10 files changed, 396 insertions, 208 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 12327b2bb785..891155817bc6 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -50,6 +50,14 @@ config MAGIC_SYSRQ
           keys are documented in <file:Documentation/sysrq.txt>. Don't say Y
           unless you really know what this hack does.
 
+config STRIP_ASM_SYMS
+        bool "Strip assembler-generated symbols during link"
+        default n
+        help
+          Strip internal assembler-generated symbols during a link (symbols
+          that look like '.Lxxx') so they don't pollute the output of
+          get_wchan() and suchlike.
+
 config UNUSED_SYMBOLS
         bool "Enable unused/obsolete exported symbols"
         default y if X86
@@ -338,7 +346,7 @@ config SLUB_STATS
 
 config DEBUG_KMEMLEAK
         bool "Kernel memory leak detector"
-        depends on DEBUG_KERNEL && EXPERIMENTAL && (X86 || ARM) && \
+        depends on DEBUG_KERNEL && EXPERIMENTAL && (X86 || ARM || PPC) && \
                 !MEMORY_HOTPLUG
         select DEBUG_FS if SYSFS
         select STACKTRACE if STACKTRACE_SUPPORT
@@ -653,6 +661,21 @@ config DEBUG_NOTIFIERS
           This is a relatively cheap check but if you care about maximum
           performance, say N.
 
+config DEBUG_CREDENTIALS
+        bool "Debug credential management"
+        depends on DEBUG_KERNEL
+        help
+          Enable this to turn on some debug checking for credential
+          management.  The additional code keeps track of the number of
+          pointers from task_structs to any given cred struct, and checks to
+          see that this number never exceeds the usage count of the cred
+          struct.
+
+          Furthermore, if SELinux is enabled, this also checks that the
+          security pointer in the cred struct is never seen to be invalid.
+
+          If unsure, say N.
+
 #
 # Select this config option from the architecture Kconfig, if it
 # it is preferred to always offer frame pointers as a config
@@ -725,7 +748,7 @@ config RCU_TORTURE_TEST_RUNNABLE
 
 config RCU_CPU_STALL_DETECTOR
         bool "Check for stalled CPUs delaying RCU grace periods"
-        depends on CLASSIC_RCU || TREE_RCU
+        depends on TREE_RCU || TREE_PREEMPT_RCU
         default n
         help
           This option causes RCU to printk information on which
@@ -790,6 +813,21 @@ config DEBUG_BLOCK_EXT_DEVT
 
           Say N if you are unsure.
 
+config DEBUG_FORCE_WEAK_PER_CPU
+        bool "Force weak per-cpu definitions"
+        depends on DEBUG_KERNEL
+        help
+          s390 and alpha require percpu variables in modules to be
+          defined weak to work around addressing range issue which
+          puts the following two restrictions on percpu variable
+          definitions.
+
+          1. percpu symbols must be unique whether static or not
+          2. percpu variables can't be defined inside a function
+
+          To ensure that generic code follows the above rules, this
+          option forces all percpu variables to be defined as weak.
+
 config LKDTM
         tristate "Linux Kernel Dump Test Tool Module"
         depends on DEBUG_KERNEL
diff --git a/lib/Kconfig.kmemcheck b/lib/Kconfig.kmemcheck
index 603c81b66549..846e039a86b4 100644
--- a/lib/Kconfig.kmemcheck
+++ b/lib/Kconfig.kmemcheck
@@ -1,6 +1,8 @@
 config HAVE_ARCH_KMEMCHECK
         bool
 
+if HAVE_ARCH_KMEMCHECK
+
 menuconfig KMEMCHECK
         bool "kmemcheck: trap use of uninitialized memory"
         depends on DEBUG_KERNEL
@@ -89,3 +91,4 @@ config KMEMCHECK_BITOPS_OK
           accesses where not all the bits are initialized at the same time.
           This may also hide some real bugs.
 
+endif
diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index 68dfce59c1b8..fc686c7a0a0d 100644
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -27,6 +27,11 @@
 
 #define GZIP_IOBUF_SIZE (16*1024)
 
+static int nofill(void *buffer, unsigned int len)
+{
+        return -1;
+}
+
 /* Included from initramfs et al code */
 STATIC int INIT gunzip(unsigned char *buf, int len,
                        int(*fill)(void*, unsigned int),
@@ -76,6 +81,9 @@ STATIC int INIT gunzip(unsigned char *buf, int len,
                 goto gunzip_nomem4;
         }
 
+        if (!fill)
+                fill = nofill;
+
         if (len == 0)
                 len = fill(zbuf, GZIP_IOBUF_SIZE);
 
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index 0b954e04bd30..ca82fde81c8f 100644
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -82,6 +82,11 @@ struct rc {
 #define RC_MODEL_TOTAL_BITS 11
 
 
+static int nofill(void *buffer, unsigned int len)
+{
+        return -1;
+}
+
 /* Called twice: once at startup and once in rc_normalize() */
 static void INIT rc_read(struct rc *rc)
 {
@@ -97,7 +102,10 @@ static inline void INIT rc_init(struct rc *rc,
                                        int (*fill)(void*, unsigned int),
                                        char *buffer, int buffer_size)
 {
-        rc->fill = fill;
+        if (fill)
+                rc->fill = fill;
+        else
+                rc->fill = nofill;
         rc->buffer = (uint8_t *)buffer;
         rc->buffer_size = buffer_size;
         rc->buffer_end = rc->buffer + rc->buffer_size;
diff --git a/lib/flex_array.c b/lib/flex_array.c
index 7baed2fc3bc8..66eef2e4483e 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -28,23 +28,6 @@ struct flex_array_part {
         char elements[FLEX_ARRAY_PART_SIZE];
 };
 
-static inline int __elements_per_part(int element_size)
-{
-        return FLEX_ARRAY_PART_SIZE / element_size;
-}
-
-static inline int bytes_left_in_base(void)
-{
-        int element_offset = offsetof(struct flex_array, parts);
-        int bytes_left = FLEX_ARRAY_BASE_SIZE - element_offset;
-        return bytes_left;
-}
-
-static inline int nr_base_part_ptrs(void)
-{
-        return bytes_left_in_base() / sizeof(struct flex_array_part *);
-}
-
 /*
  * If a user requests an allocation which is small
  * enough, we may simply use the space in the
@@ -54,7 +37,7 @@ static inline int nr_base_part_ptrs(void)
 static inline int elements_fit_in_base(struct flex_array *fa)
 {
         int data_size = fa->element_size * fa->total_nr_elements;
-        if (data_size <= bytes_left_in_base())
+        if (data_size <= FLEX_ARRAY_BASE_BYTES_LEFT)
                 return 1;
         return 0;
 }
@@ -63,6 +46,7 @@ static inline int elements_fit_in_base(struct flex_array *fa)
  * flex_array_alloc - allocate a new flexible array
  * @element_size:       the size of individual elements in the array
  * @total:              total number of elements that this should hold
+ * @flags:              page allocation flags to use for base array
  *
  * Note: all locking must be provided by the caller.
  *
@@ -103,7 +87,8 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total,
                                         gfp_t flags)
 {
         struct flex_array *ret;
-        int max_size = nr_base_part_ptrs() * __elements_per_part(element_size);
+        int max_size = FLEX_ARRAY_NR_BASE_PTRS *
+                                FLEX_ARRAY_ELEMENTS_PER_PART(element_size);
 
         /* max_size will end up 0 if element_size > PAGE_SIZE */
         if (total > max_size)
@@ -113,17 +98,21 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total,
                 return NULL;
         ret->element_size = element_size;
         ret->total_nr_elements = total;
+        if (elements_fit_in_base(ret) && !(flags & __GFP_ZERO))
+                memset(ret->parts[0], FLEX_ARRAY_FREE,
+                                                FLEX_ARRAY_BASE_BYTES_LEFT);
         return ret;
 }
 
 static int fa_element_to_part_nr(struct flex_array *fa,
                                         unsigned int element_nr)
 {
-        return element_nr / __elements_per_part(fa->element_size);
+        return element_nr / FLEX_ARRAY_ELEMENTS_PER_PART(fa->element_size);
 }
 
 /**
  * flex_array_free_parts - just free the second-level pages
+ * @fa:         the flex array from which to free parts
  *
  * This is to be used in cases where the base 'struct flex_array'
  * has been statically allocated and should not be free.
@@ -131,11 +120,10 @@ static int fa_element_to_part_nr(struct flex_array *fa,
 void flex_array_free_parts(struct flex_array *fa)
 {
         int part_nr;
-        int max_part = nr_base_part_ptrs();
 
         if (elements_fit_in_base(fa))
                 return;
-        for (part_nr = 0; part_nr < max_part; part_nr++)
+        for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++)
                 kfree(fa->parts[part_nr]);
 }
 
@@ -150,7 +138,8 @@ static unsigned int index_inside_part(struct flex_array *fa,
 {
         unsigned int part_offset;
 
-        part_offset = element_nr % __elements_per_part(fa->element_size);
+        part_offset = element_nr %
+                                FLEX_ARRAY_ELEMENTS_PER_PART(fa->element_size);
         return part_offset * fa->element_size;
 }
 
@@ -159,15 +148,12 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
 {
         struct flex_array_part *part = fa->parts[part_nr];
         if (!part) {
-                /*
-                 * This leaves the part pages uninitialized
-                 * and with potentially random data, just
-                 * as if the user had kmalloc()'d the whole.
-                 * __GFP_ZERO can be used to zero it.
-                 */
-                part = kmalloc(FLEX_ARRAY_PART_SIZE, flags);
+                part = kmalloc(sizeof(struct flex_array_part), flags);
                 if (!part)
                         return NULL;
+                if (!(flags & __GFP_ZERO))
+                        memset(part, FLEX_ARRAY_FREE,
+                                sizeof(struct flex_array_part));
                 fa->parts[part_nr] = part;
         }
         return part;
@@ -175,9 +161,12 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
 
 /**
  * flex_array_put - copy data into the array at @element_nr
- * @src:        address of data to copy into the array
+ * @fa:         the flex array to copy data into
  * @element_nr: index of the position in which to insert
  *              the new element.
+ * @src:        address of data to copy into the array
+ * @flags:      page allocation flags to use for array expansion
+ *
  *
  * Note that this *copies* the contents of @src into
  * the array.  If you are trying to store an array of
@@ -207,9 +196,38 @@ int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
 }
 
 /**
+ * flex_array_clear - clear element in array at @element_nr
+ * @fa:         the flex array of the element.
+ * @element_nr: index of the position to clear.
+ *
+ * Locking must be provided by the caller.
+ */
+int flex_array_clear(struct flex_array *fa, unsigned int element_nr)
+{
+        int part_nr = fa_element_to_part_nr(fa, element_nr);
+        struct flex_array_part *part;
+        void *dst;
+
+        if (element_nr >= fa->total_nr_elements)
+                return -ENOSPC;
+        if (elements_fit_in_base(fa))
+                part = (struct flex_array_part *)&fa->parts[0];
+        else {
+                part = fa->parts[part_nr];
+                if (!part)
+                        return -EINVAL;
+        }
+        dst = &part->elements[index_inside_part(fa, element_nr)];
+        memset(dst, FLEX_ARRAY_FREE, fa->element_size);
+        return 0;
+}
+
+/**
  * flex_array_prealloc - guarantee that array space exists
+ * @fa:         the flex array for which to preallocate parts
  * @start:      index of first array element for which space is allocated
  * @end:        index of last (inclusive) element for which space is allocated
+ * @flags:      page allocation flags
  *
  * This will guarantee that no future calls to flex_array_put()
  * will allocate memory.  It can be used if you are expecting to
@@ -242,6 +260,7 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start,
 
 /**
  * flex_array_get - pull data back out of the array
+ * @fa:         the flex array from which to extract data
  * @element_nr: index of the element to fetch from the array
  *
  * Returns a pointer to the data at index @element_nr.  Note
@@ -266,3 +285,43 @@ void *flex_array_get(struct flex_array *fa, unsigned int element_nr)
         }
         return &part->elements[index_inside_part(fa, element_nr)];
 }
+
+static int part_is_free(struct flex_array_part *part)
+{
+        int i;
+
+        for (i = 0; i < sizeof(struct flex_array_part); i++)
+                if (part->elements[i] != FLEX_ARRAY_FREE)
+                        return 0;
+        return 1;
+}
+
+/**
+ * flex_array_shrink - free unused second-level pages
+ * @fa:         the flex array to shrink
+ *
+ * Frees all second-level pages that consist solely of unused
+ * elements.  Returns the number of pages freed.
+ *
+ * Locking must be provided by the caller.
+ */
+int flex_array_shrink(struct flex_array *fa)
+{
+        struct flex_array_part *part;
+        int part_nr;
+        int ret = 0;
+
+        if (elements_fit_in_base(fa))
+                return ret;
+        for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++) {
+                part = fa->parts[part_nr];
+                if (!part)
+                        continue;
+                if (part_is_free(part)) {
+                        fa->parts[part_nr] = NULL;
+                        kfree(part);
+                        ret++;
+                }
+        }
+        return ret;
+}
diff --git a/lib/inflate.c b/lib/inflate.c
index 1a8e8a978128..d10255973a9f 100644
--- a/lib/inflate.c
+++ b/lib/inflate.c
@@ -7,7 +7,7 @@
  * Adapted for booting Linux by Hannu Savolainen 1993
  * based on gzip-1.0.3 
  *
- * Nicolas Pitre <nico@cam.org>, 1999/04/14 :
+ * Nicolas Pitre <nico@fluxnic.net>, 1999/04/14 :
  *   Little mods for all variable to reside either into rodata or bss segments
  *   by marking constant variables with 'const' and initializing all the others
  *   at run-time only.  This allows for the kernel uncompressor to run
diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
index f1ed2fe76c65..bd2bea963364 100644
--- a/lib/is_single_threaded.c
+++ b/lib/is_single_threaded.c
@@ -12,34 +12,47 @@
 
 #include <linux/sched.h>
 
-/**
- * is_single_threaded - Determine if a thread group is single-threaded or not
- * @p: A task in the thread group in question
- *
- * This returns true if the thread group to which a task belongs is single
- * threaded, false if it is not.
+/*
+ * Returns true if the task does not share ->mm with another thread/process.
  */
-bool is_single_threaded(struct task_struct *p)
+bool current_is_single_threaded(void)
 {
-        struct task_struct *g, *t;
-        struct mm_struct *mm = p->mm;
+        struct task_struct *task = current;
+        struct mm_struct *mm = task->mm;
+        struct task_struct *p, *t;
+        bool ret;
 
-        if (atomic_read(&p->signal->count) != 1)
-                goto no;
+        if (atomic_read(&task->signal->live) != 1)
+                return false;
 
-        if (atomic_read(&p->mm->mm_users) != 1) {
-                read_lock(&tasklist_lock);
-                do_each_thread(g, t) {
-                        if (t->mm == mm && t != p)
-                                goto no_unlock;
-                } while_each_thread(g, t);
-                read_unlock(&tasklist_lock);
-        }
+        if (atomic_read(&mm->mm_users) == 1)
+                return true;
 
-        return true;
+        ret = false;
+        rcu_read_lock();
+        for_each_process(p) {
+                if (unlikely(p->flags & PF_KTHREAD))
+                        continue;
+                if (unlikely(p == task->group_leader))
+                        continue;
+
+                t = p;
+                do {
+                        if (unlikely(t->mm == mm))
+                                goto found;
+                        if (likely(t->mm))
+                                break;
+                        /*
+                         * t->mm == NULL. Make sure next_thread/next_task
+                         * will see other CLONE_VM tasks which might be
+                         * forked before exiting.
+                         */
+                        smp_rmb();
+                } while_each_thread(p, t);
+        }
+        ret = true;
+found:
+        rcu_read_unlock();
 
-no_unlock:
-        read_unlock(&tasklist_lock);
-no:
-        return false;
+        return ret;
 }
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index bffe6d7ef9d9..ac25cd28e807 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -114,46 +114,11 @@ setup_io_tlb_npages(char *str)
 __setup("swiotlb=", setup_io_tlb_npages);
 /* make io_tlb_overflow tunable too? */
 
-void * __weak __init swiotlb_alloc_boot(size_t size, unsigned long nslabs)
-{
-        return alloc_bootmem_low_pages(size);
-}
-
-void * __weak swiotlb_alloc(unsigned order, unsigned long nslabs)
-{
-        return (void *)__get_free_pages(GFP_DMA | __GFP_NOWARN, order);
-}
-
-dma_addr_t __weak swiotlb_phys_to_bus(struct device *hwdev, phys_addr_t paddr)
-{
-        return paddr;
-}
-
-phys_addr_t __weak swiotlb_bus_to_phys(struct device *hwdev, dma_addr_t baddr)
-{
-        return baddr;
-}
-
+/* Note that this doesn't work with highmem page */
 static dma_addr_t swiotlb_virt_to_bus(struct device *hwdev,
                                       volatile void *address)
 {
-        return swiotlb_phys_to_bus(hwdev, virt_to_phys(address));
-}
-
-void * __weak swiotlb_bus_to_virt(struct device *hwdev, dma_addr_t address)
-{
-        return phys_to_virt(swiotlb_bus_to_phys(hwdev, address));
-}
-
-int __weak swiotlb_arch_address_needs_mapping(struct device *hwdev,
-                                               dma_addr_t addr, size_t size)
-{
-        return !is_buffer_dma_capable(dma_get_mask(hwdev), addr, size);
-}
-
-int __weak swiotlb_arch_range_needs_mapping(phys_addr_t paddr, size_t size)
-{
-        return 0;
+        return phys_to_dma(hwdev, virt_to_phys(address));
 }
 
 static void swiotlb_print_info(unsigned long bytes)
@@ -189,7 +154,7 @@ swiotlb_init_with_default_size(size_t default_size)
         /*
          * Get IO TLB memory from the low pages
          */
-        io_tlb_start = swiotlb_alloc_boot(bytes, io_tlb_nslabs);
+        io_tlb_start = alloc_bootmem_low_pages(bytes);
         if (!io_tlb_start)
                 panic("Cannot allocate SWIOTLB buffer");
         io_tlb_end = io_tlb_start + bytes;
@@ -245,7 +210,8 @@ swiotlb_late_init_with_default_size(size_t default_size)
         bytes = io_tlb_nslabs << IO_TLB_SHIFT;
 
         while ((SLABS_PER_PAGE << order) > IO_TLB_MIN_SLABS) {
-                io_tlb_start = swiotlb_alloc(order, io_tlb_nslabs);
+                io_tlb_start = (void *)__get_free_pages(GFP_DMA | __GFP_NOWARN,
+                                                        order);
                 if (io_tlb_start)
                         break;
                 order--;
@@ -315,20 +281,10 @@ cleanup1:
         return -ENOMEM;
 }
 
-static inline int
-address_needs_mapping(struct device *hwdev, dma_addr_t addr, size_t size)
+static int is_swiotlb_buffer(phys_addr_t paddr)
 {
-        return swiotlb_arch_address_needs_mapping(hwdev, addr, size);
-}
-
-static inline int range_needs_mapping(phys_addr_t paddr, size_t size)
-{
-        return swiotlb_force || swiotlb_arch_range_needs_mapping(paddr, size);
-}
-
-static int is_swiotlb_buffer(char *addr)
-{
-        return addr >= io_tlb_start && addr < io_tlb_end;
+        return paddr >= virt_to_phys(io_tlb_start) &&
+                paddr < virt_to_phys(io_tlb_end);
 }
 
 /*
@@ -561,9 +517,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                 dma_mask = hwdev->coherent_dma_mask;
 
         ret = (void *)__get_free_pages(flags, order);
-        if (ret &&
-            !is_buffer_dma_capable(dma_mask, swiotlb_virt_to_bus(hwdev, ret),
-                                   size)) {
+        if (ret && swiotlb_virt_to_bus(hwdev, ret) + size > dma_mask) {
                 /*
                  * The allocated memory isn't reachable by the device.
                  */
@@ -585,7 +539,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
         dev_addr = swiotlb_virt_to_bus(hwdev, ret);
 
         /* Confirm address can be DMA'd by device */
-        if (!is_buffer_dma_capable(dma_mask, dev_addr, size)) {
+        if (dev_addr + size > dma_mask) {
                 printk("hwdev DMA mask = 0x%016Lx, dev_addr = 0x%016Lx\n",
                        (unsigned long long)dma_mask,
                        (unsigned long long)dev_addr);
@@ -601,11 +555,13 @@ EXPORT_SYMBOL(swiotlb_alloc_coherent);
 
 void
 swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
-                      dma_addr_t dma_handle)
+                      dma_addr_t dev_addr)
 {
+        phys_addr_t paddr = dma_to_phys(hwdev, dev_addr);
+
         WARN_ON(irqs_disabled());
-        if (!is_swiotlb_buffer(vaddr))
-                free_pages((unsigned long) vaddr, get_order(size));
+        if (!is_swiotlb_buffer(paddr))
+                free_pages((unsigned long)vaddr, get_order(size));
         else
                 /* DMA_TO_DEVICE to avoid memcpy in unmap_single */
                 do_unmap_single(hwdev, vaddr, size, DMA_TO_DEVICE);
@@ -625,12 +581,15 @@ swiotlb_full(struct device *dev, size_t size, int dir, int do_panic)
         printk(KERN_ERR "DMA: Out of SW-IOMMU space for %zu bytes at "
                "device %s\n", size, dev ? dev_name(dev) : "?");
 
-        if (size > io_tlb_overflow && do_panic) {
-                if (dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL)
-                        panic("DMA: Memory would be corrupted\n");
-                if (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)
-                        panic("DMA: Random memory would be DMAed\n");
-        }
+        if (size <= io_tlb_overflow || !do_panic)
+                return;
+
+        if (dir == DMA_BIDIRECTIONAL)
+                panic("DMA: Random memory could be DMA accessed\n");
+        if (dir == DMA_FROM_DEVICE)
+                panic("DMA: Random memory could be DMA written\n");
+        if (dir == DMA_TO_DEVICE)
+                panic("DMA: Random memory could be DMA read\n");
 }
 
 /*
@@ -646,7 +605,7 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
                             struct dma_attrs *attrs)
 {
         phys_addr_t phys = page_to_phys(page) + offset;
-        dma_addr_t dev_addr = swiotlb_phys_to_bus(dev, phys);
+        dma_addr_t dev_addr = phys_to_dma(dev, phys);
         void *map;
 
         BUG_ON(dir == DMA_NONE);
@@ -655,8 +614,7 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
          * we can safely return the device addr and not worry about bounce
          * buffering it.
          */
-        if (!address_needs_mapping(dev, dev_addr, size) &&
-            !range_needs_mapping(phys, size))
+        if (dma_capable(dev, dev_addr, size) && !swiotlb_force)
                 return dev_addr;
 
         /*
@@ -673,7 +631,7 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         /*
          * Ensure that the address returned is DMA'ble
          */
-        if (address_needs_mapping(dev, dev_addr, size))
+        if (!dma_capable(dev, dev_addr, size))
                 panic("map_single: bounce buffer is not DMA'ble");
 
         return dev_addr;
@@ -691,19 +649,25 @@ EXPORT_SYMBOL_GPL(swiotlb_map_page);
 static void unmap_single(struct device *hwdev, dma_addr_t dev_addr,
                          size_t size, int dir)
 {
-        char *dma_addr = swiotlb_bus_to_virt(hwdev, dev_addr);
+        phys_addr_t paddr = dma_to_phys(hwdev, dev_addr);
 
         BUG_ON(dir == DMA_NONE);
 
-        if (is_swiotlb_buffer(dma_addr)) {
-                do_unmap_single(hwdev, dma_addr, size, dir);
+        if (is_swiotlb_buffer(paddr)) {
+                do_unmap_single(hwdev, phys_to_virt(paddr), size, dir);
                 return;
         }
 
         if (dir != DMA_FROM_DEVICE)
                 return;
 
-        dma_mark_clean(dma_addr, size);
+        /*
+         * phys_to_virt doesn't work with hihgmem page but we could
+         * call dma_mark_clean() with hihgmem page here. However, we
+         * are fine since dma_mark_clean() is null on POWERPC. We can
+         * make dma_mark_clean() take a physical address if necessary.
+         */
+        dma_mark_clean(phys_to_virt(paddr), size);
 }
 
 void swiotlb_unmap_page(struct device *hwdev, dma_addr_t dev_addr,
@@ -728,19 +692,19 @@ static void
 swiotlb_sync_single(struct device *hwdev, dma_addr_t dev_addr,
                     size_t size, int dir, int target)
 {
-        char *dma_addr = swiotlb_bus_to_virt(hwdev, dev_addr);
+        phys_addr_t paddr = dma_to_phys(hwdev, dev_addr);
 
         BUG_ON(dir == DMA_NONE);
 
-        if (is_swiotlb_buffer(dma_addr)) {
-                sync_single(hwdev, dma_addr, size, dir, target);
+        if (is_swiotlb_buffer(paddr)) {
+                sync_single(hwdev, phys_to_virt(paddr), size, dir, target);
                 return;
         }
 
         if (dir != DMA_FROM_DEVICE)
                 return;
 
-        dma_mark_clean(dma_addr, size);
+        dma_mark_clean(phys_to_virt(paddr), size);
 }
 
 void
@@ -817,10 +781,10 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems,
 
         for_each_sg(sgl, sg, nelems, i) {
                 phys_addr_t paddr = sg_phys(sg);
-                dma_addr_t dev_addr = swiotlb_phys_to_bus(hwdev, paddr);
+                dma_addr_t dev_addr = phys_to_dma(hwdev, paddr);
 
-                if (range_needs_mapping(paddr, sg->length) ||
-                    address_needs_mapping(hwdev, dev_addr, sg->length)) {
+                if (swiotlb_force ||
+                    !dma_capable(hwdev, dev_addr, sg->length)) {
                         void *map = map_single(hwdev, sg_phys(sg),
                                                sg->length, dir);
                         if (!map) {
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 756ccafa9cec..73a14b8c6d1f 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -25,6 +25,7 @@
 #include <linux/kallsyms.h>
 #include <linux/uaccess.h>
 #include <linux/ioport.h>
+#include <net/addrconf.h>
 
 #include <asm/page.h>           /* for PAGE_SIZE */
 #include <asm/div64.h>
@@ -580,7 +581,7 @@ static char *symbol_string(char *buf, char *end, void *ptr,
         unsigned long value = (unsigned long) ptr;
 #ifdef CONFIG_KALLSYMS
         char sym[KSYM_SYMBOL_LEN];
-        if (ext != 'f')
+        if (ext != 'f' && ext != 's')
                 sprint_symbol(sym, value);
         else
                 kallsyms_lookup(value, NULL, NULL, NULL, sym);
@@ -630,60 +631,156 @@ static char *resource_string(char *buf, char *end, struct resource *res,
 }
 
 static char *mac_address_string(char *buf, char *end, u8 *addr,
-                                struct printf_spec spec)
+                                struct printf_spec spec, const char *fmt)
 {
-        char mac_addr[6 * 3]; /* (6 * 2 hex digits), 5 colons and trailing zero */
+        char mac_addr[sizeof("xx:xx:xx:xx:xx:xx")];
         char *p = mac_addr;
         int i;
 
         for (i = 0; i < 6; i++) {
                 p = pack_hex_byte(p, addr[i]);
-                if (!(spec.flags & SPECIAL) && i != 5)
+                if (fmt[0] == 'M' && i != 5)
                         *p++ = ':';
         }
         *p = '\0';
-        spec.flags &= ~SPECIAL;
 
         return string(buf, end, mac_addr, spec);
 }
 
-static char *ip6_addr_string(char *buf, char *end, u8 *addr,
-                                struct printf_spec spec)
+static char *ip4_string(char *p, const u8 *addr, bool leading_zeros)
 {
-        char ip6_addr[8 * 5]; /* (8 * 4 hex digits), 7 colons and trailing zero */
-        char *p = ip6_addr;
         int i;
 
+        for (i = 0; i < 4; i++) {
+                char temp[3];   /* hold each IP quad in reverse order */
+                int digits = put_dec_trunc(temp, addr[i]) - temp;
+                if (leading_zeros) {
+                        if (digits < 3)
+                                *p++ = '0';
+                        if (digits < 2)
+                                *p++ = '0';
+                }
+                /* reverse the digits in the quad */
+                while (digits--)
+                        *p++ = temp[digits];
+                if (i < 3)
+                        *p++ = '.';
+        }
+
+        *p = '\0';
+        return p;
+}
+
+static char *ip6_compressed_string(char *p, const struct in6_addr *addr)
+{
+        int i;
+        int j;
+        int range;
+        unsigned char zerolength[8];
+        int longest = 1;
+        int colonpos = -1;
+        u16 word;
+        u8 hi;
+        u8 lo;
+        bool needcolon = false;
+        bool useIPv4 = ipv6_addr_v4mapped(addr) || ipv6_addr_is_isatap(addr);
+
+        memset(zerolength, 0, sizeof(zerolength));
+
+        if (useIPv4)
+                range = 6;
+        else
+                range = 8;
+
+        /* find position of longest 0 run */
+        for (i = 0; i < range; i++) {
+                for (j = i; j < range; j++) {
+                        if (addr->s6_addr16[j] != 0)
+                                break;
+                        zerolength[i]++;
+                }
+        }
+        for (i = 0; i < range; i++) {
+                if (zerolength[i] > longest) {
+                        longest = zerolength[i];
+                        colonpos = i;
+                }
+        }
+
+        /* emit address */
+        for (i = 0; i < range; i++) {
+                if (i == colonpos) {
+                        if (needcolon || i == 0)
+                                *p++ = ':';
+                        *p++ = ':';
+                        needcolon = false;
+                        i += longest - 1;
+                        continue;
+                }
+                if (needcolon) {
+                        *p++ = ':';
+                        needcolon = false;
+                }
+                /* hex u16 without leading 0s */
+                word = ntohs(addr->s6_addr16[i]);
+                hi = word >> 8;
+                lo = word & 0xff;
+                if (hi) {
+                        if (hi > 0x0f)
+                                p = pack_hex_byte(p, hi);
+                        else
+                                *p++ = hex_asc_lo(hi);
+                }
+                if (hi || lo > 0x0f)
+                        p = pack_hex_byte(p, lo);
+                else
+                        *p++ = hex_asc_lo(lo);
+                needcolon = true;
+        }
+
+        if (useIPv4) {
+                if (needcolon)
+                        *p++ = ':';
+                p = ip4_string(p, &addr->s6_addr[12], false);
+        }
+
+        *p = '\0';
+        return p;
+}
+
+static char *ip6_string(char *p, const struct in6_addr *addr, const char *fmt)
+{
+        int i;
         for (i = 0; i < 8; i++) {
-                p = pack_hex_byte(p, addr[2 * i]);
-                p = pack_hex_byte(p, addr[2 * i + 1]);
-                if (!(spec.flags & SPECIAL) && i != 7)
+                p = pack_hex_byte(p, addr->s6_addr[2 * i]);
+                p = pack_hex_byte(p, addr->s6_addr[2 * i + 1]);
+                if (fmt[0] == 'I' && i != 7)
                         *p++ = ':';
         }
+
         *p = '\0';
-        spec.flags &= ~SPECIAL;
+        return p;
+}
+
+static char *ip6_addr_string(char *buf, char *end, const u8 *addr,
+                             struct printf_spec spec, const char *fmt)
+{
+        char ip6_addr[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255")];
+
+        if (fmt[0] == 'I' && fmt[2] == 'c')
+                ip6_compressed_string(ip6_addr, (const struct in6_addr *)addr);
+        else
+                ip6_string(ip6_addr, (const struct in6_addr *)addr, fmt);
 
         return string(buf, end, ip6_addr, spec);
 }
 
-static char *ip4_addr_string(char *buf, char *end, u8 *addr,
-                                struct printf_spec spec)
+static char *ip4_addr_string(char *buf, char *end, const u8 *addr,
+                             struct printf_spec spec, const char *fmt)
 {
-        char ip4_addr[4 * 4]; /* (4 * 3 decimal digits), 3 dots and trailing zero */
-        char temp[3];   /* hold each IP quad in reverse order */
-        char *p = ip4_addr;
-        int i, digits;
+        char ip4_addr[sizeof("255.255.255.255")];
 
-        for (i = 0; i < 4; i++) {
-                digits = put_dec_trunc(temp, addr[i]) - temp;
-                /* reverse the digits in the quad */
-                while (digits--)
-                        *p++ = temp[digits];
-                if (i != 3)
-                        *p++ = '.';
-        }
-        *p = '\0';
-        spec.flags &= ~SPECIAL;
+        ip4_string(ip4_addr, addr, fmt[0] == 'i');
 
         return string(buf, end, ip4_addr, spec);
 }
@@ -697,16 +794,21 @@ static char *ip4_addr_string(char *buf, char *end, u8 *addr,
  *
  * - 'F' For symbolic function descriptor pointers with offset
  * - 'f' For simple symbolic function names without offset
- * - 'S' For symbolic direct pointers
+ * - 'S' For symbolic direct pointers with offset
+ * - 's' For symbolic direct pointers without offset
  * - 'R' For a struct resource pointer, it prints the range of
  *       addresses (not the name nor the flags)
  * - 'M' For a 6-byte MAC address, it prints the address in the
  *       usual colon-separated hex notation
- * - 'I' [46] for IPv4/IPv6 addresses printed in the usual way (dot-separated
- *       decimal for v4 and colon separated network-order 16 bit hex for v6)
- * - 'i' [46] for 'raw' IPv4/IPv6 addresses, IPv6 omits the colons, IPv4 is
- *       currently the same
- *
+ * - 'm' For a 6-byte MAC address, it prints the hex address without colons
+ * - 'I' [46] for IPv4/IPv6 addresses printed in the usual way
+ *       IPv4 uses dot-separated decimal without leading 0's (1.2.3.4)
+ *       IPv6 uses colon separated network-order 16 bit hex with leading 0's
+ * - 'i' [46] for 'raw' IPv4/IPv6 addresses
+ *       IPv6 omits the colons (01020304...0f)
+ *       IPv4 uses dot-separated decimal with leading 0's (010.123.045.006)
+ * - 'I6c' for IPv6 addresses printed as specified by
+ *       http://www.ietf.org/id/draft-kawamura-ipv6-text-representation-03.txt
  * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
  * function pointers are really function descriptors, which contain a
  * pointer to the real address.
@@ -721,25 +823,30 @@ static char *pointer(const char *fmt, char *buf, char *end, void *ptr,
         case 'F':
         case 'f':
                 ptr = dereference_function_descriptor(ptr);
+        case 's':
                 /* Fallthrough */
         case 'S':
                 return symbol_string(buf, end, ptr, spec, *fmt);
         case 'R':
                 return resource_string(buf, end, ptr, spec);
-        case 'm':
-                spec.flags |= SPECIAL;
-                /* Fallthrough */
-        case 'M':
-                return mac_address_string(buf, end, ptr, spec);
-        case 'i':
-                spec.flags |= SPECIAL;
-                /* Fallthrough */
-        case 'I':
-                if (fmt[1] == '6')
-                        return ip6_addr_string(buf, end, ptr, spec);
-                if (fmt[1] == '4')
-                        return ip4_addr_string(buf, end, ptr, spec);
-                spec.flags &= ~SPECIAL;
+        case 'M':                       /* Colon separated: 00:01:02:03:04:05 */
+        case 'm':                       /* Contiguous: 000102030405 */
+                return mac_address_string(buf, end, ptr, spec, fmt);
+        case 'I':                       /* Formatted IP supported
+                                         * 4:   1.2.3.4
+                                         * 6:   0001:0203:...:0708
+                                         * 6c:  1::708 or 1::1.2.3.4
+                                         */
+        case 'i':                       /* Contiguous:
+                                         * 4:   001.002.003.004
+                                         * 6:   000102...0f
+                                         */
+                switch (fmt[1]) {
+                case '6':
+                        return ip6_addr_string(buf, end, ptr, spec, fmt);
+                case '4':
+                        return ip4_addr_string(buf, end, ptr, spec, fmt);
+                }
                 break;
         }
         spec.flags |= SMALL;
@@ -958,10 +1065,12 @@ qualifier:
  * @args: Arguments for the format string
  *
  * This function follows C99 vsnprintf, but has some extensions:
- * %pS output the name of a text symbol
+ * %pS output the name of a text symbol with offset
+ * %ps output the name of a text symbol without offset
  * %pF output the name of a function pointer with its offset
  * %pf output the name of a function pointer without its offset
  * %pR output the address range in a struct resource
+ * %n is ignored
  *
  * The return value is the number of characters which would
  * be generated for the given input, excluding the trailing
@@ -983,13 +1092,8 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 
         /* Reject out-of-range values early.  Large positive sizes are
            used for unknown buffer sizes. */
-        if (unlikely((int) size < 0)) {
-                /* There can be only one.. */
-                static char warn = 1;
-                WARN_ON(warn);
-                warn = 0;
+        if (WARN_ON_ONCE((int) size < 0))
                 return 0;
-        }
 
         str = buf;
         end = buf + size;
@@ -1417,11 +1521,7 @@ EXPORT_SYMBOL_GPL(vbin_printf);
  * a binary buffer that generated by vbin_printf.
  *
  * The format follows C99 vsnprintf, but has some extensions:
- * %pS output the name of a text symbol
- * %pF output the name of a function pointer with its offset
- * %pf output the name of a function pointer without its offset
- * %pR output the address range in a struct resource
- * %n is ignored
+ *  see vsnprintf comment for details.
  *
  * The return value is the number of characters which would
  * be generated for the given input, excluding the trailing
@@ -1439,13 +1539,8 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
 
         struct printf_spec spec = {0};
 
-        if (unlikely((int) size < 0)) {
-                /* There can be only one.. */
-                static char warn = 1;
-                WARN_ON(warn);
-                warn = 0;
+        if (WARN_ON_ONCE((int) size < 0))
                 return 0;
-        }
 
         str = buf;
         end = buf + size;
diff --git a/lib/zlib_deflate/deflate.c b/lib/zlib_deflate/deflate.c
index c3e4a2baf835..46a31e5f49c3 100644
--- a/lib/zlib_deflate/deflate.c
+++ b/lib/zlib_deflate/deflate.c
@@ -135,7 +135,7 @@ static const config configuration_table[10] = {
 
 /* ===========================================================================
  * Update a hash value with the given input byte
- * IN  assertion: all calls to to UPDATE_HASH are made with consecutive
+ * IN  assertion: all calls to UPDATE_HASH are made with consecutive
  *    input characters, so that a running hash key can be computed from the
  *    previous key instead of complete recalculation each time.
  */
@@ -146,7 +146,7 @@ static const config configuration_table[10] = {
  * Insert string str in the dictionary and set match_head to the previous head
  * of the hash chain (the most recent string with same hash key). Return
  * the previous length of the hash chain.
- * IN  assertion: all calls to to INSERT_STRING are made with consecutive
+ * IN  assertion: all calls to INSERT_STRING are made with consecutive
  *    input characters and the first MIN_MATCH bytes of str are valid
  *    (except for the last MIN_MATCH-1 bytes of the input file).
  */