diff options
author | 2017-04-18 06:20:01 -0400 | |
---|---|---|
committer | 2017-04-18 06:20:01 -0400 | |
commit | f209e98096e70700cfc4d98580b2f817781c15b6 (patch) | |
tree | 9866c213a1cf31faa3ebd442c15f74487abd6a04 | |
parent | Enable crypto API for systemd as its required for systemd versions >= 233. Se... (diff) | |
download | linux-patches-3.18.tar.gz linux-patches-3.18.tar.bz2 linux-patches-3.18.zip |
Linux patch 3.18.493.18
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1048_linux-3.18.49.patch | 10446 |
2 files changed, 10450 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 4676a646..4c41f0bb 100644 --- a/0000_README +++ b/0000_README @@ -235,6 +235,10 @@ Patch: 1047_linux-3.18.48.patch From: http://www.kernel.org Desc: Linux 3.18.48 +Patch: 1048_linux-3.18.49.patch +From: http://www.kernel.org +Desc: Linux 3.18.49 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1048_linux-3.18.49.patch b/1048_linux-3.18.49.patch new file mode 100644 index 00000000..d923bd55 --- /dev/null +++ b/1048_linux-3.18.49.patch @@ -0,0 +1,10446 @@ +diff --git a/Documentation/Makefile b/Documentation/Makefile +index bc0548201755..fc759598c4c9 100644 +--- a/Documentation/Makefile ++++ b/Documentation/Makefile +@@ -1,4 +1,4 @@ + subdir-y := accounting auxdisplay blackfin connector \ +- filesystems filesystems ia64 laptops mic misc-devices \ ++ filesystems filesystems ia64 laptops misc-devices \ + networking pcmcia prctl ptp spi timers vDSO video4linux \ + watchdog +diff --git a/Documentation/mic/Makefile b/Documentation/mic/Makefile +deleted file mode 100644 +index a191d453badf..000000000000 +--- a/Documentation/mic/Makefile ++++ /dev/null +@@ -1 +0,0 @@ +-subdir-y := mpssd +diff --git a/Documentation/mic/mpssd/.gitignore b/Documentation/mic/mpssd/.gitignore +deleted file mode 100644 +index 8b7c72f07c92..000000000000 +--- a/Documentation/mic/mpssd/.gitignore ++++ /dev/null +@@ -1 +0,0 @@ +-mpssd +diff --git a/Documentation/mic/mpssd/Makefile b/Documentation/mic/mpssd/Makefile +deleted file mode 100644 +index 0f3156888048..000000000000 +--- a/Documentation/mic/mpssd/Makefile ++++ /dev/null +@@ -1,19 +0,0 @@ +-# List of programs to build +-hostprogs-y := mpssd +- +-mpssd-objs := mpssd.o sysfs.o +- +-# Tell kbuild to always build the programs +-always := $(hostprogs-y) +- +-HOSTCFLAGS += -I$(objtree)/usr/include -I$(srctree)/tools/include +- +-ifdef DEBUG +-HOSTCFLAGS += -DDEBUG=$(DEBUG) +-endif +- +-HOSTLOADLIBES_mpssd := -lpthread +- +-install: +- install mpssd /usr/sbin/mpssd +- install micctrl /usr/sbin/micctrl +diff --git a/Documentation/mic/mpssd/micctrl b/Documentation/mic/mpssd/micctrl +deleted file mode 100755 +index 8f2629b41c5f..000000000000 +--- a/Documentation/mic/mpssd/micctrl ++++ /dev/null +@@ -1,173 +0,0 @@ +-#!/bin/bash +-# Intel MIC Platform Software Stack (MPSS) +-# +-# Copyright(c) 2013 Intel Corporation. +-# +-# This program is free software; you can redistribute it and/or modify +-# it under the terms of the GNU General Public License, version 2, as +-# published by the Free Software Foundation. +-# +-# This program is distributed in the hope that it will be useful, but +-# WITHOUT ANY WARRANTY; without even the implied warranty of +-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +-# General Public License for more details. +-# +-# The full GNU General Public License is included in this distribution in +-# the file called "COPYING". +-# +-# Intel MIC User Space Tools. +-# +-# micctrl - Controls MIC boot/start/stop. +-# +-# chkconfig: 2345 95 05 +-# description: start MPSS stack processing. +-# +-### BEGIN INIT INFO +-# Provides: micctrl +-### END INIT INFO +- +-# Source function library. +-. /etc/init.d/functions +- +-sysfs="/sys/class/mic" +- +-_status() +-{ +- f=$sysfs/$1 +- echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`" +-} +- +-status() +-{ +- if [ "`echo $1 | head -c3`" == "mic" ]; then +- _status $1 +- return $? +- fi +- for f in $sysfs/* +- do +- _status `basename $f` +- RETVAL=$? +- [ $RETVAL -ne 0 ] && return $RETVAL +- done +- return 0 +-} +- +-_reset() +-{ +- f=$sysfs/$1 +- echo reset > $f/state +-} +- +-reset() +-{ +- if [ "`echo $1 | head -c3`" == "mic" ]; then +- _reset $1 +- return $? +- fi +- for f in $sysfs/* +- do +- _reset `basename $f` +- RETVAL=$? +- [ $RETVAL -ne 0 ] && return $RETVAL +- done +- return 0 +-} +- +-_boot() +-{ +- f=$sysfs/$1 +- echo "linux" > $f/bootmode +- echo "mic/uos.img" > $f/firmware +- echo "mic/$1.image" > $f/ramdisk +- echo "boot" > $f/state +-} +- +-boot() +-{ +- if [ "`echo $1 | head -c3`" == "mic" ]; then +- _boot $1 +- return $? +- fi +- for f in $sysfs/* +- do +- _boot `basename $f` +- RETVAL=$? +- [ $RETVAL -ne 0 ] && return $RETVAL +- done +- return 0 +-} +- +-_shutdown() +-{ +- f=$sysfs/$1 +- echo shutdown > $f/state +-} +- +-shutdown() +-{ +- if [ "`echo $1 | head -c3`" == "mic" ]; then +- _shutdown $1 +- return $? +- fi +- for f in $sysfs/* +- do +- _shutdown `basename $f` +- RETVAL=$? +- [ $RETVAL -ne 0 ] && return $RETVAL +- done +- return 0 +-} +- +-_wait() +-{ +- f=$sysfs/$1 +- while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ] +- do +- sleep 1 +- echo -e "Waiting for $1 to go offline" +- done +-} +- +-wait() +-{ +- if [ "`echo $1 | head -c3`" == "mic" ]; then +- _wait $1 +- return $? +- fi +- # Wait for the cards to go offline +- for f in $sysfs/* +- do +- _wait `basename $f` +- RETVAL=$? +- [ $RETVAL -ne 0 ] && return $RETVAL +- done +- return 0 +-} +- +-if [ ! -d "$sysfs" ]; then +- echo -e $"Module unloaded " +- exit 3 +-fi +- +-case $1 in +- -s) +- status $2 +- ;; +- -r) +- reset $2 +- ;; +- -b) +- boot $2 +- ;; +- -S) +- shutdown $2 +- ;; +- -w) +- wait $2 +- ;; +- *) +- echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}" +- exit 2 +-esac +- +-exit $? +diff --git a/Documentation/mic/mpssd/mpss b/Documentation/mic/mpssd/mpss +deleted file mode 100755 +index cacbdb0aefb9..000000000000 +--- a/Documentation/mic/mpssd/mpss ++++ /dev/null +@@ -1,202 +0,0 @@ +-#!/bin/bash +-# Intel MIC Platform Software Stack (MPSS) +-# +-# Copyright(c) 2013 Intel Corporation. +-# +-# This program is free software; you can redistribute it and/or modify +-# it under the terms of the GNU General Public License, version 2, as +-# published by the Free Software Foundation. +-# +-# This program is distributed in the hope that it will be useful, but +-# WITHOUT ANY WARRANTY; without even the implied warranty of +-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +-# General Public License for more details. +-# +-# The full GNU General Public License is included in this distribution in +-# the file called "COPYING". +-# +-# Intel MIC User Space Tools. +-# +-# mpss Start mpssd. +-# +-# chkconfig: 2345 95 05 +-# description: start MPSS stack processing. +-# +-### BEGIN INIT INFO +-# Provides: mpss +-# Required-Start: +-# Required-Stop: +-# Short-Description: MPSS stack control +-# Description: MPSS stack control +-### END INIT INFO +- +-# Source function library. +-. /etc/init.d/functions +- +-exec=/usr/sbin/mpssd +-sysfs="/sys/class/mic" +- +-start() +-{ +- [ -x $exec ] || exit 5 +- +- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then +- echo -e $"MPSSD already running! " +- success +- echo +- return 0 +- fi +- +- echo -e $"Starting MPSS Stack" +- echo -e $"Loading MIC_X100_DMA & MIC_HOST Modules" +- +- for f in "mic_host" "mic_x100_dma" +- do +- modprobe $f +- RETVAL=$? +- if [ $RETVAL -ne 0 ]; then +- failure +- echo +- return $RETVAL +- fi +- done +- +- # Start the daemon +- echo -n $"Starting MPSSD " +- $exec +- RETVAL=$? +- if [ $RETVAL -ne 0 ]; then +- failure +- echo +- return $RETVAL +- fi +- success +- echo +- +- sleep 5 +- +- # Boot the cards +- micctrl -b +- +- # Wait till ping works +- for f in $sysfs/* +- do +- count=100 +- ipaddr=`cat $f/cmdline` +- ipaddr=${ipaddr#*address,} +- ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1` +- while [ $count -ge 0 ] +- do +- echo -e "Pinging "`basename $f`" " +- ping -c 1 $ipaddr &> /dev/null +- RETVAL=$? +- if [ $RETVAL -eq 0 ]; then +- success +- break +- fi +- sleep 1 +- count=`expr $count - 1` +- done +- [ $RETVAL -ne 0 ] && failure || success +- echo +- done +- return $RETVAL +-} +- +-stop() +-{ +- echo -e $"Shutting down MPSS Stack: " +- +- # Bail out if module is unloaded +- if [ ! -d "$sysfs" ]; then +- echo -n $"Module unloaded " +- success +- echo +- return 0 +- fi +- +- # Shut down the cards. +- micctrl -S +- +- # Wait for the cards to go offline +- for f in $sysfs/* +- do +- while [ "`cat $f/state`" != "offline" ] +- do +- sleep 1 +- echo -e "Waiting for "`basename $f`" to go offline" +- done +- done +- +- # Display the status of the cards +- micctrl -s +- +- # Kill MPSSD now +- echo -n $"Killing MPSSD" +- killall -9 mpssd 2>/dev/null +- RETVAL=$? +- [ $RETVAL -ne 0 ] && failure || success +- echo +- return $RETVAL +-} +- +-restart() +-{ +- stop +- sleep 5 +- start +-} +- +-status() +-{ +- micctrl -s +- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then +- echo "mpssd is running" +- else +- echo "mpssd is stopped" +- fi +- return 0 +-} +- +-unload() +-{ +- if [ ! -d "$sysfs" ]; then +- echo -n $"No MIC_HOST Module: " +- success +- echo +- return +- fi +- +- stop +- +- sleep 5 +- echo -n $"Removing MIC_HOST & MIC_X100_DMA Modules: " +- modprobe -r mic_host mic_x100_dma +- RETVAL=$? +- [ $RETVAL -ne 0 ] && failure || success +- echo +- return $RETVAL +-} +- +-case $1 in +- start) +- start +- ;; +- stop) +- stop +- ;; +- restart) +- restart +- ;; +- status) +- status +- ;; +- unload) +- unload +- ;; +- *) +- echo $"Usage: $0 {start|stop|restart|status|unload}" +- exit 2 +-esac +- +-exit $? +diff --git a/Documentation/mic/mpssd/mpssd.c b/Documentation/mic/mpssd/mpssd.c +deleted file mode 100644 +index 3c5c379fc29d..000000000000 +--- a/Documentation/mic/mpssd/mpssd.c ++++ /dev/null +@@ -1,1728 +0,0 @@ +-/* +- * Intel MIC Platform Software Stack (MPSS) +- * +- * Copyright(c) 2013 Intel Corporation. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License, version 2, as +- * published by the Free Software Foundation. +- * +- * This program is distributed in the hope that it will be useful, but +- * WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +- * General Public License for more details. +- * +- * The full GNU General Public License is included in this distribution in +- * the file called "COPYING". +- * +- * Intel MIC User Space Tools. +- */ +- +-#define _GNU_SOURCE +- +-#include <stdlib.h> +-#include <fcntl.h> +-#include <getopt.h> +-#include <assert.h> +-#include <unistd.h> +-#include <stdbool.h> +-#include <signal.h> +-#include <poll.h> +-#include <features.h> +-#include <sys/types.h> +-#include <sys/stat.h> +-#include <sys/mman.h> +-#include <sys/socket.h> +-#include <linux/virtio_ring.h> +-#include <linux/virtio_net.h> +-#include <linux/virtio_console.h> +-#include <linux/virtio_blk.h> +-#include <linux/version.h> +-#include "mpssd.h" +-#include <linux/mic_ioctl.h> +-#include <linux/mic_common.h> +-#include <tools/endian.h> +- +-static void init_mic(struct mic_info *mic); +- +-static FILE *logfp; +-static struct mic_info mic_list; +- +-#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) +- +-#define min_t(type, x, y) ({ \ +- type __min1 = (x); \ +- type __min2 = (y); \ +- __min1 < __min2 ? __min1 : __min2; }) +- +-/* align addr on a size boundary - adjust address up/down if needed */ +-#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1))) +-#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size) +- +-/* align addr on a size boundary - adjust address up if needed */ +-#define _ALIGN(addr, size) _ALIGN_UP(addr, size) +- +-/* to align the pointer to the (next) page boundary */ +-#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE) +- +-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x)) +- +-#define GSO_ENABLED 1 +-#define MAX_GSO_SIZE (64 * 1024) +-#define ETH_H_LEN 14 +-#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64)) +-#define MIC_DEVICE_PAGE_END 0x1000 +- +-#ifndef VIRTIO_NET_HDR_F_DATA_VALID +-#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */ +-#endif +- +-static struct { +- struct mic_device_desc dd; +- struct mic_vqconfig vqconfig[2]; +- __u32 host_features, guest_acknowledgements; +- struct virtio_console_config cons_config; +-} virtcons_dev_page = { +- .dd = { +- .type = VIRTIO_ID_CONSOLE, +- .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig), +- .feature_len = sizeof(virtcons_dev_page.host_features), +- .config_len = sizeof(virtcons_dev_page.cons_config), +- }, +- .vqconfig[0] = { +- .num = htole16(MIC_VRING_ENTRIES), +- }, +- .vqconfig[1] = { +- .num = htole16(MIC_VRING_ENTRIES), +- }, +-}; +- +-static struct { +- struct mic_device_desc dd; +- struct mic_vqconfig vqconfig[2]; +- __u32 host_features, guest_acknowledgements; +- struct virtio_net_config net_config; +-} virtnet_dev_page = { +- .dd = { +- .type = VIRTIO_ID_NET, +- .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig), +- .feature_len = sizeof(virtnet_dev_page.host_features), +- .config_len = sizeof(virtnet_dev_page.net_config), +- }, +- .vqconfig[0] = { +- .num = htole16(MIC_VRING_ENTRIES), +- }, +- .vqconfig[1] = { +- .num = htole16(MIC_VRING_ENTRIES), +- }, +-#if GSO_ENABLED +- .host_features = htole32( +- 1 << VIRTIO_NET_F_CSUM | +- 1 << VIRTIO_NET_F_GSO | +- 1 << VIRTIO_NET_F_GUEST_TSO4 | +- 1 << VIRTIO_NET_F_GUEST_TSO6 | +- 1 << VIRTIO_NET_F_GUEST_ECN | +- 1 << VIRTIO_NET_F_GUEST_UFO), +-#else +- .host_features = 0, +-#endif +-}; +- +-static const char *mic_config_dir = "/etc/sysconfig/mic"; +-static const char *virtblk_backend = "VIRTBLK_BACKEND"; +-static struct { +- struct mic_device_desc dd; +- struct mic_vqconfig vqconfig[1]; +- __u32 host_features, guest_acknowledgements; +- struct virtio_blk_config blk_config; +-} virtblk_dev_page = { +- .dd = { +- .type = VIRTIO_ID_BLOCK, +- .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig), +- .feature_len = sizeof(virtblk_dev_page.host_features), +- .config_len = sizeof(virtblk_dev_page.blk_config), +- }, +- .vqconfig[0] = { +- .num = htole16(MIC_VRING_ENTRIES), +- }, +- .host_features = +- htole32(1<<VIRTIO_BLK_F_SEG_MAX), +- .blk_config = { +- .seg_max = htole32(MIC_VRING_ENTRIES - 2), +- .capacity = htole64(0), +- } +-}; +- +-static char *myname; +- +-static int +-tap_configure(struct mic_info *mic, char *dev) +-{ +- pid_t pid; +- char *ifargv[7]; +- char ipaddr[IFNAMSIZ]; +- int ret = 0; +- +- pid = fork(); +- if (pid == 0) { +- ifargv[0] = "ip"; +- ifargv[1] = "link"; +- ifargv[2] = "set"; +- ifargv[3] = dev; +- ifargv[4] = "up"; +- ifargv[5] = NULL; +- mpsslog("Configuring %s\n", dev); +- ret = execvp("ip", ifargv); +- if (ret < 0) { +- mpsslog("%s execvp failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- } +- if (pid < 0) { +- mpsslog("%s fork failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- +- ret = waitpid(pid, NULL, 0); +- if (ret < 0) { +- mpsslog("%s waitpid failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- +- snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id); +- +- pid = fork(); +- if (pid == 0) { +- ifargv[0] = "ip"; +- ifargv[1] = "addr"; +- ifargv[2] = "add"; +- ifargv[3] = ipaddr; +- ifargv[4] = "dev"; +- ifargv[5] = dev; +- ifargv[6] = NULL; +- mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr); +- ret = execvp("ip", ifargv); +- if (ret < 0) { +- mpsslog("%s execvp failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- } +- if (pid < 0) { +- mpsslog("%s fork failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- +- ret = waitpid(pid, NULL, 0); +- if (ret < 0) { +- mpsslog("%s waitpid failed errno %s\n", +- mic->name, strerror(errno)); +- return ret; +- } +- mpsslog("MIC name %s %s %d DONE!\n", +- mic->name, __func__, __LINE__); +- return 0; +-} +- +-static int tun_alloc(struct mic_info *mic, char *dev) +-{ +- struct ifreq ifr; +- int fd, err; +-#if GSO_ENABLED +- unsigned offload; +-#endif +- fd = open("/dev/net/tun", O_RDWR); +- if (fd < 0) { +- mpsslog("Could not open /dev/net/tun %s\n", strerror(errno)); +- goto done; +- } +- +- memset(&ifr, 0, sizeof(ifr)); +- +- ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR; +- if (*dev) +- strncpy(ifr.ifr_name, dev, IFNAMSIZ); +- +- err = ioctl(fd, TUNSETIFF, (void *)&ifr); +- if (err < 0) { +- mpsslog("%s %s %d TUNSETIFF failed %s\n", +- mic->name, __func__, __LINE__, strerror(errno)); +- close(fd); +- return err; +- } +-#if GSO_ENABLED +- offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | +- TUN_F_TSO_ECN | TUN_F_UFO; +- +- err = ioctl(fd, TUNSETOFFLOAD, offload); +- if (err < 0) { +- mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n", +- mic->name, __func__, __LINE__, strerror(errno)); +- close(fd); +- return err; +- } +-#endif +- strcpy(dev, ifr.ifr_name); +- mpsslog("Created TAP %s\n", dev); +-done: +- return fd; +-} +- +-#define NET_FD_VIRTIO_NET 0 +-#define NET_FD_TUN 1 +-#define MAX_NET_FD 2 +- +-static void set_dp(struct mic_info *mic, int type, void *dp) +-{ +- switch (type) { +- case VIRTIO_ID_CONSOLE: +- mic->mic_console.console_dp = dp; +- return; +- case VIRTIO_ID_NET: +- mic->mic_net.net_dp = dp; +- return; +- case VIRTIO_ID_BLOCK: +- mic->mic_virtblk.block_dp = dp; +- return; +- } +- mpsslog("%s %s %d not found\n", mic->name, __func__, type); +- assert(0); +-} +- +-static void *get_dp(struct mic_info *mic, int type) +-{ +- switch (type) { +- case VIRTIO_ID_CONSOLE: +- return mic->mic_console.console_dp; +- case VIRTIO_ID_NET: +- return mic->mic_net.net_dp; +- case VIRTIO_ID_BLOCK: +- return mic->mic_virtblk.block_dp; +- } +- mpsslog("%s %s %d not found\n", mic->name, __func__, type); +- assert(0); +- return NULL; +-} +- +-static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type) +-{ +- struct mic_device_desc *d; +- int i; +- void *dp = get_dp(mic, type); +- +- for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE; +- i += mic_total_desc_size(d)) { +- d = dp + i; +- +- /* End of list */ +- if (d->type == 0) +- break; +- +- if (d->type == -1) +- continue; +- +- mpsslog("%s %s d-> type %d d %p\n", +- mic->name, __func__, d->type, d); +- +- if (d->type == (__u8)type) +- return d; +- } +- mpsslog("%s %s %d not found\n", mic->name, __func__, type); +- assert(0); +- return NULL; +-} +- +-/* See comments in vhost.c for explanation of next_desc() */ +-static unsigned next_desc(struct vring_desc *desc) +-{ +- unsigned int next; +- +- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) +- return -1U; +- next = le16toh(desc->next); +- return next; +-} +- +-/* Sum up all the IOVEC length */ +-static ssize_t +-sum_iovec_len(struct mic_copy_desc *copy) +-{ +- ssize_t sum = 0; +- int i; +- +- for (i = 0; i < copy->iovcnt; i++) +- sum += copy->iov[i].iov_len; +- return sum; +-} +- +-static inline void verify_out_len(struct mic_info *mic, +- struct mic_copy_desc *copy) +-{ +- if (copy->out_len != sum_iovec_len(copy)) { +- mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n", +- mic->name, __func__, __LINE__, +- copy->out_len, sum_iovec_len(copy)); +- assert(copy->out_len == sum_iovec_len(copy)); +- } +-} +- +-/* Display an iovec */ +-static void +-disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy, +- const char *s, int line) +-{ +- int i; +- +- for (i = 0; i < copy->iovcnt; i++) +- mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n", +- mic->name, s, line, i, +- copy->iov[i].iov_base, copy->iov[i].iov_len); +-} +- +-static inline __u16 read_avail_idx(struct mic_vring *vr) +-{ +- return ACCESS_ONCE(vr->info->avail_idx); +-} +- +-static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr, +- struct mic_copy_desc *copy, ssize_t len) +-{ +- copy->vr_idx = tx ? 0 : 1; +- copy->update_used = true; +- if (type == VIRTIO_ID_NET) +- copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr); +- else +- copy->iov[0].iov_len = len; +-} +- +-/* Central API which triggers the copies */ +-static int +-mic_virtio_copy(struct mic_info *mic, int fd, +- struct mic_vring *vr, struct mic_copy_desc *copy) +-{ +- int ret; +- +- ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy); +- if (ret) { +- mpsslog("%s %s %d errno %s ret %d\n", +- mic->name, __func__, __LINE__, +- strerror(errno), ret); +- } +- return ret; +-} +- +-/* +- * This initialization routine requires at least one +- * vring i.e. vr0. vr1 is optional. +- */ +-static void * +-init_vr(struct mic_info *mic, int fd, int type, +- struct mic_vring *vr0, struct mic_vring *vr1, int num_vq) +-{ +- int vr_size; +- char *va; +- +- vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES, +- MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info)); +- va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq, +- PROT_READ, MAP_SHARED, fd, 0); +- if (MAP_FAILED == va) { +- mpsslog("%s %s %d mmap failed errno %s\n", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- goto done; +- } +- set_dp(mic, type, va); +- vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END]; +- vr0->info = vr0->va + +- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN); +- vring_init(&vr0->vr, +- MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN); +- mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ", +- __func__, mic->name, vr0->va, vr0->info, vr_size, +- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); +- mpsslog("magic 0x%x expected 0x%x\n", +- le32toh(vr0->info->magic), MIC_MAGIC + type); +- assert(le32toh(vr0->info->magic) == MIC_MAGIC + type); +- if (vr1) { +- vr1->va = (struct mic_vring *) +- &va[MIC_DEVICE_PAGE_END + vr_size]; +- vr1->info = vr1->va + vring_size(MIC_VRING_ENTRIES, +- MIC_VIRTIO_RING_ALIGN); +- vring_init(&vr1->vr, +- MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN); +- mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ", +- __func__, mic->name, vr1->va, vr1->info, vr_size, +- vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); +- mpsslog("magic 0x%x expected 0x%x\n", +- le32toh(vr1->info->magic), MIC_MAGIC + type + 1); +- assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1); +- } +-done: +- return va; +-} +- +-static void +-wait_for_card_driver(struct mic_info *mic, int fd, int type) +-{ +- struct pollfd pollfd; +- int err; +- struct mic_device_desc *desc = get_device_desc(mic, type); +- +- pollfd.fd = fd; +- mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n", +- mic->name, __func__, type, desc->status); +- while (1) { +- pollfd.events = POLLIN; +- pollfd.revents = 0; +- err = poll(&pollfd, 1, -1); +- if (err < 0) { +- mpsslog("%s %s poll failed %s\n", +- mic->name, __func__, strerror(errno)); +- continue; +- } +- +- if (pollfd.revents) { +- mpsslog("%s %s Waiting... desc-> type %d status 0x%x\n", +- mic->name, __func__, type, desc->status); +- if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) { +- mpsslog("%s %s poll.revents %d\n", +- mic->name, __func__, pollfd.revents); +- mpsslog("%s %s desc-> type %d status 0x%x\n", +- mic->name, __func__, type, +- desc->status); +- break; +- } +- } +- } +-} +- +-/* Spin till we have some descriptors */ +-static void +-spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr) +-{ +- __u16 avail_idx = read_avail_idx(vr); +- +- while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) { +-#ifdef DEBUG +- mpsslog("%s %s waiting for desc avail %d info_avail %d\n", +- mic->name, __func__, +- le16toh(vr->vr.avail->idx), vr->info->avail_idx); +-#endif +- sched_yield(); +- } +-} +- +-static void * +-virtio_net(void *arg) +-{ +- static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)]; +- static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64))); +- struct iovec vnet_iov[2][2] = { +- { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) }, +- { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } }, +- { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) }, +- { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } }, +- }; +- struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1]; +- struct mic_info *mic = (struct mic_info *)arg; +- char if_name[IFNAMSIZ]; +- struct pollfd net_poll[MAX_NET_FD]; +- struct mic_vring tx_vr, rx_vr; +- struct mic_copy_desc copy; +- struct mic_device_desc *desc; +- int err; +- +- snprintf(if_name, IFNAMSIZ, "mic%d", mic->id); +- mic->mic_net.tap_fd = tun_alloc(mic, if_name); +- if (mic->mic_net.tap_fd < 0) +- goto done; +- +- if (tap_configure(mic, if_name)) +- goto done; +- mpsslog("MIC name %s id %d\n", mic->name, mic->id); +- +- net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd; +- net_poll[NET_FD_VIRTIO_NET].events = POLLIN; +- net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd; +- net_poll[NET_FD_TUN].events = POLLIN; +- +- if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd, +- VIRTIO_ID_NET, &tx_vr, &rx_vr, +- virtnet_dev_page.dd.num_vq)) { +- mpsslog("%s init_vr failed %s\n", +- mic->name, strerror(errno)); +- goto done; +- } +- +- copy.iovcnt = 2; +- desc = get_device_desc(mic, VIRTIO_ID_NET); +- +- while (1) { +- ssize_t len; +- +- net_poll[NET_FD_VIRTIO_NET].revents = 0; +- net_poll[NET_FD_TUN].revents = 0; +- +- /* Start polling for data from tap and virtio net */ +- err = poll(net_poll, 2, -1); +- if (err < 0) { +- mpsslog("%s poll failed %s\n", +- __func__, strerror(errno)); +- continue; +- } +- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) +- wait_for_card_driver(mic, mic->mic_net.virtio_net_fd, +- VIRTIO_ID_NET); +- /* +- * Check if there is data to be read from TUN and write to +- * virtio net fd if there is. +- */ +- if (net_poll[NET_FD_TUN].revents & POLLIN) { +- copy.iov = iov0; +- len = readv(net_poll[NET_FD_TUN].fd, +- copy.iov, copy.iovcnt); +- if (len > 0) { +- struct virtio_net_hdr *hdr +- = (struct virtio_net_hdr *)vnet_hdr[0]; +- +- /* Disable checksums on the card since we are on +- a reliable PCIe link */ +- hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID; +-#ifdef DEBUG +- mpsslog("%s %s %d hdr->flags 0x%x ", mic->name, +- __func__, __LINE__, hdr->flags); +- mpsslog("copy.out_len %d hdr->gso_type 0x%x\n", +- copy.out_len, hdr->gso_type); +-#endif +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, __LINE__); +- mpsslog("%s %s %d read from tap 0x%lx\n", +- mic->name, __func__, __LINE__, +- len); +-#endif +- spin_for_descriptors(mic, &tx_vr); +- txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©, +- len); +- +- err = mic_virtio_copy(mic, +- mic->mic_net.virtio_net_fd, &tx_vr, +- ©); +- if (err < 0) { +- mpsslog("%s %s %d mic_virtio_copy %s\n", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- } +- if (!err) +- verify_out_len(mic, ©); +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, __LINE__); +- mpsslog("%s %s %d wrote to net 0x%lx\n", +- mic->name, __func__, __LINE__, +- sum_iovec_len(©)); +-#endif +- /* Reinitialize IOV for next run */ +- iov0[1].iov_len = MAX_NET_PKT_SIZE; +- } else if (len < 0) { +- disp_iovec(mic, ©, __func__, __LINE__); +- mpsslog("%s %s %d read failed %s ", mic->name, +- __func__, __LINE__, strerror(errno)); +- mpsslog("cnt %d sum %zd\n", +- copy.iovcnt, sum_iovec_len(©)); +- } +- } +- +- /* +- * Check if there is data to be read from virtio net and +- * write to TUN if there is. +- */ +- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) { +- while (rx_vr.info->avail_idx != +- le16toh(rx_vr.vr.avail->idx)) { +- copy.iov = iov1; +- txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©, +- MAX_NET_PKT_SIZE +- + sizeof(struct virtio_net_hdr)); +- +- err = mic_virtio_copy(mic, +- mic->mic_net.virtio_net_fd, &rx_vr, +- ©); +- if (!err) { +-#ifdef DEBUG +- struct virtio_net_hdr *hdr +- = (struct virtio_net_hdr *) +- vnet_hdr[1]; +- +- mpsslog("%s %s %d hdr->flags 0x%x, ", +- mic->name, __func__, __LINE__, +- hdr->flags); +- mpsslog("out_len %d gso_type 0x%x\n", +- copy.out_len, +- hdr->gso_type); +-#endif +- /* Set the correct output iov_len */ +- iov1[1].iov_len = copy.out_len - +- sizeof(struct virtio_net_hdr); +- verify_out_len(mic, ©); +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, +- __LINE__); +- mpsslog("%s %s %d ", +- mic->name, __func__, __LINE__); +- mpsslog("read from net 0x%lx\n", +- sum_iovec_len(copy)); +-#endif +- len = writev(net_poll[NET_FD_TUN].fd, +- copy.iov, copy.iovcnt); +- if (len != sum_iovec_len(©)) { +- mpsslog("Tun write failed %s ", +- strerror(errno)); +- mpsslog("len 0x%zx ", len); +- mpsslog("read_len 0x%zx\n", +- sum_iovec_len(©)); +- } else { +-#ifdef DEBUG +- disp_iovec(mic, ©, __func__, +- __LINE__); +- mpsslog("%s %s %d ", +- mic->name, __func__, +- __LINE__); +- mpsslog("wrote to tap 0x%lx\n", +- len); +-#endif +- } +- } else { +- mpsslog("%s %s %d mic_virtio_copy %s\n", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- break; +- } +- } +- } +- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR) +- mpsslog("%s: %s: POLLERR\n", __func__, mic->name); +- } +-done: +- pthread_exit(NULL); +-} +- +-/* virtio_console */ +-#define VIRTIO_CONSOLE_FD 0 +-#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1) +-#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */ +-#define MAX_BUFFER_SIZE PAGE_SIZE +- +-static void * +-virtio_console(void *arg) +-{ +- static __u8 vcons_buf[2][PAGE_SIZE]; +- struct iovec vcons_iov[2] = { +- { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) }, +- { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) }, +- }; +- struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1]; +- struct mic_info *mic = (struct mic_info *)arg; +- int err; +- struct pollfd console_poll[MAX_CONSOLE_FD]; +- int pty_fd; +- char *pts_name; +- ssize_t len; +- struct mic_vring tx_vr, rx_vr; +- struct mic_copy_desc copy; +- struct mic_device_desc *desc; +- +- pty_fd = posix_openpt(O_RDWR); +- if (pty_fd < 0) { +- mpsslog("can't open a pseudoterminal master device: %s\n", +- strerror(errno)); +- goto _return; +- } +- pts_name = ptsname(pty_fd); +- if (pts_name == NULL) { +- mpsslog("can't get pts name\n"); +- goto _close_pty; +- } +- printf("%s console message goes to %s\n", mic->name, pts_name); +- mpsslog("%s console message goes to %s\n", mic->name, pts_name); +- err = grantpt(pty_fd); +- if (err < 0) { +- mpsslog("can't grant access: %s %s\n", +- pts_name, strerror(errno)); +- goto _close_pty; +- } +- err = unlockpt(pty_fd); +- if (err < 0) { +- mpsslog("can't unlock a pseudoterminal: %s %s\n", +- pts_name, strerror(errno)); +- goto _close_pty; +- } +- console_poll[MONITOR_FD].fd = pty_fd; +- console_poll[MONITOR_FD].events = POLLIN; +- +- console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd; +- console_poll[VIRTIO_CONSOLE_FD].events = POLLIN; +- +- if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd, +- VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr, +- virtcons_dev_page.dd.num_vq)) { +- mpsslog("%s init_vr failed %s\n", +- mic->name, strerror(errno)); +- goto _close_pty; +- } +- +- copy.iovcnt = 1; +- desc = get_device_desc(mic, VIRTIO_ID_CONSOLE); +- +- for (;;) { +- console_poll[MONITOR_FD].revents = 0; +- console_poll[VIRTIO_CONSOLE_FD].revents = 0; +- err = poll(console_poll, MAX_CONSOLE_FD, -1); +- if (err < 0) { +- mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__, +- strerror(errno)); +- continue; +- } +- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) +- wait_for_card_driver(mic, +- mic->mic_console.virtio_console_fd, +- VIRTIO_ID_CONSOLE); +- +- if (console_poll[MONITOR_FD].revents & POLLIN) { +- copy.iov = iov0; +- len = readv(pty_fd, copy.iov, copy.iovcnt); +- if (len > 0) { +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, __LINE__); +- mpsslog("%s %s %d read from tap 0x%lx\n", +- mic->name, __func__, __LINE__, +- len); +-#endif +- spin_for_descriptors(mic, &tx_vr); +- txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr, +- ©, len); +- +- err = mic_virtio_copy(mic, +- mic->mic_console.virtio_console_fd, +- &tx_vr, ©); +- if (err < 0) { +- mpsslog("%s %s %d mic_virtio_copy %s\n", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- } +- if (!err) +- verify_out_len(mic, ©); +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, __LINE__); +- mpsslog("%s %s %d wrote to net 0x%lx\n", +- mic->name, __func__, __LINE__, +- sum_iovec_len(copy)); +-#endif +- /* Reinitialize IOV for next run */ +- iov0->iov_len = PAGE_SIZE; +- } else if (len < 0) { +- disp_iovec(mic, ©, __func__, __LINE__); +- mpsslog("%s %s %d read failed %s ", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- mpsslog("cnt %d sum %zd\n", +- copy.iovcnt, sum_iovec_len(©)); +- } +- } +- +- if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) { +- while (rx_vr.info->avail_idx != +- le16toh(rx_vr.vr.avail->idx)) { +- copy.iov = iov1; +- txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr, +- ©, PAGE_SIZE); +- +- err = mic_virtio_copy(mic, +- mic->mic_console.virtio_console_fd, +- &rx_vr, ©); +- if (!err) { +- /* Set the correct output iov_len */ +- iov1->iov_len = copy.out_len; +- verify_out_len(mic, ©); +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, +- __LINE__); +- mpsslog("%s %s %d ", +- mic->name, __func__, __LINE__); +- mpsslog("read from net 0x%lx\n", +- sum_iovec_len(copy)); +-#endif +- len = writev(pty_fd, +- copy.iov, copy.iovcnt); +- if (len != sum_iovec_len(©)) { +- mpsslog("Tun write failed %s ", +- strerror(errno)); +- mpsslog("len 0x%zx ", len); +- mpsslog("read_len 0x%zx\n", +- sum_iovec_len(©)); +- } else { +-#ifdef DEBUG +- disp_iovec(mic, copy, __func__, +- __LINE__); +- mpsslog("%s %s %d ", +- mic->name, __func__, +- __LINE__); +- mpsslog("wrote to tap 0x%lx\n", +- len); +-#endif +- } +- } else { +- mpsslog("%s %s %d mic_virtio_copy %s\n", +- mic->name, __func__, __LINE__, +- strerror(errno)); +- break; +- } +- } +- } +- if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR) +- mpsslog("%s: %s: POLLERR\n", __func__, mic->name); +- } +-_close_pty: +- close(pty_fd); +-_return: +- pthread_exit(NULL); +-} +- +-static void +-add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd) +-{ +- char path[PATH_MAX]; +- int fd, err; +- +- snprintf(path, PATH_MAX, "/dev/mic%d", mic->id); +- fd = open(path, O_RDWR); +- if (fd < 0) { +- mpsslog("Could not open %s %s\n", path, strerror(errno)); +- return; +- } +- +- err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd); +- if (err < 0) { +- mpsslog("Could not add %d %s\n", dd->type, strerror(errno)); +- close(fd); +- return; +- } +- switch (dd->type) { +- case VIRTIO_ID_NET: +- mic->mic_net.virtio_net_fd = fd; +- mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name); +- break; +- case VIRTIO_ID_CONSOLE: +- mic->mic_console.virtio_console_fd = fd; +- mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name); +- break; +- case VIRTIO_ID_BLOCK: +- mic->mic_virtblk.virtio_block_fd = fd; +- mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name); +- break; +- } +-} +- +-static bool +-set_backend_file(struct mic_info *mic) +-{ +- FILE *config; +- char buff[PATH_MAX], *line, *evv, *p; +- +- snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id); +- config = fopen(buff, "r"); +- if (config == NULL) +- return false; +- do { /* look for "virtblk_backend=XXXX" */ +- line = fgets(buff, PATH_MAX, config); +- if (line == NULL) +- break; +- if (*line == '#') +- continue; +- p = strchr(line, '\n'); +- if (p) +- *p = '\0'; +- } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0); +- fclose(config); +- if (line == NULL) +- return false; +- evv = strchr(line, '='); +- if (evv == NULL) +- return false; +- mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1); +- if (mic->mic_virtblk.backend_file == NULL) { +- mpsslog("%s %d can't allocate memory\n", mic->name, mic->id); +- return false; +- } +- strcpy(mic->mic_virtblk.backend_file, evv + 1); +- return true; +-} +- +-#define SECTOR_SIZE 512 +-static bool +-set_backend_size(struct mic_info *mic) +-{ +- mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0, +- SEEK_END); +- if (mic->mic_virtblk.backend_size < 0) { +- mpsslog("%s: can't seek: %s\n", +- mic->name, mic->mic_virtblk.backend_file); +- return false; +- } +- virtblk_dev_page.blk_config.capacity = +- mic->mic_virtblk.backend_size / SECTOR_SIZE; +- if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0) +- virtblk_dev_page.blk_config.capacity++; +- +- virtblk_dev_page.blk_config.capacity = +- htole64(virtblk_dev_page.blk_config.capacity); +- +- return true; +-} +- +-static bool +-open_backend(struct mic_info *mic) +-{ +- if (!set_backend_file(mic)) +- goto _error_exit; +- mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR); +- if (mic->mic_virtblk.backend < 0) { +- mpsslog("%s: can't open: %s\n", mic->name, +- mic->mic_virtblk.backend_file); +- goto _error_free; +- } +- if (!set_backend_size(mic)) +- goto _error_close; +- mic->mic_virtblk.backend_addr = mmap(NULL, +- mic->mic_virtblk.backend_size, +- PROT_READ|PROT_WRITE, MAP_SHARED, +- mic->mic_virtblk.backend, 0L); +- if (mic->mic_virtblk.backend_addr == MAP_FAILED) { +- mpsslog("%s: can't map: %s %s\n", +- mic->name, mic->mic_virtblk.backend_file, +- strerror(errno)); +- goto _error_close; +- } +- return true; +- +- _error_close: +- close(mic->mic_virtblk.backend); +- _error_free: +- free(mic->mic_virtblk.backend_file); +- _error_exit: +- return false; +-} +- +-static void +-close_backend(struct mic_info *mic) +-{ +- munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size); +- close(mic->mic_virtblk.backend); +- free(mic->mic_virtblk.backend_file); +-} +- +-static bool +-start_virtblk(struct mic_info *mic, struct mic_vring *vring) +-{ +- if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) { +- mpsslog("%s: blk_config is not 8 byte aligned.\n", +- mic->name); +- return false; +- } +- add_virtio_device(mic, &virtblk_dev_page.dd); +- if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd, +- VIRTIO_ID_BLOCK, vring, NULL, +- virtblk_dev_page.dd.num_vq)) { +- mpsslog("%s init_vr failed %s\n", +- mic->name, strerror(errno)); +- return false; +- } +- return true; +-} +- +-static void +-stop_virtblk(struct mic_info *mic) +-{ +- int vr_size, ret; +- +- vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES, +- MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info)); +- ret = munmap(mic->mic_virtblk.block_dp, +- MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq); +- if (ret < 0) +- mpsslog("%s munmap errno %d\n", mic->name, errno); +- close(mic->mic_virtblk.virtio_block_fd); +-} +- +-static __u8 +-header_error_check(struct vring_desc *desc) +-{ +- if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) { +- mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n", +- __func__, __LINE__); +- return -EIO; +- } +- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) { +- mpsslog("%s() %d: alone\n", +- __func__, __LINE__); +- return -EIO; +- } +- if (le16toh(desc->flags) & VRING_DESC_F_WRITE) { +- mpsslog("%s() %d: not read\n", +- __func__, __LINE__); +- return -EIO; +- } +- return 0; +-} +- +-static int +-read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx) +-{ +- struct iovec iovec; +- struct mic_copy_desc copy; +- +- iovec.iov_len = sizeof(*hdr); +- iovec.iov_base = hdr; +- copy.iov = &iovec; +- copy.iovcnt = 1; +- copy.vr_idx = 0; /* only one vring on virtio_block */ +- copy.update_used = false; /* do not update used index */ +- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); +-} +- +-static int +-transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt) +-{ +- struct mic_copy_desc copy; +- +- copy.iov = iovec; +- copy.iovcnt = iovcnt; +- copy.vr_idx = 0; /* only one vring on virtio_block */ +- copy.update_used = false; /* do not update used index */ +- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); +-} +- +-static __u8 +-status_error_check(struct vring_desc *desc) +-{ +- if (le32toh(desc->len) != sizeof(__u8)) { +- mpsslog("%s() %d: length is not sizeof(status)\n", +- __func__, __LINE__); +- return -EIO; +- } +- return 0; +-} +- +-static int +-write_status(int fd, __u8 *status) +-{ +- struct iovec iovec; +- struct mic_copy_desc copy; +- +- iovec.iov_base = status; +- iovec.iov_len = sizeof(*status); +- copy.iov = &iovec; +- copy.iovcnt = 1; +- copy.vr_idx = 0; /* only one vring on virtio_block */ +- copy.update_used = true; /* Update used index */ +- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); +-} +- +-static void * +-virtio_block(void *arg) +-{ +- struct mic_info *mic = (struct mic_info *)arg; +- int ret; +- struct pollfd block_poll; +- struct mic_vring vring; +- __u16 avail_idx; +- __u32 desc_idx; +- struct vring_desc *desc; +- struct iovec *iovec, *piov; +- __u8 status; +- __u32 buffer_desc_idx; +- struct virtio_blk_outhdr hdr; +- void *fos; +- +- for (;;) { /* forever */ +- if (!open_backend(mic)) { /* No virtblk */ +- for (mic->mic_virtblk.signaled = 0; +- !mic->mic_virtblk.signaled;) +- sleep(1); +- continue; +- } +- +- /* backend file is specified. */ +- if (!start_virtblk(mic, &vring)) +- goto _close_backend; +- iovec = malloc(sizeof(*iovec) * +- le32toh(virtblk_dev_page.blk_config.seg_max)); +- if (!iovec) { +- mpsslog("%s: can't alloc iovec: %s\n", +- mic->name, strerror(ENOMEM)); +- goto _stop_virtblk; +- } +- +- block_poll.fd = mic->mic_virtblk.virtio_block_fd; +- block_poll.events = POLLIN; +- for (mic->mic_virtblk.signaled = 0; +- !mic->mic_virtblk.signaled;) { +- block_poll.revents = 0; +- /* timeout in 1 sec to see signaled */ +- ret = poll(&block_poll, 1, 1000); +- if (ret < 0) { +- mpsslog("%s %d: poll failed: %s\n", +- __func__, __LINE__, +- strerror(errno)); +- continue; +- } +- +- if (!(block_poll.revents & POLLIN)) { +-#ifdef DEBUG +- mpsslog("%s %d: block_poll.revents=0x%x\n", +- __func__, __LINE__, block_poll.revents); +-#endif +- continue; +- } +- +- /* POLLIN */ +- while (vring.info->avail_idx != +- le16toh(vring.vr.avail->idx)) { +- /* read header element */ +- avail_idx = +- vring.info->avail_idx & +- (vring.vr.num - 1); +- desc_idx = le16toh( +- vring.vr.avail->ring[avail_idx]); +- desc = &vring.vr.desc[desc_idx]; +-#ifdef DEBUG +- mpsslog("%s() %d: avail_idx=%d ", +- __func__, __LINE__, +- vring.info->avail_idx); +- mpsslog("vring.vr.num=%d desc=%p\n", +- vring.vr.num, desc); +-#endif +- status = header_error_check(desc); +- ret = read_header( +- mic->mic_virtblk.virtio_block_fd, +- &hdr, desc_idx); +- if (ret < 0) { +- mpsslog("%s() %d %s: ret=%d %s\n", +- __func__, __LINE__, +- mic->name, ret, +- strerror(errno)); +- break; +- } +- /* buffer element */ +- piov = iovec; +- status = 0; +- fos = mic->mic_virtblk.backend_addr + +- (hdr.sector * SECTOR_SIZE); +- buffer_desc_idx = next_desc(desc); +- desc_idx = buffer_desc_idx; +- for (desc = &vring.vr.desc[buffer_desc_idx]; +- desc->flags & VRING_DESC_F_NEXT; +- desc_idx = next_desc(desc), +- desc = &vring.vr.desc[desc_idx]) { +- piov->iov_len = desc->len; +- piov->iov_base = fos; +- piov++; +- fos += desc->len; +- } +- /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */ +- if (hdr.type & ~(VIRTIO_BLK_T_OUT | +- VIRTIO_BLK_T_GET_ID)) { +- /* +- VIRTIO_BLK_T_IN - does not do +- anything. Probably for documenting. +- VIRTIO_BLK_T_SCSI_CMD - for +- virtio_scsi. +- VIRTIO_BLK_T_FLUSH - turned off in +- config space. +- VIRTIO_BLK_T_BARRIER - defined but not +- used in anywhere. +- */ +- mpsslog("%s() %d: type %x ", +- __func__, __LINE__, +- hdr.type); +- mpsslog("is not supported\n"); +- status = -ENOTSUP; +- +- } else { +- ret = transfer_blocks( +- mic->mic_virtblk.virtio_block_fd, +- iovec, +- piov - iovec); +- if (ret < 0 && +- status != 0) +- status = ret; +- } +- /* write status and update used pointer */ +- if (status != 0) +- status = status_error_check(desc); +- ret = write_status( +- mic->mic_virtblk.virtio_block_fd, +- &status); +-#ifdef DEBUG +- mpsslog("%s() %d: write status=%d on desc=%p\n", +- __func__, __LINE__, +- status, desc); +-#endif +- } +- } +- free(iovec); +-_stop_virtblk: +- stop_virtblk(mic); +-_close_backend: +- close_backend(mic); +- } /* forever */ +- +- pthread_exit(NULL); +-} +- +-static void +-reset(struct mic_info *mic) +-{ +-#define RESET_TIMEOUT 120 +- int i = RESET_TIMEOUT; +- setsysfs(mic->name, "state", "reset"); +- while (i) { +- char *state; +- state = readsysfs(mic->name, "state"); +- if (!state) +- goto retry; +- mpsslog("%s: %s %d state %s\n", +- mic->name, __func__, __LINE__, state); +- +- /* +- * If the shutdown was initiated by OSPM, the state stays +- * in "suspended" which is also a valid condition for reset. +- */ +- if ((!strcmp(state, "offline")) || +- (!strcmp(state, "suspended"))) { +- free(state); +- break; +- } +- free(state); +-retry: +- sleep(1); +- i--; +- } +-} +- +-static int +-get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status) +-{ +- if (!strcmp(shutdown_status, "nop")) +- return MIC_NOP; +- if (!strcmp(shutdown_status, "crashed")) +- return MIC_CRASHED; +- if (!strcmp(shutdown_status, "halted")) +- return MIC_HALTED; +- if (!strcmp(shutdown_status, "poweroff")) +- return MIC_POWER_OFF; +- if (!strcmp(shutdown_status, "restart")) +- return MIC_RESTART; +- mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status); +- /* Invalid state */ +- assert(0); +-}; +- +-static int get_mic_state(struct mic_info *mic, char *state) +-{ +- if (!strcmp(state, "offline")) +- return MIC_OFFLINE; +- if (!strcmp(state, "online")) +- return MIC_ONLINE; +- if (!strcmp(state, "shutting_down")) +- return MIC_SHUTTING_DOWN; +- if (!strcmp(state, "reset_failed")) +- return MIC_RESET_FAILED; +- if (!strcmp(state, "suspending")) +- return MIC_SUSPENDING; +- if (!strcmp(state, "suspended")) +- return MIC_SUSPENDED; +- mpsslog("%s: BUG invalid state %s\n", mic->name, state); +- /* Invalid state */ +- assert(0); +-}; +- +-static void mic_handle_shutdown(struct mic_info *mic) +-{ +-#define SHUTDOWN_TIMEOUT 60 +- int i = SHUTDOWN_TIMEOUT, ret, stat = 0; +- char *shutdown_status; +- while (i) { +- shutdown_status = readsysfs(mic->name, "shutdown_status"); +- if (!shutdown_status) +- continue; +- mpsslog("%s: %s %d shutdown_status %s\n", +- mic->name, __func__, __LINE__, shutdown_status); +- switch (get_mic_shutdown_status(mic, shutdown_status)) { +- case MIC_RESTART: +- mic->restart = 1; +- case MIC_HALTED: +- case MIC_POWER_OFF: +- case MIC_CRASHED: +- free(shutdown_status); +- goto reset; +- default: +- break; +- } +- free(shutdown_status); +- sleep(1); +- i--; +- } +-reset: +- ret = kill(mic->pid, SIGTERM); +- mpsslog("%s: %s %d kill pid %d ret %d\n", +- mic->name, __func__, __LINE__, +- mic->pid, ret); +- if (!ret) { +- ret = waitpid(mic->pid, &stat, +- WIFSIGNALED(stat)); +- mpsslog("%s: %s %d waitpid ret %d pid %d\n", +- mic->name, __func__, __LINE__, +- ret, mic->pid); +- } +- if (ret == mic->pid) +- reset(mic); +-} +- +-static void * +-mic_config(void *arg) +-{ +- struct mic_info *mic = (struct mic_info *)arg; +- char *state = NULL; +- char pathname[PATH_MAX]; +- int fd, ret; +- struct pollfd ufds[1]; +- char value[4096]; +- +- snprintf(pathname, PATH_MAX - 1, "%s/%s/%s", +- MICSYSFSDIR, mic->name, "state"); +- +- fd = open(pathname, O_RDONLY); +- if (fd < 0) { +- mpsslog("%s: opening file %s failed %s\n", +- mic->name, pathname, strerror(errno)); +- goto error; +- } +- +- do { +- ret = lseek(fd, 0, SEEK_SET); +- if (ret < 0) { +- mpsslog("%s: Failed to seek to file start '%s': %s\n", +- mic->name, pathname, strerror(errno)); +- goto close_error1; +- } +- ret = read(fd, value, sizeof(value)); +- if (ret < 0) { +- mpsslog("%s: Failed to read sysfs entry '%s': %s\n", +- mic->name, pathname, strerror(errno)); +- goto close_error1; +- } +-retry: +- state = readsysfs(mic->name, "state"); +- if (!state) +- goto retry; +- mpsslog("%s: %s %d state %s\n", +- mic->name, __func__, __LINE__, state); +- switch (get_mic_state(mic, state)) { +- case MIC_SHUTTING_DOWN: +- mic_handle_shutdown(mic); +- goto close_error; +- case MIC_SUSPENDING: +- mic->boot_on_resume = 1; +- setsysfs(mic->name, "state", "suspend"); +- mic_handle_shutdown(mic); +- goto close_error; +- case MIC_OFFLINE: +- if (mic->boot_on_resume) { +- setsysfs(mic->name, "state", "boot"); +- mic->boot_on_resume = 0; +- } +- break; +- default: +- break; +- } +- free(state); +- +- ufds[0].fd = fd; +- ufds[0].events = POLLERR | POLLPRI; +- ret = poll(ufds, 1, -1); +- if (ret < 0) { +- mpsslog("%s: poll failed %s\n", +- mic->name, strerror(errno)); +- goto close_error1; +- } +- } while (1); +-close_error: +- free(state); +-close_error1: +- close(fd); +-error: +- init_mic(mic); +- pthread_exit(NULL); +-} +- +-static void +-set_cmdline(struct mic_info *mic) +-{ +- char buffer[PATH_MAX]; +- int len; +- +- len = snprintf(buffer, PATH_MAX, +- "clocksource=tsc highres=off nohz=off "); +- len += snprintf(buffer + len, PATH_MAX - len, +- "cpufreq_on;corec6_off;pc3_off;pc6_off "); +- len += snprintf(buffer + len, PATH_MAX - len, +- "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0", +- mic->id); +- +- setsysfs(mic->name, "cmdline", buffer); +- mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer); +- snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id); +- mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer); +-} +- +-static void +-set_log_buf_info(struct mic_info *mic) +-{ +- int fd; +- off_t len; +- char system_map[] = "/lib/firmware/mic/System.map"; +- char *map, *temp, log_buf[17] = {'\0'}; +- +- fd = open(system_map, O_RDONLY); +- if (fd < 0) { +- mpsslog("%s: Opening System.map failed: %d\n", +- mic->name, errno); +- return; +- } +- len = lseek(fd, 0, SEEK_END); +- if (len < 0) { +- mpsslog("%s: Reading System.map size failed: %d\n", +- mic->name, errno); +- close(fd); +- return; +- } +- map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0); +- if (map == MAP_FAILED) { +- mpsslog("%s: mmap of System.map failed: %d\n", +- mic->name, errno); +- close(fd); +- return; +- } +- temp = strstr(map, "__log_buf"); +- if (!temp) { +- mpsslog("%s: __log_buf not found: %d\n", mic->name, errno); +- munmap(map, len); +- close(fd); +- return; +- } +- strncpy(log_buf, temp - 19, 16); +- setsysfs(mic->name, "log_buf_addr", log_buf); +- mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf); +- temp = strstr(map, "log_buf_len"); +- if (!temp) { +- mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno); +- munmap(map, len); +- close(fd); +- return; +- } +- strncpy(log_buf, temp - 19, 16); +- setsysfs(mic->name, "log_buf_len", log_buf); +- mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf); +- munmap(map, len); +- close(fd); +-} +- +-static void init_mic(struct mic_info *mic); +- +-static void +-change_virtblk_backend(int x, siginfo_t *siginfo, void *p) +-{ +- struct mic_info *mic; +- +- for (mic = mic_list.next; mic != NULL; mic = mic->next) +- mic->mic_virtblk.signaled = 1/* true */; +-} +- +-static void +-init_mic(struct mic_info *mic) +-{ +- struct sigaction ignore = { +- .sa_flags = 0, +- .sa_handler = SIG_IGN +- }; +- struct sigaction act = { +- .sa_flags = SA_SIGINFO, +- .sa_sigaction = change_virtblk_backend, +- }; +- char buffer[PATH_MAX]; +- int err; +- +- /* +- * Currently, one virtio block device is supported for each MIC card +- * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon. +- * The signal informs the virtio block backend about a change in the +- * configuration file which specifies the virtio backend file name on +- * the host. Virtio block backend then re-reads the configuration file +- * and switches to the new block device. This signalling mechanism may +- * not be required once multiple virtio block devices are supported by +- * the MIC daemon. +- */ +- sigaction(SIGUSR1, &ignore, NULL); +- +- mic->pid = fork(); +- switch (mic->pid) { +- case 0: +- set_log_buf_info(mic); +- set_cmdline(mic); +- add_virtio_device(mic, &virtcons_dev_page.dd); +- add_virtio_device(mic, &virtnet_dev_page.dd); +- err = pthread_create(&mic->mic_console.console_thread, NULL, +- virtio_console, mic); +- if (err) +- mpsslog("%s virtcons pthread_create failed %s\n", +- mic->name, strerror(err)); +- err = pthread_create(&mic->mic_net.net_thread, NULL, +- virtio_net, mic); +- if (err) +- mpsslog("%s virtnet pthread_create failed %s\n", +- mic->name, strerror(err)); +- err = pthread_create(&mic->mic_virtblk.block_thread, NULL, +- virtio_block, mic); +- if (err) +- mpsslog("%s virtblk pthread_create failed %s\n", +- mic->name, strerror(err)); +- sigemptyset(&act.sa_mask); +- err = sigaction(SIGUSR1, &act, NULL); +- if (err) +- mpsslog("%s sigaction SIGUSR1 failed %s\n", +- mic->name, strerror(errno)); +- while (1) +- sleep(60); +- case -1: +- mpsslog("fork failed MIC name %s id %d errno %d\n", +- mic->name, mic->id, errno); +- break; +- default: +- if (mic->restart) { +- snprintf(buffer, PATH_MAX, "boot"); +- setsysfs(mic->name, "state", buffer); +- mpsslog("%s restarting mic %d\n", +- mic->name, mic->restart); +- mic->restart = 0; +- } +- pthread_create(&mic->config_thread, NULL, mic_config, mic); +- } +-} +- +-static void +-start_daemon(void) +-{ +- struct mic_info *mic; +- +- for (mic = mic_list.next; mic != NULL; mic = mic->next) +- init_mic(mic); +- +- while (1) +- sleep(60); +-} +- +-static int +-init_mic_list(void) +-{ +- struct mic_info *mic = &mic_list; +- struct dirent *file; +- DIR *dp; +- int cnt = 0; +- +- dp = opendir(MICSYSFSDIR); +- if (!dp) +- return 0; +- +- while ((file = readdir(dp)) != NULL) { +- if (!strncmp(file->d_name, "mic", 3)) { +- mic->next = calloc(1, sizeof(struct mic_info)); +- if (mic->next) { +- mic = mic->next; +- mic->id = atoi(&file->d_name[3]); +- mic->name = malloc(strlen(file->d_name) + 16); +- if (mic->name) +- strcpy(mic->name, file->d_name); +- mpsslog("MIC name %s id %d\n", mic->name, +- mic->id); +- cnt++; +- } +- } +- } +- +- closedir(dp); +- return cnt; +-} +- +-void +-mpsslog(char *format, ...) +-{ +- va_list args; +- char buffer[4096]; +- char ts[52], *ts1; +- time_t t; +- +- if (logfp == NULL) +- return; +- +- va_start(args, format); +- vsprintf(buffer, format, args); +- va_end(args); +- +- time(&t); +- ts1 = ctime_r(&t, ts); +- ts1[strlen(ts1) - 1] = '\0'; +- fprintf(logfp, "%s: %s", ts1, buffer); +- +- fflush(logfp); +-} +- +-int +-main(int argc, char *argv[]) +-{ +- int cnt; +- pid_t pid; +- +- myname = argv[0]; +- +- logfp = fopen(LOGFILE_NAME, "a+"); +- if (!logfp) { +- fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME); +- exit(1); +- } +- pid = fork(); +- switch (pid) { +- case 0: +- break; +- case -1: +- exit(2); +- default: +- exit(0); +- } +- +- mpsslog("MIC Daemon start\n"); +- +- cnt = init_mic_list(); +- if (cnt == 0) { +- mpsslog("MIC module not loaded\n"); +- exit(3); +- } +- mpsslog("MIC found %d devices\n", cnt); +- +- start_daemon(); +- +- exit(0); +-} +diff --git a/Documentation/mic/mpssd/mpssd.h b/Documentation/mic/mpssd/mpssd.h +deleted file mode 100644 +index f5f18b15d9a0..000000000000 +--- a/Documentation/mic/mpssd/mpssd.h ++++ /dev/null +@@ -1,102 +0,0 @@ +-/* +- * Intel MIC Platform Software Stack (MPSS) +- * +- * Copyright(c) 2013 Intel Corporation. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License, version 2, as +- * published by the Free Software Foundation. +- * +- * This program is distributed in the hope that it will be useful, but +- * WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +- * General Public License for more details. +- * +- * The full GNU General Public License is included in this distribution in +- * the file called "COPYING". +- * +- * Intel MIC User Space Tools. +- */ +-#ifndef _MPSSD_H_ +-#define _MPSSD_H_ +- +-#include <stdio.h> +-#include <stdlib.h> +-#include <string.h> +-#include <fcntl.h> +-#include <unistd.h> +-#include <dirent.h> +-#include <libgen.h> +-#include <pthread.h> +-#include <stdarg.h> +-#include <time.h> +-#include <errno.h> +-#include <sys/dir.h> +-#include <sys/ioctl.h> +-#include <sys/poll.h> +-#include <sys/types.h> +-#include <sys/socket.h> +-#include <sys/stat.h> +-#include <sys/types.h> +-#include <sys/mman.h> +-#include <sys/utsname.h> +-#include <sys/wait.h> +-#include <netinet/in.h> +-#include <arpa/inet.h> +-#include <netdb.h> +-#include <pthread.h> +-#include <signal.h> +-#include <limits.h> +-#include <syslog.h> +-#include <getopt.h> +-#include <net/if.h> +-#include <linux/if_tun.h> +-#include <linux/if_tun.h> +-#include <linux/virtio_ids.h> +- +-#define MICSYSFSDIR "/sys/class/mic" +-#define LOGFILE_NAME "/var/log/mpssd" +-#define PAGE_SIZE 4096 +- +-struct mic_console_info { +- pthread_t console_thread; +- int virtio_console_fd; +- void *console_dp; +-}; +- +-struct mic_net_info { +- pthread_t net_thread; +- int virtio_net_fd; +- int tap_fd; +- void *net_dp; +-}; +- +-struct mic_virtblk_info { +- pthread_t block_thread; +- int virtio_block_fd; +- void *block_dp; +- volatile sig_atomic_t signaled; +- char *backend_file; +- int backend; +- void *backend_addr; +- long backend_size; +-}; +- +-struct mic_info { +- int id; +- char *name; +- pthread_t config_thread; +- pid_t pid; +- struct mic_console_info mic_console; +- struct mic_net_info mic_net; +- struct mic_virtblk_info mic_virtblk; +- int restart; +- int boot_on_resume; +- struct mic_info *next; +-}; +- +-__attribute__((format(printf, 1, 2))) +-void mpsslog(char *format, ...); +-char *readsysfs(char *dir, char *entry); +-int setsysfs(char *dir, char *entry, char *value); +-#endif +diff --git a/Documentation/mic/mpssd/sysfs.c b/Documentation/mic/mpssd/sysfs.c +deleted file mode 100644 +index 8dd326936083..000000000000 +--- a/Documentation/mic/mpssd/sysfs.c ++++ /dev/null +@@ -1,102 +0,0 @@ +-/* +- * Intel MIC Platform Software Stack (MPSS) +- * +- * Copyright(c) 2013 Intel Corporation. +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License, version 2, as +- * published by the Free Software Foundation. +- * +- * This program is distributed in the hope that it will be useful, but +- * WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +- * General Public License for more details. +- * +- * The full GNU General Public License is included in this distribution in +- * the file called "COPYING". +- * +- * Intel MIC User Space Tools. +- */ +- +-#include "mpssd.h" +- +-#define PAGE_SIZE 4096 +- +-char * +-readsysfs(char *dir, char *entry) +-{ +- char filename[PATH_MAX]; +- char value[PAGE_SIZE]; +- char *string = NULL; +- int fd; +- int len; +- +- if (dir == NULL) +- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); +- else +- snprintf(filename, PATH_MAX, +- "%s/%s/%s", MICSYSFSDIR, dir, entry); +- +- fd = open(filename, O_RDONLY); +- if (fd < 0) { +- mpsslog("Failed to open sysfs entry '%s': %s\n", +- filename, strerror(errno)); +- return NULL; +- } +- +- len = read(fd, value, sizeof(value)); +- if (len < 0) { +- mpsslog("Failed to read sysfs entry '%s': %s\n", +- filename, strerror(errno)); +- goto readsys_ret; +- } +- if (len == 0) +- goto readsys_ret; +- +- value[len - 1] = '\0'; +- +- string = malloc(strlen(value) + 1); +- if (string) +- strcpy(string, value); +- +-readsys_ret: +- close(fd); +- return string; +-} +- +-int +-setsysfs(char *dir, char *entry, char *value) +-{ +- char filename[PATH_MAX]; +- char *oldvalue; +- int fd, ret = 0; +- +- if (dir == NULL) +- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); +- else +- snprintf(filename, PATH_MAX, "%s/%s/%s", +- MICSYSFSDIR, dir, entry); +- +- oldvalue = readsysfs(dir, entry); +- +- fd = open(filename, O_RDWR); +- if (fd < 0) { +- ret = errno; +- mpsslog("Failed to open sysfs entry '%s': %s\n", +- filename, strerror(errno)); +- goto done; +- } +- +- if (!oldvalue || strcmp(value, oldvalue)) { +- if (write(fd, value, strlen(value)) < 0) { +- ret = errno; +- mpsslog("Failed to write new sysfs entry '%s': %s\n", +- filename, strerror(errno)); +- } +- } +- close(fd); +-done: +- if (oldvalue) +- free(oldvalue); +- return ret; +-} +diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt +deleted file mode 100644 +index c6af4bac5aa8..000000000000 +--- a/Documentation/networking/netlink_mmap.txt ++++ /dev/null +@@ -1,339 +0,0 @@ +-This file documents how to use memory mapped I/O with netlink. +- +-Author: Patrick McHardy <kaber@trash.net> +- +-Overview +--------- +- +-Memory mapped netlink I/O can be used to increase throughput and decrease +-overhead of unicast receive and transmit operations. Some netlink subsystems +-require high throughput, these are mainly the netfilter subsystems +-nfnetlink_queue and nfnetlink_log, but it can also help speed up large +-dump operations of f.i. the routing database. +- +-Memory mapped netlink I/O used two circular ring buffers for RX and TX which +-are mapped into the processes address space. +- +-The RX ring is used by the kernel to directly construct netlink messages into +-user-space memory without copying them as done with regular socket I/O, +-additionally as long as the ring contains messages no recvmsg() or poll() +-syscalls have to be issued by user-space to get more message. +- +-The TX ring is used to process messages directly from user-space memory, the +-kernel processes all messages contained in the ring using a single sendmsg() +-call. +- +-Usage overview +--------------- +- +-In order to use memory mapped netlink I/O, user-space needs three main changes: +- +-- ring setup +-- conversion of the RX path to get messages from the ring instead of recvmsg() +-- conversion of the TX path to construct messages into the ring +- +-Ring setup is done using setsockopt() to provide the ring parameters to the +-kernel, then a call to mmap() to map the ring into the processes address space: +- +-- setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, ¶ms, sizeof(params)); +-- setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, ¶ms, sizeof(params)); +-- ring = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0) +- +-Usage of either ring is optional, but even if only the RX ring is used the +-mapping still needs to be writable in order to update the frame status after +-processing. +- +-Conversion of the reception path involves calling poll() on the file +-descriptor, once the socket is readable the frames from the ring are +-processed in order until no more messages are available, as indicated by +-a status word in the frame header. +- +-On kernel side, in order to make use of memory mapped I/O on receive, the +-originating netlink subsystem needs to support memory mapped I/O, otherwise +-it will use an allocated socket buffer as usual and the contents will be +- copied to the ring on transmission, nullifying most of the performance gains. +-Dumps of kernel databases automatically support memory mapped I/O. +- +-Conversion of the transmit path involves changing message construction to +-use memory from the TX ring instead of (usually) a buffer declared on the +-stack and setting up the frame header appropriately. Optionally poll() can +-be used to wait for free frames in the TX ring. +- +-Structured and definitions for using memory mapped I/O are contained in +-<linux/netlink.h>. +- +-RX and TX rings +----------------- +- +-Each ring contains a number of continuous memory blocks, containing frames of +-fixed size dependent on the parameters used for ring setup. +- +-Ring: [ block 0 ] +- [ frame 0 ] +- [ frame 1 ] +- [ block 1 ] +- [ frame 2 ] +- [ frame 3 ] +- ... +- [ block n ] +- [ frame 2 * n ] +- [ frame 2 * n + 1 ] +- +-The blocks are only visible to the kernel, from the point of view of user-space +-the ring just contains the frames in a continuous memory zone. +- +-The ring parameters used for setting up the ring are defined as follows: +- +-struct nl_mmap_req { +- unsigned int nm_block_size; +- unsigned int nm_block_nr; +- unsigned int nm_frame_size; +- unsigned int nm_frame_nr; +-}; +- +-Frames are grouped into blocks, where each block is a continuous region of memory +-and holds nm_block_size / nm_frame_size frames. The total number of frames in +-the ring is nm_frame_nr. The following invariants hold: +- +-- frames_per_block = nm_block_size / nm_frame_size +- +-- nm_frame_nr = frames_per_block * nm_block_nr +- +-Some parameters are constrained, specifically: +- +-- nm_block_size must be a multiple of the architectures memory page size. +- The getpagesize() function can be used to get the page size. +- +-- nm_frame_size must be equal or larger to NL_MMAP_HDRLEN, IOW a frame must be +- able to hold at least the frame header +- +-- nm_frame_size must be smaller or equal to nm_block_size +- +-- nm_frame_size must be a multiple of NL_MMAP_MSG_ALIGNMENT +- +-- nm_frame_nr must equal the actual number of frames as specified above. +- +-When the kernel can't allocate physically continuous memory for a ring block, +-it will fall back to use physically discontinuous memory. This might affect +-performance negatively, in order to avoid this the nm_frame_size parameter +-should be chosen to be as small as possible for the required frame size and +-the number of blocks should be increased instead. +- +-Ring frames +------------- +- +-Each frames contain a frame header, consisting of a synchronization word and some +-meta-data, and the message itself. +- +-Frame: [ header message ] +- +-The frame header is defined as follows: +- +-struct nl_mmap_hdr { +- unsigned int nm_status; +- unsigned int nm_len; +- __u32 nm_group; +- /* credentials */ +- __u32 nm_pid; +- __u32 nm_uid; +- __u32 nm_gid; +-}; +- +-- nm_status is used for synchronizing processing between the kernel and user- +- space and specifies ownership of the frame as well as the operation to perform +- +-- nm_len contains the length of the message contained in the data area +- +-- nm_group specified the destination multicast group of message +- +-- nm_pid, nm_uid and nm_gid contain the netlink pid, UID and GID of the sending +- process. These values correspond to the data available using SOCK_PASSCRED in +- the SCM_CREDENTIALS cmsg. +- +-The possible values in the status word are: +- +-- NL_MMAP_STATUS_UNUSED: +- RX ring: frame belongs to the kernel and contains no message +- for user-space. Approriate action is to invoke poll() +- to wait for new messages. +- +- TX ring: frame belongs to user-space and can be used for +- message construction. +- +-- NL_MMAP_STATUS_RESERVED: +- RX ring only: frame is currently used by the kernel for message +- construction and contains no valid message yet. +- Appropriate action is to invoke poll() to wait for +- new messages. +- +-- NL_MMAP_STATUS_VALID: +- RX ring: frame contains a valid message. Approriate action is +- to process the message and release the frame back to +- the kernel by setting the status to +- NL_MMAP_STATUS_UNUSED or queue the frame by setting the +- status to NL_MMAP_STATUS_SKIP. +- +- TX ring: the frame contains a valid message from user-space to +- be processed by the kernel. After completing processing +- the kernel will release the frame back to user-space by +- setting the status to NL_MMAP_STATUS_UNUSED. +- +-- NL_MMAP_STATUS_COPY: +- RX ring only: a message is ready to be processed but could not be +- stored in the ring, either because it exceeded the +- frame size or because the originating subsystem does +- not support memory mapped I/O. Appropriate action is +- to invoke recvmsg() to receive the message and release +- the frame back to the kernel by setting the status to +- NL_MMAP_STATUS_UNUSED. +- +-- NL_MMAP_STATUS_SKIP: +- RX ring only: user-space queued the message for later processing, but +- processed some messages following it in the ring. The +- kernel should skip this frame when looking for unused +- frames. +- +-The data area of a frame begins at a offset of NL_MMAP_HDRLEN relative to the +-frame header. +- +-TX limitations +--------------- +- +-Kernel processing usually involves validation of the message received by +-user-space, then processing its contents. The kernel must assure that +-userspace is not able to modify the message contents after they have been +-validated. In order to do so, the message is copied from the ring frame +-to an allocated buffer if either of these conditions is false: +- +-- only a single mapping of the ring exists +-- the file descriptor is not shared between processes +- +-This means that for threaded programs, the kernel will fall back to copying. +- +-Example +-------- +- +-Ring setup: +- +- unsigned int block_size = 16 * getpagesize(); +- struct nl_mmap_req req = { +- .nm_block_size = block_size, +- .nm_block_nr = 64, +- .nm_frame_size = 16384, +- .nm_frame_nr = 64 * block_size / 16384, +- }; +- unsigned int ring_size; +- void *rx_ring, *tx_ring; +- +- /* Configure ring parameters */ +- if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0) +- exit(1); +- if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0) +- exit(1) +- +- /* Calculate size of each individual ring */ +- ring_size = req.nm_block_nr * req.nm_block_size; +- +- /* Map RX/TX rings. The TX ring is located after the RX ring */ +- rx_ring = mmap(NULL, 2 * ring_size, PROT_READ | PROT_WRITE, +- MAP_SHARED, fd, 0); +- if ((long)rx_ring == -1L) +- exit(1); +- tx_ring = rx_ring + ring_size: +- +-Message reception: +- +-This example assumes some ring parameters of the ring setup are available. +- +- unsigned int frame_offset = 0; +- struct nl_mmap_hdr *hdr; +- struct nlmsghdr *nlh; +- unsigned char buf[16384]; +- ssize_t len; +- +- while (1) { +- struct pollfd pfds[1]; +- +- pfds[0].fd = fd; +- pfds[0].events = POLLIN | POLLERR; +- pfds[0].revents = 0; +- +- if (poll(pfds, 1, -1) < 0 && errno != -EINTR) +- exit(1); +- +- /* Check for errors. Error handling omitted */ +- if (pfds[0].revents & POLLERR) +- <handle error> +- +- /* If no new messages, poll again */ +- if (!(pfds[0].revents & POLLIN)) +- continue; +- +- /* Process all frames */ +- while (1) { +- /* Get next frame header */ +- hdr = rx_ring + frame_offset; +- +- if (hdr->nm_status == NL_MMAP_STATUS_VALID) { +- /* Regular memory mapped frame */ +- nlh = (void *)hdr + NL_MMAP_HDRLEN; +- len = hdr->nm_len; +- +- /* Release empty message immediately. May happen +- * on error during message construction. +- */ +- if (len == 0) +- goto release; +- } else if (hdr->nm_status == NL_MMAP_STATUS_COPY) { +- /* Frame queued to socket receive queue */ +- len = recv(fd, buf, sizeof(buf), MSG_DONTWAIT); +- if (len <= 0) +- break; +- nlh = buf; +- } else +- /* No more messages to process, continue polling */ +- break; +- +- process_msg(nlh); +-release: +- /* Release frame back to the kernel */ +- hdr->nm_status = NL_MMAP_STATUS_UNUSED; +- +- /* Advance frame offset to next frame */ +- frame_offset = (frame_offset + frame_size) % ring_size; +- } +- } +- +-Message transmission: +- +-This example assumes some ring parameters of the ring setup are available. +-A single message is constructed and transmitted, to send multiple messages +-at once they would be constructed in consecutive frames before a final call +-to sendto(). +- +- unsigned int frame_offset = 0; +- struct nl_mmap_hdr *hdr; +- struct nlmsghdr *nlh; +- struct sockaddr_nl addr = { +- .nl_family = AF_NETLINK, +- }; +- +- hdr = tx_ring + frame_offset; +- if (hdr->nm_status != NL_MMAP_STATUS_UNUSED) +- /* No frame available. Use poll() to avoid. */ +- exit(1); +- +- nlh = (void *)hdr + NL_MMAP_HDRLEN; +- +- /* Build message */ +- build_message(nlh); +- +- /* Fill frame header: length and status need to be set */ +- hdr->nm_len = nlh->nlmsg_len; +- hdr->nm_status = NL_MMAP_STATUS_VALID; +- +- if (sendto(fd, NULL, 0, 0, &addr, sizeof(addr)) < 0) +- exit(1); +- +- /* Advance frame offset to next frame */ +- frame_offset = (frame_offset + frame_size) % ring_size; +diff --git a/Makefile b/Makefile +index 52d32f6bd7c5..252070fdf91c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 18 +-SUBLEVEL = 48 ++SUBLEVEL = 49 + EXTRAVERSION = + NAME = Diseased Newt + +diff --git a/arch/arm/include/asm/floppy.h b/arch/arm/include/asm/floppy.h +index f4882553fbb0..85a34cc8316a 100644 +--- a/arch/arm/include/asm/floppy.h ++++ b/arch/arm/include/asm/floppy.h +@@ -17,7 +17,7 @@ + + #define fd_outb(val,port) \ + do { \ +- if ((port) == FD_DOR) \ ++ if ((port) == (u32)FD_DOR) \ + fd_setdor((val)); \ + else \ + outb((val),(port)); \ +diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig +index 48e16d98b2cc..6ecc67f3736b 100644 +--- a/arch/mips/configs/ip27_defconfig ++++ b/arch/mips/configs/ip27_defconfig +@@ -206,7 +206,6 @@ CONFIG_MLX4_EN=m + # CONFIG_MLX4_DEBUG is not set + CONFIG_TEHUTI=m + CONFIG_BNX2X=m +-CONFIG_QLGE=m + CONFIG_SFC=m + CONFIG_BE2NET=m + CONFIG_LIBERTAS_THINFIRM=m +diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S +index 41a2fa1fa12e..c7953f2aca4f 100644 +--- a/arch/mips/dec/int-handler.S ++++ b/arch/mips/dec/int-handler.S +@@ -146,7 +146,25 @@ + /* + * Find irq with highest priority + */ +- PTR_LA t1,cpu_mask_nr_tbl ++ # open coded PTR_LA t1, cpu_mask_nr_tbl ++#if (_MIPS_SZPTR == 32) ++ # open coded la t1, cpu_mask_nr_tbl ++ lui t1, %hi(cpu_mask_nr_tbl) ++ addiu t1, %lo(cpu_mask_nr_tbl) ++ ++#endif ++#if (_MIPS_SZPTR == 64) ++ # open coded dla t1, cpu_mask_nr_tbl ++ .set push ++ .set noat ++ lui t1, %highest(cpu_mask_nr_tbl) ++ lui AT, %hi(cpu_mask_nr_tbl) ++ daddiu t1, t1, %higher(cpu_mask_nr_tbl) ++ daddiu AT, AT, %lo(cpu_mask_nr_tbl) ++ dsll t1, 32 ++ daddu t1, t1, AT ++ .set pop ++#endif + 1: lw t2,(t1) + nop + and t2,t0 +@@ -195,7 +213,25 @@ + /* + * Find irq with highest priority + */ +- PTR_LA t1,asic_mask_nr_tbl ++ # open coded PTR_LA t1,asic_mask_nr_tbl ++#if (_MIPS_SZPTR == 32) ++ # open coded la t1, asic_mask_nr_tbl ++ lui t1, %hi(asic_mask_nr_tbl) ++ addiu t1, %lo(asic_mask_nr_tbl) ++ ++#endif ++#if (_MIPS_SZPTR == 64) ++ # open coded dla t1, asic_mask_nr_tbl ++ .set push ++ .set noat ++ lui t1, %highest(asic_mask_nr_tbl) ++ lui AT, %hi(asic_mask_nr_tbl) ++ daddiu t1, t1, %higher(asic_mask_nr_tbl) ++ daddiu AT, AT, %lo(asic_mask_nr_tbl) ++ dsll t1, 32 ++ daddu t1, t1, AT ++ .set pop ++#endif + 2: lw t2,(t1) + nop + and t2,t0 +diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform +index b7a4b7e04c38..e8f6b3a42a48 100644 +--- a/arch/mips/sgi-ip22/Platform ++++ b/arch/mips/sgi-ip22/Platform +@@ -25,7 +25,7 @@ endif + # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys + # + ifdef CONFIG_SGI_IP28 +- ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n) ++ ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n) + $(error gcc doesn't support needed option -mr10k-cache-barrier=store) + endif + endif +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index 54651fc2d412..51b667316605 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -1806,8 +1806,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto instr_done; + + case LARX: +- if (regs->msr & MSR_LE) +- return 0; + if (op.ea & (size - 1)) + break; /* can't handle misaligned */ + err = -EFAULT; +@@ -1829,8 +1827,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case STCX: +- if (regs->msr & MSR_LE) +- return 0; + if (op.ea & (size - 1)) + break; /* can't handle misaligned */ + err = -EFAULT; +@@ -1854,8 +1850,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case LOAD: +- if (regs->msr & MSR_LE) +- return 0; + err = read_mem(®s->gpr[op.reg], op.ea, size, regs); + if (!err) { + if (op.type & SIGNEXT) +@@ -1866,8 +1860,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case LOAD_FP: +- if (regs->msr & MSR_LE) +- return 0; + if (size == 4) + err = do_fp_load(op.reg, do_lfs, op.ea, size, regs); + else +@@ -1876,15 +1868,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + + #ifdef CONFIG_ALTIVEC + case LOAD_VMX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs); + goto ldst_done; + #endif + #ifdef CONFIG_VSX + case LOAD_VSX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs); + goto ldst_done; + #endif +@@ -1907,8 +1895,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto instr_done; + + case STORE: +- if (regs->msr & MSR_LE) +- return 0; + if ((op.type & UPDATE) && size == sizeof(long) && + op.reg == 1 && op.update_reg == 1 && + !(regs->msr & MSR_PR) && +@@ -1920,8 +1906,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + goto ldst_done; + + case STORE_FP: +- if (regs->msr & MSR_LE) +- return 0; + if (size == 4) + err = do_fp_store(op.reg, do_stfs, op.ea, size, regs); + else +@@ -1930,15 +1914,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + + #ifdef CONFIG_ALTIVEC + case STORE_VMX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs); + goto ldst_done; + #endif + #ifdef CONFIG_VSX + case STORE_VSX: +- if (regs->msr & MSR_LE) +- return 0; + err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs); + goto ldst_done; + #endif +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index d559bdb03d18..2006b955ea91 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -74,7 +74,8 @@ extern void execve_tail(void); + + #else /* CONFIG_64BIT */ + +-#define TASK_SIZE_OF(tsk) ((tsk)->mm->context.asce_limit) ++#define TASK_SIZE_OF(tsk) ((tsk)->mm ? \ ++ (tsk)->mm->context.asce_limit : TASK_MAX_SIZE) + #define TASK_UNMAPPED_BASE (test_thread_flag(TIF_31BIT) ? \ + (1UL << 30) : (1UL << 41)) + #define TASK_SIZE TASK_SIZE_OF(current) +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index e80d9ff9a56d..ec3b505238cb 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -822,10 +822,10 @@ static void __init setup_randomness(void) + { + struct sysinfo_3_2_2 *vmms; + +- vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL); +- if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count) +- add_device_randomness(&vmms, vmms->count); +- free_page((unsigned long) vmms); ++ vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE); ++ if (stsi(vmms, 3, 2, 2) == 0 && vmms->count) ++ add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count); ++ memblock_free((unsigned long) vmms, PAGE_SIZE); + } + + /* +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 49e4d64ff74d..0ce029c73ca3 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -207,6 +207,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, + struct kvm_memory_slot *memslot; + int is_dirty = 0; + ++ if (kvm_is_ucontrol(kvm)) ++ return -EINVAL; ++ + mutex_lock(&kvm->slots_lock); + + r = -EINVAL; +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index 35fde2a24751..d0f59879cdca 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -1358,11 +1358,28 @@ EXPORT_SYMBOL_GPL(s390_enable_skey); + */ + bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap) + { ++ pgd_t *pgd; ++ pud_t *pud; ++ pmd_t *pmd; + pte_t *pte; + spinlock_t *ptl; + bool dirty = false; + +- pte = get_locked_pte(gmap->mm, address, &ptl); ++ pgd = pgd_offset(gmap->mm, address); ++ pud = pud_alloc(gmap->mm, pgd, address); ++ if (!pud) ++ return false; ++ pmd = pmd_alloc(gmap->mm, pud, address); ++ if (!pmd) ++ return false; ++ /* We can't run guests backed by huge pages, but userspace can ++ * still set them up and then try to migrate them without any ++ * migration support. ++ */ ++ if (pmd_large(*pmd)) ++ return true; ++ ++ pte = pte_alloc_map_lock(gmap->mm, pmd, address, &ptl); + if (unlikely(!pte)) + return false; + +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index de1d72e3ec59..2f5cd2f62a2b 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -218,6 +218,29 @@ static int ghash_async_final(struct ahash_request *req) + } + } + ++static int ghash_async_import(struct ahash_request *req, const void *in) ++{ ++ struct ahash_request *cryptd_req = ahash_request_ctx(req); ++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); ++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ ++ ghash_async_init(req); ++ memcpy(dctx, in, sizeof(*dctx)); ++ return 0; ++ ++} ++ ++static int ghash_async_export(struct ahash_request *req, void *out) ++{ ++ struct ahash_request *cryptd_req = ahash_request_ctx(req); ++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); ++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ ++ memcpy(out, dctx, sizeof(*dctx)); ++ return 0; ++ ++} ++ + static int ghash_async_digest(struct ahash_request *req) + { + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); +@@ -285,8 +308,11 @@ static struct ahash_alg ghash_async_alg = { + .final = ghash_async_final, + .setkey = ghash_async_setkey, + .digest = ghash_async_digest, ++ .export = ghash_async_export, ++ .import = ghash_async_import, + .halg = { + .digestsize = GHASH_DIGEST_SIZE, ++ .statesize = sizeof(struct ghash_desc_ctx), + .base = { + .cra_name = "ghash", + .cra_driver_name = "ghash-clmulni", +diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h +index 8e046ade1c88..504be087d682 100644 +--- a/arch/x86/include/asm/uaccess.h ++++ b/arch/x86/include/asm/uaccess.h +@@ -329,7 +329,7 @@ do { \ + #define __get_user_asm_u64(x, ptr, retval, errret) \ + __get_user_asm(x, ptr, retval, "q", "", "=r", errret) + #define __get_user_asm_ex_u64(x, ptr) \ +- __get_user_asm_ex(x, ptr, "q", "", "=r") ++ __get_user_asm_ex(x, ptr, "q", "", "=&r") + #endif + + #define __get_user_size(x, ptr, size, retval, errret) \ +@@ -372,13 +372,13 @@ do { \ + __chk_user_ptr(ptr); \ + switch (size) { \ + case 1: \ +- __get_user_asm_ex(x, ptr, "b", "b", "=q"); \ ++ __get_user_asm_ex(x, ptr, "b", "b", "=&q"); \ + break; \ + case 2: \ +- __get_user_asm_ex(x, ptr, "w", "w", "=r"); \ ++ __get_user_asm_ex(x, ptr, "w", "w", "=&r"); \ + break; \ + case 4: \ +- __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ ++ __get_user_asm_ex(x, ptr, "l", "k", "=&r"); \ + break; \ + case 8: \ + __get_user_asm_ex_u64(x, ptr); \ +@@ -396,7 +396,7 @@ do { \ + " jmp 2b\n" \ + ".previous\n" \ + _ASM_EXTABLE_EX(1b, 3b) \ +- : ltype(x) : "m" (__m(addr))) ++ : ltype(x) : "m" (__m(addr)), "0" (0)) + + #define __put_user_nocheck(x, ptr, size) \ + ({ \ +diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c +index 06370ccea9e9..b70097e7f37a 100644 +--- a/arch/xtensa/kernel/setup.c ++++ b/arch/xtensa/kernel/setup.c +@@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag) + + __tagtable(BP_TAG_INITRD, parse_tag_initrd); + ++#endif /* CONFIG_BLK_DEV_INITRD */ ++ + #ifdef CONFIG_OF + + static int __init parse_tag_fdt(const bp_tag_t *tag) +@@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt); + + #endif /* CONFIG_OF */ + +-#endif /* CONFIG_BLK_DEV_INITRD */ +- + static int __init parse_tag_cmdline(const bp_tag_t* tag) + { + strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE); +diff --git a/crypto/Makefile b/crypto/Makefile +index 1445b9100c05..ea11cf871ebc 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -47,6 +47,7 @@ obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o + obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o + obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o + obj-$(CONFIG_CRYPTO_WP512) += wp512.o ++CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o + obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o + obj-$(CONFIG_CRYPTO_ECB) += ecb.o +@@ -68,6 +69,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH_COMMON) += blowfish_common.o + obj-$(CONFIG_CRYPTO_TWOFISH) += twofish_generic.o + obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o + obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o ++CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_AES) += aes_generic.o + obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o + obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o +diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c +index df99445a899a..9eb8174aa58c 100644 +--- a/crypto/algif_hash.c ++++ b/crypto/algif_hash.c +@@ -195,7 +195,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags) + struct alg_sock *ask = alg_sk(sk); + struct hash_ctx *ctx = ask->private; + struct ahash_request *req = &ctx->req; +- char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))]; ++ char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1]; + struct sock *sk2; + struct alg_sock *ask2; + struct hash_ctx *ctx2; +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index be367e43ffe8..fb0d140065e2 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -606,6 +606,7 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, + inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC; + + inst->alg.halg.digestsize = salg->digestsize; ++ inst->alg.halg.statesize = salg->statesize; + inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx); + + inst->alg.halg.base.cra_init = cryptd_hash_init_tfm; +diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c +index a8e870444ea9..02a1c10fa909 100644 +--- a/crypto/mcryptd.c ++++ b/crypto/mcryptd.c +@@ -505,6 +505,7 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, + inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC; + + inst->alg.halg.digestsize = salg->digestsize; ++ inst->alg.halg.statesize = salg->statesize; + inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx); + + inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm; +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 973c185c9cfe..a31b282de8e0 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -1802,7 +1802,7 @@ int drbd_send(struct drbd_connection *connection, struct socket *sock, + * do we need to block DRBD_SIG if sock == &meta.socket ?? + * otherwise wake_asender() might interrupt some send_*Ack ! + */ +- rv = kernel_sendmsg(sock, &msg, &iov, 1, size); ++ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len); + if (rv == -EAGAIN) { + if (we_should_drop_the_connection(connection, sock)) + break; +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 036969223c16..0b4b67b859e2 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -94,6 +94,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x04CA, 0x300f) }, + { USB_DEVICE(0x04CA, 0x3010) }, + { USB_DEVICE(0x04CA, 0x3014) }, ++ { USB_DEVICE(0x04CA, 0x3018) }, + { USB_DEVICE(0x0930, 0x0219) }, + { USB_DEVICE(0x0930, 0x0220) }, + { USB_DEVICE(0x0930, 0x0227) }, +@@ -160,6 +161,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 2dd73a3e95a2..ce9a00a5c5ca 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -186,6 +186,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index 810c51d92b99..30672a3df8a9 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -58,13 +58,9 @@ bool ast_is_vga_enabled(struct drm_device *dev) + /* TODO 1180 */ + } else { + ch = ast_io_read8(ast, AST_IO_VGA_ENABLE_PORT); +- if (ch) { +- ast_open_key(ast); +- ch = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb6, 0xff); +- return ch & 0x04; +- } ++ return !!(ch & 0x01); + } +- return 0; ++ return false; + } + + static const u8 extreginfo[] = { 0x0f, 0x04, 0x1c, 0xff }; +@@ -375,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev) + pci_write_config_dword(ast->dev->pdev, 0x04, reg); + + ast_enable_vga(dev); +- ast_enable_mmio(dev); + ast_open_key(ast); ++ ast_enable_mmio(dev); + ast_set_def_ext_reg(dev); + + if (ast->chip == AST2300 || ast->chip == AST2400) +@@ -1630,12 +1626,44 @@ static void ast_init_dram_2300(struct drm_device *dev) + temp |= 0x73; + ast_write32(ast, 0x12008, temp); + ++ param.dram_freq = 396; + param.dram_type = AST_DDR3; ++ temp = ast_mindwm(ast, 0x1e6e2070); + if (temp & 0x01000000) + param.dram_type = AST_DDR2; +- param.dram_chipid = ast->dram_type; +- param.dram_freq = ast->mclk; +- param.vram_size = ast->vram_size; ++ switch (temp & 0x18000000) { ++ case 0: ++ param.dram_chipid = AST_DRAM_512Mx16; ++ break; ++ default: ++ case 0x08000000: ++ param.dram_chipid = AST_DRAM_1Gx16; ++ break; ++ case 0x10000000: ++ param.dram_chipid = AST_DRAM_2Gx16; ++ break; ++ case 0x18000000: ++ param.dram_chipid = AST_DRAM_4Gx16; ++ break; ++ } ++ switch (temp & 0x0c) { ++ default: ++ case 0x00: ++ param.vram_size = AST_VIDMEM_SIZE_8M; ++ break; ++ ++ case 0x04: ++ param.vram_size = AST_VIDMEM_SIZE_16M; ++ break; ++ ++ case 0x08: ++ param.vram_size = AST_VIDMEM_SIZE_32M; ++ break; ++ ++ case 0x0c: ++ param.vram_size = AST_VIDMEM_SIZE_64M; ++ break; ++ } + + if (param.dram_type == AST_DDR3) { + get_ddr3_info(ast, ¶m); +diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c +index 4c9f972eaa07..ba64d23b90a7 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_core.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_core.c +@@ -141,7 +141,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file) + return 0; + + err: +- list_for_each_entry_reverse(subdrv, &subdrv->list, list) { ++ list_for_each_entry_continue_reverse(subdrv, &exynos_drm_subdrv_list, list) { + if (subdrv->close) + subdrv->close(dev, subdrv->dev, file); + } +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 7370202c2022..4ca35798b0b2 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -1617,7 +1617,6 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink) + struct ttm_buffer_object *bo; + int ret = -EBUSY; + int put_count; +- uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM); + + spin_lock(&glob->lru_lock); + list_for_each_entry(bo, &glob->swap_lru, swap) { +@@ -1653,7 +1652,8 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink) + if (unlikely(ret != 0)) + goto out; + +- if ((bo->mem.placement & swap_placement) != swap_placement) { ++ if (bo->mem.mem_type != TTM_PL_SYSTEM || ++ bo->ttm->caching_state != tt_cached) { + struct ttm_mem_reg evict_mem; + + evict_mem = bo->mem; +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 984e43cb83f0..213f616e7a1f 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -168,6 +168,7 @@ + #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205 + #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208 + #define USB_DEVICE_ID_ATEN_CS682 0x2213 ++#define USB_DEVICE_ID_ATEN_CS692 0x8021 + + #define USB_VENDOR_ID_ATMEL 0x03eb + #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c +diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c +index f7dd36e4fcb3..999dff00b214 100644 +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -61,6 +61,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET }, ++ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET }, +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 933efcea0d03..cdf0a78e0c99 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1478,12 +1478,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr, + + ret = ipoib_set_mode(dev, buf); + +- rtnl_unlock(); +- +- if (!ret) +- return count; ++ /* The assumption is that the function ipoib_set_mode returned ++ * with the rtnl held by it, if not the value -EBUSY returned, ++ * then no need to rtnl_unlock ++ */ ++ if (ret != -EBUSY) ++ rtnl_unlock(); + +- return ret; ++ return (!ret || ret == -EBUSY) ? count : ret; + } + + static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 58b5aa3b6f2d..483ddbd1bdc8 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -236,8 +236,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf) + priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM; + + ipoib_flush_paths(dev); +- rtnl_lock(); +- return 0; ++ return (!rtnl_trylock()) ? -EBUSY : 0; + } + + if (!strcmp(buf, "datagram\n")) { +@@ -246,8 +245,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf) + dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu)); + rtnl_unlock(); + ipoib_flush_paths(dev); +- rtnl_lock(); +- return 0; ++ return (!rtnl_trylock()) ? -EBUSY : 0; + } + + return -EINVAL; +diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c +index 8d9ba0c3827c..94ab494a6ade 100644 +--- a/drivers/input/serio/gscps2.c ++++ b/drivers/input/serio/gscps2.c +@@ -40,7 +40,6 @@ + MODULE_AUTHOR("Laurent Canet <canetl@esiee.fr>, Thibaut Varene <varenet@parisc-linux.org>, Helge Deller <deller@gmx.de>"); + MODULE_DESCRIPTION("HP GSC PS2 port driver"); + MODULE_LICENSE("GPL"); +-MODULE_DEVICE_TABLE(parisc, gscps2_device_tbl); + + #define PFX "gscps2.c: " + +@@ -439,6 +438,7 @@ static struct parisc_device_id gscps2_device_tbl[] = { + #endif + { 0, } /* 0 terminated list */ + }; ++MODULE_DEVICE_TABLE(parisc, gscps2_device_tbl); + + static struct parisc_driver parisc_ps2_driver = { + .name = "gsc_ps2", +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 8a0643ae1fd9..6b78e131f6dd 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -317,7 +317,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb, + struct pci_dev *pdev = to_pci_dev(data); + struct dmar_pci_notify_info *info; + +- /* Only care about add/remove events for physical functions */ ++ /* Only care about add/remove events for physical functions. ++ * For VFs we actually do the lookup based on the corresponding ++ * PF in device_to_iommu() anyway. */ + if (pdev->is_virtfn) + return NOTIFY_DONE; + if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE) +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 3d1fc736a420..1689632e4e92 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -696,7 +696,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf + int i; + + if (dev_is_pci(dev)) { ++ struct pci_dev *pf_pdev; ++ + pdev = to_pci_dev(dev); ++ /* VFs aren't listed in scope tables; we need to look up ++ * the PF instead to find the IOMMU. */ ++ pf_pdev = pci_physfn(pdev); ++ dev = &pf_pdev->dev; + segment = pci_domain_nr(pdev->bus); + } else if (ACPI_COMPANION(dev)) + dev = &ACPI_COMPANION(dev)->dev; +@@ -709,6 +715,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf + for_each_active_dev_scope(drhd->devices, + drhd->devices_cnt, i, tmp) { + if (tmp == dev) { ++ /* For a VF use its original BDF# not that of the PF ++ * which we used for the IOMMU lookup. Strictly speaking ++ * we could do this for all PCI devices; we only need to ++ * get the BDF# from the scope table for ACPI matches. */ ++ if (pdev->is_virtfn) ++ goto got_pdev; ++ + *bus = drhd->devices[i].bus; + *devfn = drhd->devices[i].devfn; + goto out; +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 042114fbd200..fb07be386287 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1300,11 +1300,62 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors) + } + EXPORT_SYMBOL_GPL(dm_accept_partial_bio); + ++/* ++ * Flush current->bio_list when the target map method blocks. ++ * This fixes deadlocks in snapshot and possibly in other targets. ++ */ ++struct dm_offload { ++ struct blk_plug plug; ++ struct blk_plug_cb cb; ++}; ++ ++static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule) ++{ ++ struct dm_offload *o = container_of(cb, struct dm_offload, cb); ++ struct bio_list list; ++ struct bio *bio; ++ ++ INIT_LIST_HEAD(&o->cb.list); ++ ++ if (unlikely(!current->bio_list)) ++ return; ++ ++ list = *current->bio_list; ++ bio_list_init(current->bio_list); ++ ++ while ((bio = bio_list_pop(&list))) { ++ struct bio_set *bs = bio->bi_pool; ++ if (unlikely(!bs) || bs == fs_bio_set) { ++ bio_list_add(current->bio_list, bio); ++ continue; ++ } ++ ++ spin_lock(&bs->rescue_lock); ++ bio_list_add(&bs->rescue_list, bio); ++ queue_work(bs->rescue_workqueue, &bs->rescue_work); ++ spin_unlock(&bs->rescue_lock); ++ } ++} ++ ++static void dm_offload_start(struct dm_offload *o) ++{ ++ blk_start_plug(&o->plug); ++ o->cb.callback = flush_current_bio_list; ++ list_add(&o->cb.list, ¤t->plug->cb_list); ++} ++ ++static void dm_offload_end(struct dm_offload *o) ++{ ++ list_del(&o->cb.list); ++ blk_finish_plug(&o->plug); ++} ++ + static void __map_bio(struct dm_target_io *tio) + { + int r; + sector_t sector; + struct mapped_device *md; ++ struct dm_offload o; + struct bio *clone = &tio->clone; + struct dm_target *ti = tio->ti; + +@@ -1317,7 +1368,11 @@ static void __map_bio(struct dm_target_io *tio) + */ + atomic_inc(&tio->io->io_count); + sector = clone->bi_iter.bi_sector; ++ ++ dm_offload_start(&o); + r = ti->type->map(ti, clone); ++ dm_offload_end(&o); ++ + if (r == DM_MAPIO_REMAPPED) { + /* the bio has been remapped so dispatch it */ + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 644f9e576736..3e4def3c2b9f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1171,6 +1171,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio) + int max_sectors; + int sectors; + ++ md_write_start(mddev, bio); ++ + /* + * Register the new request and wait if the reconstruction + * thread has put up a bar for new requests. +@@ -1556,8 +1558,6 @@ static void make_request(struct mddev *mddev, struct bio *bio) + return; + } + +- md_write_start(mddev, bio); +- + do { + + /* +diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c +index 605b090c618b..b128624c56b8 100644 +--- a/drivers/media/usb/dvb-usb/dib0700_core.c ++++ b/drivers/media/usb/dvb-usb/dib0700_core.c +@@ -680,7 +680,7 @@ static void dib0700_rc_urb_completion(struct urb *purb) + struct dvb_usb_device *d = purb->context; + struct dib0700_rc_response *poll_reply; + enum rc_type protocol; +- u32 uninitialized_var(keycode); ++ u32 keycode; + u8 toggle; + + deb_info("%s()\n", __func__); +@@ -722,7 +722,8 @@ static void dib0700_rc_urb_completion(struct urb *purb) + poll_reply->nec.data == 0x00 && + poll_reply->nec.not_data == 0xff) { + poll_reply->data_state = 2; +- break; ++ rc_repeat(d->rc_dev); ++ goto resubmit; + } + + if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) { +diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c +index 744ca5cacc9b..cf54420f943d 100644 +--- a/drivers/mtd/maps/pmcmsp-flash.c ++++ b/drivers/mtd/maps/pmcmsp-flash.c +@@ -139,15 +139,13 @@ static int __init init_msp_flash(void) + } + + msp_maps[i].bankwidth = 1; +- msp_maps[i].name = kmalloc(7, GFP_KERNEL); ++ msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL); + if (!msp_maps[i].name) { + iounmap(msp_maps[i].virt); + kfree(msp_parts[i]); + goto cleanup_loop; + } + +- msp_maps[i].name = strncpy(msp_maps[i].name, flash_name, 7); +- + for (j = 0; j < pcnt; j++) { + part_name[5] = '0' + i; + part_name[7] = '0' + j; +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 9d38605717a0..303f69149439 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -446,10 +446,11 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, + unsigned long long ec = be64_to_cpu(ech->ec); + unmap_peb(ai, pnum); + dbg_bld("Adding PEB to free: %i", pnum); ++ + if (err == UBI_IO_FF_BITFLIPS) +- add_aeb(ai, free, pnum, ec, 1); +- else +- add_aeb(ai, free, pnum, ec, 0); ++ scrub = 1; ++ ++ add_aeb(ai, free, pnum, ec, scrub); + continue; + } else if (err == 0 || err == UBI_IO_BITFLIPS) { + dbg_bld("Found non empty PEB:%i in pool", pnum); +diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c +index 56022d647837..f0cab2d3532f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/cq.c ++++ b/drivers/net/ethernet/mellanox/mlx4/cq.c +@@ -56,13 +56,19 @@ void mlx4_cq_completion(struct mlx4_dev *dev, u32 cqn) + { + struct mlx4_cq *cq; + ++ rcu_read_lock(); + cq = radix_tree_lookup(&mlx4_priv(dev)->cq_table.tree, + cqn & (dev->caps.num_cqs - 1)); ++ rcu_read_unlock(); ++ + if (!cq) { + mlx4_dbg(dev, "Completion event for bogus CQ %08x\n", cqn); + return; + } + ++ /* Acessing the CQ outside of rcu_read_lock is safe, because ++ * the CQ is freed only after interrupt handling is completed. ++ */ + ++cq->arm_sn; + + cq->comp(cq); +@@ -73,23 +79,19 @@ void mlx4_cq_event(struct mlx4_dev *dev, u32 cqn, int event_type) + struct mlx4_cq_table *cq_table = &mlx4_priv(dev)->cq_table; + struct mlx4_cq *cq; + +- spin_lock(&cq_table->lock); +- ++ rcu_read_lock(); + cq = radix_tree_lookup(&cq_table->tree, cqn & (dev->caps.num_cqs - 1)); +- if (cq) +- atomic_inc(&cq->refcount); +- +- spin_unlock(&cq_table->lock); ++ rcu_read_unlock(); + + if (!cq) { +- mlx4_warn(dev, "Async event for bogus CQ %08x\n", cqn); ++ mlx4_dbg(dev, "Async event for bogus CQ %08x\n", cqn); + return; + } + ++ /* Acessing the CQ outside of rcu_read_lock is safe, because ++ * the CQ is freed only after interrupt handling is completed. ++ */ + cq->event(cq, event_type); +- +- if (atomic_dec_and_test(&cq->refcount)) +- complete(&cq->free); + } + + static int mlx4_SW2HW_CQ(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox, +@@ -256,9 +258,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, + if (err) + return err; + +- spin_lock_irq(&cq_table->lock); ++ spin_lock(&cq_table->lock); + err = radix_tree_insert(&cq_table->tree, cq->cqn, cq); +- spin_unlock_irq(&cq_table->lock); ++ spin_unlock(&cq_table->lock); + if (err) + goto err_icm; + +@@ -297,9 +299,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, + return 0; + + err_radix: +- spin_lock_irq(&cq_table->lock); ++ spin_lock(&cq_table->lock); + radix_tree_delete(&cq_table->tree, cq->cqn); +- spin_unlock_irq(&cq_table->lock); ++ spin_unlock(&cq_table->lock); + + err_icm: + mlx4_cq_free_icm(dev, cq->cqn); +@@ -314,16 +316,16 @@ void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq) + struct mlx4_cq_table *cq_table = &priv->cq_table; + int err; + ++ spin_lock(&cq_table->lock); ++ radix_tree_delete(&cq_table->tree, cq->cqn); ++ spin_unlock(&cq_table->lock); ++ + err = mlx4_HW2SW_CQ(dev, NULL, cq->cqn); + if (err) + mlx4_warn(dev, "HW2SW_CQ failed (%d) for CQN %06x\n", err, cq->cqn); + + synchronize_irq(priv->eq_table.eq[cq->vector].irq); + +- spin_lock_irq(&cq_table->lock); +- radix_tree_delete(&cq_table->tree, cq->cqn); +- spin_unlock_irq(&cq_table->lock); +- + if (atomic_dec_and_test(&cq->refcount)) + complete(&cq->free); + wait_for_completion(&cq->free); +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +index 5bbb59dce4d5..c175938d9717 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +@@ -438,8 +438,14 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv) + ring->cqn = priv->rx_cq[ring_ind]->mcq.cqn; + + ring->stride = stride; +- if (ring->stride <= TXBB_SIZE) ++ if (ring->stride <= TXBB_SIZE) { ++ /* Stamp first unused send wqe */ ++ __be32 *ptr = (__be32 *)ring->buf; ++ __be32 stamp = cpu_to_be32(1 << STAMP_SHIFT); ++ *ptr = stamp; ++ /* Move pointer to start of rx section */ + ring->buf += TXBB_SIZE; ++ } + + ring->log_stride = ffs(ring->stride) - 1; + ring->buf_size = ring->size * ring->stride; +@@ -501,8 +507,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv) + return; + + for (ring = 0; ring < priv->rx_ring_num; ring++) { +- if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) ++ if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) { ++ local_bh_disable(); + napi_reschedule(&priv->rx_cq[ring]->napi); ++ local_bh_enable(); ++ } + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index e57df91bad06..fbb0c02276f9 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -2769,6 +2769,9 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave, + put_res(dev, slave, srqn, RES_SRQ); + qp->srq = srq; + } ++ ++ /* Save param3 for dynamic changes from VST back to VGT */ ++ qp->param3 = qpc->param3; + put_res(dev, slave, rcqn, RES_CQ); + put_res(dev, slave, mtt_base, RES_MTT); + res_end_move(dev, slave, RES_QP, qpn); +@@ -3531,7 +3534,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave, + int qpn = vhcr->in_modifier & 0x7fffff; + struct res_qp *qp; + u8 orig_sched_queue; +- __be32 orig_param3 = qpc->param3; + u8 orig_vlan_control = qpc->pri_path.vlan_control; + u8 orig_fvl_rx = qpc->pri_path.fvl_rx; + u8 orig_pri_path_fl = qpc->pri_path.fl; +@@ -3572,7 +3574,6 @@ out: + */ + if (!err) { + qp->sched_queue = orig_sched_queue; +- qp->param3 = orig_param3; + qp->vlan_control = orig_vlan_control; + qp->fvl_rx = orig_fvl_rx; + qp->pri_path_fl = orig_pri_path_fl; +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 6cc3cf6f17c8..9a289e79e8a7 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -535,7 +535,7 @@ static inline void smc_rcv(struct net_device *dev) + #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags) + #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags) + #else +-#define smc_special_trylock(lock, flags) (flags == flags) ++#define smc_special_trylock(lock, flags) ((void)flags, true) + #define smc_special_lock(lock, flags) do { flags = 0; } while (0) + #define smc_special_unlock(lock, flags) do { flags = 0; } while (0) + #endif +diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c +index dd9430043536..cf5ce371ec21 100644 +--- a/drivers/net/ethernet/ti/cpmac.c ++++ b/drivers/net/ethernet/ti/cpmac.c +@@ -1235,7 +1235,7 @@ int cpmac_init(void) + goto fail_alloc; + } + +-#warning FIXME: unhardcode gpio&reset bits ++ /* FIXME: unhardcode gpio&reset bits */ + ar7_gpio_disable(26); + ar7_gpio_disable(27); + ar7_device_reset(AR7_RESET_BIT_CPMAC_LO); +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 59282dd2d9e0..2dc89582575a 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2260,7 +2260,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[]) + + if (data[IFLA_VXLAN_ID]) { + __u32 id = nla_get_u32(data[IFLA_VXLAN_ID]); +- if (id >= VXLAN_VID_MASK) ++ if (id >= VXLAN_N_VID) + return -ERANGE; + } + +diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c +index 966497d10c6e..f3c64b38f1d3 100644 +--- a/drivers/pwm/core.c ++++ b/drivers/pwm/core.c +@@ -293,6 +293,8 @@ int pwmchip_remove(struct pwm_chip *chip) + unsigned int i; + int ret = 0; + ++ pwmchip_sysfs_unexport_children(chip); ++ + mutex_lock(&pwm_lock); + + for (i = 0; i < chip->npwm; i++) { +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index 4bd0c639e16d..6c88e1adf637 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -340,6 +340,24 @@ void pwmchip_sysfs_unexport(struct pwm_chip *chip) + } + } + ++void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) ++{ ++ struct device *parent; ++ unsigned int i; ++ ++ parent = class_find_device(&pwm_class, NULL, chip, ++ pwmchip_sysfs_match); ++ if (!parent) ++ return; ++ ++ for (i = 0; i < chip->npwm; i++) { ++ struct pwm_device *pwm = &chip->pwms[i]; ++ ++ if (test_bit(PWMF_EXPORTED, &pwm->flags)) ++ pwm_unexport_child(parent, pwm); ++ } ++} ++ + static int __init pwm_sysfs_init(void) + { + return class_register(&pwm_class); +diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c +index 5d06253c2a7a..30e9fbbff051 100644 +--- a/drivers/s390/cio/qdio_thinint.c ++++ b/drivers/s390/cio/qdio_thinint.c +@@ -147,11 +147,11 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq) + struct qdio_q *q; + int i; + +- for_each_input_queue(irq, q, i) { +- if (!references_shared_dsci(irq) && +- has_multiple_inq_on_dsci(irq)) +- xchg(q->irq_ptr->dsci, 0); ++ if (!references_shared_dsci(irq) && ++ has_multiple_inq_on_dsci(irq)) ++ xchg(irq->dsci, 0); + ++ for_each_input_queue(irq, q, i) { + if (q->u.in.queue_start_poll) { + /* skip if polling is enabled or already in work */ + if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED, +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 89215d44d83f..f054d8dee013 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -737,8 +737,8 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + mv_dprintk("device %016llx not ready.\n", + SAS_ADDR(dev->sas_addr)); + +- rc = SAS_PHY_DOWN; +- return rc; ++ rc = SAS_PHY_DOWN; ++ return rc; + } + tei.port = dev->port->lldd_port; + if (tei.port && !tei.port->port_attached && !tmf) { +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index ad4f5790a76f..658d640022be 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -392,6 +392,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) + ret = PTR_ERR(vmfile); + goto out; + } ++ vmfile->f_mode |= FMODE_LSEEK; + asma->file = vmfile; + } + get_file(asma->file); +diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c +index c69c40d69d5c..2186380a6f51 100644 +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -998,7 +998,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal) + + + static struct binder_ref *binder_get_ref(struct binder_proc *proc, +- uint32_t desc) ++ u32 desc, bool need_strong_ref) + { + struct rb_node *n = proc->refs_by_desc.rb_node; + struct binder_ref *ref; +@@ -1006,12 +1006,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc, + while (n) { + ref = rb_entry(n, struct binder_ref, rb_node_desc); + +- if (desc < ref->desc) ++ if (desc < ref->desc) { + n = n->rb_left; +- else if (desc > ref->desc) ++ } else if (desc > ref->desc) { + n = n->rb_right; +- else ++ } else if (need_strong_ref && !ref->strong) { ++ binder_user_error("tried to use weak ref as strong ref\n"); ++ return NULL; ++ } else { + return ref; ++ } + } + return NULL; + } +@@ -1281,7 +1285,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, + } break; + case BINDER_TYPE_HANDLE: + case BINDER_TYPE_WEAK_HANDLE: { +- struct binder_ref *ref = binder_get_ref(proc, fp->handle); ++ struct binder_ref *ref; ++ ++ ref = binder_get_ref(proc, fp->handle, ++ fp->type == BINDER_TYPE_HANDLE); + + if (ref == NULL) { + pr_err("transaction release %d bad handle %d\n", +@@ -1375,7 +1382,7 @@ static void binder_transaction(struct binder_proc *proc, + if (tr->target.handle) { + struct binder_ref *ref; + +- ref = binder_get_ref(proc, tr->target.handle); ++ ref = binder_get_ref(proc, tr->target.handle, true); + if (ref == NULL) { + binder_user_error("%d:%d got transaction to invalid handle\n", + proc->pid, thread->pid); +@@ -1556,7 +1563,9 @@ static void binder_transaction(struct binder_proc *proc, + fp->type = BINDER_TYPE_HANDLE; + else + fp->type = BINDER_TYPE_WEAK_HANDLE; ++ fp->binder = 0; + fp->handle = ref->desc; ++ fp->cookie = 0; + binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, + &thread->todo); + +@@ -1568,7 +1577,10 @@ static void binder_transaction(struct binder_proc *proc, + } break; + case BINDER_TYPE_HANDLE: + case BINDER_TYPE_WEAK_HANDLE: { +- struct binder_ref *ref = binder_get_ref(proc, fp->handle); ++ struct binder_ref *ref; ++ ++ ref = binder_get_ref(proc, fp->handle, ++ fp->type == BINDER_TYPE_HANDLE); + + if (ref == NULL) { + binder_user_error("%d:%d got transaction with invalid handle, %d\n", +@@ -1598,7 +1610,9 @@ static void binder_transaction(struct binder_proc *proc, + return_error = BR_FAILED_REPLY; + goto err_binder_get_ref_for_node_failed; + } ++ fp->binder = 0; + fp->handle = new_ref->desc; ++ fp->cookie = 0; + binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); + trace_binder_transaction_ref_to_ref(t, ref, + new_ref); +@@ -1645,6 +1659,7 @@ static void binder_transaction(struct binder_proc *proc, + binder_debug(BINDER_DEBUG_TRANSACTION, + " fd %d -> %d\n", fp->handle, target_fd); + /* TODO: fput? */ ++ fp->binder = 0; + fp->handle = target_fd; + } break; + +@@ -1767,7 +1782,9 @@ static int binder_thread_write(struct binder_proc *proc, + ref->desc); + } + } else +- ref = binder_get_ref(proc, target); ++ ref = binder_get_ref(proc, target, ++ cmd == BC_ACQUIRE || ++ cmd == BC_RELEASE); + if (ref == NULL) { + binder_user_error("%d:%d refcount change on invalid ref %d\n", + proc->pid, thread->pid, target); +@@ -1963,7 +1980,7 @@ static int binder_thread_write(struct binder_proc *proc, + if (get_user(cookie, (binder_uintptr_t __user *)ptr)) + return -EFAULT; + ptr += sizeof(binder_uintptr_t); +- ref = binder_get_ref(proc, target); ++ ref = binder_get_ref(proc, target, false); + if (ref == NULL) { + binder_user_error("%d:%d %s invalid ref %d\n", + proc->pid, thread->pid, +diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c +index b6bd609c3655..3559e1d19c3a 100644 +--- a/drivers/staging/iio/impedance-analyzer/ad5933.c ++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c +@@ -647,6 +647,7 @@ static void ad5933_work(struct work_struct *work) + struct iio_dev *indio_dev = i2c_get_clientdata(st->client); + signed short buf[2]; + unsigned char status; ++ int ret; + + mutex_lock(&indio_dev->mlock); + if (st->state == AD5933_CTRL_INIT_START_FREQ) { +@@ -654,19 +655,22 @@ static void ad5933_work(struct work_struct *work) + ad5933_cmd(st, AD5933_CTRL_START_SWEEP); + st->state = AD5933_CTRL_START_SWEEP; + schedule_delayed_work(&st->work, st->poll_time_jiffies); +- mutex_unlock(&indio_dev->mlock); +- return; ++ goto out; + } + +- ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); ++ ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); ++ if (ret) ++ goto out; + + if (status & AD5933_STAT_DATA_VALID) { + int scan_count = bitmap_weight(indio_dev->active_scan_mask, + indio_dev->masklength); +- ad5933_i2c_read(st->client, ++ ret = ad5933_i2c_read(st->client, + test_bit(1, indio_dev->active_scan_mask) ? + AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA, + scan_count * 2, (u8 *)buf); ++ if (ret) ++ goto out; + + if (scan_count == 2) { + buf[0] = be16_to_cpu(buf[0]); +@@ -678,8 +682,7 @@ static void ad5933_work(struct work_struct *work) + } else { + /* no data available - try again later */ + schedule_delayed_work(&st->work, st->poll_time_jiffies); +- mutex_unlock(&indio_dev->mlock); +- return; ++ goto out; + } + + if (status & AD5933_STAT_SWEEP_DONE) { +@@ -691,7 +694,7 @@ static void ad5933_work(struct work_struct *work) + ad5933_cmd(st, AD5933_CTRL_INC_FREQ); + schedule_delayed_work(&st->work, st->poll_time_jiffies); + } +- ++out: + mutex_unlock(&indio_dev->mlock); + } + +diff --git a/drivers/staging/nvec/nvec_ps2.c b/drivers/staging/nvec/nvec_ps2.c +index f56f1db15bad..3f631c067f54 100644 +--- a/drivers/staging/nvec/nvec_ps2.c ++++ b/drivers/staging/nvec/nvec_ps2.c +@@ -106,13 +106,12 @@ static int nvec_mouse_probe(struct platform_device *pdev) + { + struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent); + struct serio *ser_dev; +- char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 }; + + ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL); + if (ser_dev == NULL) + return -ENOMEM; + +- ser_dev->id.type = SERIO_PS_PSTHRU; ++ ser_dev->id.type = SERIO_8042; + ser_dev->write = ps2_sendcommand; + ser_dev->start = ps2_startstreaming; + ser_dev->stop = ps2_stopstreaming; +@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platform_device *pdev) + + serio_register_port(ser_dev); + +- /* mouse reset */ +- nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset)); +- + return 0; + } + +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index 644ddb841d9f..6d1e2f746ab4 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -114,7 +114,7 @@ + #define DEFAULT_TX_BUF_COUNT 3 + + struct n_hdlc_buf { +- struct n_hdlc_buf *link; ++ struct list_head list_item; + int count; + char buf[1]; + }; +@@ -122,8 +122,7 @@ struct n_hdlc_buf { + #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe) + + struct n_hdlc_buf_list { +- struct n_hdlc_buf *head; +- struct n_hdlc_buf *tail; ++ struct list_head list; + int count; + spinlock_t spinlock; + }; +@@ -136,7 +135,6 @@ struct n_hdlc_buf_list { + * @backup_tty - TTY to use if tty gets closed + * @tbusy - reentrancy flag for tx wakeup code + * @woke_up - FIXME: describe this field +- * @tbuf - currently transmitting tx buffer + * @tx_buf_list - list of pending transmit frame buffers + * @rx_buf_list - list of received frame buffers + * @tx_free_buf_list - list unused transmit frame buffers +@@ -149,7 +147,6 @@ struct n_hdlc { + struct tty_struct *backup_tty; + int tbusy; + int woke_up; +- struct n_hdlc_buf *tbuf; + struct n_hdlc_buf_list tx_buf_list; + struct n_hdlc_buf_list rx_buf_list; + struct n_hdlc_buf_list tx_free_buf_list; +@@ -159,7 +156,8 @@ struct n_hdlc { + /* + * HDLC buffer list manipulation functions + */ +-static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list); ++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list, ++ struct n_hdlc_buf *buf); + static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, + struct n_hdlc_buf *buf); + static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list); +@@ -209,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty) + { + struct n_hdlc *n_hdlc = tty2n_hdlc(tty); + struct n_hdlc_buf *buf; +- unsigned long flags; + + while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list))) + n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf); +- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags); +- if (n_hdlc->tbuf) { +- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf); +- n_hdlc->tbuf = NULL; +- } +- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); + } + + static struct tty_ldisc_ops n_hdlc_ldisc = { +@@ -284,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc) + } else + break; + } +- kfree(n_hdlc->tbuf); + kfree(n_hdlc); + + } /* end of n_hdlc_release() */ +@@ -403,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + n_hdlc->woke_up = 0; + spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); + +- /* get current transmit buffer or get new transmit */ +- /* buffer from list of pending transmit buffers */ +- +- tbuf = n_hdlc->tbuf; +- if (!tbuf) +- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); +- ++ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); + while (tbuf) { + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)sending frame %p, count=%d\n", +@@ -421,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + + /* rollback was possible and has been done */ + if (actual == -ERESTARTSYS) { +- n_hdlc->tbuf = tbuf; ++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); + break; + } + /* if transmit error, throw frame away by */ +@@ -436,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + + /* free current transmit buffer */ + n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf); +- +- /* this tx buffer is done */ +- n_hdlc->tbuf = NULL; +- ++ + /* wait up sleeping writers */ + wake_up_interruptible(&tty->write_wait); + +@@ -449,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)frame %p pending\n", + __FILE__,__LINE__,tbuf); +- +- /* buffer not accepted by driver */ +- /* set this buffer as pending buffer */ +- n_hdlc->tbuf = tbuf; ++ ++ /* ++ * the buffer was not accepted by driver, ++ * return it back into tx queue ++ */ ++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); + break; + } + } +@@ -750,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + int error = 0; + int count; + unsigned long flags; +- ++ struct n_hdlc_buf *buf = NULL; ++ + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)n_hdlc_tty_ioctl() called %d\n", + __FILE__,__LINE__,cmd); +@@ -764,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + /* report count of read data available */ + /* in next available frame (if any) */ + spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags); +- if (n_hdlc->rx_buf_list.head) +- count = n_hdlc->rx_buf_list.head->count; ++ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list, ++ struct n_hdlc_buf, list_item); ++ if (buf) ++ count = buf->count; + else + count = 0; + spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags); +@@ -777,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + count = tty_chars_in_buffer(tty); + /* add size of next output frame in queue */ + spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags); +- if (n_hdlc->tx_buf_list.head) +- count += n_hdlc->tx_buf_list.head->count; ++ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list, ++ struct n_hdlc_buf, list_item); ++ if (buf) ++ count += buf->count; + spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags); + error = put_user(count, (int __user *)arg); + break; +@@ -826,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, + poll_wait(filp, &tty->write_wait, wait); + + /* set bits for operations that won't block */ +- if (n_hdlc->rx_buf_list.head) ++ if (!list_empty(&n_hdlc->rx_buf_list.list)) + mask |= POLLIN | POLLRDNORM; /* readable */ + if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) + mask |= POLLHUP; + if (tty_hung_up_p(filp)) + mask |= POLLHUP; + if (!tty_is_writelocked(tty) && +- n_hdlc->tx_free_buf_list.head) ++ !list_empty(&n_hdlc->tx_free_buf_list.list)) + mask |= POLLOUT | POLLWRNORM; /* writable */ + } + return mask; +@@ -853,11 +841,16 @@ static struct n_hdlc *n_hdlc_alloc(void) + if (!n_hdlc) + return NULL; + +- n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list); +- ++ spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->rx_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->tx_buf_list.spinlock); ++ ++ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list); ++ + /* allocate free rx buffer list */ + for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) { + buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL); +@@ -885,63 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void) + } /* end of n_hdlc_alloc() */ + + /** +- * n_hdlc_buf_list_init - initialize specified HDLC buffer list +- * @list - pointer to buffer list ++ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list ++ * @buf_list - pointer to the buffer list ++ * @buf - pointer to the buffer + */ +-static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list) ++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list, ++ struct n_hdlc_buf *buf) + { +- memset(list, 0, sizeof(*list)); +- spin_lock_init(&list->spinlock); +-} /* end of n_hdlc_buf_list_init() */ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ list_add(&buf->list_item, &buf_list->list); ++ buf_list->count++; ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); ++} + + /** + * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list +- * @list - pointer to buffer list ++ * @buf_list - pointer to buffer list + * @buf - pointer to buffer + */ +-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, ++static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list, + struct n_hdlc_buf *buf) + { + unsigned long flags; +- spin_lock_irqsave(&list->spinlock,flags); +- +- buf->link=NULL; +- if (list->tail) +- list->tail->link = buf; +- else +- list->head = buf; +- list->tail = buf; +- (list->count)++; +- +- spin_unlock_irqrestore(&list->spinlock,flags); +- ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ list_add_tail(&buf->list_item, &buf_list->list); ++ buf_list->count++; ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); + } /* end of n_hdlc_buf_put() */ + + /** + * n_hdlc_buf_get - remove and return an HDLC buffer from list +- * @list - pointer to HDLC buffer list ++ * @buf_list - pointer to HDLC buffer list + * + * Remove and return an HDLC buffer from the head of the specified HDLC buffer + * list. + * Returns a pointer to HDLC buffer if available, otherwise %NULL. + */ +-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list) ++static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list) + { + unsigned long flags; + struct n_hdlc_buf *buf; +- spin_lock_irqsave(&list->spinlock,flags); +- +- buf = list->head; ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ buf = list_first_entry_or_null(&buf_list->list, ++ struct n_hdlc_buf, list_item); + if (buf) { +- list->head = buf->link; +- (list->count)--; ++ list_del(&buf->list_item); ++ buf_list->count--; + } +- if (!list->head) +- list->tail = NULL; +- +- spin_unlock_irqrestore(&list->spinlock,flags); ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); + return buf; +- + } /* end of n_hdlc_buf_get() */ + + static char hdlc_banner[] __initdata = +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index f6e5ef5bac5e..786bc9e6bed9 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2743,6 +2743,8 @@ enum pci_board_num_t { + pbn_b0_4_1152000_200, + pbn_b0_8_1152000_200, + ++ pbn_b0_4_1250000, ++ + pbn_b0_2_1843200, + pbn_b0_4_1843200, + +@@ -2971,6 +2973,13 @@ static struct pciserial_board pci_boards[] = { + .uart_offset = 0x200, + }, + ++ [pbn_b0_4_1250000] = { ++ .flags = FL_BASE0, ++ .num_ports = 4, ++ .base_baud = 1250000, ++ .uart_offset = 8, ++ }, ++ + [pbn_b0_2_1843200] = { + .flags = FL_BASE0, + .num_ports = 2, +@@ -5464,6 +5473,10 @@ static struct pci_device_id serial_pci_tbl[] = { + { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 }, + { PCI_DEVICE(0x1c29, 0x1112), .driver_data = pbn_fintek_12 }, + ++ /* MKS Tenta SCOM-080x serial cards */ ++ { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 }, ++ { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 }, ++ + /* + * These entries match devices with class COMMUNICATION_SERIAL, + * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 1a049e4de937..a57f3761ab47 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1169,7 +1169,7 @@ static void csi_J(struct vc_data *vc, int vpar) + break; + case 3: /* erase scroll-back buffer (and whole display) */ + scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char, +- vc->vc_screenbuf_size >> 1); ++ vc->vc_screenbuf_size); + set_origin(vc); + if (CON_IS_VISIBLE(vc)) + update_screen(vc); +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 9bdc6bd73432..78f4d70db917 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -594,6 +594,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + return -ENOMEM; + } + ++ spin_lock_init(&ci->lock); + ci->dev = dev; + ci->platdata = dev_get_platdata(dev); + ci->imx28_write_fix = !!(ci->platdata->flags & +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 7b362870277e..98d5882aa91b 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1798,8 +1798,6 @@ static int udc_start(struct ci_hdrc *ci) + struct device *dev = ci->dev; + int retval = 0; + +- spin_lock_init(&ci->lock); +- + ci->gadget.ops = &usb_gadget_ops; + ci->gadget.speed = USB_SPEED_UNKNOWN; + ci->gadget.max_speed = USB_SPEED_HIGH; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index e2f63f5d30cb..201e9229d323 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -872,8 +872,6 @@ static int wait_serial_change(struct acm *acm, unsigned long arg) + DECLARE_WAITQUEUE(wait, current); + struct async_icount old, new; + +- if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD )) +- return -EINVAL; + do { + spin_lock_irq(&acm->read_lock); + old = acm->oldcount; +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 81336acc7040..65e2cec1ca2a 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -208,6 +208,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, + + /* + * Adjust bInterval for quirked devices. ++ */ ++ /* ++ * This quirk fixes bIntervals reported in ms. ++ */ ++ if (to_usb_device(ddev)->quirks & ++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) { ++ n = clamp(fls(d->bInterval) + 3, i, j); ++ i = j = n; ++ } ++ /* + * This quirk fixes bIntervals reported in + * linear microframes. + */ +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 096bb82c69c4..652e3e558257 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -498,8 +498,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb) + */ + tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength); + tbuf = kzalloc(tbuf_size, GFP_KERNEL); +- if (!tbuf) +- return -ENOMEM; ++ if (!tbuf) { ++ status = -ENOMEM; ++ goto err_alloc; ++ } + + bufp = tbuf; + +@@ -702,6 +704,7 @@ error: + } + + kfree(tbuf); ++ err_alloc: + + /* any errors get returned through the urb completion */ + spin_lock_irq(&hcd_root_hub_lock); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 1a3df0f8b891..a3c136b03810 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2616,8 +2616,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1, + if (ret < 0) + return ret; + +- /* The port state is unknown until the reset completes. */ +- if (!(portstatus & USB_PORT_STAT_RESET)) ++ /* ++ * The port state is unknown until the reset completes. ++ * ++ * On top of that, some chips may require additional time ++ * to re-establish a connection after the reset is complete, ++ * so also wait for the connection to be re-established. ++ */ ++ if (!(portstatus & USB_PORT_STAT_RESET) && ++ (portstatus & USB_PORT_STAT_CONNECTION)) + break; + + /* switch to the long delay after two short delay failures */ +@@ -4168,7 +4175,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev) + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN; + +- if (!udev->usb2_hw_lpm_capable) ++ if (!udev->usb2_hw_lpm_capable || !udev->bos) + return; + + if (hub) +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 6c7e47f67dd4..ab12e018de86 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -163,6 +163,14 @@ static const struct usb_device_id usb_quirk_list[] = { + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Baum Vario Ultra */ ++ { USB_DEVICE(0x0904, 0x6101), .driver_info = ++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, ++ { USB_DEVICE(0x0904, 0x6102), .driver_info = ++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, ++ { USB_DEVICE(0x0904, 0x6103), .driver_info = ++ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, ++ + /* Keytouch QWERTY Panel keyboard */ + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h +index 18ae3eaa8b6f..ccd9694f8e36 100644 +--- a/drivers/usb/dwc3/gadget.h ++++ b/drivers/usb/dwc3/gadget.h +@@ -28,23 +28,23 @@ struct dwc3; + #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget)) + + /* DEPCFG parameter 1 */ +-#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0) ++#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0) + #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8) + #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9) + #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10) + #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11) + #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13) +-#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16) ++#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) + #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24) +-#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25) ++#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) + #define DWC3_DEPCFG_BULK_BASED (1 << 30) + #define DWC3_DEPCFG_FIFO_BASED (1 << 31) + + /* DEPCFG parameter 0 */ +-#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1) +-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3) +-#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17) +-#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22) ++#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1) ++#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3) ++#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17) ++#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22) + #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26) + /* This applies for core versions earlier than 1.94a */ + #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index ab9b7ac63407..58888b8bd389 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1649,11 +1649,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) + spin_lock_irqsave(&func->ffs->eps_lock, flags); + do { + struct usb_endpoint_descriptor *ds; ++ struct usb_ss_ep_comp_descriptor *comp_desc = NULL; ++ int needs_comp_desc = false; + int desc_idx; + +- if (ffs->gadget->speed == USB_SPEED_SUPER) ++ if (ffs->gadget->speed == USB_SPEED_SUPER) { + desc_idx = 2; +- else if (ffs->gadget->speed == USB_SPEED_HIGH) ++ needs_comp_desc = true; ++ } else if (ffs->gadget->speed == USB_SPEED_HIGH) + desc_idx = 1; + else + desc_idx = 0; +@@ -1670,6 +1673,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) + + ep->ep->driver_data = ep; + ep->ep->desc = ds; ++ ++ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + ++ USB_DT_ENDPOINT_SIZE); ++ ep->ep->maxburst = comp_desc->bMaxBurst + 1; ++ ++ if (needs_comp_desc) ++ ep->ep->comp_desc = comp_desc; ++ + ret = usb_ep_enable(ep->ep); + if (likely(!ret)) { + epfile->ep = ep; +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index 945b3bd2ca98..f4a0b25d1810 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -643,7 +643,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) + uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst; + uvc_ss_streaming_comp.wBytesPerInterval = + cpu_to_le16(max_packet_size * max_packet_mult * +- opts->streaming_maxburst); ++ (opts->streaming_maxburst + 1)); + + /* Allocate endpoints. */ + ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep); +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index 2e7d27b4cf89..33011f8ee865 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -589,14 +589,6 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, + + req->length = length; + +- /* throttle high/super speed IRQ rate back slightly */ +- if (gadget_is_dualspeed(dev->gadget)) +- req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH || +- dev->gadget->speed == USB_SPEED_SUPER)) && +- !list_empty(&dev->tx_reqs)) +- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0) +- : 0; +- + retval = usb_ep_queue(in, req, GFP_ATOMIC); + switch (retval) { + default: +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 81dc5959e36b..53c747fed9d7 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -972,6 +972,8 @@ static int dummy_udc_probe(struct platform_device *pdev) + int rc; + + dum = *((void **)dev_get_platdata(&pdev->dev)); ++ /* Clear usb_gadget region for new registration to udc-core */ ++ memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); + dum->gadget.name = gadget_name; + dum->gadget.ops = &dummy_ops; + dum->gadget.max_speed = USB_SPEED_SUPER; +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 3dd487872bf1..8788799538eb 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -189,6 +189,8 @@ static int xhci_plat_remove(struct platform_device *dev) + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct clk *clk = xhci->clk; + ++ xhci->xhc_state |= XHCI_STATE_REMOVING; ++ + usb_remove_hcd(xhci->shared_hcd); + usb_put_hcd(xhci->shared_hcd); + +diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c +index 4e38683c653c..6d4e75785710 100644 +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -346,6 +346,9 @@ static int idmouse_probe(struct usb_interface *interface, + if (iface_desc->desc.bInterfaceClass != 0x0A) + return -ENODEV; + ++ if (iface_desc->desc.bNumEndpoints < 1) ++ return -ENODEV; ++ + /* allocate memory for our device state and initialize it */ + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + if (dev == NULL) +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index 1950e87b4219..775690bed4c0 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -787,12 +787,6 @@ static int iowarrior_probe(struct usb_interface *interface, + iface_desc = interface->cur_altsetting; + dev->product_id = le16_to_cpu(udev->descriptor.idProduct); + +- if (iface_desc->desc.bNumEndpoints < 1) { +- dev_err(&interface->dev, "Invalid number of endpoints\n"); +- retval = -EINVAL; +- goto error; +- } +- + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; +@@ -803,6 +797,21 @@ static int iowarrior_probe(struct usb_interface *interface, + /* this one will match for the IOWarrior56 only */ + dev->int_out_endpoint = endpoint; + } ++ ++ if (!dev->int_in_endpoint) { ++ dev_err(&interface->dev, "no interrupt-in endpoint found\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ ++ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) { ++ if (!dev->int_out_endpoint) { ++ dev_err(&interface->dev, "no interrupt-out endpoint found\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ } ++ + /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ + dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); + if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && +diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c +index 62cb8cd08403..66e2d036bb37 100644 +--- a/drivers/usb/misc/lvstest.c ++++ b/drivers/usb/misc/lvstest.c +@@ -370,6 +370,10 @@ static int lvs_rh_probe(struct usb_interface *intf, + + hdev = interface_to_usbdev(intf); + desc = intf->cur_altsetting; ++ ++ if (desc->desc.bNumEndpoints < 1) ++ return -ENODEV; ++ + endpoint = &desc->endpoint[0].desc; + + /* valid only for SS root hub */ +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 40ef40affe83..3cb05eb5f1df 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -715,6 +715,11 @@ static int uss720_probe(struct usb_interface *intf, + + interface = intf->cur_altsetting; + ++ if (interface->desc.bNumEndpoints < 3) { ++ usb_put_dev(usbdev); ++ return -ENODEV; ++ } ++ + /* + * Allocate parport interface + */ +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index 3df7b7ec178e..e0b1fe2f60e1 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -1483,16 +1483,20 @@ static int digi_read_oob_callback(struct urb *urb) + struct usb_serial *serial = port->serial; + struct tty_struct *tty; + struct digi_port *priv = usb_get_serial_port_data(port); ++ unsigned char *buf = urb->transfer_buffer; + int opcode, line, status, val; + int i; + unsigned int rts; + ++ if (urb->actual_length < 4) ++ return -1; ++ + /* handle each oob command */ +- for (i = 0; i < urb->actual_length - 3;) { +- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; +- line = ((unsigned char *)urb->transfer_buffer)[i++]; +- status = ((unsigned char *)urb->transfer_buffer)[i++]; +- val = ((unsigned char *)urb->transfer_buffer)[i++]; ++ for (i = 0; i < urb->actual_length - 3; i += 4) { ++ opcode = buf[i]; ++ line = buf[i + 1]; ++ status = buf[i + 2]; ++ val = buf[i + 3]; + + dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", + opcode, line, status, val); +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c +index ddbb8fe1046d..f6f6960218a7 100644 +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -1546,6 +1546,12 @@ static void edge_interrupt_callback(struct urb *urb) + function = TIUMP_GET_FUNC_FROM_CODE(data[0]); + dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__, + port_number, function, data[1]); ++ ++ if (port_number >= edge_serial->serial->num_ports) { ++ dev_err(dev, "bad port number %d\n", port_number); ++ goto exit; ++ } ++ + port = edge_serial->serial->port[port_number]; + edge_port = usb_get_serial_port_data(port); + if (!edge_port) { +@@ -1626,7 +1632,7 @@ static void edge_bulk_in_callback(struct urb *urb) + + port_number = edge_port->port->port_number; + +- if (edge_port->lsr_event) { ++ if (urb->actual_length > 0 && edge_port->lsr_event) { + edge_port->lsr_event = 0; + dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n", + __func__, port_number, edge_port->lsr_mask, *data); +diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c +index f6c6900bccf0..880bbdba19d2 100644 +--- a/drivers/usb/serial/omninet.c ++++ b/drivers/usb/serial/omninet.c +@@ -129,12 +129,6 @@ static int omninet_port_remove(struct usb_serial_port *port) + + static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port) + { +- struct usb_serial *serial = port->serial; +- struct usb_serial_port *wport; +- +- wport = serial->port[1]; +- tty_port_tty_set(&wport->port, tty); +- + return usb_serial_generic_open(tty, port); + } + +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 9dfbea6c1d2c..ae652223fabc 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -163,6 +163,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ ++ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ ++ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ + + /* Huawei devices */ + {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */ +diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c +index b2dff0f14743..236ea43f7815 100644 +--- a/drivers/usb/serial/safe_serial.c ++++ b/drivers/usb/serial/safe_serial.c +@@ -205,6 +205,11 @@ static void safe_process_read_urb(struct urb *urb) + if (!safe) + goto out; + ++ if (length < 2) { ++ dev_err(&port->dev, "malformed packet\n"); ++ return; ++ } ++ + fcs = fcs_compute10(data, length, CRC10_INITFCS); + if (fcs) { + dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs); +diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c +index 252c7bd9218a..d01496fd27fe 100644 +--- a/drivers/usb/wusbcore/wa-hc.c ++++ b/drivers/usb/wusbcore/wa-hc.c +@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface, + int result; + struct device *dev = &iface->dev; + ++ if (iface->cur_altsetting->desc.bNumEndpoints < 3) ++ return -ENODEV; ++ + result = wa_rpipes_create(wa); + if (result < 0) + goto error_rpipes_create; +diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c +index f89245b8ba8e..68a113594808 100644 +--- a/drivers/video/fbdev/core/fbcmap.c ++++ b/drivers/video/fbdev/core/fbcmap.c +@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap) + + int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) + { +- int tooff = 0, fromoff = 0; +- int size; ++ unsigned int tooff = 0, fromoff = 0; ++ size_t size; + + if (to->start > from->start) + fromoff = to->start - from->start; + else + tooff = from->start - to->start; +- size = to->len - tooff; +- if (size > (int) (from->len - fromoff)) +- size = from->len - fromoff; +- if (size <= 0) ++ if (fromoff >= from->len || tooff >= to->len) ++ return -EINVAL; ++ ++ size = min_t(size_t, to->len - tooff, from->len - fromoff); ++ if (size == 0) + return -EINVAL; + size *= sizeof(u16); + +@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) + + int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) + { +- int tooff = 0, fromoff = 0; +- int size; ++ unsigned int tooff = 0, fromoff = 0; ++ size_t size; + + if (to->start > from->start) + fromoff = to->start - from->start; + else + tooff = from->start - to->start; +- size = to->len - tooff; +- if (size > (int) (from->len - fromoff)) +- size = from->len - fromoff; +- if (size <= 0) ++ if (fromoff >= from->len || tooff >= to->len) ++ return -EINVAL; ++ ++ size = min_t(size_t, to->len - tooff, from->len - fromoff); ++ if (size == 0) + return -EINVAL; + size *= sizeof(u16); + +diff --git a/fs/coredump.c b/fs/coredump.c +index 7eb6181184ea..0ad7a30e3107 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -1,6 +1,7 @@ + #include <linux/slab.h> + #include <linux/file.h> + #include <linux/fdtable.h> ++#include <linux/freezer.h> + #include <linux/mm.h> + #include <linux/stat.h> + #include <linux/fcntl.h> +@@ -393,7 +394,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state) + if (core_waiters > 0) { + struct core_thread *ptr; + ++ freezer_do_not_count(); + wait_for_completion(&core_state->startup); ++ freezer_count(); + /* + * Wait for all the threads to become inactive, so that + * all the thread context (extended register state, like +diff --git a/fs/fat/inode.c b/fs/fat/inode.c +index 756aead10d96..75b5a159d607 100644 +--- a/fs/fat/inode.c ++++ b/fs/fat/inode.c +@@ -1266,6 +1266,16 @@ out: + return 0; + } + ++static void fat_dummy_inode_init(struct inode *inode) ++{ ++ /* Initialize this dummy inode to work as no-op. */ ++ MSDOS_I(inode)->mmu_private = 0; ++ MSDOS_I(inode)->i_start = 0; ++ MSDOS_I(inode)->i_logstart = 0; ++ MSDOS_I(inode)->i_attrs = 0; ++ MSDOS_I(inode)->i_pos = 0; ++} ++ + static int fat_read_root(struct inode *inode) + { + struct super_block *sb = inode->i_sb; +@@ -1711,12 +1721,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat, + fat_inode = new_inode(sb); + if (!fat_inode) + goto out_fail; +- MSDOS_I(fat_inode)->i_pos = 0; ++ fat_dummy_inode_init(fat_inode); + sbi->fat_inode = fat_inode; + + fsinfo_inode = new_inode(sb); + if (!fsinfo_inode) + goto out_fail; ++ fat_dummy_inode_init(fsinfo_inode); + fsinfo_inode->i_ino = MSDOS_FSINFO_INO; + sbi->fsinfo_inode = fsinfo_inode; + insert_inode_hash(fsinfo_inode); +diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c +index f5b2453a43b2..5dcd602b2996 100644 +--- a/fs/xfs/xfs_aops.c ++++ b/fs/xfs/xfs_aops.c +@@ -153,6 +153,12 @@ xfs_setfilesize( + rwsem_acquire_read(&VFS_I(ip)->i_sb->s_writers.lock_map[SB_FREEZE_FS-1], + 0, 1, _THIS_IP_); + ++ /* we abort the update if there was an IO error */ ++ if (ioend->io_error) { ++ xfs_trans_cancel(tp, 0); ++ return ioend->io_error; ++ } ++ + xfs_ilock(ip, XFS_ILOCK_EXCL); + isize = xfs_new_eof(ip, ioend->io_offset + ioend->io_size); + if (!isize) { +@@ -208,14 +214,17 @@ xfs_end_io( + ioend->io_error = -EIO; + goto done; + } +- if (ioend->io_error) +- goto done; + + /* + * For unwritten extents we need to issue transactions to convert a + * range to normal written extens after the data I/O has finished. ++ * Detecting and handling completion IO errors is done individually ++ * for each case as different cleanup operations need to be performed ++ * on error. + */ + if (ioend->io_type == XFS_IO_UNWRITTEN) { ++ if (ioend->io_error) ++ goto done; + error = xfs_iomap_write_unwritten(ip, ioend->io_offset, + ioend->io_size); + } else if (ioend->io_isdirect && xfs_ioend_is_append(ioend)) { +diff --git a/include/linux/can/core.h b/include/linux/can/core.h +index a0875001b13c..df08a41d5be5 100644 +--- a/include/linux/can/core.h ++++ b/include/linux/can/core.h +@@ -45,10 +45,9 @@ struct can_proto { + extern int can_proto_register(const struct can_proto *cp); + extern void can_proto_unregister(const struct can_proto *cp); + +-extern int can_rx_register(struct net_device *dev, canid_t can_id, +- canid_t mask, +- void (*func)(struct sk_buff *, void *), +- void *data, char *ident); ++int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, ++ void (*func)(struct sk_buff *, void *), ++ void *data, char *ident, struct sock *sk); + + extern void can_rx_unregister(struct net_device *dev, canid_t can_id, + canid_t mask, +diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h +index 561ea896c657..e5ea74c354a0 100644 +--- a/include/linux/ceph/osdmap.h ++++ b/include/linux/ceph/osdmap.h +@@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool) + case CEPH_POOL_TYPE_EC: + return false; + default: +- BUG_ON(1); ++ BUG(); + } + } + +diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h +index ff82a32871b5..439cde68dda9 100644 +--- a/include/linux/lockd/lockd.h ++++ b/include/linux/lockd/lockd.h +@@ -351,7 +351,8 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp) + static inline int nlm_compare_locks(const struct file_lock *fl1, + const struct file_lock *fl2) + { +- return fl1->fl_pid == fl2->fl_pid ++ return file_inode(fl1->fl_file) == file_inode(fl2->fl_file) ++ && fl1->fl_pid == fl2->fl_pid + && fl1->fl_owner == fl2->fl_owner + && fl1->fl_start == fl2->fl_start + && fl1->fl_end == fl2->fl_end +diff --git a/include/linux/mroute.h b/include/linux/mroute.h +index 79aaa9fc1a15..d5277fc3ce2e 100644 +--- a/include/linux/mroute.h ++++ b/include/linux/mroute.h +@@ -103,5 +103,5 @@ struct mfc_cache { + struct rtmsg; + extern int ipmr_get_route(struct net *net, struct sk_buff *skb, + __be32 saddr, __be32 daddr, +- struct rtmsg *rtm, int nowait); ++ struct rtmsg *rtm, int nowait, u32 portid); + #endif +diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h +index 66982e764051..f831155dc7d1 100644 +--- a/include/linux/mroute6.h ++++ b/include/linux/mroute6.h +@@ -115,7 +115,7 @@ struct mfc6_cache { + + struct rtmsg; + extern int ip6mr_get_route(struct net *net, struct sk_buff *skb, +- struct rtmsg *rtm, int nowait); ++ struct rtmsg *rtm, int nowait, u32 portid); + + #ifdef CONFIG_IPV6_MROUTE + extern struct sock *mroute6_socket(struct net *net, struct sk_buff *skb); +diff --git a/include/linux/pwm.h b/include/linux/pwm.h +index e90628cac8fa..84e526a12def 100644 +--- a/include/linux/pwm.h ++++ b/include/linux/pwm.h +@@ -299,6 +299,7 @@ static inline void pwm_add_table(struct pwm_lookup *table, size_t num) + #ifdef CONFIG_PWM_SYSFS + void pwmchip_sysfs_export(struct pwm_chip *chip); + void pwmchip_sysfs_unexport(struct pwm_chip *chip); ++void pwmchip_sysfs_unexport_children(struct pwm_chip *chip); + #else + static inline void pwmchip_sysfs_export(struct pwm_chip *chip) + { +@@ -307,6 +308,10 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip) + static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip) + { + } ++ ++static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) ++{ ++} + #endif /* CONFIG_PWM_SYSFS */ + + #endif /* __LINUX_PWM_H */ +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index 1d0043dc34e4..de2a722fe3cf 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -50,4 +50,10 @@ + /* device can't handle Link Power Management */ + #define USB_QUIRK_NO_LPM BIT(10) + ++/* ++ * Device reports its bInterval as linear frames instead of the ++ * USB 2.0 calculation. ++ */ ++#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h +index 3ebb168b9afc..a34b141f125f 100644 +--- a/include/net/cipso_ipv4.h ++++ b/include/net/cipso_ipv4.h +@@ -309,6 +309,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, + } + + for (opt_iter = 6; opt_iter < opt_len;) { ++ if (opt_iter + 1 == opt_len) { ++ err_offset = opt_iter; ++ goto out; ++ } + tag_len = opt[opt_iter + 1]; + if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { + err_offset = opt_iter + 1; +diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h +index 14e49c798135..b35533b94277 100644 +--- a/include/trace/events/syscalls.h ++++ b/include/trace/events/syscalls.h +@@ -1,5 +1,6 @@ + #undef TRACE_SYSTEM + #define TRACE_SYSTEM raw_syscalls ++#undef TRACE_INCLUDE_FILE + #define TRACE_INCLUDE_FILE syscalls + + #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ) +diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h +index 1a85940f8ab7..8a8135c4e99a 100644 +--- a/include/uapi/linux/netlink.h ++++ b/include/uapi/linux/netlink.h +@@ -106,8 +106,10 @@ struct nlmsgerr { + #define NETLINK_PKTINFO 3 + #define NETLINK_BROADCAST_ERROR 4 + #define NETLINK_NO_ENOBUFS 5 ++#ifndef __KERNEL__ + #define NETLINK_RX_RING 6 + #define NETLINK_TX_RING 7 ++#endif + + struct nl_pktinfo { + __u32 group; +@@ -130,6 +132,7 @@ struct nl_mmap_hdr { + __u32 nm_gid; + }; + ++#ifndef __KERNEL__ + enum nl_mmap_status { + NL_MMAP_STATUS_UNUSED, + NL_MMAP_STATUS_RESERVED, +@@ -141,6 +144,7 @@ enum nl_mmap_status { + #define NL_MMAP_MSG_ALIGNMENT NLMSG_ALIGNTO + #define NL_MMAP_MSG_ALIGN(sz) __ALIGN_KERNEL(sz, NL_MMAP_MSG_ALIGNMENT) + #define NL_MMAP_HDRLEN NL_MMAP_MSG_ALIGN(sizeof(struct nl_mmap_hdr)) ++#endif + + #define NET_MAJOR 36 /* Major 36 is reserved for networking */ + +diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h +index f2159d30d1f5..d79399394b46 100644 +--- a/include/uapi/linux/netlink_diag.h ++++ b/include/uapi/linux/netlink_diag.h +@@ -48,6 +48,8 @@ enum { + + #define NDIAG_SHOW_MEMINFO 0x00000001 /* show memory info of a socket */ + #define NDIAG_SHOW_GROUPS 0x00000002 /* show groups of a netlink socket */ ++#ifndef __KERNEL__ + #define NDIAG_SHOW_RING_CFG 0x00000004 /* show ring configuration */ ++#endif + + #endif +diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h +index d08c63f3dd6f..0c5d5dd61b6a 100644 +--- a/include/uapi/linux/packet_diag.h ++++ b/include/uapi/linux/packet_diag.h +@@ -64,7 +64,7 @@ struct packet_diag_mclist { + __u32 pdmc_count; + __u16 pdmc_type; + __u16 pdmc_alen; +- __u8 pdmc_addr[MAX_ADDR_LEN]; ++ __u8 pdmc_addr[32]; /* MAX_ADDR_LEN */ + }; + + struct packet_diag_ring { +diff --git a/kernel/futex.c b/kernel/futex.c +index 8874a7b431e4..54ebb63711f4 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2567,7 +2567,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + { + struct hrtimer_sleeper timeout, *to = NULL; + struct rt_mutex_waiter rt_waiter; +- struct rt_mutex *pi_mutex = NULL; + struct futex_hash_bucket *hb; + union futex_key key2 = FUTEX_KEY_INIT; + struct futex_q q = futex_q_init; +@@ -2651,6 +2650,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + if (q.pi_state && (q.pi_state->owner != current)) { + spin_lock(q.lock_ptr); + ret = fixup_pi_state_owner(uaddr2, &q, current); ++ if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) ++ rt_mutex_unlock(&q.pi_state->pi_mutex); + /* + * Drop the reference to the pi state which + * the requeue_pi() code acquired for us. +@@ -2659,6 +2660,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + spin_unlock(q.lock_ptr); + } + } else { ++ struct rt_mutex *pi_mutex; ++ + /* + * We have been woken up by futex_unlock_pi(), a timeout, or a + * signal. futex_unlock_pi() will not destroy the lock_ptr nor +@@ -2682,18 +2685,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + if (res) + ret = (res < 0) ? res : 0; + ++ /* ++ * If fixup_pi_state_owner() faulted and was unable to handle ++ * the fault, unlock the rt_mutex and return the fault to ++ * userspace. ++ */ ++ if (ret && rt_mutex_owner(pi_mutex) == current) ++ rt_mutex_unlock(pi_mutex); ++ + /* Unqueue and drop the lock. */ + unqueue_me_pi(&q); + } + +- /* +- * If fixup_pi_state_owner() faulted and was unable to handle the +- * fault, unlock the rt_mutex and return the fault to userspace. +- */ +- if (ret == -EFAULT) { +- if (pi_mutex && rt_mutex_owner(pi_mutex) == current) +- rt_mutex_unlock(pi_mutex); +- } else if (ret == -EINTR) { ++ if (ret == -EINTR) { + /* + * We've already been requeued, but cannot restart by calling + * futex_lock_pi() directly. We could restart this syscall, but +diff --git a/kernel/padata.c b/kernel/padata.c +index 161402f0b517..1e3f9772dbd4 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd) + + reorder = &next_queue->reorder; + ++ spin_lock(&reorder->lock); + if (!list_empty(&reorder->list)) { + padata = list_entry(reorder->list.next, + struct padata_priv, list); + +- spin_lock(&reorder->lock); + list_del_init(&padata->list); + atomic_dec(&pd->reorder_objects); +- spin_unlock(&reorder->lock); + + pd->processed++; + ++ spin_unlock(&reorder->lock); + goto out; + } ++ spin_unlock(&reorder->lock); + + if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) { + padata = ERR_PTR(-ENODATA); +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index ec337f64f52d..3146abf4efc3 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1728,7 +1728,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args) + + /* Reject out-of-range values early. Large positive sizes are + used for unknown buffer sizes. */ +- if (WARN_ON_ONCE((int) size < 0)) ++ if (WARN_ON_ONCE(size > INT_MAX)) + return 0; + + str = buf; +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 8798b2e0ac59..14ae9e3ec728 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2184,6 +2184,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p, + swab32s(&swap_header->info.version); + swab32s(&swap_header->info.last_page); + swab32s(&swap_header->info.nr_badpages); ++ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) ++ return 0; + for (i = 0; i < swap_header->info.nr_badpages; i++) + swab32s(&swap_header->info.badpages[i]); + } +diff --git a/net/can/af_can.c b/net/can/af_can.c +index d6030d6949df..ee6eee7a8b42 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -446,6 +446,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, + * @func: callback function on filter match + * @data: returned parameter for callback function + * @ident: string for calling module identification ++ * @sk: socket pointer (might be NULL) + * + * Description: + * Invokes the callback function with the received sk_buff and the given +@@ -469,7 +470,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, + */ + int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, + void (*func)(struct sk_buff *, void *), void *data, +- char *ident) ++ char *ident, struct sock *sk) + { + struct receiver *r; + struct hlist_head *rl; +@@ -497,6 +498,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, + r->func = func; + r->data = data; + r->ident = ident; ++ r->sk = sk; + + hlist_add_head_rcu(&r->list, rl); + d->entries++; +@@ -521,8 +523,11 @@ EXPORT_SYMBOL(can_rx_register); + static void can_rx_delete_receiver(struct rcu_head *rp) + { + struct receiver *r = container_of(rp, struct receiver, rcu); ++ struct sock *sk = r->sk; + + kmem_cache_free(rcv_cache, r); ++ if (sk) ++ sock_put(sk); + } + + /** +@@ -597,8 +602,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask, + spin_unlock(&can_rcvlists_lock); + + /* schedule the receiver item for deletion */ +- if (r) ++ if (r) { ++ if (r->sk) ++ sock_hold(r->sk); + call_rcu(&r->rcu, can_rx_delete_receiver); ++ } + } + EXPORT_SYMBOL(can_rx_unregister); + +diff --git a/net/can/af_can.h b/net/can/af_can.h +index fca0fe9fc45a..b86f5129e838 100644 +--- a/net/can/af_can.h ++++ b/net/can/af_can.h +@@ -50,13 +50,14 @@ + + struct receiver { + struct hlist_node list; +- struct rcu_head rcu; + canid_t can_id; + canid_t mask; + unsigned long matches; + void (*func)(struct sk_buff *, void *); + void *data; + char *ident; ++ struct sock *sk; ++ struct rcu_head rcu; + }; + + #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS) +diff --git a/net/can/bcm.c b/net/can/bcm.c +index dcb75c0e66c1..51c208f0d3d1 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -1169,7 +1169,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = can_rx_register(dev, op->can_id, + REGMASK(op->can_id), + bcm_rx_handler, op, +- "bcm"); ++ "bcm", sk); + + op->rx_reg_dev = dev; + dev_put(dev); +@@ -1178,7 +1178,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + } else + err = can_rx_register(NULL, op->can_id, + REGMASK(op->can_id), +- bcm_rx_handler, op, "bcm"); ++ bcm_rx_handler, op, "bcm", sk); + if (err) { + /* this bcm rx op is broken -> remove it */ + list_del(&op->list); +diff --git a/net/can/gw.c b/net/can/gw.c +index 050a2110d43f..d4921582d3bd 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -441,7 +441,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj) + { + return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id, + gwj->ccgw.filter.can_mask, can_can_gw_rcv, +- gwj, "gw"); ++ gwj, "gw", NULL); + } + + static inline void cgw_unregister_filter(struct cgw_job *gwj) +diff --git a/net/can/raw.c b/net/can/raw.c +index 081e81fd017f..bdca782df701 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -164,7 +164,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk, + for (i = 0; i < count; i++) { + err = can_rx_register(dev, filter[i].can_id, + filter[i].can_mask, +- raw_rcv, sk, "raw"); ++ raw_rcv, sk, "raw", sk); + if (err) { + /* clean up successfully registered filters */ + while (--i >= 0) +@@ -185,7 +185,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk, + + if (err_mask) + err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG, +- raw_rcv, sk, "raw"); ++ raw_rcv, sk, "raw", sk); + + return err; + } +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index 60441b6a9546..8bb2e0c1cb50 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -1240,7 +1240,6 @@ static int decode_new_up_state_weight(void **p, void *end, + if ((map->osd_state[osd] & CEPH_OSD_EXISTS) && + (xorstate & CEPH_OSD_EXISTS)) { + pr_info("osd%d does not exist\n", osd); +- map->osd_weight[osd] = CEPH_OSD_IN; + ret = set_primary_affinity(map, osd, + CEPH_OSD_DEFAULT_PRIMARY_AFFINITY); + if (ret) +diff --git a/net/core/dev.c b/net/core/dev.c +index 2a24197f3a45..86bdf6d813f6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1611,24 +1611,19 @@ EXPORT_SYMBOL(call_netdevice_notifiers); + + static struct static_key netstamp_needed __read_mostly; + #ifdef HAVE_JUMP_LABEL +-/* We are not allowed to call static_key_slow_dec() from irq context +- * If net_disable_timestamp() is called from irq context, defer the +- * static_key_slow_dec() calls. +- */ + static atomic_t netstamp_needed_deferred; +-#endif +- +-void net_enable_timestamp(void) ++static void netstamp_clear(struct work_struct *work) + { +-#ifdef HAVE_JUMP_LABEL + int deferred = atomic_xchg(&netstamp_needed_deferred, 0); + +- if (deferred) { +- while (--deferred) +- static_key_slow_dec(&netstamp_needed); +- return; +- } ++ while (deferred--) ++ static_key_slow_dec(&netstamp_needed); ++} ++static DECLARE_WORK(netstamp_work, netstamp_clear); + #endif ++ ++void net_enable_timestamp(void) ++{ + static_key_slow_inc(&netstamp_needed); + } + EXPORT_SYMBOL(net_enable_timestamp); +@@ -1636,12 +1631,12 @@ EXPORT_SYMBOL(net_enable_timestamp); + void net_disable_timestamp(void) + { + #ifdef HAVE_JUMP_LABEL +- if (in_interrupt()) { +- atomic_inc(&netstamp_needed_deferred); +- return; +- } +-#endif ++ /* net_disable_timestamp() can be called from non process context */ ++ atomic_inc(&netstamp_needed_deferred); ++ schedule_work(&netstamp_work); ++#else + static_key_slow_dec(&netstamp_needed); ++#endif + } + EXPORT_SYMBOL(net_disable_timestamp); + +@@ -2746,6 +2741,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d + } + return head; + } ++EXPORT_SYMBOL_GPL(validate_xmit_skb_list); + + static void qdisc_pkt_len_init(struct sk_buff *skb) + { +@@ -4898,6 +4894,7 @@ static inline bool netdev_adjacent_is_neigh_list(struct net_device *dev, + + static int __netdev_adjacent_dev_insert(struct net_device *dev, + struct net_device *adj_dev, ++ u16 ref_nr, + struct list_head *dev_list, + void *private, bool master) + { +@@ -4907,7 +4904,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, + adj = __netdev_find_adj(dev, adj_dev, dev_list); + + if (adj) { +- adj->ref_nr++; ++ adj->ref_nr += ref_nr; + return 0; + } + +@@ -4917,7 +4914,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev, + + adj->dev = adj_dev; + adj->master = master; +- adj->ref_nr = 1; ++ adj->ref_nr = ref_nr; + adj->private = private; + dev_hold(adj_dev); + +@@ -4956,6 +4953,7 @@ free_adj: + + static void __netdev_adjacent_dev_remove(struct net_device *dev, + struct net_device *adj_dev, ++ u16 ref_nr, + struct list_head *dev_list) + { + struct netdev_adjacent *adj; +@@ -4968,10 +4966,10 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, + BUG(); + } + +- if (adj->ref_nr > 1) { +- pr_debug("%s to %s ref_nr-- = %d\n", dev->name, adj_dev->name, +- adj->ref_nr-1); +- adj->ref_nr--; ++ if (adj->ref_nr > ref_nr) { ++ pr_debug("%s to %s ref_nr-%d = %d\n", dev->name, adj_dev->name, ++ ref_nr, adj->ref_nr-ref_nr); ++ adj->ref_nr -= ref_nr; + return; + } + +@@ -4990,21 +4988,22 @@ static void __netdev_adjacent_dev_remove(struct net_device *dev, + + static int __netdev_adjacent_dev_link_lists(struct net_device *dev, + struct net_device *upper_dev, ++ u16 ref_nr, + struct list_head *up_list, + struct list_head *down_list, + void *private, bool master) + { + int ret; + +- ret = __netdev_adjacent_dev_insert(dev, upper_dev, up_list, private, +- master); ++ ret = __netdev_adjacent_dev_insert(dev, upper_dev, ref_nr, up_list, ++ private, master); + if (ret) + return ret; + +- ret = __netdev_adjacent_dev_insert(upper_dev, dev, down_list, private, +- false); ++ ret = __netdev_adjacent_dev_insert(upper_dev, dev, ref_nr, down_list, ++ private, false); + if (ret) { +- __netdev_adjacent_dev_remove(dev, upper_dev, up_list); ++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list); + return ret; + } + +@@ -5012,9 +5011,10 @@ static int __netdev_adjacent_dev_link_lists(struct net_device *dev, + } + + static int __netdev_adjacent_dev_link(struct net_device *dev, +- struct net_device *upper_dev) ++ struct net_device *upper_dev, ++ u16 ref_nr) + { +- return __netdev_adjacent_dev_link_lists(dev, upper_dev, ++ return __netdev_adjacent_dev_link_lists(dev, upper_dev, ref_nr, + &dev->all_adj_list.upper, + &upper_dev->all_adj_list.lower, + NULL, false); +@@ -5022,17 +5022,19 @@ static int __netdev_adjacent_dev_link(struct net_device *dev, + + static void __netdev_adjacent_dev_unlink_lists(struct net_device *dev, + struct net_device *upper_dev, ++ u16 ref_nr, + struct list_head *up_list, + struct list_head *down_list) + { +- __netdev_adjacent_dev_remove(dev, upper_dev, up_list); +- __netdev_adjacent_dev_remove(upper_dev, dev, down_list); ++ __netdev_adjacent_dev_remove(dev, upper_dev, ref_nr, up_list); ++ __netdev_adjacent_dev_remove(upper_dev, dev, ref_nr, down_list); + } + + static void __netdev_adjacent_dev_unlink(struct net_device *dev, +- struct net_device *upper_dev) ++ struct net_device *upper_dev, ++ u16 ref_nr) + { +- __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ref_nr, + &dev->all_adj_list.upper, + &upper_dev->all_adj_list.lower); + } +@@ -5041,17 +5043,17 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev, + struct net_device *upper_dev, + void *private, bool master) + { +- int ret = __netdev_adjacent_dev_link(dev, upper_dev); ++ int ret = __netdev_adjacent_dev_link(dev, upper_dev, 1); + + if (ret) + return ret; + +- ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, ++ ret = __netdev_adjacent_dev_link_lists(dev, upper_dev, 1, + &dev->adj_list.upper, + &upper_dev->adj_list.lower, + private, master); + if (ret) { +- __netdev_adjacent_dev_unlink(dev, upper_dev); ++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1); + return ret; + } + +@@ -5061,8 +5063,8 @@ static int __netdev_adjacent_dev_link_neighbour(struct net_device *dev, + static void __netdev_adjacent_dev_unlink_neighbour(struct net_device *dev, + struct net_device *upper_dev) + { +- __netdev_adjacent_dev_unlink(dev, upper_dev); +- __netdev_adjacent_dev_unlink_lists(dev, upper_dev, ++ __netdev_adjacent_dev_unlink(dev, upper_dev, 1); ++ __netdev_adjacent_dev_unlink_lists(dev, upper_dev, 1, + &dev->adj_list.upper, + &upper_dev->adj_list.lower); + } +@@ -5103,7 +5105,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, + list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) { + pr_debug("Interlinking %s with %s, non-neighbour\n", + i->dev->name, j->dev->name); +- ret = __netdev_adjacent_dev_link(i->dev, j->dev); ++ ret = __netdev_adjacent_dev_link(i->dev, j->dev, i->ref_nr); + if (ret) + goto rollback_mesh; + } +@@ -5113,7 +5115,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, + list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) { + pr_debug("linking %s's upper device %s with %s\n", + upper_dev->name, i->dev->name, dev->name); +- ret = __netdev_adjacent_dev_link(dev, i->dev); ++ ret = __netdev_adjacent_dev_link(dev, i->dev, i->ref_nr); + if (ret) + goto rollback_upper_mesh; + } +@@ -5122,7 +5124,7 @@ static int __netdev_upper_dev_link(struct net_device *dev, + list_for_each_entry(i, &dev->all_adj_list.lower, list) { + pr_debug("linking %s's lower device %s with %s\n", dev->name, + i->dev->name, upper_dev->name); +- ret = __netdev_adjacent_dev_link(i->dev, upper_dev); ++ ret = __netdev_adjacent_dev_link(i->dev, upper_dev, i->ref_nr); + if (ret) + goto rollback_lower_mesh; + } +@@ -5135,7 +5137,7 @@ rollback_lower_mesh: + list_for_each_entry(i, &dev->all_adj_list.lower, list) { + if (i == to_i) + break; +- __netdev_adjacent_dev_unlink(i->dev, upper_dev); ++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr); + } + + i = NULL; +@@ -5145,7 +5147,7 @@ rollback_upper_mesh: + list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) { + if (i == to_i) + break; +- __netdev_adjacent_dev_unlink(dev, i->dev); ++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr); + } + + i = j = NULL; +@@ -5157,7 +5159,7 @@ rollback_mesh: + list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) { + if (i == to_i && j == to_j) + break; +- __netdev_adjacent_dev_unlink(i->dev, j->dev); ++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr); + } + if (i == to_i) + break; +@@ -5233,16 +5235,16 @@ void netdev_upper_dev_unlink(struct net_device *dev, + */ + list_for_each_entry(i, &dev->all_adj_list.lower, list) + list_for_each_entry(j, &upper_dev->all_adj_list.upper, list) +- __netdev_adjacent_dev_unlink(i->dev, j->dev); ++ __netdev_adjacent_dev_unlink(i->dev, j->dev, i->ref_nr); + + /* remove also the devices itself from lower/upper device + * list + */ + list_for_each_entry(i, &dev->all_adj_list.lower, list) +- __netdev_adjacent_dev_unlink(i->dev, upper_dev); ++ __netdev_adjacent_dev_unlink(i->dev, upper_dev, i->ref_nr); + + list_for_each_entry(i, &upper_dev->all_adj_list.upper, list) +- __netdev_adjacent_dev_unlink(dev, i->dev); ++ __netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr); + + call_netdevice_notifiers(NETDEV_CHANGEUPPER, dev); + } +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 4ff3eacc99f5..b3aa63260cab 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -211,8 +211,8 @@ + #define T_REMDEV (1<<3) /* Remove one dev */ + + /* If lock -- protects updating of if_list */ +-#define if_lock(t) spin_lock(&(t->if_lock)); +-#define if_unlock(t) spin_unlock(&(t->if_lock)); ++#define if_lock(t) mutex_lock(&(t->if_lock)); ++#define if_unlock(t) mutex_unlock(&(t->if_lock)); + + /* Used to help with determining the pkts on receive */ + #define PKTGEN_MAGIC 0xbe9be955 +@@ -418,7 +418,7 @@ struct pktgen_net { + }; + + struct pktgen_thread { +- spinlock_t if_lock; /* for list of devices */ ++ struct mutex if_lock; /* for list of devices */ + struct list_head if_list; /* All device here */ + struct list_head th_list; + struct task_struct *tsk; +@@ -1952,11 +1952,13 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d + { + struct pktgen_thread *t; + ++ mutex_lock(&pktgen_thread_lock); ++ + list_for_each_entry(t, &pn->pktgen_threads, th_list) { + struct pktgen_dev *pkt_dev; + +- rcu_read_lock(); +- list_for_each_entry_rcu(pkt_dev, &t->if_list, list) { ++ if_lock(t); ++ list_for_each_entry(pkt_dev, &t->if_list, list) { + if (pkt_dev->odev != dev) + continue; + +@@ -1971,8 +1973,9 @@ static void pktgen_change_name(const struct pktgen_net *pn, struct net_device *d + dev->name); + break; + } +- rcu_read_unlock(); ++ if_unlock(t); + } ++ mutex_unlock(&pktgen_thread_lock); + } + + static int pktgen_device_event(struct notifier_block *unused, +@@ -3656,7 +3659,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn) + return -ENOMEM; + } + +- spin_lock_init(&t->if_lock); ++ mutex_init(&t->if_lock); + t->cpu = cpu; + + INIT_LIST_HEAD(&t->if_list); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 97549212e9e3..b2e2a53c2284 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3617,13 +3617,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, + { + struct sock *sk = skb->sk; + +- /* take a reference to prevent skb_orphan() from freeing the socket */ +- sock_hold(sk); +- +- *skb_hwtstamps(skb) = *hwtstamps; +- __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); +- +- sock_put(sk); ++ /* Take a reference to prevent skb_orphan() from freeing the socket, ++ * but only if the socket refcount is not zero. ++ */ ++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { ++ *skb_hwtstamps(skb) = *hwtstamps; ++ __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); ++ sock_put(sk); ++ } + } + EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); + +@@ -3661,7 +3662,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) + { + struct sock *sk = skb->sk; + struct sock_exterr_skb *serr; +- int err; ++ int err = 1; + + skb->wifi_acked_valid = 1; + skb->wifi_acked = acked; +@@ -3671,14 +3672,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) + serr->ee.ee_errno = ENOMSG; + serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; + +- /* take a reference to prevent skb_orphan() from freeing the socket */ +- sock_hold(sk); +- +- err = sock_queue_err_skb(sk, skb); ++ /* Take a reference to prevent skb_orphan() from freeing the socket, ++ * but only if the socket refcount is not zero. ++ */ ++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { ++ err = sock_queue_err_skb(sk, skb); ++ sock_put(sk); ++ } + if (err) + kfree_skb(skb); +- +- sock_put(sk); + } + EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); + +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index f053198e730c..5e3a7302f774 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk) + for (i = 0; i < hc->tx_seqbufc; i++) + kfree(hc->tx_seqbuf[i]); + hc->tx_seqbufc = 0; ++ dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks); + } + + static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb) +diff --git a/net/dccp/input.c b/net/dccp/input.c +index 3c8ec7d4a34e..700440e4fa3b 100644 +--- a/net/dccp/input.c ++++ b/net/dccp/input.c +@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, + if (inet_csk(sk)->icsk_af_ops->conn_request(sk, + skb) < 0) + return 1; +- goto discard; ++ consume_skb(skb); ++ return 0; + } + if (dh->dccph_type == DCCP_PKT_RESET) + goto discard; +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index 6ca645c4b48e..502d9a885329 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -262,7 +262,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info) + + switch (type) { + case ICMP_REDIRECT: +- dccp_do_redirect(skb, sk); ++ if (!sock_owned_by_user(sk)) ++ dccp_do_redirect(skb, sk); + goto out; + case ICMP_SOURCE_QUENCH: + /* Just silently ignore these. */ +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 7bcb22317841..ff186dac3e07 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -131,10 +131,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + np = inet6_sk(sk); + + if (type == NDISC_REDIRECT) { +- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); ++ if (!sock_owned_by_user(sk)) { ++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); + +- if (dst) +- dst->ops->redirect(dst, sk, skb); ++ if (dst) ++ dst->ops->redirect(dst, sk, skb); ++ } + goto out; + } + +diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c +index b50dc436db1f..e6aaf92e0e1b 100644 +--- a/net/dccp/minisocks.c ++++ b/net/dccp/minisocks.c +@@ -135,6 +135,7 @@ struct sock *dccp_create_openreq_child(struct sock *sk, + /* It is still raw copy of parent, so invalidate + * destructor and make plain sk_free() */ + newsk->sk_destruct = NULL; ++ bh_unlock_sock(newsk); + sk_free(newsk); + return NULL; + } +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index bc7c9662a904..e08003d026eb 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1655,6 +1655,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) + goto validate_return_locked; + } + ++ if (opt_iter + 1 == opt_len) { ++ err_offset = opt_iter; ++ goto validate_return_locked; ++ } + tag_len = tag[1]; + if (tag_len > (opt_len - opt_iter)) { + err_offset = opt_iter + 1; +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 046fce012da5..8839b55ea4de 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -1066,7 +1066,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) + pktinfo->ipi_ifindex = 0; + pktinfo->ipi_spec_dst.s_addr = 0; + } +- skb_dst_drop(skb); ++ /* We need to keep the dst for __ip_options_echo() ++ * We could restrict the test to opt.ts_needtime || opt.srr, ++ * but the following is good enough as IP options are not often used. ++ */ ++ if (unlikely(IPCB(skb)->opt.optlen)) ++ skb_dst_force(skb); ++ else ++ skb_dst_drop(skb); + } + + int ip_setsockopt(struct sock *sk, int level, +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 1b7f6da99ef4..2348cc87b0bc 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -2188,7 +2188,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, + + int ipmr_get_route(struct net *net, struct sk_buff *skb, + __be32 saddr, __be32 daddr, +- struct rtmsg *rtm, int nowait) ++ struct rtmsg *rtm, int nowait, u32 portid) + { + struct mfc_cache *cache; + struct mr_table *mrt; +@@ -2233,6 +2233,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb, + return -ENOMEM; + } + ++ NETLINK_CB(skb2).portid = portid; + skb_push(skb2, sizeof(struct iphdr)); + skb_reset_network_header(skb2); + iph = ip_hdr(skb2); +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 64f4edb2dbf9..c225b227cc45 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -644,6 +644,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh, + { + struct sk_buff *skb = skb_peek(&sk->sk_write_queue); + ++ if (!skb) ++ return 0; + pfh->wcheck = csum_partial((char *)&pfh->icmph, + sizeof(struct icmphdr), pfh->wcheck); + pfh->icmph.checksum = csum_fold(pfh->wcheck); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 12c5df33c0b7..2fe9459fbe24 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1835,6 +1835,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr, + { + int res; + ++ tos &= IPTOS_RT_MASK; + rcu_read_lock(); + + /* Multicast recognition logic is moved from route cache to here. +@@ -2373,7 +2374,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, + IPV4_DEVCONF_ALL(net, MC_FORWARDING)) { + int err = ipmr_get_route(net, skb, + fl4->saddr, fl4->daddr, +- r, nowait); ++ r, nowait, portid); ++ + if (err <= 0) { + if (!nowait) { + if (err == 0) +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 633cd34f57ec..3d61bdbae920 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -103,10 +103,10 @@ static void set_ping_group_range(struct ctl_table *table, kgid_t low, kgid_t hig + kgid_t *data = table->data; + struct net *net = + container_of(table->data, struct net, ipv4.ping_group_range.range); +- write_seqlock(&net->ipv4.ip_local_ports.lock); ++ write_seqlock_bh(&net->ipv4.ip_local_ports.lock); + data[0] = low; + data[1] = high; +- write_sequnlock(&net->ipv4.ip_local_ports.lock); ++ write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); + } + + /* Validate changes from /proc interface. */ +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index a21c47289765..daf3b217b1e4 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -775,6 +775,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos, + ret = -EAGAIN; + break; + } ++ /* if __tcp_splice_read() got nothing while we have ++ * an skb in receive queue, we do not want to loop. ++ * This might happen with URG data. ++ */ ++ if (!skb_queue_empty(&sk->sk_receive_queue)) ++ break; + sk_wait_data(sk, &timeo); + if (signal_pending(current)) { + ret = sock_intr_errno(timeo); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 067baa738001..737186dbbd74 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2360,10 +2360,9 @@ static void DBGUNDO(struct sock *sk, const char *msg) + } + #if IS_ENABLED(CONFIG_IPV6) + else if (sk->sk_family == AF_INET6) { +- struct ipv6_pinfo *np = inet6_sk(sk); + pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n", + msg, +- &np->daddr, ntohs(inet->inet_dport), ++ &sk->sk_v6_daddr, ntohs(inet->inet_dport), + tp->snd_cwnd, tcp_left_out(tp), + tp->snd_ssthresh, tp->prior_ssthresh, + tp->packets_out); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 5d5390299277..d3d62be2376b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect); + */ + void tcp_v4_mtu_reduced(struct sock *sk) + { +- struct dst_entry *dst; + struct inet_sock *inet = inet_sk(sk); +- u32 mtu = tcp_sk(sk)->mtu_info; ++ struct dst_entry *dst; ++ u32 mtu; + ++ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) ++ return; ++ mtu = tcp_sk(sk)->mtu_info; + dst = inet_csk_update_pmtu(sk, mtu); + if (!dst) + return; +@@ -386,7 +389,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) + + switch (type) { + case ICMP_REDIRECT: +- do_redirect(icmp_skb, sk); ++ if (!sock_owned_by_user(sk)) ++ do_redirect(icmp_skb, sk); + goto out; + case ICMP_SOURCE_QUENCH: + /* Just silently ignore these. */ +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index af2f64eeb98f..a680177694ec 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1869,12 +1869,14 @@ static int tcp_mtu_probe(struct sock *sk) + len = 0; + tcp_for_write_queue_from_safe(skb, next, sk) { + copy = min_t(int, skb->len, probe_size - len); +- if (nskb->ip_summed) ++ if (nskb->ip_summed) { + skb_copy_bits(skb, 0, skb_put(nskb, copy), copy); +- else +- nskb->csum = skb_copy_and_csum_bits(skb, 0, +- skb_put(nskb, copy), +- copy, nskb->csum); ++ } else { ++ __wsum csum = skb_copy_and_csum_bits(skb, 0, ++ skb_put(nskb, copy), ++ copy, 0); ++ nskb->csum = csum_block_add(nskb->csum, csum, len); ++ } + + if (skb->len <= copy) { + /* We've eaten all the data from this skb. +@@ -2291,9 +2293,11 @@ u32 __tcp_select_window(struct sock *sk) + int full_space = min_t(int, tp->window_clamp, allowed_space); + int window; + +- if (mss > full_space) ++ if (unlikely(mss > full_space)) { + mss = full_space; +- ++ if (mss <= 0) ++ return 0; ++ } + if (free_space < (full_space >> 1)) { + icsk->icsk_ack.quick = 0; + +@@ -2479,7 +2483,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) + * copying overhead: fragmentation, tunneling, mangling etc. + */ + if (atomic_read(&sk->sk_wmem_alloc) > +- min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf)) ++ min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), ++ sk->sk_sndbuf)) + return -EAGAIN; + + if (skb_still_in_host_queue(sk, skb)) +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 9b21ae8b2e31..baec68553e90 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -207,7 +207,8 @@ void tcp_delack_timer_handler(struct sock *sk) + + sk_mem_reclaim_partial(sk); + +- if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) ++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || ++ !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) + goto out; + + if (time_after(icsk->icsk_ack.timeout, jiffies)) { +@@ -486,7 +487,8 @@ void tcp_write_timer_handler(struct sock *sk) + struct inet_connection_sock *icsk = inet_csk(sk); + int event; + +- if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending) ++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || ++ !icsk->icsk_pending) + goto out; + + if (time_after(icsk->icsk_timeout, jiffies)) { +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 953572c17b3d..4cc14452d5cc 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2695,7 +2695,7 @@ static void init_loopback(struct net_device *dev) + * lo device down, release this obsolete dst and + * reallocate a new router for ifa. + */ +- if (sp_ifa->rt->dst.obsolete > 0) { ++ if (!atomic_read(&sp_ifa->rt->rt6i_ref)) { + ip6_rt_put(sp_ifa->rt); + sp_ifa->rt = NULL; + } else { +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 1a93a39b2aab..df3633e20458 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -55,6 +55,7 @@ + #include <net/ip6_fib.h> + #include <net/ip6_route.h> + #include <net/ip6_tunnel.h> ++#include <net/gre.h> + + + static bool log_ecn_error = true; +@@ -367,35 +368,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) + + + static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, +- u8 type, u8 code, int offset, __be32 info) ++ u8 type, u8 code, int offset, __be32 info) + { +- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data; +- __be16 *p = (__be16 *)(skb->data + offset); +- int grehlen = offset + 4; ++ const struct gre_base_hdr *greh; ++ const struct ipv6hdr *ipv6h; ++ int grehlen = sizeof(*greh); + struct ip6_tnl *t; ++ int key_off = 0; + __be16 flags; ++ __be32 key; + +- flags = p[0]; +- if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) { +- if (flags&(GRE_VERSION|GRE_ROUTING)) +- return; +- if (flags&GRE_KEY) { +- grehlen += 4; +- if (flags&GRE_CSUM) +- grehlen += 4; +- } ++ if (!pskb_may_pull(skb, offset + grehlen)) ++ return; ++ greh = (const struct gre_base_hdr *)(skb->data + offset); ++ flags = greh->flags; ++ if (flags & (GRE_VERSION | GRE_ROUTING)) ++ return; ++ if (flags & GRE_CSUM) ++ grehlen += 4; ++ if (flags & GRE_KEY) { ++ key_off = grehlen + offset; ++ grehlen += 4; + } + +- /* If only 8 bytes returned, keyed message will be dropped here */ +- if (!pskb_may_pull(skb, grehlen)) ++ if (!pskb_may_pull(skb, offset + grehlen)) + return; + ipv6h = (const struct ipv6hdr *)skb->data; +- p = (__be16 *)(skb->data + offset); ++ greh = (const struct gre_base_hdr *)(skb->data + offset); ++ key = key_off ? *(__be32 *)(skb->data + key_off) : 0; + + t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr, +- flags & GRE_KEY ? +- *(((__be32 *)p) + (grehlen / 4) - 1) : 0, +- p[1]); ++ key, greh->protocol); + if (t == NULL) + return; + +@@ -889,7 +892,6 @@ static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev) + encap_limit = t->parms.encap_limit; + + memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6)); +- fl6.flowi6_proto = skb->protocol; + + err = ip6gre_xmit2(skb, dev, 0, &fl6, encap_limit, &mtu); + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 6987d3cb4163..8afea07e53a2 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -407,18 +407,19 @@ ip6_tnl_dev_uninit(struct net_device *dev) + + __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + { +- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw; +- __u8 nexthdr = ipv6h->nexthdr; +- __u16 off = sizeof(*ipv6h); ++ const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; ++ unsigned int nhoff = raw - skb->data; ++ unsigned int off = nhoff + sizeof(*ipv6h); ++ u8 next, nexthdr = ipv6h->nexthdr; + + while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { +- __u16 optlen = 0; + struct ipv6_opt_hdr *hdr; +- if (raw + off + sizeof(*hdr) > skb->data && +- !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr))) ++ u16 optlen; ++ ++ if (!pskb_may_pull(skb, off + sizeof(*hdr))) + break; + +- hdr = (struct ipv6_opt_hdr *) (raw + off); ++ hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { + struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; + if (frag_hdr->frag_off) +@@ -429,20 +430,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + } else { + optlen = ipv6_optlen(hdr); + } ++ /* cache hdr->nexthdr, since pskb_may_pull() might ++ * invalidate hdr ++ */ ++ next = hdr->nexthdr; + if (nexthdr == NEXTHDR_DEST) { +- __u16 i = off + 2; ++ u16 i = 2; ++ ++ /* Remember : hdr is no longer valid at this point. */ ++ if (!pskb_may_pull(skb, off + optlen)) ++ break; ++ + while (1) { + struct ipv6_tlv_tnl_enc_lim *tel; + + /* No more room for encapsulation limit */ +- if (i + sizeof (*tel) > off + optlen) ++ if (i + sizeof(*tel) > optlen) + break; + +- tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i]; ++ tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i); + /* return index of option if found and valid */ + if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT && + tel->length == 1) +- return i; ++ return i + off - nhoff; + /* else jump to next option */ + if (tel->type) + i += tel->length + 2; +@@ -450,7 +460,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + i++; + } + } +- nexthdr = hdr->nexthdr; ++ nexthdr = next; + off += optlen; + } + return 0; +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 1d67b37592d1..591e2355cc9e 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -645,6 +645,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p) + u->link = p->link; + u->i_key = p->i_key; + u->o_key = p->o_key; ++ if (u->i_key) ++ u->i_flags |= GRE_KEY; ++ if (u->o_key) ++ u->o_flags |= GRE_KEY; + u->proto = p->proto; + + memcpy(u->name, p->name, sizeof(u->name)); +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 4ca7cdd15aad..2b93262d5d5f 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -2276,8 +2276,8 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb, + return 1; + } + +-int ip6mr_get_route(struct net *net, +- struct sk_buff *skb, struct rtmsg *rtm, int nowait) ++int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm, ++ int nowait, u32 portid) + { + int err; + struct mr6_table *mrt; +@@ -2322,6 +2322,7 @@ int ip6mr_get_route(struct net *net, + return -ENOMEM; + } + ++ NETLINK_CB(skb2).portid = portid; + skb_reset_transport_header(skb2); + + skb_put(skb2, sizeof(struct ipv6hdr)); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 2d9aca57e7c7..8d3103459b2d 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2612,7 +2612,9 @@ static int rt6_fill_node(struct net *net, + if (iif) { + #ifdef CONFIG_IPV6_MROUTE + if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) { +- int err = ip6mr_get_route(net, skb, rtm, nowait); ++ int err = ip6mr_get_route(net, skb, rtm, nowait, ++ portid); ++ + if (err <= 0) { + if (!nowait) { + if (err == 0) +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 45eae1e609d6..eb36219f0a3c 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1388,6 +1388,7 @@ static int ipip6_tunnel_init(struct net_device *dev) + tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst); + if (!tunnel->dst_cache) { + free_percpu(dev->tstats); ++ dev->tstats = NULL; + return -ENOMEM; + } + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index b8e14a5ae0b1..0ade453839c4 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -389,10 +389,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + np = inet6_sk(sk); + + if (type == NDISC_REDIRECT) { +- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); ++ if (!sock_owned_by_user(sk)) { ++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); + +- if (dst) +- dst->ops->redirect(dst, sk, skb); ++ if (dst) ++ dst->ops->redirect(dst, sk, skb); ++ } + goto out; + } + +@@ -1049,6 +1051,16 @@ drop: + return 0; /* don't send reset */ + } + ++static void tcp_v6_restore_cb(struct sk_buff *skb) ++{ ++ /* We need to move header back to the beginning if xfrm6_policy_check() ++ * and tcp_v6_fill_cb() are going to be called again. ++ * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there. ++ */ ++ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, ++ sizeof(struct inet6_skb_parm)); ++} ++ + static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, + struct request_sock *req, + struct dst_entry *dst) +@@ -1180,8 +1192,10 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb, + sk_gfp_atomic(sk, GFP_ATOMIC)); + consume_skb(ireq->pktopts); + ireq->pktopts = NULL; +- if (newnp->pktoptions) ++ if (newnp->pktoptions) { ++ tcp_v6_restore_cb(newnp->pktoptions); + skb_set_owner_r(newnp->pktoptions, newsk); ++ } + } + newnp->opt = NULL; + newnp->mcast_oif = tcp_v6_iif(skb); +@@ -1381,6 +1395,7 @@ ipv6_pktoptions: + np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb)); + if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) { + skb_set_owner_r(opt_skb, sk); ++ tcp_v6_restore_cb(opt_skb); + opt_skb = xchg(&np->pktoptions, opt_skb); + } else { + __kfree_skb(opt_skb); +@@ -1414,15 +1429,6 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr, + TCP_SKB_CB(skb)->sacked = 0; + } + +-static void tcp_v6_restore_cb(struct sk_buff *skb) +-{ +- /* We need to move header back to the beginning if xfrm6_policy_check() +- * and tcp_v6_fill_cb() are going to be called again. +- */ +- memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, +- sizeof(struct inet6_skb_parm)); +-} +- + static int tcp_v6_rcv(struct sk_buff *skb) + { + const struct tcphdr *th; +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 68aa9ffd4ae4..e9ec7d2cc357 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -273,6 +273,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, + int l2tp_nl_register_ops(enum l2tp_pwtype pw_type, + const struct l2tp_nl_cmd_ops *ops); + void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type); ++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg); + + /* Session reference counts. Incremented when code obtains a reference + * to a session. +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index e45d2b77bb42..c2cd3dd7fa67 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -11,6 +11,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include <asm/ioctls.h> + #include <linux/icmp.h> + #include <linux/module.h> + #include <linux/skbuff.h> +@@ -381,7 +382,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb) + drop: + IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS); + kfree_skb(skb); +- return -1; ++ return 0; + } + + /* Userspace will call sendmsg() on the tunnel socket to send L2TP +@@ -554,6 +555,30 @@ out: + return err ? err : copied; + } + ++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg) ++{ ++ struct sk_buff *skb; ++ int amount; ++ ++ switch (cmd) { ++ case SIOCOUTQ: ++ amount = sk_wmem_alloc_get(sk); ++ break; ++ case SIOCINQ: ++ spin_lock_bh(&sk->sk_receive_queue.lock); ++ skb = skb_peek(&sk->sk_receive_queue); ++ amount = skb ? skb->len : 0; ++ spin_unlock_bh(&sk->sk_receive_queue.lock); ++ break; ++ ++ default: ++ return -ENOIOCTLCMD; ++ } ++ ++ return put_user(amount, (int __user *)arg); ++} ++EXPORT_SYMBOL(l2tp_ioctl); ++ + static struct proto l2tp_ip_prot = { + .name = "L2TP/IP", + .owner = THIS_MODULE, +@@ -562,7 +587,7 @@ static struct proto l2tp_ip_prot = { + .bind = l2tp_ip_bind, + .connect = l2tp_ip_connect, + .disconnect = l2tp_ip_disconnect, +- .ioctl = udp_ioctl, ++ .ioctl = l2tp_ioctl, + .destroy = l2tp_ip_destroy_sock, + .setsockopt = ip_setsockopt, + .getsockopt = ip_getsockopt, +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index b8e469b832df..f5d6fd834303 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -715,7 +715,7 @@ static struct proto l2tp_ip6_prot = { + .bind = l2tp_ip6_bind, + .connect = l2tp_ip6_connect, + .disconnect = l2tp_ip6_disconnect, +- .ioctl = udp_ioctl, ++ .ioctl = l2tp_ioctl, + .destroy = l2tp_ip6_destroy_sock, + .setsockopt = ipv6_setsockopt, + .getsockopt = ipv6_getsockopt, +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 42dc2e45c921..9c68d0bca046 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb) + * another trick required to cope with how the PROCOM state + * machine works. -acme + */ ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + } + if (!sock_owned_by_user(sk)) + llc_conn_rcv(sk, skb); +diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c +index 06033f6c845f..cdc1b620cbe1 100644 +--- a/net/llc/llc_sap.c ++++ b/net/llc/llc_sap.c +@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb, + + ev->type = LLC_SAP_EV_TYPE_PDU; + ev->reason = 0; ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + llc_sap_state_process(sap, skb); + } + +diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c +index 4a95fe3cffbc..3b98c1b4a719 100644 +--- a/net/mac80211/pm.c ++++ b/net/mac80211/pm.c +@@ -116,6 +116,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) + break; + } + ++ flush_delayed_work(&sdata->dec_tailroom_needed_wk); + drv_remove_interface(local, sdata); + } + +diff --git a/net/netlink/Kconfig b/net/netlink/Kconfig +index 2c5e95e9bfbd..5d6e8c05b3d4 100644 +--- a/net/netlink/Kconfig ++++ b/net/netlink/Kconfig +@@ -2,15 +2,6 @@ + # Netlink Sockets + # + +-config NETLINK_MMAP +- bool "NETLINK: mmaped IO" +- ---help--- +- This option enables support for memory mapped netlink IO. This +- reduces overhead by avoiding copying data between kernel- and +- userspace. +- +- If unsure, say N. +- + config NETLINK_DIAG + tristate "NETLINK: socket monitoring interface" + default n +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 15fc0938e1c4..4792e76b7d4a 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -234,7 +234,7 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb, + + dev_hold(dev); + +- if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head)) ++ if (is_vmalloc_addr(skb->head)) + nskb = netlink_to_full_skb(skb, GFP_ATOMIC); + else + nskb = skb_clone(skb, GFP_ATOMIC); +@@ -308,599 +308,8 @@ static void netlink_rcv_wake(struct sock *sk) + wake_up_interruptible(&nlk->wait); + } + +-#ifdef CONFIG_NETLINK_MMAP +-static bool netlink_rx_is_mmaped(struct sock *sk) +-{ +- return nlk_sk(sk)->rx_ring.pg_vec != NULL; +-} +- +-static bool netlink_tx_is_mmaped(struct sock *sk) +-{ +- return nlk_sk(sk)->tx_ring.pg_vec != NULL; +-} +- +-static __pure struct page *pgvec_to_page(const void *addr) +-{ +- if (is_vmalloc_addr(addr)) +- return vmalloc_to_page(addr); +- else +- return virt_to_page(addr); +-} +- +-static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len) +-{ +- unsigned int i; +- +- for (i = 0; i < len; i++) { +- if (pg_vec[i] != NULL) { +- if (is_vmalloc_addr(pg_vec[i])) +- vfree(pg_vec[i]); +- else +- free_pages((unsigned long)pg_vec[i], order); +- } +- } +- kfree(pg_vec); +-} +- +-static void *alloc_one_pg_vec_page(unsigned long order) +-{ +- void *buffer; +- gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO | +- __GFP_NOWARN | __GFP_NORETRY; +- +- buffer = (void *)__get_free_pages(gfp_flags, order); +- if (buffer != NULL) +- return buffer; +- +- buffer = vzalloc((1 << order) * PAGE_SIZE); +- if (buffer != NULL) +- return buffer; +- +- gfp_flags &= ~__GFP_NORETRY; +- return (void *)__get_free_pages(gfp_flags, order); +-} +- +-static void **alloc_pg_vec(struct netlink_sock *nlk, +- struct nl_mmap_req *req, unsigned int order) +-{ +- unsigned int block_nr = req->nm_block_nr; +- unsigned int i; +- void **pg_vec; +- +- pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL); +- if (pg_vec == NULL) +- return NULL; +- +- for (i = 0; i < block_nr; i++) { +- pg_vec[i] = alloc_one_pg_vec_page(order); +- if (pg_vec[i] == NULL) +- goto err1; +- } +- +- return pg_vec; +-err1: +- free_pg_vec(pg_vec, order, block_nr); +- return NULL; +-} +- +- +-static void +-__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec, +- unsigned int order) +-{ +- struct netlink_sock *nlk = nlk_sk(sk); +- struct sk_buff_head *queue; +- struct netlink_ring *ring; +- +- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; +- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; +- +- spin_lock_bh(&queue->lock); +- +- ring->frame_max = req->nm_frame_nr - 1; +- ring->head = 0; +- ring->frame_size = req->nm_frame_size; +- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; +- +- swap(ring->pg_vec_len, req->nm_block_nr); +- swap(ring->pg_vec_order, order); +- swap(ring->pg_vec, pg_vec); +- +- __skb_queue_purge(queue); +- spin_unlock_bh(&queue->lock); +- +- WARN_ON(atomic_read(&nlk->mapped)); +- +- if (pg_vec) +- free_pg_vec(pg_vec, order, req->nm_block_nr); +-} +- +-static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, +- bool tx_ring) +-{ +- struct netlink_sock *nlk = nlk_sk(sk); +- struct netlink_ring *ring; +- void **pg_vec = NULL; +- unsigned int order = 0; +- +- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; +- +- if (atomic_read(&nlk->mapped)) +- return -EBUSY; +- if (atomic_read(&ring->pending)) +- return -EBUSY; +- +- if (req->nm_block_nr) { +- if (ring->pg_vec != NULL) +- return -EBUSY; +- +- if ((int)req->nm_block_size <= 0) +- return -EINVAL; +- if (!PAGE_ALIGNED(req->nm_block_size)) +- return -EINVAL; +- if (req->nm_frame_size < NL_MMAP_HDRLEN) +- return -EINVAL; +- if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT)) +- return -EINVAL; +- +- ring->frames_per_block = req->nm_block_size / +- req->nm_frame_size; +- if (ring->frames_per_block == 0) +- return -EINVAL; +- if (ring->frames_per_block * req->nm_block_nr != +- req->nm_frame_nr) +- return -EINVAL; +- +- order = get_order(req->nm_block_size); +- pg_vec = alloc_pg_vec(nlk, req, order); +- if (pg_vec == NULL) +- return -ENOMEM; +- } else { +- if (req->nm_frame_nr) +- return -EINVAL; +- } +- +- mutex_lock(&nlk->pg_vec_lock); +- if (atomic_read(&nlk->mapped) == 0) { +- __netlink_set_ring(sk, req, tx_ring, pg_vec, order); +- mutex_unlock(&nlk->pg_vec_lock); +- return 0; +- } +- +- mutex_unlock(&nlk->pg_vec_lock); +- +- if (pg_vec) +- free_pg_vec(pg_vec, order, req->nm_block_nr); +- +- return -EBUSY; +-} +- +-static void netlink_mm_open(struct vm_area_struct *vma) +-{ +- struct file *file = vma->vm_file; +- struct socket *sock = file->private_data; +- struct sock *sk = sock->sk; +- +- if (sk) +- atomic_inc(&nlk_sk(sk)->mapped); +-} +- +-static void netlink_mm_close(struct vm_area_struct *vma) +-{ +- struct file *file = vma->vm_file; +- struct socket *sock = file->private_data; +- struct sock *sk = sock->sk; +- +- if (sk) +- atomic_dec(&nlk_sk(sk)->mapped); +-} +- +-static const struct vm_operations_struct netlink_mmap_ops = { +- .open = netlink_mm_open, +- .close = netlink_mm_close, +-}; +- +-static int netlink_mmap(struct file *file, struct socket *sock, +- struct vm_area_struct *vma) +-{ +- struct sock *sk = sock->sk; +- struct netlink_sock *nlk = nlk_sk(sk); +- struct netlink_ring *ring; +- unsigned long start, size, expected; +- unsigned int i; +- int err = -EINVAL; +- +- if (vma->vm_pgoff) +- return -EINVAL; +- +- mutex_lock(&nlk->pg_vec_lock); +- +- expected = 0; +- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { +- if (ring->pg_vec == NULL) +- continue; +- expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE; +- } +- +- if (expected == 0) +- goto out; +- +- size = vma->vm_end - vma->vm_start; +- if (size != expected) +- goto out; +- +- start = vma->vm_start; +- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { +- if (ring->pg_vec == NULL) +- continue; +- +- for (i = 0; i < ring->pg_vec_len; i++) { +- struct page *page; +- void *kaddr = ring->pg_vec[i]; +- unsigned int pg_num; +- +- for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) { +- page = pgvec_to_page(kaddr); +- err = vm_insert_page(vma, start, page); +- if (err < 0) +- goto out; +- start += PAGE_SIZE; +- kaddr += PAGE_SIZE; +- } +- } +- } +- +- atomic_inc(&nlk->mapped); +- vma->vm_ops = &netlink_mmap_ops; +- err = 0; +-out: +- mutex_unlock(&nlk->pg_vec_lock); +- return err; +-} +- +-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) +-{ +-#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 +- struct page *p_start, *p_end; +- +- /* First page is flushed through netlink_{get,set}_status */ +- p_start = pgvec_to_page(hdr + PAGE_SIZE); +- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); +- while (p_start <= p_end) { +- flush_dcache_page(p_start); +- p_start++; +- } +-#endif +-} +- +-static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) +-{ +- smp_rmb(); +- flush_dcache_page(pgvec_to_page(hdr)); +- return hdr->nm_status; +-} +- +-static void netlink_set_status(struct nl_mmap_hdr *hdr, +- enum nl_mmap_status status) +-{ +- smp_mb(); +- hdr->nm_status = status; +- flush_dcache_page(pgvec_to_page(hdr)); +-} +- +-static struct nl_mmap_hdr * +-__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos) +-{ +- unsigned int pg_vec_pos, frame_off; +- +- pg_vec_pos = pos / ring->frames_per_block; +- frame_off = pos % ring->frames_per_block; +- +- return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size); +-} +- +-static struct nl_mmap_hdr * +-netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos, +- enum nl_mmap_status status) +-{ +- struct nl_mmap_hdr *hdr; +- +- hdr = __netlink_lookup_frame(ring, pos); +- if (netlink_get_status(hdr) != status) +- return NULL; +- +- return hdr; +-} +- +-static struct nl_mmap_hdr * +-netlink_current_frame(const struct netlink_ring *ring, +- enum nl_mmap_status status) +-{ +- return netlink_lookup_frame(ring, ring->head, status); +-} +- +-static struct nl_mmap_hdr * +-netlink_previous_frame(const struct netlink_ring *ring, +- enum nl_mmap_status status) +-{ +- unsigned int prev; +- +- prev = ring->head ? ring->head - 1 : ring->frame_max; +- return netlink_lookup_frame(ring, prev, status); +-} +- +-static void netlink_increment_head(struct netlink_ring *ring) +-{ +- ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0; +-} +- +-static void netlink_forward_ring(struct netlink_ring *ring) +-{ +- unsigned int head = ring->head, pos = head; +- const struct nl_mmap_hdr *hdr; +- +- do { +- hdr = __netlink_lookup_frame(ring, pos); +- if (hdr->nm_status == NL_MMAP_STATUS_UNUSED) +- break; +- if (hdr->nm_status != NL_MMAP_STATUS_SKIP) +- break; +- netlink_increment_head(ring); +- } while (ring->head != head); +-} +- +-static bool netlink_dump_space(struct netlink_sock *nlk) +-{ +- struct netlink_ring *ring = &nlk->rx_ring; +- struct nl_mmap_hdr *hdr; +- unsigned int n; +- +- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); +- if (hdr == NULL) +- return false; +- +- n = ring->head + ring->frame_max / 2; +- if (n > ring->frame_max) +- n -= ring->frame_max; +- +- hdr = __netlink_lookup_frame(ring, n); +- +- return hdr->nm_status == NL_MMAP_STATUS_UNUSED; +-} +- +-static unsigned int netlink_poll(struct file *file, struct socket *sock, +- poll_table *wait) +-{ +- struct sock *sk = sock->sk; +- struct netlink_sock *nlk = nlk_sk(sk); +- unsigned int mask; +- int err; +- +- if (nlk->rx_ring.pg_vec != NULL) { +- /* Memory mapped sockets don't call recvmsg(), so flow control +- * for dumps is performed here. A dump is allowed to continue +- * if at least half the ring is unused. +- */ +- while (nlk->cb_running && netlink_dump_space(nlk)) { +- err = netlink_dump(sk); +- if (err < 0) { +- sk->sk_err = -err; +- sk->sk_error_report(sk); +- break; +- } +- } +- netlink_rcv_wake(sk); +- } +- +- mask = datagram_poll(file, sock, wait); +- +- spin_lock_bh(&sk->sk_receive_queue.lock); +- if (nlk->rx_ring.pg_vec) { +- netlink_forward_ring(&nlk->rx_ring); +- if (!netlink_previous_frame(&nlk->rx_ring, NL_MMAP_STATUS_UNUSED)) +- mask |= POLLIN | POLLRDNORM; +- } +- spin_unlock_bh(&sk->sk_receive_queue.lock); +- +- spin_lock_bh(&sk->sk_write_queue.lock); +- if (nlk->tx_ring.pg_vec) { +- if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED)) +- mask |= POLLOUT | POLLWRNORM; +- } +- spin_unlock_bh(&sk->sk_write_queue.lock); +- +- return mask; +-} +- +-static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb) +-{ +- return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN); +-} +- +-static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk, +- struct netlink_ring *ring, +- struct nl_mmap_hdr *hdr) +-{ +- unsigned int size; +- void *data; +- +- size = ring->frame_size - NL_MMAP_HDRLEN; +- data = (void *)hdr + NL_MMAP_HDRLEN; +- +- skb->head = data; +- skb->data = data; +- skb_reset_tail_pointer(skb); +- skb->end = skb->tail + size; +- skb->len = 0; +- +- skb->destructor = netlink_skb_destructor; +- NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED; +- NETLINK_CB(skb).sk = sk; +-} +- +-static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, +- u32 dst_portid, u32 dst_group, +- struct sock_iocb *siocb) +-{ +- struct netlink_sock *nlk = nlk_sk(sk); +- struct netlink_ring *ring; +- struct nl_mmap_hdr *hdr; +- struct sk_buff *skb; +- unsigned int maxlen; +- int err = 0, len = 0; +- +- mutex_lock(&nlk->pg_vec_lock); +- +- ring = &nlk->tx_ring; +- maxlen = ring->frame_size - NL_MMAP_HDRLEN; +- +- do { +- unsigned int nm_len; +- +- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); +- if (hdr == NULL) { +- if (!(msg->msg_flags & MSG_DONTWAIT) && +- atomic_read(&nlk->tx_ring.pending)) +- schedule(); +- continue; +- } +- +- nm_len = ACCESS_ONCE(hdr->nm_len); +- if (nm_len > maxlen) { +- err = -EINVAL; +- goto out; +- } +- +- netlink_frame_flush_dcache(hdr, nm_len); +- +- skb = alloc_skb(nm_len, GFP_KERNEL); +- if (skb == NULL) { +- err = -ENOBUFS; +- goto out; +- } +- __skb_put(skb, nm_len); +- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); +- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); +- +- netlink_increment_head(ring); +- +- NETLINK_CB(skb).portid = nlk->portid; +- NETLINK_CB(skb).dst_group = dst_group; +- NETLINK_CB(skb).creds = siocb->scm->creds; +- +- err = security_netlink_send(sk, skb); +- if (err) { +- kfree_skb(skb); +- goto out; +- } +- +- if (unlikely(dst_group)) { +- atomic_inc(&skb->users); +- netlink_broadcast(sk, skb, dst_portid, dst_group, +- GFP_KERNEL); +- } +- err = netlink_unicast(sk, skb, dst_portid, +- msg->msg_flags & MSG_DONTWAIT); +- if (err < 0) +- goto out; +- len += err; +- +- } while (hdr != NULL || +- (!(msg->msg_flags & MSG_DONTWAIT) && +- atomic_read(&nlk->tx_ring.pending))); +- +- if (len > 0) +- err = len; +-out: +- mutex_unlock(&nlk->pg_vec_lock); +- return err; +-} +- +-static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) +-{ +- struct nl_mmap_hdr *hdr; +- +- hdr = netlink_mmap_hdr(skb); +- hdr->nm_len = skb->len; +- hdr->nm_group = NETLINK_CB(skb).dst_group; +- hdr->nm_pid = NETLINK_CB(skb).creds.pid; +- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); +- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); +- netlink_frame_flush_dcache(hdr, hdr->nm_len); +- netlink_set_status(hdr, NL_MMAP_STATUS_VALID); +- +- NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; +- kfree_skb(skb); +-} +- +-static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb) +-{ +- struct netlink_sock *nlk = nlk_sk(sk); +- struct netlink_ring *ring = &nlk->rx_ring; +- struct nl_mmap_hdr *hdr; +- +- spin_lock_bh(&sk->sk_receive_queue.lock); +- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); +- if (hdr == NULL) { +- spin_unlock_bh(&sk->sk_receive_queue.lock); +- kfree_skb(skb); +- netlink_overrun(sk); +- return; +- } +- netlink_increment_head(ring); +- __skb_queue_tail(&sk->sk_receive_queue, skb); +- spin_unlock_bh(&sk->sk_receive_queue.lock); +- +- hdr->nm_len = skb->len; +- hdr->nm_group = NETLINK_CB(skb).dst_group; +- hdr->nm_pid = NETLINK_CB(skb).creds.pid; +- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); +- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); +- netlink_set_status(hdr, NL_MMAP_STATUS_COPY); +-} +- +-#else /* CONFIG_NETLINK_MMAP */ +-#define netlink_rx_is_mmaped(sk) false +-#define netlink_tx_is_mmaped(sk) false +-#define netlink_mmap sock_no_mmap +-#define netlink_poll datagram_poll +-#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, siocb) 0 +-#endif /* CONFIG_NETLINK_MMAP */ +- + static void netlink_skb_destructor(struct sk_buff *skb) + { +-#ifdef CONFIG_NETLINK_MMAP +- struct nl_mmap_hdr *hdr; +- struct netlink_ring *ring; +- struct sock *sk; +- +- /* If a packet from the kernel to userspace was freed because of an +- * error without being delivered to userspace, the kernel must reset +- * the status. In the direction userspace to kernel, the status is +- * always reset here after the packet was processed and freed. +- */ +- if (netlink_skb_is_mmaped(skb)) { +- hdr = netlink_mmap_hdr(skb); +- sk = NETLINK_CB(skb).sk; +- +- if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) { +- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); +- ring = &nlk_sk(sk)->tx_ring; +- } else { +- if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) { +- hdr->nm_len = 0; +- netlink_set_status(hdr, NL_MMAP_STATUS_VALID); +- } +- ring = &nlk_sk(sk)->rx_ring; +- } +- +- WARN_ON(atomic_read(&ring->pending) == 0); +- atomic_dec(&ring->pending); +- sock_put(sk); +- +- skb->head = NULL; +- } +-#endif + if (is_vmalloc_addr(skb->head)) { + if (!skb->cloned || + !atomic_dec_return(&(skb_shinfo(skb)->dataref))) +@@ -934,18 +343,6 @@ static void netlink_sock_destruct(struct sock *sk) + } + + skb_queue_purge(&sk->sk_receive_queue); +-#ifdef CONFIG_NETLINK_MMAP +- if (1) { +- struct nl_mmap_req req; +- +- memset(&req, 0, sizeof(req)); +- if (nlk->rx_ring.pg_vec) +- __netlink_set_ring(sk, &req, false, NULL, 0); +- memset(&req, 0, sizeof(req)); +- if (nlk->tx_ring.pg_vec) +- __netlink_set_ring(sk, &req, true, NULL, 0); +- } +-#endif /* CONFIG_NETLINK_MMAP */ + + if (!sock_flag(sk, SOCK_DEAD)) { + printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); +@@ -1153,9 +550,6 @@ static int __netlink_create(struct net *net, struct socket *sock, + mutex_init(nlk->cb_mutex); + } + init_waitqueue_head(&nlk->wait); +-#ifdef CONFIG_NETLINK_MMAP +- mutex_init(&nlk->pg_vec_lock); +-#endif + + sk->sk_destruct = netlink_sock_destruct; + sk->sk_protocol = protocol; +@@ -1653,9 +1047,8 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, + + nlk = nlk_sk(sk); + +- if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || +- test_bit(NETLINK_CONGESTED, &nlk->state)) && +- !netlink_skb_is_mmaped(skb)) { ++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || ++ test_bit(NETLINK_CONGESTED, &nlk->state)) { + DECLARE_WAITQUEUE(wait, current); + if (!*timeo) { + if (!ssk || netlink_is_kernel(ssk)) +@@ -1693,14 +1086,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) + + netlink_deliver_tap(skb); + +-#ifdef CONFIG_NETLINK_MMAP +- if (netlink_skb_is_mmaped(skb)) +- netlink_queue_mmaped_skb(sk, skb); +- else if (netlink_rx_is_mmaped(sk)) +- netlink_ring_set_copied(sk, skb); +- else +-#endif /* CONFIG_NETLINK_MMAP */ +- skb_queue_tail(&sk->sk_receive_queue, skb); ++ skb_queue_tail(&sk->sk_receive_queue, skb); + sk->sk_data_ready(sk); + return len; + } +@@ -1724,9 +1110,6 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) + int delta; + + WARN_ON(skb->sk != NULL); +- if (netlink_skb_is_mmaped(skb)) +- return skb; +- + delta = skb->end - skb->tail; + if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize) + return skb; +@@ -1805,66 +1188,6 @@ EXPORT_SYMBOL(netlink_unicast); + struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size, + u32 dst_portid, gfp_t gfp_mask) + { +-#ifdef CONFIG_NETLINK_MMAP +- struct sock *sk = NULL; +- struct sk_buff *skb; +- struct netlink_ring *ring; +- struct nl_mmap_hdr *hdr; +- unsigned int maxlen; +- +- sk = netlink_getsockbyportid(ssk, dst_portid); +- if (IS_ERR(sk)) +- goto out; +- +- ring = &nlk_sk(sk)->rx_ring; +- /* fast-path without atomic ops for common case: non-mmaped receiver */ +- if (ring->pg_vec == NULL) +- goto out_put; +- +- if (ring->frame_size - NL_MMAP_HDRLEN < size) +- goto out_put; +- +- skb = alloc_skb_head(gfp_mask); +- if (skb == NULL) +- goto err1; +- +- spin_lock_bh(&sk->sk_receive_queue.lock); +- /* check again under lock */ +- if (ring->pg_vec == NULL) +- goto out_free; +- +- /* check again under lock */ +- maxlen = ring->frame_size - NL_MMAP_HDRLEN; +- if (maxlen < size) +- goto out_free; +- +- netlink_forward_ring(ring); +- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); +- if (hdr == NULL) +- goto err2; +- netlink_ring_setup_skb(skb, sk, ring, hdr); +- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); +- atomic_inc(&ring->pending); +- netlink_increment_head(ring); +- +- spin_unlock_bh(&sk->sk_receive_queue.lock); +- return skb; +- +-err2: +- kfree_skb(skb); +- spin_unlock_bh(&sk->sk_receive_queue.lock); +- netlink_overrun(sk); +-err1: +- sock_put(sk); +- return NULL; +- +-out_free: +- kfree_skb(skb); +- spin_unlock_bh(&sk->sk_receive_queue.lock); +-out_put: +- sock_put(sk); +-out: +-#endif + return alloc_skb(size, gfp_mask); + } + EXPORT_SYMBOL_GPL(netlink_alloc_skb); +@@ -2126,8 +1449,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, + if (level != SOL_NETLINK) + return -ENOPROTOOPT; + +- if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING && +- optlen >= sizeof(int) && ++ if (optlen >= sizeof(int) && + get_user(val, (unsigned int __user *)optval)) + return -EFAULT; + +@@ -2180,25 +1502,6 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, + } + err = 0; + break; +-#ifdef CONFIG_NETLINK_MMAP +- case NETLINK_RX_RING: +- case NETLINK_TX_RING: { +- struct nl_mmap_req req; +- +- /* Rings might consume more memory than queue limits, require +- * CAP_NET_ADMIN. +- */ +- if (!capable(CAP_NET_ADMIN)) +- return -EPERM; +- if (optlen < sizeof(req)) +- return -EINVAL; +- if (copy_from_user(&req, optval, sizeof(req))) +- return -EFAULT; +- err = netlink_set_ring(sk, &req, +- optname == NETLINK_TX_RING); +- break; +- } +-#endif /* CONFIG_NETLINK_MMAP */ + default: + err = -ENOPROTOOPT; + } +@@ -2311,13 +1614,6 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + goto out; + } + +- if (netlink_tx_is_mmaped(sk) && +- msg->msg_iov->iov_base == NULL) { +- err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, +- siocb); +- goto out; +- } +- + err = -EMSGSIZE; + if (len > sk->sk_sndbuf - 32) + goto out; +@@ -2398,7 +1694,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, + /* Record the max length of recvmsg() calls for future allocations */ + nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); + nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, +- 16384); ++ SKB_WITH_OVERHEAD(32768)); + + copied = data_skb->len; + if (len < copied) { +@@ -2643,8 +1939,7 @@ static int netlink_dump(struct sock *sk) + cb = &nlk->cb; + alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); + +- if (!netlink_rx_is_mmaped(sk) && +- atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) ++ if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) + goto errout_skb; + + /* NLMSG_GOODSIZE is small to avoid high order allocations being +@@ -2656,9 +1951,8 @@ static int netlink_dump(struct sock *sk) + skb = netlink_alloc_skb(sk, + nlk->max_recvmsg_len, + nlk->portid, +- GFP_KERNEL | +- __GFP_NOWARN | +- __GFP_NORETRY); ++ (GFP_KERNEL & ~__GFP_WAIT) | ++ __GFP_NOWARN | __GFP_NORETRY); + /* available room should be exact amount to avoid MSG_TRUNC */ + if (skb) + skb_reserve(skb, skb_tailroom(skb) - +@@ -2666,7 +1960,7 @@ static int netlink_dump(struct sock *sk) + } + if (!skb) + skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, +- GFP_KERNEL); ++ (GFP_KERNEL & ~__GFP_WAIT)); + if (!skb) + goto errout_skb; + netlink_skb_set_owner_r(skb, sk); +@@ -2722,16 +2016,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, + struct netlink_sock *nlk; + int ret; + +- /* Memory mapped dump requests need to be copied to avoid looping +- * on the pending state in netlink_mmap_sendmsg() while the CB hold +- * a reference to the skb. +- */ +- if (netlink_skb_is_mmaped(skb)) { +- skb = skb_copy(skb, GFP_KERNEL); +- if (skb == NULL) +- return -ENOBUFS; +- } else +- atomic_inc(&skb->users); ++ atomic_inc(&skb->users); + + sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid); + if (sk == NULL) { +@@ -3072,7 +2357,7 @@ static const struct proto_ops netlink_ops = { + .socketpair = sock_no_socketpair, + .accept = sock_no_accept, + .getname = netlink_getname, +- .poll = netlink_poll, ++ .poll = datagram_poll, + .ioctl = sock_no_ioctl, + .listen = sock_no_listen, + .shutdown = sock_no_shutdown, +@@ -3080,7 +2365,7 @@ static const struct proto_ops netlink_ops = { + .getsockopt = netlink_getsockopt, + .sendmsg = netlink_sendmsg, + .recvmsg = netlink_recvmsg, +- .mmap = netlink_mmap, ++ .mmap = sock_no_mmap, + .sendpage = sock_no_sendpage, + }; + +diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h +index 3951874e715d..c6bd3dd35cb3 100644 +--- a/net/netlink/af_netlink.h ++++ b/net/netlink/af_netlink.h +@@ -42,12 +42,6 @@ struct netlink_sock { + int (*netlink_bind)(int group); + void (*netlink_unbind)(int group); + struct module *module; +-#ifdef CONFIG_NETLINK_MMAP +- struct mutex pg_vec_lock; +- struct netlink_ring rx_ring; +- struct netlink_ring tx_ring; +- atomic_t mapped; +-#endif /* CONFIG_NETLINK_MMAP */ + + struct rhash_head node; + }; +@@ -57,15 +51,6 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk) + return container_of(sk, struct netlink_sock, sk); + } + +-static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb) +-{ +-#ifdef CONFIG_NETLINK_MMAP +- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; +-#else +- return false; +-#endif /* CONFIG_NETLINK_MMAP */ +-} +- + struct netlink_table { + struct rhashtable hash; + struct hlist_head mc_list; +diff --git a/net/netlink/diag.c b/net/netlink/diag.c +index de8c74a3c061..dd5f2ffd13e6 100644 +--- a/net/netlink/diag.c ++++ b/net/netlink/diag.c +@@ -8,41 +8,6 @@ + + #include "af_netlink.h" + +-#ifdef CONFIG_NETLINK_MMAP +-static int sk_diag_put_ring(struct netlink_ring *ring, int nl_type, +- struct sk_buff *nlskb) +-{ +- struct netlink_diag_ring ndr; +- +- ndr.ndr_block_size = ring->pg_vec_pages << PAGE_SHIFT; +- ndr.ndr_block_nr = ring->pg_vec_len; +- ndr.ndr_frame_size = ring->frame_size; +- ndr.ndr_frame_nr = ring->frame_max + 1; +- +- return nla_put(nlskb, nl_type, sizeof(ndr), &ndr); +-} +- +-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb) +-{ +- struct netlink_sock *nlk = nlk_sk(sk); +- int ret; +- +- mutex_lock(&nlk->pg_vec_lock); +- ret = sk_diag_put_ring(&nlk->rx_ring, NETLINK_DIAG_RX_RING, nlskb); +- if (!ret) +- ret = sk_diag_put_ring(&nlk->tx_ring, NETLINK_DIAG_TX_RING, +- nlskb); +- mutex_unlock(&nlk->pg_vec_lock); +- +- return ret; +-} +-#else +-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb) +-{ +- return 0; +-} +-#endif +- + static int sk_diag_dump_groups(struct sock *sk, struct sk_buff *nlskb) + { + struct netlink_sock *nlk = nlk_sk(sk); +@@ -87,10 +52,6 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + sock_diag_put_meminfo(sk, skb, NETLINK_DIAG_MEMINFO)) + goto out_nlmsg_trim; + +- if ((req->ndiag_show & NDIAG_SHOW_RING_CFG) && +- sk_diag_put_rings_cfg(sk, skb)) +- goto out_nlmsg_trim; +- + return nlmsg_end(skb, nlh); + + out_nlmsg_trim: +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index abffc1519e4d..86b3e2f70a27 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -240,7 +240,7 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po); + static int packet_direct_xmit(struct sk_buff *skb) + { + struct net_device *dev = skb->dev; +- netdev_features_t features; ++ struct sk_buff *orig_skb = skb; + struct netdev_queue *txq; + int ret = NETDEV_TX_BUSY; + +@@ -248,9 +248,8 @@ static int packet_direct_xmit(struct sk_buff *skb) + !netif_carrier_ok(dev))) + goto drop; + +- features = netif_skb_features(skb); +- if (skb_needs_linearize(skb, features) && +- __skb_linearize(skb)) ++ skb = validate_xmit_skb_list(skb, dev); ++ if (skb != orig_skb) + goto drop; + + txq = skb_get_tx_queue(dev, skb); +@@ -270,7 +269,7 @@ static int packet_direct_xmit(struct sk_buff *skb) + return ret; + drop: + atomic_long_inc(&dev->tx_dropped); +- kfree_skb(skb); ++ kfree_skb_list(skb); + return NET_XMIT_DROP; + } + +@@ -2739,7 +2738,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + int addr_len) + { + struct sock *sk = sock->sk; +- char name[15]; ++ char name[sizeof(uaddr->sa_data) + 1]; + + /* + * Check legality +@@ -2747,7 +2746,11 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + + if (addr_len != sizeof(struct sockaddr)) + return -EINVAL; +- strlcpy(name, uaddr->sa_data, sizeof(name)); ++ /* uaddr->sa_data comes from the userspace, it's not guaranteed to be ++ * zero-terminated. ++ */ ++ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); ++ name[sizeof(uaddr->sa_data)] = 0; + + return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); + } +@@ -3552,6 +3555,7 @@ static int packet_notifier(struct notifier_block *this, + } + if (msg == NETDEV_UNREGISTER) { + packet_cached_dev_reset(po); ++ fanout_release(sk); + po->ifindex = -1; + if (po->prot_hook.dev) + dev_put(po->prot_hook.dev); +@@ -3804,8 +3808,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) + goto out; + if (po->tp_version >= TPACKET_V3 && +- (int)(req->tp_block_size - +- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) ++ req->tp_block_size <= ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) + goto out; + if (unlikely(req->tp_frame_size < po->tp_hdrlen + + po->tp_reserve)) +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index e6bb98e583fb..690a973b72b5 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -3426,6 +3426,12 @@ sctp_disposition_t sctp_sf_ootb(struct net *net, + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, + commands); + ++ /* Report violation if chunk len overflows */ ++ ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); ++ if (ch_end > skb_tail_pointer(skb)) ++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, ++ commands); ++ + /* Now that we know we at least have a chunk header, + * do things that are type appropriate. + */ +@@ -3457,12 +3463,6 @@ sctp_disposition_t sctp_sf_ootb(struct net *net, + } + } + +- /* Report violation if chunk len overflows */ +- ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); +- if (ch_end > skb_tail_pointer(skb)) +- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, +- commands); +- + ch = (sctp_chunkhdr_t *) ch_end; + } while (ch_end < skb_tail_pointer(skb)); + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 72da7d58ccca..1e557ee4cd65 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4385,7 +4385,7 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len, + static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval, + int __user *optlen) + { +- if (len <= 0) ++ if (len == 0) + return -EINVAL; + if (len > sizeof(struct sctp_event_subscribe)) + len = sizeof(struct sctp_event_subscribe); +@@ -5981,6 +5981,9 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname, + if (get_user(len, optlen)) + return -EFAULT; + ++ if (len < 0) ++ return -EINVAL; ++ + lock_sock(sk); + + switch (optname) { +@@ -6962,7 +6965,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + */ + release_sock(sk); + current_timeo = schedule_timeout(current_timeo); +- BUG_ON(sk != asoc->base.sk); ++ if (sk != asoc->base.sk) ++ goto do_error; + lock_sock(sk); + + *timeo_p = current_timeo; +diff --git a/net/socket.c b/net/socket.c +index 7f61789c78ff..e72371710fe3 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2355,8 +2355,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + return err; + + err = sock_error(sock->sk); +- if (err) ++ if (err) { ++ datagrams = err; + goto out_put; ++ } + + entry = mmsg; + compat_entry = (struct compat_mmsghdr __user *)mmsg; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 287087b10a7e..7950b4c26651 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -940,20 +940,32 @@ fail: + return NULL; + } + +-static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode, +- struct path *res) ++static int unix_mknod(const char *sun_path, umode_t mode, struct path *res) + { +- int err; ++ struct dentry *dentry; ++ struct path path; ++ int err = 0; ++ /* ++ * Get the parent directory, calculate the hash for last ++ * component. ++ */ ++ dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0); ++ err = PTR_ERR(dentry); ++ if (IS_ERR(dentry)) ++ return err; + +- err = security_path_mknod(path, dentry, mode, 0); ++ /* ++ * All right, let's create it. ++ */ ++ err = security_path_mknod(&path, dentry, mode, 0); + if (!err) { +- err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0); ++ err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0); + if (!err) { +- res->mnt = mntget(path->mnt); ++ res->mnt = mntget(path.mnt); + res->dentry = dget(dentry); + } + } +- ++ done_path_create(&path, dentry); + return err; + } + +@@ -964,12 +976,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + struct unix_sock *u = unix_sk(sk); + struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr; + char *sun_path = sunaddr->sun_path; +- int err, name_err; ++ int err; + unsigned int hash; + struct unix_address *addr; + struct hlist_head *list; +- struct path path; +- struct dentry *dentry; + + err = -EINVAL; + if (sunaddr->sun_family != AF_UNIX) +@@ -985,34 +995,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + addr_len = err; + +- name_err = 0; +- dentry = NULL; +- if (sun_path[0]) { +- /* Get the parent directory, calculate the hash for last +- * component. +- */ +- dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0); +- +- if (IS_ERR(dentry)) { +- /* delay report until after 'already bound' check */ +- name_err = PTR_ERR(dentry); +- dentry = NULL; +- } +- } +- + err = mutex_lock_interruptible(&u->readlock); + if (err) +- goto out_path; ++ goto out; + + err = -EINVAL; + if (u->addr) + goto out_up; + +- if (name_err) { +- err = name_err == -EEXIST ? -EADDRINUSE : name_err; +- goto out_up; +- } +- + err = -ENOMEM; + addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL); + if (!addr) +@@ -1023,11 +1013,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + addr->hash = hash ^ sk->sk_type; + atomic_set(&addr->refcnt, 1); + +- if (dentry) { +- struct path u_path; ++ if (sun_path[0]) { ++ struct path path; + umode_t mode = S_IFSOCK | + (SOCK_INODE(sock)->i_mode & ~current_umask()); +- err = unix_mknod(dentry, &path, mode, &u_path); ++ err = unix_mknod(sun_path, mode, &path); + if (err) { + if (err == -EEXIST) + err = -EADDRINUSE; +@@ -1035,9 +1025,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out_up; + } + addr->hash = UNIX_HASH_SIZE; +- hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1); ++ hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE-1); + spin_lock(&unix_table_lock); +- u->path = u_path; ++ u->path = path; + list = &unix_socket_table[hash]; + } else { + spin_lock(&unix_table_lock); +@@ -1060,10 +1050,6 @@ out_unlock: + spin_unlock(&unix_table_lock); + out_up: + mutex_unlock(&u->readlock); +-out_path: +- if (dentry) +- done_path_create(&path, dentry); +- + out: + return err; + } +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 4769382d9478..64faba06be38 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3004,6 +3004,11 @@ static int __net_init xfrm_net_init(struct net *net) + { + int rv; + ++ /* Initialize the per-net locks here */ ++ spin_lock_init(&net->xfrm.xfrm_state_lock); ++ rwlock_init(&net->xfrm.xfrm_policy_lock); ++ mutex_init(&net->xfrm.xfrm_cfg_mutex); ++ + rv = xfrm_statistics_init(net); + if (rv < 0) + goto out_statistics; +@@ -3020,11 +3025,6 @@ static int __net_init xfrm_net_init(struct net *net) + if (rv < 0) + goto out; + +- /* Initialize the per-net locks here */ +- spin_lock_init(&net->xfrm.xfrm_state_lock); +- rwlock_init(&net->xfrm.xfrm_policy_lock); +- mutex_init(&net->xfrm.xfrm_cfg_mutex); +- + return 0; + + out: +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index e812e988c111..b8170ae1461e 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -386,7 +386,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es + up = nla_data(rp); + ulen = xfrm_replay_state_esn_len(up); + +- if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) ++ /* Check the overall length and the internal bitmap length to avoid ++ * potential overflow. */ ++ if (nla_len(rp) < ulen || ++ xfrm_replay_state_esn_len(replay_esn) != ulen || ++ replay_esn->bmp_len != up->bmp_len) ++ return -EINVAL; ++ ++ if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) + return -EINVAL; + + return 0; +diff --git a/samples/mic/mpssd/.gitignore b/samples/mic/mpssd/.gitignore +new file mode 100644 +index 000000000000..8b7c72f07c92 +--- /dev/null ++++ b/samples/mic/mpssd/.gitignore +@@ -0,0 +1 @@ ++mpssd +diff --git a/samples/mic/mpssd/Makefile b/samples/mic/mpssd/Makefile +new file mode 100644 +index 000000000000..3e3ef91fed6b +--- /dev/null ++++ b/samples/mic/mpssd/Makefile +@@ -0,0 +1,27 @@ ++ifndef CROSS_COMPILE ++uname_M := $(shell uname -m 2>/dev/null || echo not) ++ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) ++ ++ifeq ($(ARCH),x86) ++ ++PROGS := mpssd ++CC = $(CROSS_COMPILE)gcc ++CFLAGS := -I../../../usr/include -I../../../tools/include ++ ++ifdef DEBUG ++CFLAGS += -DDEBUG=$(DEBUG) ++endif ++ ++all: $(PROGS) ++mpssd: mpssd.c sysfs.c ++ $(CC) $(CFLAGS) mpssd.c sysfs.c -o mpssd -lpthread ++ ++install: ++ install mpssd /usr/sbin/mpssd ++ install micctrl /usr/sbin/micctrl ++ ++clean: ++ rm -fr $(PROGS) ++ ++endif ++endif +diff --git a/samples/mic/mpssd/micctrl b/samples/mic/mpssd/micctrl +new file mode 100644 +index 000000000000..8f2629b41c5f +--- /dev/null ++++ b/samples/mic/mpssd/micctrl +@@ -0,0 +1,173 @@ ++#!/bin/bash ++# Intel MIC Platform Software Stack (MPSS) ++# ++# Copyright(c) 2013 Intel Corporation. ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License, version 2, as ++# published by the Free Software Foundation. ++# ++# This program is distributed in the hope that it will be useful, but ++# WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++# General Public License for more details. ++# ++# The full GNU General Public License is included in this distribution in ++# the file called "COPYING". ++# ++# Intel MIC User Space Tools. ++# ++# micctrl - Controls MIC boot/start/stop. ++# ++# chkconfig: 2345 95 05 ++# description: start MPSS stack processing. ++# ++### BEGIN INIT INFO ++# Provides: micctrl ++### END INIT INFO ++ ++# Source function library. ++. /etc/init.d/functions ++ ++sysfs="/sys/class/mic" ++ ++_status() ++{ ++ f=$sysfs/$1 ++ echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`" ++} ++ ++status() ++{ ++ if [ "`echo $1 | head -c3`" == "mic" ]; then ++ _status $1 ++ return $? ++ fi ++ for f in $sysfs/* ++ do ++ _status `basename $f` ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && return $RETVAL ++ done ++ return 0 ++} ++ ++_reset() ++{ ++ f=$sysfs/$1 ++ echo reset > $f/state ++} ++ ++reset() ++{ ++ if [ "`echo $1 | head -c3`" == "mic" ]; then ++ _reset $1 ++ return $? ++ fi ++ for f in $sysfs/* ++ do ++ _reset `basename $f` ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && return $RETVAL ++ done ++ return 0 ++} ++ ++_boot() ++{ ++ f=$sysfs/$1 ++ echo "linux" > $f/bootmode ++ echo "mic/uos.img" > $f/firmware ++ echo "mic/$1.image" > $f/ramdisk ++ echo "boot" > $f/state ++} ++ ++boot() ++{ ++ if [ "`echo $1 | head -c3`" == "mic" ]; then ++ _boot $1 ++ return $? ++ fi ++ for f in $sysfs/* ++ do ++ _boot `basename $f` ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && return $RETVAL ++ done ++ return 0 ++} ++ ++_shutdown() ++{ ++ f=$sysfs/$1 ++ echo shutdown > $f/state ++} ++ ++shutdown() ++{ ++ if [ "`echo $1 | head -c3`" == "mic" ]; then ++ _shutdown $1 ++ return $? ++ fi ++ for f in $sysfs/* ++ do ++ _shutdown `basename $f` ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && return $RETVAL ++ done ++ return 0 ++} ++ ++_wait() ++{ ++ f=$sysfs/$1 ++ while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ] ++ do ++ sleep 1 ++ echo -e "Waiting for $1 to go offline" ++ done ++} ++ ++wait() ++{ ++ if [ "`echo $1 | head -c3`" == "mic" ]; then ++ _wait $1 ++ return $? ++ fi ++ # Wait for the cards to go offline ++ for f in $sysfs/* ++ do ++ _wait `basename $f` ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && return $RETVAL ++ done ++ return 0 ++} ++ ++if [ ! -d "$sysfs" ]; then ++ echo -e $"Module unloaded " ++ exit 3 ++fi ++ ++case $1 in ++ -s) ++ status $2 ++ ;; ++ -r) ++ reset $2 ++ ;; ++ -b) ++ boot $2 ++ ;; ++ -S) ++ shutdown $2 ++ ;; ++ -w) ++ wait $2 ++ ;; ++ *) ++ echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}" ++ exit 2 ++esac ++ ++exit $? +diff --git a/samples/mic/mpssd/mpss b/samples/mic/mpssd/mpss +new file mode 100644 +index 000000000000..cacbdb0aefb9 +--- /dev/null ++++ b/samples/mic/mpssd/mpss +@@ -0,0 +1,202 @@ ++#!/bin/bash ++# Intel MIC Platform Software Stack (MPSS) ++# ++# Copyright(c) 2013 Intel Corporation. ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License, version 2, as ++# published by the Free Software Foundation. ++# ++# This program is distributed in the hope that it will be useful, but ++# WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++# General Public License for more details. ++# ++# The full GNU General Public License is included in this distribution in ++# the file called "COPYING". ++# ++# Intel MIC User Space Tools. ++# ++# mpss Start mpssd. ++# ++# chkconfig: 2345 95 05 ++# description: start MPSS stack processing. ++# ++### BEGIN INIT INFO ++# Provides: mpss ++# Required-Start: ++# Required-Stop: ++# Short-Description: MPSS stack control ++# Description: MPSS stack control ++### END INIT INFO ++ ++# Source function library. ++. /etc/init.d/functions ++ ++exec=/usr/sbin/mpssd ++sysfs="/sys/class/mic" ++ ++start() ++{ ++ [ -x $exec ] || exit 5 ++ ++ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then ++ echo -e $"MPSSD already running! " ++ success ++ echo ++ return 0 ++ fi ++ ++ echo -e $"Starting MPSS Stack" ++ echo -e $"Loading MIC_X100_DMA & MIC_HOST Modules" ++ ++ for f in "mic_host" "mic_x100_dma" ++ do ++ modprobe $f ++ RETVAL=$? ++ if [ $RETVAL -ne 0 ]; then ++ failure ++ echo ++ return $RETVAL ++ fi ++ done ++ ++ # Start the daemon ++ echo -n $"Starting MPSSD " ++ $exec ++ RETVAL=$? ++ if [ $RETVAL -ne 0 ]; then ++ failure ++ echo ++ return $RETVAL ++ fi ++ success ++ echo ++ ++ sleep 5 ++ ++ # Boot the cards ++ micctrl -b ++ ++ # Wait till ping works ++ for f in $sysfs/* ++ do ++ count=100 ++ ipaddr=`cat $f/cmdline` ++ ipaddr=${ipaddr#*address,} ++ ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1` ++ while [ $count -ge 0 ] ++ do ++ echo -e "Pinging "`basename $f`" " ++ ping -c 1 $ipaddr &> /dev/null ++ RETVAL=$? ++ if [ $RETVAL -eq 0 ]; then ++ success ++ break ++ fi ++ sleep 1 ++ count=`expr $count - 1` ++ done ++ [ $RETVAL -ne 0 ] && failure || success ++ echo ++ done ++ return $RETVAL ++} ++ ++stop() ++{ ++ echo -e $"Shutting down MPSS Stack: " ++ ++ # Bail out if module is unloaded ++ if [ ! -d "$sysfs" ]; then ++ echo -n $"Module unloaded " ++ success ++ echo ++ return 0 ++ fi ++ ++ # Shut down the cards. ++ micctrl -S ++ ++ # Wait for the cards to go offline ++ for f in $sysfs/* ++ do ++ while [ "`cat $f/state`" != "offline" ] ++ do ++ sleep 1 ++ echo -e "Waiting for "`basename $f`" to go offline" ++ done ++ done ++ ++ # Display the status of the cards ++ micctrl -s ++ ++ # Kill MPSSD now ++ echo -n $"Killing MPSSD" ++ killall -9 mpssd 2>/dev/null ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && failure || success ++ echo ++ return $RETVAL ++} ++ ++restart() ++{ ++ stop ++ sleep 5 ++ start ++} ++ ++status() ++{ ++ micctrl -s ++ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then ++ echo "mpssd is running" ++ else ++ echo "mpssd is stopped" ++ fi ++ return 0 ++} ++ ++unload() ++{ ++ if [ ! -d "$sysfs" ]; then ++ echo -n $"No MIC_HOST Module: " ++ success ++ echo ++ return ++ fi ++ ++ stop ++ ++ sleep 5 ++ echo -n $"Removing MIC_HOST & MIC_X100_DMA Modules: " ++ modprobe -r mic_host mic_x100_dma ++ RETVAL=$? ++ [ $RETVAL -ne 0 ] && failure || success ++ echo ++ return $RETVAL ++} ++ ++case $1 in ++ start) ++ start ++ ;; ++ stop) ++ stop ++ ;; ++ restart) ++ restart ++ ;; ++ status) ++ status ++ ;; ++ unload) ++ unload ++ ;; ++ *) ++ echo $"Usage: $0 {start|stop|restart|status|unload}" ++ exit 2 ++esac ++ ++exit $? +diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c +new file mode 100644 +index 000000000000..3c5c379fc29d +--- /dev/null ++++ b/samples/mic/mpssd/mpssd.c +@@ -0,0 +1,1728 @@ ++/* ++ * Intel MIC Platform Software Stack (MPSS) ++ * ++ * Copyright(c) 2013 Intel Corporation. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License, version 2, as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * General Public License for more details. ++ * ++ * The full GNU General Public License is included in this distribution in ++ * the file called "COPYING". ++ * ++ * Intel MIC User Space Tools. ++ */ ++ ++#define _GNU_SOURCE ++ ++#include <stdlib.h> ++#include <fcntl.h> ++#include <getopt.h> ++#include <assert.h> ++#include <unistd.h> ++#include <stdbool.h> ++#include <signal.h> ++#include <poll.h> ++#include <features.h> ++#include <sys/types.h> ++#include <sys/stat.h> ++#include <sys/mman.h> ++#include <sys/socket.h> ++#include <linux/virtio_ring.h> ++#include <linux/virtio_net.h> ++#include <linux/virtio_console.h> ++#include <linux/virtio_blk.h> ++#include <linux/version.h> ++#include "mpssd.h" ++#include <linux/mic_ioctl.h> ++#include <linux/mic_common.h> ++#include <tools/endian.h> ++ ++static void init_mic(struct mic_info *mic); ++ ++static FILE *logfp; ++static struct mic_info mic_list; ++ ++#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) ++ ++#define min_t(type, x, y) ({ \ ++ type __min1 = (x); \ ++ type __min2 = (y); \ ++ __min1 < __min2 ? __min1 : __min2; }) ++ ++/* align addr on a size boundary - adjust address up/down if needed */ ++#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1))) ++#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size) ++ ++/* align addr on a size boundary - adjust address up if needed */ ++#define _ALIGN(addr, size) _ALIGN_UP(addr, size) ++ ++/* to align the pointer to the (next) page boundary */ ++#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE) ++ ++#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x)) ++ ++#define GSO_ENABLED 1 ++#define MAX_GSO_SIZE (64 * 1024) ++#define ETH_H_LEN 14 ++#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64)) ++#define MIC_DEVICE_PAGE_END 0x1000 ++ ++#ifndef VIRTIO_NET_HDR_F_DATA_VALID ++#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */ ++#endif ++ ++static struct { ++ struct mic_device_desc dd; ++ struct mic_vqconfig vqconfig[2]; ++ __u32 host_features, guest_acknowledgements; ++ struct virtio_console_config cons_config; ++} virtcons_dev_page = { ++ .dd = { ++ .type = VIRTIO_ID_CONSOLE, ++ .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig), ++ .feature_len = sizeof(virtcons_dev_page.host_features), ++ .config_len = sizeof(virtcons_dev_page.cons_config), ++ }, ++ .vqconfig[0] = { ++ .num = htole16(MIC_VRING_ENTRIES), ++ }, ++ .vqconfig[1] = { ++ .num = htole16(MIC_VRING_ENTRIES), ++ }, ++}; ++ ++static struct { ++ struct mic_device_desc dd; ++ struct mic_vqconfig vqconfig[2]; ++ __u32 host_features, guest_acknowledgements; ++ struct virtio_net_config net_config; ++} virtnet_dev_page = { ++ .dd = { ++ .type = VIRTIO_ID_NET, ++ .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig), ++ .feature_len = sizeof(virtnet_dev_page.host_features), ++ .config_len = sizeof(virtnet_dev_page.net_config), ++ }, ++ .vqconfig[0] = { ++ .num = htole16(MIC_VRING_ENTRIES), ++ }, ++ .vqconfig[1] = { ++ .num = htole16(MIC_VRING_ENTRIES), ++ }, ++#if GSO_ENABLED ++ .host_features = htole32( ++ 1 << VIRTIO_NET_F_CSUM | ++ 1 << VIRTIO_NET_F_GSO | ++ 1 << VIRTIO_NET_F_GUEST_TSO4 | ++ 1 << VIRTIO_NET_F_GUEST_TSO6 | ++ 1 << VIRTIO_NET_F_GUEST_ECN | ++ 1 << VIRTIO_NET_F_GUEST_UFO), ++#else ++ .host_features = 0, ++#endif ++}; ++ ++static const char *mic_config_dir = "/etc/sysconfig/mic"; ++static const char *virtblk_backend = "VIRTBLK_BACKEND"; ++static struct { ++ struct mic_device_desc dd; ++ struct mic_vqconfig vqconfig[1]; ++ __u32 host_features, guest_acknowledgements; ++ struct virtio_blk_config blk_config; ++} virtblk_dev_page = { ++ .dd = { ++ .type = VIRTIO_ID_BLOCK, ++ .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig), ++ .feature_len = sizeof(virtblk_dev_page.host_features), ++ .config_len = sizeof(virtblk_dev_page.blk_config), ++ }, ++ .vqconfig[0] = { ++ .num = htole16(MIC_VRING_ENTRIES), ++ }, ++ .host_features = ++ htole32(1<<VIRTIO_BLK_F_SEG_MAX), ++ .blk_config = { ++ .seg_max = htole32(MIC_VRING_ENTRIES - 2), ++ .capacity = htole64(0), ++ } ++}; ++ ++static char *myname; ++ ++static int ++tap_configure(struct mic_info *mic, char *dev) ++{ ++ pid_t pid; ++ char *ifargv[7]; ++ char ipaddr[IFNAMSIZ]; ++ int ret = 0; ++ ++ pid = fork(); ++ if (pid == 0) { ++ ifargv[0] = "ip"; ++ ifargv[1] = "link"; ++ ifargv[2] = "set"; ++ ifargv[3] = dev; ++ ifargv[4] = "up"; ++ ifargv[5] = NULL; ++ mpsslog("Configuring %s\n", dev); ++ ret = execvp("ip", ifargv); ++ if (ret < 0) { ++ mpsslog("%s execvp failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ } ++ if (pid < 0) { ++ mpsslog("%s fork failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ ++ ret = waitpid(pid, NULL, 0); ++ if (ret < 0) { ++ mpsslog("%s waitpid failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ ++ snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id); ++ ++ pid = fork(); ++ if (pid == 0) { ++ ifargv[0] = "ip"; ++ ifargv[1] = "addr"; ++ ifargv[2] = "add"; ++ ifargv[3] = ipaddr; ++ ifargv[4] = "dev"; ++ ifargv[5] = dev; ++ ifargv[6] = NULL; ++ mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr); ++ ret = execvp("ip", ifargv); ++ if (ret < 0) { ++ mpsslog("%s execvp failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ } ++ if (pid < 0) { ++ mpsslog("%s fork failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ ++ ret = waitpid(pid, NULL, 0); ++ if (ret < 0) { ++ mpsslog("%s waitpid failed errno %s\n", ++ mic->name, strerror(errno)); ++ return ret; ++ } ++ mpsslog("MIC name %s %s %d DONE!\n", ++ mic->name, __func__, __LINE__); ++ return 0; ++} ++ ++static int tun_alloc(struct mic_info *mic, char *dev) ++{ ++ struct ifreq ifr; ++ int fd, err; ++#if GSO_ENABLED ++ unsigned offload; ++#endif ++ fd = open("/dev/net/tun", O_RDWR); ++ if (fd < 0) { ++ mpsslog("Could not open /dev/net/tun %s\n", strerror(errno)); ++ goto done; ++ } ++ ++ memset(&ifr, 0, sizeof(ifr)); ++ ++ ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR; ++ if (*dev) ++ strncpy(ifr.ifr_name, dev, IFNAMSIZ); ++ ++ err = ioctl(fd, TUNSETIFF, (void *)&ifr); ++ if (err < 0) { ++ mpsslog("%s %s %d TUNSETIFF failed %s\n", ++ mic->name, __func__, __LINE__, strerror(errno)); ++ close(fd); ++ return err; ++ } ++#if GSO_ENABLED ++ offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | ++ TUN_F_TSO_ECN | TUN_F_UFO; ++ ++ err = ioctl(fd, TUNSETOFFLOAD, offload); ++ if (err < 0) { ++ mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n", ++ mic->name, __func__, __LINE__, strerror(errno)); ++ close(fd); ++ return err; ++ } ++#endif ++ strcpy(dev, ifr.ifr_name); ++ mpsslog("Created TAP %s\n", dev); ++done: ++ return fd; ++} ++ ++#define NET_FD_VIRTIO_NET 0 ++#define NET_FD_TUN 1 ++#define MAX_NET_FD 2 ++ ++static void set_dp(struct mic_info *mic, int type, void *dp) ++{ ++ switch (type) { ++ case VIRTIO_ID_CONSOLE: ++ mic->mic_console.console_dp = dp; ++ return; ++ case VIRTIO_ID_NET: ++ mic->mic_net.net_dp = dp; ++ return; ++ case VIRTIO_ID_BLOCK: ++ mic->mic_virtblk.block_dp = dp; ++ return; ++ } ++ mpsslog("%s %s %d not found\n", mic->name, __func__, type); ++ assert(0); ++} ++ ++static void *get_dp(struct mic_info *mic, int type) ++{ ++ switch (type) { ++ case VIRTIO_ID_CONSOLE: ++ return mic->mic_console.console_dp; ++ case VIRTIO_ID_NET: ++ return mic->mic_net.net_dp; ++ case VIRTIO_ID_BLOCK: ++ return mic->mic_virtblk.block_dp; ++ } ++ mpsslog("%s %s %d not found\n", mic->name, __func__, type); ++ assert(0); ++ return NULL; ++} ++ ++static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type) ++{ ++ struct mic_device_desc *d; ++ int i; ++ void *dp = get_dp(mic, type); ++ ++ for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE; ++ i += mic_total_desc_size(d)) { ++ d = dp + i; ++ ++ /* End of list */ ++ if (d->type == 0) ++ break; ++ ++ if (d->type == -1) ++ continue; ++ ++ mpsslog("%s %s d-> type %d d %p\n", ++ mic->name, __func__, d->type, d); ++ ++ if (d->type == (__u8)type) ++ return d; ++ } ++ mpsslog("%s %s %d not found\n", mic->name, __func__, type); ++ assert(0); ++ return NULL; ++} ++ ++/* See comments in vhost.c for explanation of next_desc() */ ++static unsigned next_desc(struct vring_desc *desc) ++{ ++ unsigned int next; ++ ++ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) ++ return -1U; ++ next = le16toh(desc->next); ++ return next; ++} ++ ++/* Sum up all the IOVEC length */ ++static ssize_t ++sum_iovec_len(struct mic_copy_desc *copy) ++{ ++ ssize_t sum = 0; ++ int i; ++ ++ for (i = 0; i < copy->iovcnt; i++) ++ sum += copy->iov[i].iov_len; ++ return sum; ++} ++ ++static inline void verify_out_len(struct mic_info *mic, ++ struct mic_copy_desc *copy) ++{ ++ if (copy->out_len != sum_iovec_len(copy)) { ++ mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n", ++ mic->name, __func__, __LINE__, ++ copy->out_len, sum_iovec_len(copy)); ++ assert(copy->out_len == sum_iovec_len(copy)); ++ } ++} ++ ++/* Display an iovec */ ++static void ++disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy, ++ const char *s, int line) ++{ ++ int i; ++ ++ for (i = 0; i < copy->iovcnt; i++) ++ mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n", ++ mic->name, s, line, i, ++ copy->iov[i].iov_base, copy->iov[i].iov_len); ++} ++ ++static inline __u16 read_avail_idx(struct mic_vring *vr) ++{ ++ return ACCESS_ONCE(vr->info->avail_idx); ++} ++ ++static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr, ++ struct mic_copy_desc *copy, ssize_t len) ++{ ++ copy->vr_idx = tx ? 0 : 1; ++ copy->update_used = true; ++ if (type == VIRTIO_ID_NET) ++ copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr); ++ else ++ copy->iov[0].iov_len = len; ++} ++ ++/* Central API which triggers the copies */ ++static int ++mic_virtio_copy(struct mic_info *mic, int fd, ++ struct mic_vring *vr, struct mic_copy_desc *copy) ++{ ++ int ret; ++ ++ ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy); ++ if (ret) { ++ mpsslog("%s %s %d errno %s ret %d\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno), ret); ++ } ++ return ret; ++} ++ ++/* ++ * This initialization routine requires at least one ++ * vring i.e. vr0. vr1 is optional. ++ */ ++static void * ++init_vr(struct mic_info *mic, int fd, int type, ++ struct mic_vring *vr0, struct mic_vring *vr1, int num_vq) ++{ ++ int vr_size; ++ char *va; ++ ++ vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES, ++ MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info)); ++ va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq, ++ PROT_READ, MAP_SHARED, fd, 0); ++ if (MAP_FAILED == va) { ++ mpsslog("%s %s %d mmap failed errno %s\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ goto done; ++ } ++ set_dp(mic, type, va); ++ vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END]; ++ vr0->info = vr0->va + ++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN); ++ vring_init(&vr0->vr, ++ MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN); ++ mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ", ++ __func__, mic->name, vr0->va, vr0->info, vr_size, ++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); ++ mpsslog("magic 0x%x expected 0x%x\n", ++ le32toh(vr0->info->magic), MIC_MAGIC + type); ++ assert(le32toh(vr0->info->magic) == MIC_MAGIC + type); ++ if (vr1) { ++ vr1->va = (struct mic_vring *) ++ &va[MIC_DEVICE_PAGE_END + vr_size]; ++ vr1->info = vr1->va + vring_size(MIC_VRING_ENTRIES, ++ MIC_VIRTIO_RING_ALIGN); ++ vring_init(&vr1->vr, ++ MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN); ++ mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ", ++ __func__, mic->name, vr1->va, vr1->info, vr_size, ++ vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); ++ mpsslog("magic 0x%x expected 0x%x\n", ++ le32toh(vr1->info->magic), MIC_MAGIC + type + 1); ++ assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1); ++ } ++done: ++ return va; ++} ++ ++static void ++wait_for_card_driver(struct mic_info *mic, int fd, int type) ++{ ++ struct pollfd pollfd; ++ int err; ++ struct mic_device_desc *desc = get_device_desc(mic, type); ++ ++ pollfd.fd = fd; ++ mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n", ++ mic->name, __func__, type, desc->status); ++ while (1) { ++ pollfd.events = POLLIN; ++ pollfd.revents = 0; ++ err = poll(&pollfd, 1, -1); ++ if (err < 0) { ++ mpsslog("%s %s poll failed %s\n", ++ mic->name, __func__, strerror(errno)); ++ continue; ++ } ++ ++ if (pollfd.revents) { ++ mpsslog("%s %s Waiting... desc-> type %d status 0x%x\n", ++ mic->name, __func__, type, desc->status); ++ if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) { ++ mpsslog("%s %s poll.revents %d\n", ++ mic->name, __func__, pollfd.revents); ++ mpsslog("%s %s desc-> type %d status 0x%x\n", ++ mic->name, __func__, type, ++ desc->status); ++ break; ++ } ++ } ++ } ++} ++ ++/* Spin till we have some descriptors */ ++static void ++spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr) ++{ ++ __u16 avail_idx = read_avail_idx(vr); ++ ++ while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) { ++#ifdef DEBUG ++ mpsslog("%s %s waiting for desc avail %d info_avail %d\n", ++ mic->name, __func__, ++ le16toh(vr->vr.avail->idx), vr->info->avail_idx); ++#endif ++ sched_yield(); ++ } ++} ++ ++static void * ++virtio_net(void *arg) ++{ ++ static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)]; ++ static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64))); ++ struct iovec vnet_iov[2][2] = { ++ { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) }, ++ { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } }, ++ { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) }, ++ { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } }, ++ }; ++ struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1]; ++ struct mic_info *mic = (struct mic_info *)arg; ++ char if_name[IFNAMSIZ]; ++ struct pollfd net_poll[MAX_NET_FD]; ++ struct mic_vring tx_vr, rx_vr; ++ struct mic_copy_desc copy; ++ struct mic_device_desc *desc; ++ int err; ++ ++ snprintf(if_name, IFNAMSIZ, "mic%d", mic->id); ++ mic->mic_net.tap_fd = tun_alloc(mic, if_name); ++ if (mic->mic_net.tap_fd < 0) ++ goto done; ++ ++ if (tap_configure(mic, if_name)) ++ goto done; ++ mpsslog("MIC name %s id %d\n", mic->name, mic->id); ++ ++ net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd; ++ net_poll[NET_FD_VIRTIO_NET].events = POLLIN; ++ net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd; ++ net_poll[NET_FD_TUN].events = POLLIN; ++ ++ if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd, ++ VIRTIO_ID_NET, &tx_vr, &rx_vr, ++ virtnet_dev_page.dd.num_vq)) { ++ mpsslog("%s init_vr failed %s\n", ++ mic->name, strerror(errno)); ++ goto done; ++ } ++ ++ copy.iovcnt = 2; ++ desc = get_device_desc(mic, VIRTIO_ID_NET); ++ ++ while (1) { ++ ssize_t len; ++ ++ net_poll[NET_FD_VIRTIO_NET].revents = 0; ++ net_poll[NET_FD_TUN].revents = 0; ++ ++ /* Start polling for data from tap and virtio net */ ++ err = poll(net_poll, 2, -1); ++ if (err < 0) { ++ mpsslog("%s poll failed %s\n", ++ __func__, strerror(errno)); ++ continue; ++ } ++ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) ++ wait_for_card_driver(mic, mic->mic_net.virtio_net_fd, ++ VIRTIO_ID_NET); ++ /* ++ * Check if there is data to be read from TUN and write to ++ * virtio net fd if there is. ++ */ ++ if (net_poll[NET_FD_TUN].revents & POLLIN) { ++ copy.iov = iov0; ++ len = readv(net_poll[NET_FD_TUN].fd, ++ copy.iov, copy.iovcnt); ++ if (len > 0) { ++ struct virtio_net_hdr *hdr ++ = (struct virtio_net_hdr *)vnet_hdr[0]; ++ ++ /* Disable checksums on the card since we are on ++ a reliable PCIe link */ ++ hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID; ++#ifdef DEBUG ++ mpsslog("%s %s %d hdr->flags 0x%x ", mic->name, ++ __func__, __LINE__, hdr->flags); ++ mpsslog("copy.out_len %d hdr->gso_type 0x%x\n", ++ copy.out_len, hdr->gso_type); ++#endif ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, __LINE__); ++ mpsslog("%s %s %d read from tap 0x%lx\n", ++ mic->name, __func__, __LINE__, ++ len); ++#endif ++ spin_for_descriptors(mic, &tx_vr); ++ txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©, ++ len); ++ ++ err = mic_virtio_copy(mic, ++ mic->mic_net.virtio_net_fd, &tx_vr, ++ ©); ++ if (err < 0) { ++ mpsslog("%s %s %d mic_virtio_copy %s\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ } ++ if (!err) ++ verify_out_len(mic, ©); ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, __LINE__); ++ mpsslog("%s %s %d wrote to net 0x%lx\n", ++ mic->name, __func__, __LINE__, ++ sum_iovec_len(©)); ++#endif ++ /* Reinitialize IOV for next run */ ++ iov0[1].iov_len = MAX_NET_PKT_SIZE; ++ } else if (len < 0) { ++ disp_iovec(mic, ©, __func__, __LINE__); ++ mpsslog("%s %s %d read failed %s ", mic->name, ++ __func__, __LINE__, strerror(errno)); ++ mpsslog("cnt %d sum %zd\n", ++ copy.iovcnt, sum_iovec_len(©)); ++ } ++ } ++ ++ /* ++ * Check if there is data to be read from virtio net and ++ * write to TUN if there is. ++ */ ++ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) { ++ while (rx_vr.info->avail_idx != ++ le16toh(rx_vr.vr.avail->idx)) { ++ copy.iov = iov1; ++ txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©, ++ MAX_NET_PKT_SIZE ++ + sizeof(struct virtio_net_hdr)); ++ ++ err = mic_virtio_copy(mic, ++ mic->mic_net.virtio_net_fd, &rx_vr, ++ ©); ++ if (!err) { ++#ifdef DEBUG ++ struct virtio_net_hdr *hdr ++ = (struct virtio_net_hdr *) ++ vnet_hdr[1]; ++ ++ mpsslog("%s %s %d hdr->flags 0x%x, ", ++ mic->name, __func__, __LINE__, ++ hdr->flags); ++ mpsslog("out_len %d gso_type 0x%x\n", ++ copy.out_len, ++ hdr->gso_type); ++#endif ++ /* Set the correct output iov_len */ ++ iov1[1].iov_len = copy.out_len - ++ sizeof(struct virtio_net_hdr); ++ verify_out_len(mic, ©); ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, ++ __LINE__); ++ mpsslog("%s %s %d ", ++ mic->name, __func__, __LINE__); ++ mpsslog("read from net 0x%lx\n", ++ sum_iovec_len(copy)); ++#endif ++ len = writev(net_poll[NET_FD_TUN].fd, ++ copy.iov, copy.iovcnt); ++ if (len != sum_iovec_len(©)) { ++ mpsslog("Tun write failed %s ", ++ strerror(errno)); ++ mpsslog("len 0x%zx ", len); ++ mpsslog("read_len 0x%zx\n", ++ sum_iovec_len(©)); ++ } else { ++#ifdef DEBUG ++ disp_iovec(mic, ©, __func__, ++ __LINE__); ++ mpsslog("%s %s %d ", ++ mic->name, __func__, ++ __LINE__); ++ mpsslog("wrote to tap 0x%lx\n", ++ len); ++#endif ++ } ++ } else { ++ mpsslog("%s %s %d mic_virtio_copy %s\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ break; ++ } ++ } ++ } ++ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR) ++ mpsslog("%s: %s: POLLERR\n", __func__, mic->name); ++ } ++done: ++ pthread_exit(NULL); ++} ++ ++/* virtio_console */ ++#define VIRTIO_CONSOLE_FD 0 ++#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1) ++#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */ ++#define MAX_BUFFER_SIZE PAGE_SIZE ++ ++static void * ++virtio_console(void *arg) ++{ ++ static __u8 vcons_buf[2][PAGE_SIZE]; ++ struct iovec vcons_iov[2] = { ++ { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) }, ++ { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) }, ++ }; ++ struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1]; ++ struct mic_info *mic = (struct mic_info *)arg; ++ int err; ++ struct pollfd console_poll[MAX_CONSOLE_FD]; ++ int pty_fd; ++ char *pts_name; ++ ssize_t len; ++ struct mic_vring tx_vr, rx_vr; ++ struct mic_copy_desc copy; ++ struct mic_device_desc *desc; ++ ++ pty_fd = posix_openpt(O_RDWR); ++ if (pty_fd < 0) { ++ mpsslog("can't open a pseudoterminal master device: %s\n", ++ strerror(errno)); ++ goto _return; ++ } ++ pts_name = ptsname(pty_fd); ++ if (pts_name == NULL) { ++ mpsslog("can't get pts name\n"); ++ goto _close_pty; ++ } ++ printf("%s console message goes to %s\n", mic->name, pts_name); ++ mpsslog("%s console message goes to %s\n", mic->name, pts_name); ++ err = grantpt(pty_fd); ++ if (err < 0) { ++ mpsslog("can't grant access: %s %s\n", ++ pts_name, strerror(errno)); ++ goto _close_pty; ++ } ++ err = unlockpt(pty_fd); ++ if (err < 0) { ++ mpsslog("can't unlock a pseudoterminal: %s %s\n", ++ pts_name, strerror(errno)); ++ goto _close_pty; ++ } ++ console_poll[MONITOR_FD].fd = pty_fd; ++ console_poll[MONITOR_FD].events = POLLIN; ++ ++ console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd; ++ console_poll[VIRTIO_CONSOLE_FD].events = POLLIN; ++ ++ if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd, ++ VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr, ++ virtcons_dev_page.dd.num_vq)) { ++ mpsslog("%s init_vr failed %s\n", ++ mic->name, strerror(errno)); ++ goto _close_pty; ++ } ++ ++ copy.iovcnt = 1; ++ desc = get_device_desc(mic, VIRTIO_ID_CONSOLE); ++ ++ for (;;) { ++ console_poll[MONITOR_FD].revents = 0; ++ console_poll[VIRTIO_CONSOLE_FD].revents = 0; ++ err = poll(console_poll, MAX_CONSOLE_FD, -1); ++ if (err < 0) { ++ mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__, ++ strerror(errno)); ++ continue; ++ } ++ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) ++ wait_for_card_driver(mic, ++ mic->mic_console.virtio_console_fd, ++ VIRTIO_ID_CONSOLE); ++ ++ if (console_poll[MONITOR_FD].revents & POLLIN) { ++ copy.iov = iov0; ++ len = readv(pty_fd, copy.iov, copy.iovcnt); ++ if (len > 0) { ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, __LINE__); ++ mpsslog("%s %s %d read from tap 0x%lx\n", ++ mic->name, __func__, __LINE__, ++ len); ++#endif ++ spin_for_descriptors(mic, &tx_vr); ++ txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr, ++ ©, len); ++ ++ err = mic_virtio_copy(mic, ++ mic->mic_console.virtio_console_fd, ++ &tx_vr, ©); ++ if (err < 0) { ++ mpsslog("%s %s %d mic_virtio_copy %s\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ } ++ if (!err) ++ verify_out_len(mic, ©); ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, __LINE__); ++ mpsslog("%s %s %d wrote to net 0x%lx\n", ++ mic->name, __func__, __LINE__, ++ sum_iovec_len(copy)); ++#endif ++ /* Reinitialize IOV for next run */ ++ iov0->iov_len = PAGE_SIZE; ++ } else if (len < 0) { ++ disp_iovec(mic, ©, __func__, __LINE__); ++ mpsslog("%s %s %d read failed %s ", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ mpsslog("cnt %d sum %zd\n", ++ copy.iovcnt, sum_iovec_len(©)); ++ } ++ } ++ ++ if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) { ++ while (rx_vr.info->avail_idx != ++ le16toh(rx_vr.vr.avail->idx)) { ++ copy.iov = iov1; ++ txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr, ++ ©, PAGE_SIZE); ++ ++ err = mic_virtio_copy(mic, ++ mic->mic_console.virtio_console_fd, ++ &rx_vr, ©); ++ if (!err) { ++ /* Set the correct output iov_len */ ++ iov1->iov_len = copy.out_len; ++ verify_out_len(mic, ©); ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, ++ __LINE__); ++ mpsslog("%s %s %d ", ++ mic->name, __func__, __LINE__); ++ mpsslog("read from net 0x%lx\n", ++ sum_iovec_len(copy)); ++#endif ++ len = writev(pty_fd, ++ copy.iov, copy.iovcnt); ++ if (len != sum_iovec_len(©)) { ++ mpsslog("Tun write failed %s ", ++ strerror(errno)); ++ mpsslog("len 0x%zx ", len); ++ mpsslog("read_len 0x%zx\n", ++ sum_iovec_len(©)); ++ } else { ++#ifdef DEBUG ++ disp_iovec(mic, copy, __func__, ++ __LINE__); ++ mpsslog("%s %s %d ", ++ mic->name, __func__, ++ __LINE__); ++ mpsslog("wrote to tap 0x%lx\n", ++ len); ++#endif ++ } ++ } else { ++ mpsslog("%s %s %d mic_virtio_copy %s\n", ++ mic->name, __func__, __LINE__, ++ strerror(errno)); ++ break; ++ } ++ } ++ } ++ if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR) ++ mpsslog("%s: %s: POLLERR\n", __func__, mic->name); ++ } ++_close_pty: ++ close(pty_fd); ++_return: ++ pthread_exit(NULL); ++} ++ ++static void ++add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd) ++{ ++ char path[PATH_MAX]; ++ int fd, err; ++ ++ snprintf(path, PATH_MAX, "/dev/mic%d", mic->id); ++ fd = open(path, O_RDWR); ++ if (fd < 0) { ++ mpsslog("Could not open %s %s\n", path, strerror(errno)); ++ return; ++ } ++ ++ err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd); ++ if (err < 0) { ++ mpsslog("Could not add %d %s\n", dd->type, strerror(errno)); ++ close(fd); ++ return; ++ } ++ switch (dd->type) { ++ case VIRTIO_ID_NET: ++ mic->mic_net.virtio_net_fd = fd; ++ mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name); ++ break; ++ case VIRTIO_ID_CONSOLE: ++ mic->mic_console.virtio_console_fd = fd; ++ mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name); ++ break; ++ case VIRTIO_ID_BLOCK: ++ mic->mic_virtblk.virtio_block_fd = fd; ++ mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name); ++ break; ++ } ++} ++ ++static bool ++set_backend_file(struct mic_info *mic) ++{ ++ FILE *config; ++ char buff[PATH_MAX], *line, *evv, *p; ++ ++ snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id); ++ config = fopen(buff, "r"); ++ if (config == NULL) ++ return false; ++ do { /* look for "virtblk_backend=XXXX" */ ++ line = fgets(buff, PATH_MAX, config); ++ if (line == NULL) ++ break; ++ if (*line == '#') ++ continue; ++ p = strchr(line, '\n'); ++ if (p) ++ *p = '\0'; ++ } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0); ++ fclose(config); ++ if (line == NULL) ++ return false; ++ evv = strchr(line, '='); ++ if (evv == NULL) ++ return false; ++ mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1); ++ if (mic->mic_virtblk.backend_file == NULL) { ++ mpsslog("%s %d can't allocate memory\n", mic->name, mic->id); ++ return false; ++ } ++ strcpy(mic->mic_virtblk.backend_file, evv + 1); ++ return true; ++} ++ ++#define SECTOR_SIZE 512 ++static bool ++set_backend_size(struct mic_info *mic) ++{ ++ mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0, ++ SEEK_END); ++ if (mic->mic_virtblk.backend_size < 0) { ++ mpsslog("%s: can't seek: %s\n", ++ mic->name, mic->mic_virtblk.backend_file); ++ return false; ++ } ++ virtblk_dev_page.blk_config.capacity = ++ mic->mic_virtblk.backend_size / SECTOR_SIZE; ++ if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0) ++ virtblk_dev_page.blk_config.capacity++; ++ ++ virtblk_dev_page.blk_config.capacity = ++ htole64(virtblk_dev_page.blk_config.capacity); ++ ++ return true; ++} ++ ++static bool ++open_backend(struct mic_info *mic) ++{ ++ if (!set_backend_file(mic)) ++ goto _error_exit; ++ mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR); ++ if (mic->mic_virtblk.backend < 0) { ++ mpsslog("%s: can't open: %s\n", mic->name, ++ mic->mic_virtblk.backend_file); ++ goto _error_free; ++ } ++ if (!set_backend_size(mic)) ++ goto _error_close; ++ mic->mic_virtblk.backend_addr = mmap(NULL, ++ mic->mic_virtblk.backend_size, ++ PROT_READ|PROT_WRITE, MAP_SHARED, ++ mic->mic_virtblk.backend, 0L); ++ if (mic->mic_virtblk.backend_addr == MAP_FAILED) { ++ mpsslog("%s: can't map: %s %s\n", ++ mic->name, mic->mic_virtblk.backend_file, ++ strerror(errno)); ++ goto _error_close; ++ } ++ return true; ++ ++ _error_close: ++ close(mic->mic_virtblk.backend); ++ _error_free: ++ free(mic->mic_virtblk.backend_file); ++ _error_exit: ++ return false; ++} ++ ++static void ++close_backend(struct mic_info *mic) ++{ ++ munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size); ++ close(mic->mic_virtblk.backend); ++ free(mic->mic_virtblk.backend_file); ++} ++ ++static bool ++start_virtblk(struct mic_info *mic, struct mic_vring *vring) ++{ ++ if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) { ++ mpsslog("%s: blk_config is not 8 byte aligned.\n", ++ mic->name); ++ return false; ++ } ++ add_virtio_device(mic, &virtblk_dev_page.dd); ++ if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd, ++ VIRTIO_ID_BLOCK, vring, NULL, ++ virtblk_dev_page.dd.num_vq)) { ++ mpsslog("%s init_vr failed %s\n", ++ mic->name, strerror(errno)); ++ return false; ++ } ++ return true; ++} ++ ++static void ++stop_virtblk(struct mic_info *mic) ++{ ++ int vr_size, ret; ++ ++ vr_size = PAGE_ALIGN(vring_size(MIC_VRING_ENTRIES, ++ MIC_VIRTIO_RING_ALIGN) + sizeof(struct _mic_vring_info)); ++ ret = munmap(mic->mic_virtblk.block_dp, ++ MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq); ++ if (ret < 0) ++ mpsslog("%s munmap errno %d\n", mic->name, errno); ++ close(mic->mic_virtblk.virtio_block_fd); ++} ++ ++static __u8 ++header_error_check(struct vring_desc *desc) ++{ ++ if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) { ++ mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n", ++ __func__, __LINE__); ++ return -EIO; ++ } ++ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) { ++ mpsslog("%s() %d: alone\n", ++ __func__, __LINE__); ++ return -EIO; ++ } ++ if (le16toh(desc->flags) & VRING_DESC_F_WRITE) { ++ mpsslog("%s() %d: not read\n", ++ __func__, __LINE__); ++ return -EIO; ++ } ++ return 0; ++} ++ ++static int ++read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx) ++{ ++ struct iovec iovec; ++ struct mic_copy_desc copy; ++ ++ iovec.iov_len = sizeof(*hdr); ++ iovec.iov_base = hdr; ++ copy.iov = &iovec; ++ copy.iovcnt = 1; ++ copy.vr_idx = 0; /* only one vring on virtio_block */ ++ copy.update_used = false; /* do not update used index */ ++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); ++} ++ ++static int ++transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt) ++{ ++ struct mic_copy_desc copy; ++ ++ copy.iov = iovec; ++ copy.iovcnt = iovcnt; ++ copy.vr_idx = 0; /* only one vring on virtio_block */ ++ copy.update_used = false; /* do not update used index */ ++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); ++} ++ ++static __u8 ++status_error_check(struct vring_desc *desc) ++{ ++ if (le32toh(desc->len) != sizeof(__u8)) { ++ mpsslog("%s() %d: length is not sizeof(status)\n", ++ __func__, __LINE__); ++ return -EIO; ++ } ++ return 0; ++} ++ ++static int ++write_status(int fd, __u8 *status) ++{ ++ struct iovec iovec; ++ struct mic_copy_desc copy; ++ ++ iovec.iov_base = status; ++ iovec.iov_len = sizeof(*status); ++ copy.iov = &iovec; ++ copy.iovcnt = 1; ++ copy.vr_idx = 0; /* only one vring on virtio_block */ ++ copy.update_used = true; /* Update used index */ ++ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); ++} ++ ++static void * ++virtio_block(void *arg) ++{ ++ struct mic_info *mic = (struct mic_info *)arg; ++ int ret; ++ struct pollfd block_poll; ++ struct mic_vring vring; ++ __u16 avail_idx; ++ __u32 desc_idx; ++ struct vring_desc *desc; ++ struct iovec *iovec, *piov; ++ __u8 status; ++ __u32 buffer_desc_idx; ++ struct virtio_blk_outhdr hdr; ++ void *fos; ++ ++ for (;;) { /* forever */ ++ if (!open_backend(mic)) { /* No virtblk */ ++ for (mic->mic_virtblk.signaled = 0; ++ !mic->mic_virtblk.signaled;) ++ sleep(1); ++ continue; ++ } ++ ++ /* backend file is specified. */ ++ if (!start_virtblk(mic, &vring)) ++ goto _close_backend; ++ iovec = malloc(sizeof(*iovec) * ++ le32toh(virtblk_dev_page.blk_config.seg_max)); ++ if (!iovec) { ++ mpsslog("%s: can't alloc iovec: %s\n", ++ mic->name, strerror(ENOMEM)); ++ goto _stop_virtblk; ++ } ++ ++ block_poll.fd = mic->mic_virtblk.virtio_block_fd; ++ block_poll.events = POLLIN; ++ for (mic->mic_virtblk.signaled = 0; ++ !mic->mic_virtblk.signaled;) { ++ block_poll.revents = 0; ++ /* timeout in 1 sec to see signaled */ ++ ret = poll(&block_poll, 1, 1000); ++ if (ret < 0) { ++ mpsslog("%s %d: poll failed: %s\n", ++ __func__, __LINE__, ++ strerror(errno)); ++ continue; ++ } ++ ++ if (!(block_poll.revents & POLLIN)) { ++#ifdef DEBUG ++ mpsslog("%s %d: block_poll.revents=0x%x\n", ++ __func__, __LINE__, block_poll.revents); ++#endif ++ continue; ++ } ++ ++ /* POLLIN */ ++ while (vring.info->avail_idx != ++ le16toh(vring.vr.avail->idx)) { ++ /* read header element */ ++ avail_idx = ++ vring.info->avail_idx & ++ (vring.vr.num - 1); ++ desc_idx = le16toh( ++ vring.vr.avail->ring[avail_idx]); ++ desc = &vring.vr.desc[desc_idx]; ++#ifdef DEBUG ++ mpsslog("%s() %d: avail_idx=%d ", ++ __func__, __LINE__, ++ vring.info->avail_idx); ++ mpsslog("vring.vr.num=%d desc=%p\n", ++ vring.vr.num, desc); ++#endif ++ status = header_error_check(desc); ++ ret = read_header( ++ mic->mic_virtblk.virtio_block_fd, ++ &hdr, desc_idx); ++ if (ret < 0) { ++ mpsslog("%s() %d %s: ret=%d %s\n", ++ __func__, __LINE__, ++ mic->name, ret, ++ strerror(errno)); ++ break; ++ } ++ /* buffer element */ ++ piov = iovec; ++ status = 0; ++ fos = mic->mic_virtblk.backend_addr + ++ (hdr.sector * SECTOR_SIZE); ++ buffer_desc_idx = next_desc(desc); ++ desc_idx = buffer_desc_idx; ++ for (desc = &vring.vr.desc[buffer_desc_idx]; ++ desc->flags & VRING_DESC_F_NEXT; ++ desc_idx = next_desc(desc), ++ desc = &vring.vr.desc[desc_idx]) { ++ piov->iov_len = desc->len; ++ piov->iov_base = fos; ++ piov++; ++ fos += desc->len; ++ } ++ /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */ ++ if (hdr.type & ~(VIRTIO_BLK_T_OUT | ++ VIRTIO_BLK_T_GET_ID)) { ++ /* ++ VIRTIO_BLK_T_IN - does not do ++ anything. Probably for documenting. ++ VIRTIO_BLK_T_SCSI_CMD - for ++ virtio_scsi. ++ VIRTIO_BLK_T_FLUSH - turned off in ++ config space. ++ VIRTIO_BLK_T_BARRIER - defined but not ++ used in anywhere. ++ */ ++ mpsslog("%s() %d: type %x ", ++ __func__, __LINE__, ++ hdr.type); ++ mpsslog("is not supported\n"); ++ status = -ENOTSUP; ++ ++ } else { ++ ret = transfer_blocks( ++ mic->mic_virtblk.virtio_block_fd, ++ iovec, ++ piov - iovec); ++ if (ret < 0 && ++ status != 0) ++ status = ret; ++ } ++ /* write status and update used pointer */ ++ if (status != 0) ++ status = status_error_check(desc); ++ ret = write_status( ++ mic->mic_virtblk.virtio_block_fd, ++ &status); ++#ifdef DEBUG ++ mpsslog("%s() %d: write status=%d on desc=%p\n", ++ __func__, __LINE__, ++ status, desc); ++#endif ++ } ++ } ++ free(iovec); ++_stop_virtblk: ++ stop_virtblk(mic); ++_close_backend: ++ close_backend(mic); ++ } /* forever */ ++ ++ pthread_exit(NULL); ++} ++ ++static void ++reset(struct mic_info *mic) ++{ ++#define RESET_TIMEOUT 120 ++ int i = RESET_TIMEOUT; ++ setsysfs(mic->name, "state", "reset"); ++ while (i) { ++ char *state; ++ state = readsysfs(mic->name, "state"); ++ if (!state) ++ goto retry; ++ mpsslog("%s: %s %d state %s\n", ++ mic->name, __func__, __LINE__, state); ++ ++ /* ++ * If the shutdown was initiated by OSPM, the state stays ++ * in "suspended" which is also a valid condition for reset. ++ */ ++ if ((!strcmp(state, "offline")) || ++ (!strcmp(state, "suspended"))) { ++ free(state); ++ break; ++ } ++ free(state); ++retry: ++ sleep(1); ++ i--; ++ } ++} ++ ++static int ++get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status) ++{ ++ if (!strcmp(shutdown_status, "nop")) ++ return MIC_NOP; ++ if (!strcmp(shutdown_status, "crashed")) ++ return MIC_CRASHED; ++ if (!strcmp(shutdown_status, "halted")) ++ return MIC_HALTED; ++ if (!strcmp(shutdown_status, "poweroff")) ++ return MIC_POWER_OFF; ++ if (!strcmp(shutdown_status, "restart")) ++ return MIC_RESTART; ++ mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status); ++ /* Invalid state */ ++ assert(0); ++}; ++ ++static int get_mic_state(struct mic_info *mic, char *state) ++{ ++ if (!strcmp(state, "offline")) ++ return MIC_OFFLINE; ++ if (!strcmp(state, "online")) ++ return MIC_ONLINE; ++ if (!strcmp(state, "shutting_down")) ++ return MIC_SHUTTING_DOWN; ++ if (!strcmp(state, "reset_failed")) ++ return MIC_RESET_FAILED; ++ if (!strcmp(state, "suspending")) ++ return MIC_SUSPENDING; ++ if (!strcmp(state, "suspended")) ++ return MIC_SUSPENDED; ++ mpsslog("%s: BUG invalid state %s\n", mic->name, state); ++ /* Invalid state */ ++ assert(0); ++}; ++ ++static void mic_handle_shutdown(struct mic_info *mic) ++{ ++#define SHUTDOWN_TIMEOUT 60 ++ int i = SHUTDOWN_TIMEOUT, ret, stat = 0; ++ char *shutdown_status; ++ while (i) { ++ shutdown_status = readsysfs(mic->name, "shutdown_status"); ++ if (!shutdown_status) ++ continue; ++ mpsslog("%s: %s %d shutdown_status %s\n", ++ mic->name, __func__, __LINE__, shutdown_status); ++ switch (get_mic_shutdown_status(mic, shutdown_status)) { ++ case MIC_RESTART: ++ mic->restart = 1; ++ case MIC_HALTED: ++ case MIC_POWER_OFF: ++ case MIC_CRASHED: ++ free(shutdown_status); ++ goto reset; ++ default: ++ break; ++ } ++ free(shutdown_status); ++ sleep(1); ++ i--; ++ } ++reset: ++ ret = kill(mic->pid, SIGTERM); ++ mpsslog("%s: %s %d kill pid %d ret %d\n", ++ mic->name, __func__, __LINE__, ++ mic->pid, ret); ++ if (!ret) { ++ ret = waitpid(mic->pid, &stat, ++ WIFSIGNALED(stat)); ++ mpsslog("%s: %s %d waitpid ret %d pid %d\n", ++ mic->name, __func__, __LINE__, ++ ret, mic->pid); ++ } ++ if (ret == mic->pid) ++ reset(mic); ++} ++ ++static void * ++mic_config(void *arg) ++{ ++ struct mic_info *mic = (struct mic_info *)arg; ++ char *state = NULL; ++ char pathname[PATH_MAX]; ++ int fd, ret; ++ struct pollfd ufds[1]; ++ char value[4096]; ++ ++ snprintf(pathname, PATH_MAX - 1, "%s/%s/%s", ++ MICSYSFSDIR, mic->name, "state"); ++ ++ fd = open(pathname, O_RDONLY); ++ if (fd < 0) { ++ mpsslog("%s: opening file %s failed %s\n", ++ mic->name, pathname, strerror(errno)); ++ goto error; ++ } ++ ++ do { ++ ret = lseek(fd, 0, SEEK_SET); ++ if (ret < 0) { ++ mpsslog("%s: Failed to seek to file start '%s': %s\n", ++ mic->name, pathname, strerror(errno)); ++ goto close_error1; ++ } ++ ret = read(fd, value, sizeof(value)); ++ if (ret < 0) { ++ mpsslog("%s: Failed to read sysfs entry '%s': %s\n", ++ mic->name, pathname, strerror(errno)); ++ goto close_error1; ++ } ++retry: ++ state = readsysfs(mic->name, "state"); ++ if (!state) ++ goto retry; ++ mpsslog("%s: %s %d state %s\n", ++ mic->name, __func__, __LINE__, state); ++ switch (get_mic_state(mic, state)) { ++ case MIC_SHUTTING_DOWN: ++ mic_handle_shutdown(mic); ++ goto close_error; ++ case MIC_SUSPENDING: ++ mic->boot_on_resume = 1; ++ setsysfs(mic->name, "state", "suspend"); ++ mic_handle_shutdown(mic); ++ goto close_error; ++ case MIC_OFFLINE: ++ if (mic->boot_on_resume) { ++ setsysfs(mic->name, "state", "boot"); ++ mic->boot_on_resume = 0; ++ } ++ break; ++ default: ++ break; ++ } ++ free(state); ++ ++ ufds[0].fd = fd; ++ ufds[0].events = POLLERR | POLLPRI; ++ ret = poll(ufds, 1, -1); ++ if (ret < 0) { ++ mpsslog("%s: poll failed %s\n", ++ mic->name, strerror(errno)); ++ goto close_error1; ++ } ++ } while (1); ++close_error: ++ free(state); ++close_error1: ++ close(fd); ++error: ++ init_mic(mic); ++ pthread_exit(NULL); ++} ++ ++static void ++set_cmdline(struct mic_info *mic) ++{ ++ char buffer[PATH_MAX]; ++ int len; ++ ++ len = snprintf(buffer, PATH_MAX, ++ "clocksource=tsc highres=off nohz=off "); ++ len += snprintf(buffer + len, PATH_MAX - len, ++ "cpufreq_on;corec6_off;pc3_off;pc6_off "); ++ len += snprintf(buffer + len, PATH_MAX - len, ++ "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0", ++ mic->id); ++ ++ setsysfs(mic->name, "cmdline", buffer); ++ mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer); ++ snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id); ++ mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer); ++} ++ ++static void ++set_log_buf_info(struct mic_info *mic) ++{ ++ int fd; ++ off_t len; ++ char system_map[] = "/lib/firmware/mic/System.map"; ++ char *map, *temp, log_buf[17] = {'\0'}; ++ ++ fd = open(system_map, O_RDONLY); ++ if (fd < 0) { ++ mpsslog("%s: Opening System.map failed: %d\n", ++ mic->name, errno); ++ return; ++ } ++ len = lseek(fd, 0, SEEK_END); ++ if (len < 0) { ++ mpsslog("%s: Reading System.map size failed: %d\n", ++ mic->name, errno); ++ close(fd); ++ return; ++ } ++ map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0); ++ if (map == MAP_FAILED) { ++ mpsslog("%s: mmap of System.map failed: %d\n", ++ mic->name, errno); ++ close(fd); ++ return; ++ } ++ temp = strstr(map, "__log_buf"); ++ if (!temp) { ++ mpsslog("%s: __log_buf not found: %d\n", mic->name, errno); ++ munmap(map, len); ++ close(fd); ++ return; ++ } ++ strncpy(log_buf, temp - 19, 16); ++ setsysfs(mic->name, "log_buf_addr", log_buf); ++ mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf); ++ temp = strstr(map, "log_buf_len"); ++ if (!temp) { ++ mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno); ++ munmap(map, len); ++ close(fd); ++ return; ++ } ++ strncpy(log_buf, temp - 19, 16); ++ setsysfs(mic->name, "log_buf_len", log_buf); ++ mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf); ++ munmap(map, len); ++ close(fd); ++} ++ ++static void init_mic(struct mic_info *mic); ++ ++static void ++change_virtblk_backend(int x, siginfo_t *siginfo, void *p) ++{ ++ struct mic_info *mic; ++ ++ for (mic = mic_list.next; mic != NULL; mic = mic->next) ++ mic->mic_virtblk.signaled = 1/* true */; ++} ++ ++static void ++init_mic(struct mic_info *mic) ++{ ++ struct sigaction ignore = { ++ .sa_flags = 0, ++ .sa_handler = SIG_IGN ++ }; ++ struct sigaction act = { ++ .sa_flags = SA_SIGINFO, ++ .sa_sigaction = change_virtblk_backend, ++ }; ++ char buffer[PATH_MAX]; ++ int err; ++ ++ /* ++ * Currently, one virtio block device is supported for each MIC card ++ * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon. ++ * The signal informs the virtio block backend about a change in the ++ * configuration file which specifies the virtio backend file name on ++ * the host. Virtio block backend then re-reads the configuration file ++ * and switches to the new block device. This signalling mechanism may ++ * not be required once multiple virtio block devices are supported by ++ * the MIC daemon. ++ */ ++ sigaction(SIGUSR1, &ignore, NULL); ++ ++ mic->pid = fork(); ++ switch (mic->pid) { ++ case 0: ++ set_log_buf_info(mic); ++ set_cmdline(mic); ++ add_virtio_device(mic, &virtcons_dev_page.dd); ++ add_virtio_device(mic, &virtnet_dev_page.dd); ++ err = pthread_create(&mic->mic_console.console_thread, NULL, ++ virtio_console, mic); ++ if (err) ++ mpsslog("%s virtcons pthread_create failed %s\n", ++ mic->name, strerror(err)); ++ err = pthread_create(&mic->mic_net.net_thread, NULL, ++ virtio_net, mic); ++ if (err) ++ mpsslog("%s virtnet pthread_create failed %s\n", ++ mic->name, strerror(err)); ++ err = pthread_create(&mic->mic_virtblk.block_thread, NULL, ++ virtio_block, mic); ++ if (err) ++ mpsslog("%s virtblk pthread_create failed %s\n", ++ mic->name, strerror(err)); ++ sigemptyset(&act.sa_mask); ++ err = sigaction(SIGUSR1, &act, NULL); ++ if (err) ++ mpsslog("%s sigaction SIGUSR1 failed %s\n", ++ mic->name, strerror(errno)); ++ while (1) ++ sleep(60); ++ case -1: ++ mpsslog("fork failed MIC name %s id %d errno %d\n", ++ mic->name, mic->id, errno); ++ break; ++ default: ++ if (mic->restart) { ++ snprintf(buffer, PATH_MAX, "boot"); ++ setsysfs(mic->name, "state", buffer); ++ mpsslog("%s restarting mic %d\n", ++ mic->name, mic->restart); ++ mic->restart = 0; ++ } ++ pthread_create(&mic->config_thread, NULL, mic_config, mic); ++ } ++} ++ ++static void ++start_daemon(void) ++{ ++ struct mic_info *mic; ++ ++ for (mic = mic_list.next; mic != NULL; mic = mic->next) ++ init_mic(mic); ++ ++ while (1) ++ sleep(60); ++} ++ ++static int ++init_mic_list(void) ++{ ++ struct mic_info *mic = &mic_list; ++ struct dirent *file; ++ DIR *dp; ++ int cnt = 0; ++ ++ dp = opendir(MICSYSFSDIR); ++ if (!dp) ++ return 0; ++ ++ while ((file = readdir(dp)) != NULL) { ++ if (!strncmp(file->d_name, "mic", 3)) { ++ mic->next = calloc(1, sizeof(struct mic_info)); ++ if (mic->next) { ++ mic = mic->next; ++ mic->id = atoi(&file->d_name[3]); ++ mic->name = malloc(strlen(file->d_name) + 16); ++ if (mic->name) ++ strcpy(mic->name, file->d_name); ++ mpsslog("MIC name %s id %d\n", mic->name, ++ mic->id); ++ cnt++; ++ } ++ } ++ } ++ ++ closedir(dp); ++ return cnt; ++} ++ ++void ++mpsslog(char *format, ...) ++{ ++ va_list args; ++ char buffer[4096]; ++ char ts[52], *ts1; ++ time_t t; ++ ++ if (logfp == NULL) ++ return; ++ ++ va_start(args, format); ++ vsprintf(buffer, format, args); ++ va_end(args); ++ ++ time(&t); ++ ts1 = ctime_r(&t, ts); ++ ts1[strlen(ts1) - 1] = '\0'; ++ fprintf(logfp, "%s: %s", ts1, buffer); ++ ++ fflush(logfp); ++} ++ ++int ++main(int argc, char *argv[]) ++{ ++ int cnt; ++ pid_t pid; ++ ++ myname = argv[0]; ++ ++ logfp = fopen(LOGFILE_NAME, "a+"); ++ if (!logfp) { ++ fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME); ++ exit(1); ++ } ++ pid = fork(); ++ switch (pid) { ++ case 0: ++ break; ++ case -1: ++ exit(2); ++ default: ++ exit(0); ++ } ++ ++ mpsslog("MIC Daemon start\n"); ++ ++ cnt = init_mic_list(); ++ if (cnt == 0) { ++ mpsslog("MIC module not loaded\n"); ++ exit(3); ++ } ++ mpsslog("MIC found %d devices\n", cnt); ++ ++ start_daemon(); ++ ++ exit(0); ++} +diff --git a/samples/mic/mpssd/mpssd.h b/samples/mic/mpssd/mpssd.h +new file mode 100644 +index 000000000000..f5f18b15d9a0 +--- /dev/null ++++ b/samples/mic/mpssd/mpssd.h +@@ -0,0 +1,102 @@ ++/* ++ * Intel MIC Platform Software Stack (MPSS) ++ * ++ * Copyright(c) 2013 Intel Corporation. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License, version 2, as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * General Public License for more details. ++ * ++ * The full GNU General Public License is included in this distribution in ++ * the file called "COPYING". ++ * ++ * Intel MIC User Space Tools. ++ */ ++#ifndef _MPSSD_H_ ++#define _MPSSD_H_ ++ ++#include <stdio.h> ++#include <stdlib.h> ++#include <string.h> ++#include <fcntl.h> ++#include <unistd.h> ++#include <dirent.h> ++#include <libgen.h> ++#include <pthread.h> ++#include <stdarg.h> ++#include <time.h> ++#include <errno.h> ++#include <sys/dir.h> ++#include <sys/ioctl.h> ++#include <sys/poll.h> ++#include <sys/types.h> ++#include <sys/socket.h> ++#include <sys/stat.h> ++#include <sys/types.h> ++#include <sys/mman.h> ++#include <sys/utsname.h> ++#include <sys/wait.h> ++#include <netinet/in.h> ++#include <arpa/inet.h> ++#include <netdb.h> ++#include <pthread.h> ++#include <signal.h> ++#include <limits.h> ++#include <syslog.h> ++#include <getopt.h> ++#include <net/if.h> ++#include <linux/if_tun.h> ++#include <linux/if_tun.h> ++#include <linux/virtio_ids.h> ++ ++#define MICSYSFSDIR "/sys/class/mic" ++#define LOGFILE_NAME "/var/log/mpssd" ++#define PAGE_SIZE 4096 ++ ++struct mic_console_info { ++ pthread_t console_thread; ++ int virtio_console_fd; ++ void *console_dp; ++}; ++ ++struct mic_net_info { ++ pthread_t net_thread; ++ int virtio_net_fd; ++ int tap_fd; ++ void *net_dp; ++}; ++ ++struct mic_virtblk_info { ++ pthread_t block_thread; ++ int virtio_block_fd; ++ void *block_dp; ++ volatile sig_atomic_t signaled; ++ char *backend_file; ++ int backend; ++ void *backend_addr; ++ long backend_size; ++}; ++ ++struct mic_info { ++ int id; ++ char *name; ++ pthread_t config_thread; ++ pid_t pid; ++ struct mic_console_info mic_console; ++ struct mic_net_info mic_net; ++ struct mic_virtblk_info mic_virtblk; ++ int restart; ++ int boot_on_resume; ++ struct mic_info *next; ++}; ++ ++__attribute__((format(printf, 1, 2))) ++void mpsslog(char *format, ...); ++char *readsysfs(char *dir, char *entry); ++int setsysfs(char *dir, char *entry, char *value); ++#endif +diff --git a/samples/mic/mpssd/sysfs.c b/samples/mic/mpssd/sysfs.c +new file mode 100644 +index 000000000000..8dd326936083 +--- /dev/null ++++ b/samples/mic/mpssd/sysfs.c +@@ -0,0 +1,102 @@ ++/* ++ * Intel MIC Platform Software Stack (MPSS) ++ * ++ * Copyright(c) 2013 Intel Corporation. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License, version 2, as ++ * published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, but ++ * WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * General Public License for more details. ++ * ++ * The full GNU General Public License is included in this distribution in ++ * the file called "COPYING". ++ * ++ * Intel MIC User Space Tools. ++ */ ++ ++#include "mpssd.h" ++ ++#define PAGE_SIZE 4096 ++ ++char * ++readsysfs(char *dir, char *entry) ++{ ++ char filename[PATH_MAX]; ++ char value[PAGE_SIZE]; ++ char *string = NULL; ++ int fd; ++ int len; ++ ++ if (dir == NULL) ++ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); ++ else ++ snprintf(filename, PATH_MAX, ++ "%s/%s/%s", MICSYSFSDIR, dir, entry); ++ ++ fd = open(filename, O_RDONLY); ++ if (fd < 0) { ++ mpsslog("Failed to open sysfs entry '%s': %s\n", ++ filename, strerror(errno)); ++ return NULL; ++ } ++ ++ len = read(fd, value, sizeof(value)); ++ if (len < 0) { ++ mpsslog("Failed to read sysfs entry '%s': %s\n", ++ filename, strerror(errno)); ++ goto readsys_ret; ++ } ++ if (len == 0) ++ goto readsys_ret; ++ ++ value[len - 1] = '\0'; ++ ++ string = malloc(strlen(value) + 1); ++ if (string) ++ strcpy(string, value); ++ ++readsys_ret: ++ close(fd); ++ return string; ++} ++ ++int ++setsysfs(char *dir, char *entry, char *value) ++{ ++ char filename[PATH_MAX]; ++ char *oldvalue; ++ int fd, ret = 0; ++ ++ if (dir == NULL) ++ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); ++ else ++ snprintf(filename, PATH_MAX, "%s/%s/%s", ++ MICSYSFSDIR, dir, entry); ++ ++ oldvalue = readsysfs(dir, entry); ++ ++ fd = open(filename, O_RDWR); ++ if (fd < 0) { ++ ret = errno; ++ mpsslog("Failed to open sysfs entry '%s': %s\n", ++ filename, strerror(errno)); ++ goto done; ++ } ++ ++ if (!oldvalue || strcmp(value, oldvalue)) { ++ if (write(fd, value, strlen(value)) < 0) { ++ ret = errno; ++ mpsslog("Failed to write new sysfs entry '%s': %s\n", ++ filename, strerror(errno)); ++ } ++ } ++ close(fd); ++done: ++ if (oldvalue) ++ free(oldvalue); ++ return ret; ++} +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index b1e455b47b82..be04b056c1bd 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5594,7 +5594,7 @@ static int selinux_setprocattr(struct task_struct *p, + return error; + + /* Obtain a SID for the context, if one was specified. */ +- if (size && str[1] && str[1] != '\n') { ++ if (size && str[0] && str[0] != '\n') { + if (str[size-1] == '\n') { + str[size-1] = 0; + size--; +diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c +index e6d4ff9fd992..736c1ea8e31e 100644 +--- a/sound/soc/codecs/cs4270.c ++++ b/sound/soc/codecs/cs4270.c +@@ -148,11 +148,11 @@ SND_SOC_DAPM_OUTPUT("AOUTR"), + }; + + static const struct snd_soc_dapm_route cs4270_dapm_routes[] = { +- { "Capture", NULL, "AINA" }, +- { "Capture", NULL, "AINB" }, ++ { "Capture", NULL, "AINL" }, ++ { "Capture", NULL, "AINR" }, + +- { "AOUTA", NULL, "Playback" }, +- { "AOUTB", NULL, "Playback" }, ++ { "AOUTL", NULL, "Playback" }, ++ { "AOUTR", NULL, "Playback" }, + }; + + /** +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 0051077a7b9d..814a118d2ef6 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2959,6 +2959,23 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + }, + ++/* Syntek STK1160 */ ++{ ++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | ++ USB_DEVICE_ID_MATCH_INT_CLASS | ++ USB_DEVICE_ID_MATCH_INT_SUBCLASS, ++ .idVendor = 0x05e1, ++ .idProduct = 0x0408, ++ .bInterfaceClass = USB_CLASS_AUDIO, ++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "Syntek", ++ .product_name = "STK1160", ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_AUDIO_ALIGN_TRANSFER ++ } ++}, ++ + /* Digidesign Mbox */ + { + /* Thanks to Clemens Ladisch <clemens@ladisch.de> */ +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index dcb1e9ac949c..d9d10f3c8ca3 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -2450,7 +2450,7 @@ sub do_run_test { + } + + waitpid $child_pid, 0; +- $child_exit = $?; ++ $child_exit = $? >> 8; + + if (!$bug && $in_bisect) { + if (defined($bisect_ret_good)) { |