifdef __KERNEL__ -+#include - #include - #include - #define GLOBAL_SPARE %g7 -@@ -22,21 +23,17 @@ - #endif - - #ifndef EX_LD --#define EX_LD(x) x -+#define EX_LD(x,y) x - #endif - #ifndef EX_LD_FP --#define EX_LD_FP(x) x -+#define EX_LD_FP(x,y) x - #endif - - #ifndef EX_ST --#define EX_ST(x) x -+#define EX_ST(x,y) x - #endif - #ifndef EX_ST_FP --#define EX_ST_FP(x) x --#endif -- --#ifndef EX_RETVAL --#define EX_RETVAL(x) x -+#define EX_ST_FP(x,y) x - #endif - - #ifndef LOAD -@@ -77,6 +74,87 @@ - */ - - .text -+#ifndef EX_RETVAL -+#define EX_RETVAL(x) x -+__restore_fp: -+ VISExitHalf -+ retl -+ nop -+ENTRY(U3_retl_o2_plus_g2_plus_g1_plus_1_fp) -+ add %g1, 1, %g1 -+ add %g2, %g1, %g2 -+ ba,pt %xcc, __restore_fp -+ add %o2, %g2, %o0 -+ENDPROC(U3_retl_o2_plus_g2_plus_g1_plus_1_fp) -+ENTRY(U3_retl_o2_plus_g2_fp) -+ ba,pt %xcc, __restore_fp -+ add %o2, %g2, %o0 -+ENDPROC(U3_retl_o2_plus_g2_fp) -+ENTRY(U3_retl_o2_plus_g2_plus_8_fp) -+ add %g2, 8, %g2 -+ ba,pt %xcc, __restore_fp -+ add %o2, %g2, %o0 -+ENDPROC(U3_retl_o2_plus_g2_plus_8_fp) -+ENTRY(U3_retl_o2) -+ retl -+ mov %o2, %o0 -+ENDPROC(U3_retl_o2) -+ENTRY(U3_retl_o2_plus_1) -+ retl -+ add %o2, 1, %o0 -+ENDPROC(U3_retl_o2_plus_1) -+ENTRY(U3_retl_o2_plus_4) -+ retl -+ add %o2, 4, %o0 -+ENDPROC(U3_retl_o2_plus_4) -+ENTRY(U3_retl_o2_plus_8) -+ retl -+ add %o2, 8, %o0 -+ENDPROC(U3_retl_o2_plus_8) -+ENTRY(U3_retl_o2_plus_g1_plus_1) -+ add %g1, 1, %g1 -+ retl -+ add %o2, %g1, %o0 -+ENDPROC(U3_retl_o2_plus_g1_plus_1) -+ENTRY(U3_retl_o2_fp) -+ ba,pt %xcc, __restore_fp -+ mov %o2, %o0 -+ENDPROC(U3_retl_o2_fp) -+ENTRY(U3_retl_o2_plus_o3_sll_6_plus_0x80_fp) -+ sll %o3, 6, %o3 -+ add %o3, 0x80, %o3 -+ ba,pt %xcc, __restore_fp -+ add %o2, %o3, %o0 -+ENDPROC(U3_retl_o2_plus_o3_sll_6_plus_0x80_fp) -+ENTRY(U3_retl_o2_plus_o3_sll_6_plus_0x40_fp) -+ sll %o3, 6, %o3 -+ add %o3, 0x40, %o3 -+ ba,pt %xcc, __restore_fp -+ add %o2, %o3, %o0 -+ENDPROC(U3_retl_o2_plus_o3_sll_6_plus_0x40_fp) -+ENTRY(U3_retl_o2_plus_GS_plus_0x10) -+ add GLOBAL_SPARE, 0x10, GLOBAL_SPARE -+ retl -+ add %o2, GLOBAL_SPARE, %o0 -+ENDPROC(U3_retl_o2_plus_GS_plus_0x10) -+ENTRY(U3_retl_o2_plus_GS_plus_0x08) -+ add GLOBAL_SPARE, 0x08, GLOBAL_SPARE -+ retl -+ add %o2, GLOBAL_SPARE, %o0 -+ENDPROC(U3_retl_o2_plus_GS_plus_0x08) -+ENTRY(U3_retl_o2_and_7_plus_GS) -+ and %o2, 7, %o2 -+ retl -+ add %o2, GLOBAL_SPARE, %o2 -+ENDPROC(U3_retl_o2_and_7_plus_GS) -+ENTRY(U3_retl_o2_and_7_plus_GS_plus_8) -+ add GLOBAL_SPARE, 8, GLOBAL_SPARE -+ and %o2, 7, %o2 -+ retl -+ add %o2, GLOBAL_SPARE, %o2 -+ENDPROC(U3_retl_o2_and_7_plus_GS_plus_8) -+#endif -+ - .align 64 - - /* The cheetah's flexible spine, oversized liver, enlarged heart, -@@ -126,8 +204,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - and %g2, 0x38, %g2 - - 1: subcc %g1, 0x1, %g1 -- EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3)) -- EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE)) -+ EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3), U3_retl_o2_plus_g2_plus_g1_plus_1) -+ EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE), U3_retl_o2_plus_g2_plus_g1_plus_1) - bgu,pt %XCC, 1b - add %o1, 0x1, %o1 - -@@ -138,20 +216,20 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - be,pt %icc, 3f - alignaddr %o1, %g0, %o1 - -- EX_LD_FP(LOAD(ldd, %o1, %f4)) --1: EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6)) -+ EX_LD_FP(LOAD(ldd, %o1, %f4), U3_retl_o2_plus_g2) -+1: EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6), U3_retl_o2_plus_g2) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f4, %f6, %f0 -- EX_ST_FP(STORE(std, %f0, %o0)) -+ EX_ST_FP(STORE(std, %f0, %o0), U3_retl_o2_plus_g2_plus_8) - be,pn %icc, 3f - add %o0, 0x8, %o0 - -- EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4), U3_retl_o2_plus_g2) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f6, %f4, %f2 -- EX_ST_FP(STORE(std, %f2, %o0)) -+ EX_ST_FP(STORE(std, %f2, %o0), U3_retl_o2_plus_g2_plus_8) - bne,pt %icc, 1b - add %o0, 0x8, %o0 - -@@ -161,25 +239,25 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - LOAD(prefetch, %o1 + 0x080, #one_read) - LOAD(prefetch, %o1 + 0x0c0, #one_read) - LOAD(prefetch, %o1 + 0x100, #one_read) -- EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0), U3_retl_o2) - LOAD(prefetch, %o1 + 0x140, #one_read) -- EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2) - LOAD(prefetch, %o1 + 0x180, #one_read) -- EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2) - LOAD(prefetch, %o1 + 0x1c0, #one_read) - faligndata %f0, %f2, %f16 -- EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2) - faligndata %f2, %f4, %f18 -- EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2) - faligndata %f4, %f6, %f20 -- EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2) - faligndata %f6, %f8, %f22 - -- EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2) - faligndata %f8, %f10, %f24 -- EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2) - faligndata %f10, %f12, %f26 -- EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) - - subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE - add %o1, 0x40, %o1 -@@ -190,26 +268,26 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - .align 64 - 1: -- EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2_plus_o3_sll_6_plus_0x80) - faligndata %f12, %f14, %f28 -- EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2_plus_o3_sll_6_plus_0x80) - faligndata %f14, %f0, %f30 -- EX_ST_FP(STORE_BLK(%f16, %o0)) -- EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6)) -+ EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x80) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f0, %f2, %f16 - add %o0, 0x40, %o0 - -- EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f2, %f4, %f18 -- EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f4, %f6, %f20 -- EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2_plus_o3_sll_6_plus_0x40) - subcc %o3, 0x01, %o3 - faligndata %f6, %f8, %f22 -- EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2_plus_o3_sll_6_plus_0x80) - - faligndata %f8, %f10, %f24 -- EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2_plus_o3_sll_6_plus_0x80) - LOAD(prefetch, %o1 + 0x1c0, #one_read) - faligndata %f10, %f12, %f26 - bg,pt %XCC, 1b -@@ -217,29 +295,29 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - /* Finally we copy the last full 64-byte block. */ - 2: -- EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2), U3_retl_o2_plus_o3_sll_6_plus_0x80) - faligndata %f12, %f14, %f28 -- EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4), U3_retl_o2_plus_o3_sll_6_plus_0x80) - faligndata %f14, %f0, %f30 -- EX_ST_FP(STORE_BLK(%f16, %o0)) -- EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6)) -+ EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x80) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f0, %f2, %f16 -- EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f2, %f4, %f18 -- EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f4, %f6, %f20 -- EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f6, %f8, %f22 -- EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14), U3_retl_o2_plus_o3_sll_6_plus_0x40) - faligndata %f8, %f10, %f24 - cmp %g1, 0 - be,pt %XCC, 1f - add %o0, 0x40, %o0 -- EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2_plus_o3_sll_6_plus_0x40) - 1: faligndata %f10, %f12, %f26 - faligndata %f12, %f14, %f28 - faligndata %f14, %f0, %f30 -- EX_ST_FP(STORE_BLK(%f16, %o0)) -+ EX_ST_FP(STORE_BLK(%f16, %o0), U3_retl_o2_plus_o3_sll_6_plus_0x40) - add %o0, 0x40, %o0 - add %o1, 0x40, %o1 - membar #Sync -@@ -259,20 +337,20 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - sub %o2, %g2, %o2 - be,a,pt %XCC, 1f -- EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0), U3_retl_o2_plus_g2) - --1: EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2)) -+1: EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2), U3_retl_o2_plus_g2) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f0, %f2, %f8 -- EX_ST_FP(STORE(std, %f8, %o0)) -+ EX_ST_FP(STORE(std, %f8, %o0), U3_retl_o2_plus_g2_plus_8) - be,pn %XCC, 2f - add %o0, 0x8, %o0 -- EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0)) -+ EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0), U3_retl_o2_plus_g2) - add %o1, 0x8, %o1 - subcc %g2, 0x8, %g2 - faligndata %f2, %f0, %f8 -- EX_ST_FP(STORE(std, %f8, %o0)) -+ EX_ST_FP(STORE(std, %f8, %o0), U3_retl_o2_plus_g2_plus_8) - bne,pn %XCC, 1b - add %o0, 0x8, %o0 - -@@ -292,30 +370,33 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andcc %o2, 0x8, %g0 - be,pt %icc, 1f - nop -- EX_LD(LOAD(ldx, %o1, %o5)) -- EX_ST(STORE(stx, %o5, %o1 + %o3)) -+ EX_LD(LOAD(ldx, %o1, %o5), U3_retl_o2) -+ EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2) - add %o1, 0x8, %o1 -+ sub %o2, 8, %o2 - - 1: andcc %o2, 0x4, %g0 - be,pt %icc, 1f - nop -- EX_LD(LOAD(lduw, %o1, %o5)) -- EX_ST(STORE(stw, %o5, %o1 + %o3)) -+ EX_LD(LOAD(lduw, %o1, %o5), U3_retl_o2) -+ EX_ST(STORE(stw, %o5, %o1 + %o3), U3_retl_o2) - add %o1, 0x4, %o1 -+ sub %o2, 4, %o2 - - 1: andcc %o2, 0x2, %g0 - be,pt %icc, 1f - nop -- EX_LD(LOAD(lduh, %o1, %o5)) -- EX_ST(STORE(sth, %o5, %o1 + %o3)) -+ EX_LD(LOAD(lduh, %o1, %o5), U3_retl_o2) -+ EX_ST(STORE(sth, %o5, %o1 + %o3), U3_retl_o2) - add %o1, 0x2, %o1 -+ sub %o2, 2, %o2 - - 1: andcc %o2, 0x1, %g0 - be,pt %icc, 85f - nop -- EX_LD(LOAD(ldub, %o1, %o5)) -+ EX_LD(LOAD(ldub, %o1, %o5), U3_retl_o2) - ba,pt %xcc, 85f -- EX_ST(STORE(stb, %o5, %o1 + %o3)) -+ EX_ST(STORE(stb, %o5, %o1 + %o3), U3_retl_o2) - - .align 64 - 70: /* 16 < len <= 64 */ -@@ -326,26 +407,26 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - andn %o2, 0xf, GLOBAL_SPARE - and %o2, 0xf, %o2 - 1: subcc GLOBAL_SPARE, 0x10, GLOBAL_SPARE -- EX_LD(LOAD(ldx, %o1 + 0x00, %o5)) -- EX_LD(LOAD(ldx, %o1 + 0x08, %g1)) -- EX_ST(STORE(stx, %o5, %o1 + %o3)) -+ EX_LD(LOAD(ldx, %o1 + 0x00, %o5), U3_retl_o2_plus_GS_plus_0x10) -+ EX_LD(LOAD(ldx, %o1 + 0x08, %g1), U3_retl_o2_plus_GS_plus_0x10) -+ EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2_plus_GS_plus_0x10) - add %o1, 0x8, %o1 -- EX_ST(STORE(stx, %g1, %o1 + %o3)) -+ EX_ST(STORE(stx, %g1, %o1 + %o3), U3_retl_o2_plus_GS_plus_0x08) - bgu,pt %XCC, 1b - add %o1, 0x8, %o1 - 73: andcc %o2, 0x8, %g0 - be,pt %XCC, 1f - nop - sub %o2, 0x8, %o2 -- EX_LD(LOAD(ldx, %o1, %o5)) -- EX_ST(STORE(stx, %o5, %o1 + %o3)) -+ EX_LD(LOAD(ldx, %o1, %o5), U3_retl_o2_plus_8) -+ EX_ST(STORE(stx, %o5, %o1 + %o3), U3_retl_o2_plus_8) - add %o1, 0x8, %o1 - 1: andcc %o2, 0x4, %g0 - be,pt %XCC, 1f - nop - sub %o2, 0x4, %o2 -- EX_LD(LOAD(lduw, %o1, %o5)) -- EX_ST(STORE(stw, %o5, %o1 + %o3)) -+ EX_LD(LOAD(lduw, %o1, %o5), U3_retl_o2_plus_4) -+ EX_ST(STORE(stw, %o5, %o1 + %o3), U3_retl_o2_plus_4) - add %o1, 0x4, %o1 - 1: cmp %o2, 0 - be,pt %XCC, 85f -@@ -361,8 +442,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - sub %o2, %g1, %o2 - - 1: subcc %g1, 1, %g1 -- EX_LD(LOAD(ldub, %o1, %o5)) -- EX_ST(STORE(stb, %o5, %o1 + %o3)) -+ EX_LD(LOAD(ldub, %o1, %o5), U3_retl_o2_plus_g1_plus_1) -+ EX_ST(STORE(stb, %o5, %o1 + %o3), U3_retl_o2_plus_g1_plus_1) - bgu,pt %icc, 1b - add %o1, 1, %o1 - -@@ -378,16 +459,16 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 8: mov 64, %o3 - andn %o1, 0x7, %o1 -- EX_LD(LOAD(ldx, %o1, %g2)) -+ EX_LD(LOAD(ldx, %o1, %g2), U3_retl_o2) - sub %o3, %g1, %o3 - andn %o2, 0x7, GLOBAL_SPARE - sllx %g2, %g1, %g2 --1: EX_LD(LOAD(ldx, %o1 + 0x8, %g3)) -+1: EX_LD(LOAD(ldx, %o1 + 0x8, %g3), U3_retl_o2_and_7_plus_GS) - subcc GLOBAL_SPARE, 0x8, GLOBAL_SPARE - add %o1, 0x8, %o1 - srlx %g3, %o3, %o5 - or %o5, %g2, %o5 -- EX_ST(STORE(stx, %o5, %o0)) -+ EX_ST(STORE(stx, %o5, %o0), U3_retl_o2_and_7_plus_GS_plus_8) - add %o0, 0x8, %o0 - bgu,pt %icc, 1b - sllx %g3, %g1, %g2 -@@ -407,8 +488,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - - 1: - subcc %o2, 4, %o2 -- EX_LD(LOAD(lduw, %o1, %g1)) -- EX_ST(STORE(stw, %g1, %o1 + %o3)) -+ EX_LD(LOAD(lduw, %o1, %g1), U3_retl_o2_plus_4) -+ EX_ST(STORE(stw, %g1, %o1 + %o3), U3_retl_o2_plus_4) - bgu,pt %XCC, 1b - add %o1, 4, %o1 - -@@ -418,8 +499,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - .align 32 - 90: - subcc %o2, 1, %o2 -- EX_LD(LOAD(ldub, %o1, %g1)) -- EX_ST(STORE(stb, %g1, %o1 + %o3)) -+ EX_LD(LOAD(ldub, %o1, %g1), U3_retl_o2_plus_1) -+ EX_ST(STORE(stb, %g1, %o1 + %o3), U3_retl_o2_plus_1) - bgu,pt %XCC, 90b - add %o1, 1, %o1 - retl -diff --git a/arch/sparc/lib/copy_in_user.S b/arch/sparc/lib/copy_in_user.S -index 302c0e60dc2c..4c89b486fa0d 100644 ---- a/arch/sparc/lib/copy_in_user.S -+++ b/arch/sparc/lib/copy_in_user.S -@@ -8,18 +8,33 @@ - - #define XCC xcc - --#define EX(x,y) \ -+#define EX(x,y,z) \ - 98: x,y; \ - .section __ex_table,"a";\ - .align 4; \ -- .word 98b, __retl_one; \ -+ .word 98b, z; \ - .text; \ - .align 4; - -+#define EX_O4(x,y) EX(x,y,__retl_o4_plus_8) -+#define EX_O2_4(x,y) EX(x,y,__retl_o2_plus_4) -+#define EX_O2_1(x,y) EX(x,y,__retl_o2_plus_1) -+ - .register %g2,#scratch - .register %g3,#scratch - - .text -+__retl_o4_plus_8: -+ add %o4, %o2, %o4 -+ retl -+ add %o4, 8, %o0 -+__retl_o2_plus_4: -+ retl -+ add %o2, 4, %o0 -+__retl_o2_plus_1: -+ retl -+ add %o2, 1, %o0 -+ - .align 32 - - /* Don't try to get too fancy here, just nice and -@@ -44,8 +59,8 @@ ENTRY(___copy_in_user) /* %o0=dst, %o1=src, %o2=len */ - andn %o2, 0x7, %o4 - and %o2, 0x7, %o2 - 1: subcc %o4, 0x8, %o4 -- EX(ldxa [%o1] %asi, %o5) -- EX(stxa %o5, [%o0] %asi) -+ EX_O4(ldxa [%o1] %asi, %o5) -+ EX_O4(stxa %o5, [%o0] %asi) - add %o1, 0x8, %o1 - bgu,pt %XCC, 1b - add %o0, 0x8, %o0 -@@ -53,8 +68,8 @@ ENTRY(___copy_in_user) /* %o0=dst, %o1=src, %o2=len */ - be,pt %XCC, 1f - nop - sub %o2, 0x4, %o2 -- EX(lduwa [%o1] %asi, %o5) -- EX(stwa %o5, [%o0] %asi) -+ EX_O2_4(lduwa [%o1] %asi, %o5) -+ EX_O2_4(stwa %o5, [%o0] %asi) - add %o1, 0x4, %o1 - add %o0, 0x4, %o0 - 1: cmp %o2, 0 -@@ -70,8 +85,8 @@ ENTRY(___copy_in_user) /* %o0=dst, %o1=src, %o2=len */ - - 82: - subcc %o2, 4, %o2 -- EX(lduwa [%o1] %asi, %g1) -- EX(stwa %g1, [%o0] %asi) -+ EX_O2_4(lduwa [%o1] %asi, %g1) -+ EX_O2_4(stwa %g1, [%o0] %asi) - add %o1, 4, %o1 - bgu,pt %XCC, 82b - add %o0, 4, %o0 -@@ -82,8 +97,8 @@ ENTRY(___copy_in_user) /* %o0=dst, %o1=src, %o2=len */ - .align 32 - 90: - subcc %o2, 1, %o2 -- EX(lduba [%o1] %asi, %g1) -- EX(stba %g1, [%o0] %asi) -+ EX_O2_1(lduba [%o1] %asi, %g1) -+ EX_O2_1(stba %g1, [%o0] %asi) - add %o1, 1, %o1 - bgu,pt %XCC, 90b - add %o0, 1, %o0 -diff --git a/arch/sparc/lib/user_fixup.c b/arch/sparc/lib/user_fixup.c -deleted file mode 100644 -index ac96ae236709..000000000000 ---- a/arch/sparc/lib/user_fixup.c -+++ /dev/null -@@ -1,71 +0,0 @@ --/* user_fixup.c: Fix up user copy faults. -- * -- * Copyright (C) 2004 David S. Miller -- */ -- --#include --#include --#include --#include --#include -- --#include -- --/* Calculating the exact fault address when using -- * block loads and stores can be very complicated. -- * -- * Instead of trying to be clever and handling all -- * of the cases, just fix things up simply here. -- */ -- --static unsigned long compute_size(unsigned long start, unsigned long size, unsigned long *offset) --{ -- unsigned long fault_addr = current_thread_info()->fault_address; -- unsigned long end = start + size; -- -- if (fault_addr < start || fault_addr >= end) { -- *offset = 0; -- } else { -- *offset = fault_addr - start; -- size = end - fault_addr; -- } -- return size; --} -- --unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned long size) --{ -- unsigned long offset; -- -- size = compute_size((unsigned long) from, size, &offset); -- if (likely(size)) -- memset(to + offset, 0, size); -- -- return size; --} --EXPORT_SYMBOL(copy_from_user_fixup); -- --unsigned long copy_to_user_fixup(void __user *to, const void *from, unsigned long size) --{ -- unsigned long offset; -- -- return compute_size((unsigned long) to, size, &offset); --} --EXPORT_SYMBOL(copy_to_user_fixup); -- --unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned long size) --{ -- unsigned long fault_addr = current_thread_info()->fault_address; -- unsigned long start = (unsigned long) to; -- unsigned long end = start + size; -- -- if (fault_addr >= start && fault_addr < end) -- return end - fault_addr; -- -- start = (unsigned long) from; -- end = start + size; -- if (fault_addr >= start && fault_addr < end) -- return end - fault_addr; -- -- return size; --} --EXPORT_SYMBOL(copy_in_user_fixup); -diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c -index dbabe5713a15..e15f33715103 100644 ---- a/arch/sparc/mm/fault_64.c -+++ b/arch/sparc/mm/fault_64.c -@@ -479,14 +479,14 @@ good_area: - up_read(&mm->mmap_sem); - - mm_rss = get_mm_rss(mm); --#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- mm_rss -= (mm->context.huge_pte_count * (HPAGE_SIZE / PAGE_SIZE)); -+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) -+ mm_rss -= (mm->context.thp_pte_count * (HPAGE_SIZE / PAGE_SIZE)); - #endif - if (unlikely(mm_rss > - mm->context.tsb_block[MM_TSB_BASE].tsb_rss_limit)) - tsb_grow(mm, MM_TSB_BASE, mm_rss); - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- mm_rss = mm->context.huge_pte_count; -+ mm_rss = mm->context.hugetlb_pte_count + mm->context.thp_pte_count; - if (unlikely(mm_rss > - mm->context.tsb_block[MM_TSB_HUGE].tsb_rss_limit)) { - if (mm->context.tsb_block[MM_TSB_HUGE].tsb) -diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c -index 364d093f46c6..da1142401bf4 100644 ---- a/arch/sparc/mm/hugetlbpage.c -+++ b/arch/sparc/mm/hugetlbpage.c -@@ -180,7 +180,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr, - unsigned long nptes; - - if (!pte_present(*ptep) && pte_present(entry)) -- mm->context.huge_pte_count++; -+ mm->context.hugetlb_pte_count++; - - addr &= HPAGE_MASK; - -@@ -212,7 +212,7 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, - - entry = *ptep; - if (pte_present(entry)) -- mm->context.huge_pte_count--; -+ mm->context.hugetlb_pte_count--; - - addr &= HPAGE_MASK; - nptes = 1 << HUGETLB_PAGE_ORDER; -diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c -index 3c4b8975fa76..a5331c336b2a 100644 ---- a/arch/sparc/mm/init_64.c -+++ b/arch/sparc/mm/init_64.c -@@ -346,7 +346,8 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t * - spin_lock_irqsave(&mm->context.lock, flags); - - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- if (mm->context.huge_pte_count && is_hugetlb_pte(pte)) -+ if ((mm->context.hugetlb_pte_count || mm->context.thp_pte_count) && -+ is_hugetlb_pte(pte)) - __update_mmu_tsb_insert(mm, MM_TSB_HUGE, REAL_HPAGE_SHIFT, - address, pte_val(pte)); - else -diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c -index f81cd9736700..3659d37b4d81 100644 ---- a/arch/sparc/mm/tlb.c -+++ b/arch/sparc/mm/tlb.c -@@ -175,9 +175,9 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, - - if ((pmd_val(pmd) ^ pmd_val(orig)) & _PAGE_PMD_HUGE) { - if (pmd_val(pmd) & _PAGE_PMD_HUGE) -- mm->context.huge_pte_count++; -+ mm->context.thp_pte_count++; - else -- mm->context.huge_pte_count--; -+ mm->context.thp_pte_count--; - - /* Do not try to allocate the TSB hash table if we - * don't have one already. We have various locks held -diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c -index a0604a493a36..9cdeca0fa955 100644 ---- a/arch/sparc/mm/tsb.c -+++ b/arch/sparc/mm/tsb.c -@@ -27,6 +27,20 @@ static inline int tag_compare(unsigned long tag, unsigned long vaddr) - return (tag == (vaddr >> 22)); - } - -+static void flush_tsb_kernel_range_scan(unsigned long start, unsigned long end) -+{ -+ unsigned long idx; -+ -+ for (idx = 0; idx < KERNEL_TSB_NENTRIES; idx++) { -+ struct tsb *ent = &swapper_tsb[idx]; -+ unsigned long match = idx << 13; -+ -+ match |= (ent->tag << 22); -+ if (match >= start && match < end) -+ ent->tag = (1UL << TSB_TAG_INVALID_BIT); -+ } -+} -+ - /* TSB flushes need only occur on the processor initiating the address - * space modification, not on each cpu the address space has run on. - * Only the TLB flush needs that treatment. -@@ -36,6 +50,9 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end) - { - unsigned long v; - -+ if ((end - start) >> PAGE_SHIFT >= 2 * KERNEL_TSB_NENTRIES) -+ return flush_tsb_kernel_range_scan(start, end); -+ - for (v = start; v < end; v += PAGE_SIZE) { - unsigned long hash = tsb_hash(v, PAGE_SHIFT, - KERNEL_TSB_NENTRIES); -@@ -470,7 +487,7 @@ retry_tsb_alloc: - int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - { - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- unsigned long huge_pte_count; -+ unsigned long total_huge_pte_count; - #endif - unsigned int i; - -@@ -479,12 +496,14 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - mm->context.sparc64_ctx_val = 0UL; - - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- /* We reset it to zero because the fork() page copying -+ /* We reset them to zero because the fork() page copying - * will re-increment the counters as the parent PTEs are - * copied into the child address space. - */ -- huge_pte_count = mm->context.huge_pte_count; -- mm->context.huge_pte_count = 0; -+ total_huge_pte_count = mm->context.hugetlb_pte_count + -+ mm->context.thp_pte_count; -+ mm->context.hugetlb_pte_count = 0; -+ mm->context.thp_pte_count = 0; - #endif - - /* copy_mm() copies over the parent's mm_struct before calling -@@ -500,8 +519,8 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm) - tsb_grow(mm, MM_TSB_BASE, get_mm_rss(mm)); - - #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) -- if (unlikely(huge_pte_count)) -- tsb_grow(mm, MM_TSB_HUGE, huge_pte_count); -+ if (unlikely(total_huge_pte_count)) -+ tsb_grow(mm, MM_TSB_HUGE, total_huge_pte_count); - #endif - - if (unlikely(!mm->context.tsb_block[MM_TSB_BASE].tsb)) -diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S -index b4f4733abc6e..5d2fd6cd3189 100644 ---- a/arch/sparc/mm/ultra.S -+++ b/arch/sparc/mm/ultra.S -@@ -30,7 +30,7 @@ - .text - .align 32 - .globl __flush_tlb_mm --__flush_tlb_mm: /* 18 insns */ -+__flush_tlb_mm: /* 19 insns */ - /* %o0=(ctx & TAG_CONTEXT_BITS), %o1=SECONDARY_CONTEXT */ - ldxa [%o1] ASI_DMMU, %g2 - cmp %g2, %o0 -@@ -81,7 +81,7 @@ __flush_tlb_page: /* 22 insns */ - - .align 32 - .globl __flush_tlb_pending --__flush_tlb_pending: /* 26 insns */ -+__flush_tlb_pending: /* 27 insns */ - /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */ - rdpr %pstate, %g7 - sllx %o1, 3, %o1 -@@ -113,12 +113,14 @@ __flush_tlb_pending: /* 26 insns */ - - .align 32 - .globl __flush_tlb_kernel_range --__flush_tlb_kernel_range: /* 16 insns */ -+__flush_tlb_kernel_range: /* 31 insns */ - /* %o0=start, %o1=end */ - cmp %o0, %o1 - be,pn %xcc, 2f -+ sub %o1, %o0, %o3 -+ srlx %o3, 18, %o4 -+ brnz,pn %o4, __spitfire_flush_tlb_kernel_range_slow - sethi %hi(PAGE_SIZE), %o4 -- sub %o1, %o0, %o3 - sub %o3, %o4, %o3 - or %o0, 0x20, %o0 ! Nucleus - 1: stxa %g0, [%o0 + %o3] ASI_DMMU_DEMAP -@@ -131,6 +133,41 @@ __flush_tlb_kernel_range: /* 16 insns */ - retl - nop - nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ -+__spitfire_flush_tlb_kernel_range_slow: -+ mov 63 * 8, %o4 -+1: ldxa [%o4] ASI_ITLB_DATA_ACCESS, %o3 -+ andcc %o3, 0x40, %g0 /* _PAGE_L_4U */ -+ bne,pn %xcc, 2f -+ mov TLB_TAG_ACCESS, %o3 -+ stxa %g0, [%o3] ASI_IMMU -+ stxa %g0, [%o4] ASI_ITLB_DATA_ACCESS -+ membar #Sync -+2: ldxa [%o4] ASI_DTLB_DATA_ACCESS, %o3 -+ andcc %o3, 0x40, %g0 -+ bne,pn %xcc, 2f -+ mov TLB_TAG_ACCESS, %o3 -+ stxa %g0, [%o3] ASI_DMMU -+ stxa %g0, [%o4] ASI_DTLB_DATA_ACCESS -+ membar #Sync -+2: sub %o4, 8, %o4 -+ brgez,pt %o4, 1b -+ nop -+ retl -+ nop - - __spitfire_flush_tlb_mm_slow: - rdpr %pstate, %g1 -@@ -285,6 +322,40 @@ __cheetah_flush_tlb_pending: /* 27 insns */ - retl - wrpr %g7, 0x0, %pstate - -+__cheetah_flush_tlb_kernel_range: /* 31 insns */ -+ /* %o0=start, %o1=end */ -+ cmp %o0, %o1 -+ be,pn %xcc, 2f -+ sub %o1, %o0, %o3 -+ srlx %o3, 18, %o4 -+ brnz,pn %o4, 3f -+ sethi %hi(PAGE_SIZE), %o4 -+ sub %o3, %o4, %o3 -+ or %o0, 0x20, %o0 ! Nucleus -+1: stxa %g0, [%o0 + %o3] ASI_DMMU_DEMAP -+ stxa %g0, [%o0 + %o3] ASI_IMMU_DEMAP -+ membar #Sync -+ brnz,pt %o3, 1b -+ sub %o3, %o4, %o3 -+2: sethi %hi(KERNBASE), %o3 -+ flush %o3 -+ retl -+ nop -+3: mov 0x80, %o4 -+ stxa %g0, [%o4] ASI_DMMU_DEMAP -+ membar #Sync -+ stxa %g0, [%o4] ASI_IMMU_DEMAP -+ membar #Sync -+ retl -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ - #ifdef DCACHE_ALIASING_POSSIBLE - __cheetah_flush_dcache_page: /* 11 insns */ - sethi %hi(PAGE_OFFSET), %g1 -@@ -309,19 +380,28 @@ __hypervisor_tlb_tl0_error: - ret - restore - --__hypervisor_flush_tlb_mm: /* 10 insns */ -+__hypervisor_flush_tlb_mm: /* 19 insns */ - mov %o0, %o2 /* ARG2: mmu context */ - mov 0, %o0 /* ARG0: CPU lists unimplemented */ - mov 0, %o1 /* ARG1: CPU lists unimplemented */ - mov HV_MMU_ALL, %o3 /* ARG3: flags */ - mov HV_FAST_MMU_DEMAP_CTX, %o5 - ta HV_FAST_TRAP -- brnz,pn %o0, __hypervisor_tlb_tl0_error -+ brnz,pn %o0, 1f - mov HV_FAST_MMU_DEMAP_CTX, %o1 - retl - nop -+1: sethi %hi(__hypervisor_tlb_tl0_error), %o5 -+ jmpl %o5 + %lo(__hypervisor_tlb_tl0_error), %g0 -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop - --__hypervisor_flush_tlb_page: /* 11 insns */ -+__hypervisor_flush_tlb_page: /* 22 insns */ - /* %o0 = context, %o1 = vaddr */ - mov %o0, %g2 - mov %o1, %o0 /* ARG0: vaddr + IMMU-bit */ -@@ -330,12 +410,23 @@ __hypervisor_flush_tlb_page: /* 11 insns */ - srlx %o0, PAGE_SHIFT, %o0 - sllx %o0, PAGE_SHIFT, %o0 - ta HV_MMU_UNMAP_ADDR_TRAP -- brnz,pn %o0, __hypervisor_tlb_tl0_error -+ brnz,pn %o0, 1f - mov HV_MMU_UNMAP_ADDR_TRAP, %o1 - retl - nop -+1: sethi %hi(__hypervisor_tlb_tl0_error), %o2 -+ jmpl %o2 + %lo(__hypervisor_tlb_tl0_error), %g0 -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop - --__hypervisor_flush_tlb_pending: /* 16 insns */ -+__hypervisor_flush_tlb_pending: /* 27 insns */ - /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */ - sllx %o1, 3, %g1 - mov %o2, %g2 -@@ -347,31 +438,57 @@ __hypervisor_flush_tlb_pending: /* 16 insns */ - srlx %o0, PAGE_SHIFT, %o0 - sllx %o0, PAGE_SHIFT, %o0 - ta HV_MMU_UNMAP_ADDR_TRAP -- brnz,pn %o0, __hypervisor_tlb_tl0_error -+ brnz,pn %o0, 1f - mov HV_MMU_UNMAP_ADDR_TRAP, %o1 - brnz,pt %g1, 1b - nop - retl - nop -+1: sethi %hi(__hypervisor_tlb_tl0_error), %o2 -+ jmpl %o2 + %lo(__hypervisor_tlb_tl0_error), %g0 -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop - --__hypervisor_flush_tlb_kernel_range: /* 16 insns */ -+__hypervisor_flush_tlb_kernel_range: /* 31 insns */ - /* %o0=start, %o1=end */ - cmp %o0, %o1 - be,pn %xcc, 2f -- sethi %hi(PAGE_SIZE), %g3 -- mov %o0, %g1 -- sub %o1, %g1, %g2 -+ sub %o1, %o0, %g2 -+ srlx %g2, 18, %g3 -+ brnz,pn %g3, 4f -+ mov %o0, %g1 -+ sethi %hi(PAGE_SIZE), %g3 - sub %g2, %g3, %g2 - 1: add %g1, %g2, %o0 /* ARG0: virtual address */ - mov 0, %o1 /* ARG1: mmu context */ - mov HV_MMU_ALL, %o2 /* ARG2: flags */ - ta HV_MMU_UNMAP_ADDR_TRAP -- brnz,pn %o0, __hypervisor_tlb_tl0_error -+ brnz,pn %o0, 3f - mov HV_MMU_UNMAP_ADDR_TRAP, %o1 - brnz,pt %g2, 1b - sub %g2, %g3, %g2 - 2: retl - nop -+3: sethi %hi(__hypervisor_tlb_tl0_error), %o2 -+ jmpl %o2 + %lo(__hypervisor_tlb_tl0_error), %g0 -+ nop -+4: mov 0, %o0 /* ARG0: CPU lists unimplemented */ -+ mov 0, %o1 /* ARG1: CPU lists unimplemented */ -+ mov 0, %o2 /* ARG2: mmu context == nucleus */ -+ mov HV_MMU_ALL, %o3 /* ARG3: flags */ -+ mov HV_FAST_MMU_DEMAP_CTX, %o5 -+ ta HV_FAST_TRAP -+ brnz,pn %o0, 3b -+ mov HV_FAST_MMU_DEMAP_CTX, %o1 -+ retl -+ nop - - #ifdef DCACHE_ALIASING_POSSIBLE - /* XXX Niagara and friends have an 8K cache, so no aliasing is -@@ -394,43 +511,6 @@ tlb_patch_one: - retl - nop - -- .globl cheetah_patch_cachetlbops --cheetah_patch_cachetlbops: -- save %sp, -128, %sp -- -- sethi %hi(__flush_tlb_mm), %o0 -- or %o0, %lo(__flush_tlb_mm), %o0 -- sethi %hi(__cheetah_flush_tlb_mm), %o1 -- or %o1, %lo(__cheetah_flush_tlb_mm), %o1 -- call tlb_patch_one -- mov 19, %o2 -- -- sethi %hi(__flush_tlb_page), %o0 -- or %o0, %lo(__flush_tlb_page), %o0 -- sethi %hi(__cheetah_flush_tlb_page), %o1 -- or %o1, %lo(__cheetah_flush_tlb_page), %o1 -- call tlb_patch_one -- mov 22, %o2 -- -- sethi %hi(__flush_tlb_pending), %o0 -- or %o0, %lo(__flush_tlb_pending), %o0 -- sethi %hi(__cheetah_flush_tlb_pending), %o1 -- or %o1, %lo(__cheetah_flush_tlb_pending), %o1 -- call tlb_patch_one -- mov 27, %o2 -- --#ifdef DCACHE_ALIASING_POSSIBLE -- sethi %hi(__flush_dcache_page), %o0 -- or %o0, %lo(__flush_dcache_page), %o0 -- sethi %hi(__cheetah_flush_dcache_page), %o1 -- or %o1, %lo(__cheetah_flush_dcache_page), %o1 -- call tlb_patch_one -- mov 11, %o2 --#endif /* DCACHE_ALIASING_POSSIBLE */ -- -- ret -- restore -- - #ifdef CONFIG_SMP - /* These are all called by the slaves of a cross call, at - * trap level 1, with interrupts fully disabled. -@@ -447,7 +527,7 @@ cheetah_patch_cachetlbops: - */ - .align 32 - .globl xcall_flush_tlb_mm --xcall_flush_tlb_mm: /* 21 insns */ -+xcall_flush_tlb_mm: /* 24 insns */ - mov PRIMARY_CONTEXT, %g2 - ldxa [%g2] ASI_DMMU, %g3 - srlx %g3, CTX_PGSZ1_NUC_SHIFT, %g4 -@@ -469,9 +549,12 @@ xcall_flush_tlb_mm: /* 21 insns */ - nop - nop - nop -+ nop -+ nop -+ nop - - .globl xcall_flush_tlb_page --xcall_flush_tlb_page: /* 17 insns */ -+xcall_flush_tlb_page: /* 20 insns */ - /* %g5=context, %g1=vaddr */ - mov PRIMARY_CONTEXT, %g4 - ldxa [%g4] ASI_DMMU, %g2 -@@ -490,15 +573,20 @@ xcall_flush_tlb_page: /* 17 insns */ - retry - nop - nop -+ nop -+ nop -+ nop - - .globl xcall_flush_tlb_kernel_range --xcall_flush_tlb_kernel_range: /* 25 insns */ -+xcall_flush_tlb_kernel_range: /* 44 insns */ - sethi %hi(PAGE_SIZE - 1), %g2 - or %g2, %lo(PAGE_SIZE - 1), %g2 - andn %g1, %g2, %g1 - andn %g7, %g2, %g7 - sub %g7, %g1, %g3 -- add %g2, 1, %g2 -+ srlx %g3, 18, %g2 -+ brnz,pn %g2, 2f -+ add %g2, 1, %g2 - sub %g3, %g2, %g3 - or %g1, 0x20, %g1 ! Nucleus - 1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP -@@ -507,8 +595,25 @@ xcall_flush_tlb_kernel_range: /* 25 insns */ - brnz,pt %g3, 1b - sub %g3, %g2, %g3 - retry -- nop -- nop -+2: mov 63 * 8, %g1 -+1: ldxa [%g1] ASI_ITLB_DATA_ACCESS, %g2 -+ andcc %g2, 0x40, %g0 /* _PAGE_L_4U */ -+ bne,pn %xcc, 2f -+ mov TLB_TAG_ACCESS, %g2 -+ stxa %g0, [%g2] ASI_IMMU -+ stxa %g0, [%g1] ASI_ITLB_DATA_ACCESS -+ membar #Sync -+2: ldxa [%g1] ASI_DTLB_DATA_ACCESS, %g2 -+ andcc %g2, 0x40, %g0 -+ bne,pn %xcc, 2f -+ mov TLB_TAG_ACCESS, %g2 -+ stxa %g0, [%g2] ASI_DMMU -+ stxa %g0, [%g1] ASI_DTLB_DATA_ACCESS -+ membar #Sync -+2: sub %g1, 8, %g1 -+ brgez,pt %g1, 1b -+ nop -+ retry - nop - nop - nop -@@ -637,6 +742,52 @@ xcall_fetch_glob_pmu_n4: - - retry - -+__cheetah_xcall_flush_tlb_kernel_range: /* 44 insns */ -+ sethi %hi(PAGE_SIZE - 1), %g2 -+ or %g2, %lo(PAGE_SIZE - 1), %g2 -+ andn %g1, %g2, %g1 -+ andn %g7, %g2, %g7 -+ sub %g7, %g1, %g3 -+ srlx %g3, 18, %g2 -+ brnz,pn %g2, 2f -+ add %g2, 1, %g2 -+ sub %g3, %g2, %g3 -+ or %g1, 0x20, %g1 ! Nucleus -+1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP -+ stxa %g0, [%g1 + %g3] ASI_IMMU_DEMAP -+ membar #Sync -+ brnz,pt %g3, 1b -+ sub %g3, %g2, %g3 -+ retry -+2: mov 0x80, %g2 -+ stxa %g0, [%g2] ASI_DMMU_DEMAP -+ membar #Sync -+ stxa %g0, [%g2] ASI_IMMU_DEMAP -+ membar #Sync -+ retry -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ nop -+ - #ifdef DCACHE_ALIASING_POSSIBLE - .align 32 - .globl xcall_flush_dcache_page_cheetah -@@ -700,7 +851,7 @@ __hypervisor_tlb_xcall_error: - ba,a,pt %xcc, rtrap - - .globl __hypervisor_xcall_flush_tlb_mm --__hypervisor_xcall_flush_tlb_mm: /* 21 insns */ -+__hypervisor_xcall_flush_tlb_mm: /* 24 insns */ - /* %g5=ctx, g1,g2,g3,g4,g7=scratch, %g6=unusable */ - mov %o0, %g2 - mov %o1, %g3 -@@ -714,7 +865,7 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */ - mov HV_FAST_MMU_DEMAP_CTX, %o5 - ta HV_FAST_TRAP - mov HV_FAST_MMU_DEMAP_CTX, %g6 -- brnz,pn %o0, __hypervisor_tlb_xcall_error -+ brnz,pn %o0, 1f - mov %o0, %g5 - mov %g2, %o0 - mov %g3, %o1 -@@ -723,9 +874,12 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */ - mov %g7, %o5 - membar #Sync - retry -+1: sethi %hi(__hypervisor_tlb_xcall_error), %g4 -+ jmpl %g4 + %lo(__hypervisor_tlb_xcall_error), %g0 -+ nop - - .globl __hypervisor_xcall_flush_tlb_page --__hypervisor_xcall_flush_tlb_page: /* 17 insns */ -+__hypervisor_xcall_flush_tlb_page: /* 20 insns */ - /* %g5=ctx, %g1=vaddr */ - mov %o0, %g2 - mov %o1, %g3 -@@ -737,42 +891,64 @@ __hypervisor_xcall_flush_tlb_page: /* 17 insns */ - sllx %o0, PAGE_SHIFT, %o0 - ta HV_MMU_UNMAP_ADDR_TRAP - mov HV_MMU_UNMAP_ADDR_TRAP, %g6 -- brnz,a,pn %o0, __hypervisor_tlb_xcall_error -+ brnz,a,pn %o0, 1f - mov %o0, %g5 - mov %g2, %o0 - mov %g3, %o1 - mov %g4, %o2 - membar #Sync - retry -+1: sethi %hi(__hypervisor_tlb_xcall_error), %g4 -+ jmpl %g4 + %lo(__hypervisor_tlb_xcall_error), %g0 -+ nop - - .globl __hypervisor_xcall_flush_tlb_kernel_range --__hypervisor_xcall_flush_tlb_kernel_range: /* 25 insns */ -+__hypervisor_xcall_flush_tlb_kernel_range: /* 44 insns */ - /* %g1=start, %g7=end, g2,g3,g4,g5,g6=scratch */ - sethi %hi(PAGE_SIZE - 1), %g2 - or %g2, %lo(PAGE_SIZE - 1), %g2 - andn %g1, %g2, %g1 - andn %g7, %g2, %g7 - sub %g7, %g1, %g3 -+ srlx %g3, 18, %g7 - add %g2, 1, %g2 - sub %g3, %g2, %g3 - mov %o0, %g2 - mov %o1, %g4 -- mov %o2, %g7 -+ brnz,pn %g7, 2f -+ mov %o2, %g7 - 1: add %g1, %g3, %o0 /* ARG0: virtual address */ - mov 0, %o1 /* ARG1: mmu context */ - mov HV_MMU_ALL, %o2 /* ARG2: flags */ - ta HV_MMU_UNMAP_ADDR_TRAP - mov HV_MMU_UNMAP_ADDR_TRAP, %g6 -- brnz,pn %o0, __hypervisor_tlb_xcall_error -+ brnz,pn %o0, 1f - mov %o0, %g5 - sethi %hi(PAGE_SIZE), %o2 - brnz,pt %g3, 1b - sub %g3, %o2, %g3 -- mov %g2, %o0 -+5: mov %g2, %o0 - mov %g4, %o1 - mov %g7, %o2 - membar #Sync - retry -+1: sethi %hi(__hypervisor_tlb_xcall_error), %g4 -+ jmpl %g4 + %lo(__hypervisor_tlb_xcall_error), %g0 -+ nop -+2: mov %o3, %g1 -+ mov %o5, %g3 -+ mov 0, %o0 /* ARG0: CPU lists unimplemented */ -+ mov 0, %o1 /* ARG1: CPU lists unimplemented */ -+ mov 0, %o2 /* ARG2: mmu context == nucleus */ -+ mov HV_MMU_ALL, %o3 /* ARG3: flags */ -+ mov HV_FAST_MMU_DEMAP_CTX, %o5 -+ ta HV_FAST_TRAP -+ mov %g1, %o3 -+ brz,pt %o0, 5b -+ mov %g3, %o5 -+ mov HV_FAST_MMU_DEMAP_CTX, %g6 -+ ba,pt %xcc, 1b -+ clr %g5 - - /* These just get rescheduled to PIL vectors. */ - .globl xcall_call_function -@@ -809,6 +985,58 @@ xcall_kgdb_capture: - - #endif /* CONFIG_SMP */ - -+ .globl cheetah_patch_cachetlbops -+cheetah_patch_cachetlbops: -+ save %sp, -128, %sp -+ -+ sethi %hi(__flush_tlb_mm), %o0 -+ or %o0, %lo(__flush_tlb_mm), %o0 -+ sethi %hi(__cheetah_flush_tlb_mm), %o1 -+ or %o1, %lo(__cheetah_flush_tlb_mm), %o1 -+ call tlb_patch_one -+ mov 19, %o2 -+ -+ sethi %hi(__flush_tlb_page), %o0 -+ or %o0, %lo(__flush_tlb_page), %o0 -+ sethi %hi(__cheetah_flush_tlb_page), %o1 -+ or %o1, %lo(__cheetah_flush_tlb_page), %o1 -+ call tlb_patch_one -+ mov 22, %o2 -+ -+ sethi %hi(__flush_tlb_pending), %o0 -+ or %o0, %lo(__flush_tlb_pending), %o0 -+ sethi %hi(__cheetah_flush_tlb_pending), %o1 -+ or %o1, %lo(__cheetah_flush_tlb_pending), %o1 -+ call tlb_patch_one -+ mov 27, %o2 -+ -+ sethi %hi(__flush_tlb_kernel_range), %o0 -+ or %o0, %lo(__flush_tlb_kernel_range), %o0 -+ sethi %hi(__cheetah_flush_tlb_kernel_range), %o1 -+ or %o1, %lo(__cheetah_flush_tlb_kernel_range), %o1 -+ call tlb_patch_one -+ mov 31, %o2 -+ -+#ifdef DCACHE_ALIASING_POSSIBLE -+ sethi %hi(__flush_dcache_page), %o0 -+ or %o0, %lo(__flush_dcache_page), %o0 -+ sethi %hi(__cheetah_flush_dcache_page), %o1 -+ or %o1, %lo(__cheetah_flush_dcache_page), %o1 -+ call tlb_patch_one -+ mov 11, %o2 -+#endif /* DCACHE_ALIASING_POSSIBLE */ -+ -+#ifdef CONFIG_SMP -+ sethi %hi(xcall_flush_tlb_kernel_range), %o0 -+ or %o0, %lo(xcall_flush_tlb_kernel_range), %o0 -+ sethi %hi(__cheetah_xcall_flush_tlb_kernel_range), %o1 -+ or %o1, %lo(__cheetah_xcall_flush_tlb_kernel_range), %o1 -+ call tlb_patch_one -+ mov 44, %o2 -+#endif /* CONFIG_SMP */ -+ -+ ret -+ restore - - .globl hypervisor_patch_cachetlbops - hypervisor_patch_cachetlbops: -@@ -819,28 +1047,28 @@ hypervisor_patch_cachetlbops: - sethi %hi(__hypervisor_flush_tlb_mm), %o1 - or %o1, %lo(__hypervisor_flush_tlb_mm), %o1 - call tlb_patch_one -- mov 10, %o2 -+ mov 19, %o2 - - sethi %hi(__flush_tlb_page), %o0 - or %o0, %lo(__flush_tlb_page), %o0 - sethi %hi(__hypervisor_flush_tlb_page), %o1 - or %o1, %lo(__hypervisor_flush_tlb_page), %o1 - call tlb_patch_one -- mov 11, %o2 -+ mov 22, %o2 - - sethi %hi(__flush_tlb_pending), %o0 - or %o0, %lo(__flush_tlb_pending), %o0 - sethi %hi(__hypervisor_flush_tlb_pending), %o1 - or %o1, %lo(__hypervisor_flush_tlb_pending), %o1 - call tlb_patch_one -- mov 16, %o2 -+ mov 27, %o2 - - sethi %hi(__flush_tlb_kernel_range), %o0 - or %o0, %lo(__flush_tlb_kernel_range), %o0 - sethi %hi(__hypervisor_flush_tlb_kernel_range), %o1 - or %o1, %lo(__hypervisor_flush_tlb_kernel_range), %o1 - call tlb_patch_one -- mov 16, %o2 -+ mov 31, %o2 - - #ifdef DCACHE_ALIASING_POSSIBLE - sethi %hi(__flush_dcache_page), %o0 -@@ -857,21 +1085,21 @@ hypervisor_patch_cachetlbops: - sethi %hi(__hypervisor_xcall_flush_tlb_mm), %o1 - or %o1, %lo(__hypervisor_xcall_flush_tlb_mm), %o1 - call tlb_patch_one -- mov 21, %o2 -+ mov 24, %o2 - - sethi %hi(xcall_flush_tlb_page), %o0 - or %o0, %lo(xcall_flush_tlb_page), %o0 - sethi %hi(__hypervisor_xcall_flush_tlb_page), %o1 - or %o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1 - call tlb_patch_one -- mov 17, %o2 -+ mov 20, %o2 - - sethi %hi(xcall_flush_tlb_kernel_range), %o0 - or %o0, %lo(xcall_flush_tlb_kernel_range), %o0 - sethi %hi(__hypervisor_xcall_flush_tlb_kernel_range), %o1 - or %o1, %lo(__hypervisor_xcall_flush_tlb_kernel_range), %o1 - call tlb_patch_one -- mov 25, %o2 -+ mov 44, %o2 - #endif /* CONFIG_SMP */ - - ret -diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c -index c32f5d32f811..b56c9c581359 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.c -+++ b/drivers/net/ethernet/broadcom/bgmac.c -@@ -314,6 +314,10 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac, - u32 ctl; - - ctl = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_CTL); -+ -+ /* preserve ONLY bits 16-17 from current hardware value */ -+ ctl &= BGMAC_DMA_RX_ADDREXT_MASK; -+ - if (bgmac->core->id.rev >= 4) { - ctl &= ~BGMAC_DMA_RX_BL_MASK; - ctl |= BGMAC_DMA_RX_BL_128 << BGMAC_DMA_RX_BL_SHIFT; -@@ -324,7 +328,6 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac, - ctl &= ~BGMAC_DMA_RX_PT_MASK; - ctl |= BGMAC_DMA_RX_PT_1 << BGMAC_DMA_RX_PT_SHIFT; - } -- ctl &= BGMAC_DMA_RX_ADDREXT_MASK; - ctl |= BGMAC_DMA_RX_ENABLE; - ctl |= BGMAC_DMA_RX_PARITY_DISABLE; - ctl |= BGMAC_DMA_RX_OVERFLOW_CONT; -diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c -index ca0d3802f2af..4e603d060e80 100644 ---- a/drivers/tty/serial/sunhv.c -+++ b/drivers/tty/serial/sunhv.c -@@ -490,12 +490,6 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig - locked = spin_trylock_irqsave(&port->lock, flags); - else - spin_lock_irqsave(&port->lock, flags); -- if (port->sysrq) { -- locked = 0; -- } else if (oops_in_progress) { -- locked = spin_trylock(&port->lock); -- } else -- spin_lock(&port->lock); - - for (i = 0; i < n; i++) { - if (*s == '\n') -diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c -index 629e3c865072..9bee25cfa0be 100644 ---- a/drivers/tty/tty_ldisc.c -+++ b/drivers/tty/tty_ldisc.c -@@ -417,6 +417,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush); - * they are not on hot paths so a little discipline won't do - * any harm. - * -+ * The line discipline-related tty_struct fields are reset to -+ * prevent the ldisc driver from re-using stale information for -+ * the new ldisc instance. -+ * - * Locking: takes termios_rwsem - */ - -@@ -425,6 +429,9 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num) - down_write(&tty->termios_rwsem); - tty->termios.c_line = num; - up_write(&tty->termios_rwsem); -+ -+ tty->disc_data = NULL; -+ tty->receive_room = 0; - } - - /** -diff --git a/include/linux/filter.h b/include/linux/filter.h -index 5110d4211866..ccb98b459c59 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -421,7 +421,11 @@ static inline void bpf_prog_unlock_ro(struct bpf_prog *fp) - } - #endif /* CONFIG_DEBUG_SET_MODULE_RONX */ - --int sk_filter(struct sock *sk, struct sk_buff *skb); -+int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap); -+static inline int sk_filter(struct sock *sk, struct sk_buff *skb) -+{ -+ return sk_filter_trim_cap(sk, skb, 1); -+} - - int bpf_prog_select_runtime(struct bpf_prog *fp); - void bpf_prog_free(struct bpf_prog *fp); -diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h -index ff788b665277..9c2c044153f6 100644 ---- a/include/net/ip6_tunnel.h -+++ b/include/net/ip6_tunnel.h -@@ -86,6 +86,7 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb, - struct net_device_stats *stats = &dev->stats; - int pkt_len, err; - -+ memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); - pkt_len = skb->len - skb_inner_network_offset(skb); - err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb); - -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 9c3ab544d3a8..e9d7a8ef9a6d 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1156,6 +1156,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp) - } - - bool tcp_prequeue(struct sock *sk, struct sk_buff *skb); -+int tcp_filter(struct sock *sk, struct sk_buff *skb); - - #undef STATE_TRACE - -diff --git a/net/core/dev.c b/net/core/dev.c -index b3fa4b86ab4c..9ca749c81b6c 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2462,7 +2462,7 @@ int skb_checksum_help(struct sk_buff *skb) - goto out; - } - -- *(__sum16 *)(skb->data + offset) = csum_fold(csum); -+ *(__sum16 *)(skb->data + offset) = csum_fold(csum) ?: CSUM_MANGLED_0; - out_set_summed: - skb->ip_summed = CHECKSUM_NONE; - out: -diff --git a/net/core/filter.c b/net/core/filter.c -index 75e9b2b2336d..e94355452166 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -52,9 +52,10 @@ - #include - - /** -- * sk_filter - run a packet through a socket filter -+ * sk_filter_trim_cap - run a packet through a socket filter - * @sk: sock associated with &sk_buff - * @skb: buffer to filter -+ * @cap: limit on how short the eBPF program may trim the packet - * - * Run the eBPF program and then cut skb->data to correct size returned by - * the program. If pkt_len is 0 we toss packet. If skb->len is smaller -@@ -63,7 +64,7 @@ - * be accepted or -EPERM if the packet should be tossed. - * - */ --int sk_filter(struct sock *sk, struct sk_buff *skb) -+int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap) - { - int err; - struct sk_filter *filter; -@@ -84,14 +85,13 @@ int sk_filter(struct sock *sk, struct sk_buff *skb) - filter = rcu_dereference(sk->sk_filter); - if (filter) { - unsigned int pkt_len = bpf_prog_run_save_cb(filter->prog, skb); -- -- err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM; -+ err = pkt_len ? pskb_trim(skb, max(cap, pkt_len)) : -EPERM; - } - rcu_read_unlock(); - - return err; - } --EXPORT_SYMBOL(sk_filter); -+EXPORT_SYMBOL(sk_filter_trim_cap); - - static u64 __skb_get_pay_offset(u64 ctx, u64 a, u64 x, u64 r4, u64 r5) - { -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 4ab6ead3d8ee..9aba9e93c0a2 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -131,7 +131,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb, - struct flow_dissector_key_tags *key_tags; - struct flow_dissector_key_keyid *key_keyid; - u8 ip_proto = 0; -- bool ret = false; -+ bool ret; - - if (!data) { - data = skb->data; -@@ -492,12 +492,17 @@ ip_proto_again: - out_good: - ret = true; - --out_bad: -+ key_control->thoff = (u16)nhoff; -+out: - key_basic->n_proto = proto; - key_basic->ip_proto = ip_proto; -- key_control->thoff = (u16)nhoff; - - return ret; -+ -+out_bad: -+ ret = false; -+ key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); -+ goto out; - } - EXPORT_SYMBOL(__skb_flow_dissect); - -diff --git a/net/core/sock.c b/net/core/sock.c -index 0d91f7dca751..88f017854509 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1562,6 +1562,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - } - - newsk->sk_err = 0; -+ newsk->sk_err_soft = 0; - newsk->sk_priority = 0; - newsk->sk_incoming_cpu = raw_smp_processor_id(); - atomic64_set(&newsk->sk_cookie, 0); -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 8be8f27bfacc..861e1fa25d5e 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -235,7 +235,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info) - { - const struct iphdr *iph = (struct iphdr *)skb->data; - const u8 offset = iph->ihl << 2; -- const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset); -+ const struct dccp_hdr *dh; - struct dccp_sock *dp; - struct inet_sock *inet; - const int type = icmp_hdr(skb)->type; -@@ -245,11 +245,13 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info) - int err; - struct net *net = dev_net(skb->dev); - -- if (skb->len < offset + sizeof(*dh) || -- skb->len < offset + __dccp_basic_hdr_len(dh)) { -- ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS); -- return; -- } -+ /* Only need dccph_dport & dccph_sport which are the first -+ * 4 bytes in dccp header. -+ * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. -+ */ -+ BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8); -+ BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); -+ dh = (struct dccp_hdr *)(skb->data + offset); - - sk = __inet_lookup_established(net, &dccp_hashinfo, - iph->daddr, dh->dccph_dport, -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index b8608b71a66d..27c4e81efa24 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -70,7 +70,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - u8 type, u8 code, int offset, __be32 info) - { - const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data; -- const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset); -+ const struct dccp_hdr *dh; - struct dccp_sock *dp; - struct ipv6_pinfo *np; - struct sock *sk; -@@ -78,12 +78,13 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - __u64 seq; - struct net *net = dev_net(skb->dev); - -- if (skb->len < offset + sizeof(*dh) || -- skb->len < offset + __dccp_basic_hdr_len(dh)) { -- ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev), -- ICMP6_MIB_INERRORS); -- return; -- } -+ /* Only need dccph_dport & dccph_sport which are the first -+ * 4 bytes in dccp header. -+ * Our caller (icmpv6_notify()) already pulled 8 bytes for us. -+ */ -+ BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8); -+ BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); -+ dh = (struct dccp_hdr *)(skb->data + offset); - - sk = __inet6_lookup_established(net, &dccp_hashinfo, - &hdr->daddr, dh->dccph_dport, -@@ -947,6 +948,7 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = { - .getsockopt = ipv6_getsockopt, - .addr2sockaddr = inet6_csk_addr2sockaddr, - .sockaddr_len = sizeof(struct sockaddr_in6), -+ .bind_conflict = inet6_csk_bind_conflict, - #ifdef CONFIG_COMPAT - .compat_setsockopt = compat_ipv6_setsockopt, - .compat_getsockopt = compat_ipv6_getsockopt, -diff --git a/net/dccp/proto.c b/net/dccp/proto.c -index 41e65804ddf5..9fe25bf63296 100644 ---- a/net/dccp/proto.c -+++ b/net/dccp/proto.c -@@ -1009,6 +1009,10 @@ void dccp_close(struct sock *sk, long timeout) - __kfree_skb(skb); - } - -+ /* If socket has been already reset kill it. */ -+ if (sk->sk_state == DCCP_CLOSED) -+ goto adjudge_to_death; -+ - if (data_was_unread) { - /* Unread data was tossed, send an appropriate Reset Code */ - DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread); -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index e5a3ff210fec..7c52afb98c42 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -2456,22 +2456,19 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, - struct key_vector *l, **tp = &iter->tnode; - t_key key; - -- /* use cache location of next-to-find key */ -+ /* use cached location of previously found key */ - if (iter->pos > 0 && pos >= iter->pos) { -- pos -= iter->pos; - key = iter->key; - } else { -- iter->pos = 0; -+ iter->pos = 1; - key = 0; - } - -- while ((l = leaf_walk_rcu(tp, key)) != NULL) { -+ pos -= iter->pos; -+ -+ while ((l = leaf_walk_rcu(tp, key)) && (pos-- > 0)) { - key = l->key + 1; - iter->pos++; -- -- if (--pos <= 0) -- break; -- - l = NULL; - - /* handle unlikely case of a key wrap */ -@@ -2480,7 +2477,7 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, - } - - if (l) -- iter->key = key; /* remember it */ -+ iter->key = l->key; /* remember it */ - else - iter->pos = 0; /* forget it */ - -@@ -2508,7 +2505,7 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos) - return fib_route_get_idx(iter, *pos); - - iter->pos = 0; -- iter->key = 0; -+ iter->key = KEY_MAX; - - return SEQ_START_TOKEN; - } -@@ -2517,7 +2514,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { - struct fib_route_iter *iter = seq->private; - struct key_vector *l = NULL; -- t_key key = iter->key; -+ t_key key = iter->key + 1; - - ++*pos; - -@@ -2526,7 +2523,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos) - l = leaf_walk_rcu(&iter->tnode, key); - - if (l) { -- iter->key = l->key + 1; -+ iter->key = l->key; - iter->pos++; - } else { - iter->pos = 0; -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 8533a75a9328..7ceb8a574a50 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -747,7 +747,9 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow - goto reject_redirect; - } - -- n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw); -+ n = __ipv4_neigh_lookup(rt->dst.dev, new_gw); -+ if (!n) -+ n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev); - if (!IS_ERR(n)) { - if (!(n->nud_state & NUD_VALID)) { - neigh_event_send(n, NULL); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 036a76ba2ac2..69daa81736f6 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1212,7 +1212,7 @@ new_segment: - - if (!skb_can_coalesce(skb, i, pfrag->page, - pfrag->offset)) { -- if (i == sysctl_max_skb_frags || !sg) { -+ if (i >= sysctl_max_skb_frags || !sg) { - tcp_mark_push(tp, skb); - goto new_segment; - } -diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c -index 7e538f71f5fb..55d7da1d2ce9 100644 ---- a/net/ipv4/tcp_dctcp.c -+++ b/net/ipv4/tcp_dctcp.c -@@ -56,6 +56,7 @@ struct dctcp { - u32 next_seq; - u32 ce_state; - u32 delayed_ack_reserved; -+ u32 loss_cwnd; - }; - - static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */ -@@ -96,6 +97,7 @@ static void dctcp_init(struct sock *sk) - ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA); - - ca->delayed_ack_reserved = 0; -+ ca->loss_cwnd = 0; - ca->ce_state = 0; - - dctcp_reset(tp, ca); -@@ -111,9 +113,10 @@ static void dctcp_init(struct sock *sk) - - static u32 dctcp_ssthresh(struct sock *sk) - { -- const struct dctcp *ca = inet_csk_ca(sk); -+ struct dctcp *ca = inet_csk_ca(sk); - struct tcp_sock *tp = tcp_sk(sk); - -+ ca->loss_cwnd = tp->snd_cwnd; - return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->dctcp_alpha) >> 11U), 2U); - } - -@@ -308,12 +311,20 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr, - return 0; - } - -+static u32 dctcp_cwnd_undo(struct sock *sk) -+{ -+ const struct dctcp *ca = inet_csk_ca(sk); -+ -+ return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd); -+} -+ - static struct tcp_congestion_ops dctcp __read_mostly = { - .init = dctcp_init, - .in_ack_event = dctcp_update_alpha, - .cwnd_event = dctcp_cwnd_event, - .ssthresh = dctcp_ssthresh, - .cong_avoid = tcp_reno_cong_avoid, -+ .undo_cwnd = dctcp_cwnd_undo, - .set_state = dctcp_state, - .get_info = dctcp_get_info, - .flags = TCP_CONG_NEEDS_ECN, -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index b5853cac3269..b58a38eea059 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1533,6 +1533,21 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb) - } - EXPORT_SYMBOL(tcp_prequeue); - -+int tcp_filter(struct sock *sk, struct sk_buff *skb) -+{ -+ struct tcphdr *th = (struct tcphdr *)skb->data; -+ unsigned int eaten = skb->len; -+ int err; -+ -+ err = sk_filter_trim_cap(sk, skb, th->doff * 4); -+ if (!err) { -+ eaten -= skb->len; -+ TCP_SKB_CB(skb)->end_seq -= eaten; -+ } -+ return err; -+} -+EXPORT_SYMBOL(tcp_filter); -+ - /* - * From tcp_input.c - */ -@@ -1638,8 +1653,10 @@ process: - - nf_reset(skb); - -- if (sk_filter(sk, skb)) -+ if (tcp_filter(sk, skb)) - goto discard_and_relse; -+ th = (const struct tcphdr *)skb->data; -+ iph = ip_hdr(skb); - - skb->dev = NULL; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index fbd521fdae53..5f581616bf6a 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1214,7 +1214,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) - if (skb->protocol == htons(ETH_P_IP)) - return tcp_v4_do_rcv(sk, skb); - -- if (sk_filter(sk, skb)) -+ if (tcp_filter(sk, skb)) - goto discard; - - /* -@@ -1438,8 +1438,10 @@ process: - if (tcp_v6_inbound_md5_hash(sk, skb)) - goto discard_and_relse; - -- if (sk_filter(sk, skb)) -+ if (tcp_filter(sk, skb)) - goto discard_and_relse; -+ th = (const struct tcphdr *)skb->data; -+ hdr = ipv6_hdr(skb); - - skb->dev = NULL; - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 402817be3873..b5fd4ab56156 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1212,9 +1212,12 @@ static int __sctp_connect(struct sock *sk, - - timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK); - -- err = sctp_wait_for_connect(asoc, &timeo); -- if ((err == 0 || err == -EINPROGRESS) && assoc_id) -+ if (assoc_id) - *assoc_id = asoc->assoc_id; -+ err = sctp_wait_for_connect(asoc, &timeo); -+ /* Note: the asoc may be freed after the return of -+ * sctp_wait_for_connect. -+ */ - - /* Don't free association on exit. */ - asoc = NULL; -diff --git a/net/socket.c b/net/socket.c -index 263b334ec5e4..0090225eeb1e 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2041,6 +2041,8 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, - if (err) - break; - ++datagrams; -+ if (msg_data_left(&msg_sys)) -+ break; - } - - fput_light(sock->file, fput_needed); diff --git a/patch/kernel/mvebu-default/patch-4.4.34-35.patch b/patch/kernel/mvebu-default/patch-4.4.34-35.patch deleted file mode 100644 index f5839b23d..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.34-35.patch +++ /dev/null @@ -1,1167 +0,0 @@ -diff --git a/Makefile b/Makefile -index 30924aabf1b4..f88830af1533 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 34 -+SUBLEVEL = 35 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -395,11 +395,12 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ - -fno-strict-aliasing -fno-common \ - -Werror-implicit-function-declaration \ - -Wno-format-security \ -- -std=gnu89 -+ -std=gnu89 $(call cc-option,-fno-PIE) -+ - - KBUILD_AFLAGS_KERNEL := - KBUILD_CFLAGS_KERNEL := --KBUILD_AFLAGS := -D__ASSEMBLY__ -+KBUILD_AFLAGS := -D__ASSEMBLY__ $(call cc-option,-fno-PIE) - KBUILD_AFLAGS_MODULE := -DMODULE - KBUILD_CFLAGS_MODULE := -DMODULE - KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 6cb5834062a3..e2defc7593a4 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -352,7 +352,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) - #ifdef CONFIG_SMP - unsigned bits; - int cpu = smp_processor_id(); -- unsigned int socket_id, core_complex_id; - - bits = c->x86_coreid_bits; - /* Low order bits define the core id (index of core in socket) */ -@@ -370,10 +369,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) - if (c->x86 != 0x17 || !cpuid_edx(0x80000006)) - return; - -- socket_id = (c->apicid >> bits) - 1; -- core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3; -- -- per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id; -+ per_cpu(cpu_llc_id, cpu) = c->apicid >> 3; - #endif - } - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 685ef431a41d..7429d481a311 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -199,7 +199,18 @@ static void kvm_on_user_return(struct user_return_notifier *urn) - struct kvm_shared_msrs *locals - = container_of(urn, struct kvm_shared_msrs, urn); - struct kvm_shared_msr_values *values; -+ unsigned long flags; - -+ /* -+ * Disabling irqs at this point since the following code could be -+ * interrupted and executed through kvm_arch_hardware_disable() -+ */ -+ local_irq_save(flags); -+ if (locals->registered) { -+ locals->registered = false; -+ user_return_notifier_unregister(urn); -+ } -+ local_irq_restore(flags); - for (slot = 0; slot < shared_msrs_global.nr; ++slot) { - values = &locals->values[slot]; - if (values->host != values->curr) { -@@ -207,8 +218,6 @@ static void kvm_on_user_return(struct user_return_notifier *urn) - values->curr = values->host; - } - } -- locals->registered = false; -- user_return_notifier_unregister(urn); - } - - static void shared_msr_update(unsigned slot, u32 msr) -@@ -3317,6 +3326,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - }; - case KVM_SET_VAPIC_ADDR: { - struct kvm_vapic_addr va; -+ int idx; - - r = -EINVAL; - if (!lapic_in_kernel(vcpu)) -@@ -3324,7 +3334,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - r = -EFAULT; - if (copy_from_user(&va, argp, sizeof va)) - goto out; -+ idx = srcu_read_lock(&vcpu->kvm->srcu); - r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr); -+ srcu_read_unlock(&vcpu->kvm->srcu, idx); - break; - } - case KVM_X86_SETUP_MCE: { -diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile -index 2c835e356349..d445c5f1aeb1 100644 ---- a/arch/x86/purgatory/Makefile -+++ b/arch/x86/purgatory/Makefile -@@ -12,6 +12,7 @@ targets += purgatory.ro - - KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large - KBUILD_CFLAGS += -m$(BITS) -+KBUILD_CFLAGS += $(call cc-option,-fno-PIE) - - $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE - $(call if_changed,ld) -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index ae60e6357d7b..e9b713675c7c 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1022,6 +1022,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a - TRACE_DEVICE(dev); - TRACE_SUSPEND(0); - -+ dpm_wait_for_children(dev, async); -+ - if (async_error) - goto Complete; - -@@ -1033,8 +1035,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a - if (dev->power.syscore || dev->power.direct_complete) - goto Complete; - -- dpm_wait_for_children(dev, async); -- - if (dev->pm_domain) { - info = "noirq power domain "; - callback = pm_noirq_op(&dev->pm_domain->ops, state); -@@ -1169,6 +1169,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as - - __pm_runtime_disable(dev, false); - -+ dpm_wait_for_children(dev, async); -+ - if (async_error) - goto Complete; - -@@ -1180,8 +1182,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as - if (dev->power.syscore || dev->power.direct_complete) - goto Complete; - -- dpm_wait_for_children(dev, async); -- - if (dev->pm_domain) { - info = "late power domain "; - callback = pm_late_early_op(&dev->pm_domain->ops, state); -diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c -index 251533d87c65..f261b1d292c7 100644 ---- a/drivers/clk/mmp/clk-of-mmp2.c -+++ b/drivers/clk/mmp/clk-of-mmp2.c -@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c -index 64eaf4141c69..427f4bb08665 100644 ---- a/drivers/clk/mmp/clk-of-pxa168.c -+++ b/drivers/clk/mmp/clk-of-pxa168.c -@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c -index 13d6173326a4..cdf5ba566d3b 100644 ---- a/drivers/clk/mmp/clk-of-pxa910.c -+++ b/drivers/clk/mmp/clk-of-pxa910.c -@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np) - } - - pxa_unit->apbcp_base = of_iomap(np, 3); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apbcp_base) { - pr_err("failed to map apbcp registers\n"); - return; - } -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index b3044219772c..2cde3796cb82 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -4542,6 +4542,15 @@ static int __init caam_algapi_init(void) - if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) - continue; - -+ /* -+ * Check support for AES modes not available -+ * on LP devices. -+ */ -+ if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP) -+ if ((alg->class1_alg_type & OP_ALG_AAI_MASK) == -+ OP_ALG_AAI_XTS) -+ continue; -+ - t_alg = caam_alg_alloc(alg); - if (IS_ERR(t_alg)) { - err = PTR_ERR(t_alg); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index ff5566c69f7d..e8e962f7b5cb 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -532,6 +532,7 @@ struct amdgpu_bo { - u64 metadata_flags; - void *metadata; - u32 metadata_size; -+ unsigned prime_shared_count; - /* list of all virtual address to which this bo - * is associated to - */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -index f82a2dd83874..3c7a7235988d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -@@ -117,7 +117,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev, - entry->allowed_domains = AMDGPU_GEM_DOMAIN_GTT; - } - entry->tv.bo = &entry->robj->tbo; -- entry->tv.shared = true; -+ entry->tv.shared = !entry->robj->prime_shared_count; - - if (entry->prefered_domains == AMDGPU_GEM_DOMAIN_GDS) - gds_obj = entry->robj; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -index 59f735a933a9..e6a7d30c3747 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -@@ -77,20 +77,36 @@ struct drm_gem_object *amdgpu_gem_prime_import_sg_table(struct drm_device *dev, - list_add_tail(&bo->list, &adev->gem.objects); - mutex_unlock(&adev->gem.mutex); - -+ bo->prime_shared_count = 1; - return &bo->gem_base; - } - - int amdgpu_gem_prime_pin(struct drm_gem_object *obj) - { - struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); -- int ret = 0; -+ long ret = 0; - - ret = amdgpu_bo_reserve(bo, false); - if (unlikely(ret != 0)) - return ret; - -+ /* -+ * Wait for all shared fences to complete before we switch to future -+ * use of exclusive fence on this prime shared bo. -+ */ -+ ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false, -+ MAX_SCHEDULE_TIMEOUT); -+ if (unlikely(ret < 0)) { -+ DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret); -+ amdgpu_bo_unreserve(bo); -+ return ret; -+ } -+ - /* pin buffer into GTT */ - ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL); -+ if (likely(ret == 0)) -+ bo->prime_shared_count++; -+ - amdgpu_bo_unreserve(bo); - return ret; - } -@@ -105,6 +121,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj) - return; - - amdgpu_bo_unpin(bo); -+ if (bo->prime_shared_count) -+ bo->prime_shared_count--; - amdgpu_bo_unreserve(bo); - } - -diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig -index 78fbee463628..65dbde778181 100644 ---- a/drivers/i2c/Kconfig -+++ b/drivers/i2c/Kconfig -@@ -59,7 +59,6 @@ config I2C_CHARDEV - - config I2C_MUX - tristate "I2C bus multiplexing support" -- depends on HAS_IOMEM - help - Say Y here if you want the I2C core to support the ability to - handle multiplexed I2C bus topologies, by presenting each -diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig -index f06b0e24673b..af2a63cb4056 100644 ---- a/drivers/i2c/muxes/Kconfig -+++ b/drivers/i2c/muxes/Kconfig -@@ -63,6 +63,7 @@ config I2C_MUX_PINCTRL - - config I2C_MUX_REG - tristate "Register-based I2C multiplexer" -+ depends on HAS_IOMEM - help - If you say yes to this option, support will be included for a - register based I2C multiplexer. This driver provides access to -diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c -index 4d8e7f18a9af..941cd9b83941 100644 ---- a/drivers/infiniband/core/cm.c -+++ b/drivers/infiniband/core/cm.c -@@ -80,6 +80,8 @@ static struct ib_cm { - __be32 random_id_operand; - struct list_head timewait_list; - struct workqueue_struct *wq; -+ /* Sync on cm change port state */ -+ spinlock_t state_lock; - } cm; - - /* Counter indexes ordered by attribute ID */ -@@ -161,6 +163,8 @@ struct cm_port { - struct ib_mad_agent *mad_agent; - struct kobject port_obj; - u8 port_num; -+ struct list_head cm_priv_prim_list; -+ struct list_head cm_priv_altr_list; - struct cm_counter_group counter_group[CM_COUNTER_GROUPS]; - }; - -@@ -241,6 +245,12 @@ struct cm_id_private { - u8 service_timeout; - u8 target_ack_delay; - -+ struct list_head prim_list; -+ struct list_head altr_list; -+ /* Indicates that the send port mad is registered and av is set */ -+ int prim_send_port_not_ready; -+ int altr_send_port_not_ready; -+ - struct list_head work_list; - atomic_t work_count; - }; -@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, - struct ib_mad_agent *mad_agent; - struct ib_mad_send_buf *m; - struct ib_ah *ah; -+ struct cm_av *av; -+ unsigned long flags, flags2; -+ int ret = 0; - -+ /* don't let the port to be released till the agent is down */ -+ spin_lock_irqsave(&cm.state_lock, flags2); -+ spin_lock_irqsave(&cm.lock, flags); -+ if (!cm_id_priv->prim_send_port_not_ready) -+ av = &cm_id_priv->av; -+ else if (!cm_id_priv->altr_send_port_not_ready && -+ (cm_id_priv->alt_av.port)) -+ av = &cm_id_priv->alt_av; -+ else { -+ pr_info("%s: not valid CM id\n", __func__); -+ ret = -ENODEV; -+ spin_unlock_irqrestore(&cm.lock, flags); -+ goto out; -+ } -+ spin_unlock_irqrestore(&cm.lock, flags); -+ /* Make sure the port haven't released the mad yet */ - mad_agent = cm_id_priv->av.port->mad_agent; -- ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr); -- if (IS_ERR(ah)) -- return PTR_ERR(ah); -+ if (!mad_agent) { -+ pr_info("%s: not a valid MAD agent\n", __func__); -+ ret = -ENODEV; -+ goto out; -+ } -+ ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr); -+ if (IS_ERR(ah)) { -+ ret = PTR_ERR(ah); -+ goto out; -+ } - - m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn, -- cm_id_priv->av.pkey_index, -+ av->pkey_index, - 0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA, - GFP_ATOMIC, - IB_MGMT_BASE_VERSION); - if (IS_ERR(m)) { - ib_destroy_ah(ah); -- return PTR_ERR(m); -+ ret = PTR_ERR(m); -+ goto out; - } - - /* Timeout set by caller if response is expected. */ -@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, - atomic_inc(&cm_id_priv->refcount); - m->context[0] = cm_id_priv; - *msg = m; -- return 0; -+ -+out: -+ spin_unlock_irqrestore(&cm.state_lock, flags2); -+ return ret; - } - - static int cm_alloc_response_msg(struct cm_port *port, -@@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc, - grh, &av->ah_attr); - } - --static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) -+static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av, -+ struct cm_id_private *cm_id_priv) - { - struct cm_device *cm_dev; - struct cm_port *port = NULL; -@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) - &av->ah_attr); - av->timeout = path->packet_life_time + 1; - -- return 0; -+ spin_lock_irqsave(&cm.lock, flags); -+ if (&cm_id_priv->av == av) -+ list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list); -+ else if (&cm_id_priv->alt_av == av) -+ list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list); -+ else -+ ret = -EINVAL; -+ -+ spin_unlock_irqrestore(&cm.lock, flags); -+ -+ return ret; - } - - static int cm_alloc_id(struct cm_id_private *cm_id_priv) -@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device, - spin_lock_init(&cm_id_priv->lock); - init_completion(&cm_id_priv->comp); - INIT_LIST_HEAD(&cm_id_priv->work_list); -+ INIT_LIST_HEAD(&cm_id_priv->prim_list); -+ INIT_LIST_HEAD(&cm_id_priv->altr_list); - atomic_set(&cm_id_priv->work_count, -1); - atomic_set(&cm_id_priv->refcount, 1); - return &cm_id_priv->id; -@@ -892,6 +945,15 @@ retest: - break; - } - -+ spin_lock_irq(&cm.lock); -+ if (!list_empty(&cm_id_priv->altr_list) && -+ (!cm_id_priv->altr_send_port_not_ready)) -+ list_del(&cm_id_priv->altr_list); -+ if (!list_empty(&cm_id_priv->prim_list) && -+ (!cm_id_priv->prim_send_port_not_ready)) -+ list_del(&cm_id_priv->prim_list); -+ spin_unlock_irq(&cm.lock); -+ - cm_free_id(cm_id->local_id); - cm_deref_id(cm_id_priv); - wait_for_completion(&cm_id_priv->comp); -@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, - goto out; - } - -- ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av); -+ ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av, -+ cm_id_priv); - if (ret) - goto error1; - if (param->alternate_path) { - ret = cm_init_av_by_path(param->alternate_path, -- &cm_id_priv->alt_av); -+ &cm_id_priv->alt_av, cm_id_priv); - if (ret) - goto error1; - } -@@ -1639,7 +1702,8 @@ static int cm_req_handler(struct cm_work *work) - cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]); - - memcpy(work->path[0].dmac, cm_id_priv->av.ah_attr.dmac, ETH_ALEN); -- ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av); -+ ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av, -+ cm_id_priv); - if (ret) { - ib_get_cached_gid(work->port->cm_dev->ib_device, - work->port->port_num, 0, &work->path[0].sgid, -@@ -1650,7 +1714,8 @@ static int cm_req_handler(struct cm_work *work) - goto rejected; - } - if (req_msg->alt_local_lid) { -- ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av); -+ ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av, -+ cm_id_priv); - if (ret) { - ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID, - &work->path[0].sgid, -@@ -2705,7 +2770,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id, - goto out; - } - -- ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av); -+ ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av, -+ cm_id_priv); - if (ret) - goto out; - cm_id_priv->alt_av.timeout = -@@ -2817,7 +2883,8 @@ static int cm_lap_handler(struct cm_work *work) - cm_init_av_for_response(work->port, work->mad_recv_wc->wc, - work->mad_recv_wc->recv_buf.grh, - &cm_id_priv->av); -- cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av); -+ cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av, -+ cm_id_priv); - ret = atomic_inc_and_test(&cm_id_priv->work_count); - if (!ret) - list_add_tail(&work->list, &cm_id_priv->work_list); -@@ -3009,7 +3076,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id, - return -EINVAL; - - cm_id_priv = container_of(cm_id, struct cm_id_private, id); -- ret = cm_init_av_by_path(param->path, &cm_id_priv->av); -+ ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv); - if (ret) - goto out; - -@@ -3446,7 +3513,9 @@ out: - static int cm_migrate(struct ib_cm_id *cm_id) - { - struct cm_id_private *cm_id_priv; -+ struct cm_av tmp_av; - unsigned long flags; -+ int tmp_send_port_not_ready; - int ret = 0; - - cm_id_priv = container_of(cm_id, struct cm_id_private, id); -@@ -3455,7 +3524,14 @@ static int cm_migrate(struct ib_cm_id *cm_id) - (cm_id->lap_state == IB_CM_LAP_UNINIT || - cm_id->lap_state == IB_CM_LAP_IDLE)) { - cm_id->lap_state = IB_CM_LAP_IDLE; -+ /* Swap address vector */ -+ tmp_av = cm_id_priv->av; - cm_id_priv->av = cm_id_priv->alt_av; -+ cm_id_priv->alt_av = tmp_av; -+ /* Swap port send ready state */ -+ tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready; -+ cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready; -+ cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready; - } else - ret = -EINVAL; - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -@@ -3875,6 +3951,9 @@ static void cm_add_one(struct ib_device *ib_device) - port->cm_dev = cm_dev; - port->port_num = i; - -+ INIT_LIST_HEAD(&port->cm_priv_prim_list); -+ INIT_LIST_HEAD(&port->cm_priv_altr_list); -+ - ret = cm_create_port_fs(port); - if (ret) - goto error1; -@@ -3932,6 +4011,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) - { - struct cm_device *cm_dev = client_data; - struct cm_port *port; -+ struct cm_id_private *cm_id_priv; -+ struct ib_mad_agent *cur_mad_agent; - struct ib_port_modify port_modify = { - .clr_port_cap_mask = IB_PORT_CM_SUP - }; -@@ -3955,15 +4036,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) - - port = cm_dev->port[i-1]; - ib_modify_port(ib_device, port->port_num, 0, &port_modify); -+ /* Mark all the cm_id's as not valid */ -+ spin_lock_irq(&cm.lock); -+ list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list) -+ cm_id_priv->altr_send_port_not_ready = 1; -+ list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list) -+ cm_id_priv->prim_send_port_not_ready = 1; -+ spin_unlock_irq(&cm.lock); - /* - * We flush the queue here after the going_down set, this - * verify that no new works will be queued in the recv handler, - * after that we can call the unregister_mad_agent - */ - flush_workqueue(cm.wq); -- ib_unregister_mad_agent(port->mad_agent); -+ spin_lock_irq(&cm.state_lock); -+ cur_mad_agent = port->mad_agent; -+ port->mad_agent = NULL; -+ spin_unlock_irq(&cm.state_lock); -+ ib_unregister_mad_agent(cur_mad_agent); - cm_remove_port_fs(port); - } -+ - device_unregister(cm_dev->device); - kfree(cm_dev); - } -@@ -3976,6 +4069,7 @@ static int __init ib_cm_init(void) - INIT_LIST_HEAD(&cm.device_list); - rwlock_init(&cm.device_lock); - spin_lock_init(&cm.lock); -+ spin_lock_init(&cm.state_lock); - cm.listen_service_table = RB_ROOT; - cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID); - cm.remote_id_table = RB_ROOT; -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index 38acb3cfc545..04f3c0db9126 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - - cur_base = addr & PAGE_MASK; - -- if (npages == 0) { -+ if (npages == 0 || npages > UINT_MAX) { - ret = -EINVAL; - goto out; - } -diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c -index d625c82d6c82..7becef27cbbe 100644 ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -244,12 +244,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, - container_of(uobj, struct ib_uqp_object, uevent.uobject); - - idr_remove_uobj(&ib_uverbs_qp_idr, uobj); -- if (qp != qp->real_qp) { -- ib_close_qp(qp); -- } else { -+ if (qp == qp->real_qp) - ib_uverbs_detach_umcast(qp, uqp); -- ib_destroy_qp(qp); -- } -+ ib_destroy_qp(qp); - ib_uverbs_release_uevent(file, &uqp->uevent); - kfree(uqp); - } -diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c -index 06da56bda201..c007c766c61e 100644 ---- a/drivers/infiniband/hw/mlx4/ah.c -+++ b/drivers/infiniband/hw/mlx4/ah.c -@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr - if (vlan_tag < 0x1000) - vlan_tag |= (ah_attr->sl & 7) << 13; - ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24)); -- ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); -+ ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ ah->av.eth.gid_index = ret; - ah->av.eth.vlan = cpu_to_be16(vlan_tag); - if (ah_attr->static_rate) { - ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET; -diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c -index b88fc8f5ab18..57e1a08925d9 100644 ---- a/drivers/infiniband/hw/mlx4/cq.c -+++ b/drivers/infiniband/hw/mlx4/cq.c -@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev, - if (context) - if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) { - err = -EFAULT; -- goto err_dbmap; -+ goto err_cq_free; - } - - return &cq->ibcq; - -+err_cq_free: -+ mlx4_cq_free(dev->dev, &cq->mcq); -+ - err_dbmap: - if (context) - mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db); -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index 8184267c7901..02c8deab1fff 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -787,8 +787,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev, - if (err) - goto err_create; - } else { -- /* for now choose 64 bytes till we have a proper interface */ -- cqe_size = 64; -+ cqe_size = cache_line_size() == 128 ? 128 : 64; - err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb, - &index, &inlen); - if (err) -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index bfc940ff9c8a..2a1fdcaa3044 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -947,13 +947,13 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, - { - struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context; - struct ib_event ibev; -- -+ bool fatal = false; - u8 port = 0; - - switch (event) { - case MLX5_DEV_EVENT_SYS_ERROR: -- ibdev->ib_active = false; - ibev.event = IB_EVENT_DEVICE_FATAL; -+ fatal = true; - break; - - case MLX5_DEV_EVENT_PORT_UP: -@@ -998,6 +998,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, - - if (ibdev->ib_active) - ib_dispatch_event(&ibev); -+ -+ if (fatal) -+ ibdev->ib_active = false; - } - - static void get_ext_port_caps(struct mlx5_ib_dev *dev) -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index 88e80ec772f6..fe89e5e337d5 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -494,9 +494,6 @@ int intel_lpss_suspend(struct device *dev) - for (i = 0; i < LPSS_PRIV_REG_COUNT; i++) - lpss->priv_ctx[i] = readl(lpss->priv + i * 4); - -- /* Put the device into reset state */ -- writel(0, lpss->priv + LPSS_PRIV_RESETS); -- - return 0; - } - EXPORT_SYMBOL_GPL(intel_lpss_suspend); -diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c -index 60b60dc63ddd..022c9374ce8b 100644 ---- a/drivers/mfd/mfd-core.c -+++ b/drivers/mfd/mfd-core.c -@@ -354,6 +354,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones) - clones[i]); - } - -+ put_device(dev); -+ - return 0; - } - EXPORT_SYMBOL(mfd_clone_cell); -diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c -index d58c094f2f04..f7e6a09926dd 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c -@@ -475,48 +475,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids); - - #ifdef CONFIG_ACPI --#define SPL_METHOD "SPLC" --#define SPL_DOMAINTYPE_MODULE BIT(0) --#define SPL_DOMAINTYPE_WIFI BIT(1) --#define SPL_DOMAINTYPE_WIGIG BIT(2) --#define SPL_DOMAINTYPE_RFEM BIT(3) -+#define ACPI_SPLC_METHOD "SPLC" -+#define ACPI_SPLC_DOMAIN_WIFI (0x07) - --static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx) -+static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc) - { -- union acpi_object *limits, *domain_type, *power_limit; -- -- if (splx->type != ACPI_TYPE_PACKAGE || -- splx->package.count != 2 || -- splx->package.elements[0].type != ACPI_TYPE_INTEGER || -- splx->package.elements[0].integer.value != 0) { -- IWL_ERR(trans, "Unsupported splx structure\n"); -+ union acpi_object *data_pkg, *dflt_pwr_limit; -+ int i; -+ -+ /* We need at least two elements, one for the revision and one -+ * for the data itself. Also check that the revision is -+ * supported (currently only revision 0). -+ */ -+ if (splc->type != ACPI_TYPE_PACKAGE || -+ splc->package.count < 2 || -+ splc->package.elements[0].type != ACPI_TYPE_INTEGER || -+ splc->package.elements[0].integer.value != 0) { -+ IWL_DEBUG_INFO(trans, -+ "Unsupported structure returned by the SPLC method. Ignoring.\n"); - return 0; - } - -- limits = &splx->package.elements[1]; -- if (limits->type != ACPI_TYPE_PACKAGE || -- limits->package.count < 2 || -- limits->package.elements[0].type != ACPI_TYPE_INTEGER || -- limits->package.elements[1].type != ACPI_TYPE_INTEGER) { -- IWL_ERR(trans, "Invalid limits element\n"); -- return 0; -+ /* loop through all the packages to find the one for WiFi */ -+ for (i = 1; i < splc->package.count; i++) { -+ union acpi_object *domain; -+ -+ data_pkg = &splc->package.elements[i]; -+ -+ /* Skip anything that is not a package with the right -+ * amount of elements (i.e. at least 2 integers). -+ */ -+ if (data_pkg->type != ACPI_TYPE_PACKAGE || -+ data_pkg->package.count < 2 || -+ data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER || -+ data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) -+ continue; -+ -+ domain = &data_pkg->package.elements[0]; -+ if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI) -+ break; -+ -+ data_pkg = NULL; - } - -- domain_type = &limits->package.elements[0]; -- power_limit = &limits->package.elements[1]; -- if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) { -- IWL_DEBUG_INFO(trans, "WiFi power is not limited\n"); -+ if (!data_pkg) { -+ IWL_DEBUG_INFO(trans, -+ "No element for the WiFi domain returned by the SPLC method.\n"); - return 0; - } - -- return power_limit->integer.value; -+ dflt_pwr_limit = &data_pkg->package.elements[1]; -+ return dflt_pwr_limit->integer.value; - } - - static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) - { - acpi_handle pxsx_handle; - acpi_handle handle; -- struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL}; -+ struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL}; - acpi_status status; - - pxsx_handle = ACPI_HANDLE(&pdev->dev); -@@ -527,23 +543,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) - } - - /* Get the method's handle */ -- status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle); -+ status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD, -+ &handle); - if (ACPI_FAILURE(status)) { -- IWL_DEBUG_INFO(trans, "SPL method not found\n"); -+ IWL_DEBUG_INFO(trans, "SPLC method not found\n"); - return; - } - - /* Call SPLC with no arguments */ -- status = acpi_evaluate_object(handle, NULL, NULL, &splx); -+ status = acpi_evaluate_object(handle, NULL, NULL, &splc); - if (ACPI_FAILURE(status)) { - IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status); - return; - } - -- trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer); -+ trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer); - IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n", - trans->dflt_pwr_limit); -- kfree(splx.pointer); -+ kfree(splc.pointer); - } - - #else /* CONFIG_ACPI */ -diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c -index ec2e9c5fb993..22394fe30579 100644 ---- a/drivers/rtc/rtc-omap.c -+++ b/drivers/rtc/rtc-omap.c -@@ -109,6 +109,7 @@ - /* OMAP_RTC_OSC_REG bit fields: */ - #define OMAP_RTC_OSC_32KCLK_EN BIT(6) - #define OMAP_RTC_OSC_SEL_32KCLK_SRC BIT(3) -+#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE BIT(4) - - /* OMAP_RTC_IRQWAKEEN bit fields: */ - #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1) -@@ -646,8 +647,9 @@ static int omap_rtc_probe(struct platform_device *pdev) - */ - if (rtc->has_ext_clk) { - reg = rtc_read(rtc, OMAP_RTC_OSC_REG); -- rtc_write(rtc, OMAP_RTC_OSC_REG, -- reg | OMAP_RTC_OSC_SEL_32KCLK_SRC); -+ reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE; -+ reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC; -+ rtc_writel(rtc, OMAP_RTC_OSC_REG, reg); - } - - rtc->type->lock(rtc); -diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c -index d059ad4d0dbd..97ee1b46db69 100644 ---- a/drivers/uwb/lc-rc.c -+++ b/drivers/uwb/lc-rc.c -@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index) - struct uwb_rc *rc = NULL; - - dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } -+ - return rc; - } - -@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc) - if (dev) { - rc = dev_get_drvdata(dev); - __uwb_rc_get(rc); -+ put_device(dev); - } -+ - return rc; - } - EXPORT_SYMBOL_GPL(__uwb_rc_try_get); -@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev) - - dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev, - find_rc_grandpa); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } -+ - return rc; - } - EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa); -@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr) - struct uwb_rc *rc = NULL; - - dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } - - return rc; - } -diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c -index c1304b8d4985..678e93741ae1 100644 ---- a/drivers/uwb/pal.c -+++ b/drivers/uwb/pal.c -@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc) - - dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc); - -+ put_device(dev); -+ - return (dev != NULL); - } - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index b7e921d207fb..cd5914495ad7 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -221,6 +221,7 @@ struct ext4_io_submit { - #define EXT4_MAX_BLOCK_SIZE 65536 - #define EXT4_MIN_BLOCK_LOG_SIZE 10 - #define EXT4_MAX_BLOCK_LOG_SIZE 16 -+#define EXT4_MAX_CLUSTER_LOG_SIZE 30 - #ifdef __KERNEL__ - # define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize) - #else -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 5bab28caa9d4..127155b82e6e 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3394,7 +3394,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - if (blocksize < EXT4_MIN_BLOCK_SIZE || - blocksize > EXT4_MAX_BLOCK_SIZE) { - ext4_msg(sb, KERN_ERR, -- "Unsupported filesystem blocksize %d", blocksize); -+ "Unsupported filesystem blocksize %d (%d log_block_size)", -+ blocksize, le32_to_cpu(es->s_log_block_size)); -+ goto failed_mount; -+ } -+ if (le32_to_cpu(es->s_log_block_size) > -+ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { -+ ext4_msg(sb, KERN_ERR, -+ "Invalid log block size: %u", -+ le32_to_cpu(es->s_log_block_size)); - goto failed_mount; - } - -@@ -3533,6 +3541,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - "block size (%d)", clustersize, blocksize); - goto failed_mount; - } -+ if (le32_to_cpu(es->s_log_cluster_size) > -+ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { -+ ext4_msg(sb, KERN_ERR, -+ "Invalid log cluster size: %u", -+ le32_to_cpu(es->s_log_cluster_size)); -+ goto failed_mount; -+ } - sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) - - le32_to_cpu(es->s_log_block_size); - sbi->s_clusters_per_group = -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 682e79965c16..8821c380a71a 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1997,6 +1997,10 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, - { - struct inode *inode = page->mapping->host; - -+ /* Haven't copied anything? Skip zeroing, size extending, dirtying. */ -+ if (!copied) -+ goto unlock; -+ - if (!PageUptodate(page)) { - /* Zero any unwritten bytes at the end of the page */ - size_t endoff = (pos + copied) & ~PAGE_CACHE_MASK; -@@ -2007,6 +2011,8 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, - - fuse_write_update_size(inode, pos + copied); - set_page_dirty(page); -+ -+unlock: - unlock_page(page); - page_cache_release(page); - -diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c -index 084452e34a12..bdff5ed57f10 100644 ---- a/kernel/power/suspend_test.c -+++ b/kernel/power/suspend_test.c -@@ -203,8 +203,10 @@ static int __init test_suspend(void) - - /* RTCs have initialized by now too ... can we use one? */ - dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm); -- if (dev) -+ if (dev) { - rtc = rtc_class_open(dev_name(dev)); -+ put_device(dev); -+ } - if (!rtc) { - printk(warn_no_rtc); - return 0; -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 6863310d6973..8ef1afacad82 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -1500,24 +1500,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, - struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; - struct sock *sk = sock->sk; - struct bcm_sock *bo = bcm_sk(sk); -+ int ret = 0; - - if (len < sizeof(*addr)) - return -EINVAL; - -- if (bo->bound) -- return -EISCONN; -+ lock_sock(sk); -+ -+ if (bo->bound) { -+ ret = -EISCONN; -+ goto fail; -+ } - - /* bind a device to this socket */ - if (addr->can_ifindex) { - struct net_device *dev; - - dev = dev_get_by_index(&init_net, addr->can_ifindex); -- if (!dev) -- return -ENODEV; -- -+ if (!dev) { -+ ret = -ENODEV; -+ goto fail; -+ } - if (dev->type != ARPHRD_CAN) { - dev_put(dev); -- return -ENODEV; -+ ret = -ENODEV; -+ goto fail; - } - - bo->ifindex = dev->ifindex; -@@ -1528,17 +1535,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, - bo->ifindex = 0; - } - -- bo->bound = 1; -- - if (proc_dir) { - /* unique socket address as filename */ - sprintf(bo->procname, "%lu", sock_i_ino(sk)); - bo->bcm_proc_read = proc_create_data(bo->procname, 0644, - proc_dir, - &bcm_proc_fops, sk); -+ if (!bo->bcm_proc_read) { -+ ret = -ENOMEM; -+ goto fail; -+ } - } - -- return 0; -+ bo->bound = 1; -+ -+fail: -+ release_sock(sk); -+ -+ return ret; - } - - static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 9dec3bd1b63c..0a5df0cbaa28 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -140,7 +140,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx, - if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { - if (!(set->flags & NFT_SET_TIMEOUT)) - return -EINVAL; -- timeout = be64_to_cpu(nla_get_be64(tb[NFTA_DYNSET_TIMEOUT])); -+ timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( -+ tb[NFTA_DYNSET_TIMEOUT]))); - } - - priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); -@@ -227,7 +228,8 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) - goto nla_put_failure; -- if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, cpu_to_be64(priv->timeout))) -+ if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, -+ cpu_to_be64(jiffies_to_msecs(priv->timeout)))) - goto nla_put_failure; - if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr)) - goto nla_put_failure; -diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh -index 973e8c141567..17867e723a51 100755 ---- a/scripts/gcc-x86_64-has-stack-protector.sh -+++ b/scripts/gcc-x86_64-has-stack-protector.sh -@@ -1,6 +1,6 @@ - #!/bin/sh - --echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs" -+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs" - if [ "$?" -eq "0" ] ; then - echo y - else diff --git a/patch/kernel/mvebu-default/patch-4.4.35-36.patch b/patch/kernel/mvebu-default/patch-4.4.35-36.patch deleted file mode 100644 index 0db6e387b..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.35-36.patch +++ /dev/null @@ -1,914 +0,0 @@ -diff --git a/Makefile b/Makefile -index f88830af1533..705eb9e38fce 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 35 -+SUBLEVEL = 36 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c -index cda6dbbe9842..fd5979f28ada 100644 ---- a/arch/parisc/kernel/cache.c -+++ b/arch/parisc/kernel/cache.c -@@ -351,6 +351,7 @@ void __init parisc_setup_cache_timing(void) - { - unsigned long rangetime, alltime; - unsigned long size, start; -+ unsigned long threshold; - - alltime = mfctl(16); - flush_data_cache(); -@@ -364,17 +365,12 @@ void __init parisc_setup_cache_timing(void) - printk(KERN_DEBUG "Whole cache flush %lu cycles, flushing %lu bytes %lu cycles\n", - alltime, size, rangetime); - -- /* Racy, but if we see an intermediate value, it's ok too... */ -- parisc_cache_flush_threshold = size * alltime / rangetime; -- -- parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold); -- if (!parisc_cache_flush_threshold) -- parisc_cache_flush_threshold = FLUSH_THRESHOLD; -- -- if (parisc_cache_flush_threshold > cache_info.dc_size) -- parisc_cache_flush_threshold = cache_info.dc_size; -- -- printk(KERN_INFO "Setting cache flush threshold to %lu kB\n", -+ threshold = L1_CACHE_ALIGN(size * alltime / rangetime); -+ if (threshold > cache_info.dc_size) -+ threshold = cache_info.dc_size; -+ if (threshold) -+ parisc_cache_flush_threshold = threshold; -+ printk(KERN_INFO "Cache flush threshold set to %lu KiB\n", - parisc_cache_flush_threshold/1024); - - /* calculate TLB flush threshold */ -@@ -383,7 +379,7 @@ void __init parisc_setup_cache_timing(void) - flush_tlb_all(); - alltime = mfctl(16) - alltime; - -- size = PAGE_SIZE; -+ size = 0; - start = (unsigned long) _text; - rangetime = mfctl(16); - while (start < (unsigned long) _end) { -@@ -396,13 +392,10 @@ void __init parisc_setup_cache_timing(void) - printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n", - alltime, size, rangetime); - -- parisc_tlb_flush_threshold = size * alltime / rangetime; -- parisc_tlb_flush_threshold *= num_online_cpus(); -- parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold); -- if (!parisc_tlb_flush_threshold) -- parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD; -- -- printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n", -+ threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime); -+ if (threshold) -+ parisc_tlb_flush_threshold = threshold; -+ printk(KERN_INFO "TLB flush threshold set to %lu KiB\n", - parisc_tlb_flush_threshold/1024); - } - -diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S -index b743a80eaba0..675521919229 100644 ---- a/arch/parisc/kernel/pacache.S -+++ b/arch/parisc/kernel/pacache.S -@@ -96,7 +96,7 @@ fitmanyloop: /* Loop if LOOP >= 2 */ - - fitmanymiddle: /* Loop if LOOP >= 2 */ - addib,COND(>) -1, %r31, fitmanymiddle /* Adjusted inner loop decr */ -- pitlbe 0(%sr1, %r28) -+ pitlbe %r0(%sr1, %r28) - pitlbe,m %arg1(%sr1, %r28) /* Last pitlbe and addr adjust */ - addib,COND(>) -1, %r29, fitmanymiddle /* Middle loop decr */ - copy %arg3, %r31 /* Re-init inner loop count */ -@@ -139,7 +139,7 @@ fdtmanyloop: /* Loop if LOOP >= 2 */ - - fdtmanymiddle: /* Loop if LOOP >= 2 */ - addib,COND(>) -1, %r31, fdtmanymiddle /* Adjusted inner loop decr */ -- pdtlbe 0(%sr1, %r28) -+ pdtlbe %r0(%sr1, %r28) - pdtlbe,m %arg1(%sr1, %r28) /* Last pdtlbe and addr adjust */ - addib,COND(>) -1, %r29, fdtmanymiddle /* Middle loop decr */ - copy %arg3, %r31 /* Re-init inner loop count */ -@@ -620,12 +620,12 @@ ENTRY(copy_user_page_asm) - /* Purge any old translations */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -- pdtlb,l 0(%r29) -+ pdtlb,l %r0(%r28) -+ pdtlb,l %r0(%r29) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -- pdtlb 0(%r29) -+ pdtlb %r0(%r28) -+ pdtlb %r0(%r29) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -768,10 +768,10 @@ ENTRY(clear_user_page_asm) - /* Purge any old translation */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -+ pdtlb,l %r0(%r28) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -+ pdtlb %r0(%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -852,10 +852,10 @@ ENTRY(flush_dcache_page_asm) - /* Purge any old translation */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -+ pdtlb,l %r0(%r28) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -+ pdtlb %r0(%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -892,10 +892,10 @@ ENTRY(flush_dcache_page_asm) - sync - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r25) -+ pdtlb,l %r0(%r25) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r25) -+ pdtlb %r0(%r25) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -925,13 +925,18 @@ ENTRY(flush_icache_page_asm) - depwi 0, 31,PAGE_SHIFT, %r28 /* Clear any offset bits */ - #endif - -- /* Purge any old translation */ -+ /* Purge any old translation. Note that the FIC instruction -+ * may use either the instruction or data TLB. Given that we -+ * have a flat address space, it's not clear which TLB will be -+ * used. So, we purge both entries. */ - - #ifdef CONFIG_PA20 -+ pdtlb,l %r0(%r28) - pitlb,l %r0(%sr4,%r28) - #else - tlb_lock %r20,%r21,%r22 -- pitlb (%sr4,%r28) -+ pdtlb %r0(%r28) -+ pitlb %r0(%sr4,%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -970,10 +975,12 @@ ENTRY(flush_icache_page_asm) - sync - - #ifdef CONFIG_PA20 -+ pdtlb,l %r0(%r28) - pitlb,l %r0(%sr4,%r25) - #else - tlb_lock %r20,%r21,%r22 -- pitlb (%sr4,%r25) -+ pdtlb %r0(%r28) -+ pitlb %r0(%sr4,%r25) - tlb_unlock %r20,%r21,%r22 - #endif - -diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c -index b9402c9b3454..af0d7fae7aa7 100644 ---- a/arch/parisc/kernel/pci-dma.c -+++ b/arch/parisc/kernel/pci-dma.c -@@ -95,8 +95,8 @@ static inline int map_pte_uncached(pte_t * pte, - - if (!pte_none(*pte)) - printk(KERN_ERR "map_pte_uncached: page already exists\n"); -- set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); - purge_tlb_start(flags); -+ set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); - pdtlb_kernel(orig_vaddr); - purge_tlb_end(flags); - vaddr += PAGE_SIZE; -diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c -index 81d6f6391944..2e66a887788e 100644 ---- a/arch/parisc/kernel/setup.c -+++ b/arch/parisc/kernel/setup.c -@@ -334,6 +334,10 @@ static int __init parisc_init(void) - /* tell PDC we're Linux. Nevermind failure. */ - pdc_stable_write(0x40, &osid, sizeof(osid)); - -+ /* start with known state */ -+ flush_cache_all_local(); -+ flush_tlb_all_local(NULL); -+ - processor_init(); - #ifdef CONFIG_SMP - pr_info("CPU(s): %d out of %d %s at %d.%06d MHz online\n", -diff --git a/arch/tile/kernel/time.c b/arch/tile/kernel/time.c -index 178989e6d3e3..ea960d660917 100644 ---- a/arch/tile/kernel/time.c -+++ b/arch/tile/kernel/time.c -@@ -218,8 +218,8 @@ void do_timer_interrupt(struct pt_regs *regs, int fault_num) - */ - unsigned long long sched_clock(void) - { -- return clocksource_cyc2ns(get_cycles(), -- sched_clock_mult, SCHED_CLOCK_SHIFT); -+ return mult_frac(get_cycles(), -+ sched_clock_mult, 1ULL << SCHED_CLOCK_SHIFT); - } - - int setup_profiling_timer(unsigned int multiplier) -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 5fa652c16a50..f49e98062ea5 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2093,16 +2093,10 @@ static int em_iret(struct x86_emulate_ctxt *ctxt) - static int em_jmp_far(struct x86_emulate_ctxt *ctxt) - { - int rc; -- unsigned short sel, old_sel; -- struct desc_struct old_desc, new_desc; -- const struct x86_emulate_ops *ops = ctxt->ops; -+ unsigned short sel; -+ struct desc_struct new_desc; - u8 cpl = ctxt->ops->cpl(ctxt); - -- /* Assignment of RIP may only fail in 64-bit mode */ -- if (ctxt->mode == X86EMUL_MODE_PROT64) -- ops->get_segment(ctxt, &old_sel, &old_desc, NULL, -- VCPU_SREG_CS); -- - memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); - - rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, -@@ -2112,12 +2106,10 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt) - return rc; - - rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc); -- if (rc != X86EMUL_CONTINUE) { -- WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -- /* assigning eip failed; restore the old cs */ -- ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS); -- return rc; -- } -+ /* Error handling is not implemented. */ -+ if (rc != X86EMUL_CONTINUE) -+ return X86EMUL_UNHANDLEABLE; -+ - return rc; - } - -@@ -2177,14 +2169,8 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt) - { - int rc; - unsigned long eip, cs; -- u16 old_cs; - int cpl = ctxt->ops->cpl(ctxt); -- struct desc_struct old_desc, new_desc; -- const struct x86_emulate_ops *ops = ctxt->ops; -- -- if (ctxt->mode == X86EMUL_MODE_PROT64) -- ops->get_segment(ctxt, &old_cs, &old_desc, NULL, -- VCPU_SREG_CS); -+ struct desc_struct new_desc; - - rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); - if (rc != X86EMUL_CONTINUE) -@@ -2201,10 +2187,10 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt) - if (rc != X86EMUL_CONTINUE) - return rc; - rc = assign_eip_far(ctxt, eip, &new_desc); -- if (rc != X86EMUL_CONTINUE) { -- WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -- ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); -- } -+ /* Error handling is not implemented. */ -+ if (rc != X86EMUL_CONTINUE) -+ return X86EMUL_UNHANDLEABLE; -+ - return rc; - } - -diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c -index 84b96d319909..d09544e826f6 100644 ---- a/arch/x86/kvm/irq_comm.c -+++ b/arch/x86/kvm/irq_comm.c -@@ -38,6 +38,15 @@ static int kvm_set_pic_irq(struct kvm_kernel_irq_routing_entry *e, - bool line_status) - { - struct kvm_pic *pic = pic_irqchip(kvm); -+ -+ /* -+ * XXX: rejecting pic routes when pic isn't in use would be better, -+ * but the default routing table is installed while kvm->arch.vpic is -+ * NULL and KVM_CREATE_IRQCHIP can race with KVM_IRQ_LINE. -+ */ -+ if (!pic) -+ return -1; -+ - return kvm_pic_set_irq(pic, e->irqchip.pin, irq_source_id, level); - } - -@@ -46,6 +55,10 @@ static int kvm_set_ioapic_irq(struct kvm_kernel_irq_routing_entry *e, - bool line_status) - { - struct kvm_ioapic *ioapic = kvm->arch.vioapic; -+ -+ if (!ioapic) -+ return -1; -+ - return kvm_ioapic_set_irq(ioapic, e->irqchip.pin, irq_source_id, level, - line_status); - } -diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c -index 79bab6fd76bb..6755d4768f59 100644 ---- a/drivers/gpu/drm/radeon/atombios_crtc.c -+++ b/drivers/gpu/drm/radeon/atombios_crtc.c -@@ -275,6 +275,8 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode) - atombios_enable_crtc_memreq(crtc, ATOM_ENABLE); - atombios_blank_crtc(crtc, ATOM_DISABLE); - drm_vblank_post_modeset(dev, radeon_crtc->crtc_id); -+ /* Make sure vblank interrupt is still enabled if needed */ -+ radeon_irq_set(rdev); - radeon_crtc_load_lut(crtc); - break; - case DRM_MODE_DPMS_STANDBY: -diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c -index 678b4386540d..89f22bdde298 100644 ---- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c -+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c -@@ -331,6 +331,8 @@ static void radeon_crtc_dpms(struct drm_crtc *crtc, int mode) - WREG32_P(RADEON_CRTC_EXT_CNTL, crtc_ext_cntl, ~(mask | crtc_ext_cntl)); - } - drm_vblank_post_modeset(dev, radeon_crtc->crtc_id); -+ /* Make sure vblank interrupt is still enabled if needed */ -+ radeon_irq_set(rdev); - radeon_crtc_load_lut(crtc); - break; - case DRM_MODE_DPMS_STANDBY: -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index 565bb2c140ed..e913a930ac80 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -326,7 +326,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb, - struct pci_dev *pdev = to_pci_dev(data); - struct dmar_pci_notify_info *info; - -- /* Only care about add/remove events for physical functions */ -+ /* Only care about add/remove events for physical functions. -+ * For VFs we actually do the lookup based on the corresponding -+ * PF in device_to_iommu() anyway. */ - if (pdev->is_virtfn) - return NOTIFY_DONE; - if (action != BUS_NOTIFY_ADD_DEVICE && -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 5baa830ce49f..59e9abd3345e 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -885,7 +885,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf - return NULL; - - if (dev_is_pci(dev)) { -+ struct pci_dev *pf_pdev; -+ - pdev = to_pci_dev(dev); -+ /* VFs aren't listed in scope tables; we need to look up -+ * the PF instead to find the IOMMU. */ -+ pf_pdev = pci_physfn(pdev); -+ dev = &pf_pdev->dev; - segment = pci_domain_nr(pdev->bus); - } else if (has_acpi_companion(dev)) - dev = &ACPI_COMPANION(dev)->dev; -@@ -898,6 +904,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf - for_each_active_dev_scope(drhd->devices, - drhd->devices_cnt, i, tmp) { - if (tmp == dev) { -+ /* For a VF use its original BDF# not that of the PF -+ * which we used for the IOMMU lookup. Strictly speaking -+ * we could do this for all PCI devices; we only need to -+ * get the BDF# from the scope table for ACPI matches. */ -+ if (pdev->is_virtfn) -+ goto got_pdev; -+ - *bus = drhd->devices[i].bus; - *devfn = drhd->devices[i].devfn; - goto out; -diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c -index d9939fa9b588..f929879ecae6 100644 ---- a/drivers/iommu/intel-svm.c -+++ b/drivers/iommu/intel-svm.c -@@ -39,10 +39,18 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - struct page *pages; - int order; - -- order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT; -- if (order < 0) -- order = 0; -- -+ /* Start at 2 because it's defined as 2^(1+PSS) */ -+ iommu->pasid_max = 2 << ecap_pss(iommu->ecap); -+ -+ /* Eventually I'm promised we will get a multi-level PASID table -+ * and it won't have to be physically contiguous. Until then, -+ * limit the size because 8MiB contiguous allocations can be hard -+ * to come by. The limit of 0x20000, which is 1MiB for each of -+ * the PASID and PASID-state tables, is somewhat arbitrary. */ -+ if (iommu->pasid_max > 0x20000) -+ iommu->pasid_max = 0x20000; -+ -+ order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max); - pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); - if (!pages) { - pr_warn("IOMMU: %s: Failed to allocate PASID table\n", -@@ -53,6 +61,8 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - pr_info("%s: Allocated order %d PASID table.\n", iommu->name, order); - - if (ecap_dis(iommu->ecap)) { -+ /* Just making it explicit... */ -+ BUILD_BUG_ON(sizeof(struct pasid_entry) != sizeof(struct pasid_state_entry)); - pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); - if (pages) - iommu->pasid_state_table = page_address(pages); -@@ -68,11 +78,7 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - - int intel_svm_free_pasid_tables(struct intel_iommu *iommu) - { -- int order; -- -- order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT; -- if (order < 0) -- order = 0; -+ int order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max); - - if (iommu->pasid_table) { - free_pages((unsigned long)iommu->pasid_table, order); -@@ -371,8 +377,8 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_ - } - svm->iommu = iommu; - -- if (pasid_max > 2 << ecap_pss(iommu->ecap)) -- pasid_max = 2 << ecap_pss(iommu->ecap); -+ if (pasid_max > iommu->pasid_max) -+ pasid_max = iommu->pasid_max; - - /* Do not use PASID 0 in caching mode (virtualised IOMMU) */ - ret = idr_alloc(&iommu->pasid_idr, svm, -diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c -index a77643954523..e59838231703 100644 ---- a/drivers/misc/mei/bus.c -+++ b/drivers/misc/mei/bus.c -@@ -144,7 +144,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length) - mutex_lock(&bus->device_lock); - - if (!mei_cl_is_connected(cl)) { -- rets = -EBUSY; -+ rets = -ENODEV; - goto out; - } - } -diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h -index 4e8069866c85..a2661381ddfc 100644 ---- a/drivers/misc/mei/hw-me-regs.h -+++ b/drivers/misc/mei/hw-me-regs.h -@@ -66,9 +66,6 @@ - #ifndef _MEI_HW_MEI_REGS_H_ - #define _MEI_HW_MEI_REGS_H_ - --#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ --#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ -- - /* - * MEI device IDs - */ -@@ -124,6 +121,10 @@ - #define MEI_DEV_ID_SPT_2 0x9D3B /* Sunrise Point 2 */ - #define MEI_DEV_ID_SPT_H 0xA13A /* Sunrise Point H */ - #define MEI_DEV_ID_SPT_H_2 0xA13B /* Sunrise Point H 2 */ -+ -+#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ -+#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ -+ - /* - * MEI HW Section - */ -diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c -index 25b1997a62cb..36333750c512 100644 ---- a/drivers/misc/mei/hw-me.c -+++ b/drivers/misc/mei/hw-me.c -@@ -1258,8 +1258,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev) - static bool mei_me_fw_type_sps(struct pci_dev *pdev) - { - u32 reg; -- /* Read ME FW Status check for SPS Firmware */ -- pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®); -+ unsigned int devfn; -+ -+ /* -+ * Read ME FW Status register to check for SPS Firmware -+ * The SPS FW is only signaled in pci function 0 -+ */ -+ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0); -+ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, ®); - /* if bits [19:16] = 15, running SPS Firmware */ - return (reg & 0xf0000) == 0xf0000; - } -diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c -index 80f9afcb1382..4ef189a7a2fb 100644 ---- a/drivers/misc/mei/main.c -+++ b/drivers/misc/mei/main.c -@@ -207,7 +207,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf, - - mutex_lock(&dev->device_lock); - if (!mei_cl_is_connected(cl)) { -- rets = -EBUSY; -+ rets = -ENODEV; - goto out; - } - } -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 0af3d7d30419..01e20384ac44 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -84,8 +84,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, -- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)}, -- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, - - {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)}, -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 2d867c5bfd9f..8cead04f26d6 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -3706,6 +3706,11 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc, - } - } - -+static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd) -+{ -+ return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16); -+} -+ - /** - * _scsih_flush_running_cmds - completing outstanding commands. - * @ioc: per adapter object -@@ -3727,6 +3732,9 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc) - if (!scmd) - continue; - count++; -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_unblock(scmd->device, -+ SDEV_RUNNING); - mpt3sas_base_free_smid(ioc, smid); - scsi_dma_unmap(scmd); - if (ioc->pci_error_recovery) -@@ -3831,8 +3839,6 @@ _scsih_eedp_error_handling(struct scsi_cmnd *scmd, u16 ioc_status) - SAM_STAT_CHECK_CONDITION; - } - -- -- - /** - * scsih_qcmd - main scsi request entry point - * @scmd: pointer to scsi command object -@@ -3859,6 +3865,13 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) - if (ioc->logging_level & MPT_DEBUG_SCSI) - scsi_print_command(scmd); - -+ /* -+ * Lock the device for any subsequent command until command is -+ * done. -+ */ -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_block(scmd->device); -+ - sas_device_priv_data = scmd->device->hostdata; - if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { - scmd->result = DID_NO_CONNECT << 16; -@@ -4431,6 +4444,9 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - if (scmd == NULL) - return 1; - -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_unblock(scmd->device, SDEV_RUNNING); -+ - mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); - - if (mpi_reply == NULL) { -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index 965d0e240dcb..ba4a2a1eb3ff 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -926,6 +926,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) - if (!ci) - return -ENOMEM; - -+ spin_lock_init(&ci->lock); - ci->dev = dev; - ci->platdata = dev_get_platdata(dev); - ci->imx28_write_fix = !!(ci->platdata->flags & -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index 68fc5fce4cc5..d8a045fc1fdb 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -1884,8 +1884,6 @@ static int udc_start(struct ci_hdrc *ci) - struct usb_otg_caps *otg_caps = &ci->platdata->ci_otg_caps; - int retval = 0; - -- spin_lock_init(&ci->lock); -- - ci->gadget.ops = &usb_gadget_ops; - ci->gadget.speed = USB_SPEED_UNKNOWN; - ci->gadget.max_speed = USB_SPEED_HIGH; -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 976195e748a3..fe7452f0f38a 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -130,6 +130,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ -+ { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 494167fe6a2c..d3d6ec455151 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1012,6 +1012,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, - { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, -+ { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 21011c0a4c64..48ee04c94a75 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -596,6 +596,12 @@ - #define STK541_PID 0x2109 /* Zigbee Controller */ - - /* -+ * Texas Instruments -+ */ -+#define TI_VID 0x0451 -+#define TI_CC3200_LAUNCHPAD_PID 0xC32A /* SimpleLink Wi-Fi CC3200 LaunchPad */ -+ -+/* - * Blackfin gnICE JTAG - * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice - */ -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index 5e67f63b2e46..02f86dd1a340 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -919,10 +919,15 @@ int usb_stor_CB_transport(struct scsi_cmnd *srb, struct us_data *us) - - /* COMMAND STAGE */ - /* let's send the command via the control pipe */ -+ /* -+ * Command is sometime (f.e. after scsi_eh_prep_cmnd) on the stack. -+ * Stack may be vmallocated. So no DMA for us. Make a copy. -+ */ -+ memcpy(us->iobuf, srb->cmnd, srb->cmd_len); - result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe, - US_CBI_ADSC, - USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0, -- us->ifnum, srb->cmnd, srb->cmd_len); -+ us->ifnum, us->iobuf, srb->cmd_len); - - /* check the return code for the command */ - usb_stor_dbg(us, "Call to usb_stor_ctrl_transfer() returned %d\n", -diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c -index 52a28311e2a4..48efe62e1302 100644 ---- a/fs/nfs/callback.c -+++ b/fs/nfs/callback.c -@@ -261,7 +261,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, - } - - ret = -EPROTONOSUPPORT; -- if (minorversion == 0) -+ if (!IS_ENABLED(CONFIG_NFS_V4_1) || minorversion == 0) - ret = nfs4_callback_up_net(serv, net); - else if (xprt->ops->bc_up) - ret = xprt->ops->bc_up(serv, net); -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index 2d9b650047a5..d49e26c6cdc7 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -429,6 +429,7 @@ struct intel_iommu { - struct page_req_dsc *prq; - unsigned char prq_name[16]; /* Name for PRQ interrupt */ - struct idr pasid_idr; -+ u32 pasid_max; - #endif - struct q_inval *qi; /* Queued invalidation info */ - u32 *iommu_state; /* Store iommu states between suspend and resume.*/ -diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c -index 5464c8744ea9..e24388a863a7 100644 ---- a/lib/mpi/mpi-pow.c -+++ b/lib/mpi/mpi-pow.c -@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - if (!esize) { - /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0 - * depending on if MOD equals 1. */ -- rp[0] = 1; - res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1; -+ if (res->nlimbs) { -+ if (mpi_resize(res, 1) < 0) -+ goto enomem; -+ rp = res->d; -+ rp[0] = 1; -+ } - res->sign = 0; - goto leave; - } -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 9aba9e93c0a2..ee9082792530 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -949,4 +949,4 @@ static int __init init_default_flow_dissectors(void) - return 0; - } - --late_initcall_sync(init_default_flow_dissectors); -+core_initcall(init_default_flow_dissectors); -diff --git a/net/wireless/core.h b/net/wireless/core.h -index a618b4b86fa4..47a967fed8ff 100644 ---- a/net/wireless/core.h -+++ b/net/wireless/core.h -@@ -72,6 +72,7 @@ struct cfg80211_registered_device { - struct list_head bss_list; - struct rb_root bss_tree; - u32 bss_generation; -+ u32 bss_entries; - struct cfg80211_scan_request *scan_req; /* protected by RTNL */ - struct sk_buff *scan_msg; - struct cfg80211_sched_scan_request __rcu *sched_scan_req; -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 14d5369eb778..8dde12a11725 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -56,6 +56,19 @@ - * also linked into the probe response struct. - */ - -+/* -+ * Limit the number of BSS entries stored in mac80211. Each one is -+ * a bit over 4k at most, so this limits to roughly 4-5M of memory. -+ * If somebody wants to really attack this though, they'd likely -+ * use small beacons, and only one type of frame, limiting each of -+ * the entries to a much smaller size (in order to generate more -+ * entries in total, so overhead is bigger.) -+ */ -+static int bss_entries_limit = 1000; -+module_param(bss_entries_limit, int, 0644); -+MODULE_PARM_DESC(bss_entries_limit, -+ "limit to number of scan BSS entries (per wiphy, default 1000)"); -+ - #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ) - - static void bss_free(struct cfg80211_internal_bss *bss) -@@ -136,6 +149,10 @@ static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev, - - list_del_init(&bss->list); - rb_erase(&bss->rbn, &rdev->bss_tree); -+ rdev->bss_entries--; -+ WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list), -+ "rdev bss entries[%d]/list[empty:%d] corruption\n", -+ rdev->bss_entries, list_empty(&rdev->bss_list)); - bss_ref_put(rdev, bss); - return true; - } -@@ -162,6 +179,40 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev, - rdev->bss_generation++; - } - -+static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev) -+{ -+ struct cfg80211_internal_bss *bss, *oldest = NULL; -+ bool ret; -+ -+ lockdep_assert_held(&rdev->bss_lock); -+ -+ list_for_each_entry(bss, &rdev->bss_list, list) { -+ if (atomic_read(&bss->hold)) -+ continue; -+ -+ if (!list_empty(&bss->hidden_list) && -+ !bss->pub.hidden_beacon_bss) -+ continue; -+ -+ if (oldest && time_before(oldest->ts, bss->ts)) -+ continue; -+ oldest = bss; -+ } -+ -+ if (WARN_ON(!oldest)) -+ return false; -+ -+ /* -+ * The callers make sure to increase rdev->bss_generation if anything -+ * gets removed (and a new entry added), so there's no need to also do -+ * it here. -+ */ -+ -+ ret = __cfg80211_unlink_bss(rdev, oldest); -+ WARN_ON(!ret); -+ return ret; -+} -+ - void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, - bool send_message) - { -@@ -687,6 +738,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - const u8 *ie; - int i, ssidlen; - u8 fold = 0; -+ u32 n_entries = 0; - - ies = rcu_access_pointer(new->pub.beacon_ies); - if (WARN_ON(!ies)) -@@ -710,6 +762,12 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - /* This is the bad part ... */ - - list_for_each_entry(bss, &rdev->bss_list, list) { -+ /* -+ * we're iterating all the entries anyway, so take the -+ * opportunity to validate the list length accounting -+ */ -+ n_entries++; -+ - if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid)) - continue; - if (bss->pub.channel != new->pub.channel) -@@ -738,6 +796,10 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - new->pub.beacon_ies); - } - -+ WARN_ONCE(n_entries != rdev->bss_entries, -+ "rdev bss entries[%d]/list[len:%d] corruption\n", -+ rdev->bss_entries, n_entries); -+ - return true; - } - -@@ -890,7 +952,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, - } - } - -+ if (rdev->bss_entries >= bss_entries_limit && -+ !cfg80211_bss_expire_oldest(rdev)) { -+ kfree(new); -+ goto drop; -+ } -+ - list_add_tail(&new->list, &rdev->bss_list); -+ rdev->bss_entries++; - rb_insert_bss(rdev, new); - found = new; - } -diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c -index dc0027b28b04..53426a6ee6dc 100644 ---- a/security/apparmor/domain.c -+++ b/security/apparmor/domain.c -@@ -623,8 +623,8 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) - /* released below */ - cred = get_current_cred(); - cxt = cred_cxt(cred); -- profile = aa_cred_profile(cred); -- previous_profile = cxt->previous; -+ profile = aa_get_newest_profile(aa_cred_profile(cred)); -+ previous_profile = aa_get_newest_profile(cxt->previous); - - if (unconfined(profile)) { - info = "unconfined"; -@@ -720,6 +720,8 @@ audit: - out: - aa_put_profile(hat); - kfree(name); -+ aa_put_profile(profile); -+ aa_put_profile(previous_profile); - put_cred(cred); - - return error; diff --git a/patch/kernel/mvebu-default/patch-4.4.36-37.patch b/patch/kernel/mvebu-default/patch-4.4.36-37.patch deleted file mode 100644 index c41e2df83..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.36-37.patch +++ /dev/null @@ -1,377 +0,0 @@ -diff --git a/Makefile b/Makefile -index 705eb9e38fce..b57ec79b4941 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 36 -+SUBLEVEL = 37 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h -index 08e7e2a16ac1..a36e8601114d 100644 ---- a/arch/arc/include/asm/delay.h -+++ b/arch/arc/include/asm/delay.h -@@ -22,10 +22,11 @@ - static inline void __delay(unsigned long loops) - { - __asm__ __volatile__( -- " lp 1f \n" -- " nop \n" -- "1: \n" -- : "+l"(loops)); -+ " mov lp_count, %0 \n" -+ " lp 1f \n" -+ " nop \n" -+ "1: \n" -+ : : "r"(loops)); - } - - extern void __bad_udelay(void); -diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h -index 8136afc9df0d..8884b5d5f48c 100644 ---- a/arch/arm64/include/asm/cpufeature.h -+++ b/arch/arm64/include/asm/cpufeature.h -@@ -77,7 +77,7 @@ struct arm64_cpu_capabilities { - const char *desc; - u16 capability; - bool (*matches)(const struct arm64_cpu_capabilities *); -- void (*enable)(void *); /* Called on all active CPUs */ -+ int (*enable)(void *); /* Called on all active CPUs */ - union { - struct { /* To be used for erratum handling only */ - u32 midr_model; -diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h -index 4acb7ca94fcd..d08559528927 100644 ---- a/arch/arm64/include/asm/processor.h -+++ b/arch/arm64/include/asm/processor.h -@@ -186,6 +186,6 @@ static inline void spin_lock_prefetch(const void *x) - - #endif - --void cpu_enable_pan(void *__unused); -+int cpu_enable_pan(void *__unused); - - #endif /* __ASM_PROCESSOR_H */ -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 0669c63281ea..2735bf814592 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -19,7 +19,9 @@ - #define pr_fmt(fmt) "CPU features: " fmt - - #include -+#include - #include -+#include - #include - #include - #include -@@ -764,7 +766,13 @@ static void enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps) - - for (i = 0; caps[i].desc; i++) - if (caps[i].enable && cpus_have_cap(caps[i].capability)) -- on_each_cpu(caps[i].enable, NULL, true); -+ /* -+ * Use stop_machine() as it schedules the work allowing -+ * us to modify PSTATE, instead of on_each_cpu() which -+ * uses an IPI, giving us a PSTATE that disappears when -+ * we return. -+ */ -+ stop_machine(caps[i].enable, NULL, cpu_online_mask); - } - - #ifdef CONFIG_HOTPLUG_CPU -diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c -index 1095aa483a1c..00c1372bf57b 100644 ---- a/arch/arm64/kernel/suspend.c -+++ b/arch/arm64/kernel/suspend.c -@@ -1,7 +1,9 @@ - #include - #include - #include -+#include - #include -+#include - #include - #include - #include -@@ -111,6 +113,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long)) - set_my_cpu_offset(per_cpu_offset(smp_processor_id())); - - /* -+ * PSTATE was not saved over suspend/resume, re-enable any -+ * detected features that might not have been set correctly. -+ */ -+ asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, -+ CONFIG_ARM64_PAN)); -+ -+ /* - * Restore HW breakpoint registers to sane values - * before debug exceptions are possibly reenabled - * through local_dbg_restore. -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 4c1a118c1d09..247bae758e1e 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -29,7 +29,9 @@ - #include - #include - #include -+#include - -+#include - #include - #include - #include -@@ -606,8 +608,16 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, - } - - #ifdef CONFIG_ARM64_PAN --void cpu_enable_pan(void *__unused) -+int cpu_enable_pan(void *__unused) - { -+ /* -+ * We modify PSTATE. This won't work from irq context as the PSTATE -+ * is discarded once we return from the exception. -+ */ -+ WARN_ON_ONCE(in_interrupt()); -+ - config_sctlr_el1(SCTLR_EL1_SPAN, 0); -+ asm(SET_PSTATE_PAN(1)); -+ return 0; - } - #endif /* CONFIG_ARM64_PAN */ -diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S -index 6bc9ae24b6d2..8f1a3f443f7d 100644 ---- a/arch/x86/kernel/head_32.S -+++ b/arch/x86/kernel/head_32.S -@@ -571,7 +571,7 @@ early_idt_handler_common: - movl %eax,%ds - movl %eax,%es - -- cmpl $(__KERNEL_CS),32(%esp) -+ cmpw $(__KERNEL_CS),32(%esp) - jne 10f - - leal 28(%esp),%eax # Pointer to %eip -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 370c2f76016d..1770c455dfdd 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -1368,7 +1368,8 @@ static ssize_t hot_remove_store(struct class *class, - zram = idr_find(&zram_index_idr, dev_id); - if (zram) { - ret = zram_remove(zram); -- idr_remove(&zram_index_idr, dev_id); -+ if (!ret) -+ idr_remove(&zram_index_idr, dev_id); - } else { - ret = -ENODEV; - } -diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c -index 4073116e6e9f..c3331d6201c3 100644 ---- a/drivers/net/wireless/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/mwifiex/cfg80211.c -@@ -2144,8 +2144,9 @@ done: - is_scanning_required = 1; - } else { - mwifiex_dbg(priv->adapter, MSG, -- "info: trying to associate to '%s' bssid %pM\n", -- (char *)req_ssid.ssid, bss->bssid); -+ "info: trying to associate to '%.*s' bssid %pM\n", -+ req_ssid.ssid_len, (char *)req_ssid.ssid, -+ bss->bssid); - memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN); - break; - } -@@ -2202,8 +2203,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev, - } - - mwifiex_dbg(adapter, INFO, -- "info: Trying to associate to %s and bssid %pM\n", -- (char *)sme->ssid, sme->bssid); -+ "info: Trying to associate to %.*s and bssid %pM\n", -+ (int)sme->ssid_len, (char *)sme->ssid, sme->bssid); - - ret = mwifiex_cfg80211_assoc(priv, sme->ssid_len, sme->ssid, sme->bssid, - priv->bss_mode, sme->channel, sme, 0); -@@ -2333,8 +2334,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev, - } - - mwifiex_dbg(priv->adapter, MSG, -- "info: trying to join to %s and bssid %pM\n", -- (char *)params->ssid, params->bssid); -+ "info: trying to join to %.*s and bssid %pM\n", -+ params->ssid_len, (char *)params->ssid, params->bssid); - - mwifiex_set_ibss_params(priv, params); - -diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c -index 182224acedbe..58f1419a68ae 100644 ---- a/drivers/pci/pcie/aer/aer_inject.c -+++ b/drivers/pci/pcie/aer/aer_inject.c -@@ -283,20 +283,6 @@ out: - return 0; - } - --static struct pci_dev *pcie_find_root_port(struct pci_dev *dev) --{ -- while (1) { -- if (!pci_is_pcie(dev)) -- break; -- if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) -- return dev; -- if (!dev->bus->self) -- break; -- dev = dev->bus->self; -- } -- return NULL; --} -- - static int find_aer_device_iter(struct device *device, void *data) - { - struct pcie_device **result = data; -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 9757cf9037a2..b5843c255263 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -1415,6 +1415,21 @@ static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp) - dev_warn(&dev->dev, "PCI-X settings not supported\n"); - } - -+static bool pcie_root_rcb_set(struct pci_dev *dev) -+{ -+ struct pci_dev *rp = pcie_find_root_port(dev); -+ u16 lnkctl; -+ -+ if (!rp) -+ return false; -+ -+ pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl); -+ if (lnkctl & PCI_EXP_LNKCTL_RCB) -+ return true; -+ -+ return false; -+} -+ - static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) - { - int pos; -@@ -1444,9 +1459,20 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) - ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or); - - /* Initialize Link Control Register */ -- if (pcie_cap_has_lnkctl(dev)) -+ if (pcie_cap_has_lnkctl(dev)) { -+ -+ /* -+ * If the Root Port supports Read Completion Boundary of -+ * 128, set RCB to 128. Otherwise, clear it. -+ */ -+ hpp->pci_exp_lnkctl_and |= PCI_EXP_LNKCTL_RCB; -+ hpp->pci_exp_lnkctl_or &= ~PCI_EXP_LNKCTL_RCB; -+ if (pcie_root_rcb_set(dev)) -+ hpp->pci_exp_lnkctl_or |= PCI_EXP_LNKCTL_RCB; -+ - pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL, - ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or); -+ } - - /* Find Advanced Error Reporting Enhanced Capability */ - pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR); -diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c -index c20163b92991..375008e2be20 100644 ---- a/drivers/pwm/sysfs.c -+++ b/drivers/pwm/sysfs.c -@@ -366,6 +366,8 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) - if (test_bit(PWMF_EXPORTED, &pwm->flags)) - pwm_unexport_child(parent, pwm); - } -+ -+ put_device(parent); - } - - static int __init pwm_sysfs_init(void) -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index eeae401a2412..287e698c28de 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -251,7 +251,9 @@ - #endif - #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */ - --#if GCC_VERSION >= 50000 -+#if GCC_VERSION >= 70000 -+#define KASAN_ABI_VERSION 5 -+#elif GCC_VERSION >= 50000 - #define KASAN_ABI_VERSION 4 - #elif GCC_VERSION >= 40902 - #define KASAN_ABI_VERSION 3 -diff --git a/include/linux/pci.h b/include/linux/pci.h -index e89c7ee7e803..5f37614f2451 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1802,6 +1802,20 @@ static inline int pci_pcie_type(const struct pci_dev *dev) - return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4; - } - -+static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev) -+{ -+ while (1) { -+ if (!pci_is_pcie(dev)) -+ break; -+ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) -+ return dev; -+ if (!dev->bus->self) -+ break; -+ dev = dev->bus->self; -+ } -+ return NULL; -+} -+ - void pci_request_acs(void); - bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags); - bool pci_acs_path_enabled(struct pci_dev *start, -diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h -index 630c19772630..32cbe72bf545 100644 ---- a/kernel/rcu/tree_plugin.h -+++ b/kernel/rcu/tree_plugin.h -@@ -2275,6 +2275,7 @@ static int rcu_nocb_kthread(void *arg) - cl++; - c++; - local_bh_enable(); -+ cond_resched_rcu_qs(); - list = next; - } - trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1); -diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h -index 4f6c62e5c21e..37ff0ab6a8ff 100644 ---- a/mm/kasan/kasan.h -+++ b/mm/kasan/kasan.h -@@ -52,6 +52,9 @@ struct kasan_global { - #if KASAN_ABI_VERSION >= 4 - struct kasan_source_location *location; - #endif -+#if KASAN_ABI_VERSION >= 5 -+ char *odr_indicator; -+#endif - }; - - static inline const void *kasan_shadow_to_mem(const void *shadow_addr) -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 3a9b66c6e09c..0aca39762ed0 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -1886,8 +1886,8 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) - snd_timer_interrupt(substream->timer, 1); - #endif - _end: -- snd_pcm_stream_unlock_irqrestore(substream, flags); - kill_fasync(&runtime->fasync, SIGIO, POLL_IN); -+ snd_pcm_stream_unlock_irqrestore(substream, flags); - } - - EXPORT_SYMBOL(snd_pcm_period_elapsed); diff --git a/patch/kernel/mvebu-default/patch-4.4.37-38.patch b/patch/kernel/mvebu-default/patch-4.4.37-38.patch deleted file mode 100644 index 4185e3448..000000000 --- a/patch/kernel/mvebu-default/patch-4.4.37-38.patch +++ /dev/null @@ -1,1016 +0,0 @@ -diff --git a/Makefile b/Makefile -index b57ec79b4941..6876efe0d735 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 37 -+SUBLEVEL = 38 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c -index c3c12efe0bc0..9c0c8fd0b292 100644 ---- a/arch/sparc/kernel/signal_32.c -+++ b/arch/sparc/kernel/signal_32.c -@@ -89,7 +89,7 @@ asmlinkage void do_sigreturn(struct pt_regs *regs) - sf = (struct signal_frame __user *) regs->u_regs[UREG_FP]; - - /* 1. Make sure we are not getting garbage from the user */ -- if (!invalid_frame_pointer(sf, sizeof(*sf))) -+ if (invalid_frame_pointer(sf, sizeof(*sf))) - goto segv_and_exit; - - if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP])) -@@ -150,7 +150,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs) - - synchronize_user_stack(); - sf = (struct rt_signal_frame __user *) regs->u_regs[UREG_FP]; -- if (!invalid_frame_pointer(sf, sizeof(*sf))) -+ if (invalid_frame_pointer(sf, sizeof(*sf))) - goto segv; - - if (get_user(ufp, &sf->regs.u_regs[UREG_FP])) -diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c -index a5331c336b2a..3d3414c14792 100644 ---- a/arch/sparc/mm/init_64.c -+++ b/arch/sparc/mm/init_64.c -@@ -800,8 +800,10 @@ struct mdesc_mblock { - }; - static struct mdesc_mblock *mblocks; - static int num_mblocks; -+static int find_numa_node_for_addr(unsigned long pa, -+ struct node_mem_mask *pnode_mask); - --static unsigned long ra_to_pa(unsigned long addr) -+static unsigned long __init ra_to_pa(unsigned long addr) - { - int i; - -@@ -817,8 +819,11 @@ static unsigned long ra_to_pa(unsigned long addr) - return addr; - } - --static int find_node(unsigned long addr) -+static int __init find_node(unsigned long addr) - { -+ static bool search_mdesc = true; -+ static struct node_mem_mask last_mem_mask = { ~0UL, ~0UL }; -+ static int last_index; - int i; - - addr = ra_to_pa(addr); -@@ -828,13 +833,30 @@ static int find_node(unsigned long addr) - if ((addr & p->mask) == p->val) - return i; - } -- /* The following condition has been observed on LDOM guests.*/ -- WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node" -- " rule. Some physical memory will be owned by node 0."); -- return 0; -+ /* The following condition has been observed on LDOM guests because -+ * node_masks only contains the best latency mask and value. -+ * LDOM guest's mdesc can contain a single latency group to -+ * cover multiple address range. Print warning message only if the -+ * address cannot be found in node_masks nor mdesc. -+ */ -+ if ((search_mdesc) && -+ ((addr & last_mem_mask.mask) != last_mem_mask.val)) { -+ /* find the available node in the mdesc */ -+ last_index = find_numa_node_for_addr(addr, &last_mem_mask); -+ numadbg("find_node: latency group for address 0x%lx is %d\n", -+ addr, last_index); -+ if ((last_index < 0) || (last_index >= num_node_masks)) { -+ /* WARN_ONCE() and use default group 0 */ -+ WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node rule. Some physical memory will be owned by node 0."); -+ search_mdesc = false; -+ last_index = 0; -+ } -+ } -+ -+ return last_index; - } - --static u64 memblock_nid_range(u64 start, u64 end, int *nid) -+static u64 __init memblock_nid_range(u64 start, u64 end, int *nid) - { - *nid = find_node(start); - start += PAGE_SIZE; -@@ -1158,6 +1180,41 @@ int __node_distance(int from, int to) - return numa_latency[from][to]; - } - -+static int find_numa_node_for_addr(unsigned long pa, -+ struct node_mem_mask *pnode_mask) -+{ -+ struct mdesc_handle *md = mdesc_grab(); -+ u64 node, arc; -+ int i = 0; -+ -+ node = mdesc_node_by_name(md, MDESC_NODE_NULL, "latency-groups"); -+ if (node == MDESC_NODE_NULL) -+ goto out; -+ -+ mdesc_for_each_node_by_name(md, node, "group") { -+ mdesc_for_each_arc(arc, md, node, MDESC_ARC_TYPE_FWD) { -+ u64 target = mdesc_arc_target(md, arc); -+ struct mdesc_mlgroup *m = find_mlgroup(target); -+ -+ if (!m) -+ continue; -+ if ((pa & m->mask) == m->match) { -+ if (pnode_mask) { -+ pnode_mask->mask = m->mask; -+ pnode_mask->val = m->match; -+ } -+ mdesc_release(md); -+ return i; -+ } -+ } -+ i++; -+ } -+ -+out: -+ mdesc_release(md); -+ return -1; -+} -+ - static int find_best_numa_node_for_mlgroup(struct mdesc_mlgroup *grp) - { - int i; -diff --git a/block/blk-map.c b/block/blk-map.c -index f565e11f465a..69953bd97e65 100644 ---- a/block/blk-map.c -+++ b/block/blk-map.c -@@ -90,6 +90,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, - if (!iter || !iter->count) - return -EINVAL; - -+ if (!iter_is_iovec(iter)) -+ return -EINVAL; -+ - iov_for_each(iov, i, *iter) { - unsigned long uaddr = (unsigned long) iov.iov_base; - -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index 6f946fedbb77..0864f05633a2 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -1137,6 +1137,7 @@ static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port, - struct phy_device *phydev) - { - struct bcm_sf2_priv *priv = ds_to_priv(ds); -+ struct ethtool_eee *p = &priv->port_sts[port].eee; - u32 id_mode_dis = 0, port_mode; - const char *str = NULL; - u32 reg; -@@ -1211,6 +1212,9 @@ force_link: - reg |= DUPLX_MODE; - - core_writel(priv, reg, CORE_STS_OVERRIDE_GMIIP_PORT(port)); -+ -+ if (!phydev->is_pseudo_fixed_link) -+ p->eee_enabled = bcm_sf2_eee_init(ds, port, phydev); - } - - static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port, -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 0fb3f8de88e9..91627561c58d 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -1168,6 +1168,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, - struct bcmgenet_tx_ring *ring) - { - struct bcmgenet_priv *priv = netdev_priv(dev); -+ struct device *kdev = &priv->pdev->dev; - struct enet_cb *tx_cb_ptr; - struct netdev_queue *txq; - unsigned int pkts_compl = 0; -@@ -1195,7 +1196,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, - pkts_compl++; - dev->stats.tx_packets++; - dev->stats.tx_bytes += tx_cb_ptr->skb->len; -- dma_unmap_single(&dev->dev, -+ dma_unmap_single(kdev, - dma_unmap_addr(tx_cb_ptr, dma_addr), - dma_unmap_len(tx_cb_ptr, dma_len), - DMA_TO_DEVICE); -@@ -1203,7 +1204,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, - } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) { - dev->stats.tx_bytes += - dma_unmap_len(tx_cb_ptr, dma_len); -- dma_unmap_page(&dev->dev, -+ dma_unmap_page(kdev, - dma_unmap_addr(tx_cb_ptr, dma_addr), - dma_unmap_len(tx_cb_ptr, dma_len), - DMA_TO_DEVICE); -@@ -1754,6 +1755,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv, - - static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv) - { -+ struct device *kdev = &priv->pdev->dev; - struct enet_cb *cb; - int i; - -@@ -1761,7 +1763,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv) - cb = &priv->rx_cbs[i]; - - if (dma_unmap_addr(cb, dma_addr)) { -- dma_unmap_single(&priv->dev->dev, -+ dma_unmap_single(kdev, - dma_unmap_addr(cb, dma_addr), - priv->rx_buf_len, DMA_FROM_DEVICE); - dma_unmap_addr_set(cb, dma_addr, 0); -diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c -index 5606a043063e..4b62aa1f9ff8 100644 ---- a/drivers/net/ethernet/marvell/sky2.c -+++ b/drivers/net/ethernet/marvell/sky2.c -@@ -5220,6 +5220,19 @@ static SIMPLE_DEV_PM_OPS(sky2_pm_ops, sky2_suspend, sky2_resume); - - static void sky2_shutdown(struct pci_dev *pdev) - { -+ struct sky2_hw *hw = pci_get_drvdata(pdev); -+ int port; -+ -+ for (port = 0; port < hw->ports; port++) { -+ struct net_device *ndev = hw->dev[port]; -+ -+ rtnl_lock(); -+ if (netif_running(ndev)) { -+ dev_close(ndev); -+ netif_device_detach(ndev); -+ } -+ rtnl_unlock(); -+ } - sky2_suspend(&pdev->dev); - pci_wake_from_d3(pdev, device_may_wakeup(&pdev->dev)); - pci_set_power_state(pdev, PCI_D3hot); -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 36fc9427418f..480f3dae0780 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -832,7 +832,7 @@ static struct sh_eth_cpu_data r7s72100_data = { - - .ecsr_value = ECSR_ICD, - .ecsipr_value = ECSIPR_ICDIP, -- .eesipr_value = 0xff7f009f, -+ .eesipr_value = 0xe77f009f, - - .tx_check = EESR_TC1 | EESR_FTC, - .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | -diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c -index 4827c6987ac3..f0961cbaf87e 100644 ---- a/drivers/net/geneve.c -+++ b/drivers/net/geneve.c -@@ -815,7 +815,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, - struct geneve_dev *geneve = netdev_priv(dev); - struct geneve_sock *gs4 = geneve->sock4; - struct rtable *rt = NULL; -- const struct iphdr *iip; /* interior IP header */ - int err = -EINVAL; - struct flowi4 fl4; - __u8 tos, ttl; -@@ -842,8 +841,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); - skb_reset_mac_header(skb); - -- iip = ip_hdr(skb); -- - if (info) { - const struct ip_tunnel_key *key = &info->key; - u8 *opts = NULL; -@@ -859,7 +856,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, - if (unlikely(err)) - goto err; - -- tos = ip_tunnel_ecn_encap(key->tos, iip, skb); -+ tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); - ttl = key->ttl; - df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; - } else { -@@ -869,7 +866,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, - if (unlikely(err)) - goto err; - -- tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb); -+ tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb); - ttl = geneve->ttl; - if (!ttl && IN_MULTICAST(ntohl(fl4.daddr))) - ttl = 1; -@@ -903,7 +900,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, - struct geneve_dev *geneve = netdev_priv(dev); - struct geneve_sock *gs6 = geneve->sock6; - struct dst_entry *dst = NULL; -- const struct iphdr *iip; /* interior IP header */ - int err = -EINVAL; - struct flowi6 fl6; - __u8 prio, ttl; -@@ -927,8 +923,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); - skb_reset_mac_header(skb); - -- iip = ip_hdr(skb); -- - if (info) { - const struct ip_tunnel_key *key = &info->key; - u8 *opts = NULL; -@@ -945,7 +939,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, - if (unlikely(err)) - goto err; - -- prio = ip_tunnel_ecn_encap(key->tos, iip, skb); -+ prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); - ttl = key->ttl; - } else { - udp_csum = false; -@@ -954,7 +948,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, - if (unlikely(err)) - goto err; - -- prio = ip_tunnel_ecn_encap(fl6.flowi6_tos, iip, skb); -+ prio = ip_tunnel_ecn_encap(fl6.flowi6_tos, ip_hdr(skb), skb); - ttl = geneve->ttl; - if (!ttl && ipv6_addr_is_multicast(&fl6.daddr)) - ttl = 1; -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index f94ab786088f..0e2a19e58923 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -1465,6 +1465,11 @@ static void virtnet_free_queues(struct virtnet_info *vi) - netif_napi_del(&vi->rq[i].napi); - } - -+ /* We called napi_hash_del() before netif_napi_del(), -+ * we need to respect an RCU grace period before freeing vi->rq -+ */ -+ synchronize_net(); -+ - kfree(vi->rq); - kfree(vi->sq); - } -diff --git a/include/linux/uio.h b/include/linux/uio.h -index 5f9c59da978b..e2225109b816 100644 ---- a/include/linux/uio.h -+++ b/include/linux/uio.h -@@ -101,12 +101,12 @@ int iov_iter_npages(const struct iov_iter *i, int maxpages); - - const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags); - --static inline size_t iov_iter_count(struct iov_iter *i) -+static inline size_t iov_iter_count(const struct iov_iter *i) - { - return i->count; - } - --static inline bool iter_is_iovec(struct iov_iter *i) -+static inline bool iter_is_iovec(const struct iov_iter *i) - { - return !(i->type & (ITER_BVEC | ITER_KVEC)); - } -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 2c2eb1b629b1..2e9a1c2818c7 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -217,6 +217,8 @@ int peernet2id_alloc(struct net *net, struct net *peer) - bool alloc; - int id; - -+ if (atomic_read(&net->count) == 0) -+ return NETNSA_NSID_NOT_ASSIGNED; - spin_lock_irqsave(&net->nsid_lock, flags); - alloc = atomic_read(&peer->count) == 0 ? false : true; - id = __peernet2id_alloc(net, peer, &alloc); -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 87b91ffbdec3..b94e165a4f79 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2600,7 +2600,10 @@ nla_put_failure: - - static inline size_t rtnl_fdb_nlmsg_size(void) - { -- return NLMSG_ALIGN(sizeof(struct ndmsg)) + nla_total_size(ETH_ALEN); -+ return NLMSG_ALIGN(sizeof(struct ndmsg)) + -+ nla_total_size(ETH_ALEN) + /* NDA_LLADDR */ -+ nla_total_size(sizeof(u16)) + /* NDA_VLAN */ -+ 0; - } - - static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type) -diff --git a/net/core/sock.c b/net/core/sock.c -index 88f017854509..f4c0917e66b5 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -745,7 +745,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, - val = min_t(u32, val, sysctl_wmem_max); - set_sndbuf: - sk->sk_userlocks |= SOCK_SNDBUF_LOCK; -- sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF); -+ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); - /* Wake up sending tasks if we upped the value. */ - sk->sk_write_space(sk); - break; -@@ -781,7 +781,7 @@ set_rcvbuf: - * returning the value we actually used in getsockopt - * is the most desirable behavior. - */ -- sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF); -+ sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); - break; - - case SO_RCVBUFFORCE: -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 861e1fa25d5e..0759f5b9180e 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -698,6 +698,7 @@ int dccp_invalid_packet(struct sk_buff *skb) - { - const struct dccp_hdr *dh; - unsigned int cscov; -+ u8 dccph_doff; - - if (skb->pkt_type != PACKET_HOST) - return 1; -@@ -719,18 +720,19 @@ int dccp_invalid_packet(struct sk_buff *skb) - /* - * If P.Data Offset is too small for packet type, drop packet and return - */ -- if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) { -- DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff); -+ dccph_doff = dh->dccph_doff; -+ if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) { -+ DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff); - return 1; - } - /* - * If P.Data Offset is too too large for packet, drop packet and return - */ -- if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) { -- DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff); -+ if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) { -+ DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff); - return 1; - } -- -+ dh = dccp_hdr(skb); - /* - * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet - * has short sequence numbers), drop packet and return -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index d95631d09248..20fb25e3027b 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -476,7 +476,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) - esph = (void *)skb_push(skb, 4); - *seqhi = esph->spi; - esph->spi = esph->seq_no; -- esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi); -+ esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi; - aead_request_set_callback(req, 0, esp_input_done_esn, skb); - } - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index f2ad5216c438..2b7283303650 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -102,6 +102,9 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb) - - iph->tot_len = htons(skb->len); - ip_send_check(iph); -+ -+ skb->protocol = htons(ETH_P_IP); -+ - return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, - net, sk, skb, NULL, skb_dst(skb)->dev, - dst_output); -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index aa67e0e64b69..23160d2b3f71 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -660,6 +660,10 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len, - if (len > 0xFFFF) - return -EMSGSIZE; - -+ /* Must have at least a full ICMP header. */ -+ if (len < icmph_len) -+ return -EINVAL; -+ - /* - * Check the flags. - */ -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 060a60b2f8a6..111ba55fd512 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -418,7 +418,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) - esph = (void *)skb_push(skb, 4); - *seqhi = esph->spi; - esph->spi = esph->seq_no; -- esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi); -+ esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi; - aead_request_set_callback(req, 0, esp_input_done_esn, skb); - } - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index e8878886eba4..2994d1f1a661 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1043,6 +1043,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - struct ipv6_tel_txoption opt; - struct dst_entry *dst = NULL, *ndst = NULL; - struct net_device *tdev; -+ bool use_cache = false; - int mtu; - unsigned int max_headroom = sizeof(struct ipv6hdr); - u8 proto; -@@ -1070,7 +1071,15 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - - memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); - neigh_release(neigh); -- } else if (!fl6->flowi6_mark) -+ } else if (!(t->parms.flags & -+ (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) { -+ /* enable the cache only only if the routing decision does -+ * not depend on the current inner header value -+ */ -+ use_cache = true; -+ } -+ -+ if (use_cache) - dst = ip6_tnl_dst_get(t); - - if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr)) -@@ -1134,7 +1143,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - skb = new_skb; - } - -- if (!fl6->flowi6_mark && ndst) -+ if (use_cache && ndst) - ip6_tnl_dst_set(t, ndst); - skb_dst_set(skb, dst); - -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 462f2a76b5c2..1d184322a7b1 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -148,6 +148,8 @@ int __ip6_local_out(struct net *net, struct sock *sk, struct sk_buff *skb) - ipv6_hdr(skb)->payload_len = htons(len); - IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); - -+ skb->protocol = htons(ETH_P_IPV6); -+ - return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, - net, sk, skb, NULL, skb_dst(skb)->dev, - dst_output); -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index 42de4ccd159f..d0e906d39642 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -251,8 +251,6 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - int ret; - int chk_addr_ret; - -- if (!sock_flag(sk, SOCK_ZAPPED)) -- return -EINVAL; - if (addr_len < sizeof(struct sockaddr_l2tpip)) - return -EINVAL; - if (addr->l2tp_family != AF_INET) -@@ -267,6 +265,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - read_unlock_bh(&l2tp_ip_lock); - - lock_sock(sk); -+ if (!sock_flag(sk, SOCK_ZAPPED)) -+ goto out; -+ - if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip)) - goto out; - -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index 9ee4ddb6b397..3c4f867d3633 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -266,8 +266,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - int addr_type; - int err; - -- if (!sock_flag(sk, SOCK_ZAPPED)) -- return -EINVAL; - if (addr->l2tp_family != AF_INET6) - return -EINVAL; - if (addr_len < sizeof(*addr)) -@@ -293,6 +291,9 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len) - lock_sock(sk); - - err = -EINVAL; -+ if (!sock_flag(sk, SOCK_ZAPPED)) -+ goto out_unlock; -+ - if (sk->sk_state != TCP_CLOSE) - goto out_unlock; - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 28fc283c1ec1..360700a2f46c 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -931,7 +931,6 @@ static void netlink_sock_destruct(struct sock *sk) - if (nlk->cb_running) { - if (nlk->cb.done) - nlk->cb.done(&nlk->cb); -- - module_put(nlk->cb.module); - kfree_skb(nlk->cb.skb); - } -@@ -960,6 +959,14 @@ static void netlink_sock_destruct(struct sock *sk) - WARN_ON(nlk_sk(sk)->groups); - } - -+static void netlink_sock_destruct_work(struct work_struct *work) -+{ -+ struct netlink_sock *nlk = container_of(work, struct netlink_sock, -+ work); -+ -+ sk_free(&nlk->sk); -+} -+ - /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on - * SMP. Look, when several writers sleep and reader wakes them up, all but one - * immediately hit write lock and grab all the cpus. Exclusive sleep solves -@@ -1265,8 +1272,18 @@ out_module: - static void deferred_put_nlk_sk(struct rcu_head *head) - { - struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu); -+ struct sock *sk = &nlk->sk; -+ -+ if (!atomic_dec_and_test(&sk->sk_refcnt)) -+ return; -+ -+ if (nlk->cb_running && nlk->cb.done) { -+ INIT_WORK(&nlk->work, netlink_sock_destruct_work); -+ schedule_work(&nlk->work); -+ return; -+ } - -- sock_put(&nlk->sk); -+ sk_free(sk); - } - - static int netlink_release(struct socket *sock) -diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h -index 14437d9b1965..df32cb92d9fc 100644 ---- a/net/netlink/af_netlink.h -+++ b/net/netlink/af_netlink.h -@@ -3,6 +3,7 @@ - - #include - #include -+#include - #include - - #define NLGRPSZ(x) (ALIGN(x, sizeof(unsigned long) * 8) / 8) -@@ -53,6 +54,7 @@ struct netlink_sock { - - struct rhash_head node; - struct rcu_head rcu; -+ struct work_struct work; - }; - - static inline struct netlink_sock *nlk_sk(struct sock *sk) -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 34e4fcfd240b..f223d1c80ccf 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3572,19 +3572,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4067,6 +4073,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - WARN(1, "Tx-ring is not supported.\n"); -@@ -4148,7 +4155,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4197,11 +4203,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } - -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index e38a7701f154..c3434e902445 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -104,6 +104,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind) - kfree(keys); - } - -+static bool offset_valid(struct sk_buff *skb, int offset) -+{ -+ if (offset > 0 && offset > skb->len) -+ return false; -+ -+ if (offset < 0 && -offset > skb_headroom(skb)) -+ return false; -+ -+ return true; -+} -+ - static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, - struct tcf_result *res) - { -@@ -130,6 +141,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, - if (tkey->offmask) { - char *d, _d; - -+ if (!offset_valid(skb, off + tkey->at)) { -+ pr_info("tc filter pedit 'at' offset %d out of bounds\n", -+ off + tkey->at); -+ goto bad; -+ } - d = skb_header_pointer(skb, off + tkey->at, 1, - &_d); - if (!d) -@@ -142,10 +158,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, - " offset must be on 32 bit boundaries\n"); - goto bad; - } -- if (offset > 0 && offset > skb->len) { -- pr_info("tc filter pedit" -- " offset %d can't exceed pkt length %d\n", -- offset, skb->len); -+ -+ if (!offset_valid(skb, off + offset)) { -+ pr_info("tc filter pedit offset %d out of bounds\n", -+ offset); - goto bad; - } - -diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c -index 0b8c3ace671f..1bf1f4517db6 100644 ---- a/net/sched/cls_basic.c -+++ b/net/sched/cls_basic.c -@@ -62,9 +62,6 @@ static unsigned long basic_get(struct tcf_proto *tp, u32 handle) - struct basic_head *head = rtnl_dereference(tp->root); - struct basic_filter *f; - -- if (head == NULL) -- return 0UL; -- - list_for_each_entry(f, &head->flist, link) { - if (f->handle == handle) { - l = (unsigned long) f; -@@ -109,7 +106,6 @@ static bool basic_destroy(struct tcf_proto *tp, bool force) - tcf_unbind_filter(tp, &f->res); - call_rcu(&f->rcu, basic_delete_filter); - } -- RCU_INIT_POINTER(tp->root, NULL); - kfree_rcu(head, rcu); - return true; - } -diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c -index 5faaa5425f7b..3eef0215e53f 100644 ---- a/net/sched/cls_bpf.c -+++ b/net/sched/cls_bpf.c -@@ -199,7 +199,6 @@ static bool cls_bpf_destroy(struct tcf_proto *tp, bool force) - call_rcu(&prog->rcu, __cls_bpf_delete_prog); - } - -- RCU_INIT_POINTER(tp->root, NULL); - kfree_rcu(head, rcu); - return true; - } -@@ -210,9 +209,6 @@ static unsigned long cls_bpf_get(struct tcf_proto *tp, u32 handle) - struct cls_bpf_prog *prog; - unsigned long ret = 0UL; - -- if (head == NULL) -- return 0UL; -- - list_for_each_entry(prog, &head->plist, link) { - if (prog->handle == handle) { - ret = (unsigned long) prog; -diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c -index 4c85bd3a750c..c104c2019feb 100644 ---- a/net/sched/cls_cgroup.c -+++ b/net/sched/cls_cgroup.c -@@ -130,11 +130,10 @@ static bool cls_cgroup_destroy(struct tcf_proto *tp, bool force) - - if (!force) - return false; -- -- if (head) { -- RCU_INIT_POINTER(tp->root, NULL); -+ /* Head can still be NULL due to cls_cgroup_init(). */ -+ if (head) - call_rcu(&head->rcu, cls_cgroup_destroy_rcu); -- } -+ - return true; - } - -diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c -index fbfec6a18839..d7ba2b4ff0f3 100644 ---- a/net/sched/cls_flow.c -+++ b/net/sched/cls_flow.c -@@ -583,7 +583,6 @@ static bool flow_destroy(struct tcf_proto *tp, bool force) - list_del_rcu(&f->list); - call_rcu(&f->rcu, flow_destroy_filter); - } -- RCU_INIT_POINTER(tp->root, NULL); - kfree_rcu(head, rcu); - return true; - } -diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c -index 95b021243233..e5a58c82728a 100644 ---- a/net/sched/cls_flower.c -+++ b/net/sched/cls_flower.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -55,7 +56,10 @@ struct cls_fl_head { - bool mask_assigned; - struct list_head filters; - struct rhashtable_params ht_params; -- struct rcu_head rcu; -+ union { -+ struct work_struct work; -+ struct rcu_head rcu; -+ }; - }; - - struct cls_fl_filter { -@@ -165,6 +169,24 @@ static void fl_destroy_filter(struct rcu_head *head) - kfree(f); - } - -+static void fl_destroy_sleepable(struct work_struct *work) -+{ -+ struct cls_fl_head *head = container_of(work, struct cls_fl_head, -+ work); -+ if (head->mask_assigned) -+ rhashtable_destroy(&head->ht); -+ kfree(head); -+ module_put(THIS_MODULE); -+} -+ -+static void fl_destroy_rcu(struct rcu_head *rcu) -+{ -+ struct cls_fl_head *head = container_of(rcu, struct cls_fl_head, rcu); -+ -+ INIT_WORK(&head->work, fl_destroy_sleepable); -+ schedule_work(&head->work); -+} -+ - static bool fl_destroy(struct tcf_proto *tp, bool force) - { - struct cls_fl_head *head = rtnl_dereference(tp->root); -@@ -177,10 +199,9 @@ static bool fl_destroy(struct tcf_proto *tp, bool force) - list_del_rcu(&f->list); - call_rcu(&f->rcu, fl_destroy_filter); - } -- RCU_INIT_POINTER(tp->root, NULL); -- if (head->mask_assigned) -- rhashtable_destroy(&head->ht); -- kfree_rcu(head, rcu); -+ -+ __module_get(THIS_MODULE); -+ call_rcu(&head->rcu, fl_destroy_rcu); - return true; - } - -diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h -index f9c9fc075fe6..9992dfac6938 100644 ---- a/net/sched/cls_rsvp.h -+++ b/net/sched/cls_rsvp.h -@@ -152,7 +152,8 @@ static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp, - return -1; - nhptr = ip_hdr(skb); - #endif -- -+ if (unlikely(!head)) -+ return -1; - restart: - - #if RSVP_DST_LEN == 4 -diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c -index 944c8ff45055..403746b20263 100644 ---- a/net/sched/cls_tcindex.c -+++ b/net/sched/cls_tcindex.c -@@ -503,7 +503,6 @@ static bool tcindex_destroy(struct tcf_proto *tp, bool force) - walker.fn = tcindex_destroy_element; - tcindex_walk(tp, &walker); - -- RCU_INIT_POINTER(tp->root, NULL); - call_rcu(&p->rcu, __tcindex_destroy); - return true; - } -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 824cc1e160bc..73f75258ce46 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -2194,7 +2194,8 @@ out: - * Sleep until more data has arrived. But check for races.. - */ - static long unix_stream_data_wait(struct sock *sk, long timeo, -- struct sk_buff *last, unsigned int last_len) -+ struct sk_buff *last, unsigned int last_len, -+ bool freezable) - { - struct sk_buff *tail; - DEFINE_WAIT(wait); -@@ -2215,7 +2216,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo, - - sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk); - unix_state_unlock(sk); -- timeo = freezable_schedule_timeout(timeo); -+ if (freezable) -+ timeo = freezable_schedule_timeout(timeo); -+ else -+ timeo = schedule_timeout(timeo); - unix_state_lock(sk); - - if (sock_flag(sk, SOCK_DEAD)) -@@ -2245,7 +2249,8 @@ struct unix_stream_read_state { - unsigned int splice_flags; - }; - --static int unix_stream_read_generic(struct unix_stream_read_state *state) -+static int unix_stream_read_generic(struct unix_stream_read_state *state, -+ bool freezable) - { - struct scm_cookie scm; - struct socket *sock = state->socket; -@@ -2324,7 +2329,7 @@ again: - mutex_unlock(&u->iolock); - - timeo = unix_stream_data_wait(sk, timeo, last, -- last_len); -+ last_len, freezable); - - if (signal_pending(current)) { - err = sock_intr_errno(timeo); -@@ -2466,7 +2471,7 @@ static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg, - .flags = flags - }; - -- return unix_stream_read_generic(&state); -+ return unix_stream_read_generic(&state, true); - } - - static ssize_t skb_unix_socket_splice(struct sock *sk, -@@ -2512,7 +2517,7 @@ static ssize_t unix_stream_splice_read(struct socket *sock, loff_t *ppos, - flags & SPLICE_F_NONBLOCK) - state.flags = MSG_DONTWAIT; - -- return unix_stream_read_generic(&state); -+ return unix_stream_read_generic(&state, false); - } - - static int unix_shutdown(struct socket *sock, int mode)