Merge tag 'for-linus-4.16a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:
 "Five minor fixes for Xen-specific drivers"

* tag 'for-linus-4.16a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  pvcalls-front: 64-bit align flags
  x86/xen: add tty0 and hvc0 as preferred consoles for dom0
  xen-netfront: Fix hang on device removal
  xen/pirq: fix error path cleanup when binding MSIs
  xen/pvcalls: fix null pointer dereference on map->sock

4 files changed, 17 insertions, 7 deletions

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 8328d395e332..3127bc8633ca 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -2005,7 +2005,10 @@ static void netback_changed(struct xenbus_device *dev,
         case XenbusStateInitialised:
         case XenbusStateReconfiguring:
         case XenbusStateReconfigured:
+                break;
+
         case XenbusStateUnknown:
+                wake_up_all(&module_unload_q);
                 break;
 
         case XenbusStateInitWait:
@@ -2136,7 +2139,9 @@ static int xennet_remove(struct xenbus_device *dev)
                 xenbus_switch_state(dev, XenbusStateClosing);
                 wait_event(module_unload_q,
                            xenbus_read_driver_state(dev->otherend) ==
-                           XenbusStateClosing);
+                           XenbusStateClosing ||
+                           xenbus_read_driver_state(dev->otherend) ==
+                           XenbusStateUnknown);
 
                 xenbus_switch_state(dev, XenbusStateClosed);
                 wait_event(module_unload_q,
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 1ab4bd11f5f3..762378f1811c 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -755,8 +755,8 @@ out:
         mutex_unlock(&irq_mapping_update_lock);
         return irq;
 error_irq:
-        for (; i >= 0; i--)
-                __unbind_from_irq(irq + i);
+        while (nvec--)
+                __unbind_from_irq(irq + nvec);
         mutex_unlock(&irq_mapping_update_lock);
         return ret;
 }
diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
index 156e5aea36db..b1092fbefa63 100644
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -416,7 +416,7 @@ static int pvcalls_back_connect(struct xenbus_device *dev,
                                         sock);
         if (!map) {
                 ret = -EFAULT;
-                sock_release(map->sock);
+                sock_release(sock);
         }
 
 out:
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index aedbee3b2838..2f11ca72a281 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -73,20 +73,25 @@ struct sock_mapping {
                         wait_queue_head_t inflight_conn_req;
                 } active;
                 struct {
-                /* Socket status */
+                /*
+                 * Socket status, needs to be 64-bit aligned due to the
+                 * test_and_* functions which have this requirement on arm64.
+                 */
 #define PVCALLS_STATUS_UNINITALIZED  0
 #define PVCALLS_STATUS_BIND          1
 #define PVCALLS_STATUS_LISTEN        2
-                        uint8_t status;
+                        uint8_t status __attribute__((aligned(8)));
                 /*
                  * Internal state-machine flags.
                  * Only one accept operation can be inflight for a socket.
                  * Only one poll operation can be inflight for a given socket.
+                 * flags needs to be 64-bit aligned due to the test_and_*
+                 * functions which have this requirement on arm64.
                  */
 #define PVCALLS_FLAG_ACCEPT_INFLIGHT 0
 #define PVCALLS_FLAG_POLL_INFLIGHT   1
 #define PVCALLS_FLAG_POLL_RET        2
-                        uint8_t flags;
+                        uint8_t flags __attribute__((aligned(8)));
                         uint32_t inflight_req_id;
                         struct sock_mapping *accept_map;
                         wait_queue_head_t inflight_accept_req;