Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0351-4.9.252-all-fixes.patch

    Contents of /trunk/kernel-alx-legacy/patches-4.9/0351-4.9.252-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3653 - (show annotations) (download)
    Mon Oct 24 14:07:32 2022 UTC (18 months ago) by niro
    File size: 26605 byte(s) 
    -linux-4.9.252
    1 diff --git a/Makefile b/Makefile
    2 index 8ebbb60f2078a..2213fe336705f 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 251
    9 +SUBLEVEL = 252
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
    14 index f989145480c8f..bf236b7af8c1a 100644
    15 --- a/arch/arm/mach-omap2/omap_device.c
    16 +++ b/arch/arm/mach-omap2/omap_device.c
    17 @@ -224,10 +224,12 @@ static int _omap_device_notifier_call(struct notifier_block *nb,
    18 break;
    19 case BUS_NOTIFY_BIND_DRIVER:
    20 od = to_omap_device(pdev);
    21 - if (od && (od->_state == OMAP_DEVICE_STATE_ENABLED) &&
    22 - pm_runtime_status_suspended(dev)) {
    23 + if (od) {
    24 od->_driver_status = BUS_NOTIFY_BIND_DRIVER;
    25 - pm_runtime_set_active(dev);
    26 + if (od->_state == OMAP_DEVICE_STATE_ENABLED &&
    27 + pm_runtime_status_suspended(dev)) {
    28 + pm_runtime_set_active(dev);
    29 + }
    30 }
    31 break;
    32 case BUS_NOTIFY_ADD_DEVICE:
    33 diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
    34 index 0ad81fa13688f..10d80456f38f1 100644
    35 --- a/arch/arm64/kvm/sys_regs.c
    36 +++ b/arch/arm64/kvm/sys_regs.c
    37 @@ -450,6 +450,10 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
    38 {
    39 u64 pmcr, val;
    40
    41 + /* No PMU available, PMCR_EL0 may UNDEF... */
    42 + if (!kvm_arm_support_pmu_v3())
    43 + return;
    44 +
    45 pmcr = read_sysreg(pmcr_el0);
    46 /*
    47 * Writable bits of PMCR_EL0 (ARMV8_PMU_PMCR_MASK) are reset to UNKNOWN
    48 diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
    49 index 6b8b2d57fdc8c..e588028922a83 100644
    50 --- a/arch/powerpc/include/asm/book3s/32/pgtable.h
    51 +++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
    52 @@ -411,9 +411,9 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
    53 if (pte_val(*ptep) & _PAGE_HASHPTE)
    54 flush_hash_entry(mm, ptep, addr);
    55 __asm__ __volatile__("\
    56 - stw%U0%X0 %2,%0\n\
    57 + stw%X0 %2,%0\n\
    58 eieio\n\
    59 - stw%U0%X0 %L2,%1"
    60 + stw%X1 %L2,%1"
    61 : "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
    62 : "r" (pte) : "memory");
    63
    64 diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
    65 index 1263c22d60d85..330fe178c0c5e 100644
    66 --- a/arch/powerpc/include/asm/nohash/pgtable.h
    67 +++ b/arch/powerpc/include/asm/nohash/pgtable.h
    68 @@ -155,9 +155,9 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
    69 flush_hash_entry(mm, ptep, addr);
    70 #endif
    71 __asm__ __volatile__("\
    72 - stw%U0%X0 %2,%0\n\
    73 + stw%X0 %2,%0\n\
    74 eieio\n\
    75 - stw%U0%X0 %L2,%1"
    76 + stw%X1 %L2,%1"
    77 : "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
    78 : "r" (pte) : "memory");
    79
    80 diff --git a/block/genhd.c b/block/genhd.c
    81 index fcd6d4fae657c..9c1adfd768d2c 100644
    82 --- a/block/genhd.c
    83 +++ b/block/genhd.c
    84 @@ -159,14 +159,17 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter)
    85 part = rcu_dereference(ptbl->part[piter->idx]);
    86 if (!part)
    87 continue;
    88 + get_device(part_to_dev(part));
    89 + piter->part = part;
    90 if (!part_nr_sects_read(part) &&
    91 !(piter->flags & DISK_PITER_INCL_EMPTY) &&
    92 !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
    93 - piter->idx == 0))
    94 + piter->idx == 0)) {
    95 + put_device(part_to_dev(part));
    96 + piter->part = NULL;
    97 continue;
    98 + }
    99
    100 - get_device(part_to_dev(part));
    101 - piter->part = part;
    102 piter->idx += inc;
    103 break;
    104 }
    105 diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
    106 index 39dd30b6ef86e..894102fd5a069 100644
    107 --- a/drivers/block/Kconfig
    108 +++ b/drivers/block/Kconfig
    109 @@ -530,6 +530,7 @@ config BLK_DEV_RBD
    110 config BLK_DEV_RSXX
    111 tristate "IBM Flash Adapter 900GB Full Height PCIe Device Driver"
    112 depends on PCI
    113 + select CRC32
    114 help
    115 Device driver for IBM's high speed PCIe SSD
    116 storage device: Flash Adapter 900GB Full Height.
    117 diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
    118 index 0b5bf135b0907..59f16807921ad 100644
    119 --- a/drivers/cpufreq/powernow-k8.c
    120 +++ b/drivers/cpufreq/powernow-k8.c
    121 @@ -887,9 +887,9 @@ static int get_transition_latency(struct powernow_k8_data *data)
    122
    123 /* Take a frequency, and issue the fid/vid transition command */
    124 static int transition_frequency_fidvid(struct powernow_k8_data *data,
    125 - unsigned int index)
    126 + unsigned int index,
    127 + struct cpufreq_policy *policy)
    128 {
    129 - struct cpufreq_policy *policy;
    130 u32 fid = 0;
    131 u32 vid = 0;
    132 int res;
    133 @@ -921,9 +921,6 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data,
    134 freqs.old = find_khz_freq_from_fid(data->currfid);
    135 freqs.new = find_khz_freq_from_fid(fid);
    136
    137 - policy = cpufreq_cpu_get(smp_processor_id());
    138 - cpufreq_cpu_put(policy);
    139 -
    140 cpufreq_freq_transition_begin(policy, &freqs);
    141 res = transition_fid_vid(data, fid, vid);
    142 cpufreq_freq_transition_end(policy, &freqs, res);
    143 @@ -978,7 +975,7 @@ static long powernowk8_target_fn(void *arg)
    144
    145 powernow_k8_acpi_pst_values(data, newstate);
    146
    147 - ret = transition_frequency_fidvid(data, newstate);
    148 + ret = transition_frequency_fidvid(data, newstate, pol);
    149
    150 if (ret) {
    151 pr_err("transition frequency failed\n");
    152 diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
    153 index ef99ef0bb1ca2..f00652585ee31 100644
    154 --- a/drivers/dma/xilinx/xilinx_dma.c
    155 +++ b/drivers/dma/xilinx/xilinx_dma.c
    156 @@ -2357,7 +2357,7 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
    157 has_dre = false;
    158
    159 if (!has_dre)
    160 - xdev->common.copy_align = fls(width - 1);
    161 + xdev->common.copy_align = (enum dmaengine_alignment)fls(width - 1);
    162
    163 if (of_device_is_compatible(node, "xlnx,axi-vdma-mm2s-channel") ||
    164 of_device_is_compatible(node, "xlnx,axi-dma-mm2s-channel") ||
    165 @@ -2630,7 +2630,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
    166 }
    167
    168 /* Register the DMA engine with the core */
    169 - dma_async_device_register(&xdev->common);
    170 + err = dma_async_device_register(&xdev->common);
    171 + if (err) {
    172 + dev_err(xdev->dev, "failed to register the dma device\n");
    173 + goto error;
    174 + }
    175
    176 err = of_dma_controller_register(node, of_dma_xilinx_xlate,
    177 xdev);
    178 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    179 index 4548d89abcdc3..ff8168c60b35a 100644
    180 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    181 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    182 @@ -882,7 +882,7 @@ eb_vma_misplaced(struct i915_vma *vma)
    183 return !only_mappable_for_reloc(entry->flags);
    184
    185 if ((entry->flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) == 0 &&
    186 - (vma->node.start + vma->node.size - 1) >> 32)
    187 + (vma->node.start + vma->node.size + 4095) >> 32)
    188 return true;
    189
    190 return false;
    191 diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
    192 index ce125ec23d2a5..88ba1a65c2830 100644
    193 --- a/drivers/iommu/intel_irq_remapping.c
    194 +++ b/drivers/iommu/intel_irq_remapping.c
    195 @@ -1350,6 +1350,8 @@ static int intel_irq_remapping_alloc(struct irq_domain *domain,
    196 irq_data = irq_domain_get_irq_data(domain, virq + i);
    197 irq_cfg = irqd_cfg(irq_data);
    198 if (!irq_data || !irq_cfg) {
    199 + if (!i)
    200 + kfree(data);
    201 ret = -EINVAL;
    202 goto out_free_data;
    203 }
    204 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
    205 index 8cd7227fbdfce..3dd0bc8804c1a 100644
    206 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
    207 +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
    208 @@ -930,6 +930,7 @@ err_destroy_groups:
    209 ft->g[ft->num_groups] = NULL;
    210 mlx5e_destroy_groups(ft);
    211 kvfree(in);
    212 + kfree(ft->g);
    213
    214 return err;
    215 }
    216 diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
    217 index 4e9fe75d70675..069f933b0add2 100644
    218 --- a/drivers/net/wan/Kconfig
    219 +++ b/drivers/net/wan/Kconfig
    220 @@ -295,6 +295,7 @@ config SLIC_DS26522
    221 tristate "Slic Maxim ds26522 card support"
    222 depends on SPI
    223 depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE || COMPILE_TEST
    224 + select BITREVERSE
    225 help
    226 This module initializes and configures the slic maxim card
    227 in T1 or E1 mode.
    228 diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
    229 index 6dfedc8bd6a3d..7df13a684d2df 100644
    230 --- a/drivers/net/wireless/ath/wil6210/Kconfig
    231 +++ b/drivers/net/wireless/ath/wil6210/Kconfig
    232 @@ -1,6 +1,7 @@
    233 config WIL6210
    234 tristate "Wilocity 60g WiFi card wil6210 support"
    235 select WANT_DEV_COREDUMP
    236 + select CRC32
    237 depends on CFG80211
    238 depends on PCI
    239 default n
    240 diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
    241 index da3834fe5e570..9bb6a574ab2fe 100644
    242 --- a/drivers/spi/spi-pxa2xx.c
    243 +++ b/drivers/spi/spi-pxa2xx.c
    244 @@ -1606,7 +1606,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
    245 return -ENODEV;
    246 }
    247
    248 - master = spi_alloc_master(dev, sizeof(struct driver_data));
    249 + master = devm_spi_alloc_master(dev, sizeof(*drv_data));
    250 if (!master) {
    251 dev_err(&pdev->dev, "cannot alloc spi_master\n");
    252 pxa_ssp_free(ssp);
    253 @@ -1788,7 +1788,6 @@ out_error_clock_enabled:
    254 free_irq(ssp->irq, drv_data);
    255
    256 out_error_master_alloc:
    257 - spi_master_put(master);
    258 pxa_ssp_free(ssp);
    259 return status;
    260 }
    261 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    262 index e738b4621cbba..ecd707f74ddcb 100644
    263 --- a/drivers/target/target_core_transport.c
    264 +++ b/drivers/target/target_core_transport.c
    265 @@ -1736,6 +1736,10 @@ void transport_generic_request_failure(struct se_cmd *cmd,
    266 case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
    267 case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
    268 case TCM_COPY_TARGET_DEVICE_NOT_REACHABLE:
    269 + case TCM_TOO_MANY_TARGET_DESCS:
    270 + case TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE:
    271 + case TCM_TOO_MANY_SEGMENT_DESCS:
    272 + case TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE:
    273 break;
    274 case TCM_OUT_OF_RESOURCES:
    275 sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
    276 @@ -2886,6 +2890,26 @@ static const struct sense_info sense_info_table[] = {
    277 .key = ILLEGAL_REQUEST,
    278 .asc = 0x26, /* INVALID FIELD IN PARAMETER LIST */
    279 },
    280 + [TCM_TOO_MANY_TARGET_DESCS] = {
    281 + .key = ILLEGAL_REQUEST,
    282 + .asc = 0x26,
    283 + .ascq = 0x06, /* TOO MANY TARGET DESCRIPTORS */
    284 + },
    285 + [TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE] = {
    286 + .key = ILLEGAL_REQUEST,
    287 + .asc = 0x26,
    288 + .ascq = 0x07, /* UNSUPPORTED TARGET DESCRIPTOR TYPE CODE */
    289 + },
    290 + [TCM_TOO_MANY_SEGMENT_DESCS] = {
    291 + .key = ILLEGAL_REQUEST,
    292 + .asc = 0x26,
    293 + .ascq = 0x08, /* TOO MANY SEGMENT DESCRIPTORS */
    294 + },
    295 + [TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE] = {
    296 + .key = ILLEGAL_REQUEST,
    297 + .asc = 0x26,
    298 + .ascq = 0x09, /* UNSUPPORTED SEGMENT DESCRIPTOR TYPE CODE */
    299 + },
    300 [TCM_PARAMETER_LIST_LENGTH_ERROR] = {
    301 .key = ILLEGAL_REQUEST,
    302 .asc = 0x1a, /* PARAMETER LIST LENGTH ERROR */
    303 diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
    304 index 18848ba8d2ba0..84e3bf1132fd5 100644
    305 --- a/drivers/target/target_core_xcopy.c
    306 +++ b/drivers/target/target_core_xcopy.c
    307 @@ -52,64 +52,87 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
    308 return 0;
    309 }
    310
    311 -static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
    312 - bool src)
    313 +/**
    314 + * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
    315 + *
    316 + * @se_dev: device being considered for match
    317 + * @dev_wwn: XCOPY requested NAA dev_wwn
    318 + * @return: 1 on match, 0 on no-match
    319 + */
    320 +static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
    321 + const unsigned char *dev_wwn)
    322 {
    323 - struct se_device *se_dev;
    324 - unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN], *dev_wwn;
    325 + unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
    326 int rc;
    327
    328 - if (src)
    329 - dev_wwn = &xop->dst_tid_wwn[0];
    330 - else
    331 - dev_wwn = &xop->src_tid_wwn[0];
    332 -
    333 - mutex_lock(&g_device_mutex);
    334 - list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
    335 -
    336 - if (!se_dev->dev_attrib.emulate_3pc)
    337 - continue;
    338 + if (!se_dev->dev_attrib.emulate_3pc) {
    339 + pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
    340 + return 0;
    341 + }
    342
    343 - memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
    344 - target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
    345 + memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
    346 + target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
    347
    348 - rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
    349 - if (rc != 0)
    350 - continue;
    351 + rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
    352 + if (rc != 0) {
    353 + pr_debug("XCOPY: skip non-matching: %*ph\n",
    354 + XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn);
    355 + return 0;
    356 + }
    357 + pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
    358
    359 - if (src) {
    360 - xop->dst_dev = se_dev;
    361 - pr_debug("XCOPY 0xe4: Setting xop->dst_dev: %p from located"
    362 - " se_dev\n", xop->dst_dev);
    363 - } else {
    364 - xop->src_dev = se_dev;
    365 - pr_debug("XCOPY 0xe4: Setting xop->src_dev: %p from located"
    366 - " se_dev\n", xop->src_dev);
    367 - }
    368 + return 1;
    369 +}
    370
    371 - rc = target_depend_item(&se_dev->dev_group.cg_item);
    372 - if (rc != 0) {
    373 - pr_err("configfs_depend_item attempt failed:"
    374 - " %d for se_dev: %p\n", rc, se_dev);
    375 - mutex_unlock(&g_device_mutex);
    376 - return rc;
    377 +static int target_xcopy_locate_se_dev_e4(struct se_session *sess,
    378 + const unsigned char *dev_wwn,
    379 + struct se_device **_found_dev,
    380 + struct percpu_ref **_found_lun_ref)
    381 +{
    382 + struct se_dev_entry *deve;
    383 + struct se_node_acl *nacl;
    384 + struct se_lun *this_lun = NULL;
    385 + struct se_device *found_dev = NULL;
    386 +
    387 + /* cmd with NULL sess indicates no associated $FABRIC_MOD */
    388 + if (!sess)
    389 + goto err_out;
    390 +
    391 + pr_debug("XCOPY 0xe4: searching for: %*ph\n",
    392 + XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn);
    393 +
    394 + nacl = sess->se_node_acl;
    395 + rcu_read_lock();
    396 + hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) {
    397 + struct se_device *this_dev;
    398 + int rc;
    399 +
    400 + this_lun = rcu_dereference(deve->se_lun);
    401 + this_dev = rcu_dereference_raw(this_lun->lun_se_dev);
    402 +
    403 + rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn);
    404 + if (rc) {
    405 + if (percpu_ref_tryget_live(&this_lun->lun_ref))
    406 + found_dev = this_dev;
    407 + break;
    408 }
    409 -
    410 - pr_debug("Called configfs_depend_item for se_dev: %p"
    411 - " se_dev->se_dev_group: %p\n", se_dev,
    412 - &se_dev->dev_group);
    413 -
    414 - mutex_unlock(&g_device_mutex);
    415 - return 0;
    416 }
    417 - mutex_unlock(&g_device_mutex);
    418 -
    419 + rcu_read_unlock();
    420 + if (found_dev == NULL)
    421 + goto err_out;
    422 +
    423 + pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n",
    424 + found_dev, &found_dev->dev_group);
    425 + *_found_dev = found_dev;
    426 + *_found_lun_ref = &this_lun->lun_ref;
    427 + return 0;
    428 +err_out:
    429 pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
    430 return -EINVAL;
    431 }
    432
    433 static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
    434 - unsigned char *p, bool src)
    435 + unsigned char *p, unsigned short cscd_index)
    436 {
    437 unsigned char *desc = p;
    438 unsigned short ript;
    439 @@ -154,7 +177,13 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
    440 return -EINVAL;
    441 }
    442
    443 - if (src) {
    444 + if (cscd_index != xop->stdi && cscd_index != xop->dtdi) {
    445 + pr_debug("XCOPY 0xe4: ignoring CSCD entry %d - neither src nor "
    446 + "dest\n", cscd_index);
    447 + return 0;
    448 + }
    449 +
    450 + if (cscd_index == xop->stdi) {
    451 memcpy(&xop->src_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
    452 /*
    453 * Determine if the source designator matches the local device
    454 @@ -166,10 +195,15 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
    455 pr_debug("XCOPY 0xe4: Set xop->src_dev %p from source"
    456 " received xop\n", xop->src_dev);
    457 }
    458 - } else {
    459 + }
    460 +
    461 + if (cscd_index == xop->dtdi) {
    462 memcpy(&xop->dst_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
    463 /*
    464 - * Determine if the destination designator matches the local device
    465 + * Determine if the destination designator matches the local
    466 + * device. If @cscd_index corresponds to both source (stdi) and
    467 + * destination (dtdi), or dtdi comes after stdi, then
    468 + * XCOL_DEST_RECV_OP wins.
    469 */
    470 if (!memcmp(&xop->local_dev_wwn[0], &xop->dst_tid_wwn[0],
    471 XCOPY_NAA_IEEE_REGEX_LEN)) {
    472 @@ -189,9 +223,9 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
    473 {
    474 struct se_device *local_dev = se_cmd->se_dev;
    475 unsigned char *desc = p;
    476 - int offset = tdll % XCOPY_TARGET_DESC_LEN, rc, ret = 0;
    477 + int offset = tdll % XCOPY_TARGET_DESC_LEN, rc;
    478 + unsigned short cscd_index = 0;
    479 unsigned short start = 0;
    480 - bool src = true;
    481
    482 *sense_ret = TCM_INVALID_PARAMETER_LIST;
    483
    484 @@ -214,25 +248,19 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
    485
    486 while (start < tdll) {
    487 /*
    488 - * Check target descriptor identification with 0xE4 type with
    489 - * use VPD 0x83 WWPN matching ..
    490 + * Check target descriptor identification with 0xE4 type, and
    491 + * compare the current index with the CSCD descriptor IDs in
    492 + * the segment descriptor. Use VPD 0x83 WWPN matching ..
    493 */
    494 switch (desc[0]) {
    495 case 0xe4:
    496 rc = target_xcopy_parse_tiddesc_e4(se_cmd, xop,
    497 - &desc[0], src);
    498 + &desc[0], cscd_index);
    499 if (rc != 0)
    500 goto out;
    501 - /*
    502 - * Assume target descriptors are in source -> destination order..
    503 - */
    504 - if (src)
    505 - src = false;
    506 - else
    507 - src = true;
    508 start += XCOPY_TARGET_DESC_LEN;
    509 desc += XCOPY_TARGET_DESC_LEN;
    510 - ret++;
    511 + cscd_index++;
    512 break;
    513 default:
    514 pr_err("XCOPY unsupported descriptor type code:"
    515 @@ -241,10 +269,25 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
    516 }
    517 }
    518
    519 - if (xop->op_origin == XCOL_SOURCE_RECV_OP)
    520 - rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, true);
    521 - else
    522 - rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, false);
    523 + switch (xop->op_origin) {
    524 + case XCOL_SOURCE_RECV_OP:
    525 + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
    526 + xop->dst_tid_wwn,
    527 + &xop->dst_dev,
    528 + &xop->remote_lun_ref);
    529 + break;
    530 + case XCOL_DEST_RECV_OP:
    531 + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
    532 + xop->src_tid_wwn,
    533 + &xop->src_dev,
    534 + &xop->remote_lun_ref);
    535 + break;
    536 + default:
    537 + pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - "
    538 + "stdi: %hu dtdi: %hu\n", xop->stdi, xop->dtdi);
    539 + rc = -EINVAL;
    540 + break;
    541 + }
    542 /*
    543 * If a matching IEEE NAA 0x83 descriptor for the requested device
    544 * is not located on this node, return COPY_ABORTED with ASQ/ASQC
    545 @@ -261,7 +304,7 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
    546 pr_debug("XCOPY TGT desc: Dest dev: %p NAA IEEE WWN: 0x%16phN\n",
    547 xop->dst_dev, &xop->dst_tid_wwn[0]);
    548
    549 - return ret;
    550 + return cscd_index;
    551
    552 out:
    553 return -EINVAL;
    554 @@ -305,17 +348,26 @@ static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op
    555
    556 static int target_xcopy_parse_segment_descriptors(struct se_cmd *se_cmd,
    557 struct xcopy_op *xop, unsigned char *p,
    558 - unsigned int sdll)
    559 + unsigned int sdll, sense_reason_t *sense_ret)
    560 {
    561 unsigned char *desc = p;
    562 unsigned int start = 0;
    563 int offset = sdll % XCOPY_SEGMENT_DESC_LEN, rc, ret = 0;
    564
    565 + *sense_ret = TCM_INVALID_PARAMETER_LIST;
    566 +
    567 if (offset != 0) {
    568 pr_err("XCOPY segment descriptor list length is not"
    569 " multiple of %d\n", XCOPY_SEGMENT_DESC_LEN);
    570 return -EINVAL;
    571 }
    572 + if (sdll > RCR_OP_MAX_SG_DESC_COUNT * XCOPY_SEGMENT_DESC_LEN) {
    573 + pr_err("XCOPY supports %u segment descriptor(s), sdll: %u too"
    574 + " large..\n", RCR_OP_MAX_SG_DESC_COUNT, sdll);
    575 + /* spc4r37 6.4.3.5 SEGMENT DESCRIPTOR LIST LENGTH field */
    576 + *sense_ret = TCM_TOO_MANY_SEGMENT_DESCS;
    577 + return -EINVAL;
    578 + }
    579
    580 while (start < sdll) {
    581 /*
    582 @@ -372,18 +424,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd)
    583
    584 static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop)
    585 {
    586 - struct se_device *remote_dev;
    587 -
    588 if (xop->op_origin == XCOL_SOURCE_RECV_OP)
    589 - remote_dev = xop->dst_dev;
    590 + pr_debug("putting dst lun_ref for %p\n", xop->dst_dev);
    591 else
    592 - remote_dev = xop->src_dev;
    593 + pr_debug("putting src lun_ref for %p\n", xop->src_dev);
    594
    595 - pr_debug("Calling configfs_undepend_item for"
    596 - " remote_dev: %p remote_dev->dev_group: %p\n",
    597 - remote_dev, &remote_dev->dev_group.cg_item);
    598 -
    599 - target_undepend_item(&remote_dev->dev_group.cg_item);
    600 + percpu_ref_put(xop->remote_lun_ref);
    601 }
    602
    603 static void xcopy_pt_release_cmd(struct se_cmd *se_cmd)
    604 @@ -893,6 +939,20 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
    605 " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
    606 tdll, sdll, inline_dl);
    607
    608 + /*
    609 + * skip over the target descriptors until segment descriptors
    610 + * have been passed - CSCD ids are needed to determine src and dest.
    611 + */
    612 + seg_desc = &p[16] + tdll;
    613 +
    614 + rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc,
    615 + sdll, &ret);
    616 + if (rc <= 0)
    617 + goto out;
    618 +
    619 + pr_debug("XCOPY: Processed %d segment descriptors, length: %u\n", rc,
    620 + rc * XCOPY_SEGMENT_DESC_LEN);
    621 +
    622 rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
    623 if (rc <= 0)
    624 goto out;
    625 @@ -910,18 +970,8 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
    626
    627 pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
    628 rc * XCOPY_TARGET_DESC_LEN);
    629 - seg_desc = &p[16];
    630 - seg_desc += (rc * XCOPY_TARGET_DESC_LEN);
    631 -
    632 - rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc, sdll);
    633 - if (rc <= 0) {
    634 - xcopy_pt_undepend_remotedev(xop);
    635 - goto out;
    636 - }
    637 transport_kunmap_data_sg(se_cmd);
    638
    639 - pr_debug("XCOPY: Processed %d segment descriptors, length: %u\n", rc,
    640 - rc * XCOPY_SEGMENT_DESC_LEN);
    641 INIT_WORK(&xop->xop_work, target_xcopy_do_work);
    642 queue_work(xcopy_wq, &xop->xop_work);
    643 return TCM_NO_SENSE;
    644 diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h
    645 index 700a981c7b415..7db8d0c9223f8 100644
    646 --- a/drivers/target/target_core_xcopy.h
    647 +++ b/drivers/target/target_core_xcopy.h
    648 @@ -19,6 +19,7 @@ struct xcopy_op {
    649 struct se_device *dst_dev;
    650 unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
    651 unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
    652 + struct percpu_ref *remote_lun_ref;
    653
    654 sector_t src_lba;
    655 sector_t dst_lba;
    656 diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
    657 index 9213a9e046ae0..99caaae01caba 100644
    658 --- a/fs/ubifs/io.c
    659 +++ b/fs/ubifs/io.c
    660 @@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad)
    661 {
    662 uint32_t crc;
    663
    664 - ubifs_assert(pad >= 0 && !(pad & 7));
    665 + ubifs_assert(pad >= 0);
    666
    667 if (pad >= UBIFS_PAD_NODE_SZ) {
    668 struct ubifs_ch *ch = buf;
    669 @@ -721,6 +721,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
    670 * write-buffer.
    671 */
    672 memcpy(wbuf->buf + wbuf->used, buf, len);
    673 + if (aligned_len > len) {
    674 + ubifs_assert(aligned_len - len < 8);
    675 + ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
    676 + }
    677
    678 if (aligned_len == wbuf->avail) {
    679 dbg_io("flush jhead %s wbuf to LEB %d:%d",
    680 @@ -813,13 +817,18 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
    681 }
    682
    683 spin_lock(&wbuf->lock);
    684 - if (aligned_len)
    685 + if (aligned_len) {
    686 /*
    687 * And now we have what's left and what does not take whole
    688 * max. write unit, so write it to the write-buffer and we are
    689 * done.
    690 */
    691 memcpy(wbuf->buf, buf + written, len);
    692 + if (aligned_len > len) {
    693 + ubifs_assert(aligned_len - len < 8);
    694 + ubifs_pad(c, wbuf->buf + len, aligned_len - len);
    695 + }
    696 + }
    697
    698 if (c->leb_size - wbuf->offs >= c->max_write_size)
    699 wbuf->size = c->max_write_size;
    700 diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
    701 index 4fdb1d9848444..36198563fb8bc 100644
    702 --- a/include/asm-generic/vmlinux.lds.h
    703 +++ b/include/asm-generic/vmlinux.lds.h
    704 @@ -460,7 +460,10 @@
    705 */
    706 #define TEXT_TEXT \
    707 ALIGN_FUNCTION(); \
    708 - *(.text.hot TEXT_MAIN .text.fixup .text.unlikely) \
    709 + *(.text.hot .text.hot.*) \
    710 + *(TEXT_MAIN .text.fixup) \
    711 + *(.text.unlikely .text.unlikely.*) \
    712 + *(.text.unknown .text.unknown.*) \
    713 *(.ref.text) \
    714 MEM_KEEP(init.text) \
    715 MEM_KEEP(exit.text) \
    716 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
    717 index 30f99ce4c6cea..8a70d38f13329 100644
    718 --- a/include/target/target_core_base.h
    719 +++ b/include/target/target_core_base.h
    720 @@ -178,6 +178,10 @@ enum tcm_sense_reason_table {
    721 TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED = R(0x16),
    722 TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED = R(0x17),
    723 TCM_COPY_TARGET_DEVICE_NOT_REACHABLE = R(0x18),
    724 + TCM_TOO_MANY_TARGET_DESCS = R(0x19),
    725 + TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE = R(0x1a),
    726 + TCM_TOO_MANY_SEGMENT_DESCS = R(0x1b),
    727 + TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE = R(0x1c),
    728 #undef R
    729 };
    730
    731 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    732 index a4c4234976862..026f4525063c1 100644
    733 --- a/net/core/skbuff.c
    734 +++ b/net/core/skbuff.c
    735 @@ -1592,6 +1592,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)
    736 skb->csum = csum_block_sub(skb->csum,
    737 skb_checksum(skb, len, delta, 0),
    738 len);
    739 + } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
    740 + int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
    741 + int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
    742 +
    743 + if (offset + sizeof(__sum16) > hdlen)
    744 + return -EINVAL;
    745 }
    746 return __pskb_trim(skb, len);
    747 }
    748 diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    749 index c37e9598262e5..3164bae4024a4 100644
    750 --- a/net/ipv4/ip_output.c
    751 +++ b/net/ipv4/ip_output.c
    752 @@ -300,7 +300,7 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk
    753 if (skb_is_gso(skb))
    754 return ip_finish_output_gso(net, sk, skb, mtu);
    755
    756 - if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
    757 + if (skb->len > mtu || IPCB(skb)->frag_max_size)
    758 return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
    759
    760 return ip_finish_output2(net, sk, skb);
    761 diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
    762 index 5f2e3334cccec..26e1dbc958189 100644
    763 --- a/net/ipv4/ip_tunnel.c
    764 +++ b/net/ipv4/ip_tunnel.c
    765 @@ -743,7 +743,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
    766 goto tx_error;
    767 }
    768
    769 - if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
    770 + df = tnl_params->frag_off;
    771 + if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
    772 + df |= (inner_iph->frag_off & htons(IP_DF));
    773 +
    774 + if (tnl_update_pmtu(dev, skb, rt, df, inner_iph)) {
    775 ip_rt_put(rt);
    776 goto tx_error;
    777 }
    778 @@ -771,10 +775,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
    779 ttl = ip4_dst_hoplimit(&rt->dst);
    780 }
    781
    782 - df = tnl_params->frag_off;
    783 - if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
    784 - df |= (inner_iph->frag_off&htons(IP_DF));
    785 -
    786 max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
    787 + rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
    788 if (max_headroom > dev->needed_headroom)