Merge branch 'android-4.4@b834e92' into branch 'msm-4.4'

* refs/heads/tmp-b834e92
  Revert "USB: gadget: u_ether: Fix data stall issue in RNDIS tethering mode"
  Linux 4.4.63
  MIPS: fix Select HAVE_IRQ_EXIT_ON_IRQ_STACK patch.
  sctp: deny peeloff operation on asocs with threads sleeping on it
  net: ipv6: check route protocol when deleting routes
  tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done
  SUNRPC: fix refcounting problems with auth_gss messages.
  ibmveth: calculate gso_segs for large packets
  catc: Use heap buffer for memory size test
  catc: Combine failure cleanup code in catc_probe()
  rtl8150: Use heap buffers for all register access
  pegasus: Use heap buffers for all register access
  virtio-console: avoid DMA from stack
  dvb-usb-firmware: don't do DMA on stack
  dvb-usb: don't use stack for firmware load
  mm: Tighten x86 /dev/mem with zeroing reads
  rtc: tegra: Implement clock handling
  platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event
  ext4: fix inode checksum calculation problem if i_extra_size is small
  dvb-usb-v2: avoid use-after-free
  ath9k: fix NULL pointer dereference
  crypto: ahash - Fix EINPROGRESS notification callback
  powerpc: Disable HFSCR[TM] if TM is not supported
  zram: do not use copy_page with non-page aligned address
  kvm: fix page struct leak in handle_vmon
  Revert "MIPS: Lantiq: Fix cascaded IRQ setup"
  char: lack of bool string made CONFIG_DEVPORT always on
  char: Drop bogus dependency of DEVPORT on !M68K
  ftrace: Fix removing of second function probe
  irqchip/irq-imx-gpcv2: Fix spinlock initialization
  libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
  xen, fbfront: fix connecting to backend
  scsi: sd: Fix capacity calculation with 32-bit sector_t
  scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
  scsi: sr: Sanity check returned mode data
  iscsi-target: Drop work-around for legacy GlobalSAN initiator
  iscsi-target: Fix TMR reference leak during session shutdown
  acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
  x86/vdso: Plug race between mapping and ELF header setup
  x86/vdso: Ensure vdso32_enabled gets set to valid values only
  perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
  Input: xpad - add support for Razer Wildcat gamepad
  CIFS: store results of cifs_reopen_file to avoid infinite wait
  drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one
  drm/nouveau/mpeg: mthd returns true on success now
  thp: fix MADV_DONTNEED vs clear soft dirty race
  cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
  ANDROID: uid_sys_stats: reduce update_io_stats overhead
  UPSTREAM: char: lack of bool string made CONFIG_DEVPORT always on
  UPSTREAM: char: Drop bogus dependency of DEVPORT on !M68K
  Revert "Android: sdcardfs: Don't do d_add for lower fs"
  ANDROID: usb: gadget: fix MTP enumeration issue under super speed mode
  Android: sdcardfs: Don't complain in fixup_lower_ownership
  Android: sdcardfs: Don't do d_add for lower fs
  ANDROID: sdcardfs: ->iget fixes
  Android: sdcardfs: Change cache GID value
  BACKPORT: [UPSTREAM] ext2: convert to mbcache2
  BACKPORT [UPSTREAM] ext4: convert to mbcache2
  BACKPORT: [UPSTREAM] mbcache2: reimplement mbcache
  Linux 4.4.62
  ibmveth: set correct gso_size and gso_type
  net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions
  net/mlx4_core: Fix racy CQ (Completion Queue) free
  net/mlx4_en: Fix bad WQE issue
  usb: hub: Wait for connection to be reestablished after port reset
  blk-mq: Avoid memory reclaim when remapping queues
  net/packet: fix overflow in check for priv area size
  crypto: caam - fix RNG deinstantiation error checking
  MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
  MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
  MIPS: Switch to the irq_stack in interrupts
  MIPS: Only change $28 to thread_info if coming from user mode
  MIPS: Stack unwinding while on IRQ stack
  MIPS: Introduce irq_stack
  mtd: bcm47xxpart: fix parsing first block after aligned TRX
  usb: dwc3: gadget: delay unmap of bounced requests
  drm/i915: Stop using RP_DOWN_EI on Baytrail
  drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
  UPSTREAM: net: socket: Make unnecessarily global sockfs_setattr() static
  UPSTREAM: net: ipv4: Don't crash if passing a null sk to ip_do_redirect.
  UPSTREAM: net/packet: fix overflow in check for priv area size
  Linux 4.4.61
  mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
  MIPS: Flush wrong invalid FTLB entry for huge page
  MIPS: Lantiq: fix missing xbar kernel panic
  MIPS: End spinlocks with .insn
  MIPS: ralink: Fix typos in rt3883 pinctrl
  MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
  s390/uaccess: get_user() should zero on failure (again)
  s390/decompressor: fix initrd corruption caused by bss clear
  nios2: reserve boot memory for device tree
  powerpc: Don't try to fix up misaligned load-with-reservation instructions
  powerpc/mm: Add missing global TLB invalidate if cxl is active
  metag/usercopy: Add missing fixups
  metag/usercopy: Fix src fixup in from user rapf loops
  metag/usercopy: Set flags before ADDZ
  metag/usercopy: Zero rest of buffer from copy_from_user
  metag/usercopy: Add early abort to copy_to_user
  metag/usercopy: Fix alignment error checking
  metag/usercopy: Drop unused macros
  ring-buffer: Fix return value check in test_ringbuffer()
  ptrace: fix PTRACE_LISTEN race corrupting task->state
  Reset TreeId to zero on SMB2 TREE_CONNECT
  iio: bmg160: reset chip when probing
  arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
  arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
  staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
  sysfs: be careful of error returns from ops->show()
  drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
  drm/vmwgfx: Remove getparam error message
  drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
  drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
  drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
  drm/vmwgfx: Type-check lookups of fence objects
  Revert "Revert "Revert "CHROMIUM: android: binder: Fix potential scheduling-while-atomic"""
  ANDROID: sdcardfs: Directly pass lower file for mmap
  UPSTREAM: checkpatch: special audit for revert commit line
  UPSTREAM: PM / sleep: make PM notifiers called symmetrically
  Revert "Revert "CHROMIUM: android: binder: Fix potential scheduling-while-atomic""
  Linux 4.4.60
  padata: avoid race in reordering
  blk: Ensure users for current->bio_list can see the full list.
  blk: improve order of bio handling in generic_make_request()
  power: reset: at91-poweroff: timely shutdown LPDDR memories
  KVM: kvm_io_bus_unregister_dev() should never fail
  rtc: s35390a: improve irq handling
  rtc: s35390a: implement reset routine as suggested by the reference
  rtc: s35390a: make sure all members in the output are set
  rtc: s35390a: fix reading out alarm
  MIPS: Lantiq: Fix cascaded IRQ setup
  mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()
  drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
  KVM: x86: clear bus pointer when destroyed
  USB: fix linked-list corruption in rh_call_control()
  tty/serial: atmel: fix TX path in atmel_console_write()
  tty/serial: atmel: fix race condition (TX+DMA)
  ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
  ACPI: Fix incompatibility with mcount-based function graph tracing
  ASoC: atmel-classd: fix audio clock rate
  ALSA: hda - fix a problem for lineout on a Dell AIO machine
  ALSA: seq: Fix race during FIFO resize
  scsi: libsas: fix ata xfer length
  scsi: sg: check length passed to SG_NEXT_CMD_LEN
  scsi: mpt3sas: fix hang on ata passthrough commands
  xen/setup: Don't relocate p2m over existing one
  libceph: force GFP_NOIO for socket allocations
  Linux 4.4.59
  sched/rt: Add a missing rescheduling point
  fscrypt: remove broken support for detecting keyring key revocation
  metag/ptrace: Reject partial NT_METAG_RPIPE writes
  metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
  metag/ptrace: Preserve previous registers for short regset write
  sparc/ptrace: Preserve previous registers for short regset write
  mips/ptrace: Preserve previous registers for short regset write
  h8300/ptrace: Fix incorrect register transfer count
  c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
  pinctrl: qcom: Don't clear status bit on irq_unmask
  virtio_balloon: init 1st buffer in stats vq
  xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
  xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
  xfrm: policy: init locks early

Conflicts:
	drivers/scsi/sd.c
	drivers/usb/gadget/function/f_mtp.c
	drivers/usb/gadget/function/u_ether.c

Change-Id: I80501cf02d04204f8c0f3a7f5a036eaa4d54546e
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

3 files changed, 66 insertions, 34 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 8e3bff9c7fe9..fd75deefe28c 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -585,10 +585,12 @@ config TELCLOCK
 	  controlling the behavior of this hardware.
 
 config DEVPORT
-	bool
-	depends on !M68K
+	bool "/dev/port character device"
 	depends on ISA || PCI
 	default y
+	help
+	  Say Y here if you want to support the /dev/port device. The /dev/port
+	  device is similar to /dev/mem, but for I/O ports.
 
 source "drivers/s390/char/Kconfig"
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6b1721f978c2..e901463d4972 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -59,6 +59,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
 #endif
 
 #ifdef CONFIG_STRICT_DEVMEM
+static inline int page_is_allowed(unsigned long pfn)
+{
+	return devmem_is_allowed(pfn);
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
 	u64 from = ((u64)pfn) << PAGE_SHIFT;
@@ -78,6 +82,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 	return 1;
 }
 #else
+static inline int page_is_allowed(unsigned long pfn)
+{
+	return 1;
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
 	return 1;
@@ -125,23 +133,31 @@ static ssize_t read_mem(struct file *file, char __user *buf,
 
 	while (count > 0) {
 		unsigned long remaining;
+		int allowed;
 
 		sz = size_inside_page(p, count);
 
-		if (!range_is_allowed(p >> PAGE_SHIFT, count))
+		allowed = page_is_allowed(p >> PAGE_SHIFT);
+		if (!allowed)
 			return -EPERM;
+		if (allowed == 2) {
+			/* Show zeros for restricted memory. */
+			remaining = clear_user(buf, sz);
+		} else {
+			/*
+			 * On ia64 if a page has been mapped somewhere as
+			 * uncached, then it must also be accessed uncached
+			 * by the kernel or data corruption may occur.
+			 */
+			ptr = xlate_dev_mem_ptr(p);
+			if (!ptr)
+				return -EFAULT;
 
-		/*
-		 * On ia64 if a page has been mapped somewhere as uncached, then
-		 * it must also be accessed uncached by the kernel or data
-		 * corruption may occur.
-		 */
-		ptr = xlate_dev_mem_ptr(p);
-		if (!ptr)
-			return -EFAULT;
+			remaining = copy_to_user(buf, ptr, sz);
+
+			unxlate_dev_mem_ptr(p, ptr);
+		}
 
-		remaining = copy_to_user(buf, ptr, sz);
-		unxlate_dev_mem_ptr(p, ptr);
 		if (remaining)
 			return -EFAULT;
 
@@ -184,30 +200,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
 #endif
 
 	while (count > 0) {
+		int allowed;
+
 		sz = size_inside_page(p, count);
 
-		if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+		allowed = page_is_allowed(p >> PAGE_SHIFT);
+		if (!allowed)
 			return -EPERM;
 
-		/*
-		 * On ia64 if a page has been mapped somewhere as uncached, then
-		 * it must also be accessed uncached by the kernel or data
-		 * corruption may occur.
-		 */
-		ptr = xlate_dev_mem_ptr(p);
-		if (!ptr) {
-			if (written)
-				break;
-			return -EFAULT;
-		}
+		/* Skip actual writing when a page is marked as restricted. */
+		if (allowed == 1) {
+			/*
+			 * On ia64 if a page has been mapped somewhere as
+			 * uncached, then it must also be accessed uncached
+			 * by the kernel or data corruption may occur.
+			 */
+			ptr = xlate_dev_mem_ptr(p);
+			if (!ptr) {
+				if (written)
+					break;
+				return -EFAULT;
+			}
 
-		copied = copy_from_user(ptr, buf, sz);
-		unxlate_dev_mem_ptr(p, ptr);
-		if (copied) {
-			written += sz - copied;
-			if (written)
-				break;
-			return -EFAULT;
+			copied = copy_from_user(ptr, buf, sz);
+			unxlate_dev_mem_ptr(p, ptr);
+			if (copied) {
+				written += sz - copied;
+				if (written)
+					break;
+				return -EFAULT;
+			}
 		}
 
 		buf += sz;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 090183f812be..31e8ae916ba0 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1130,6 +1130,8 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 {
 	struct port *port;
 	struct scatterlist sg[1];
+	void *data;
+	int ret;
 
 	if (unlikely(early_put_chars))
 		return early_put_chars(vtermno, buf, count);
@@ -1138,8 +1140,14 @@ static int put_chars(u32 vtermno, const char *buf, int count)
 	if (!port)
 		return -EPIPE;
 
-	sg_init_one(sg, buf, count);
-	return __send_to_port(port, sg, 1, count, (void *)buf, false);
+	data = kmemdup(buf, count, GFP_ATOMIC);
+	if (!data)
+		return -ENOMEM;
+
+	sg_init_one(sg, data, count);
+	ret = __send_to_port(port, sg, 1, count, data, false);
+	kfree(data);
+	return ret;
 }
 
 /*