diff options
Diffstat (limited to '4.4.8/1007_linux-4.4.8.patch')
| -rw-r--r-- | 4.4.8/1007_linux-4.4.8.patch | 5319 |
1 files changed, 5319 insertions, 0 deletions
diff --git a/4.4.8/1007_linux-4.4.8.patch b/4.4.8/1007_linux-4.4.8.patch new file mode 100644 index 0000000..e8c236b --- /dev/null +++ b/4.4.8/1007_linux-4.4.8.patch @@ -0,0 +1,5319 @@ +diff --git a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt +index 08a4a32..0326154 100644 +--- a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt +@@ -134,12 +134,12 @@ mfio80 ddr_debug, mips_trace_data, mips_debug + mfio81 dreq0, mips_trace_data, eth_debug + mfio82 dreq1, mips_trace_data, eth_debug + mfio83 mips_pll_lock, mips_trace_data, usb_debug +-mfio84 sys_pll_lock, mips_trace_data, usb_debug +-mfio85 wifi_pll_lock, mips_trace_data, sdhost_debug +-mfio86 bt_pll_lock, mips_trace_data, sdhost_debug +-mfio87 rpu_v_pll_lock, dreq2, socif_debug +-mfio88 rpu_l_pll_lock, dreq3, socif_debug +-mfio89 audio_pll_lock, dreq4, dreq5 ++mfio84 audio_pll_lock, mips_trace_data, usb_debug ++mfio85 rpu_v_pll_lock, mips_trace_data, sdhost_debug ++mfio86 rpu_l_pll_lock, mips_trace_data, sdhost_debug ++mfio87 sys_pll_lock, dreq2, socif_debug ++mfio88 wifi_pll_lock, dreq3, socif_debug ++mfio89 bt_pll_lock, dreq4, dreq5 + tck + trstn + tdi +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 742f69d..0e4102a 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -3928,6 +3928,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + sector if the number is odd); + i = IGNORE_DEVICE (don't bind to this + device); ++ j = NO_REPORT_LUNS (don't use report luns ++ command, uas only); + l = NOT_LOCKABLE (don't try to lock and + unlock ejectable media); + m = MAX_SECTORS_64 (don't transfer more +diff --git a/Makefile b/Makefile +index 5a493e7..1928fcd 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 7 ++SUBLEVEL = 8 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm64/include/asm/opcodes.h b/arch/arm64/include/asm/opcodes.h +index 4e603ea..123f45d 100644 +--- a/arch/arm64/include/asm/opcodes.h ++++ b/arch/arm64/include/asm/opcodes.h +@@ -1 +1,5 @@ ++#ifdef CONFIG_CPU_BIG_ENDIAN ++#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN ++#endif ++ + #include <../../arm/include/asm/opcodes.h> +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 8aee3ae..c1492ba 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt_regs *regs) + + /* EL1 Single Step Handler hooks */ + static LIST_HEAD(step_hook); +-static DEFINE_RWLOCK(step_hook_lock); ++static DEFINE_SPINLOCK(step_hook_lock); + + void register_step_hook(struct step_hook *hook) + { +- write_lock(&step_hook_lock); +- list_add(&hook->node, &step_hook); +- write_unlock(&step_hook_lock); ++ spin_lock(&step_hook_lock); ++ list_add_rcu(&hook->node, &step_hook); ++ spin_unlock(&step_hook_lock); + } + + void unregister_step_hook(struct step_hook *hook) + { +- write_lock(&step_hook_lock); +- list_del(&hook->node); +- write_unlock(&step_hook_lock); ++ spin_lock(&step_hook_lock); ++ list_del_rcu(&hook->node); ++ spin_unlock(&step_hook_lock); ++ synchronize_rcu(); + } + + /* +@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr) + struct step_hook *hook; + int retval = DBG_HOOK_ERROR; + +- read_lock(&step_hook_lock); ++ rcu_read_lock(); + +- list_for_each_entry(hook, &step_hook, node) { ++ list_for_each_entry_rcu(hook, &step_hook, node) { + retval = hook->fn(regs, esr); + if (retval == DBG_HOOK_HANDLED) + break; + } + +- read_unlock(&step_hook_lock); ++ rcu_read_unlock(); + + return retval; + } +diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c +index bdeed9d..433c4b9 100644 +--- a/arch/mips/alchemy/devboards/db1000.c ++++ b/arch/mips/alchemy/devboards/db1000.c +@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void) + if (board == BCSR_WHOAMI_DB1500) { + c0 = AU1500_GPIO2_INT; + c1 = AU1500_GPIO5_INT; +- d0 = AU1500_GPIO0_INT; +- d1 = AU1500_GPIO3_INT; ++ d0 = 0; /* GPIO number, NOT irq! */ ++ d1 = 3; /* GPIO number, NOT irq! */ + s0 = AU1500_GPIO1_INT; + s1 = AU1500_GPIO4_INT; + } else if (board == BCSR_WHOAMI_DB1100) { + c0 = AU1100_GPIO2_INT; + c1 = AU1100_GPIO5_INT; +- d0 = AU1100_GPIO0_INT; +- d1 = AU1100_GPIO3_INT; ++ d0 = 0; /* GPIO number, NOT irq! */ ++ d1 = 3; /* GPIO number, NOT irq! */ + s0 = AU1100_GPIO1_INT; + s1 = AU1100_GPIO4_INT; + +@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void) + } else if (board == BCSR_WHOAMI_DB1000) { + c0 = AU1000_GPIO2_INT; + c1 = AU1000_GPIO5_INT; +- d0 = AU1000_GPIO0_INT; +- d1 = AU1000_GPIO3_INT; ++ d0 = 0; /* GPIO number, NOT irq! */ ++ d1 = 3; /* GPIO number, NOT irq! */ + s0 = AU1000_GPIO1_INT; + s1 = AU1000_GPIO4_INT; + platform_add_devices(db1000_devs, ARRAY_SIZE(db1000_devs)); + } else if ((board == BCSR_WHOAMI_PB1500) || + (board == BCSR_WHOAMI_PB1500R2)) { + c0 = AU1500_GPIO203_INT; +- d0 = AU1500_GPIO201_INT; ++ d0 = 1; /* GPIO number, NOT irq! */ + s0 = AU1500_GPIO202_INT; + twosocks = 0; + flashsize = 64; +@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void) + */ + } else if (board == BCSR_WHOAMI_PB1100) { + c0 = AU1100_GPIO11_INT; +- d0 = AU1100_GPIO9_INT; ++ d0 = 9; /* GPIO number, NOT irq! */ + s0 = AU1100_GPIO10_INT; + twosocks = 0; + flashsize = 64; +@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void) + } else + return 0; /* unknown board, no further dev setup to do */ + +- irq_set_irq_type(d0, IRQ_TYPE_EDGE_BOTH); + irq_set_irq_type(c0, IRQ_TYPE_LEVEL_LOW); + irq_set_irq_type(s0, IRQ_TYPE_LEVEL_LOW); + +@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void) + c0, d0, /*s0*/0, 0, 0); + + if (twosocks) { +- irq_set_irq_type(d1, IRQ_TYPE_EDGE_BOTH); + irq_set_irq_type(c1, IRQ_TYPE_LEVEL_LOW); + irq_set_irq_type(s1, IRQ_TYPE_LEVEL_LOW); + +diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c +index 5740bcf..6c37b93 100644 +--- a/arch/mips/alchemy/devboards/db1550.c ++++ b/arch/mips/alchemy/devboards/db1550.c +@@ -514,7 +514,7 @@ static void __init db1550_devices(void) + AU1000_PCMCIA_MEM_PHYS_ADDR + 0x000400000 - 1, + AU1000_PCMCIA_IO_PHYS_ADDR, + AU1000_PCMCIA_IO_PHYS_ADDR + 0x000010000 - 1, +- AU1550_GPIO3_INT, AU1550_GPIO0_INT, ++ AU1550_GPIO3_INT, 0, + /*AU1550_GPIO21_INT*/0, 0, 0); + + db1x_register_pcmcia_socket( +@@ -524,7 +524,7 @@ static void __init db1550_devices(void) + AU1000_PCMCIA_MEM_PHYS_ADDR + 0x004400000 - 1, + AU1000_PCMCIA_IO_PHYS_ADDR + 0x004000000, + AU1000_PCMCIA_IO_PHYS_ADDR + 0x004010000 - 1, +- AU1550_GPIO5_INT, AU1550_GPIO1_INT, ++ AU1550_GPIO5_INT, 1, + /*AU1550_GPIO22_INT*/0, 0, 1); + + platform_device_register(&db1550_nand_dev); +diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c +index 490cea5..5c62065 100644 +--- a/arch/mips/kernel/unaligned.c ++++ b/arch/mips/kernel/unaligned.c +@@ -885,7 +885,7 @@ static void emulate_load_store_insn(struct pt_regs *regs, + { + union mips_instruction insn; + unsigned long value; +- unsigned int res; ++ unsigned int res, preempted; + unsigned long origpc; + unsigned long orig31; + void __user *fault_addr = NULL; +@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struct pt_regs *regs, + if (!access_ok(VERIFY_READ, addr, sizeof(*fpr))) + goto sigbus; + +- /* +- * Disable preemption to avoid a race between copying +- * state from userland, migrating to another CPU and +- * updating the hardware vector register below. +- */ +- preempt_disable(); +- +- res = __copy_from_user_inatomic(fpr, addr, +- sizeof(*fpr)); +- if (res) +- goto fault; +- +- /* +- * Update the hardware register if it is in use by the +- * task in this quantum, in order to avoid having to +- * save & restore the whole vector context. +- */ +- if (test_thread_flag(TIF_USEDMSA)) +- write_msa_wr(wd, fpr, df); ++ do { ++ /* ++ * If we have live MSA context keep track of ++ * whether we get preempted in order to avoid ++ * the register context we load being clobbered ++ * by the live context as it's saved during ++ * preemption. If we don't have live context ++ * then it can't be saved to clobber the value ++ * we load. ++ */ ++ preempted = test_thread_flag(TIF_USEDMSA); ++ ++ res = __copy_from_user_inatomic(fpr, addr, ++ sizeof(*fpr)); ++ if (res) ++ goto fault; + +- preempt_enable(); ++ /* ++ * Update the hardware register if it is in use ++ * by the task in this quantum, in order to ++ * avoid having to save & restore the whole ++ * vector context. ++ */ ++ preempt_disable(); ++ if (test_thread_flag(TIF_USEDMSA)) { ++ write_msa_wr(wd, fpr, df); ++ preempted = 0; ++ } ++ preempt_enable(); ++ } while (preempted); + break; + + case msa_st_op: +diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h +index 0abdd4c..1960b87 100644 +--- a/arch/parisc/include/asm/uaccess.h ++++ b/arch/parisc/include/asm/uaccess.h +@@ -76,6 +76,7 @@ struct exception_table_entry { + */ + struct exception_data { + unsigned long fault_ip; ++ unsigned long fault_gp; + unsigned long fault_space; + unsigned long fault_addr; + }; +diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c +index d2f6257..78d30d2 100644 +--- a/arch/parisc/kernel/asm-offsets.c ++++ b/arch/parisc/kernel/asm-offsets.c +@@ -299,6 +299,7 @@ int main(void) + #endif + BLANK(); + DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip)); ++ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp)); + DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space)); + DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr)); + BLANK(); +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 568b2c6..3cad8aa 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); + EXPORT_SYMBOL(lclear_user); + EXPORT_SYMBOL(lstrnlen_user); + +-/* Global fixups */ +-extern void fixup_get_user_skip_1(void); +-extern void fixup_get_user_skip_2(void); +-extern void fixup_put_user_skip_1(void); +-extern void fixup_put_user_skip_2(void); ++/* Global fixups - defined as int to avoid creation of function pointers */ ++extern int fixup_get_user_skip_1; ++extern int fixup_get_user_skip_2; ++extern int fixup_put_user_skip_1; ++extern int fixup_put_user_skip_2; + EXPORT_SYMBOL(fixup_get_user_skip_1); + EXPORT_SYMBOL(fixup_get_user_skip_2); + EXPORT_SYMBOL(fixup_put_user_skip_1); +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index 553b098..77e2262 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + + if (fault_space == 0 && !faulthandler_disabled()) + { ++ /* Clean up and return if in exception table. */ ++ if (fixup_exception(regs)) ++ return; + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); + parisc_terminate("Kernel Fault", regs, code, fault_address); + } +diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S +index 536ef66..1052b74 100644 +--- a/arch/parisc/lib/fixup.S ++++ b/arch/parisc/lib/fixup.S +@@ -26,6 +26,7 @@ + + #ifdef CONFIG_SMP + .macro get_fault_ip t1 t2 ++ loadgp + addil LT%__per_cpu_offset,%r27 + LDREG RT%__per_cpu_offset(%r1),\t1 + /* t2 = smp_processor_id() */ +@@ -40,14 +41,19 @@ + LDREG RT%exception_data(%r1),\t1 + /* t1 = this_cpu_ptr(&exception_data) */ + add,l \t1,\t2,\t1 ++ /* %r27 = t1->fault_gp - restore gp */ ++ LDREG EXCDATA_GP(\t1), %r27 + /* t1 = t1->fault_ip */ + LDREG EXCDATA_IP(\t1), \t1 + .endm + #else + .macro get_fault_ip t1 t2 ++ loadgp + /* t1 = this_cpu_ptr(&exception_data) */ + addil LT%exception_data,%r27 + LDREG RT%exception_data(%r1),\t2 ++ /* %r27 = t2->fault_gp - restore gp */ ++ LDREG EXCDATA_GP(\t2), %r27 + /* t1 = t2->fault_ip */ + LDREG EXCDATA_IP(\t2), \t1 + .endm +diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c +index a762864..f906444 100644 +--- a/arch/parisc/mm/fault.c ++++ b/arch/parisc/mm/fault.c +@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs) + struct exception_data *d; + d = this_cpu_ptr(&exception_data); + d->fault_ip = regs->iaoq[0]; ++ d->fault_gp = regs->gr[27]; + d->fault_space = regs->isr; + d->fault_addr = regs->ior; + +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index 9833fee..807f159 100644 +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -486,13 +486,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte) + { + struct hugepd_freelist **batchp; + +- batchp = this_cpu_ptr(&hugepd_freelist_cur); ++ batchp = &get_cpu_var(hugepd_freelist_cur); + + if (atomic_read(&tlb->mm->mm_users) < 2 || + cpumask_equal(mm_cpumask(tlb->mm), + cpumask_of(smp_processor_id()))) { + kmem_cache_free(hugepte_cache, hugepte); +- put_cpu_var(hugepd_freelist_cur); ++ put_cpu_var(hugepd_freelist_cur); + return; + } + +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 30cfd64..9d2abb2 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -41,7 +41,7 @@ + + #define KVM_PIO_PAGE_OFFSET 1 + #define KVM_COALESCED_MMIO_PAGE_OFFSET 2 +-#define KVM_HALT_POLL_NS_DEFAULT 500000 ++#define KVM_HALT_POLL_NS_DEFAULT 400000 + + #define KVM_IRQCHIP_NUM_PINS KVM_IOAPIC_NUM_PINS + +diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h +index fa1195d..164e3f8 100644 +--- a/arch/x86/include/asm/pci_x86.h ++++ b/arch/x86/include/asm/pci_x86.h +@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock; + extern int (*pcibios_enable_irq)(struct pci_dev *dev); + extern void (*pcibios_disable_irq)(struct pci_dev *dev); + ++extern bool mp_should_keep_irq(struct device *dev); ++ + struct pci_raw_ops { + int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn, + int reg, int len, u32 *val); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 8bfc5fc..7eb4ebd 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6024,12 +6024,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win) + } + + /* try to inject new event if pending */ +- if (vcpu->arch.nmi_pending) { +- if (kvm_x86_ops->nmi_allowed(vcpu)) { +- --vcpu->arch.nmi_pending; +- vcpu->arch.nmi_injected = true; +- kvm_x86_ops->set_nmi(vcpu); +- } ++ if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) { ++ --vcpu->arch.nmi_pending; ++ vcpu->arch.nmi_injected = true; ++ kvm_x86_ops->set_nmi(vcpu); + } else if (kvm_cpu_has_injectable_intr(vcpu)) { + /* + * Because interrupts can be injected asynchronously, we are +@@ -6474,10 +6472,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) + if (inject_pending_event(vcpu, req_int_win) != 0) + req_immediate_exit = true; + /* enable NMI/IRQ window open exits if needed */ +- else if (vcpu->arch.nmi_pending) +- kvm_x86_ops->enable_nmi_window(vcpu); +- else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) +- kvm_x86_ops->enable_irq_window(vcpu); ++ else { ++ if (vcpu->arch.nmi_pending) ++ kvm_x86_ops->enable_nmi_window(vcpu); ++ if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win) ++ kvm_x86_ops->enable_irq_window(vcpu); ++ } + + if (kvm_lapic_enabled(vcpu)) { + update_cr8_intercept(vcpu); +diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c +index eccd4d9..8fd6f44 100644 +--- a/arch/x86/pci/common.c ++++ b/arch/x86/pci/common.c +@@ -673,28 +673,22 @@ int pcibios_add_device(struct pci_dev *dev) + return 0; + } + +-int pcibios_alloc_irq(struct pci_dev *dev) ++int pcibios_enable_device(struct pci_dev *dev, int mask) + { +- /* +- * If the PCI device was already claimed by core code and has +- * MSI enabled, probing of the pcibios IRQ will overwrite +- * dev->irq. So bail out if MSI is already enabled. +- */ +- if (pci_dev_msi_enabled(dev)) +- return -EBUSY; ++ int err; + +- return pcibios_enable_irq(dev); +-} ++ if ((err = pci_enable_resources(dev, mask)) < 0) ++ return err; + +-void pcibios_free_irq(struct pci_dev *dev) +-{ +- if (pcibios_disable_irq) +- pcibios_disable_irq(dev); ++ if (!pci_dev_msi_enabled(dev)) ++ return pcibios_enable_irq(dev); ++ return 0; + } + +-int pcibios_enable_device(struct pci_dev *dev, int mask) ++void pcibios_disable_device (struct pci_dev *dev) + { +- return pci_enable_resources(dev, mask); ++ if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq) ++ pcibios_disable_irq(dev); + } + + int pci_ext_cfg_avail(void) +diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c +index 0d24e7c..8b93e63 100644 +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -215,7 +215,7 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) + int polarity; + int ret; + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + switch (intel_mid_identify_cpu()) { +@@ -256,13 +256,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) + + static void intel_mid_pci_irq_disable(struct pci_dev *dev) + { +- if (pci_has_managed_irq(dev)) { ++ if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed && ++ dev->irq > 0) { + mp_unmap_irq(dev->irq); + dev->irq_managed = 0; +- /* +- * Don't reset dev->irq here, otherwise +- * intel_mid_pci_irq_enable() will fail on next call. +- */ + } + } + +diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c +index 32e7034..9bd1154 100644 +--- a/arch/x86/pci/irq.c ++++ b/arch/x86/pci/irq.c +@@ -1202,7 +1202,7 @@ static int pirq_enable_irq(struct pci_dev *dev) + struct pci_dev *temp_dev; + int irq; + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + irq = IO_APIC_get_PCI_irq_vector(dev->bus->number, +@@ -1230,7 +1230,8 @@ static int pirq_enable_irq(struct pci_dev *dev) + } + dev = temp_dev; + if (irq >= 0) { +- pci_set_managed_irq(dev, irq); ++ dev->irq_managed = 1; ++ dev->irq = irq; + dev_info(&dev->dev, "PCI->APIC IRQ transform: " + "INT %c -> IRQ %d\n", 'A' + pin - 1, irq); + return 0; +@@ -1256,10 +1257,24 @@ static int pirq_enable_irq(struct pci_dev *dev) + return 0; + } + ++bool mp_should_keep_irq(struct device *dev) ++{ ++ if (dev->power.is_prepared) ++ return true; ++#ifdef CONFIG_PM ++ if (dev->power.runtime_status == RPM_SUSPENDING) ++ return true; ++#endif ++ ++ return false; ++} ++ + static void pirq_disable_irq(struct pci_dev *dev) + { +- if (io_apic_assign_pci_irqs && pci_has_managed_irq(dev)) { ++ if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) && ++ dev->irq_managed && dev->irq) { + mp_unmap_irq(dev->irq); +- pci_reset_managed_irq(dev); ++ dev->irq = 0; ++ dev->irq_managed = 0; + } + } +diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c +index 90d6d47..ecdb5a2 100644 +--- a/crypto/asymmetric_keys/pkcs7_trust.c ++++ b/crypto/asymmetric_keys/pkcs7_trust.c +@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7, + int cached_ret = -ENOKEY; + int ret; + ++ *_trusted = false; ++ + for (p = pkcs7->certs; p; p = p->next) + p->seen = false; + +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c +index c933675..8a10a7a 100644 +--- a/drivers/acpi/pci_irq.c ++++ b/drivers/acpi/pci_irq.c +@@ -409,7 +409,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev) + return 0; + } + +- if (pci_has_managed_irq(dev)) ++ if (dev->irq_managed && dev->irq > 0) + return 0; + + entry = acpi_pci_irq_lookup(dev, pin); +@@ -454,7 +454,8 @@ int acpi_pci_irq_enable(struct pci_dev *dev) + kfree(entry); + return rc; + } +- pci_set_managed_irq(dev, rc); ++ dev->irq = rc; ++ dev->irq_managed = 1; + + if (link) + snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link); +@@ -477,9 +478,17 @@ void acpi_pci_irq_disable(struct pci_dev *dev) + u8 pin; + + pin = dev->pin; +- if (!pin || !pci_has_managed_irq(dev)) ++ if (!pin || !dev->irq_managed || dev->irq <= 0) + return; + ++ /* Keep IOAPIC pin configuration when suspending */ ++ if (dev->dev.power.is_prepared) ++ return; ++#ifdef CONFIG_PM ++ if (dev->dev.power.runtime_status == RPM_SUSPENDING) ++ return; ++#endif ++ + entry = acpi_pci_irq_lookup(dev, pin); + if (!entry) + return; +@@ -499,6 +508,6 @@ void acpi_pci_irq_disable(struct pci_dev *dev) + dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin)); + if (gsi >= 0) { + acpi_unregister_gsi(gsi); +- pci_reset_managed_irq(dev); ++ dev->irq_managed = 0; + } + } +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 81ea69f..fbdddd6 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_req_create( + + osdc = &rbd_dev->rbd_client->client->osdc; + osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false, +- GFP_ATOMIC); ++ GFP_NOIO); + if (!osd_req) + return NULL; /* ENOMEM */ + +@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request) + rbd_dev = img_request->rbd_dev; + osdc = &rbd_dev->rbd_client->client->osdc; + osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops, +- false, GFP_ATOMIC); ++ false, GFP_NOIO); + if (!osd_req) + return NULL; /* ENOMEM */ + +@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request, + bio_chain_clone_range(&bio_list, + &bio_offset, + clone_size, +- GFP_ATOMIC); ++ GFP_NOIO); + if (!obj_request->bio_list) + goto out_unwind; + } else if (type == OBJ_REQUEST_PAGES) { +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c +index 272110c..ea87033 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c +@@ -898,14 +898,6 @@ static int gmc_v7_0_early_init(void *handle) + gmc_v7_0_set_gart_funcs(adev); + gmc_v7_0_set_irq_funcs(adev); + +- if (adev->flags & AMD_IS_APU) { +- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; +- } else { +- u32 tmp = RREG32(mmMC_SEQ_MISC0); +- tmp &= MC_SEQ_MISC0__MT__MASK; +- adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); +- } +- + return 0; + } + +@@ -926,6 +918,14 @@ static int gmc_v7_0_sw_init(void *handle) + if (r) + return r; + ++ if (adev->flags & AMD_IS_APU) { ++ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; ++ } else { ++ u32 tmp = RREG32(mmMC_SEQ_MISC0); ++ tmp &= MC_SEQ_MISC0__MT__MASK; ++ adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp); ++ } ++ + r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); + if (r) + return r; +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +index ba4ad00..0842308 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +@@ -852,14 +852,6 @@ static int gmc_v8_0_early_init(void *handle) + gmc_v8_0_set_gart_funcs(adev); + gmc_v8_0_set_irq_funcs(adev); + +- if (adev->flags & AMD_IS_APU) { +- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; +- } else { +- u32 tmp = RREG32(mmMC_SEQ_MISC0); +- tmp &= MC_SEQ_MISC0__MT__MASK; +- adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); +- } +- + return 0; + } + +@@ -870,6 +862,8 @@ static int gmc_v8_0_late_init(void *handle) + return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0); + } + ++#define mmMC_SEQ_MISC0_FIJI 0xA71 ++ + static int gmc_v8_0_sw_init(void *handle) + { + int r; +@@ -880,6 +874,19 @@ static int gmc_v8_0_sw_init(void *handle) + if (r) + return r; + ++ if (adev->flags & AMD_IS_APU) { ++ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN; ++ } else { ++ u32 tmp; ++ ++ if (adev->asic_type == CHIP_FIJI) ++ tmp = RREG32(mmMC_SEQ_MISC0_FIJI); ++ else ++ tmp = RREG32(mmMC_SEQ_MISC0); ++ tmp &= MC_SEQ_MISC0__MT__MASK; ++ adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp); ++ } ++ + r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault); + if (r) + return r; +diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c +index 9535c5b..7e5a972 100644 +--- a/drivers/gpu/drm/drm_dp_helper.c ++++ b/drivers/gpu/drm/drm_dp_helper.c +@@ -178,7 +178,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, + { + struct drm_dp_aux_msg msg; + unsigned int retry; +- int err; ++ int err = 0; + + memset(&msg, 0, sizeof(msg)); + msg.address = offset; +@@ -186,6 +186,8 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, + msg.buffer = buffer; + msg.size = size; + ++ mutex_lock(&aux->hw_mutex); ++ + /* + * The specification doesn't give any recommendation on how often to + * retry native transactions. We used to retry 7 times like for +@@ -194,25 +196,24 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, + */ + for (retry = 0; retry < 32; retry++) { + +- mutex_lock(&aux->hw_mutex); + err = aux->transfer(aux, &msg); +- mutex_unlock(&aux->hw_mutex); + if (err < 0) { + if (err == -EBUSY) + continue; + +- return err; ++ goto unlock; + } + + + switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) { + case DP_AUX_NATIVE_REPLY_ACK: + if (err < size) +- return -EPROTO; +- return err; ++ err = -EPROTO; ++ goto unlock; + + case DP_AUX_NATIVE_REPLY_NACK: +- return -EIO; ++ err = -EIO; ++ goto unlock; + + case DP_AUX_NATIVE_REPLY_DEFER: + usleep_range(AUX_RETRY_INTERVAL, AUX_RETRY_INTERVAL + 100); +@@ -221,7 +222,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request, + } + + DRM_DEBUG_KMS("too many retries, giving up\n"); +- return -EIO; ++ err = -EIO; ++ ++unlock: ++ mutex_unlock(&aux->hw_mutex); ++ return err; + } + + /** +@@ -543,9 +548,7 @@ static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) + int max_retries = max(7, drm_dp_i2c_retry_count(msg, dp_aux_i2c_speed_khz)); + + for (retry = 0, defer_i2c = 0; retry < (max_retries + defer_i2c); retry++) { +- mutex_lock(&aux->hw_mutex); + ret = aux->transfer(aux, msg); +- mutex_unlock(&aux->hw_mutex); + if (ret < 0) { + if (ret == -EBUSY) + continue; +@@ -684,6 +687,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + + memset(&msg, 0, sizeof(msg)); + ++ mutex_lock(&aux->hw_mutex); ++ + for (i = 0; i < num; i++) { + msg.address = msgs[i].addr; + drm_dp_i2c_msg_set_request(&msg, &msgs[i]); +@@ -738,6 +743,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, + msg.size = 0; + (void)drm_dp_i2c_do_msg(aux, &msg); + ++ mutex_unlock(&aux->hw_mutex); ++ + return err; + } + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index a82b891..7285adb 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2926,9 +2926,11 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { + /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ + { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 }, + { 0, 0, 0, 0 }, + }; + +@@ -3008,6 +3010,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + } + ++p; + } ++ /* limit mclk on all R7 370 parts for stability */ ++ if (rdev->pdev->device == 0x6811 && ++ rdev->pdev->revision == 0x81) ++ max_mclk = 120000; + + if (rps->vce_active) { + rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index 62c7b1d..73e41a8 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -539,7 +539,7 @@ static int udlfb_create(struct drm_fb_helper *helper, + out_destroy_fbi: + drm_fb_helper_release_fbi(helper); + out_gfree: +- drm_gem_object_unreference(&ufbdev->ufb.obj->base); ++ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base); + out: + return ret; + } +diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c +index 2a0a784..d7528e0 100644 +--- a/drivers/gpu/drm/udl/udl_gem.c ++++ b/drivers/gpu/drm/udl/udl_gem.c +@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file, + return ret; + } + +- drm_gem_object_unreference(&obj->base); ++ drm_gem_object_unreference_unlocked(&obj->base); + *handle_p = handle; + return 0; + } +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index 5dd426f..0df32fe 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count) + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_interface *intf) + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device *hid) + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interface *intf) + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 01a4f05..3c0f47a 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2493,6 +2493,17 @@ void wacom_setup_device_quirks(struct wacom *wacom) + } + + /* ++ * Hack for the Bamboo One: ++ * the device presents a PAD/Touch interface as most Bamboos and even ++ * sends ghosts PAD data on it. However, later, we must disable this ++ * ghost interface, and we can not detect it unless we set it here ++ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH. ++ */ ++ if (features->type == BAMBOO_PEN && ++ features->pktlen == WACOM_PKGLEN_BBTOUCH3) ++ features->device_type |= WACOM_DEVICETYPE_PAD; ++ ++ /* + * Raw Wacom-mode pen and touch events both come from interface + * 0, whose HID descriptor has an application usage of 0xFF0D + * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back +diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c +index 36544c4..303d0c9 100644 +--- a/drivers/hwmon/max1111.c ++++ b/drivers/hwmon/max1111.c +@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; + + int max1111_read_channel(int channel) + { ++ if (!the_max1111 || !the_max1111->spi) ++ return -ENODEV; ++ + return max1111_read(&the_max1111->spi->dev, channel); + } + EXPORT_SYMBOL(max1111_read_channel); +@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi) + { + struct max1111_data *data = spi_get_drvdata(spi); + ++#ifdef CONFIG_SHARPSL_PM ++ the_max1111 = NULL; ++#endif + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); + sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); +diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c +index 2d33f1e..291c61a 100644 +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, + { + int ret; + int axis = chan->scan_index; +- unsigned int raw_val; ++ __le16 raw_val; + + mutex_lock(&data->mutex); + ret = bmc150_accel_set_power_state(data, true); +@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data, + } + + ret = regmap_bulk_read(data->regmap, BMC150_ACCEL_AXIS_TO_REG(axis), +- &raw_val, 2); ++ &raw_val, sizeof(raw_val)); + if (ret < 0) { + dev_err(data->dev, "Error reading axis %d\n", axis); + bmc150_accel_set_power_state(data, false); + mutex_unlock(&data->mutex); + return ret; + } +- *val = sign_extend32(raw_val >> chan->scan_type.shift, ++ *val = sign_extend32(le16_to_cpu(raw_val) >> chan->scan_type.shift, + chan->scan_type.realbits - 1); + ret = bmc150_accel_set_power_state(data, false); + mutex_unlock(&data->mutex); +@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc150_accel_event = { + .realbits = (bits), \ + .storagebits = 16, \ + .shift = 16 - (bits), \ ++ .endianness = IIO_LE, \ + }, \ + .event_spec = &bmc150_accel_event, \ + .num_event_specs = 1 \ +diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c +index 02ff789..acb3b30 100644 +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160_data *data, int *val) + static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) + { + int ret; +- unsigned int raw_val; ++ __le16 raw_val; + + mutex_lock(&data->mutex); + ret = bmg160_set_power_state(data, true); +@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) + } + + ret = regmap_bulk_read(data->regmap, BMG160_AXIS_TO_REG(axis), &raw_val, +- 2); ++ sizeof(raw_val)); + if (ret < 0) { + dev_err(data->dev, "Error reading axis %d\n", axis); + bmg160_set_power_state(data, false); +@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val) + return ret; + } + +- *val = sign_extend32(raw_val, 15); ++ *val = sign_extend32(le16_to_cpu(raw_val), 15); + ret = bmg160_set_power_state(data, false); + mutex_unlock(&data->mutex); + if (ret < 0) +@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg160_event = { + .sign = 's', \ + .realbits = 16, \ + .storagebits = 16, \ ++ .endianness = IIO_LE, \ + }, \ + .event_spec = &bmg160_event, \ + .num_event_specs = 1 \ +@@ -780,7 +781,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p) + mutex_unlock(&data->mutex); + goto err; + } +- data->buffer[i++] = ret; ++ data->buffer[i++] = val; + } + mutex_unlock(&data->mutex); + +diff --git a/drivers/iio/magnetometer/st_magn.h b/drivers/iio/magnetometer/st_magn.h +index 06a4d9c..9daca46 100644 +--- a/drivers/iio/magnetometer/st_magn.h ++++ b/drivers/iio/magnetometer/st_magn.h +@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(struct iio_dev *indio_dev) + static inline void st_magn_deallocate_ring(struct iio_dev *indio_dev) + { + } ++#define ST_MAGN_TRIGGER_SET_STATE NULL + #endif /* CONFIG_IIO_BUFFER */ + + #endif /* ST_MAGN_H */ +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 0e3b009..515bb8b 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev) + if (!group->default_domain) { + group->default_domain = __iommu_domain_alloc(dev->bus, + IOMMU_DOMAIN_DMA); +- group->domain = group->default_domain; ++ if (!group->domain) ++ group->domain = group->default_domain; + } + + ret = iommu_group_add_device(group, dev); +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 15516a6..323aad3 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -2119,14 +2119,12 @@ static int coda_probe(struct platform_device *pdev) + + pdev_id = of_id ? of_id->data : platform_get_device_id(pdev); + +- if (of_id) { ++ if (of_id) + dev->devtype = of_id->data; +- } else if (pdev_id) { ++ else if (pdev_id) + dev->devtype = &coda_devdata[pdev_id->driver_data]; +- } else { +- ret = -EINVAL; +- goto err_v4l2_register; +- } ++ else ++ return -EINVAL; + + spin_lock_init(&dev->irqlock); + INIT_LIST_HEAD(&dev->instances); +diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c +index 6310aca..d41ae95 100644 +--- a/drivers/media/platform/vsp1/vsp1_sru.c ++++ b/drivers/media/platform/vsp1/vsp1_sru.c +@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable) + mutex_lock(sru->ctrls.lock); + ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0) + & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK); ++ vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0); + mutex_unlock(sru->ctrls.lock); + + vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5); +diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c +index 0934024..d91ded7 100644 +--- a/drivers/media/usb/au0828/au0828-core.c ++++ b/drivers/media/usb/au0828/au0828-core.c +@@ -159,7 +159,7 @@ static void au0828_usb_disconnect(struct usb_interface *interface) + Set the status so poll routines can check and avoid + access after disconnect. + */ +- dev->dev_state = DEV_DISCONNECTED; ++ set_bit(DEV_DISCONNECTED, &dev->dev_state); + + au0828_rc_unregister(dev); + /* Digital TV */ +diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c +index b0f0679..3d6687f 100644 +--- a/drivers/media/usb/au0828/au0828-input.c ++++ b/drivers/media/usb/au0828/au0828-input.c +@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(struct au0828_rc *ir) + bool first = true; + + /* do nothing if device is disconnected */ +- if (ir->dev->dev_state == DEV_DISCONNECTED) ++ if (test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) + return 0; + + /* Check IR int */ +@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_dev *rc) + cancel_delayed_work_sync(&ir->work); + + /* do nothing if device is disconnected */ +- if (ir->dev->dev_state != DEV_DISCONNECTED) { ++ if (!test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) { + /* Disable IR */ + au8522_rc_clear(ir, 0xe0, 1 << 4); + } +diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c +index 45c622e..7b2fe1b 100644 +--- a/drivers/media/usb/au0828/au0828-video.c ++++ b/drivers/media/usb/au0828/au0828-video.c +@@ -104,14 +104,13 @@ static inline void print_err_status(struct au0828_dev *dev, + + static int check_dev(struct au0828_dev *dev) + { +- if (dev->dev_state & DEV_DISCONNECTED) { ++ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) { + pr_info("v4l2 ioctl: device not present\n"); + return -ENODEV; + } + +- if (dev->dev_state & DEV_MISCONFIGURED) { +- pr_info("v4l2 ioctl: device is misconfigured; " +- "close and open it again\n"); ++ if (test_bit(DEV_MISCONFIGURED, &dev->dev_state)) { ++ pr_info("v4l2 ioctl: device is misconfigured; close and open it again\n"); + return -EIO; + } + return 0; +@@ -519,8 +518,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb) + if (!dev) + return 0; + +- if ((dev->dev_state & DEV_DISCONNECTED) || +- (dev->dev_state & DEV_MISCONFIGURED)) ++ if (test_bit(DEV_DISCONNECTED, &dev->dev_state) || ++ test_bit(DEV_MISCONFIGURED, &dev->dev_state)) + return 0; + + if (urb->status < 0) { +@@ -766,10 +765,10 @@ static int au0828_stream_interrupt(struct au0828_dev *dev) + int ret = 0; + + dev->stream_state = STREAM_INTERRUPT; +- if (dev->dev_state == DEV_DISCONNECTED) ++ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) + return -ENODEV; + else if (ret) { +- dev->dev_state = DEV_MISCONFIGURED; ++ set_bit(DEV_MISCONFIGURED, &dev->dev_state); + dprintk(1, "%s device is misconfigured!\n", __func__); + return ret; + } +@@ -958,7 +957,7 @@ static int au0828_v4l2_open(struct file *filp) + int ret; + + dprintk(1, +- "%s called std_set %d dev_state %d stream users %d users %d\n", ++ "%s called std_set %d dev_state %ld stream users %d users %d\n", + __func__, dev->std_set_in_tuner_core, dev->dev_state, + dev->streaming_users, dev->users); + +@@ -977,7 +976,7 @@ static int au0828_v4l2_open(struct file *filp) + au0828_analog_stream_enable(dev); + au0828_analog_stream_reset(dev); + dev->stream_state = STREAM_OFF; +- dev->dev_state |= DEV_INITIALIZED; ++ set_bit(DEV_INITIALIZED, &dev->dev_state); + } + dev->users++; + mutex_unlock(&dev->lock); +@@ -991,7 +990,7 @@ static int au0828_v4l2_close(struct file *filp) + struct video_device *vdev = video_devdata(filp); + + dprintk(1, +- "%s called std_set %d dev_state %d stream users %d users %d\n", ++ "%s called std_set %d dev_state %ld stream users %d users %d\n", + __func__, dev->std_set_in_tuner_core, dev->dev_state, + dev->streaming_users, dev->users); + +@@ -1007,7 +1006,7 @@ static int au0828_v4l2_close(struct file *filp) + del_timer_sync(&dev->vbi_timeout); + } + +- if (dev->dev_state == DEV_DISCONNECTED) ++ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) + goto end; + + if (dev->users == 1) { +@@ -1036,7 +1035,7 @@ static void au0828_init_tuner(struct au0828_dev *dev) + .type = V4L2_TUNER_ANALOG_TV, + }; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + if (dev->std_set_in_tuner_core) +@@ -1108,7 +1107,7 @@ static int vidioc_querycap(struct file *file, void *priv, + struct video_device *vdev = video_devdata(file); + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + strlcpy(cap->driver, "au0828", sizeof(cap->driver)); +@@ -1151,7 +1150,7 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv, + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + f->fmt.pix.width = dev->width; +@@ -1170,7 +1169,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv, + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + return au0828_set_format(dev, VIDIOC_TRY_FMT, f); +@@ -1182,7 +1181,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv, + struct au0828_dev *dev = video_drvdata(file); + int rc; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + rc = check_dev(dev); +@@ -1204,7 +1203,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id norm) + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + if (norm == dev->std) +@@ -1236,7 +1235,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *norm) + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + *norm = dev->std; +@@ -1259,7 +1258,7 @@ static int vidioc_enum_input(struct file *file, void *priv, + [AU0828_VMUX_DEBUG] = "tv debug" + }; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + tmp = input->index; +@@ -1289,7 +1288,7 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i) + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + *i = dev->ctrl_input; +@@ -1300,7 +1299,7 @@ static void au0828_s_input(struct au0828_dev *dev, int index) + { + int i; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + switch (AUVI_INPUT(index).type) { +@@ -1385,7 +1384,7 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a) + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + a->index = dev->ctrl_ainput; +@@ -1405,7 +1404,7 @@ static int vidioc_s_audio(struct file *file, void *priv, const struct v4l2_audio + if (a->index != dev->ctrl_ainput) + return -EINVAL; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + return 0; + } +@@ -1417,7 +1416,7 @@ static int vidioc_g_tuner(struct file *file, void *priv, struct v4l2_tuner *t) + if (t->index != 0) + return -EINVAL; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + strcpy(t->name, "Auvitek tuner"); +@@ -1437,7 +1436,7 @@ static int vidioc_s_tuner(struct file *file, void *priv, + if (t->index != 0) + return -EINVAL; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + au0828_init_tuner(dev); +@@ -1459,7 +1458,7 @@ static int vidioc_g_frequency(struct file *file, void *priv, + + if (freq->tuner != 0) + return -EINVAL; +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + freq->frequency = dev->ctrl_freq; + return 0; +@@ -1474,7 +1473,7 @@ static int vidioc_s_frequency(struct file *file, void *priv, + if (freq->tuner != 0) + return -EINVAL; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + au0828_init_tuner(dev); +@@ -1500,7 +1499,7 @@ static int vidioc_g_fmt_vbi_cap(struct file *file, void *priv, + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + format->fmt.vbi.samples_per_line = dev->vbi_width; +@@ -1526,7 +1525,7 @@ static int vidioc_cropcap(struct file *file, void *priv, + if (cc->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) + return -EINVAL; + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + cc->bounds.left = 0; +@@ -1548,7 +1547,7 @@ static int vidioc_g_register(struct file *file, void *priv, + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + reg->val = au0828_read(dev, reg->reg); +@@ -1561,7 +1560,7 @@ static int vidioc_s_register(struct file *file, void *priv, + { + struct au0828_dev *dev = video_drvdata(file); + +- dprintk(1, "%s called std_set %d dev_state %d\n", __func__, ++ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__, + dev->std_set_in_tuner_core, dev->dev_state); + + return au0828_writereg(dev, reg->reg, reg->val); +diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h +index 60b5939..d1b6405a 100644 +--- a/drivers/media/usb/au0828/au0828.h ++++ b/drivers/media/usb/au0828/au0828.h +@@ -21,6 +21,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include <linux/bitops.h> + #include <linux/usb.h> + #include <linux/i2c.h> + #include <linux/i2c-algo-bit.h> +@@ -122,9 +123,9 @@ enum au0828_stream_state { + + /* device state */ + enum au0828_dev_state { +- DEV_INITIALIZED = 0x01, +- DEV_DISCONNECTED = 0x02, +- DEV_MISCONFIGURED = 0x04 ++ DEV_INITIALIZED = 0, ++ DEV_DISCONNECTED = 1, ++ DEV_MISCONFIGURED = 2 + }; + + struct au0828_dev; +@@ -248,7 +249,7 @@ struct au0828_dev { + int input_type; + int std_set_in_tuner_core; + unsigned int ctrl_input; +- enum au0828_dev_state dev_state; ++ long unsigned int dev_state; /* defined at enum au0828_dev_state */; + enum au0828_stream_state stream_state; + wait_queue_head_t open; + +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index b693206..d1dc1a1 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf, + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 45ee07d..6101548 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -390,6 +390,7 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot) + slot->cd_idx = 0; + slot->cd_override_level = true; + if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD || ++ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXTM_SD || + slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD) + slot->host->mmc_host_ops.get_cd = bxt_get_cd; + +@@ -1173,6 +1174,30 @@ static const struct pci_device_id pci_ids[] = { + + { + .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BXTM_EMMC, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BXTM_SDIO, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, ++ .device = PCI_DEVICE_ID_INTEL_BXTM_SD, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd, ++ }, ++ ++ { ++ .vendor = PCI_VENDOR_ID_INTEL, + .device = PCI_DEVICE_ID_INTEL_APL_EMMC, + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, +diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h +index d1a0b4d..89e7151 100644 +--- a/drivers/mmc/host/sdhci-pci.h ++++ b/drivers/mmc/host/sdhci-pci.h +@@ -28,6 +28,9 @@ + #define PCI_DEVICE_ID_INTEL_BXT_SD 0x0aca + #define PCI_DEVICE_ID_INTEL_BXT_EMMC 0x0acc + #define PCI_DEVICE_ID_INTEL_BXT_SDIO 0x0ad0 ++#define PCI_DEVICE_ID_INTEL_BXTM_SD 0x1aca ++#define PCI_DEVICE_ID_INTEL_BXTM_EMMC 0x1acc ++#define PCI_DEVICE_ID_INTEL_BXTM_SDIO 0x1ad0 + #define PCI_DEVICE_ID_INTEL_APL_SD 0x5aca + #define PCI_DEVICE_ID_INTEL_APL_EMMC 0x5acc + #define PCI_DEVICE_ID_INTEL_APL_SDIO 0x5ad0 +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 28bbca0..b3d70a7 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3260,6 +3260,30 @@ static int bond_close(struct net_device *bond_dev) + return 0; + } + ++/* fold stats, assuming all rtnl_link_stats64 fields are u64, but ++ * that some drivers can provide 32bit values only. ++ */ ++static void bond_fold_stats(struct rtnl_link_stats64 *_res, ++ const struct rtnl_link_stats64 *_new, ++ const struct rtnl_link_stats64 *_old) ++{ ++ const u64 *new = (const u64 *)_new; ++ const u64 *old = (const u64 *)_old; ++ u64 *res = (u64 *)_res; ++ int i; ++ ++ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { ++ u64 nv = new[i]; ++ u64 ov = old[i]; ++ ++ /* detects if this particular field is 32bit only */ ++ if (((nv | ov) >> 32) == 0) ++ res[i] += (u32)nv - (u32)ov; ++ else ++ res[i] += nv - ov; ++ } ++} ++ + static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, + struct rtnl_link_stats64 *stats) + { +@@ -3268,43 +3292,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, + struct list_head *iter; + struct slave *slave; + ++ spin_lock(&bond->stats_lock); + memcpy(stats, &bond->bond_stats, sizeof(*stats)); + +- bond_for_each_slave(bond, slave, iter) { +- const struct rtnl_link_stats64 *sstats = ++ rcu_read_lock(); ++ bond_for_each_slave_rcu(bond, slave, iter) { ++ const struct rtnl_link_stats64 *new = + dev_get_stats(slave->dev, &temp); +- struct rtnl_link_stats64 *pstats = &slave->slave_stats; +- +- stats->rx_packets += sstats->rx_packets - pstats->rx_packets; +- stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes; +- stats->rx_errors += sstats->rx_errors - pstats->rx_errors; +- stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped; +- +- stats->tx_packets += sstats->tx_packets - pstats->tx_packets;; +- stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes; +- stats->tx_errors += sstats->tx_errors - pstats->tx_errors; +- stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped; +- +- stats->multicast += sstats->multicast - pstats->multicast; +- stats->collisions += sstats->collisions - pstats->collisions; +- +- stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors; +- stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors; +- stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors; +- stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors; +- stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors; +- stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors; +- +- stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors; +- stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors; +- stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors; +- stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors; +- stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors; ++ ++ bond_fold_stats(stats, new, &slave->slave_stats); + + /* save off the slave stats for the next run */ +- memcpy(pstats, sstats, sizeof(*sstats)); ++ memcpy(&slave->slave_stats, new, sizeof(*new)); + } ++ rcu_read_unlock(); ++ + memcpy(&bond->bond_stats, stats, sizeof(*stats)); ++ spin_unlock(&bond->stats_lock); + + return stats; + } +@@ -4118,6 +4122,7 @@ void bond_setup(struct net_device *bond_dev) + struct bonding *bond = netdev_priv(bond_dev); + + spin_lock_init(&bond->mode_lock); ++ spin_lock_init(&bond->stats_lock); + bond->params = bonding_defaults; + + /* Initialize pointers */ +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 17f017a..0fb3f8d 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev, + dev->stats.tx_bytes += tx_cb_ptr->skb->len; + dma_unmap_single(&dev->dev, + dma_unmap_addr(tx_cb_ptr, dma_addr), +- tx_cb_ptr->skb->len, ++ dma_unmap_len(tx_cb_ptr, dma_len), + DMA_TO_DEVICE); + bcmgenet_free_cb(tx_cb_ptr); + } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) { +@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct net_device *dev, + } + + dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping); +- dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len); ++ dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len); + length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags | + (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) | + DMA_TX_APPEND_CRC; +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index 060dd39..973dade 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -3312,13 +3312,14 @@ jme_resume(struct device *dev) + jme_reset_phy_processor(jme); + jme_phy_calibration(jme); + jme_phy_setEA(jme); +- jme_start_irq(jme); + netif_device_attach(netdev); + + atomic_inc(&jme->link_changing); + + jme_reset_link(jme); + ++ jme_start_irq(jme); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index cad6c44..d314d96 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -3132,7 +3132,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, + case QP_TRANS_RTS2RTS: + case QP_TRANS_SQD2SQD: + case QP_TRANS_SQD2RTS: +- if (slave != mlx4_master_func_num(dev)) ++ if (slave != mlx4_master_func_num(dev)) { + if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) { + port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1; + if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB) +@@ -3151,6 +3151,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev, + if (qp_ctx->alt_path.mgid_index >= num_gids) + return -EINVAL; + } ++ } + break; + default: + break; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index 4365c8b..605f641 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -61,6 +61,8 @@ struct mlxsw_sp { + #define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100 + unsigned int interval; /* ms */ + } fdb_notify; ++#define MLXSW_SP_MIN_AGEING_TIME 10 ++#define MLXSW_SP_MAX_AGEING_TIME 1000000 + #define MLXSW_SP_DEFAULT_AGEING_TIME 300 + u32 ageing_time; + struct { +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 7dbeafa..d4c4c2b 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -232,8 +232,13 @@ static int mlxsw_sp_port_attr_br_ageing_set(struct mlxsw_sp_port *mlxsw_sp_port, + unsigned long ageing_jiffies = clock_t_to_jiffies(ageing_clock_t); + u32 ageing_time = jiffies_to_msecs(ageing_jiffies) / 1000; + +- if (switchdev_trans_ph_prepare(trans)) +- return 0; ++ if (switchdev_trans_ph_prepare(trans)) { ++ if (ageing_time < MLXSW_SP_MIN_AGEING_TIME || ++ ageing_time > MLXSW_SP_MAX_AGEING_TIME) ++ return -ERANGE; ++ else ++ return 0; ++ } + + return mlxsw_sp_ageing_set(mlxsw_sp, ageing_time); + } +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +index 46bbea8..55007f1 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h +@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats { + u64 tx_dma_map_error; + u64 spurious_intr; + u64 mac_filter_limit_overrun; ++ u64 mbx_spurious_intr; + }; + + /* +@@ -1099,7 +1100,7 @@ struct qlcnic_mailbox { + unsigned long status; + spinlock_t queue_lock; /* Mailbox queue lock */ + spinlock_t aen_lock; /* Mailbox response/AEN lock */ +- atomic_t rsp_status; ++ u32 rsp_status; + u32 num_cmds; + }; + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index 37a731b..f9640d5ce 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter) + + static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx) + { +- atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED); ++ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; + complete(&mbx->completion); + } + +@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter) + if (event & QLCNIC_MBX_ASYNC_EVENT) { + __qlcnic_83xx_process_aen(adapter); + } else { +- if (atomic_read(&mbx->rsp_status) != rsp_status) ++ if (mbx->rsp_status != rsp_status) + qlcnic_83xx_notify_mbx_response(mbx); + } + out: +@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter) + if (event & QLCNIC_MBX_ASYNC_EVENT) { + __qlcnic_83xx_process_aen(adapter); + } else { +- if (atomic_read(&mbx->rsp_status) != rsp_status) ++ if (mbx->rsp_status != rsp_status) + qlcnic_83xx_notify_mbx_response(mbx); + } + } +@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter, + + static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) + { ++ u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED; + struct qlcnic_adapter *adapter = data; + struct qlcnic_mailbox *mbx; +- u32 mask, resp, event; + unsigned long flags; + + mbx = adapter->ahw->mailbox; +@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data) + goto out; + + event = readl(QLCNIC_MBX_FW(adapter->ahw, 0)); +- if (event & QLCNIC_MBX_ASYNC_EVENT) ++ if (event & QLCNIC_MBX_ASYNC_EVENT) { + __qlcnic_83xx_process_aen(adapter); +- else +- qlcnic_83xx_notify_mbx_response(mbx); ++ } else { ++ if (mbx->rsp_status != rsp_status) ++ qlcnic_83xx_notify_mbx_response(mbx); ++ else ++ adapter->stats.mbx_spurious_intr++; ++ } + + out: + mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK); +@@ -4050,10 +4054,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) + struct qlcnic_adapter *adapter = mbx->adapter; + const struct qlcnic_mbx_ops *mbx_ops = mbx->ops; + struct device *dev = &adapter->pdev->dev; +- atomic_t *rsp_status = &mbx->rsp_status; + struct list_head *head = &mbx->cmd_q; + struct qlcnic_hardware_context *ahw; + struct qlcnic_cmd_args *cmd = NULL; ++ unsigned long flags; + + ahw = adapter->ahw; + +@@ -4063,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) + return; + } + +- atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT); ++ spin_lock_irqsave(&mbx->aen_lock, flags); ++ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; ++ spin_unlock_irqrestore(&mbx->aen_lock, flags); + + spin_lock(&mbx->queue_lock); + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index 494e810..0a2318c 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = { + QLC_OFF(stats.mac_filter_limit_overrun)}, + {"spurious intr", QLC_SIZEOF(stats.spurious_intr), + QLC_OFF(stats.spurious_intr)}, +- ++ {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr), ++ QLC_OFF(stats.mbx_spurious_intr)}, + }; + + static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = { +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index 9979764..b28e73e 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, + return; + } + skb_reserve(new_skb, NET_IP_ALIGN); ++ ++ pci_dma_sync_single_for_cpu(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); ++ + memcpy(skb_put(new_skb, length), skb->data, length); ++ ++ pci_dma_sync_single_for_device(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); + skb = new_skb; + + /* Frame error, so drop the packet. */ +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 689a4a5..1ef0393 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -811,7 +811,7 @@ qcaspi_netdev_setup(struct net_device *dev) + dev->netdev_ops = &qcaspi_netdev_ops; + qcaspi_set_ethtool_ops(dev); + dev->watchdog_timeo = QCASPI_TX_TIMEOUT; +- dev->flags = IFF_MULTICAST; ++ dev->priv_flags &= ~IFF_TX_SKB_SHARING; + dev->tx_queue_len = 100; + + qca = netdev_priv(dev); +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 6a8fc0f..36fc942 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1185,11 +1185,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + break; + sh_eth_set_receive_align(skb); + +- /* RX descriptor */ +- rxdesc = &mdp->rx_ring[i]; + /* The size of the buffer is a multiple of 32 bytes. */ + buf_len = ALIGN(mdp->rx_buf_sz, 32); +- rxdesc->len = cpu_to_edmac(mdp, buf_len << 16); + dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len, + DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, dma_addr)) { +@@ -1197,6 +1194,10 @@ static void sh_eth_ring_format(struct net_device *ndev) + break; + } + mdp->rx_skbuff[i] = skb; ++ ++ /* RX descriptor */ ++ rxdesc = &mdp->rx_ring[i]; ++ rxdesc->len = cpu_to_edmac(mdp, buf_len << 16); + rxdesc->addr = cpu_to_edmac(mdp, dma_addr); + rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP); + +@@ -1212,7 +1213,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); + + /* Mark the last entry as wrapping the ring. */ +- rxdesc->status |= cpu_to_edmac(mdp, RD_RDLE); ++ if (rxdesc) ++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDLE); + + memset(mdp->tx_ring, 0, tx_ringsize); + +diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c +index 52ec3d6..2b34622 100644 +--- a/drivers/net/ethernet/rocker/rocker.c ++++ b/drivers/net/ethernet/rocker/rocker.c +@@ -239,6 +239,7 @@ struct rocker { + struct { + u64 id; + } hw; ++ unsigned long ageing_time; + spinlock_t cmd_ring_lock; /* for cmd ring accesses */ + struct rocker_dma_ring_info cmd_ring; + struct rocker_dma_ring_info event_ring; +@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned long data) + struct rocker_port *rocker_port; + struct rocker_fdb_tbl_entry *entry; + struct hlist_node *tmp; +- unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME; ++ unsigned long next_timer = jiffies + rocker->ageing_time; + unsigned long expires; + unsigned long lock_flags; + int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE | +@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_time(struct rocker_port *rocker_port, + struct switchdev_trans *trans, + u32 ageing_time) + { ++ struct rocker *rocker = rocker_port->rocker; ++ + if (!switchdev_trans_ph_prepare(trans)) { + rocker_port->ageing_time = clock_t_to_jiffies(ageing_time); ++ if (rocker_port->ageing_time < rocker->ageing_time) ++ rocker->ageing_time = rocker_port->ageing_time; + mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies); + } + +@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err_init_tbls; + } + ++ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; + setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup, + (unsigned long) rocker); + mod_timer(&rocker->fdb_cleanup_timer, jiffies); + ++ rocker->ageing_time = BR_DEFAULT_AGEING_TIME; ++ + err = rocker_probe_ports(rocker); + if (err) { + dev_err(&pdev->dev, "failed to probe ports\n"); +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 0fc5219..159a687 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, + macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN; + if (copylen > good_linear) + copylen = good_linear; ++ else if (copylen < ETH_HLEN) ++ copylen = ETH_HLEN; + linear = copylen; + i = *from; + iov_iter_advance(&i, copylen); +@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, + + if (!zerocopy) { + copylen = len; +- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear) ++ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); ++ if (linear > good_linear) + linear = good_linear; +- else +- linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len); ++ else if (linear < ETH_HLEN) ++ linear = ETH_HLEN; + } + + skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen, +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 9a863c6..174e06e 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -567,7 +567,7 @@ static int get_filter(void __user *arg, struct sock_filter **p) + + static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { +- struct ppp_file *pf = file->private_data; ++ struct ppp_file *pf; + struct ppp *ppp; + int err = -EFAULT, val, val2, i; + struct ppp_idle idle; +@@ -577,9 +577,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + void __user *argp = (void __user *)arg; + int __user *p = argp; + +- if (!pf) +- return ppp_unattached_ioctl(current->nsproxy->net_ns, +- pf, file, cmd, arg); ++ mutex_lock(&ppp_mutex); ++ ++ pf = file->private_data; ++ if (!pf) { ++ err = ppp_unattached_ioctl(current->nsproxy->net_ns, ++ pf, file, cmd, arg); ++ goto out; ++ } + + if (cmd == PPPIOCDETACH) { + /* +@@ -594,7 +599,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + * this fd and reopening /dev/ppp. + */ + err = -EINVAL; +- mutex_lock(&ppp_mutex); + if (pf->kind == INTERFACE) { + ppp = PF_TO_PPP(pf); + rtnl_lock(); +@@ -608,15 +612,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + } else + pr_warn("PPPIOCDETACH file->f_count=%ld\n", + atomic_long_read(&file->f_count)); +- mutex_unlock(&ppp_mutex); +- return err; ++ goto out; + } + + if (pf->kind == CHANNEL) { + struct channel *pch; + struct ppp_channel *chan; + +- mutex_lock(&ppp_mutex); + pch = PF_TO_CHANNEL(pf); + + switch (cmd) { +@@ -638,17 +640,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + err = chan->ops->ioctl(chan, cmd, arg); + up_read(&pch->chan_sem); + } +- mutex_unlock(&ppp_mutex); +- return err; ++ goto out; + } + + if (pf->kind != INTERFACE) { + /* can't happen */ + pr_err("PPP: not interface or channel??\n"); +- return -EINVAL; ++ err = -EINVAL; ++ goto out; + } + +- mutex_lock(&ppp_mutex); + ppp = PF_TO_PPP(pf); + switch (cmd) { + case PPPIOCSMRU: +@@ -823,7 +824,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + default: + err = -ENOTTY; + } ++ ++out: + mutex_unlock(&ppp_mutex); ++ + return err; + } + +@@ -836,7 +840,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, + struct ppp_net *pn; + int __user *p = (int __user *)arg; + +- mutex_lock(&ppp_mutex); + switch (cmd) { + case PPPIOCNEWUNIT: + /* Create a new ppp unit */ +@@ -886,7 +889,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, + default: + err = -ENOTTY; + } +- mutex_unlock(&ppp_mutex); ++ + return err; + } + +@@ -2290,7 +2293,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) + + pch->ppp = NULL; + pch->chan = chan; +- pch->chan_net = net; ++ pch->chan_net = get_net(net); + chan->ppp = pch; + init_ppp_file(&pch->file, CHANNEL); + pch->file.hdrlen = chan->hdrlen; +@@ -2387,6 +2390,8 @@ ppp_unregister_channel(struct ppp_channel *chan) + spin_lock_bh(&pn->all_channels_lock); + list_del(&pch->list); + spin_unlock_bh(&pn->all_channels_lock); ++ put_net(pch->chan_net); ++ pch->chan_net = NULL; + + pch->file.dead = 1; + wake_up_interruptible(&pch->file.rwait); +@@ -2803,6 +2808,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit, + + out2: + mutex_unlock(&pn->all_ppp_mutex); ++ rtnl_unlock(); + free_netdev(dev); + out1: + *retp = ret; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index f0db770..2d186bd 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte + + /* Re-attach the filter to persist device */ + if (!skip_filter && (tun->filter_attached == true)) { +- err = sk_attach_filter(&tun->fprog, tfile->socket.sk); ++ err = __sk_attach_filter(&tun->fprog, tfile->socket.sk, ++ lockdep_rtnl_is_held()); + if (!err) + goto out; + } +@@ -1000,7 +1001,6 @@ static void tun_net_init(struct net_device *dev) + /* Zero header length */ + dev->type = ARPHRD_NONE; + dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; +- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ + break; + + case IFF_TAP: +@@ -1012,7 +1012,6 @@ static void tun_net_init(struct net_device *dev) + + eth_hw_addr_random(dev); + +- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */ + break; + } + } +@@ -1463,6 +1462,8 @@ static void tun_setup(struct net_device *dev) + + dev->ethtool_ops = &tun_ethtool_ops; + dev->destructor = tun_free_netdev; ++ /* We prefer our own queue length */ ++ dev->tx_queue_len = TUN_READQ_SIZE; + } + + /* Trivial set of netlink ops to allow deleting tun or tap +@@ -1804,7 +1805,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n) + + for (i = 0; i < n; i++) { + tfile = rtnl_dereference(tun->tfiles[i]); +- sk_detach_filter(tfile->socket.sk); ++ __sk_detach_filter(tfile->socket.sk, lockdep_rtnl_is_held()); + } + + tun->filter_attached = false; +@@ -1817,7 +1818,8 @@ static int tun_attach_filter(struct tun_struct *tun) + + for (i = 0; i < tun->numqueues; i++) { + tfile = rtnl_dereference(tun->tfiles[i]); +- ret = sk_attach_filter(&tun->fprog, tfile->socket.sk); ++ ret = __sk_attach_filter(&tun->fprog, tfile->socket.sk, ++ lockdep_rtnl_is_held()); + if (ret) { + tun_detach_filter(tun, i); + return ret; +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index 3da70bf..7cba2c3 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -160,6 +160,12 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf) + info->u = header.usb_cdc_union_desc; + info->header = header.usb_cdc_header_desc; + info->ether = header.usb_cdc_ether_desc; ++ if (!info->u) { ++ if (rndis) ++ goto skip; ++ else /* in that case a quirk is mandatory */ ++ goto bad_desc; ++ } + /* we need a master/control interface (what we're + * probed with) and a slave/data interface; union + * descriptors sort this all out. +@@ -256,7 +262,7 @@ skip: + goto bad_desc; + } + +- } else if (!info->header || !info->u || (!rndis && !info->ether)) { ++ } else if (!info->header || (!rndis && !info->ether)) { + dev_dbg(&intf->dev, "missing cdc %s%s%sdescriptor\n", + info->header ? "" : "header ", + info->u ? "" : "union ", +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index e8a1144..8c2bb77 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -794,7 +794,11 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ + + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; + +- /* reset data interface */ ++ /* Reset data interface. Some devices will not reset properly ++ * unless they are configured first. Toggle the altsetting to ++ * force a reset ++ */ ++ usb_set_interface(dev->udev, iface_no, data_altsetting); + temp = usb_set_interface(dev->udev, iface_no, 0); + if (temp) { + dev_dbg(&intf->dev, "set interface failed\n"); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 982e0acd..a34f491 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -699,6 +699,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ + {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ ++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +@@ -718,8 +719,10 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */ + {QMI_FIXED_INTF(0x1199, 0x9070, 8)}, /* Sierra Wireless MC74xx/EM74xx */ + {QMI_FIXED_INTF(0x1199, 0x9070, 10)}, /* Sierra Wireless MC74xx/EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx/EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx/EM74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 0744bf2..c2ea4e5 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1766,6 +1766,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 0a242b2..903bda4 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -114,20 +114,23 @@ static struct dst_ops vrf_dst_ops = { + #if IS_ENABLED(CONFIG_IPV6) + static bool check_ipv6_frame(const struct sk_buff *skb) + { +- const struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb->data; +- size_t hlen = sizeof(*ipv6h); ++ const struct ipv6hdr *ipv6h; ++ struct ipv6hdr _ipv6h; + bool rc = true; + +- if (skb->len < hlen) ++ ipv6h = skb_header_pointer(skb, 0, sizeof(_ipv6h), &_ipv6h); ++ if (!ipv6h) + goto out; + + if (ipv6h->nexthdr == NEXTHDR_ICMP) { + const struct icmp6hdr *icmph; ++ struct icmp6hdr _icmph; + +- if (skb->len < hlen + sizeof(*icmph)) ++ icmph = skb_header_pointer(skb, sizeof(_ipv6h), ++ sizeof(_icmph), &_icmph); ++ if (!icmph) + goto out; + +- icmph = (struct icmp6hdr *)(skb->data + sizeof(*ipv6h)); + switch (icmph->icmp6_type) { + case NDISC_ROUTER_SOLICITATION: + case NDISC_ROUTER_ADVERTISEMENT: +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index e0fcda4..3c0df70 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -1306,8 +1306,10 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb) + gbp = (struct vxlanhdr_gbp *)vxh; + md->gbp = ntohs(gbp->policy_id); + +- if (tun_dst) ++ if (tun_dst) { + tun_dst->u.tun_info.key.tun_flags |= TUNNEL_VXLAN_OPT; ++ tun_dst->u.tun_info.options_len = sizeof(*md); ++ } + + if (gbp->dont_learn) + md->gbp |= VXLAN_GBP_DONT_LEARN; +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index 44541dbc..69b994f 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dev->mem_start = card->phys_mem + + BUF_OFFSET ( txBuffer[i][0][0]); + dev->mem_end = card->phys_mem +- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); + dev->base_addr = card->pci_conf; + dev->irq = card->irq; + +diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c +index cc81482..113a43f 100644 +--- a/drivers/net/wireless/ath/ath9k/eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom.c +@@ -403,10 +403,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + + if (match) { + if (AR_SREV_9287(ah)) { +- /* FIXME: array overrun? */ + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_9287[idxL].pwrPdg[i], + data_9287[idxL].vpdPdg[i], +@@ -416,7 +415,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else if (eeprom_4k) { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_4k[idxL].pwrPdg[i], + data_4k[idxL].vpdPdg[i], +@@ -426,7 +425,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_def[idxL].pwrPdg[i], + data_def[idxL].vpdPdg[i], +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index 496b9b6..5f47356 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd_dimm_descs[] = { + [ND_CMD_IMPLEMENTED] = { }, + [ND_CMD_SMART] = { + .out_num = 2, +- .out_sizes = { 4, 8, }, ++ .out_sizes = { 4, 128, }, + }, + [ND_CMD_SMART_THRESHOLD] = { + .out_num = 2, +diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c +index 71805a1..9d39745 100644 +--- a/drivers/nvdimm/pfn_devs.c ++++ b/drivers/nvdimm/pfn_devs.c +@@ -275,7 +275,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn) + } else { + /* from init we validate */ + if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0) +- return -EINVAL; ++ return -ENODEV; + } + + /* +diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c +index 4c2fa05..944674e 100644 +--- a/drivers/pcmcia/db1xxx_ss.c ++++ b/drivers/pcmcia/db1xxx_ss.c +@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock { + int stschg_irq; /* card-status-change irq */ + int card_irq; /* card irq */ + int eject_irq; /* db1200/pb1200 have these */ ++ int insert_gpio; /* db1000 carddetect gpio */ + + #define BOARD_TYPE_DEFAULT 0 /* most boards */ + #define BOARD_TYPE_DB1200 1 /* IRQs aren't gpios */ +@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct db1x_pcmcia_sock *sock) + /* carddetect gpio: low-active */ + static int db1000_card_inserted(struct db1x_pcmcia_sock *sock) + { +- return !gpio_get_value(irq_to_gpio(sock->insert_irq)); ++ return !gpio_get_value(sock->insert_gpio); + } + + static int db1x_card_inserted(struct db1x_pcmcia_sock *sock) +@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(struct platform_device *pdev) + r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "card"); + sock->card_irq = r ? r->start : 0; + +- /* insert: irq which triggers on card insertion/ejection */ ++ /* insert: irq which triggers on card insertion/ejection ++ * BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here! ++ */ + r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "insert"); + sock->insert_irq = r ? r->start : -1; ++ if (sock->board_type == BOARD_TYPE_DEFAULT) { ++ sock->insert_gpio = r ? r->start : -1; ++ sock->insert_irq = r ? gpio_to_irq(r->start) : -1; ++ } + + /* stschg: irq which trigger on card status change (optional) */ + r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "stschg"); +diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c +index a5bb939..1029aa7 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx.c +@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_device *pdev, + + if (of_property_read_bool(dev_np, "fsl,input-sel")) { + np = of_parse_phandle(dev_np, "fsl,input-sel", 0); +- if (np) { +- ipctl->input_sel_base = of_iomap(np, 0); +- if (IS_ERR(ipctl->input_sel_base)) { +- of_node_put(np); +- dev_err(&pdev->dev, +- "iomuxc input select base address not found\n"); +- return PTR_ERR(ipctl->input_sel_base); +- } +- } else { ++ if (!np) { + dev_err(&pdev->dev, "iomuxc fsl,input-sel property not found\n"); + return -EINVAL; + } ++ ++ ipctl->input_sel_base = of_iomap(np, 0); + of_node_put(np); ++ if (!ipctl->input_sel_base) { ++ dev_err(&pdev->dev, ++ "iomuxc input select base address not found\n"); ++ return -ENOMEM; ++ } + } + + imx_pinctrl_desc.name = dev_name(&pdev->dev); +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index eebfae0..f844b4a 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -995,7 +995,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s, + int val; + + if (pull) +- pullidx = data_out ? 1 : 2; ++ pullidx = data_out ? 2 : 1; + + seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s", + gpio, +diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c +index 85c9046..6b1a47f 100644 +--- a/drivers/pinctrl/pinctrl-pistachio.c ++++ b/drivers/pinctrl/pinctrl-pistachio.c +@@ -469,27 +469,27 @@ static const char * const pistachio_mips_pll_lock_groups[] = { + "mfio83", + }; + +-static const char * const pistachio_sys_pll_lock_groups[] = { ++static const char * const pistachio_audio_pll_lock_groups[] = { + "mfio84", + }; + +-static const char * const pistachio_wifi_pll_lock_groups[] = { ++static const char * const pistachio_rpu_v_pll_lock_groups[] = { + "mfio85", + }; + +-static const char * const pistachio_bt_pll_lock_groups[] = { ++static const char * const pistachio_rpu_l_pll_lock_groups[] = { + "mfio86", + }; + +-static const char * const pistachio_rpu_v_pll_lock_groups[] = { ++static const char * const pistachio_sys_pll_lock_groups[] = { + "mfio87", + }; + +-static const char * const pistachio_rpu_l_pll_lock_groups[] = { ++static const char * const pistachio_wifi_pll_lock_groups[] = { + "mfio88", + }; + +-static const char * const pistachio_audio_pll_lock_groups[] = { ++static const char * const pistachio_bt_pll_lock_groups[] = { + "mfio89", + }; + +@@ -559,12 +559,12 @@ enum pistachio_mux_option { + PISTACHIO_FUNCTION_DREQ4, + PISTACHIO_FUNCTION_DREQ5, + PISTACHIO_FUNCTION_MIPS_PLL_LOCK, ++ PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, ++ PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, ++ PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, + PISTACHIO_FUNCTION_SYS_PLL_LOCK, + PISTACHIO_FUNCTION_WIFI_PLL_LOCK, + PISTACHIO_FUNCTION_BT_PLL_LOCK, +- PISTACHIO_FUNCTION_RPU_V_PLL_LOCK, +- PISTACHIO_FUNCTION_RPU_L_PLL_LOCK, +- PISTACHIO_FUNCTION_AUDIO_PLL_LOCK, + PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND, + PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND, + PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND, +@@ -620,12 +620,12 @@ static const struct pistachio_function pistachio_functions[] = { + FUNCTION(dreq4), + FUNCTION(dreq5), + FUNCTION(mips_pll_lock), ++ FUNCTION(audio_pll_lock), ++ FUNCTION(rpu_v_pll_lock), ++ FUNCTION(rpu_l_pll_lock), + FUNCTION(sys_pll_lock), + FUNCTION(wifi_pll_lock), + FUNCTION(bt_pll_lock), +- FUNCTION(rpu_v_pll_lock), +- FUNCTION(rpu_l_pll_lock), +- FUNCTION(audio_pll_lock), + FUNCTION(debug_raw_cca_ind), + FUNCTION(debug_ed_sec20_cca_ind), + FUNCTION(debug_ed_sec40_cca_ind), +diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c +index 181ea98..2b0d702 100644 +--- a/drivers/pinctrl/sh-pfc/core.c ++++ b/drivers/pinctrl/sh-pfc/core.c +@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_device *pdev) + return ret; + } + +- pinctrl_provide_dummies(); ++ /* Enable dummy states for those platforms without pinctrl support */ ++ if (!of_have_populated_dt()) ++ pinctrl_provide_dummies(); + + ret = sh_pfc_init_ranges(pfc); + if (ret < 0) +diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c +index 00265f0..8b381d6 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c +@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc sun8i_a33_pinctrl_data = { + .pins = sun8i_a33_pins, + .npins = ARRAY_SIZE(sun8i_a33_pins), + .irq_banks = 2, ++ .irq_bank_base = 1, + }; + + static int sun8i_a33_pinctrl_probe(struct platform_device *pdev) +diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c +index dead97d..a4a5b50 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c +@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_resources(struct irq_data *d) + static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) + { + struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); +- u32 reg = sunxi_irq_cfg_reg(d->hwirq); ++ u32 reg = sunxi_irq_cfg_reg(d->hwirq, pctl->desc->irq_bank_base); + u8 index = sunxi_irq_cfg_offset(d->hwirq); + unsigned long flags; + u32 regval; +@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type) + static void sunxi_pinctrl_irq_ack(struct irq_data *d) + { + struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); +- u32 status_reg = sunxi_irq_status_reg(d->hwirq); ++ u32 status_reg = sunxi_irq_status_reg(d->hwirq, ++ pctl->desc->irq_bank_base); + u8 status_idx = sunxi_irq_status_offset(d->hwirq); + + /* Clear the IRQ */ +@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(struct irq_data *d) + static void sunxi_pinctrl_irq_mask(struct irq_data *d) + { + struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); +- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); ++ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); + u8 idx = sunxi_irq_ctrl_offset(d->hwirq); + unsigned long flags; + u32 val; +@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d) + static void sunxi_pinctrl_irq_unmask(struct irq_data *d) + { + struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d); +- u32 reg = sunxi_irq_ctrl_reg(d->hwirq); ++ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base); + u8 idx = sunxi_irq_ctrl_offset(d->hwirq); + unsigned long flags; + u32 val; +@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc) + if (bank == pctl->desc->irq_banks) + return; + +- reg = sunxi_irq_status_reg_from_bank(bank); ++ reg = sunxi_irq_status_reg_from_bank(bank, pctl->desc->irq_bank_base); + val = readl(pctl->membase + reg); + + if (val) { +@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_device *pdev, + + for (i = 0; i < pctl->desc->irq_banks; i++) { + /* Mask and clear all IRQs before registering a handler */ +- writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i)); ++ writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i, ++ pctl->desc->irq_bank_base)); + writel(0xffffffff, +- pctl->membase + sunxi_irq_status_reg_from_bank(i)); ++ pctl->membase + sunxi_irq_status_reg_from_bank(i, ++ pctl->desc->irq_bank_base)); + + irq_set_chained_handler_and_data(pctl->irq[i], + sunxi_pinctrl_irq_handler, +diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h +index e248e81..0afce1a 100644 +--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h ++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h +@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc { + int npins; + unsigned pin_base; + unsigned irq_banks; ++ unsigned irq_bank_base; + bool irq_read_needs_mux; + }; + +@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16 pin) + return pin_num * PULL_PINS_BITS; + } + +-static inline u32 sunxi_irq_cfg_reg(u16 irq) ++static inline u32 sunxi_irq_cfg_reg(u16 irq, unsigned bank_base) + { + u8 bank = irq / IRQ_PER_BANK; + u8 reg = (irq % IRQ_PER_BANK) / IRQ_CFG_IRQ_PER_REG * 0x04; + +- return IRQ_CFG_REG + bank * IRQ_MEM_SIZE + reg; ++ return IRQ_CFG_REG + (bank_base + bank) * IRQ_MEM_SIZE + reg; + } + + static inline u32 sunxi_irq_cfg_offset(u16 irq) +@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq) + return irq_num * IRQ_CFG_IRQ_BITS; + } + +-static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank) ++static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank, unsigned bank_base) + { +- return IRQ_CTRL_REG + bank * IRQ_MEM_SIZE; ++ return IRQ_CTRL_REG + (bank_base + bank) * IRQ_MEM_SIZE; + } + +-static inline u32 sunxi_irq_ctrl_reg(u16 irq) ++static inline u32 sunxi_irq_ctrl_reg(u16 irq, unsigned bank_base) + { + u8 bank = irq / IRQ_PER_BANK; + +- return sunxi_irq_ctrl_reg_from_bank(bank); ++ return sunxi_irq_ctrl_reg_from_bank(bank, bank_base); + } + + static inline u32 sunxi_irq_ctrl_offset(u16 irq) +@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq) + return irq_num * IRQ_CTRL_IRQ_BITS; + } + +-static inline u32 sunxi_irq_status_reg_from_bank(u8 bank) ++static inline u32 sunxi_irq_status_reg_from_bank(u8 bank, unsigned bank_base) + { +- return IRQ_STATUS_REG + bank * IRQ_MEM_SIZE; ++ return IRQ_STATUS_REG + (bank_base + bank) * IRQ_MEM_SIZE; + } + +-static inline u32 sunxi_irq_status_reg(u16 irq) ++static inline u32 sunxi_irq_status_reg(u16 irq, unsigned bank_base) + { + u8 bank = irq / IRQ_PER_BANK; + +- return sunxi_irq_status_reg_from_bank(bank); ++ return sunxi_irq_status_reg_from_bank(bank, bank_base); + } + + static inline u32 sunxi_irq_status_offset(u16 irq) +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index cc84ea7..0d7c6e8 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo) + struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk); + struct scsi_device *sdp = sdkp->device; + struct Scsi_Host *host = sdp->host; ++ sector_t capacity = logical_to_sectors(sdp, sdkp->capacity); + int diskinfo[4]; + + /* default to most commonly used values */ +- diskinfo[0] = 0x40; /* 1 << 6 */ +- diskinfo[1] = 0x20; /* 1 << 5 */ +- diskinfo[2] = sdkp->capacity >> 11; +- ++ diskinfo[0] = 0x40; /* 1 << 6 */ ++ diskinfo[1] = 0x20; /* 1 << 5 */ ++ diskinfo[2] = capacity >> 11; ++ + /* override with calculated, extended default, or driver values */ + if (host->hostt->bios_param) +- host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo); ++ host->hostt->bios_param(sdp, bdev, capacity, diskinfo); + else +- scsicam_bios_param(bdev, sdkp->capacity, diskinfo); ++ scsicam_bios_param(bdev, capacity, diskinfo); + + geo->heads = diskinfo[0]; + geo->sectors = diskinfo[1]; +@@ -2337,14 +2338,6 @@ got_data: + if (sdkp->capacity > 0xffffffff) + sdp->use_16_for_rw = 1; + +- /* Rescale capacity to 512-byte units */ +- if (sector_size == 4096) +- sdkp->capacity <<= 3; +- else if (sector_size == 2048) +- sdkp->capacity <<= 2; +- else if (sector_size == 1024) +- sdkp->capacity <<= 1; +- + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); + sdkp->device->sector_size = sector_size; +@@ -2812,11 +2805,6 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp) + return 0; + } + +-static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks) +-{ +- return blocks << (ilog2(sdev->sector_size) - 9); +-} +- + /** + * sd_revalidate_disk - called the first time a new disk is seen, + * performs disk spin up, read_capacity, etc. +@@ -2900,7 +2888,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + /* Combine with controller limits */ + q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); + +- set_capacity(disk, sdkp->capacity); ++ set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); + sd_config_write_same(sdkp); + kfree(buffer); + +diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h +index 5f2a84a..654630b 100644 +--- a/drivers/scsi/sd.h ++++ b/drivers/scsi/sd.h +@@ -65,7 +65,7 @@ struct scsi_disk { + struct device dev; + struct gendisk *disk; + atomic_t openers; +- sector_t capacity; /* size in 512-byte sectors */ ++ sector_t capacity; /* size in logical blocks */ + u32 max_xfer_blocks; + u32 opt_xfer_blocks; + u32 max_ws_blocks; +@@ -146,6 +146,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd) + return 0; + } + ++static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks) ++{ ++ return blocks << (ilog2(sdev->sector_size) - 9); ++} ++ + /* + * A DIF-capable target device can be formatted with different + * protection schemes. Currently 0 through 3 are defined: +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index e237e9f..df56021 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, + * memory coming from the heaps is ready for dma, ie if it has a + * cached mapping that mapping has been invalidated + */ +- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) ++ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) { + sg_dma_address(sg) = sg_phys(sg); ++ sg_dma_len(sg) = sg->length; ++ } + mutex_lock(&dev->buffer_lock); + ion_buffer_add(dev, buffer); + mutex_unlock(&dev->buffer_lock); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 2a27488..84df093 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5392,6 +5392,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) + } + + bos = udev->bos; ++ udev->bos = NULL; + + for (i = 0; i < SET_CONFIG_TRIES; ++i) { + +@@ -5484,11 +5485,8 @@ done: + usb_set_usb2_hardware_lpm(udev, 1); + usb_unlocked_enable_lpm(udev); + usb_enable_ltm(udev); +- /* release the new BOS descriptor allocated by hub_port_init() */ +- if (udev->bos != bos) { +- usb_release_bos_descriptor(udev); +- udev->bos = bos; +- } ++ usb_release_bos_descriptor(udev); ++ udev->bos = bos; + return 0; + + re_enumerate: +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index c0f5c65..f1893e0 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) + goto __usbhs_pkt_handler_end; + } + +- ret = func(pkt, &is_done); ++ if (likely(func)) ++ ret = func(pkt, &is_done); + + if (is_done) + __usbhsf_pkt_del(pkt); +@@ -889,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done) + + pkt->trans = len; + ++ usbhsf_tx_irq_ctrl(pipe, 0); + INIT_WORK(&pkt->work, xfer_work); + schedule_work(&pkt->work); + +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 8f7a78e..fa14198 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt) + struct usbhs_pipe *pipe = pkt->pipe; + struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe); + struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt); ++ unsigned long flags; + + ureq->req.actual = pkt->actual; + +- usbhsg_queue_pop(uep, ureq, 0); ++ usbhs_lock(priv, flags); ++ if (uep) ++ __usbhsg_queue_pop(uep, ureq, 0); ++ usbhs_unlock(priv, flags); + } + + static void usbhsg_queue_push(struct usbhsg_uep *uep, +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index ce0cd6e..9baf081 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -2,7 +2,7 @@ + * USB Attached SCSI + * Note that this is not the same as the USB Mass Storage driver + * +- * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014 ++ * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016 + * Copyright Matthew Wilcox for Intel Corp, 2010 + * Copyright Sarah Sharp for Intel Corp, 2010 + * +@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd) + return SUCCESS; + } + ++static int uas_target_alloc(struct scsi_target *starget) ++{ ++ struct uas_dev_info *devinfo = (struct uas_dev_info *) ++ dev_to_shost(starget->dev.parent)->hostdata; ++ ++ if (devinfo->flags & US_FL_NO_REPORT_LUNS) ++ starget->no_report_luns = 1; ++ ++ return 0; ++} ++ + static int uas_slave_alloc(struct scsi_device *sdev) + { + struct uas_dev_info *devinfo = +@@ -800,7 +811,6 @@ static int uas_slave_configure(struct scsi_device *sdev) + if (devinfo->flags & US_FL_BROKEN_FUA) + sdev->broken_fua = 1; + +- scsi_change_queue_depth(sdev, devinfo->qdepth - 2); + return 0; + } + +@@ -808,6 +818,7 @@ static struct scsi_host_template uas_host_template = { + .module = THIS_MODULE, + .name = "uas", + .queuecommand = uas_queuecommand, ++ .target_alloc = uas_target_alloc, + .slave_alloc = uas_slave_alloc, + .slave_configure = uas_slave_configure, + .eh_abort_handler = uas_eh_abort_handler, +@@ -932,6 +943,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id) + if (result) + goto set_alt0; + ++ /* ++ * 1 tag is reserved for untagged commands + ++ * 1 tag to avoid off by one errors in some bridge firmwares ++ */ ++ shost->can_queue = devinfo->qdepth - 2; ++ + usb_set_intfdata(intf, shost); + result = scsi_add_host(shost, &intf->dev); + if (result) +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index ccc113e..53341a7 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_ATA_1X), + ++/* Reported-by: David Webb <djw@noc.ac.uk> */ ++UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999, ++ "Seagate", ++ "Expansion Desk", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_LUNS), ++ + /* Reported-by: Hans de Goede <hdegoede@redhat.com> */ + UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999, + "Seagate", +diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c +index 43576ed..9de988a 100644 +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) + US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 | + US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE | + US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES | +- US_FL_MAX_SECTORS_240); ++ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS); + + p = quirks; + while (*p) { +@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags) + case 'i': + f |= US_FL_IGNORE_DEVICE; + break; ++ case 'j': ++ f |= US_FL_NO_REPORT_LUNS; ++ break; + case 'l': + f |= US_FL_NOT_LOCKABLE; + break; +diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c +index 8e5cf19..4469202 100644 +--- a/drivers/virtio/virtio_pci_modern.c ++++ b/drivers/virtio/virtio_pci_modern.c +@@ -17,6 +17,7 @@ + * + */ + ++#include <linux/delay.h> + #define VIRTIO_PCI_NO_LEGACY + #include "virtio_pci_common.h" + +@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_device *vdev) + struct virtio_pci_device *vp_dev = to_vp_device(vdev); + /* 0 status means a reset. */ + vp_iowrite8(0, &vp_dev->common->device_status); +- /* Flush out the status write, and flush in device writes, +- * including MSI-X interrupts, if any. */ +- vp_ioread8(&vp_dev->common->device_status); ++ /* After writing 0 to device_status, the driver MUST wait for a read of ++ * device_status to return 0 before reinitializing the device. ++ * This will flush out the status write, and flush in device writes, ++ * including MSI-X interrupts, if any. ++ */ ++ while (vp_ioread8(&vp_dev->common->device_status)) ++ msleep(1); + /* Flush pending VQ/configuration callbacks. */ + vp_synchronize_vectors(vdev); + } +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 524c221..4436778 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *data) + struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; + int rc = 0; + +- irq_move_irq(data); ++ if (!VALID_EVTCHN(evtchn)) ++ return; + +- if (VALID_EVTCHN(evtchn)) ++ if (unlikely(irqd_is_setaffinity_pending(data))) { ++ int masked = test_and_set_mask(evtchn); ++ ++ clear_evtchn(evtchn); ++ ++ irq_move_masked_irq(data); ++ ++ if (!masked) ++ unmask_evtchn(evtchn); ++ } else + clear_evtchn(evtchn); + + if (pirq_needs_eoi(data->irq)) { +@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *data) + { + int evtchn = evtchn_from_irq(data->irq); + +- irq_move_irq(data); ++ if (!VALID_EVTCHN(evtchn)) ++ return; + +- if (VALID_EVTCHN(evtchn)) ++ if (unlikely(irqd_is_setaffinity_pending(data))) { ++ int masked = test_and_set_mask(evtchn); ++ ++ clear_evtchn(evtchn); ++ ++ irq_move_masked_irq(data); ++ ++ if (!masked) ++ unmask_evtchn(evtchn); ++ } else + clear_evtchn(evtchn); + } + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 0f09526..5e5db36 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1885,7 +1885,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end) + */ + int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + { +- struct dentry *dentry = file->f_path.dentry; ++ struct dentry *dentry = file_dentry(file); + struct inode *inode = d_inode(dentry); + struct btrfs_root *root = BTRFS_I(inode)->root; + struct btrfs_trans_handle *trans; +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 323e12c..0e044d7 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4406,6 +4406,127 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans, + return ret; + } + ++/* ++ * When we are logging a new inode X, check if it doesn't have a reference that ++ * matches the reference from some other inode Y created in a past transaction ++ * and that was renamed in the current transaction. If we don't do this, then at ++ * log replay time we can lose inode Y (and all its files if it's a directory): ++ * ++ * mkdir /mnt/x ++ * echo "hello world" > /mnt/x/foobar ++ * sync ++ * mv /mnt/x /mnt/y ++ * mkdir /mnt/x # or touch /mnt/x ++ * xfs_io -c fsync /mnt/x ++ * <power fail> ++ * mount fs, trigger log replay ++ * ++ * After the log replay procedure, we would lose the first directory and all its ++ * files (file foobar). ++ * For the case where inode Y is not a directory we simply end up losing it: ++ * ++ * echo "123" > /mnt/foo ++ * sync ++ * mv /mnt/foo /mnt/bar ++ * echo "abc" > /mnt/foo ++ * xfs_io -c fsync /mnt/foo ++ * <power fail> ++ * ++ * We also need this for cases where a snapshot entry is replaced by some other ++ * entry (file or directory) otherwise we end up with an unreplayable log due to ++ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as ++ * if it were a regular entry: ++ * ++ * mkdir /mnt/x ++ * btrfs subvolume snapshot /mnt /mnt/x/snap ++ * btrfs subvolume delete /mnt/x/snap ++ * rmdir /mnt/x ++ * mkdir /mnt/x ++ * fsync /mnt/x or fsync some new file inside it ++ * <power fail> ++ * ++ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in ++ * the same transaction. ++ */ ++static int btrfs_check_ref_name_override(struct extent_buffer *eb, ++ const int slot, ++ const struct btrfs_key *key, ++ struct inode *inode) ++{ ++ int ret; ++ struct btrfs_path *search_path; ++ char *name = NULL; ++ u32 name_len = 0; ++ u32 item_size = btrfs_item_size_nr(eb, slot); ++ u32 cur_offset = 0; ++ unsigned long ptr = btrfs_item_ptr_offset(eb, slot); ++ ++ search_path = btrfs_alloc_path(); ++ if (!search_path) ++ return -ENOMEM; ++ search_path->search_commit_root = 1; ++ search_path->skip_locking = 1; ++ ++ while (cur_offset < item_size) { ++ u64 parent; ++ u32 this_name_len; ++ u32 this_len; ++ unsigned long name_ptr; ++ struct btrfs_dir_item *di; ++ ++ if (key->type == BTRFS_INODE_REF_KEY) { ++ struct btrfs_inode_ref *iref; ++ ++ iref = (struct btrfs_inode_ref *)(ptr + cur_offset); ++ parent = key->offset; ++ this_name_len = btrfs_inode_ref_name_len(eb, iref); ++ name_ptr = (unsigned long)(iref + 1); ++ this_len = sizeof(*iref) + this_name_len; ++ } else { ++ struct btrfs_inode_extref *extref; ++ ++ extref = (struct btrfs_inode_extref *)(ptr + ++ cur_offset); ++ parent = btrfs_inode_extref_parent(eb, extref); ++ this_name_len = btrfs_inode_extref_name_len(eb, extref); ++ name_ptr = (unsigned long)&extref->name; ++ this_len = sizeof(*extref) + this_name_len; ++ } ++ ++ if (this_name_len > name_len) { ++ char *new_name; ++ ++ new_name = krealloc(name, this_name_len, GFP_NOFS); ++ if (!new_name) { ++ ret = -ENOMEM; ++ goto out; ++ } ++ name_len = this_name_len; ++ name = new_name; ++ } ++ ++ read_extent_buffer(eb, name, name_ptr, this_name_len); ++ di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root, ++ search_path, parent, ++ name, this_name_len, 0); ++ if (di && !IS_ERR(di)) { ++ ret = 1; ++ goto out; ++ } else if (IS_ERR(di)) { ++ ret = PTR_ERR(di); ++ goto out; ++ } ++ btrfs_release_path(search_path); ++ ++ cur_offset += this_len; ++ } ++ ret = 0; ++out: ++ btrfs_free_path(search_path); ++ kfree(name); ++ return ret; ++} ++ + /* log a single inode in the tree log. + * At least one parent directory for this inode must exist in the tree + * or be logged already. +@@ -4578,6 +4699,22 @@ again: + if (min_key.type == BTRFS_INODE_ITEM_KEY) + need_log_inode_item = false; + ++ if ((min_key.type == BTRFS_INODE_REF_KEY || ++ min_key.type == BTRFS_INODE_EXTREF_KEY) && ++ BTRFS_I(inode)->generation == trans->transid) { ++ ret = btrfs_check_ref_name_override(path->nodes[0], ++ path->slots[0], ++ &min_key, inode); ++ if (ret < 0) { ++ err = ret; ++ goto out_unlock; ++ } else if (ret > 0) { ++ err = 1; ++ btrfs_set_log_full_commit(root->fs_info, trans); ++ goto out_unlock; ++ } ++ } ++ + /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ + if (min_key.type == BTRFS_XATTR_ITEM_KEY) { + if (ins_nr == 0) +diff --git a/fs/dcache.c b/fs/dcache.c +index 877bcbb..18effa3 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1666,7 +1666,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) + DCACHE_OP_REVALIDATE | + DCACHE_OP_WEAK_REVALIDATE | + DCACHE_OP_DELETE | +- DCACHE_OP_SELECT_INODE)); ++ DCACHE_OP_SELECT_INODE | ++ DCACHE_OP_REAL)); + dentry->d_op = op; + if (!op) + return; +@@ -1684,6 +1685,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op) + dentry->d_flags |= DCACHE_OP_PRUNE; + if (op->d_select_inode) + dentry->d_flags |= DCACHE_OP_SELECT_INODE; ++ if (op->d_real) ++ dentry->d_flags |= DCACHE_OP_REAL; + + } + EXPORT_SYMBOL(d_set_d_op); +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index cc7ca4e..d4156e1 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -850,6 +850,29 @@ do { \ + #include "extents_status.h" + + /* ++ * Lock subclasses for i_data_sem in the ext4_inode_info structure. ++ * ++ * These are needed to avoid lockdep false positives when we need to ++ * allocate blocks to the quota inode during ext4_map_blocks(), while ++ * holding i_data_sem for a normal (non-quota) inode. Since we don't ++ * do quota tracking for the quota inode, this avoids deadlock (as ++ * well as infinite recursion, since it isn't turtles all the way ++ * down...) ++ * ++ * I_DATA_SEM_NORMAL - Used for most inodes ++ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode ++ * where the second inode has larger inode number ++ * than the first ++ * I_DATA_SEM_QUOTA - Used for quota inodes only ++ */ ++enum { ++ I_DATA_SEM_NORMAL = 0, ++ I_DATA_SEM_OTHER, ++ I_DATA_SEM_QUOTA, ++}; ++ ++ ++/* + * fourth extended file system inode data in memory + */ + struct ext4_inode_info { +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index e032a04..9bdbf98 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) + { + if (first < second) { + down_write(&EXT4_I(first)->i_data_sem); +- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); + } else { + down_write(&EXT4_I(second)->i_data_sem); +- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); + + } + } +@@ -483,6 +483,13 @@ mext_check_arguments(struct inode *orig_inode, + return -EBUSY; + } + ++ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { ++ ext4_debug("ext4 move extent: The argument files should " ++ "not be quota files [ino:orig %lu, donor %lu]\n", ++ orig_inode->i_ino, donor_inode->i_ino); ++ return -EBUSY; ++ } ++ + /* Ext4 move extent supports only extent based file */ + if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { + ext4_debug("ext4 move extent: orig file is not extents " +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index c9ab67d..ba1cf0b 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1292,9 +1292,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args) + return -1; + } + if (ext4_has_feature_quota(sb)) { +- ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options " +- "when QUOTA feature is enabled"); +- return -1; ++ ext4_msg(sb, KERN_INFO, "Journaled quota options " ++ "ignored when QUOTA feature is enabled"); ++ return 1; + } + qname = match_strdup(args); + if (!qname) { +@@ -1657,10 +1657,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token, + return -1; + } + if (ext4_has_feature_quota(sb)) { +- ext4_msg(sb, KERN_ERR, +- "Cannot set journaled quota options " ++ ext4_msg(sb, KERN_INFO, ++ "Quota format mount options ignored " + "when QUOTA feature is enabled"); +- return -1; ++ return 1; + } + sbi->s_jquota_fmt = m->mount_opt; + #endif +@@ -1721,11 +1721,11 @@ static int parse_options(char *options, struct super_block *sb, + #ifdef CONFIG_QUOTA + if (ext4_has_feature_quota(sb) && + (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) { +- ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA " +- "feature is enabled"); +- return 0; +- } +- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { ++ ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota " ++ "mount options ignored."); ++ clear_opt(sb, USRQUOTA); ++ clear_opt(sb, GRPQUOTA); ++ } else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) { + if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA]) + clear_opt(sb, USRQUOTA); + +@@ -4936,6 +4936,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) + EXT4_SB(sb)->s_jquota_fmt, type); + } + ++static void lockdep_set_quota_inode(struct inode *inode, int subclass) ++{ ++ struct ext4_inode_info *ei = EXT4_I(inode); ++ ++ /* The first argument of lockdep_set_subclass has to be ++ * *exactly* the same as the argument to init_rwsem() --- in ++ * this case, in init_once() --- or lockdep gets unhappy ++ * because the name of the lock is set using the ++ * stringification of the argument to init_rwsem(). ++ */ ++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ ++ lockdep_set_subclass(&ei->i_data_sem, subclass); ++} ++ + /* + * Standard function to be called on quota_on + */ +@@ -4975,8 +4989,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, + if (err) + return err; + } +- +- return dquot_quota_on(sb, type, format_id, path); ++ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); ++ err = dquot_quota_on(sb, type, format_id, path); ++ if (err) ++ lockdep_set_quota_inode(path->dentry->d_inode, ++ I_DATA_SEM_NORMAL); ++ return err; + } + + static int ext4_quota_enable(struct super_block *sb, int type, int format_id, +@@ -5002,8 +5020,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, + + /* Don't account quota for quota files to avoid recursion */ + qf_inode->i_flags |= S_NOQUOTA; ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); + err = dquot_enable(qf_inode, type, format_id, flags); + iput(qf_inode); ++ if (err) ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); + + return err; + } +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index ce5a218..5fc2162 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page **pages, nfs_readdir_descriptor_t *desc, + again: + timestamp = jiffies; + gencount = nfs_inc_attr_generation_counter(); +- error = NFS_PROTO(inode)->readdir(file->f_path.dentry, cred, entry->cookie, pages, ++ error = NFS_PROTO(inode)->readdir(file_dentry(file), cred, entry->cookie, pages, + NFS_SERVER(inode)->dtsize, desc->plus); + if (error < 0) { + /* We requested READDIRPLUS, but the server doesn't grok it */ +@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en + count++; + + if (desc->plus != 0) +- nfs_prime_dcache(desc->file->f_path.dentry, entry); ++ nfs_prime_dcache(file_dentry(desc->file), entry); + + status = nfs_readdir_add_to_array(entry, page); + if (status != 0) +@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalidate(struct inode *dir) + */ + static int nfs_readdir(struct file *file, struct dir_context *ctx) + { +- struct dentry *dentry = file->f_path.dentry; ++ struct dentry *dentry = file_dentry(file); + struct inode *inode = d_inode(dentry); + nfs_readdir_descriptor_t my_desc, + *desc = &my_desc; +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 3e2071a..f714b98 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -927,7 +927,7 @@ int nfs_open(struct inode *inode, struct file *filp) + { + struct nfs_open_context *ctx; + +- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); ++ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + nfs_file_set_open_context(filp, ctx); +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index db9b5fe..679e003 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -26,7 +26,7 @@ static int + nfs4_file_open(struct inode *inode, struct file *filp) + { + struct nfs_open_context *ctx; +- struct dentry *dentry = filp->f_path.dentry; ++ struct dentry *dentry = file_dentry(filp); + struct dentry *parent = NULL; + struct inode *dir; + unsigned openflags = filp->f_flags; +@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, struct file *filp) + parent = dget_parent(dentry); + dir = d_inode(parent); + +- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode); ++ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode); + err = PTR_ERR(ctx); + if (IS_ERR(ctx)) + goto out; +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 000b2ed..a1acc60 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -276,6 +276,37 @@ static void ovl_dentry_release(struct dentry *dentry) + } + } + ++static struct dentry *ovl_d_real(struct dentry *dentry, struct inode *inode) ++{ ++ struct dentry *real; ++ ++ if (d_is_dir(dentry)) { ++ if (!inode || inode == d_inode(dentry)) ++ return dentry; ++ goto bug; ++ } ++ ++ real = ovl_dentry_upper(dentry); ++ if (real && (!inode || inode == d_inode(real))) ++ return real; ++ ++ real = ovl_dentry_lower(dentry); ++ if (!real) ++ goto bug; ++ ++ if (!inode || inode == d_inode(real)) ++ return real; ++ ++ /* Handle recursion */ ++ if (real->d_flags & DCACHE_OP_REAL) ++ return real->d_op->d_real(real, inode); ++ ++bug: ++ WARN(1, "ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n", dentry, ++ inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0); ++ return dentry; ++} ++ + static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags) + { + struct ovl_entry *oe = dentry->d_fsdata; +@@ -320,11 +351,13 @@ static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags) + static const struct dentry_operations ovl_dentry_operations = { + .d_release = ovl_dentry_release, + .d_select_inode = ovl_d_select_inode, ++ .d_real = ovl_d_real, + }; + + static const struct dentry_operations ovl_reval_dentry_operations = { + .d_release = ovl_dentry_release, + .d_select_inode = ovl_d_select_inode, ++ .d_real = ovl_d_real, + .d_revalidate = ovl_dentry_revalidate, + .d_weak_revalidate = ovl_dentry_weak_revalidate, + }; +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 22ab246..eeae401 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -199,7 +199,7 @@ + #define unreachable() __builtin_unreachable() + + /* Mark a function definition as prohibited from being cloned. */ +-#define __noclone __attribute__((__noclone__)) ++#define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) + + #endif /* GCC_VERSION >= 40500 */ + +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index 8a2e009..f513dd8 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -161,6 +161,7 @@ struct dentry_operations { + struct vfsmount *(*d_automount)(struct path *); + int (*d_manage)(struct dentry *, bool); + struct inode *(*d_select_inode)(struct dentry *, unsigned); ++ struct dentry *(*d_real)(struct dentry *, struct inode *); + } ____cacheline_aligned; + + /* +@@ -227,6 +228,7 @@ struct dentry_operations { + #define DCACHE_MAY_FREE 0x00800000 + #define DCACHE_FALLTHRU 0x01000000 /* Fall through to lower layer */ + #define DCACHE_OP_SELECT_INODE 0x02000000 /* Unioned entry: dcache op selects inode */ ++#define DCACHE_OP_REAL 0x08000000 + + extern seqlock_t rename_lock; + +@@ -582,4 +584,12 @@ static inline struct dentry *d_backing_dentry(struct dentry *upper) + return upper; + } + ++static inline struct dentry *d_real(struct dentry *dentry) ++{ ++ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) ++ return dentry->d_op->d_real(dentry, NULL); ++ else ++ return dentry; ++} ++ + #endif /* __LINUX_DCACHE_H */ +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 5972ffe..5110d42 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -446,8 +446,12 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog, + void bpf_prog_destroy(struct bpf_prog *fp); + + int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk); ++int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, ++ bool locked); + int sk_attach_bpf(u32 ufd, struct sock *sk); + int sk_detach_filter(struct sock *sk); ++int __sk_detach_filter(struct sock *sk, bool locked); ++ + int sk_get_filter(struct sock *sk, struct sock_filter __user *filter, + unsigned int len); + +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 22c5a0c..ab3d8d9 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1207,6 +1207,16 @@ static inline struct inode *file_inode(const struct file *f) + return f->f_inode; + } + ++static inline struct dentry *file_dentry(const struct file *file) ++{ ++ struct dentry *dentry = file->f_path.dentry; ++ ++ if (unlikely(dentry->d_flags & DCACHE_OP_REAL)) ++ return dentry->d_op->d_real(dentry, file_inode(file)); ++ else ++ return dentry; ++} ++ + static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl) + { + return locks_lock_inode_wait(file_inode(filp), fl); +diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h +index a338a688..dcb89e3 100644 +--- a/include/linux/if_bridge.h ++++ b/include/linux/if_bridge.h +@@ -46,10 +46,6 @@ struct br_ip_list { + #define BR_LEARNING_SYNC BIT(9) + #define BR_PROXYARP_WIFI BIT(10) + +-/* values as per ieee8021QBridgeFdbAgingTime */ +-#define BR_MIN_AGEING_TIME (10 * HZ) +-#define BR_MAX_AGEING_TIME (1000000 * HZ) +- + #define BR_DEFAULT_AGEING_TIME (300 * HZ) + + extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *)); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 3143c84..04c068e 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -265,6 +265,7 @@ struct header_ops { + void (*cache_update)(struct hh_cache *hh, + const struct net_device *dev, + const unsigned char *haddr); ++ bool (*validate)(const char *ll_header, unsigned int len); + }; + + /* These flag bits are private to the generic network queueing +@@ -1398,8 +1399,7 @@ enum netdev_priv_flags { + * @dma: DMA channel + * @mtu: Interface MTU value + * @type: Interface hardware type +- * @hard_header_len: Hardware header length, which means that this is the +- * minimum size of a packet. ++ * @hard_header_len: Maximum hardware header length. + * + * @needed_headroom: Extra headroom the hardware may need, but not in all + * cases can this be guaranteed +@@ -2493,6 +2493,24 @@ static inline int dev_parse_header(const struct sk_buff *skb, + return dev->header_ops->parse(skb, haddr); + } + ++/* ll_header must have at least hard_header_len allocated */ ++static inline bool dev_validate_header(const struct net_device *dev, ++ char *ll_header, int len) ++{ ++ if (likely(len >= dev->hard_header_len)) ++ return true; ++ ++ if (capable(CAP_SYS_RAWIO)) { ++ memset(ll_header + len, 0, dev->hard_header_len - len); ++ return true; ++ } ++ ++ if (dev->header_ops && dev->header_ops->validate) ++ return dev->header_ops->validate(ll_header, len); ++ ++ return false; ++} ++ + typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len); + int register_gifconf(unsigned int family, gifconf_func_t *gifconf); + static inline int unregister_gifconf(unsigned int family) +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 4e554bf..e89c7ee 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -989,23 +989,6 @@ static inline int pci_is_managed(struct pci_dev *pdev) + return pdev->is_managed; + } + +-static inline void pci_set_managed_irq(struct pci_dev *pdev, unsigned int irq) +-{ +- pdev->irq = irq; +- pdev->irq_managed = 1; +-} +- +-static inline void pci_reset_managed_irq(struct pci_dev *pdev) +-{ +- pdev->irq = 0; +- pdev->irq_managed = 0; +-} +- +-static inline bool pci_has_managed_irq(struct pci_dev *pdev) +-{ +- return pdev->irq_managed && pdev->irq > 0; +-} +- + void pci_disable_device(struct pci_dev *dev); + + extern unsigned int pcibios_max_latency; +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 75f136a..4fde618 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -1908,6 +1908,30 @@ static inline void skb_reserve(struct sk_buff *skb, int len) + skb->tail += len; + } + ++/** ++ * skb_tailroom_reserve - adjust reserved_tailroom ++ * @skb: buffer to alter ++ * @mtu: maximum amount of headlen permitted ++ * @needed_tailroom: minimum amount of reserved_tailroom ++ * ++ * Set reserved_tailroom so that headlen can be as large as possible but ++ * not larger than mtu and tailroom cannot be smaller than ++ * needed_tailroom. ++ * The required headroom should already have been reserved before using ++ * this function. ++ */ ++static inline void skb_tailroom_reserve(struct sk_buff *skb, unsigned int mtu, ++ unsigned int needed_tailroom) ++{ ++ SKB_LINEAR_ASSERT(skb); ++ if (mtu < skb_tailroom(skb) - needed_tailroom) ++ /* use at most mtu */ ++ skb->reserved_tailroom = skb_tailroom(skb) - mtu; ++ else ++ /* use up to all available space */ ++ skb->reserved_tailroom = needed_tailroom; ++} ++ + #define ENCAP_TYPE_ETHER 0 + #define ENCAP_TYPE_IPPROTO 1 + +@@ -2724,6 +2748,23 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, + + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); + ++static inline void skb_postpush_rcsum(struct sk_buff *skb, ++ const void *start, unsigned int len) ++{ ++ /* For performing the reverse operation to skb_postpull_rcsum(), ++ * we can instead of ... ++ * ++ * skb->csum = csum_add(skb->csum, csum_partial(start, len, 0)); ++ * ++ * ... just use this equivalent version here to save a few ++ * instructions. Feeding csum of 0 in csum_partial() and later ++ * on adding skb->csum is equivalent to feed skb->csum in the ++ * first place. ++ */ ++ if (skb->ip_summed == CHECKSUM_COMPLETE) ++ skb->csum = csum_partial(start, len, skb->csum); ++} ++ + /** + * pskb_trim_rcsum - trim received skb and update checksum + * @skb: buffer to trim +diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h +index 7f5f78b..245f57d 100644 +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -79,6 +79,8 @@ + /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \ + US_FLAG(MAX_SECTORS_240, 0x08000000) \ + /* Sets max_sectors to 240 */ \ ++ US_FLAG(NO_REPORT_LUNS, 0x10000000) \ ++ /* Cannot handle REPORT_LUNS */ \ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; +diff --git a/include/net/bonding.h b/include/net/bonding.h +index c1740a2..93abe5f 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -214,6 +214,7 @@ struct bonding { + * ALB mode (6) - to sync the use and modifications of its hash table + */ + spinlock_t mode_lock; ++ spinlock_t stats_lock; + u8 send_peer_notif; + u8 igmp_retrans; + #ifdef CONFIG_PROC_FS +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 4504ca6..50da680 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5) + if (!task) + return -EINVAL; + +- memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); ++ strlcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm))); + return 0; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index faf2067..1e889a0 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1580,14 +1580,14 @@ event_sched_out(struct perf_event *event, + + perf_pmu_disable(event->pmu); + ++ event->tstamp_stopped = tstamp; ++ event->pmu->del(event, 0); ++ event->oncpu = -1; + event->state = PERF_EVENT_STATE_INACTIVE; + if (event->pending_disable) { + event->pending_disable = 0; + event->state = PERF_EVENT_STATE_OFF; + } +- event->tstamp_stopped = tstamp; +- event->pmu->del(event, 0); +- event->oncpu = -1; + + if (!is_software_event(event)) + cpuctx->active_oncpu--; +@@ -8583,7 +8583,12 @@ err_context: + perf_unpin_context(ctx); + put_ctx(ctx); + err_alloc: +- free_event(event); ++ /* ++ * If event_file is set, the fput() above will have called ->release() ++ * and that will take care of freeing the event. ++ */ ++ if (!event_file) ++ free_event(event); + err_cpus: + put_online_cpus(); + err_task: +diff --git a/mm/page_isolation.c b/mm/page_isolation.c +index 4568fd5..00c9646 100644 +--- a/mm/page_isolation.c ++++ b/mm/page_isolation.c +@@ -283,11 +283,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private, + * now as a simple work-around, we use the next node for destination. + */ + if (PageHuge(page)) { +- nodemask_t src = nodemask_of_node(page_to_nid(page)); +- nodemask_t dst; +- nodes_complement(dst, src); ++ int node = next_online_node(page_to_nid(page)); ++ if (node == MAX_NUMNODES) ++ node = first_online_node; + return alloc_huge_page_node(page_hstate(compound_head(page)), +- next_node(page_to_nid(page), dst)); ++ node); + } + + if (PageHighMem(page)) +diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c +index b563a3f..2fa3be9 100644 +--- a/net/ax25/ax25_ip.c ++++ b/net/ax25/ax25_ip.c +@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb) + } + #endif + ++static bool ax25_validate_header(const char *header, unsigned int len) ++{ ++ ax25_digi digi; ++ ++ if (!len) ++ return false; ++ ++ if (header[0]) ++ return true; ++ ++ return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL, ++ NULL); ++} ++ + const struct header_ops ax25_header_ops = { + .create = ax25_hard_header, ++ .validate = ax25_validate_header, + }; + + EXPORT_SYMBOL(ax25_header_ops); +diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c +index 5f3f645..eff69cb 100644 +--- a/net/bridge/br_stp.c ++++ b/net/bridge/br_stp.c +@@ -567,6 +567,14 @@ int br_set_max_age(struct net_bridge *br, unsigned long val) + + } + ++/* Set time interval that dynamic forwarding entries live ++ * For pure software bridge, allow values outside the 802.1 ++ * standard specification for special cases: ++ * 0 - entry never ages (all permanant) ++ * 1 - entry disappears (no persistance) ++ * ++ * Offloaded switch entries maybe more restrictive ++ */ + int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) + { + struct switchdev_attr attr = { +@@ -577,11 +585,8 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time) + unsigned long t = clock_t_to_jiffies(ageing_time); + int err; + +- if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME) +- return -ERANGE; +- + err = switchdev_port_attr_set(br->dev, &attr); +- if (err) ++ if (err && err != -EOPNOTSUPP) + return err; + + br->ageing_time = t; +diff --git a/net/core/filter.c b/net/core/filter.c +index 37157c4..f393a22 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1139,7 +1139,8 @@ void bpf_prog_destroy(struct bpf_prog *fp) + } + EXPORT_SYMBOL_GPL(bpf_prog_destroy); + +-static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) ++static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk, ++ bool locked) + { + struct sk_filter *fp, *old_fp; + +@@ -1155,10 +1156,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) + return -ENOMEM; + } + +- old_fp = rcu_dereference_protected(sk->sk_filter, +- sock_owned_by_user(sk)); ++ old_fp = rcu_dereference_protected(sk->sk_filter, locked); + rcu_assign_pointer(sk->sk_filter, fp); +- + if (old_fp) + sk_filter_uncharge(sk, old_fp); + +@@ -1175,7 +1174,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk) + * occurs or there is insufficient memory for the filter a negative + * errno code is returned. On success the return is zero. + */ +-int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) ++int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk, ++ bool locked) + { + unsigned int fsize = bpf_classic_proglen(fprog); + unsigned int bpf_fsize = bpf_prog_size(fprog->len); +@@ -1213,7 +1213,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) + if (IS_ERR(prog)) + return PTR_ERR(prog); + +- err = __sk_attach_prog(prog, sk); ++ err = __sk_attach_prog(prog, sk, locked); + if (err < 0) { + __bpf_prog_release(prog); + return err; +@@ -1221,7 +1221,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) + + return 0; + } +-EXPORT_SYMBOL_GPL(sk_attach_filter); ++EXPORT_SYMBOL_GPL(__sk_attach_filter); ++ ++int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) ++{ ++ return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk)); ++} + + int sk_attach_bpf(u32 ufd, struct sock *sk) + { +@@ -1240,7 +1245,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk) + return -EINVAL; + } + +- err = __sk_attach_prog(prog, sk); ++ err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk)); + if (err < 0) { + bpf_prog_put(prog); + return err; +@@ -1913,7 +1918,7 @@ static int __init register_sk_filter_ops(void) + } + late_initcall(register_sk_filter_ops); + +-int sk_detach_filter(struct sock *sk) ++int __sk_detach_filter(struct sock *sk, bool locked) + { + int ret = -ENOENT; + struct sk_filter *filter; +@@ -1921,8 +1926,7 @@ int sk_detach_filter(struct sock *sk) + if (sock_flag(sk, SOCK_FILTER_LOCKED)) + return -EPERM; + +- filter = rcu_dereference_protected(sk->sk_filter, +- sock_owned_by_user(sk)); ++ filter = rcu_dereference_protected(sk->sk_filter, locked); + if (filter) { + RCU_INIT_POINTER(sk->sk_filter, NULL); + sk_filter_uncharge(sk, filter); +@@ -1931,7 +1935,12 @@ int sk_detach_filter(struct sock *sk) + + return ret; + } +-EXPORT_SYMBOL_GPL(sk_detach_filter); ++EXPORT_SYMBOL_GPL(__sk_detach_filter); ++ ++int sk_detach_filter(struct sock *sk) ++{ ++ return __sk_detach_filter(sk, sock_owned_by_user(sk)); ++} + + int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, + unsigned int len) +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 34ba7a0..ca966f7 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, + + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */ + + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */ + + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */ ++ + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */ + + nla_total_size(1); /* IFLA_PROTO_DOWN */ + + } +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 5bf88f5..8616d11 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2948,6 +2948,24 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page, + EXPORT_SYMBOL_GPL(skb_append_pagefrags); + + /** ++ * skb_push_rcsum - push skb and update receive checksum ++ * @skb: buffer to update ++ * @len: length of data pulled ++ * ++ * This function performs an skb_push on the packet and updates ++ * the CHECKSUM_COMPLETE checksum. It should be used on ++ * receive path processing instead of skb_push unless you know ++ * that the checksum difference is zero (e.g., a valid IP header) ++ * or you are setting ip_summed to CHECKSUM_NONE. ++ */ ++static unsigned char *skb_push_rcsum(struct sk_buff *skb, unsigned len) ++{ ++ skb_push(skb, len); ++ skb_postpush_rcsum(skb, skb->data, len); ++ return skb->data; ++} ++ ++/** + * skb_pull_rcsum - pull skb and update receive checksum + * @skb: buffer to update + * @len: length of data pulled +@@ -4084,9 +4102,9 @@ struct sk_buff *skb_checksum_trimmed(struct sk_buff *skb, + if (!pskb_may_pull(skb_chk, offset)) + goto err; + +- __skb_pull(skb_chk, offset); ++ skb_pull_rcsum(skb_chk, offset); + ret = skb_chkf(skb_chk); +- __skb_push(skb_chk, offset); ++ skb_push_rcsum(skb_chk, offset); + + if (ret) + goto err; +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index 902d606..8be8f27 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 seq) + * ICMPs are not backlogged, hence we cannot get an established + * socket here. + */ +- WARN_ON(req->sk); +- + if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) { + NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); + } else { +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index f6303b1..0212591 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, + + ASSERT_RTNL(); + ++ if (in_dev->dead) ++ goto no_promotions; ++ + /* 1. Deleting primary ifaddr forces deletion all secondaries + * unless alias promotion is set + **/ +@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap, + fib_del_ifaddr(ifa, ifa1); + } + ++no_promotions: + /* 2. Unlink it */ + + *ifap = ifa1->ifa_next; +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 4734475..8a9246d 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) + struct in_device *in_dev; + struct fib_result res; + struct rtable *rt; +- struct flowi4 fl4; + struct net *net; + int scope; + +@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) + + scope = RT_SCOPE_UNIVERSE; + if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { +- fl4.flowi4_oif = 0; +- fl4.flowi4_iif = LOOPBACK_IFINDEX; +- fl4.daddr = ip_hdr(skb)->saddr; +- fl4.saddr = 0; +- fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos); +- fl4.flowi4_scope = scope; +- fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0; +- fl4.flowi4_tun_key.tun_id = 0; ++ struct flowi4 fl4 = { ++ .flowi4_iif = LOOPBACK_IFINDEX, ++ .daddr = ip_hdr(skb)->saddr, ++ .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), ++ .flowi4_scope = scope, ++ .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0, ++ }; + if (!fib_lookup(net, &fl4, &res, 0)) + return FIB_RES_PREFSRC(net, res); + } else { +@@ -922,6 +920,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) + subnet = 1; + } + ++ if (in_dev->dead) ++ goto no_promotions; ++ + /* Deletion is more complicated than add. + * We should take care of not to delete too much :-) + * +@@ -997,6 +998,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim) + } + } + ++no_promotions: + if (!(ok & BRD_OK)) + fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim); + if (subnet && ifa->ifa_prefixlen < 31) { +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 05e4cba..b3086cf 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -356,9 +356,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) + skb_dst_set(skb, &rt->dst); + skb->dev = dev; + +- skb->reserved_tailroom = skb_end_offset(skb) - +- min(mtu, skb_end_offset(skb)); + skb_reserve(skb, hlen); ++ skb_tailroom_reserve(skb, mtu, tlen); + + skb_reset_network_header(skb); + pip = ip_hdr(skb); +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 49f0285..f2ad521 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1237,13 +1237,16 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, + if (!skb) + return -EINVAL; + +- cork->length += size; + if ((size + skb->len > mtu) && + (sk->sk_protocol == IPPROTO_UDP) && + (rt->dst.dev->features & NETIF_F_UFO)) { ++ if (skb->ip_summed != CHECKSUM_PARTIAL) ++ return -EOPNOTSUPP; ++ + skb_shinfo(skb)->gso_size = mtu - fragheaderlen; + skb_shinfo(skb)->gso_type = SKB_GSO_UDP; + } ++ cork->length += size; + + while (size > 0) { + if (skb_is_gso(skb)) { +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index cbb51f3..ce30c8b 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -663,6 +663,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + inner_iph = (const struct iphdr *)skb_inner_network_header(skb); + connected = (tunnel->parms.iph.daddr != 0); + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + dst = tnl_params->daddr; + if (dst == 0) { + /* NBMA tunnel */ +@@ -760,7 +762,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + tunnel->err_time + IPTUNNEL_ERR_TIMEO)) { + tunnel->err_count--; + +- memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + dst_link_failure(skb); + } else + tunnel->err_count = 0; +diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +index c6eb421..ea91058 100644 +--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c ++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this, + unsigned long event, + void *ptr) + { +- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; ++ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; + struct netdev_notifier_info info; + +- netdev_notifier_info_init(&info, dev); ++ /* The masq_dev_notifier will catch the case of the device going ++ * down. So if the inetdev is dead and being destroyed we have ++ * no work to do. Otherwise this is an individual address removal ++ * and we have to perform the flush. ++ */ ++ if (idev->dead) ++ return NOTIFY_DONE; ++ ++ netdev_notifier_info_init(&info, idev->dev); + return masq_device_event(this, event, &info); + } + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 8c7e631..048418b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -320,8 +320,6 @@ void tcp_req_err(struct sock *sk, u32 seq, bool abort) + /* ICMPs are not backlogged, hence we cannot get + * an established socket here. + */ +- WARN_ON(req->sk); +- + if (seq != tcp_rsk(req)->snt_isn) { + NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS); + } else if (abort) { +diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c +index c8cbc2b..a726d78 100644 +--- a/net/ipv4/tcp_metrics.c ++++ b/net/ipv4/tcp_metrics.c +@@ -550,7 +550,7 @@ reset: + */ + if (crtt > tp->srtt_us) { + /* Set RTO like tcp_rtt_estimator(), but from cached RTT. */ +- crtt /= 8 * USEC_PER_MSEC; ++ crtt /= 8 * USEC_PER_SEC / HZ; + inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk)); + } else if (tp->srtt_us == 0) { + /* RFC6298: 5.7 We've failed to get a valid RTT sample from +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index ac6b196..9475a27 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -458,7 +458,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + + newtp->rcv_wup = newtp->copied_seq = + newtp->rcv_nxt = treq->rcv_isn + 1; +- newtp->segs_in = 0; ++ newtp->segs_in = 1; + + newtp->snd_sml = newtp->snd_una = + newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1; +@@ -818,6 +818,7 @@ int tcp_child_process(struct sock *parent, struct sock *child, + int ret = 0; + int state = child->sk_state; + ++ tcp_sk(child)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs); + if (!sock_owned_by_user(child)) { + ret = tcp_rcv_state_process(child, skb); + /* Wakeup parent, send SIGIO */ +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 7f8ab46..21fbb54 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1990,10 +1990,14 @@ void udp_v4_early_demux(struct sk_buff *skb) + if (!in_dev) + return; + +- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, +- iph->protocol); +- if (!ours) +- return; ++ /* we are supposed to accept bcast packets */ ++ if (skb->pkt_type == PACKET_MULTICAST) { ++ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, ++ iph->protocol); ++ if (!ours) ++ return; ++ } ++ + sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, + uh->source, iph->saddr, dif); + } else if (skb->pkt_type == PACKET_HOST) { +diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c +index aba4286..280a9bd 100644 +--- a/net/ipv4/udp_tunnel.c ++++ b/net/ipv4/udp_tunnel.c +@@ -89,6 +89,8 @@ int udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb, + uh->source = src_port; + uh->len = htons(skb->len); + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + udp_set_csum(nocheck, skb, src, dst, skb->len); + + return iptunnel_xmit(sk, rt, skb, src, dst, IPPROTO_UDP, +diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c +index 5c5d23e..9508a20 100644 +--- a/net/ipv6/exthdrs_core.c ++++ b/net/ipv6/exthdrs_core.c +@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, + *fragoff = _frag_off; + return hp->nexthdr; + } +- return -ENOENT; ++ if (!found) ++ return -ENOENT; ++ if (fragoff) ++ *fragoff = _frag_off; ++ break; + } + hdrlen = 8; + } else if (nexthdr == NEXTHDR_AUTH) { +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e5ea177..4650c68 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -778,6 +778,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev) + __u32 mtu; + int err; + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) + encap_limit = t->parms.encap_limit; + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 31144c4..a175152 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk, + int getfrag(void *from, char *to, int offset, int len, + int odd, struct sk_buff *skb), + void *from, int length, int hh_len, int fragheaderlen, +- int transhdrlen, int mtu, unsigned int flags, +- const struct flowi6 *fl6) ++ int exthdrlen, int transhdrlen, int mtu, ++ unsigned int flags, const struct flowi6 *fl6) + + { + struct sk_buff *skb; +@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk, + skb_put(skb, fragheaderlen + transhdrlen); + + /* initialize network header pointer */ +- skb_reset_network_header(skb); ++ skb_set_network_header(skb, exthdrlen); + + /* initialize protocol header pointer */ + skb->transport_header = skb->network_header + fragheaderlen; +@@ -1359,7 +1359,7 @@ emsgsize: + (rt->dst.dev->features & NETIF_F_UFO) && + (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { + err = ip6_ufo_append_data(sk, queue, getfrag, from, length, +- hh_len, fragheaderlen, ++ hh_len, fragheaderlen, exthdrlen, + transhdrlen, mtu, flags, fl6); + if (err) + goto error; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 137fca4..3991b21 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev) + + t = netdev_priv(dev); + ++ dev->rtnl_link_ops = &ip6_link_ops; + err = register_netdevice(dev); + if (err < 0) + goto out; + + strcpy(t->parms.name, dev->name); +- dev->rtnl_link_ops = &ip6_link_ops; + + dev_hold(dev); + ip6_tnl_link(ip6n, t); +@@ -1180,6 +1180,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) + u8 tproto; + int err; + ++ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); ++ + tproto = ACCESS_ONCE(t->parms.proto); + if (tproto != IPPROTO_IPIP && tproto != 0) + return -1; +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 5ee56d0..d64ee7e 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -1574,9 +1574,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) + return NULL; + + skb->priority = TC_PRIO_CONTROL; +- skb->reserved_tailroom = skb_end_offset(skb) - +- min(mtu, skb_end_offset(skb)); + skb_reserve(skb, hlen); ++ skb_tailroom_reserve(skb, mtu, tlen); + + if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) { + /* <draft-ietf-magma-mld-source-05.txt>: +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 9da3287..6665e1a 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -837,8 +837,8 @@ start_lookup: + flush_stack(stack, count, skb, count - 1); + } else { + if (!inner_flushed) +- UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, +- proto == IPPROTO_UDPLITE); ++ UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI, ++ proto == IPPROTO_UDPLITE); + consume_skb(skb); + } + return 0; +@@ -916,11 +916,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + ret = udpv6_queue_rcv_skb(sk, skb); + sock_put(sk); + +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ ++ /* a return value > 0 means to resubmit the input */ + if (ret > 0) +- return -ret; ++ return ret; + + return 0; + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index ec22078..42de4cc 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index a2c8747..9ee4ddb 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c +index 6a12b0f..980e9e9 100644 +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -7,6 +7,7 @@ + * Copyright 2007, Michael Wu <flamingice@sourmilk.net> + * Copyright 2009, Johannes Berg <johannes@sipsolutions.net> + * Copyright 2013-2014 Intel Mobile Communications GmbH ++ * Copyright(c) 2016 Intel Deutschland GmbH + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -1484,14 +1485,21 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata) + + sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); + +- num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, +- &ifibss->chandef, +- channels, +- ARRAY_SIZE(channels)); + scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef); +- ieee80211_request_ibss_scan(sdata, ifibss->ssid, +- ifibss->ssid_len, channels, num, +- scan_width); ++ ++ if (ifibss->fixed_channel) { ++ num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy, ++ &ifibss->chandef, ++ channels, ++ ARRAY_SIZE(channels)); ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ++ ifibss->ssid_len, channels, ++ num, scan_width); ++ } else { ++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ++ ifibss->ssid_len, NULL, ++ 0, scan_width); ++ } + } else { + int interval = IEEE80211_SCAN_INTERVAL; + +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index c9e325d..7a2b791 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + if (sdata->vif.txq) { + struct txq_info *txqi = to_txq_info(sdata->vif.txq); + ++ spin_lock_bh(&txqi->queue.lock); + ieee80211_purge_tx_queue(&local->hw, &txqi->queue); ++ spin_unlock_bh(&txqi->queue.lock); ++ + atomic_set(&sdata->txqs_len[txqi->txq.ac], 0); + } + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 4cbf36c..a3bb8f7 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2250,7 +2250,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + struct ieee80211_local *local = rx->local; + struct ieee80211_sub_if_data *sdata = rx->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; +- u16 q, hdrlen; ++ u16 ac, q, hdrlen; + + hdr = (struct ieee80211_hdr *) skb->data; + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -2319,7 +2319,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + ether_addr_equal(sdata->vif.addr, hdr->addr3)) + return RX_CONTINUE; + +- q = ieee80211_select_queue_80211(sdata, skb, hdr); ++ ac = ieee80211_select_queue_80211(sdata, skb, hdr); ++ q = sdata->vif.hw_queue[ac]; + if (ieee80211_queue_stopped(&local->hw, q)) { + IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); + return RX_DROP_MONITOR; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index f91d187..67066d0 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -256,11 +256,11 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + } + + /* Caller must hold local->sta_mtx */ +-static void sta_info_hash_add(struct ieee80211_local *local, +- struct sta_info *sta) ++static int sta_info_hash_add(struct ieee80211_local *local, ++ struct sta_info *sta) + { +- rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, +- sta_rht_params); ++ return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node, ++ sta_rht_params); + } + + static void sta_deliver_ps_frames(struct work_struct *wk) +@@ -484,11 +484,17 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + { + struct ieee80211_local *local = sta->local; + struct ieee80211_sub_if_data *sdata = sta->sdata; +- struct station_info sinfo; ++ struct station_info *sinfo; + int err = 0; + + lockdep_assert_held(&local->sta_mtx); + ++ sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); ++ if (!sinfo) { ++ err = -ENOMEM; ++ goto out_err; ++ } ++ + /* check if STA exists already */ + if (sta_info_get_bss(sdata, sta->sta.addr)) { + err = -EEXIST; +@@ -503,7 +509,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + set_sta_flag(sta, WLAN_STA_BLOCK_BA); + + /* make the station visible */ +- sta_info_hash_add(local, sta); ++ err = sta_info_hash_add(local, sta); ++ if (err) ++ goto out_drop_sta; + + list_add_tail_rcu(&sta->list, &local->sta_list); + +@@ -520,10 +528,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + ieee80211_sta_debugfs_add(sta); + rate_control_add_sta_debugfs(sta); + +- memset(&sinfo, 0, sizeof(sinfo)); +- sinfo.filled = 0; +- sinfo.generation = local->sta_generation; +- cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); ++ sinfo->generation = local->sta_generation; ++ cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); ++ kfree(sinfo); + + sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr); + +@@ -538,6 +545,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + out_remove: + sta_info_hash_del(local, sta); + list_del_rcu(&sta->list); ++ out_drop_sta: + local->num_sta--; + synchronize_net(); + __cleanup_single_sta(sta); +@@ -882,7 +890,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + { + struct ieee80211_local *local = sta->local; + struct ieee80211_sub_if_data *sdata = sta->sdata; +- struct station_info sinfo = {}; ++ struct station_info *sinfo; + int ret; + + /* +@@ -920,8 +928,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) + + sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr); + +- sta_set_sinfo(sta, &sinfo); +- cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL); ++ sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL); ++ if (sinfo) ++ sta_set_sinfo(sta, sinfo); ++ cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL); ++ kfree(sinfo); + + rate_control_remove_sta_debugfs(sta); + ieee80211_sta_debugfs_remove(sta); +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index c32fc41..881bc20 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -518,6 +518,9 @@ static struct net_device *find_outdev(struct net *net, + if (!dev) + return ERR_PTR(-ENODEV); + ++ if (IS_ERR(dev)) ++ return dev; ++ + /* The caller is holding rtnl anyways, so release the dev reference */ + dev_put(dev); + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 992396a..da1ae0e1 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1916,6 +1916,10 @@ retry: + goto retry; + } + ++ if (!dev_validate_header(dev, skb->data, len)) { ++ err = -EINVAL; ++ goto out_unlock; ++ } + if (len > (dev->mtu + dev->hard_header_len + extra_len) && + !packet_extra_vlan_len_allowed(dev, skb)) { + err = -EMSGSIZE; +@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb) + sock_wfree(skb); + } + +-static bool ll_header_truncated(const struct net_device *dev, int len) +-{ +- /* net device doesn't like empty head */ +- if (unlikely(len < dev->hard_header_len)) { +- net_warn_ratelimited("%s: packet size is too short (%d < %d)\n", +- current->comm, len, dev->hard_header_len); +- return true; +- } +- +- return false; +-} +- + static void tpacket_set_protocol(const struct net_device *dev, + struct sk_buff *skb) + { +@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, + if (unlikely(err < 0)) + return -EINVAL; + } else if (dev->hard_header_len) { +- if (ll_header_truncated(dev, tp_len)) +- return -EINVAL; ++ int hdrlen = min_t(int, dev->hard_header_len, tp_len); + + skb_push(skb, dev->hard_header_len); +- err = skb_store_bits(skb, 0, data, +- dev->hard_header_len); ++ err = skb_store_bits(skb, 0, data, hdrlen); + if (unlikely(err)) + return err; ++ if (!dev_validate_header(dev, skb->data, hdrlen)) ++ return -EINVAL; + if (!skb->protocol) + tpacket_set_protocol(dev, skb); + +- data += dev->hard_header_len; +- to_write -= dev->hard_header_len; ++ data += hdrlen; ++ to_write -= hdrlen; + } + + offset = offset_in_page(data); +@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len); + if (unlikely(offset < 0)) + goto out_free; +- } else { +- if (ll_header_truncated(dev, len)) +- goto out_free; + } + + /* Returns -EFAULT on error */ +@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + if (err) + goto out_free; + ++ if (sock->type == SOCK_RAW && ++ !dev_validate_header(dev, skb->data, len)) { ++ err = -EINVAL; ++ goto out_free; ++ } ++ + sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags); + + if (!gso_type && (len > dev->mtu + reserve + extra_len) && +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index ec52912..ce46f1c 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -526,6 +526,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1, + } + return 0; + } ++ if (addr1->v6.sin6_port != addr2->v6.sin6_port) ++ return 0; + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; + /* If this is a linklocal address, compare the scope_id. */ +diff --git a/net/socket.c b/net/socket.c +index d730ef9..263b334 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2238,31 +2238,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + break; + } + +-out_put: +- fput_light(sock->file, fput_needed); +- + if (err == 0) +- return datagrams; ++ goto out_put; + +- if (datagrams != 0) { ++ if (datagrams == 0) { ++ datagrams = err; ++ goto out_put; ++ } ++ ++ /* ++ * We may return less entries than requested (vlen) if the ++ * sock is non block and there aren't enough datagrams... ++ */ ++ if (err != -EAGAIN) { + /* +- * We may return less entries than requested (vlen) if the +- * sock is non block and there aren't enough datagrams... ++ * ... or if recvmsg returns an error after we ++ * received some datagrams, where we record the ++ * error to return on the next call or if the ++ * app asks about it using getsockopt(SO_ERROR). + */ +- if (err != -EAGAIN) { +- /* +- * ... or if recvmsg returns an error after we +- * received some datagrams, where we record the +- * error to return on the next call or if the +- * app asks about it using getsockopt(SO_ERROR). +- */ +- sock->sk->sk_err = -err; +- } +- +- return datagrams; ++ sock->sk->sk_err = -err; + } ++out_put: ++ fput_light(sock->file, fput_needed); + +- return err; ++ return datagrams; + } + + SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index b53246f..e53003c 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -673,7 +673,7 @@ static int tipc_sendmcast(struct socket *sock, struct tipc_name_seq *seq, + struct tipc_sock *tsk = tipc_sk(sk); + struct net *net = sock_net(sk); + struct tipc_msg *mhdr = &tsk->phdr; +- struct sk_buff_head *pktchain = &sk->sk_write_queue; ++ struct sk_buff_head pktchain; + struct iov_iter save = msg->msg_iter; + uint mtu; + int rc; +@@ -687,14 +687,16 @@ static int tipc_sendmcast(struct socket *sock, struct tipc_name_seq *seq, + msg_set_nameupper(mhdr, seq->upper); + msg_set_hdr_sz(mhdr, MCAST_H_SIZE); + ++ skb_queue_head_init(&pktchain); ++ + new_mtu: + mtu = tipc_bcast_get_mtu(net); +- rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, pktchain); ++ rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, &pktchain); + if (unlikely(rc < 0)) + return rc; + + do { +- rc = tipc_bcast_xmit(net, pktchain); ++ rc = tipc_bcast_xmit(net, &pktchain); + if (likely(!rc)) + return dsz; + +@@ -704,7 +706,7 @@ new_mtu: + if (!rc) + continue; + } +- __skb_queue_purge(pktchain); ++ __skb_queue_purge(&pktchain); + if (rc == -EMSGSIZE) { + msg->msg_iter = save; + goto new_mtu; +@@ -863,7 +865,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz) + struct net *net = sock_net(sk); + struct tipc_msg *mhdr = &tsk->phdr; + u32 dnode, dport; +- struct sk_buff_head *pktchain = &sk->sk_write_queue; ++ struct sk_buff_head pktchain; + struct sk_buff *skb; + struct tipc_name_seq *seq; + struct iov_iter save; +@@ -924,17 +926,18 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz) + msg_set_hdr_sz(mhdr, BASIC_H_SIZE); + } + ++ skb_queue_head_init(&pktchain); + save = m->msg_iter; + new_mtu: + mtu = tipc_node_get_mtu(net, dnode, tsk->portid); +- rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, pktchain); ++ rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, &pktchain); + if (rc < 0) + return rc; + + do { +- skb = skb_peek(pktchain); ++ skb = skb_peek(&pktchain); + TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong; +- rc = tipc_node_xmit(net, pktchain, dnode, tsk->portid); ++ rc = tipc_node_xmit(net, &pktchain, dnode, tsk->portid); + if (likely(!rc)) { + if (sock->state != SS_READY) + sock->state = SS_CONNECTING; +@@ -946,7 +949,7 @@ new_mtu: + if (!rc) + continue; + } +- __skb_queue_purge(pktchain); ++ __skb_queue_purge(&pktchain); + if (rc == -EMSGSIZE) { + m->msg_iter = save; + goto new_mtu; +@@ -1016,7 +1019,7 @@ static int __tipc_send_stream(struct socket *sock, struct msghdr *m, size_t dsz) + struct net *net = sock_net(sk); + struct tipc_sock *tsk = tipc_sk(sk); + struct tipc_msg *mhdr = &tsk->phdr; +- struct sk_buff_head *pktchain = &sk->sk_write_queue; ++ struct sk_buff_head pktchain; + DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name); + u32 portid = tsk->portid; + int rc = -EINVAL; +@@ -1044,17 +1047,19 @@ static int __tipc_send_stream(struct socket *sock, struct msghdr *m, size_t dsz) + + timeo = sock_sndtimeo(sk, m->msg_flags & MSG_DONTWAIT); + dnode = tsk_peer_node(tsk); ++ skb_queue_head_init(&pktchain); + + next: + save = m->msg_iter; + mtu = tsk->max_pkt; + send = min_t(uint, dsz - sent, TIPC_MAX_USER_MSG_SIZE); +- rc = tipc_msg_build(mhdr, m, sent, send, mtu, pktchain); ++ rc = tipc_msg_build(mhdr, m, sent, send, mtu, &pktchain); + if (unlikely(rc < 0)) + return rc; ++ + do { + if (likely(!tsk_conn_cong(tsk))) { +- rc = tipc_node_xmit(net, pktchain, dnode, portid); ++ rc = tipc_node_xmit(net, &pktchain, dnode, portid); + if (likely(!rc)) { + tsk->sent_unacked++; + sent += send; +@@ -1063,7 +1068,7 @@ next: + goto next; + } + if (rc == -EMSGSIZE) { +- __skb_queue_purge(pktchain); ++ __skb_queue_purge(&pktchain); + tsk->max_pkt = tipc_node_get_mtu(net, dnode, + portid); + m->msg_iter = save; +@@ -1077,7 +1082,7 @@ next: + rc = tipc_wait_for_sndpkt(sock, &timeo); + } while (!rc); + +- __skb_queue_purge(pktchain); ++ __skb_queue_purge(&pktchain); + return sent ? sent : rc; + } + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index ad7f5b3..1c4ad47 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; + + skb_dst_force(skb); ++ dev_hold(skb->dev); + + nexthdr = x->type->input(x, skb); + + if (nexthdr == -EINPROGRESS) + return 0; + resume: ++ dev_put(skb->dev); ++ + spin_lock(&x->lock); + if (nexthdr <= 0) { + if (nexthdr == -EBADMSG) { +diff --git a/sound/core/timer.c b/sound/core/timer.c +index f24c9fc..b982d1b 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1051,8 +1051,8 @@ static int snd_timer_s_start(struct snd_timer * timer) + njiff += timer->sticks - priv->correction; + priv->correction = 0; + } +- priv->last_expires = priv->tlist.expires = njiff; +- add_timer(&priv->tlist); ++ priv->last_expires = njiff; ++ mod_timer(&priv->tlist, njiff); + return 0; + } + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6968b79..1402ba9 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3801,6 +3801,10 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin, + + static void alc_headset_mode_default(struct hda_codec *codec) + { ++ static struct coef_fw coef0225[] = { ++ UPDATE_COEF(0x45, 0x3f<<10, 0x34<<10), ++ {} ++ }; + static struct coef_fw coef0255[] = { + WRITE_COEF(0x45, 0xc089), + WRITE_COEF(0x45, 0xc489), +@@ -3842,6 +3846,9 @@ static void alc_headset_mode_default(struct hda_codec *codec) + }; + + switch (codec->core.vendor_id) { ++ case 0x10ec0225: ++ alc_process_coef_fw(codec, coef0225); ++ break; + case 0x10ec0255: + case 0x10ec0256: + alc_process_coef_fw(codec, coef0255); +@@ -4750,6 +4757,10 @@ enum { + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, ++ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC280_FIXUP_HP_HEADSET_MIC, ++ ALC221_FIXUP_HP_FRONT_MIC, ++ ALC292_FIXUP_TPT460, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5375,6 +5386,36 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* Disable pass-through path for FRONT 14h */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 }, ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, ++ [ALC280_FIXUP_HP_HEADSET_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_disable_aamix, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MIC, ++ }, ++ [ALC221_FIXUP_HP_FRONT_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x02a19020 }, /* Front Mic */ ++ { } ++ }, ++ }, ++ [ALC292_FIXUP_TPT460] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_tpt440_dock, ++ .chained = true, ++ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5479,6 +5520,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +@@ -5527,7 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), ++ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +@@ -5622,6 +5665,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"}, + {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"}, + {.id = ALC292_FIXUP_TPT440, .name = "tpt440"}, ++ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"}, + {} + }; + #define ALC225_STANDARD_PINS \ +@@ -5648,10 +5692,10 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {0x21, 0x03211020} + + static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { +- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, + {0x14, 0x901701a0}), +- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, + {0x14, 0x901701b0}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE, +@@ -6379,6 +6423,7 @@ enum { + ALC668_FIXUP_AUTO_MUTE, + ALC668_FIXUP_DELL_DISABLE_AAMIX, + ALC668_FIXUP_DELL_XPS13, ++ ALC662_FIXUP_ASUS_Nx50, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -6619,6 +6664,12 @@ static const struct hda_fixup alc662_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_bass_chmap, + }, ++ [ALC662_FIXUP_ASUS_Nx50] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_auto_mute_via_amp, ++ .chained = true, ++ .chain_id = ALC662_FIXUP_BASS_1A ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -6641,8 +6692,9 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), +- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A), ++ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), + SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A), ++ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), + SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP), + SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16), + SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16), +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index ddca654..1f8fb0d9 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = { + }; + + /* ++ * Dell usb dock with ALC4020 codec had a firmware problem where it got ++ * screwed up when zero volume is passed; just skip it as a workaround ++ */ ++static const struct usbmix_name_map dell_alc4020_map[] = { ++ { 16, NULL }, ++ { 19, NULL }, ++ { 0 } ++}; ++ ++/* + * Control map entries + */ + +@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .map = aureon_51_2_map, + }, + { ++ .id = USB_ID(0x0bda, 0x4014), ++ .map = dell_alc4020_map, ++ }, ++ { + .id = USB_ID(0x0dba, 0x1000), + .map = mbox1_map, + }, +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index cd7eac2..001fb4d 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1135,9 +1135,11 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */ + case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */ + case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */ ++ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */ + case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */ + case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ ++ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ + case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */ + return true; + } |