diff options
| -rw-r--r-- | 4.9.10/0000_README (renamed from 4.9.9/0000_README) | 10 | ||||
| -rw-r--r-- | 4.9.10/1009_linux-4.9.10.patch | 2157 | ||||
| -rw-r--r-- | 4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch (renamed from 4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch) | 373 | ||||
| -rw-r--r-- | 4.9.10/4425_grsec_remove_EI_PAX.patch (renamed from 4.9.9/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4426_default_XATTR_PAX_FLAGS.patch (renamed from 4.9.9/4426_default_XATTR_PAX_FLAGS.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.9.9/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4430_grsec-remove-localversion-grsec.patch (renamed from 4.9.9/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4435_grsec-mute-warnings.patch (renamed from 4.9.9/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4440_grsec-remove-protected-paths.patch (renamed from 4.9.9/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4450_grsec-kconfig-default-gids.patch (renamed from 4.9.9/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.9.9/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4470_disable-compat_vdso.patch (renamed from 4.9.9/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.9.10/4475_emutramp_default_on.patch (renamed from 4.9.9/4475_emutramp_default_on.patch) | 0 | ||||
| -rw-r--r-- | 4.9.9/1007_linux-4.9.8.patch | 2048 | ||||
| -rw-r--r-- | 4.9.9/1008_linux-4.9.9.patch | 2333 |
15 files changed, 2368 insertions, 4553 deletions
diff --git a/4.9.9/0000_README b/4.9.10/0000_README index e2a9385..3bc6d08 100644 --- a/4.9.9/0000_README +++ b/4.9.10/0000_README @@ -2,15 +2,11 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1007_linux-4.9.8.patch +Patch: 1009_linux-4.9.10.patch From: http://www.kernel.org -Desc: Linux 4.9.8 +Desc: Linux 4.9.10 -Patch: 1008_linux-4.9.9.patch -From: http://www.kernel.org -Desc: Linux 4.9.9 - -Patch: 4420_grsecurity-3.1-4.9.9-201702122044.patch +Patch: 4420_grsecurity-3.1-4.9.10-201702162016.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/4.9.10/1009_linux-4.9.10.patch b/4.9.10/1009_linux-4.9.10.patch new file mode 100644 index 0000000..1767b59 --- /dev/null +++ b/4.9.10/1009_linux-4.9.10.patch @@ -0,0 +1,2157 @@ +diff --git a/Makefile b/Makefile +index c0c41c9..d2fe757 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 9 ++SUBLEVEL = 10 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c +index 91ebe38..5f69c3b 100644 +--- a/arch/arc/kernel/unaligned.c ++++ b/arch/arc/kernel/unaligned.c +@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs, + + /* clear any remanants of delay slot */ + if (delay_mode(regs)) { +- regs->ret = regs->bta ~1U; ++ regs->ret = regs->bta & ~1U; + regs->status32 &= ~STATUS_DE_MASK; + } else { + regs->ret += state.instr_len; +diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi +index 1ade195..7aa120f 100644 +--- a/arch/arm/boot/dts/imx6dl.dtsi ++++ b/arch/arm/boot/dts/imx6dl.dtsi +@@ -137,7 +137,7 @@ + &gpio4 { + gpio-ranges = <&iomuxc 5 136 1>, <&iomuxc 6 145 1>, <&iomuxc 7 150 1>, + <&iomuxc 8 146 1>, <&iomuxc 9 151 1>, <&iomuxc 10 147 1>, +- <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>, ++ <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>, + <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16 39 7>, + <&iomuxc 23 56 1>, <&iomuxc 24 61 7>, <&iomuxc 31 46 1>; + }; +diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c +index ce131ed..ae738a6 100644 +--- a/arch/arm/kernel/ptrace.c ++++ b/arch/arm/kernel/ptrace.c +@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + int ret; +- struct pt_regs newregs; ++ struct pt_regs newregs = *task_pt_regs(target); + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &newregs, +diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c +index 3a2e678..0122ad1 100644 +--- a/arch/arm/mm/fault.c ++++ b/arch/arm/mm/fault.c +@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr, + + void __init early_abt_enable(void) + { +- fsr_info[22].fn = early_abort_handler; ++ fsr_info[FSR_FS_AEA].fn = early_abort_handler; + local_abt_enable(); +- fsr_info[22].fn = do_bad; ++ fsr_info[FSR_FS_AEA].fn = do_bad; + } + + #ifndef CONFIG_ARM_LPAE +diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h +index 67532f2..afc1f84 100644 +--- a/arch/arm/mm/fault.h ++++ b/arch/arm/mm/fault.h +@@ -11,11 +11,15 @@ + #define FSR_FS5_0 (0x3f) + + #ifdef CONFIG_ARM_LPAE ++#define FSR_FS_AEA 17 ++ + static inline int fsr_fs(unsigned int fsr) + { + return fsr & FSR_FS5_0; + } + #else ++#define FSR_FS_AEA 22 ++ + static inline int fsr_fs(unsigned int fsr) + { + return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6; +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 9e1499f..13f5fad 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -641,9 +641,10 @@ + #define SRR1_ISI_N_OR_G 0x10000000 /* ISI: Access is no-exec or G */ + #define SRR1_ISI_PROT 0x08000000 /* ISI: Other protection fault */ + #define SRR1_WAKEMASK 0x00380000 /* reason for wakeup */ +-#define SRR1_WAKEMASK_P8 0x003c0000 /* reason for wakeup on POWER8 */ ++#define SRR1_WAKEMASK_P8 0x003c0000 /* reason for wakeup on POWER8 and 9 */ + #define SRR1_WAKESYSERR 0x00300000 /* System error */ + #define SRR1_WAKEEE 0x00200000 /* External interrupt */ ++#define SRR1_WAKEHVI 0x00240000 /* Hypervisor Virtualization Interrupt (P9) */ + #define SRR1_WAKEMT 0x00280000 /* mtctrl */ + #define SRR1_WAKEHMI 0x00280000 /* Hypervisor maintenance */ + #define SRR1_WAKEDEC 0x00180000 /* Decrementer interrupt */ +diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h +index f0b2385..e0b9e57 100644 +--- a/arch/powerpc/include/asm/xics.h ++++ b/arch/powerpc/include/asm/xics.h +@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; } + + #ifdef CONFIG_PPC_POWERNV + extern int icp_opal_init(void); ++extern void icp_opal_flush_interrupt(void); + #else + static inline int icp_opal_init(void) { return -ENODEV; } + #endif +diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c +index 3493cf4..71697ff 100644 +--- a/arch/powerpc/mm/tlb-radix.c ++++ b/arch/powerpc/mm/tlb-radix.c +@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric) + for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) { + __tlbiel_pid(pid, set, ric); + } +- if (cpu_has_feature(CPU_FTR_POWER9_DD1)) +- asm volatile(PPC_INVALIDATE_ERAT : : :"memory"); +- return; ++ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory"); + } + + static inline void _tlbie_pid(unsigned long pid, unsigned long ric) +@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid, + asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1) + : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory"); + asm volatile("ptesync": : :"memory"); +- if (cpu_has_feature(CPU_FTR_POWER9_DD1)) +- asm volatile(PPC_INVALIDATE_ERAT : : :"memory"); + } + + static inline void _tlbie_va(unsigned long va, unsigned long pid, +diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c +index c789258..eec0e8d 100644 +--- a/arch/powerpc/platforms/powernv/smp.c ++++ b/arch/powerpc/platforms/powernv/smp.c +@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void) + wmask = SRR1_WAKEMASK_P8; + + idle_states = pnv_get_supported_cpuidle_states(); ++ + /* We don't want to take decrementer interrupts while we are offline, +- * so clear LPCR:PECE1. We keep PECE2 enabled. ++ * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9) ++ * enabled as to let IPIs in. + */ + mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1); + +@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void) + * contains 0. + */ + if (((srr1 & wmask) == SRR1_WAKEEE) || ++ ((srr1 & wmask) == SRR1_WAKEHVI) || + (local_paca->irq_happened & PACA_IRQ_EE)) { +- icp_native_flush_interrupt(); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ icp_opal_flush_interrupt(); ++ else ++ icp_native_flush_interrupt(); + } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) { + unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER); + asm volatile(PPC_MSGCLR(%0) : : "r" (msg)); +@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void) + if (srr1 && !generic_check_cpu_restart(cpu)) + DBG("CPU%d Unexpected exit while offline !\n", cpu); + } ++ ++ /* Re-enable decrementer interrupts */ + mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1); + DBG("CPU%d coming online...\n", cpu); + } +diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c +index 60c5765..c96c0cb 100644 +--- a/arch/powerpc/sysdev/xics/icp-opal.c ++++ b/arch/powerpc/sysdev/xics/icp-opal.c +@@ -132,6 +132,35 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id) + return smp_ipi_demux(); + } + ++/* ++ * Called when an interrupt is received on an off-line CPU to ++ * clear the interrupt, so that the CPU can go back to nap mode. ++ */ ++void icp_opal_flush_interrupt(void) ++{ ++ unsigned int xirr; ++ unsigned int vec; ++ ++ do { ++ xirr = icp_opal_get_xirr(); ++ vec = xirr & 0x00ffffff; ++ if (vec == XICS_IRQ_SPURIOUS) ++ break; ++ if (vec == XICS_IPI) { ++ /* Clear pending IPI */ ++ int cpu = smp_processor_id(); ++ kvmppc_set_host_ipi(cpu, 0); ++ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff); ++ } else { ++ pr_err("XICS: hw interrupt 0x%x to offline cpu, " ++ "disabling\n", vec); ++ xics_mask_unknown_vec(vec); ++ } ++ ++ /* EOI the interrupt */ ++ } while (opal_int_eoi(xirr) > 0); ++} ++ + #endif /* CONFIG_SMP */ + + static const struct icp_ops icp_opal_ops = { +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 984a7bf..83db0ea 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -104,6 +104,7 @@ struct cpuinfo_x86 { + __u8 x86_phys_bits; + /* CPUID returned core id bits: */ + __u8 x86_coreid_bits; ++ __u8 cu_id; + /* Max extended CPUID function supported: */ + __u32 extended_cpuid_level; + /* Maximum supported CPUID level, -1=no CPUID: */ +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 7249f15..d1e2556 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1876,7 +1876,6 @@ static struct irq_chip ioapic_chip __read_mostly = { + .irq_ack = irq_chip_ack_parent, + .irq_eoi = ioapic_ack_level, + .irq_set_affinity = ioapic_set_affinity, +- .irq_retrigger = irq_chip_retrigger_hierarchy, + .flags = IRQCHIP_SKIP_SET_WAKE, + }; + +@@ -1888,7 +1887,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = { + .irq_ack = irq_chip_ack_parent, + .irq_eoi = ioapic_ir_ack_level, + .irq_set_affinity = ioapic_set_affinity, +- .irq_retrigger = irq_chip_retrigger_hierarchy, + .flags = IRQCHIP_SKIP_SET_WAKE, + }; + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 1d31672..2b4cf04 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c) + + /* get information required for multi-node processors */ + if (boot_cpu_has(X86_FEATURE_TOPOEXT)) { ++ u32 eax, ebx, ecx, edx; + +- node_id = cpuid_ecx(0x8000001e) & 7; ++ cpuid(0x8000001e, &eax, &ebx, &ecx, &edx); ++ ++ node_id = ecx & 0xff; ++ smp_num_siblings = ((ebx >> 8) & 0xff) + 1; ++ ++ if (c->x86 == 0x15) ++ c->cu_id = ebx & 0xff; ++ ++ if (c->x86 >= 0x17) { ++ c->cpu_core_id = ebx & 0xff; ++ ++ if (smp_num_siblings > 1) ++ c->x86_max_cores /= smp_num_siblings; ++ } + + /* + * We may have multiple LLCs if L3 caches exist, so check if we +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 023c7bf..4eece91 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) + c->x86_model_id[0] = '\0'; /* Unset */ + c->x86_max_cores = 1; + c->x86_coreid_bits = 0; ++ c->cu_id = 0xff; + #ifdef CONFIG_X86_64 + c->x86_clflush_size = 64; + c->x86_phys_bits = 36; +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index e9bbe02..36171bc 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -423,9 +423,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o) + int cpu1 = c->cpu_index, cpu2 = o->cpu_index; + + if (c->phys_proc_id == o->phys_proc_id && +- per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) && +- c->cpu_core_id == o->cpu_core_id) +- return topology_sane(c, o, "smt"); ++ per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) { ++ if (c->cpu_core_id == o->cpu_core_id) ++ return topology_sane(c, o, "smt"); ++ ++ if ((c->cu_id != 0xff) && ++ (o->cu_id != 0xff) && ++ (c->cu_id == o->cu_id)) ++ return topology_sane(c, o, "smt"); ++ } + + } else if (c->phys_proc_id == o->phys_proc_id && + c->cpu_core_id == o->cpu_core_id) { +diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c +index ea9c49a..8aa6bea 100644 +--- a/arch/x86/mm/dump_pagetables.c ++++ b/arch/x86/mm/dump_pagetables.c +@@ -15,6 +15,7 @@ + #include <linux/debugfs.h> + #include <linux/mm.h> + #include <linux/init.h> ++#include <linux/sched.h> + #include <linux/seq_file.h> + + #include <asm/pgtable.h> +@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd, + } else + note_page(m, &st, __pgprot(0), 1); + ++ cond_resched(); + start++; + } + +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index e9c0993..e8817e2 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -671,9 +671,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags) + unlock: + list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) { + af_alg_free_sg(&rsgl->sgl); ++ list_del(&rsgl->list); + if (rsgl != &ctx->first_rsgl) + sock_kfree_s(sk, rsgl, sizeof(*rsgl)); +- list_del(&rsgl->list); + } + INIT_LIST_HEAD(&ctx->list); + aead_wmem_wakeup(sk); +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 312c4b4..6eb6733 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc) + struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc); + struct device *dev = acpi_desc->dev; + struct acpi_nfit_flush_work flush; ++ int rc; + + /* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */ + device_lock(dev); +@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc) + INIT_WORK_ONSTACK(&flush.work, flush_probe); + COMPLETION_INITIALIZER_ONSTACK(flush.cmp); + queue_work(nfit_wq, &flush.work); +- return wait_for_completion_interruptible(&flush.cmp); ++ ++ rc = wait_for_completion_interruptible(&flush.cmp); ++ cancel_work_sync(&flush.work); ++ return rc; + } + + static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc, +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 4737520..80fa656 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -820,6 +820,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata) + wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1); + } + ++#define MSR_IA32_POWER_CTL_BIT_EE 19 ++ ++/* Disable energy efficiency optimization */ ++static void intel_pstate_disable_ee(int cpu) ++{ ++ u64 power_ctl; ++ int ret; ++ ++ ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl); ++ if (ret) ++ return; ++ ++ if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) { ++ pr_info("Disabling energy efficiency optimization\n"); ++ power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE); ++ wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl); ++ } ++} ++ + static int atom_get_min_pstate(void) + { + u64 value; +@@ -1420,6 +1439,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = { + {} + }; + ++static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = { ++ ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params), ++ {} ++}; ++ + static int intel_pstate_init_cpu(unsigned int cpunum) + { + struct cpudata *cpu; +@@ -1435,6 +1459,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum) + cpu->cpu = cpunum; + + if (hwp_active) { ++ const struct x86_cpu_id *id; ++ ++ id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids); ++ if (id) ++ intel_pstate_disable_ee(cpunum); ++ + intel_pstate_hwp_enable(cpu); + pid_params.sample_rate_ms = 50; + pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC; +diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c +index faf3cb3..a388bf2 100644 +--- a/drivers/crypto/ccp/ccp-dev-v5.c ++++ b/drivers/crypto/ccp/ccp-dev-v5.c +@@ -955,7 +955,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data) + static void ccp5_config(struct ccp_device *ccp) + { + /* Public side */ +- iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET); ++ iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET); + } + + static void ccp5other_config(struct ccp_device *ccp) +diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h +index da5f4a6..340aef1 100644 +--- a/drivers/crypto/ccp/ccp-dev.h ++++ b/drivers/crypto/ccp/ccp-dev.h +@@ -238,6 +238,7 @@ struct ccp_dma_chan { + struct ccp_device *ccp; + + spinlock_t lock; ++ struct list_head created; + struct list_head pending; + struct list_head active; + struct list_head complete; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 6553912..e5d9278 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan) + ccp_free_desc_resources(chan->ccp, &chan->complete); + ccp_free_desc_resources(chan->ccp, &chan->active); + ccp_free_desc_resources(chan->ccp, &chan->pending); ++ ccp_free_desc_resources(chan->ccp, &chan->created); + + spin_unlock_irqrestore(&chan->lock, flags); + } +@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc) + spin_lock_irqsave(&chan->lock, flags); + + cookie = dma_cookie_assign(tx_desc); ++ list_del(&desc->entry); + list_add_tail(&desc->entry, &chan->pending); + + spin_unlock_irqrestore(&chan->lock, flags); +@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan, + + spin_lock_irqsave(&chan->lock, sflags); + +- list_add_tail(&desc->entry, &chan->pending); ++ list_add_tail(&desc->entry, &chan->created); + + spin_unlock_irqrestore(&chan->lock, sflags); + +@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) + /*TODO: Purge the complete list? */ + ccp_free_desc_resources(chan->ccp, &chan->active); + ccp_free_desc_resources(chan->ccp, &chan->pending); ++ ccp_free_desc_resources(chan->ccp, &chan->created); + + spin_unlock_irqrestore(&chan->lock, flags); + +@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) + chan->ccp = ccp; + + spin_lock_init(&chan->lock); ++ INIT_LIST_HEAD(&chan->created); + INIT_LIST_HEAD(&chan->pending); + INIT_LIST_HEAD(&chan->active); + INIT_LIST_HEAD(&chan->complete); +diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c +index fb5f9bb..6aece3f 100644 +--- a/drivers/crypto/chelsio/chcr_core.c ++++ b/drivers/crypto/chelsio/chcr_core.c +@@ -51,6 +51,7 @@ static struct cxgb4_uld_info chcr_uld_info = { + int assign_chcr_device(struct chcr_dev **dev) + { + struct uld_ctx *u_ctx; ++ int ret = -ENXIO; + + /* + * Which device to use if multiple devices are available TODO +@@ -58,15 +59,14 @@ int assign_chcr_device(struct chcr_dev **dev) + * must go to the same device to maintain the ordering. + */ + mutex_lock(&dev_mutex); /* TODO ? */ +- u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry); +- if (!u_ctx) { +- mutex_unlock(&dev_mutex); +- return -ENXIO; ++ list_for_each_entry(u_ctx, &uld_ctx_list, entry) ++ if (u_ctx && u_ctx->dev) { ++ *dev = u_ctx->dev; ++ ret = 0; ++ break; + } +- +- *dev = u_ctx->dev; + mutex_unlock(&dev_mutex); +- return 0; ++ return ret; + } + + static int chcr_dev_add(struct uld_ctx *u_ctx) +@@ -203,10 +203,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state) + + static int __init chcr_crypto_init(void) + { +- if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) { ++ if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) + pr_err("ULD register fail: No chcr crypto support in cxgb4"); +- return -1; +- } + + return 0; + } +diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c +index bc5cbc1..5b2d78a 100644 +--- a/drivers/crypto/qat/qat_c62x/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c +@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + &hw_data->accel_capabilities_mask); + + /* Find and map all the device's BARS */ +- i = 0; ++ i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0; + bar_mask = pci_select_bars(pdev, IORESOURCE_MEM); + for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask, + ADF_PCI_MAX_BARS * 2) { +diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h +index e882253..33f0a62 100644 +--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h ++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h +@@ -69,6 +69,7 @@ + #define ADF_ERRSOU5 (0x3A000 + 0xD8) + #define ADF_DEVICE_FUSECTL_OFFSET 0x40 + #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C ++#define ADF_DEVICE_FUSECTL_MASK 0x80000000 + #define ADF_PCI_MAX_BARS 3 + #define ADF_DEVICE_NAME_LENGTH 32 + #define ADF_ETR_MAX_RINGS_PER_BANK 16 +diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c +index 1e480f1..8c4fd25 100644 +--- a/drivers/crypto/qat/qat_common/qat_hal.c ++++ b/drivers/crypto/qat/qat_common/qat_hal.c +@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle) + unsigned int csr_val; + int times = 30; + +- if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID) ++ if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID) + return 0; + + csr_val = ADF_CSR_RD(csr_addr, 0); +@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev) + (void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v + + LOCAL_TO_XFER_REG_OFFSET); + handle->pci_dev = pci_info->pci_dev; +- if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) { ++ if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) { + sram_bar = + &pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)]; + handle->hal_sram_addr_v = sram_bar->virt_addr; +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index e6862a7..4e19bde 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1759,16 +1759,16 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, + + if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) { + /* +- * TEST_ONLY and PAGE_FLIP_EVENT are mutually exclusive, +- * if they weren't, this code should be called on success +- * for TEST_ONLY too. ++ * Free the allocated event. drm_atomic_helper_setup_commit ++ * can allocate an event too, so only free it if it's ours ++ * to prevent a double free in drm_atomic_state_clear. + */ +- + for_each_crtc_in_state(state, crtc, crtc_state, i) { +- if (!crtc_state->event) +- continue; +- +- drm_event_cancel_free(dev, &crtc_state->event->base); ++ struct drm_pending_vblank_event *event = crtc_state->event; ++ if (event && (event->base.fence || event->base.file_priv)) { ++ drm_event_cancel_free(dev, &event->base); ++ crtc_state->event = NULL; ++ } + } + } + +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index a218c2e..0c400f8 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -1215,14 +1215,14 @@ validate_exec_list(struct drm_device *dev, + if (exec[i].offset != + gen8_canonical_addr(exec[i].offset & PAGE_MASK)) + return -EINVAL; +- +- /* From drm_mm perspective address space is continuous, +- * so from this point we're always using non-canonical +- * form internally. +- */ +- exec[i].offset = gen8_noncanonical_addr(exec[i].offset); + } + ++ /* From drm_mm perspective address space is continuous, ++ * so from this point we're always using non-canonical ++ * form internally. ++ */ ++ exec[i].offset = gen8_noncanonical_addr(exec[i].offset); ++ + if (exec[i].alignment && !is_power_of_2(exec[i].alignment)) + return -EINVAL; + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 8079e5b..b9be8a6 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4280,10 +4280,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc) + drm_crtc_vblank_put(&intel_crtc->base); + + wake_up_all(&dev_priv->pending_flip_queue); +- queue_work(dev_priv->wq, &work->unpin_work); +- + trace_i915_flip_complete(intel_crtc->plane, + work->pending_flip_obj); ++ ++ queue_work(dev_priv->wq, &work->unpin_work); + } + + static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc) +diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c +index 1c59ca5..cae27c5 100644 +--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c ++++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c +@@ -1723,7 +1723,8 @@ bxt_get_dpll(struct intel_crtc *crtc, + return NULL; + + if ((encoder->type == INTEL_OUTPUT_DP || +- encoder->type == INTEL_OUTPUT_EDP) && ++ encoder->type == INTEL_OUTPUT_EDP || ++ encoder->type == INTEL_OUTPUT_DP_MST) && + !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state)) + return NULL; + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 16f91c8..5fb4c6d 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -39,7 +39,7 @@ + * vmbus_setevent- Trigger an event notification on the specified + * channel. + */ +-static void vmbus_setevent(struct vmbus_channel *channel) ++void vmbus_setevent(struct vmbus_channel *channel) + { + struct hv_monitor_page *monitorpage; + +@@ -65,6 +65,7 @@ static void vmbus_setevent(struct vmbus_channel *channel) + vmbus_set_event(channel); + } + } ++EXPORT_SYMBOL_GPL(vmbus_setevent); + + /* + * vmbus_open - Open the specified channel. +@@ -635,8 +636,6 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer, + u32 packetlen_aligned = ALIGN(packetlen, sizeof(u64)); + struct kvec bufferlist[3]; + u64 aligned_data = 0; +- int ret; +- bool signal = false; + bool lock = channel->acquire_ring_lock; + int num_vecs = ((bufferlen != 0) ? 3 : 1); + +@@ -656,33 +655,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer, + bufferlist[2].iov_base = &aligned_data; + bufferlist[2].iov_len = (packetlen_aligned - packetlen); + +- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs, +- &signal, lock, channel->signal_policy); +- +- /* +- * Signalling the host is conditional on many factors: +- * 1. The ring state changed from being empty to non-empty. +- * This is tracked by the variable "signal". +- * 2. The variable kick_q tracks if more data will be placed +- * on the ring. We will not signal if more data is +- * to be placed. +- * +- * Based on the channel signal state, we will decide +- * which signaling policy will be applied. +- * +- * If we cannot write to the ring-buffer; signal the host +- * even if we may not have written anything. This is a rare +- * enough condition that it should not matter. +- * NOTE: in this case, the hvsock channel is an exception, because +- * it looks the host side's hvsock implementation has a throttling +- * mechanism which can hurt the performance otherwise. +- */ +- +- if (((ret == 0) && kick_q && signal) || +- (ret && !is_hvsock_channel(channel))) +- vmbus_setevent(channel); ++ return hv_ringbuffer_write(channel, bufferlist, num_vecs, ++ lock, kick_q); + +- return ret; + } + EXPORT_SYMBOL(vmbus_sendpacket_ctl); + +@@ -723,7 +698,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel, + u32 flags, + bool kick_q) + { +- int ret; + int i; + struct vmbus_channel_packet_page_buffer desc; + u32 descsize; +@@ -731,7 +705,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel, + u32 packetlen_aligned; + struct kvec bufferlist[3]; + u64 aligned_data = 0; +- bool signal = false; + bool lock = channel->acquire_ring_lock; + + if (pagecount > MAX_PAGE_BUFFER_COUNT) +@@ -769,29 +742,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel, + bufferlist[2].iov_base = &aligned_data; + bufferlist[2].iov_len = (packetlen_aligned - packetlen); + +- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, +- &signal, lock, channel->signal_policy); +- +- /* +- * Signalling the host is conditional on many factors: +- * 1. The ring state changed from being empty to non-empty. +- * This is tracked by the variable "signal". +- * 2. The variable kick_q tracks if more data will be placed +- * on the ring. We will not signal if more data is +- * to be placed. +- * +- * Based on the channel signal state, we will decide +- * which signaling policy will be applied. +- * +- * If we cannot write to the ring-buffer; signal the host +- * even if we may not have written anything. This is a rare +- * enough condition that it should not matter. +- */ +- +- if (((ret == 0) && kick_q && signal) || (ret)) +- vmbus_setevent(channel); +- +- return ret; ++ return hv_ringbuffer_write(channel, bufferlist, 3, ++ lock, kick_q); + } + EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer_ctl); + +@@ -822,12 +774,10 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, + u32 desc_size, + void *buffer, u32 bufferlen, u64 requestid) + { +- int ret; + u32 packetlen; + u32 packetlen_aligned; + struct kvec bufferlist[3]; + u64 aligned_data = 0; +- bool signal = false; + bool lock = channel->acquire_ring_lock; + + packetlen = desc_size + bufferlen; +@@ -848,13 +798,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel, + bufferlist[2].iov_base = &aligned_data; + bufferlist[2].iov_len = (packetlen_aligned - packetlen); + +- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, +- &signal, lock, channel->signal_policy); +- +- if (ret == 0 && signal) +- vmbus_setevent(channel); +- +- return ret; ++ return hv_ringbuffer_write(channel, bufferlist, 3, ++ lock, true); + } + EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc); + +@@ -866,14 +811,12 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel, + struct hv_multipage_buffer *multi_pagebuffer, + void *buffer, u32 bufferlen, u64 requestid) + { +- int ret; + struct vmbus_channel_packet_multipage_buffer desc; + u32 descsize; + u32 packetlen; + u32 packetlen_aligned; + struct kvec bufferlist[3]; + u64 aligned_data = 0; +- bool signal = false; + bool lock = channel->acquire_ring_lock; + u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset, + multi_pagebuffer->len); +@@ -913,13 +856,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel, + bufferlist[2].iov_base = &aligned_data; + bufferlist[2].iov_len = (packetlen_aligned - packetlen); + +- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, +- &signal, lock, channel->signal_policy); +- +- if (ret == 0 && signal) +- vmbus_setevent(channel); +- +- return ret; ++ return hv_ringbuffer_write(channel, bufferlist, 3, ++ lock, true); + } + EXPORT_SYMBOL_GPL(vmbus_sendpacket_multipagebuffer); + +@@ -941,16 +879,9 @@ __vmbus_recvpacket(struct vmbus_channel *channel, void *buffer, + u32 bufferlen, u32 *buffer_actual_len, u64 *requestid, + bool raw) + { +- int ret; +- bool signal = false; ++ return hv_ringbuffer_read(channel, buffer, bufferlen, ++ buffer_actual_len, requestid, raw); + +- ret = hv_ringbuffer_read(&channel->inbound, buffer, bufferlen, +- buffer_actual_len, requestid, &signal, raw); +- +- if (signal) +- vmbus_setevent(channel); +- +- return ret; + } + + int vmbus_recvpacket(struct vmbus_channel *channel, void *buffer, +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 1bc1d479..caf3418 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -449,8 +449,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel) + } + + dev_type = hv_get_dev_type(newchannel); +- if (dev_type == HV_NIC) +- set_channel_signal_state(newchannel, HV_SIGNAL_POLICY_EXPLICIT); + + init_vp_index(newchannel, dev_type); + +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index a5b4442..2b13f2a 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -527,14 +527,14 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info, + + void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info); + +-int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info, ++int hv_ringbuffer_write(struct vmbus_channel *channel, + struct kvec *kv_list, +- u32 kv_count, bool *signal, bool lock, +- enum hv_signal_policy policy); ++ u32 kv_count, bool lock, ++ bool kick_q); + +-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, ++int hv_ringbuffer_read(struct vmbus_channel *channel, + void *buffer, u32 buflen, u32 *buffer_actual_len, +- u64 *requestid, bool *signal, bool raw); ++ u64 *requestid, bool raw); + + void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info, + struct hv_ring_buffer_debug_info *debug_info); +diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c +index 08043da..308dbda 100644 +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -66,21 +66,25 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi) + * once the ring buffer is empty, it will clear the + * interrupt_mask and re-check to see if new data has + * arrived. ++ * ++ * KYS: Oct. 30, 2016: ++ * It looks like Windows hosts have logic to deal with DOS attacks that ++ * can be triggered if it receives interrupts when it is not expecting ++ * the interrupt. The host expects interrupts only when the ring ++ * transitions from empty to non-empty (or full to non full on the guest ++ * to host ring). ++ * So, base the signaling decision solely on the ring state until the ++ * host logic is fixed. + */ + +-static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi, +- enum hv_signal_policy policy) ++static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel, ++ bool kick_q) + { ++ struct hv_ring_buffer_info *rbi = &channel->outbound; ++ + virt_mb(); + if (READ_ONCE(rbi->ring_buffer->interrupt_mask)) +- return false; +- +- /* +- * When the client wants to control signaling, +- * we only honour the host interrupt mask. +- */ +- if (policy == HV_SIGNAL_POLICY_EXPLICIT) +- return true; ++ return; + + /* check interrupt_mask before read_index */ + virt_rmb(); +@@ -89,9 +93,9 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi, + * ring transitions from being empty to non-empty. + */ + if (old_write == READ_ONCE(rbi->ring_buffer->read_index)) +- return true; ++ vmbus_setevent(channel); + +- return false; ++ return; + } + + /* Get the next write location for the specified ring buffer. */ +@@ -280,9 +284,9 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info) + } + + /* Write to the ring buffer. */ +-int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info, +- struct kvec *kv_list, u32 kv_count, bool *signal, bool lock, +- enum hv_signal_policy policy) ++int hv_ringbuffer_write(struct vmbus_channel *channel, ++ struct kvec *kv_list, u32 kv_count, bool lock, ++ bool kick_q) + { + int i = 0; + u32 bytes_avail_towrite; +@@ -292,6 +296,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info, + u32 old_write; + u64 prev_indices = 0; + unsigned long flags = 0; ++ struct hv_ring_buffer_info *outring_info = &channel->outbound; + + for (i = 0; i < kv_count; i++) + totalbytes_towrite += kv_list[i].iov_len; +@@ -344,13 +349,13 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info, + if (lock) + spin_unlock_irqrestore(&outring_info->ring_lock, flags); + +- *signal = hv_need_to_signal(old_write, outring_info, policy); ++ hv_signal_on_write(old_write, channel, kick_q); + return 0; + } + +-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, ++int hv_ringbuffer_read(struct vmbus_channel *channel, + void *buffer, u32 buflen, u32 *buffer_actual_len, +- u64 *requestid, bool *signal, bool raw) ++ u64 *requestid, bool raw) + { + u32 bytes_avail_toread; + u32 next_read_location = 0; +@@ -359,6 +364,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, + u32 offset; + u32 packetlen; + int ret = 0; ++ struct hv_ring_buffer_info *inring_info = &channel->inbound; + + if (buflen <= 0) + return -EINVAL; +@@ -377,6 +383,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, + return ret; + } + ++ init_cached_read_index(channel); + next_read_location = hv_get_next_read_location(inring_info); + next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc, + sizeof(desc), +@@ -416,7 +423,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info, + /* Update the read index */ + hv_set_next_read_location(inring_info, next_read_location); + +- *signal = hv_need_to_signal_on_read(inring_info); ++ hv_signal_on_read(channel); + + return ret; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 1869152..9b732c5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length) + + case RXE_MEM_TYPE_MR: + case RXE_MEM_TYPE_FMR: +- return ((iova < mem->iova) || +- ((iova + length) > (mem->iova + mem->length))) ? +- -EFAULT : 0; ++ if (iova < mem->iova || ++ length > mem->length || ++ iova > mem->iova + mem->length - length) ++ return -EFAULT; ++ return 0; + + default: + return -EFAULT; +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index dd3d88a..ccf6247 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -472,7 +472,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp, + goto err2; + } + +- resid = mtu; ++ qp->resp.resid = mtu; + } else { + if (pktlen != resid) { + state = RESPST_ERR_LENGTH; +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index 92595b9..022be0e 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev) + return -EINVAL; + } + +- if (test_bit(ABS_MT_SLOT, dev->absbit)) { +- nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; +- error = input_mt_init_slots(dev, nslot, 0); +- if (error) ++ if (test_bit(EV_ABS, dev->evbit)) { ++ input_alloc_absinfo(dev); ++ if (!dev->absinfo) { ++ error = -EINVAL; + goto fail1; +- } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { +- input_set_events_per_packet(dev, 60); ++ } ++ ++ if (test_bit(ABS_MT_SLOT, dev->absbit)) { ++ nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; ++ error = input_mt_init_slots(dev, nslot, 0); ++ if (error) ++ goto fail1; ++ } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { ++ input_set_events_per_packet(dev, 60); ++ } + } + + if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) { +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 31a89c8..2c96542 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -804,6 +804,10 @@ static void dm_old_request_fn(struct request_queue *q) + int srcu_idx; + struct dm_table *map = dm_get_live_table(md, &srcu_idx); + ++ if (unlikely(!map)) { ++ dm_put_live_table(md, srcu_idx); ++ return; ++ } + ti = dm_table_find_target(map, pos); + dm_put_live_table(md, srcu_idx); + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +index 878950a..2cf8b1d 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h +@@ -1007,9 +1007,7 @@ + + static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value) + { +- u8 __iomem *reg_addr = ACCESS_ONCE(base); +- +- writel(value, reg_addr + reg); ++ writel(value, base + reg); + } + + #define dsaf_write_dev(a, reg, value) \ +@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value) + + static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg) + { +- u8 __iomem *reg_addr = ACCESS_ONCE(base); +- +- return readl(reg_addr + reg); ++ return readl(base + reg); + } + + static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index 27ff401..51c6a57 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -991,6 +991,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir, + { + struct mlx5e_priv *priv = netdev_priv(dev); + int inlen = MLX5_ST_SZ_BYTES(modify_tir_in); ++ bool hash_changed = false; + void *in; + + if ((hfunc != ETH_RSS_HASH_NO_CHANGE) && +@@ -1012,14 +1013,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir, + mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0); + } + +- if (key) ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && ++ hfunc != priv->params.rss_hfunc) { ++ priv->params.rss_hfunc = hfunc; ++ hash_changed = true; ++ } ++ ++ if (key) { + memcpy(priv->params.toeplitz_hash_key, key, + sizeof(priv->params.toeplitz_hash_key)); ++ hash_changed = hash_changed || ++ priv->params.rss_hfunc == ETH_RSS_HASH_TOP; ++ } + +- if (hfunc != ETH_RSS_HASH_NO_CHANGE) +- priv->params.rss_hfunc = hfunc; +- +- mlx5e_modify_tirs_hash(priv, in, inlen); ++ if (hash_changed) ++ mlx5e_modify_tirs_hash(priv, in, inlen); + + mutex_unlock(&priv->state_lock); + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 720b5fa..c2ac39a 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1288,6 +1288,9 @@ void netvsc_channel_cb(void *context) + ndev = hv_get_drvdata(device); + buffer = get_per_channel_state(channel); + ++ /* commit_rd_index() -> hv_signal_on_read() needs this. */ ++ init_cached_read_index(channel); ++ + do { + desc = get_next_pkt_raw(channel); + if (desc != NULL) { +@@ -1340,6 +1343,9 @@ void netvsc_channel_cb(void *context) + + bufferlen = bytes_recvd; + } ++ ++ init_cached_read_index(channel); ++ + } while (1); + + if (bufferlen > NETVSC_PACKET_SIZE) +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c +index 8b6e37c..20bfb37 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c +@@ -96,7 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); +- char *fw_name = "rtlwifi/rtl8192cfwU.bin"; ++ char *fw_name; + + rtl8192ce_bt_reg_init(hw); + +@@ -168,8 +168,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw) + } + + /* request fw */ +- if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version)) ++ if (IS_VENDOR_UMC_A_CUT(rtlhal->version) && ++ !IS_92C_SERIAL(rtlhal->version)) ++ fw_name = "rtlwifi/rtl8192cfwU.bin"; ++ else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version)) + fw_name = "rtlwifi/rtl8192cfwU_B.bin"; ++ else ++ fw_name = "rtlwifi/rtl8192cfw.bin"; + + rtlpriv->max_fw_size = 0x4000; + pr_info("Using firmware %s\n", fw_name); +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index bf2744e..0cdcb21 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1397,6 +1397,8 @@ static void xennet_disconnect_backend(struct netfront_info *info) + for (i = 0; i < num_queues && info->queues; ++i) { + struct netfront_queue *queue = &info->queues[i]; + ++ del_timer_sync(&queue->rx_refill_timer); ++ + if (queue->tx_irq && (queue->tx_irq == queue->rx_irq)) + unbind_from_irqhandler(queue->tx_irq, queue); + if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) { +@@ -1751,7 +1753,6 @@ static void xennet_destroy_queues(struct netfront_info *info) + + if (netif_running(info->netdev)) + napi_disable(&queue->napi); +- del_timer_sync(&queue->rx_refill_timer); + netif_napi_del(&queue->napi); + } + +diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c +index 1480734..aefca64 100644 +--- a/drivers/nvdimm/namespace_devs.c ++++ b/drivers/nvdimm/namespace_devs.c +@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val) + struct nvdimm_drvdata *ndd; + struct nd_label_id label_id; + u32 flags = 0, remainder; ++ int rc, i, id = -1; + u8 *uuid = NULL; +- int rc, i; + + if (dev->driver || ndns->claim) + return -EBUSY; +@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val) + struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev); + + uuid = nspm->uuid; ++ id = nspm->id; + } else if (is_namespace_blk(dev)) { + struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev); + + uuid = nsblk->uuid; + flags = NSLABEL_FLAG_LOCAL; ++ id = nsblk->id; + } + + /* +@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val) + + /* + * Try to delete the namespace if we deleted all of its +- * allocation, this is not the seed device for the region, and +- * it is not actively claimed by a btt instance. ++ * allocation, this is not the seed or 0th device for the ++ * region, and it is not actively claimed by a btt, pfn, or dax ++ * instance. + */ +- if (val == 0 && nd_region->ns_seed != dev && !ndns->claim) ++ if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim) + nd_device_unregister(dev, ND_ASYNC); + + return rc; +diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c +index a2ac9e6..6c033c9 100644 +--- a/drivers/nvdimm/pfn_devs.c ++++ b/drivers/nvdimm/pfn_devs.c +@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn) + size = resource_size(&nsio->res); + npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K; + if (nd_pfn->mode == PFN_MODE_PMEM) { +- unsigned long memmap_size; +- + /* + * vmemmap_populate_hugepages() allocates the memmap array in + * HPAGE_SIZE chunks. + */ +- memmap_size = ALIGN(64 * npfns, HPAGE_SIZE); +- offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve, +- nd_pfn->align) - start; ++ offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve, ++ max(nd_pfn->align, HPAGE_SIZE)) - start; + } else if (nd_pfn->mode == PFN_MODE_RAM) + offset = ALIGN(start + SZ_8K + dax_label_reserve, + nd_pfn->align) - start; +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index 75f820ca..27ff38f 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -1583,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req) + int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) + { + struct zfcp_qdio *qdio = wka_port->adapter->qdio; +- struct zfcp_fsf_req *req = NULL; ++ struct zfcp_fsf_req *req; + int retval = -EIO; + + spin_lock_irq(&qdio->req_q_lock); +@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) + zfcp_fsf_req_free(req); + out: + spin_unlock_irq(&qdio->req_q_lock); +- if (req && !IS_ERR(req)) ++ if (!retval) + zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id); + return retval; + } +@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req) + int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) + { + struct zfcp_qdio *qdio = wka_port->adapter->qdio; +- struct zfcp_fsf_req *req = NULL; ++ struct zfcp_fsf_req *req; + int retval = -EIO; + + spin_lock_irq(&qdio->req_q_lock); +@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) + zfcp_fsf_req_free(req); + out: + spin_unlock_irq(&qdio->req_q_lock); +- if (req && !IS_ERR(req)) ++ if (!retval) + zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id); + return retval; + } +diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c +index 341ea32..792d3e7 100644 +--- a/drivers/scsi/aacraid/comminit.c ++++ b/drivers/scsi/aacraid/comminit.c +@@ -50,9 +50,13 @@ struct aac_common aac_config = { + + static inline int aac_is_msix_mode(struct aac_dev *dev) + { +- u32 status; ++ u32 status = 0; + +- status = src_readl(dev, MUnit.OMR); ++ if (dev->pdev->device == PMC_DEVICE_S6 || ++ dev->pdev->device == PMC_DEVICE_S7 || ++ dev->pdev->device == PMC_DEVICE_S8) { ++ status = src_readl(dev, MUnit.OMR); ++ } + return (status & AAC_INT_MODE_MSIX); + } + +diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +index e3b911c..91dfd58 100644 +--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c ++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +@@ -3929,6 +3929,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = { + static const struct target_core_fabric_ops ibmvscsis_ops = { + .module = THIS_MODULE, + .name = "ibmvscsis", ++ .max_data_sg_nents = MAX_TXU / PAGE_SIZE, + .get_fabric_name = ibmvscsis_get_fabric_name, + .tpg_get_wwn = ibmvscsis_get_fabric_wwn, + .tpg_get_tag = ibmvscsis_get_tag, +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index f84a608..8a7941b 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -51,6 +51,7 @@ + #include <linux/workqueue.h> + #include <linux/delay.h> + #include <linux/pci.h> ++#include <linux/pci-aspm.h> + #include <linux/interrupt.h> + #include <linux/aer.h> + #include <linux/raid_class.h> +@@ -8706,6 +8707,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + switch (hba_mpi_version) { + case MPI2_VERSION: ++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | ++ PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM); + /* Use mpt2sas driver host template for SAS 2.0 HBA's */ + shost = scsi_host_alloc(&mpt2sas_driver_template, + sizeof(struct MPT3SAS_ADAPTER)); +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 078d797..bea819e 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1459,7 +1459,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res) + /* Don't abort commands in adapter during EEH + * recovery as it's not accessible/responding. + */ +- if (!ha->flags.eeh_busy) { ++ if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) { + /* Get a reference to the sp and drop the lock. + * The reference ensures this sp->done() call + * - and not the call in qla2xxx_eh_abort() - +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 6b42348..ea9617c 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -351,7 +351,15 @@ int core_enable_device_list_for_node( + kfree(new); + return -EINVAL; + } +- BUG_ON(orig->se_lun_acl != NULL); ++ if (orig->se_lun_acl != NULL) { ++ pr_warn_ratelimited("Detected existing explicit" ++ " se_lun_acl->se_lun_group reference for %s" ++ " mapped_lun: %llu, failing\n", ++ nacl->initiatorname, mapped_lun); ++ mutex_unlock(&nacl->lun_entry_mutex); ++ kfree(new); ++ return -EINVAL; ++ } + + rcu_assign_pointer(new->se_lun, lun); + rcu_assign_pointer(new->se_lun_acl, lun_acl); +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index 04f616b..aabd660 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -450,6 +450,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + int *post_ret) + { + struct se_device *dev = cmd->se_dev; ++ sense_reason_t ret = TCM_NO_SENSE; + + /* + * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through +@@ -457,9 +458,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + * sent to the backend driver. + */ + spin_lock_irq(&cmd->t_state_lock); +- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) { ++ if (cmd->transport_state & CMD_T_SENT) { + cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST; + *post_ret = 1; ++ ++ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) ++ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + } + spin_unlock_irq(&cmd->t_state_lock); + +@@ -469,7 +473,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + */ + up(&dev->caw_sem); + +- return TCM_NO_SENSE; ++ return ret; + } + + static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success, +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 7dfefd6..767d1eb6 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref) + { + struct se_node_acl *nacl = container_of(kref, + struct se_node_acl, acl_kref); ++ struct se_portal_group *se_tpg = nacl->se_tpg; + +- complete(&nacl->acl_free_comp); ++ if (!nacl->dynamic_stop) { ++ complete(&nacl->acl_free_comp); ++ return; ++ } ++ ++ mutex_lock(&se_tpg->acl_node_mutex); ++ list_del(&nacl->acl_list); ++ mutex_unlock(&se_tpg->acl_node_mutex); ++ ++ core_tpg_wait_for_nacl_pr_ref(nacl); ++ core_free_device_list_for_node(nacl, se_tpg); ++ kfree(nacl); + } + + void target_put_nacl(struct se_node_acl *nacl) +@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs); + void transport_free_session(struct se_session *se_sess) + { + struct se_node_acl *se_nacl = se_sess->se_node_acl; ++ + /* + * Drop the se_node_acl->nacl_kref obtained from within + * core_tpg_get_initiator_node_acl(). + */ + if (se_nacl) { ++ struct se_portal_group *se_tpg = se_nacl->se_tpg; ++ const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo; ++ unsigned long flags; ++ + se_sess->se_node_acl = NULL; ++ ++ /* ++ * Also determine if we need to drop the extra ->cmd_kref if ++ * it had been previously dynamically generated, and ++ * the endpoint is not caching dynamic ACLs. ++ */ ++ mutex_lock(&se_tpg->acl_node_mutex); ++ if (se_nacl->dynamic_node_acl && ++ !se_tfo->tpg_check_demo_mode_cache(se_tpg)) { ++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); ++ if (list_empty(&se_nacl->acl_sess_list)) ++ se_nacl->dynamic_stop = true; ++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); ++ ++ if (se_nacl->dynamic_stop) ++ list_del(&se_nacl->acl_list); ++ } ++ mutex_unlock(&se_tpg->acl_node_mutex); ++ ++ if (se_nacl->dynamic_stop) ++ target_put_nacl(se_nacl); ++ + target_put_nacl(se_nacl); + } + if (se_sess->sess_cmd_map) { +@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session); + void transport_deregister_session(struct se_session *se_sess) + { + struct se_portal_group *se_tpg = se_sess->se_tpg; +- const struct target_core_fabric_ops *se_tfo; +- struct se_node_acl *se_nacl; + unsigned long flags; +- bool drop_nacl = false; + + if (!se_tpg) { + transport_free_session(se_sess); + return; + } +- se_tfo = se_tpg->se_tpg_tfo; + + spin_lock_irqsave(&se_tpg->session_lock, flags); + list_del(&se_sess->sess_list); +@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess) + se_sess->fabric_sess_ptr = NULL; + spin_unlock_irqrestore(&se_tpg->session_lock, flags); + +- /* +- * Determine if we need to do extra work for this initiator node's +- * struct se_node_acl if it had been previously dynamically generated. +- */ +- se_nacl = se_sess->se_node_acl; +- +- mutex_lock(&se_tpg->acl_node_mutex); +- if (se_nacl && se_nacl->dynamic_node_acl) { +- if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) { +- list_del(&se_nacl->acl_list); +- drop_nacl = true; +- } +- } +- mutex_unlock(&se_tpg->acl_node_mutex); +- +- if (drop_nacl) { +- core_tpg_wait_for_nacl_pr_ref(se_nacl); +- core_free_device_list_for_node(se_nacl, se_tpg); +- se_sess->se_node_acl = NULL; +- kfree(se_nacl); +- } + pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", + se_tpg->se_tpg_tfo->get_fabric_name()); + /* + * If last kref is dropping now for an explicit NodeACL, awake sleeping + * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group + * removal context from within transport_free_session() code. ++ * ++ * For dynamic ACL, target_put_nacl() uses target_complete_nacl() ++ * to release all remaining generate_node_acl=1 created ACL resources. + */ + + transport_free_session(se_sess); +@@ -3086,7 +3103,6 @@ static void target_tmr_work(struct work_struct *work) + spin_unlock_irqrestore(&cmd->t_state_lock, flags); + goto check_stop; + } +- cmd->t_state = TRANSPORT_ISTATE_PROCESSING; + spin_unlock_irqrestore(&cmd->t_state_lock, flags); + + cmd->se_tfo->queue_tm_rsp(cmd); +@@ -3099,11 +3115,25 @@ int transport_generic_handle_tmr( + struct se_cmd *cmd) + { + unsigned long flags; ++ bool aborted = false; + + spin_lock_irqsave(&cmd->t_state_lock, flags); +- cmd->transport_state |= CMD_T_ACTIVE; ++ if (cmd->transport_state & CMD_T_ABORTED) { ++ aborted = true; ++ } else { ++ cmd->t_state = TRANSPORT_ISTATE_PROCESSING; ++ cmd->transport_state |= CMD_T_ACTIVE; ++ } + spin_unlock_irqrestore(&cmd->t_state_lock, flags); + ++ if (aborted) { ++ pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d" ++ "ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function, ++ cmd->se_tmr_req->ref_task_tag, cmd->tag); ++ transport_cmd_check_stop_to_fabric(cmd); ++ return 0; ++ } ++ + INIT_WORK(&cmd->work, target_tmr_work); + queue_work(cmd->se_dev->tmr_wq, &cmd->work); + return 0; +diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c +index 094a144..18848ba 100644 +--- a/drivers/target/target_core_xcopy.c ++++ b/drivers/target/target_core_xcopy.c +@@ -836,7 +836,7 @@ static void target_xcopy_do_work(struct work_struct *work) + " CHECK_CONDITION -> sending response\n", rc); + ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION; + } +- target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION); ++ target_complete_cmd(ec_cmd, ec_cmd->scsi_status); + } + + sense_reason_t target_do_xcopy(struct se_cmd *se_cmd) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 7acbd2c..1782804 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -5648,6 +5648,10 @@ long btrfs_ioctl(struct file *file, unsigned int + #ifdef CONFIG_COMPAT + long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + { ++ /* ++ * These all access 32-bit values anyway so no further ++ * handling is necessary. ++ */ + switch (cmd) { + case FS_IOC32_GETFLAGS: + cmd = FS_IOC_GETFLAGS; +@@ -5658,8 +5662,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + case FS_IOC32_GETVERSION: + cmd = FS_IOC_GETVERSION; + break; +- default: +- return -ENOIOCTLCMD; + } + + return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg)); +diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h +index da7fbf1..fa3b155 100644 +--- a/include/linux/cpumask.h ++++ b/include/linux/cpumask.h +@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp, + static inline int cpumask_parse_user(const char __user *buf, int len, + struct cpumask *dstp) + { +- return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids); ++ return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits); + } + + /** +@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len, + struct cpumask *dstp) + { + return bitmap_parselist_user(buf, len, cpumask_bits(dstp), +- nr_cpu_ids); ++ nr_cpumask_bits); + } + + /** +@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp) + char *nl = strchr(buf, '\n'); + unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf); + +- return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids); ++ return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits); + } + + /** +@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp) + */ + static inline int cpulist_parse(const char *buf, struct cpumask *dstp) + { +- return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids); ++ return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits); + } + + /** +diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h +index cd184bd..c92a083 100644 +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -128,6 +128,7 @@ struct hv_ring_buffer_info { + u32 ring_data_startoffset; + u32 priv_write_index; + u32 priv_read_index; ++ u32 cached_read_index; + }; + + /* +@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi) + return write; + } + ++static inline u32 hv_get_cached_bytes_to_write( ++ const struct hv_ring_buffer_info *rbi) ++{ ++ u32 read_loc, write_loc, dsize, write; ++ ++ dsize = rbi->ring_datasize; ++ read_loc = rbi->cached_read_index; ++ write_loc = rbi->ring_buffer->write_index; ++ ++ write = write_loc >= read_loc ? dsize - (write_loc - read_loc) : ++ read_loc - write_loc; ++ return write; ++} + /* + * VMBUS version is 32 bit entity broken up into + * two 16 bit quantities: major_number. minor_number. +@@ -1447,6 +1461,7 @@ void hv_event_tasklet_enable(struct vmbus_channel *channel); + + void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid); + ++void vmbus_setevent(struct vmbus_channel *channel); + /* + * Negotiated version with the Host. + */ +@@ -1479,10 +1494,11 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info) + * there is room for the producer to send the pending packet. + */ + +-static inline bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi) ++static inline void hv_signal_on_read(struct vmbus_channel *channel) + { +- u32 cur_write_sz; ++ u32 cur_write_sz, cached_write_sz; + u32 pending_sz; ++ struct hv_ring_buffer_info *rbi = &channel->inbound; + + /* + * Issue a full memory barrier before making the signaling decision. +@@ -1500,14 +1516,26 @@ static inline bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi) + pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz); + /* If the other end is not blocked on write don't bother. */ + if (pending_sz == 0) +- return false; ++ return; + + cur_write_sz = hv_get_bytes_to_write(rbi); + +- if (cur_write_sz >= pending_sz) +- return true; ++ if (cur_write_sz < pending_sz) ++ return; ++ ++ cached_write_sz = hv_get_cached_bytes_to_write(rbi); ++ if (cached_write_sz < pending_sz) ++ vmbus_setevent(channel); ++ ++ return; ++} ++ ++static inline void ++init_cached_read_index(struct vmbus_channel *channel) ++{ ++ struct hv_ring_buffer_info *rbi = &channel->inbound; + +- return false; ++ rbi->cached_read_index = rbi->ring_buffer->read_index; + } + + /* +@@ -1571,6 +1599,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel, + * This call commits the read index and potentially signals the host. + * Here is the pattern for using the "in-place" consumption APIs: + * ++ * init_cached_read_index(); ++ * + * while (get_next_pkt_raw() { + * process the packet "in-place"; + * put_pkt_raw(); +@@ -1589,8 +1619,7 @@ static inline void commit_rd_index(struct vmbus_channel *channel) + virt_rmb(); + ring_info->ring_buffer->read_index = ring_info->priv_read_index; + +- if (hv_need_to_signal_on_read(ring_info)) +- vmbus_set_event(channel); ++ hv_signal_on_read(channel); + } + + +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index c211900..48bc1ac 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -538,6 +538,7 @@ struct se_node_acl { + char initiatorname[TRANSPORT_IQN_LEN]; + /* Used to signal demo mode created ACL, disabled by default */ + bool dynamic_node_acl; ++ bool dynamic_stop; + u32 queue_depth; + u32 acl_index; + enum target_prot_type saved_prot_type; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index b1cfd74..4b33231 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3461,14 +3461,15 @@ struct perf_read_data { + int ret; + }; + +-static int find_cpu_to_read(struct perf_event *event, int local_cpu) ++static int __perf_event_read_cpu(struct perf_event *event, int event_cpu) + { +- int event_cpu = event->oncpu; + u16 local_pkg, event_pkg; + + if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) { +- event_pkg = topology_physical_package_id(event_cpu); +- local_pkg = topology_physical_package_id(local_cpu); ++ int local_cpu = smp_processor_id(); ++ ++ event_pkg = topology_physical_package_id(event_cpu); ++ local_pkg = topology_physical_package_id(local_cpu); + + if (event_pkg == local_pkg) + return local_cpu; +@@ -3598,7 +3599,7 @@ u64 perf_event_read_local(struct perf_event *event) + + static int perf_event_read(struct perf_event *event, bool group) + { +- int ret = 0, cpu_to_read, local_cpu; ++ int event_cpu, ret = 0; + + /* + * If event is enabled and currently active on a CPU, update the +@@ -3611,21 +3612,25 @@ static int perf_event_read(struct perf_event *event, bool group) + .ret = 0, + }; + +- local_cpu = get_cpu(); +- cpu_to_read = find_cpu_to_read(event, local_cpu); +- put_cpu(); ++ event_cpu = READ_ONCE(event->oncpu); ++ if ((unsigned)event_cpu >= nr_cpu_ids) ++ return 0; ++ ++ preempt_disable(); ++ event_cpu = __perf_event_read_cpu(event, event_cpu); + + /* + * Purposely ignore the smp_call_function_single() return + * value. + * +- * If event->oncpu isn't a valid CPU it means the event got ++ * If event_cpu isn't a valid CPU it means the event got + * scheduled out and that will have updated the event count. + * + * Therefore, either way, we'll have an up-to-date event count + * after this. + */ +- (void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1); ++ (void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1); ++ preempt_enable(); + ret = data.ret; + } else if (event->state == PERF_EVENT_STATE_INACTIVE) { + struct perf_event_context *ctx = event->ctx; +diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c +index b6e4c16..9c15a91 100644 +--- a/kernel/stacktrace.c ++++ b/kernel/stacktrace.c +@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces) + if (WARN_ON(!trace->entries)) + return; + +- for (i = 0; i < trace->nr_entries; i++) { +- printk("%*c", 1 + spaces, ' '); +- print_ip_sym(trace->entries[i]); +- } ++ for (i = 0; i < trace->nr_entries; i++) ++ printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]); + } + EXPORT_SYMBOL_GPL(print_stack_trace); + +@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size, + struct stack_trace *trace, int spaces) + { + int i; +- unsigned long ip; + int generated; + int total = 0; + +@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size, + return 0; + + for (i = 0; i < trace->nr_entries; i++) { +- ip = trace->entries[i]; +- generated = snprintf(buf, size, "%*c[<%p>] %pS\n", +- 1 + spaces, ' ', (void *) ip, (void *) ip); ++ generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ', ++ (void *)trace->entries[i]); + + total += generated; + +diff --git a/mm/slub.c b/mm/slub.c +index 2b3e740..7aa0e97 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1419,6 +1419,10 @@ static int init_cache_random_seq(struct kmem_cache *s) + int err; + unsigned long i, count = oo_objects(s->oo); + ++ /* Bailout if already initialised */ ++ if (s->random_seq) ++ return 0; ++ + err = cache_random_seq_create(s, count, GFP_KERNEL); + if (err) { + pr_err("SLUB: Unable to initialize free list for %s\n", +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 42120d9..50e1b7f 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata, + /* fast-forward to vendor IEs */ + offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0); + +- if (offset) { ++ if (offset < ifmsh->ie_len) { + len = ifmsh->ie_len - offset; + data = ifmsh->ie + offset; + if (skb_tailroom(skb) < len) +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 1b3c18c..cd7a419 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -5874,6 +5874,7 @@ do { \ + break; + } + cfg->ht_opmode = ht_opmode; ++ mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); + } + FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout, + 1, 65535, mask, +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 09fd610..c2da45a 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5858,7 +5858,7 @@ static int selinux_setprocattr(struct task_struct *p, + return error; + + /* Obtain a SID for the context, if one was specified. */ +- if (size && str[1] && str[1] != '\n') { ++ if (size && str[0] && str[0] != '\n') { + if (str[size-1] == '\n') { + str[size-1] = 0; + size--; +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index c850345..dfa5156 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) + { + unsigned long flags; + struct snd_seq_event_cell *ptr; +- int max_count = 5 * HZ; + + if (snd_BUG_ON(!pool)) + return -EINVAL; +@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) + if (waitqueue_active(&pool->output_sleep)) + wake_up(&pool->output_sleep); + +- while (atomic_read(&pool->counter) > 0) { +- if (max_count == 0) { +- pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter)); +- break; +- } ++ while (atomic_read(&pool->counter) > 0) + schedule_timeout_uninterruptible(1); +- max_count--; +- } + + /* release all resources */ + spin_lock_irqsave(&pool->lock, flags); +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 0bec02e..450c518 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void) + } + } + ++static void queue_use(struct snd_seq_queue *queue, int client, int use); ++ + /* allocate a new queue - + * return queue index value or negative value for error + */ +@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags) + if (q == NULL) + return -ENOMEM; + q->info_flags = info_flags; ++ queue_use(q, client, 1); + if (queue_list_add(q) < 0) { + queue_delete(q); + return -ENOMEM; + } +- snd_seq_queue_use(q->queue, client, 1); /* use this queue */ + return q->queue; + } + +@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client, + return result; + } + +- +-/* use or unuse this queue - +- * if it is the first client, starts the timer. +- * if it is not longer used by any clients, stop the timer. +- */ +-int snd_seq_queue_use(int queueid, int client, int use) ++/* use or unuse this queue */ ++static void queue_use(struct snd_seq_queue *queue, int client, int use) + { +- struct snd_seq_queue *queue; +- +- queue = queueptr(queueid); +- if (queue == NULL) +- return -EINVAL; +- mutex_lock(&queue->timer_mutex); + if (use) { + if (!test_and_set_bit(client, queue->clients_bitmap)) + queue->clients++; +@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use) + } else { + snd_seq_timer_close(queue); + } ++} ++ ++/* use or unuse this queue - ++ * if it is the first client, starts the timer. ++ * if it is not longer used by any clients, stop the timer. ++ */ ++int snd_seq_queue_use(int queueid, int client, int use) ++{ ++ struct snd_seq_queue *queue; ++ ++ queue = queueptr(queueid); ++ if (queue == NULL) ++ return -EINVAL; ++ mutex_lock(&queue->timer_mutex); ++ queue_use(queue, client, use); + mutex_unlock(&queue->timer_mutex); + queuefree(queue); + return 0; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 56e5204..4bf4833 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -3638,6 +3638,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index 90009c0..ab3c280 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface, + goto error; + } + ++ line6_get_interval(line6); ++ + if (properties->capabilities & LINE6_CAP_CONTROL) { +- line6_get_interval(line6); + ret = line6_init_cap_control(line6); + if (ret < 0) + goto error; +diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c +index 9ff0db4..933aeec 100644 +--- a/tools/perf/builtin-diff.c ++++ b/tools/perf/builtin-diff.c +@@ -1199,7 +1199,7 @@ static int ui_init(void) + BUG_ON(1); + } + +- perf_hpp__register_sort_field(fmt); ++ perf_hpp__prepend_sort_field(fmt); + return 0; + } + +diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c +index 3738839..18cfcdc9 100644 +--- a/tools/perf/ui/hist.c ++++ b/tools/perf/ui/hist.c +@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list, + list_add_tail(&format->sort_list, &list->sorts); + } + ++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list, ++ struct perf_hpp_fmt *format) ++{ ++ list_add(&format->sort_list, &list->sorts); ++} ++ + void perf_hpp__column_unregister(struct perf_hpp_fmt *format) + { + list_del(&format->list); +@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list) + perf_hpp_list__for_each_sort_list(list, fmt) { + struct perf_hpp_fmt *pos; + ++ /* skip sort-only fields ("sort_compute" in perf diff) */ ++ if (!fmt->entry && !fmt->color) ++ continue; ++ + perf_hpp_list__for_each_format(list, pos) { + if (fmt_equal(fmt, pos)) + goto next; +diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h +index 9928fed..a440a04 100644 +--- a/tools/perf/util/hist.h ++++ b/tools/perf/util/hist.h +@@ -282,6 +282,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list, + struct perf_hpp_fmt *format); + void perf_hpp_list__register_sort_field(struct perf_hpp_list *list, + struct perf_hpp_fmt *format); ++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list, ++ struct perf_hpp_fmt *format); + + static inline void perf_hpp__column_register(struct perf_hpp_fmt *format) + { +@@ -293,6 +295,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format) + perf_hpp_list__register_sort_field(&perf_hpp_list, format); + } + ++static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format) ++{ ++ perf_hpp_list__prepend_sort_field(&perf_hpp_list, format); ++} ++ + #define perf_hpp_list__for_each_format(_list, format) \ + list_for_each_entry(format, &(_list)->fields, list) + diff --git a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch index 32e3834..ef4d7f3 100644 --- a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch +++ b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch @@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644 cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags) diff --git a/Makefile b/Makefile -index c0c41c9..630adc4 100644 +index d2fe757..92fd198 100644 --- a/Makefile +++ b/Makefile @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3161,7 +3161,7 @@ index 91d2d5b..042c26e 100644 } #endif diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c -index ce131ed..26f9765 100644 +index ae738a6..ee4d46f 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c @@ -928,10 +928,19 @@ static void tracehook_report_syscall(struct pt_regs *regs, @@ -3938,7 +3938,7 @@ index c8c8b9e..c55cc79 100644 atomic64_set(&mm->context.id, asid); } diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index 3a2e678..ebdbf80 100644 +index 0122ad1..1aae1cb 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -25,6 +25,7 @@ @@ -4172,7 +4172,7 @@ index 3a2e678..ebdbf80 100644 inf->name, ifsr, addr); diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h -index 67532f2..10b646e 100644 +index afc1f84..b1daab5 100644 --- a/arch/arm/mm/fault.h +++ b/arch/arm/mm/fault.h @@ -3,6 +3,7 @@ @@ -4183,7 +4183,7 @@ index 67532f2..10b646e 100644 */ #define FSR_LNX_PF (1 << 31) #define FSR_WRITE (1 << 11) -@@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr) +@@ -26,6 +27,17 @@ static inline int fsr_fs(unsigned int fsr) } #endif @@ -9234,7 +9234,7 @@ index 4ba26dd..2d1137d 100644 #define PAGE_KERNEL_RO __pgprot(_PAGE_BASE | _PAGE_KERNEL_RO) #define PAGE_KERNEL_ROX __pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX) diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index 9e1499f..4e03a24 100644 +index 13f5fad..6ec27c3 100644 --- a/arch/powerpc/include/asm/reg.h +++ b/arch/powerpc/include/asm/reg.h @@ -270,6 +270,7 @@ @@ -26426,10 +26426,10 @@ index 17f2186..f394307 100644 /* diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 984a7bf..c3e410d 100644 +index 83db0ea..137bc2c 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h -@@ -135,7 +135,7 @@ struct cpuinfo_x86 { +@@ -136,7 +136,7 @@ struct cpuinfo_x86 { /* Index into per_cpu list: */ u16 cpu_index; u32 microcode; @@ -26438,7 +26438,7 @@ index 984a7bf..c3e410d 100644 #define X86_VENDOR_INTEL 0 #define X86_VENDOR_CYRIX 1 -@@ -159,7 +159,7 @@ extern __u32 cpu_caps_cleared[NCAPINTS]; +@@ -160,7 +160,7 @@ extern __u32 cpu_caps_cleared[NCAPINTS]; extern __u32 cpu_caps_set[NCAPINTS]; #ifdef CONFIG_SMP @@ -26447,7 +26447,7 @@ index 984a7bf..c3e410d 100644 #define cpu_data(cpu) per_cpu(cpu_info, cpu) #else #define cpu_info boot_cpu_data -@@ -205,9 +205,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx, +@@ -206,9 +206,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx, : "memory"); } @@ -26470,7 +26470,7 @@ index 984a7bf..c3e410d 100644 } #ifdef CONFIG_X86_32 -@@ -307,11 +319,9 @@ struct tss_struct { +@@ -308,11 +320,9 @@ struct tss_struct { } ____cacheline_aligned; @@ -26483,7 +26483,7 @@ index 984a7bf..c3e410d 100644 /* * Save the original ist values for checking stack pointers during debugging -@@ -340,6 +350,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible; +@@ -341,6 +351,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible; DECLARE_INIT_PER_CPU(irq_stack_union); DECLARE_PER_CPU(char *, irq_stack_ptr); @@ -26491,7 +26491,7 @@ index 984a7bf..c3e410d 100644 DECLARE_PER_CPU(unsigned int, irq_count); extern asmlinkage void ignore_sysret(void); #else /* X86_64 */ -@@ -388,6 +399,7 @@ struct thread_struct { +@@ -389,6 +400,7 @@ struct thread_struct { unsigned short ds; unsigned short fsindex; unsigned short gsindex; @@ -26499,7 +26499,7 @@ index 984a7bf..c3e410d 100644 #endif u32 status; /* thread synchronous flags */ -@@ -404,6 +416,9 @@ struct thread_struct { +@@ -405,6 +417,9 @@ struct thread_struct { unsigned long gs; #endif @@ -26509,7 +26509,7 @@ index 984a7bf..c3e410d 100644 /* Save middle states of ptrace breakpoints */ struct perf_event *ptrace_bps[HBP_NUM]; /* Debug status used for traps, single steps, etc... */ -@@ -425,17 +440,11 @@ struct thread_struct { +@@ -426,17 +441,11 @@ struct thread_struct { unsigned io_bitmap_max; mm_segment_t addr_limit; @@ -26529,7 +26529,7 @@ index 984a7bf..c3e410d 100644 /* * Thread-synchronous status. -@@ -487,12 +496,8 @@ static inline void native_swapgs(void) +@@ -488,12 +497,8 @@ static inline void native_swapgs(void) static inline unsigned long current_top_of_stack(void) { @@ -26542,7 +26542,7 @@ index 984a7bf..c3e410d 100644 } #ifdef CONFIG_PARAVIRT -@@ -717,20 +722,30 @@ static inline void spin_lock_prefetch(const void *x) +@@ -718,20 +723,30 @@ static inline void spin_lock_prefetch(const void *x) #define TOP_OF_INIT_STACK ((unsigned long)&init_stack + sizeof(init_stack) - \ TOP_OF_KERNEL_STACK_PADDING) @@ -26574,7 +26574,7 @@ index 984a7bf..c3e410d 100644 } /* -@@ -743,12 +758,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -744,12 +759,7 @@ static inline void spin_lock_prefetch(const void *x) * "struct pt_regs" is possible, but they may contain the * completely wrong values. */ @@ -26588,7 +26588,7 @@ index 984a7bf..c3e410d 100644 #define KSTK_ESP(task) (task_pt_regs(task)->sp) -@@ -762,13 +772,13 @@ static inline void spin_lock_prefetch(const void *x) +@@ -763,13 +773,13 @@ static inline void spin_lock_prefetch(const void *x) * particular problem by preventing anything from being mapped * at the maximum canonical address. */ @@ -26604,7 +26604,7 @@ index 984a7bf..c3e410d 100644 #define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \ IA32_PAGE_OFFSET : TASK_SIZE_MAX) -@@ -781,6 +791,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -782,6 +792,7 @@ static inline void spin_lock_prefetch(const void *x) #define INIT_THREAD { \ .sp0 = TOP_OF_INIT_STACK, \ .addr_limit = KERNEL_DS, \ @@ -26612,7 +26612,7 @@ index 984a7bf..c3e410d 100644 } #define task_pt_regs(tsk) ((struct pt_regs *)(tsk)->thread.sp0 - 1) -@@ -799,6 +810,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, +@@ -800,6 +811,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, */ #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3)) @@ -26623,7 +26623,7 @@ index 984a7bf..c3e410d 100644 #define KSTK_EIP(task) (task_pt_regs(task)->ip) /* Get/set a process' ability to use the timestamp counter instruction */ -@@ -844,7 +859,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves) +@@ -845,7 +860,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves) return 0; } @@ -26632,7 +26632,7 @@ index 984a7bf..c3e410d 100644 extern void free_init_pages(char *what, unsigned long begin, unsigned long end); void default_idle(void); -@@ -854,6 +869,6 @@ bool xen_set_default_idle(void); +@@ -855,6 +870,6 @@ bool xen_set_default_idle(void); #define xen_set_default_idle 0 #endif @@ -29131,7 +29131,7 @@ index f223491..9083344 100644 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x", smp_processor_id(), v); diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 7249f15..8e941bd 100644 +index d1e2556..2f6454d 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -1683,7 +1683,7 @@ static unsigned int startup_ioapic_irq(struct irq_data *data) @@ -29161,7 +29161,7 @@ index 7249f15..8e941bd 100644 .name = "IO-APIC", .irq_startup = startup_ioapic_irq, .irq_mask = mask_ioapic_irq, -@@ -1880,7 +1880,7 @@ static struct irq_chip ioapic_chip __read_mostly = { +@@ -1879,7 +1879,7 @@ static struct irq_chip ioapic_chip __read_mostly = { .flags = IRQCHIP_SKIP_SET_WAKE, }; @@ -29170,7 +29170,7 @@ index 7249f15..8e941bd 100644 .name = "IR-IO-APIC", .irq_startup = startup_ioapic_irq, .irq_mask = mask_ioapic_irq, -@@ -1939,7 +1939,7 @@ static void ack_lapic_irq(struct irq_data *data) +@@ -1937,7 +1937,7 @@ static void ack_lapic_irq(struct irq_data *data) ack_APIC_irq(); } @@ -29377,10 +29377,10 @@ index 4a8697f..8a13428 100644 obj-y += common.o obj-y += rdrand.o diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 1d31672..542cba3 100644 +index 2b4cf04..c73b25e 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c -@@ -794,7 +794,7 @@ static void init_amd(struct cpuinfo_x86 *c) +@@ -808,7 +808,7 @@ static void init_amd(struct cpuinfo_x86 *c) static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size) { /* AMD errata T13 (order #21922) */ @@ -29410,7 +29410,7 @@ index a972ac4..938c163 100644 /* diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 023c7bf..1ce29b3 100644 +index 4eece91..9eeb03b 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -93,60 +93,6 @@ static const struct cpu_dev default_cpu = { @@ -29616,7 +29616,7 @@ index 023c7bf..1ce29b3 100644 } } -@@ -1063,6 +1118,20 @@ static void identify_cpu(struct cpuinfo_x86 *c) +@@ -1064,6 +1119,20 @@ static void identify_cpu(struct cpuinfo_x86 *c) setup_smep(c); setup_smap(c); @@ -29637,7 +29637,7 @@ index 023c7bf..1ce29b3 100644 /* * The vendor-specific functions might have changed features. * Now we do "generic changes." -@@ -1108,10 +1177,14 @@ static void identify_cpu(struct cpuinfo_x86 *c) +@@ -1109,10 +1178,14 @@ static void identify_cpu(struct cpuinfo_x86 *c) * executed, c == &boot_cpu_data. */ if (c != &boot_cpu_data) { @@ -29652,7 +29652,7 @@ index 023c7bf..1ce29b3 100644 /* OR, i.e. replicate the bug flags */ for (i = NCAPINTS; i < NCAPINTS + NBUGINTS; i++) c->x86_capability[i] |= boot_cpu_data.x86_capability[i]; -@@ -1141,7 +1214,7 @@ void enable_sep_cpu(void) +@@ -1142,7 +1215,7 @@ void enable_sep_cpu(void) return; cpu = get_cpu(); @@ -29661,7 +29661,7 @@ index 023c7bf..1ce29b3 100644 /* * We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field -- -@@ -1307,6 +1380,8 @@ EXPORT_PER_CPU_SYMBOL(current_task); +@@ -1308,6 +1381,8 @@ EXPORT_PER_CPU_SYMBOL(current_task); DEFINE_PER_CPU(char *, irq_stack_ptr) = init_per_cpu_var(irq_stack_union.irq_stack) + IRQ_STACK_SIZE; @@ -29670,7 +29670,7 @@ index 023c7bf..1ce29b3 100644 DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1; -@@ -1399,21 +1474,21 @@ EXPORT_PER_CPU_SYMBOL(current_task); +@@ -1400,21 +1475,21 @@ EXPORT_PER_CPU_SYMBOL(current_task); DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT; EXPORT_PER_CPU_SYMBOL(__preempt_count); @@ -29699,7 +29699,7 @@ index 023c7bf..1ce29b3 100644 /* * Clear all 6 debug registers: */ -@@ -1489,7 +1564,7 @@ void cpu_init(void) +@@ -1490,7 +1565,7 @@ void cpu_init(void) */ load_ucode_ap(); @@ -29708,7 +29708,7 @@ index 023c7bf..1ce29b3 100644 oist = &per_cpu(orig_ist, cpu); #ifdef CONFIG_NUMA -@@ -1521,7 +1596,6 @@ void cpu_init(void) +@@ -1522,7 +1597,6 @@ void cpu_init(void) wrmsrl(MSR_KERNEL_GS_BASE, 0); barrier(); @@ -29716,7 +29716,7 @@ index 023c7bf..1ce29b3 100644 x2apic_setup(); /* -@@ -1573,7 +1647,7 @@ void cpu_init(void) +@@ -1574,7 +1648,7 @@ void cpu_init(void) { int cpu = smp_processor_id(); struct task_struct *curr = current; @@ -34538,7 +34538,7 @@ index c00cb64..73f6b30 100644 .smp_prepare_cpus = native_smp_prepare_cpus, .smp_cpus_done = native_smp_cpus_done, diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index e9bbe02..aaaed9d 100644 +index 36171bc..e32a454 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -94,7 +94,7 @@ EXPORT_PER_CPU_SYMBOL(cpu_core_map); @@ -34572,7 +34572,7 @@ index e9bbe02..aaaed9d 100644 /* * Check TSC synchronization with the BP: */ -@@ -925,13 +928,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle) +@@ -931,13 +934,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle) per_cpu(current_task, cpu) = idle; #ifdef CONFIG_X86_32 @@ -34587,7 +34587,7 @@ index e9bbe02..aaaed9d 100644 } /* -@@ -952,9 +953,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle) +@@ -958,9 +959,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle) unsigned long timeout; idle->thread.sp = (unsigned long) (((struct pt_regs *) @@ -34600,7 +34600,7 @@ index e9bbe02..aaaed9d 100644 initial_code = (unsigned long)start_secondary; initial_stack = idle->thread.sp; -@@ -1102,6 +1105,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle) +@@ -1108,6 +1111,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle) common_cpu_up(cpu, tidle); @@ -37310,10 +37310,18 @@ index 9b33024..cdbc725 100644 ENDPROC(this_cpu_cmpxchg16b_emu) diff --git a/arch/x86/lib/cmpxchg8b_emu.S b/arch/x86/lib/cmpxchg8b_emu.S -index 03a186f..34c859b 100644 +index 03a186f..6793bf2 100644 --- a/arch/x86/lib/cmpxchg8b_emu.S +++ b/arch/x86/lib/cmpxchg8b_emu.S -@@ -38,7 +38,7 @@ ENTRY(cmpxchg8b_emu) +@@ -8,6 +8,7 @@ + + #include <linux/linkage.h> + #include <asm/export.h> ++#include <asm/alternative-asm.h> + + .text + +@@ -38,7 +39,7 @@ ENTRY(cmpxchg8b_emu) movl %ecx, 4(%esi) popfl @@ -37322,7 +37330,7 @@ index 03a186f..34c859b 100644 .Lnot_same: movl (%esi), %eax -@@ -46,7 +46,7 @@ ENTRY(cmpxchg8b_emu) +@@ -46,7 +47,7 @@ ENTRY(cmpxchg8b_emu) movl 4(%esi), %edx popfl @@ -40044,10 +40052,10 @@ index 96d2b84..b3db380 100644 +CFLAGS_uderef_64.o := -fcall-saved-rax -fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11 + diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c -index ea9c49a..7ab033a 100644 +index 8aa6bea..1181e44 100644 --- a/arch/x86/mm/dump_pagetables.c +++ b/arch/x86/mm/dump_pagetables.c -@@ -27,6 +27,7 @@ +@@ -28,6 +28,7 @@ struct pg_state { int level; pgprot_t current_prot; @@ -40055,7 +40063,7 @@ index ea9c49a..7ab033a 100644 unsigned long start_address; unsigned long current_address; const struct addr_marker *marker; -@@ -184,6 +185,23 @@ static unsigned long normalize_addr(unsigned long u) +@@ -185,6 +186,23 @@ static unsigned long normalize_addr(unsigned long u) #endif } @@ -40079,7 +40087,7 @@ index ea9c49a..7ab033a 100644 /* * This function gets called on a break in a continuous series * of PTE entries; the next one is different so we need to -@@ -200,11 +218,13 @@ static void note_page(struct seq_file *m, struct pg_state *st, +@@ -201,11 +219,13 @@ static void note_page(struct seq_file *m, struct pg_state *st, * we have now. "break" is either changing perms, levels or * address space marker. */ @@ -40093,7 +40101,7 @@ index ea9c49a..7ab033a 100644 st->current_prot = new_prot; st->level = level; st->marker = address_markers; -@@ -216,9 +236,8 @@ static void note_page(struct seq_file *m, struct pg_state *st, +@@ -217,9 +237,8 @@ static void note_page(struct seq_file *m, struct pg_state *st, const char *unit = units; unsigned long delta; int width = sizeof(unsigned long) * 2; @@ -40104,7 +40112,7 @@ index ea9c49a..7ab033a 100644 WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %p/%pS\n", (void *)st->start_address, -@@ -304,9 +323,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, +@@ -305,9 +324,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, start = (pmd_t *) pud_page_vaddr(addr); for (i = 0; i < PTRS_PER_PMD; i++) { st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT); @@ -40116,7 +40124,7 @@ index ea9c49a..7ab033a 100644 note_page(m, st, __pgprot(prot), 3); } else { walk_pte_level(m, st, *start, -@@ -337,9 +357,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr, +@@ -338,9 +358,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr, for (i = 0; i < PTRS_PER_PUD; i++) { st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT); @@ -40128,7 +40136,7 @@ index ea9c49a..7ab033a 100644 note_page(m, st, __pgprot(prot), 2); } else { walk_pmd_level(m, st, *start, -@@ -395,9 +416,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd, +@@ -396,9 +417,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd, for (i = 0; i < PTRS_PER_PGD; i++) { st.current_address = normalize_addr(i * PGD_LEVEL_MULT); @@ -49938,7 +49946,7 @@ index 3a1f49f..42a478e 100644 } EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler); diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 4737520..4cafa68 100644 +index 80fa656..fe055932 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -283,13 +283,13 @@ struct pstate_funcs { @@ -50018,7 +50026,7 @@ index 4737520..4cafa68 100644 const char *buf, size_t count) { unsigned int input; -@@ -1154,7 +1154,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate) +@@ -1173,7 +1173,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate) * right CPU. */ wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL, @@ -50027,7 +50035,7 @@ index 4737520..4cafa68 100644 } static void intel_pstate_set_min_pstate(struct cpudata *cpu) -@@ -1173,14 +1173,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu) +@@ -1192,14 +1192,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu) static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) { @@ -50049,7 +50057,7 @@ index 4737520..4cafa68 100644 intel_pstate_set_min_pstate(cpu); } -@@ -1329,7 +1329,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate) +@@ -1348,7 +1348,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate) return; cpu->pstate.current_pstate = pstate; @@ -50058,7 +50066,7 @@ index 4737520..4cafa68 100644 } static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) -@@ -1340,7 +1340,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) +@@ -1359,7 +1359,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) from = cpu->pstate.current_pstate; target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ? @@ -50067,7 +50075,7 @@ index 4737520..4cafa68 100644 intel_pstate_update_pstate(cpu, target_pstate); -@@ -1653,15 +1653,15 @@ static unsigned int force_load __initdata; +@@ -1683,15 +1683,15 @@ static unsigned int force_load __initdata; static int __init intel_pstate_msrs_not_valid(void) { @@ -50087,7 +50095,7 @@ index 4737520..4cafa68 100644 { pid_params.sample_rate_ms = policy->sample_rate_ms; pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC; -@@ -1674,15 +1674,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy) +@@ -1704,15 +1704,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy) static void __init copy_cpu_funcs(struct pstate_funcs *funcs) { @@ -52837,7 +52845,7 @@ index 670beeb..642dcef 100644 * deal with them for Intel hardware. */ diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index a218c2e..c834d0b 100644 +index 0c400f8..4f2bba6 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -1187,12 +1187,12 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec) @@ -53057,7 +53065,7 @@ index 3fc286c..4c19f25 100644 /** diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 8079e5b..70051e8 100644 +index b9be8a6..05d5f12 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -16133,13 +16133,13 @@ struct intel_quirk { @@ -55316,10 +55324,10 @@ index c13fb5b..55a3802 100644 *off += size; diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 16f91c8..a45059b 100644 +index 5fb4c6d..29316a6 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c -@@ -397,7 +397,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, +@@ -398,7 +398,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, int ret = 0; next_gpadl_handle = @@ -55328,7 +55336,7 @@ index 16f91c8..a45059b 100644 ret = create_gpadl_header(kbuffer, size, &msginfo); if (ret) -@@ -742,9 +742,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel, +@@ -715,9 +715,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel, * Adjust the size down since vmbus_channel_packet_page_buffer is the * largest size we support */ @@ -55496,7 +55504,7 @@ index fdf8da9..d3fefc5 100644 cap_msg.caps.cap_bits.balloon = 1; cap_msg.caps.cap_bits.hot_add = 1; diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index a5b4442..b3b5e3e 100644 +index 2b13f2a..e150466 100644 --- a/drivers/hv/hyperv_vmbus.h +++ b/drivers/hv/hyperv_vmbus.h @@ -567,7 +567,7 @@ enum vmbus_connect_state { @@ -74069,6 +74077,19 @@ index 2478ccd..1194b50 100644 mwifiex_shutdown_sw(adapter, adapter->card_sem); } } +diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c +index 18fbb96..db73632 100644 +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -751,7 +751,7 @@ void mwifiex_hist_data_reset(struct mwifiex_private *priv) + void *mwifiex_alloc_dma_align_buf(int rx_len, gfp_t flags) + { + struct sk_buff *skb; +- int buf_len, pad; ++ long buf_len, pad; + + buf_len = rx_len + MWIFIEX_RX_HEADROOM + MWIFIEX_DMA_ALIGN_SZ; + diff --git a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c index 155f343..5db43e7 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c @@ -74920,7 +74941,7 @@ index 74dc2bf..e942c3b 100644 struct xenvif *vif = netdev_priv(dev); struct xenvif_queue *queue = NULL; diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index bf2744e..c8b5fd0 100644 +index 0cdcb21..72354a5 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -550,7 +550,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb, @@ -79178,10 +79199,10 @@ index a1a5ceb..8e83e34 100644 int ret = param_set_int(val, kp); struct MPT3SAS_ADAPTER *ioc; diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index f84a608..b6e984c 100644 +index 8a7941b..eb919a5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -280,7 +280,7 @@ struct _scsi_io_transfer { +@@ -281,7 +281,7 @@ struct _scsi_io_transfer { * Note: The logging levels are defined in mpt3sas_debug.h. */ static int @@ -79190,7 +79211,7 @@ index f84a608..b6e984c 100644 { int ret = param_set_int(val, kp); struct MPT3SAS_ADAPTER *ioc; -@@ -8952,7 +8952,7 @@ scsih_resume(struct pci_dev *pdev) +@@ -8955,7 +8955,7 @@ scsih_resume(struct pci_dev *pdev) * PCI_ERS_RESULT_NEED_RESET or PCI_ERS_RESULT_DISCONNECT */ static pci_ers_result_t @@ -79454,7 +79475,7 @@ index 6ca0081..fbb9efd 100644 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool); extern void qla2x00_init_host_attr(scsi_qla_host_t *); diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 078d797..1735786 100644 +index bea819e..fb745e0 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -301,12 +301,12 @@ struct scsi_transport_template *qla2xxx_transport_vport_template = NULL; @@ -83879,6 +83900,28 @@ index 7d90e25..0780424 100644 } info->fbops = &lynxfb_ops; +diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c +index 5987149..15c44ea 100644 +--- a/drivers/staging/unisys/visorbus/visorchipset.c ++++ b/drivers/staging/unisys/visorbus/visorchipset.c +@@ -2234,7 +2234,7 @@ static __init uint32_t visorutil_spar_detect(void) + } + } + +-static int init_unisys(void) ++static __init int init_unisys(void) + { + int result; + +@@ -2249,7 +2249,7 @@ static int init_unisys(void) + return 0; + }; + +-static void exit_unisys(void) ++static __exit void exit_unisys(void) + { + acpi_bus_unregister_driver(&unisys_acpi_driver); + } diff --git a/drivers/staging/unisys/visornic/visornic_main.c b/drivers/staging/unisys/visornic/visornic_main.c index 1367007..d7a3530 100644 --- a/drivers/staging/unisys/visornic/visornic_main.c @@ -138051,7 +138094,7 @@ index bb31373..e85eb5f 100644 #ifdef CONFIG_CPU_IDLE extern int cpuidle_register_governor(struct cpuidle_governor *gov); diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h -index da7fbf1..c2a221b 100644 +index fa3b155..258dde5 100644 --- a/include/linux/cpumask.h +++ b/include/linux/cpumask.h @@ -131,17 +131,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp) @@ -148744,7 +148787,7 @@ index e9fdb52..cfb547d 100644 new_table.data = &new_value; ret = proc_dointvec_minmax(&new_table, write, buffer, lenp, ppos); diff --git a/kernel/events/core.c b/kernel/events/core.c -index b1cfd74..62fe53a 100644 +index 4b33231..e0edf1b 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -389,8 +389,15 @@ static struct srcu_struct pmus_srcu; @@ -148793,7 +148836,7 @@ index b1cfd74..62fe53a 100644 { u64 frequency = event->attr.sample_freq; u64 sec = NSEC_PER_SEC; -@@ -4267,9 +4275,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) +@@ -4272,9 +4280,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) total += perf_event_count(event); *enabled += event->total_time_enabled + @@ -148805,7 +148848,7 @@ index b1cfd74..62fe53a 100644 list_for_each_entry(child, &event->child_list, child_list) { (void)perf_event_read(child, false); -@@ -4301,12 +4309,12 @@ static int __perf_read_group_add(struct perf_event *leader, +@@ -4306,12 +4314,12 @@ static int __perf_read_group_add(struct perf_event *leader, */ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] += leader->total_time_enabled + @@ -148820,7 +148863,7 @@ index b1cfd74..62fe53a 100644 } /* -@@ -4829,10 +4837,10 @@ void perf_event_update_userpage(struct perf_event *event) +@@ -4834,10 +4842,10 @@ void perf_event_update_userpage(struct perf_event *event) userpg->offset -= local64_read(&event->hw.prev_count); userpg->time_enabled = enabled + @@ -148833,7 +148876,7 @@ index b1cfd74..62fe53a 100644 arch_perf_update_userpage(event, userpg, now); -@@ -5535,7 +5543,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, +@@ -5540,7 +5548,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, /* Data. */ sp = perf_user_stack_pointer(regs); @@ -148842,7 +148885,7 @@ index b1cfd74..62fe53a 100644 dyn_size = dump_size - rem; perf_output_skip(handle, rem); -@@ -5626,11 +5634,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, +@@ -5631,11 +5639,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, values[n++] = perf_event_count(event); if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] = enabled + @@ -148856,7 +148899,7 @@ index b1cfd74..62fe53a 100644 } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); -@@ -8705,8 +8713,7 @@ perf_event_mux_interval_ms_store(struct device *dev, +@@ -8710,8 +8718,7 @@ perf_event_mux_interval_ms_store(struct device *dev, cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu); cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer); @@ -148866,7 +148909,7 @@ index b1cfd74..62fe53a 100644 } put_online_cpus(); mutex_unlock(&mux_interval_mutex); -@@ -9152,7 +9159,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, +@@ -9157,7 +9164,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, event->parent = parent_event; event->ns = get_pid_ns(task_active_pid_ns(current)); @@ -148875,7 +148918,7 @@ index b1cfd74..62fe53a 100644 event->state = PERF_EVENT_STATE_INACTIVE; -@@ -9587,6 +9594,11 @@ SYSCALL_DEFINE5(perf_event_open, +@@ -9592,6 +9599,11 @@ SYSCALL_DEFINE5(perf_event_open, if (flags & ~PERF_FLAG_ALL) return -EINVAL; @@ -148887,7 +148930,7 @@ index b1cfd74..62fe53a 100644 err = perf_copy_attr(attr_uptr, &attr); if (err) return err; -@@ -10126,10 +10138,10 @@ static void sync_child_event(struct perf_event *child_event, +@@ -10131,10 +10143,10 @@ static void sync_child_event(struct perf_event *child_event, /* * Add back the child's count to the parent's count: */ @@ -153143,7 +153186,7 @@ index 4a5c6e7..96ef058 100644 mutex_unlock(&smpboot_threads_lock); put_online_cpus(); diff --git a/kernel/softirq.c b/kernel/softirq.c -index 744fa61..32960f2 100644 +index 744fa61..ab73a78 100644 --- a/kernel/softirq.c +++ b/kernel/softirq.c @@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned; @@ -153155,7 +153198,7 @@ index 744fa61..32960f2 100644 DEFINE_PER_CPU(struct task_struct *, ksoftirqd); -@@ -281,7 +281,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) +@@ -281,10 +281,10 @@ asmlinkage __visible void __softirq_entry __do_softirq(void) kstat_incr_softirqs_this_cpu(vec_nr); trace_softirq_entry(vec_nr); @@ -153163,7 +153206,11 @@ index 744fa61..32960f2 100644 + h->action(); trace_softirq_exit(vec_nr); if (unlikely(prev_count != preempt_count())) { - pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n", +- pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n", ++ pr_err("huh, entered softirq %u %s %pA with preempt_count %08x, exited with %08x?\n", + vec_nr, softirq_to_name[vec_nr], h->action, + prev_count, preempt_count()); + preempt_count_set(prev_count); @@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr) or_softirq_pending(1UL << nr); } @@ -161396,7 +161443,7 @@ index 5ec1580..eea07f2 100644 EXPORT_SYMBOL(kmem_cache_free); diff --git a/mm/slub.c b/mm/slub.c -index 2b3e740..ca3813c 100644 +index 7aa0e97..ca3813c 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -34,6 +34,7 @@ @@ -161471,18 +161518,7 @@ index 2b3e740..ca3813c 100644 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid); #ifdef CONFIG_STACKTRACE { -@@ -1419,6 +1430,10 @@ static int init_cache_random_seq(struct kmem_cache *s) - int err; - unsigned long i, count = oo_objects(s->oo); - -+ /* Bailout if already initialised */ -+ if (s->random_seq) -+ return 0; -+ - err = cache_random_seq_create(s, count, GFP_KERNEL); - if (err) { - pr_err("SLUB: Unable to initialize free list for %s\n", -@@ -2911,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s, +@@ -2915,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s, void *tail_obj = tail ? : head; struct kmem_cache_cpu *c; unsigned long tid; @@ -161506,7 +161542,7 @@ index 2b3e740..ca3813c 100644 redo: /* * Determine the currently cpus per cpu slab. -@@ -3714,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str) +@@ -3718,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str) __setup("slub_min_objects=", setup_slub_min_objects); @@ -161515,7 +161551,7 @@ index 2b3e740..ca3813c 100644 { struct kmem_cache *s; void *ret; -@@ -3752,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node) +@@ -3756,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node) return ptr; } @@ -161524,7 +161560,7 @@ index 2b3e740..ca3813c 100644 { struct kmem_cache *s; void *ret; -@@ -3783,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node) +@@ -3787,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node) EXPORT_SYMBOL(__kmalloc_node); #endif @@ -161567,7 +161603,7 @@ index 2b3e740..ca3813c 100644 * * Returns NULL if check passes, otherwise const char * to name of cache * to indicate an error. -@@ -3795,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n, +@@ -3799,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n, { struct kmem_cache *s; unsigned long offset; @@ -161585,7 +161621,7 @@ index 2b3e740..ca3813c 100644 /* Find offset within object. */ offset = (ptr - page_address(page)) % s->size; -@@ -3815,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n, +@@ -3819,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n, offset -= s->red_left_pad; } @@ -161606,7 +161642,7 @@ index 2b3e740..ca3813c 100644 } #endif /* CONFIG_HARDENED_USERCOPY */ -@@ -3861,6 +3930,7 @@ void kfree(const void *x) +@@ -3865,6 +3930,7 @@ void kfree(const void *x) if (unlikely(ZERO_OR_NULL_PTR(x))) return; @@ -161614,7 +161650,7 @@ index 2b3e740..ca3813c 100644 page = virt_to_head_page(x); if (unlikely(!PageSlab(page))) { BUG_ON(!PageCompound(page)); -@@ -4131,7 +4201,7 @@ void __init kmem_cache_init(void) +@@ -4135,7 +4201,7 @@ void __init kmem_cache_init(void) kmem_cache = &boot_kmem_cache; create_boot_cache(kmem_cache_node, "kmem_cache_node", @@ -161623,7 +161659,7 @@ index 2b3e740..ca3813c 100644 register_hotmemory_notifier(&slab_memory_callback_nb); -@@ -4141,7 +4211,7 @@ void __init kmem_cache_init(void) +@@ -4145,7 +4211,7 @@ void __init kmem_cache_init(void) create_boot_cache(kmem_cache, "kmem_cache", offsetof(struct kmem_cache, node) + nr_node_ids * sizeof(struct kmem_cache_node *), @@ -161632,7 +161668,7 @@ index 2b3e740..ca3813c 100644 kmem_cache = bootstrap(&boot_kmem_cache); -@@ -4180,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align, +@@ -4184,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align, s = find_mergeable(size, align, flags, name, ctor); if (s) { @@ -161641,7 +161677,7 @@ index 2b3e740..ca3813c 100644 /* * Adjust the object sizes so that we clear -@@ -4196,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align, +@@ -4200,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align, } if (sysfs_slab_alias(s, name)) { @@ -161650,7 +161686,7 @@ index 2b3e740..ca3813c 100644 s = NULL; } } -@@ -4208,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags) +@@ -4212,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags) { int err; @@ -161659,7 +161695,7 @@ index 2b3e740..ca3813c 100644 err = kmem_cache_open(s, flags); if (err) return err; -@@ -4276,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags, +@@ -4280,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags, } #endif @@ -161668,7 +161704,7 @@ index 2b3e740..ca3813c 100644 static int count_inuse(struct page *page) { return page->inuse; -@@ -4557,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf, +@@ -4561,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf, len += sprintf(buf + len, "%7ld ", l->count); if (l->addr) @@ -161680,7 +161716,7 @@ index 2b3e740..ca3813c 100644 else len += sprintf(buf + len, "<not-available>"); -@@ -4655,12 +4731,12 @@ static void __init resiliency_test(void) +@@ -4659,12 +4731,12 @@ static void __init resiliency_test(void) validate_slab_cache(kmalloc_caches[9]); } #else @@ -161695,7 +161731,7 @@ index 2b3e740..ca3813c 100644 enum slab_stat_type { SL_ALL, /* All slabs */ SL_PARTIAL, /* Only partially allocated slabs */ -@@ -4897,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf) +@@ -4901,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf) { if (!s->ctor) return 0; @@ -161714,7 +161750,7 @@ index 2b3e740..ca3813c 100644 } SLAB_ATTR_RO(aliases); -@@ -4991,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf) +@@ -4995,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf) SLAB_ATTR_RO(cache_dma); #endif @@ -161737,7 +161773,7 @@ index 2b3e740..ca3813c 100644 static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf) { return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU)); -@@ -5046,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf, +@@ -5050,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf, * as well as cause other issues like converting a mergeable * cache into an umergeable one. */ @@ -161746,7 +161782,7 @@ index 2b3e740..ca3813c 100644 return -EINVAL; s->flags &= ~SLAB_TRACE; -@@ -5164,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf) +@@ -5168,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf) static ssize_t failslab_store(struct kmem_cache *s, const char *buf, size_t length) { @@ -161755,7 +161791,7 @@ index 2b3e740..ca3813c 100644 return -EINVAL; s->flags &= ~SLAB_FAILSLAB; -@@ -5296,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node); +@@ -5300,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node); STAT_ATTR(CPU_PARTIAL_DRAIN, cpu_partial_drain); #endif @@ -161764,7 +161800,7 @@ index 2b3e740..ca3813c 100644 &slab_size_attr.attr, &object_size_attr.attr, &objs_per_slab_attr.attr, -@@ -5331,6 +5427,12 @@ static struct attribute *slab_attrs[] = { +@@ -5335,6 +5427,12 @@ static struct attribute *slab_attrs[] = { #ifdef CONFIG_ZONE_DMA &cache_dma_attr.attr, #endif @@ -161777,7 +161813,7 @@ index 2b3e740..ca3813c 100644 #ifdef CONFIG_NUMA &remote_node_defrag_ratio_attr.attr, #endif -@@ -5574,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s) +@@ -5578,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s) return name; } @@ -161785,7 +161821,7 @@ index 2b3e740..ca3813c 100644 static int sysfs_slab_add(struct kmem_cache *s) { int err; -@@ -5645,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s) +@@ -5649,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s) kobject_del(&s->kobj); kobject_put(&s->kobj); } @@ -161793,7 +161829,7 @@ index 2b3e740..ca3813c 100644 /* * Need to buffer aliases during bootup until sysfs becomes -@@ -5658,6 +5762,7 @@ struct saved_alias { +@@ -5662,6 +5762,7 @@ struct saved_alias { static struct saved_alias *alias_list; @@ -161801,7 +161837,7 @@ index 2b3e740..ca3813c 100644 static int sysfs_slab_alias(struct kmem_cache *s, const char *name) { struct saved_alias *al; -@@ -5680,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name) +@@ -5684,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name) alias_list = al; return 0; } @@ -170432,33 +170468,6 @@ index 6cfb6e9..eaa7ef4 100644 linkwatch_fire_event(dev); } } -diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c -index 303355c..d6ce615 100644 ---- a/net/sched/sch_tbf.c -+++ b/net/sched/sch_tbf.c -@@ -162,7 +162,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch, - struct sk_buff *segs, *nskb; - netdev_features_t features = netif_skb_features(skb); - unsigned int len = 0, prev_len = qdisc_pkt_len(skb); -- int ret, nb; -+ int ret; -+ unsigned int nb; - - segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); - -@@ -185,8 +186,10 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch, - segs = nskb; - } - sch->q.qlen += nb; -- if (nb > 1) -- qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len); -+ if (nb > 1) { -+ nb--; -+ qdisc_tree_reduce_backlog(sch, -nb, prev_len - len); -+ } - consume_skb(skb); - return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; - } diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 176af30..585194b 100644 --- a/net/sctp/ipv6.c @@ -174500,10 +174509,10 @@ index 0000000..7514850 +fi diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c new file mode 100644 -index 0000000..ad28ed6 +index 0000000..1c8d204 --- /dev/null +++ b/scripts/gcc-plugins/initify_plugin.c -@@ -0,0 +1,1831 @@ +@@ -0,0 +1,1865 @@ +/* + * Copyright 2015-2017 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2 @@ -174553,7 +174562,7 @@ index 0000000..ad28ed6 +__visible int plugin_is_GPL_compatible; + +static struct plugin_info initify_plugin_info = { -+ .version = "20170112", ++ .version = "20170215", + .help = "disable\tturn off the initify plugin\n" + "verbose\tprint all initified strings and all" + " functions which should be __init/__exit\n" @@ -174622,14 +174631,37 @@ index 0000000..ad28ed6 +{ + delete visited; +} ++ ++typedef struct hash_set<struct cgraph_node *> cgraph_set; ++ ++static inline bool pointer_set_insert(cgraph_set *visited, struct cgraph_node *node) ++{ ++ return visited->add(node); ++} ++ ++static inline cgraph_set* cgraph_pointer_set_create(void) ++{ ++ return new hash_set<struct cgraph_node *>; ++} ++ ++static inline void pointer_set_destroy(cgraph_set *visited) ++{ ++ delete visited; ++} +#else +typedef struct pointer_set_t gimple_set; +typedef struct pointer_set_t tree_set; ++typedef struct pointer_set_t cgraph_set; + +static inline tree_set *tree_pointer_set_create(void) +{ + return pointer_set_create(); +} ++ ++static inline cgraph_set *cgraph_pointer_set_create(void) ++{ ++ return pointer_set_create(); ++} +#endif + +static gimple initify_get_def_stmt(const_tree node) @@ -175295,7 +175327,8 @@ index 0000000..ad28ed6 + + if (fndecl == NULL_TREE) + fndecl = gimple_call_fn(call); -+ gcc_assert(fndecl != NULL_TREE); ++ if (fndecl == NULL_TREE) ++ return false; + + if (is_negative_nocapture_arg(fndecl, -arg_num) && is_return_value_captured(visited_defs, call)) + return false; @@ -175658,7 +175691,7 @@ index 0000000..ad28ed6 + tree var; + + FOR_EACH_LOCAL_DECL(cfun, i, var) { -+ tree str, init_val; ++ tree str, init_val, asm_name; + + if (TREE_CODE(TREE_TYPE(var)) != ARRAY_TYPE) + continue; @@ -175669,6 +175702,10 @@ index 0000000..ad28ed6 + if (TREE_CODE(init_val) != STRING_CST) + continue; + ++ asm_name = DECL_ASSEMBLER_NAME(var); ++ if (asm_name != NULL_TREE && TREE_SYMBOL_REFERENCED(asm_name)) ++ continue; ++ + if (has_capture_use_local_var(var)) + continue; + @@ -176044,18 +176081,21 @@ index 0000000..ad28ed6 + return false; +} + -+static void has_non_init_clone(struct cgraph_node *node, bool *has_non_init) ++static bool has_non_init_clone(cgraph_set *visited, struct cgraph_node *node) +{ -+ if (*has_non_init) -+ return; ++ if (!node) ++ return false; ++ ++ if (pointer_set_insert(visited, node)) ++ return false; + + if (has_non_init_caller(node)) -+ *has_non_init = true; ++ return true; + -+ if (node->clones) -+ has_non_init_clone(node->clones, has_non_init); -+ if (node->clone_of) -+ has_non_init_clone(node->clone_of, has_non_init); ++ if (has_non_init_clone(visited, node->clones)) ++ return true; ++ ++ return has_non_init_clone(visited, node->clone_of); +} + +/* @@ -176064,6 +176104,7 @@ index 0000000..ad28ed6 + */ +static bool should_init_exit(struct cgraph_node *callee) +{ ++ cgraph_set *visited; + bool has_non_init; + const_tree callee_decl = NODE_DECL(callee); + @@ -176079,8 +176120,10 @@ index 0000000..ad28ed6 + if (NODE_SYMBOL(callee)->address_taken) + return false; + -+ has_non_init = false; -+ has_non_init_clone(callee, &has_non_init); ++ visited = cgraph_pointer_set_create(); ++ has_non_init = has_non_init_clone(visited, callee); ++ pointer_set_destroy(visited); ++ + return !has_non_init; +} + @@ -224547,7 +224590,7 @@ index 062c446..a4b6f4c 100644 }; diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c -index c850345..ec0a853 100644 +index dfa5156..05c2b75 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -87,7 +87,7 @@ int snd_seq_dump_var_event(const struct snd_seq_event *event, @@ -225456,7 +225499,7 @@ index a020920..55579f6 100644 diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index 90009c0..41ed071 100644 +index ab3c280..e5cb292 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -337,7 +337,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, diff --git a/4.9.9/4425_grsec_remove_EI_PAX.patch b/4.9.10/4425_grsec_remove_EI_PAX.patch index 594598a..594598a 100644 --- a/4.9.9/4425_grsec_remove_EI_PAX.patch +++ b/4.9.10/4425_grsec_remove_EI_PAX.patch diff --git a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch index f7e97b5..f7e97b5 100644 --- a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch +++ b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch diff --git a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch index 3871139..3871139 100644 --- a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch diff --git a/4.9.9/4430_grsec-remove-localversion-grsec.patch b/4.9.10/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.9.9/4430_grsec-remove-localversion-grsec.patch +++ b/4.9.10/4430_grsec-remove-localversion-grsec.patch diff --git a/4.9.9/4435_grsec-mute-warnings.patch b/4.9.10/4435_grsec-mute-warnings.patch index 8929222..8929222 100644 --- a/4.9.9/4435_grsec-mute-warnings.patch +++ b/4.9.10/4435_grsec-mute-warnings.patch diff --git a/4.9.9/4440_grsec-remove-protected-paths.patch b/4.9.10/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.9.9/4440_grsec-remove-protected-paths.patch +++ b/4.9.10/4440_grsec-remove-protected-paths.patch diff --git a/4.9.9/4450_grsec-kconfig-default-gids.patch b/4.9.10/4450_grsec-kconfig-default-gids.patch index cee6e27..cee6e27 100644 --- a/4.9.9/4450_grsec-kconfig-default-gids.patch +++ b/4.9.10/4450_grsec-kconfig-default-gids.patch diff --git a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch index 06a5294..06a5294 100644 --- a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.9.9/4470_disable-compat_vdso.patch b/4.9.10/4470_disable-compat_vdso.patch index a1401d8..a1401d8 100644 --- a/4.9.9/4470_disable-compat_vdso.patch +++ b/4.9.10/4470_disable-compat_vdso.patch diff --git a/4.9.9/4475_emutramp_default_on.patch b/4.9.10/4475_emutramp_default_on.patch index feb8c7b..feb8c7b 100644 --- a/4.9.9/4475_emutramp_default_on.patch +++ b/4.9.10/4475_emutramp_default_on.patch diff --git a/4.9.9/1007_linux-4.9.8.patch b/4.9.9/1007_linux-4.9.8.patch deleted file mode 100644 index a93aab4..0000000 --- a/4.9.9/1007_linux-4.9.8.patch +++ /dev/null @@ -1,2048 +0,0 @@ -diff --git a/Makefile b/Makefile -index da704d9..1130803 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 9 --SUBLEVEL = 7 -+SUBLEVEL = 8 - EXTRAVERSION = - NAME = Roaring Lionus - -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 25d1eb4..be7ec5a 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -710,11 +710,8 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, - unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs; - unsigned int pkts_compl = 0, bytes_compl = 0; - struct bcm_sysport_cb *cb; -- struct netdev_queue *txq; - u32 hw_ind; - -- txq = netdev_get_tx_queue(ndev, ring->index); -- - /* Compute how many descriptors have been processed since last call */ - hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index)); - c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK; -@@ -745,9 +742,6 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, - - ring->c_index = c_index; - -- if (netif_tx_queue_stopped(txq) && pkts_compl) -- netif_tx_wake_queue(txq); -- - netif_dbg(priv, tx_done, ndev, - "ring=%d c_index=%d pkts_compl=%d, bytes_compl=%d\n", - ring->index, ring->c_index, pkts_compl, bytes_compl); -@@ -759,16 +753,33 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, - static unsigned int bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, - struct bcm_sysport_tx_ring *ring) - { -+ struct netdev_queue *txq; - unsigned int released; - unsigned long flags; - -+ txq = netdev_get_tx_queue(priv->netdev, ring->index); -+ - spin_lock_irqsave(&ring->lock, flags); - released = __bcm_sysport_tx_reclaim(priv, ring); -+ if (released) -+ netif_tx_wake_queue(txq); -+ - spin_unlock_irqrestore(&ring->lock, flags); - - return released; - } - -+/* Locked version of the per-ring TX reclaim, but does not wake the queue */ -+static void bcm_sysport_tx_clean(struct bcm_sysport_priv *priv, -+ struct bcm_sysport_tx_ring *ring) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&ring->lock, flags); -+ __bcm_sysport_tx_reclaim(priv, ring); -+ spin_unlock_irqrestore(&ring->lock, flags); -+} -+ - static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget) - { - struct bcm_sysport_tx_ring *ring = -@@ -1253,7 +1264,7 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv, - napi_disable(&ring->napi); - netif_napi_del(&ring->napi); - -- bcm_sysport_tx_reclaim(priv, ring); -+ bcm_sysport_tx_clean(priv, ring); - - kfree(ring->cbs); - ring->cbs = NULL; -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -index fb8bb02..d223e7c 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -@@ -1740,8 +1740,11 @@ int mlx4_en_start_port(struct net_device *dev) - /* Process all completions if exist to prevent - * the queues freezing if they are full - */ -- for (i = 0; i < priv->rx_ring_num; i++) -+ for (i = 0; i < priv->rx_ring_num; i++) { -+ local_bh_disable(); - napi_schedule(&priv->rx_cq[i]->napi); -+ local_bh_enable(); -+ } - - netif_tx_start_all_queues(dev); - netif_device_attach(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 33495d8..e7b2158 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -193,6 +193,9 @@ static inline bool mlx5e_rx_cache_put(struct mlx5e_rq *rq, - return false; - } - -+ if (unlikely(page_is_pfmemalloc(dma_info->page))) -+ return false; -+ - cache->page_cache[cache->tail] = *dma_info; - cache->tail = tail_next; - return true; -diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.h b/drivers/net/ethernet/mellanox/mlxsw/pci.h -index d942a3e..846fd4d 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/pci.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.h -@@ -211,21 +211,21 @@ MLXSW_ITEM32(pci, eqe, owner, 0x0C, 0, 1); - /* pci_eqe_cmd_token - * Command completion event - token - */ --MLXSW_ITEM32(pci, eqe, cmd_token, 0x08, 16, 16); -+MLXSW_ITEM32(pci, eqe, cmd_token, 0x00, 16, 16); - - /* pci_eqe_cmd_status - * Command completion event - status - */ --MLXSW_ITEM32(pci, eqe, cmd_status, 0x08, 0, 8); -+MLXSW_ITEM32(pci, eqe, cmd_status, 0x00, 0, 8); - - /* pci_eqe_cmd_out_param_h - * Command completion event - output parameter - higher part - */ --MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x0C, 0, 32); -+MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x04, 0, 32); - - /* pci_eqe_cmd_out_param_l - * Command completion event - output parameter - lower part - */ --MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x10, 0, 32); -+MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x08, 0, 32); - - #endif -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -index dda5761..f902c4d 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -@@ -684,6 +684,7 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb, - dev_kfree_skb_any(skb_orig); - return NETDEV_TX_OK; - } -+ dev_consume_skb_any(skb_orig); - } - - if (eth_skb_pad(skb)) { -diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -index 92bda87..d548f0a 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c -@@ -314,6 +314,7 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb, - dev_kfree_skb_any(skb_orig); - return NETDEV_TX_OK; - } -+ dev_consume_skb_any(skb_orig); - } - mlxsw_sx_txhdr_construct(skb, &tx_info); - /* TX header is consumed by HW on the way so we shouldn't count its -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index d6a2178..862f18e 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1508,6 +1508,19 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) + - entry / NUM_TX_DESC * DPTR_ALIGN; - len = PTR_ALIGN(skb->data, DPTR_ALIGN) - skb->data; -+ /* Zero length DMA descriptors are problematic as they seem to -+ * terminate DMA transfers. Avoid them by simply using a length of -+ * DPTR_ALIGN (4) when skb data is aligned to DPTR_ALIGN. -+ * -+ * As skb is guaranteed to have at least ETH_ZLEN (60) bytes of -+ * data by the call to skb_put_padto() above this is safe with -+ * respect to both the length of the first DMA descriptor (len) -+ * overflowing the available data and the length of the second DMA -+ * descriptor (skb->len - len) being negative. -+ */ -+ if (len == 0) -+ len = DPTR_ALIGN; -+ - memcpy(buffer, skb->data, len); - dma_addr = dma_map_single(ndev->dev.parent, buffer, len, DMA_TO_DEVICE); - if (dma_mapping_error(ndev->dev.parent, dma_addr)) -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index c9140c3..ff038e5 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -659,6 +659,7 @@ int netvsc_recv_callback(struct hv_device *device_obj, - * policy filters on the host). Deliver these via the VF - * interface in the guest. - */ -+ rcu_read_lock(); - vf_netdev = rcu_dereference(net_device_ctx->vf_netdev); - if (vf_netdev && (vf_netdev->flags & IFF_UP)) - net = vf_netdev; -@@ -667,6 +668,7 @@ int netvsc_recv_callback(struct hv_device *device_obj, - skb = netvsc_alloc_recv_skb(net, packet, csum_info, *data, vlan_tci); - if (unlikely(!skb)) { - ++net->stats.rx_dropped; -+ rcu_read_unlock(); - return NVSP_STAT_FAIL; - } - -@@ -696,6 +698,7 @@ int netvsc_recv_callback(struct hv_device *device_obj, - * TODO - use NAPI? - */ - netif_rx(skb); -+ rcu_read_unlock(); - - return 0; - } -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 7869b06..6f38daf 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -827,7 +827,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q, - return -EINVAL; - - ret = virtio_net_hdr_from_skb(skb, &vnet_hdr, -- macvtap_is_little_endian(q)); -+ macvtap_is_little_endian(q), true); - if (ret) - BUG(); - -diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c -index e741bf6..b0492ef 100644 ---- a/drivers/net/phy/bcm63xx.c -+++ b/drivers/net/phy/bcm63xx.c -@@ -21,6 +21,23 @@ MODULE_DESCRIPTION("Broadcom 63xx internal PHY driver"); - MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>"); - MODULE_LICENSE("GPL"); - -+static int bcm63xx_config_intr(struct phy_device *phydev) -+{ -+ int reg, err; -+ -+ reg = phy_read(phydev, MII_BCM63XX_IR); -+ if (reg < 0) -+ return reg; -+ -+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) -+ reg &= ~MII_BCM63XX_IR_GMASK; -+ else -+ reg |= MII_BCM63XX_IR_GMASK; -+ -+ err = phy_write(phydev, MII_BCM63XX_IR, reg); -+ return err; -+} -+ - static int bcm63xx_config_init(struct phy_device *phydev) - { - int reg, err; -@@ -55,7 +72,7 @@ static struct phy_driver bcm63xx_driver[] = { - .config_aneg = genphy_config_aneg, - .read_status = genphy_read_status, - .ack_interrupt = bcm_phy_ack_intr, -- .config_intr = bcm_phy_config_intr, -+ .config_intr = bcm63xx_config_intr, - }, { - /* same phy as above, with just a different OUI */ - .phy_id = 0x002bdc00, -@@ -67,7 +84,7 @@ static struct phy_driver bcm63xx_driver[] = { - .config_aneg = genphy_config_aneg, - .read_status = genphy_read_status, - .ack_interrupt = bcm_phy_ack_intr, -- .config_intr = bcm_phy_config_intr, -+ .config_intr = bcm63xx_config_intr, - } }; - - module_phy_driver(bcm63xx_driver); -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index db6acec..18402d7 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1374,7 +1374,7 @@ static ssize_t tun_put_user(struct tun_struct *tun, - return -EINVAL; - - ret = virtio_net_hdr_from_skb(skb, &gso, -- tun_is_little_endian(tun)); -+ tun_is_little_endian(tun), true); - if (ret) { - struct skb_shared_info *sinfo = skb_shinfo(skb); - pr_err("unexpected GSO type: " -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index dd623f6..b82be81 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -531,6 +531,7 @@ static const struct driver_info wwan_info = { - #define SAMSUNG_VENDOR_ID 0x04e8 - #define LENOVO_VENDOR_ID 0x17ef - #define NVIDIA_VENDOR_ID 0x0955 -+#define HP_VENDOR_ID 0x03f0 - - static const struct usb_device_id products[] = { - /* BLACKLIST !! -@@ -677,6 +678,13 @@ static const struct usb_device_id products[] = { - .driver_info = 0, - }, - -+/* HP lt2523 (Novatel E371) - handled by qmi_wwan */ -+{ -+ USB_DEVICE_AND_INTERFACE_INFO(HP_VENDOR_ID, 0x421d, USB_CLASS_COMM, -+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), -+ .driver_info = 0, -+}, -+ - /* AnyDATA ADU960S - handled by qmi_wwan */ - { - USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM, -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 6fe1cdb..24d5272 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -654,6 +654,13 @@ static const struct usb_device_id products[] = { - USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&qmi_wwan_info, - }, -+ { /* HP lt2523 (Novatel E371) */ -+ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, -+ USB_CLASS_COMM, -+ USB_CDC_SUBCLASS_ETHERNET, -+ USB_CDC_PROTO_NONE), -+ .driver_info = (unsigned long)&qmi_wwan_info, -+ }, - { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ - USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), - .driver_info = (unsigned long)&qmi_wwan_info, -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 4b5cb16..90b426c 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -32,7 +32,7 @@ - #define NETNEXT_VERSION "08" - - /* Information for net */ --#define NET_VERSION "6" -+#define NET_VERSION "7" - - #define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION - #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>" -@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc) - u8 checksum = CHECKSUM_NONE; - u32 opts2, opts3; - -- if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02) -+ if (!(tp->netdev->features & NETIF_F_RXCSUM)) - goto return_result; - - opts2 = le32_to_cpu(rx_desc->opts2); -@@ -3572,6 +3572,8 @@ static bool delay_autosuspend(struct r8152 *tp) - */ - if (!sw_linking && tp->rtl_ops.in_nway(tp)) - return true; -+ else if (!skb_queue_empty(&tp->tx_queue)) -+ return true; - else - return false; - } -@@ -4358,6 +4360,11 @@ static int rtl8152_probe(struct usb_interface *intf, - NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | - NETIF_F_IPV6_CSUM | NETIF_F_TSO6; - -+ if (tp->version == RTL_VER_01) { -+ netdev->features &= ~NETIF_F_RXCSUM; -+ netdev->hw_features &= ~NETIF_F_RXCSUM; -+ } -+ - netdev->ethtool_ops = &ops; - netif_set_gso_max_size(netdev, RTL_LIMITED_TSO_SIZE); - -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index cbf1c61..51fc0c3 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -840,7 +840,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) - hdr = skb_vnet_hdr(skb); - - if (virtio_net_hdr_from_skb(skb, &hdr->hdr, -- virtio_is_little_endian(vi->vdev))) -+ virtio_is_little_endian(vi->vdev), false)) - BUG(); - - if (vi->mergeable_rx_bufs) -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 2ba01ca..0fafaa9 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2887,7 +2887,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev, - memcpy(&vxlan->cfg, conf, sizeof(*conf)); - if (!vxlan->cfg.dst_port) { - if (conf->flags & VXLAN_F_GPE) -- vxlan->cfg.dst_port = 4790; /* IANA assigned VXLAN-GPE port */ -+ vxlan->cfg.dst_port = htons(4790); /* IANA VXLAN-GPE port */ - else - vxlan->cfg.dst_port = default_port; - } -diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c -index 5050056..9f06a21 100644 ---- a/fs/xfs/libxfs/xfs_alloc.c -+++ b/fs/xfs/libxfs/xfs_alloc.c -@@ -95,10 +95,7 @@ unsigned int - xfs_alloc_set_aside( - struct xfs_mount *mp) - { -- unsigned int blocks; -- -- blocks = 4 + (mp->m_sb.sb_agcount * XFS_ALLOC_AGFL_RESERVE); -- return blocks; -+ return mp->m_sb.sb_agcount * (XFS_ALLOC_AGFL_RESERVE + 4); - } - - /* -@@ -365,36 +362,12 @@ xfs_alloc_fix_len( - return; - ASSERT(rlen >= args->minlen && rlen <= args->maxlen); - ASSERT(rlen % args->prod == args->mod); -+ ASSERT(args->pag->pagf_freeblks + args->pag->pagf_flcount >= -+ rlen + args->minleft); - args->len = rlen; - } - - /* -- * Fix up length if there is too little space left in the a.g. -- * Return 1 if ok, 0 if too little, should give up. -- */ --STATIC int --xfs_alloc_fix_minleft( -- xfs_alloc_arg_t *args) /* allocation argument structure */ --{ -- xfs_agf_t *agf; /* a.g. freelist header */ -- int diff; /* free space difference */ -- -- if (args->minleft == 0) -- return 1; -- agf = XFS_BUF_TO_AGF(args->agbp); -- diff = be32_to_cpu(agf->agf_freeblks) -- - args->len - args->minleft; -- if (diff >= 0) -- return 1; -- args->len += diff; /* shrink the allocated space */ -- /* casts to (int) catch length underflows */ -- if ((int)args->len >= (int)args->minlen) -- return 1; -- args->agbno = NULLAGBLOCK; -- return 0; --} -- --/* - * Update the two btrees, logically removing from freespace the extent - * starting at rbno, rlen blocks. The extent is contained within the - * actual (current) free extent fbno for flen blocks. -@@ -689,8 +662,6 @@ xfs_alloc_ag_vextent( - xfs_alloc_arg_t *args) /* argument structure for allocation */ - { - int error=0; -- xfs_extlen_t reservation; -- xfs_extlen_t oldmax; - - ASSERT(args->minlen > 0); - ASSERT(args->maxlen > 0); -@@ -699,20 +670,6 @@ xfs_alloc_ag_vextent( - ASSERT(args->alignment > 0); - - /* -- * Clamp maxlen to the amount of free space minus any reservations -- * that have been made. -- */ -- oldmax = args->maxlen; -- reservation = xfs_ag_resv_needed(args->pag, args->resv); -- if (args->maxlen > args->pag->pagf_freeblks - reservation) -- args->maxlen = args->pag->pagf_freeblks - reservation; -- if (args->maxlen == 0) { -- args->agbno = NULLAGBLOCK; -- args->maxlen = oldmax; -- return 0; -- } -- -- /* - * Branch to correct routine based on the type. - */ - args->wasfromfl = 0; -@@ -731,8 +688,6 @@ xfs_alloc_ag_vextent( - /* NOTREACHED */ - } - -- args->maxlen = oldmax; -- - if (error || args->agbno == NULLAGBLOCK) - return error; - -@@ -841,9 +796,6 @@ xfs_alloc_ag_vextent_exact( - args->len = XFS_AGBLOCK_MIN(tend, args->agbno + args->maxlen) - - args->agbno; - xfs_alloc_fix_len(args); -- if (!xfs_alloc_fix_minleft(args)) -- goto not_found; -- - ASSERT(args->agbno + args->len <= tend); - - /* -@@ -1149,12 +1101,7 @@ xfs_alloc_ag_vextent_near( - XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0); - ASSERT(ltbno + ltlen <= be32_to_cpu(XFS_BUF_TO_AGF(args->agbp)->agf_length)); - args->len = blen; -- if (!xfs_alloc_fix_minleft(args)) { -- xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR); -- trace_xfs_alloc_near_nominleft(args); -- return 0; -- } -- blen = args->len; -+ - /* - * We are allocating starting at bnew for blen blocks. - */ -@@ -1346,12 +1293,6 @@ xfs_alloc_ag_vextent_near( - */ - args->len = XFS_EXTLEN_MIN(ltlena, args->maxlen); - xfs_alloc_fix_len(args); -- if (!xfs_alloc_fix_minleft(args)) { -- trace_xfs_alloc_near_nominleft(args); -- xfs_btree_del_cursor(bno_cur_lt, XFS_BTREE_NOERROR); -- xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR); -- return 0; -- } - rlen = args->len; - (void)xfs_alloc_compute_diff(args->agbno, rlen, args->alignment, - args->datatype, ltbnoa, ltlena, <new); -@@ -1553,8 +1494,6 @@ xfs_alloc_ag_vextent_size( - } - xfs_alloc_fix_len(args); - -- if (!xfs_alloc_fix_minleft(args)) -- goto out_nominleft; - rlen = args->len; - XFS_WANT_CORRUPTED_GOTO(args->mp, rlen <= flen, error0); - /* -@@ -2056,7 +1995,7 @@ xfs_alloc_space_available( - int flags) - { - struct xfs_perag *pag = args->pag; -- xfs_extlen_t longest; -+ xfs_extlen_t alloc_len, longest; - xfs_extlen_t reservation; /* blocks that are still reserved */ - int available; - -@@ -2066,17 +2005,28 @@ xfs_alloc_space_available( - reservation = xfs_ag_resv_needed(pag, args->resv); - - /* do we have enough contiguous free space for the allocation? */ -+ alloc_len = args->minlen + (args->alignment - 1) + args->minalignslop; - longest = xfs_alloc_longest_free_extent(args->mp, pag, min_free, - reservation); -- if ((args->minlen + args->alignment + args->minalignslop - 1) > longest) -+ if (longest < alloc_len) - return false; - - /* do we have enough free space remaining for the allocation? */ - available = (int)(pag->pagf_freeblks + pag->pagf_flcount - -- reservation - min_free - args->total); -- if (available < (int)args->minleft || available <= 0) -+ reservation - min_free - args->minleft); -+ if (available < (int)max(args->total, alloc_len)) - return false; - -+ /* -+ * Clamp maxlen to the amount of free space available for the actual -+ * extent allocation. -+ */ -+ if (available < (int)args->maxlen && !(flags & XFS_ALLOC_FLAG_CHECK)) { -+ args->maxlen = available; -+ ASSERT(args->maxlen > 0); -+ ASSERT(args->maxlen >= args->minlen); -+ } -+ - return true; - } - -@@ -2122,7 +2072,8 @@ xfs_alloc_fix_freelist( - } - - need = xfs_alloc_min_freelist(mp, pag); -- if (!xfs_alloc_space_available(args, need, flags)) -+ if (!xfs_alloc_space_available(args, need, flags | -+ XFS_ALLOC_FLAG_CHECK)) - goto out_agbp_relse; - - /* -@@ -2638,12 +2589,10 @@ xfs_alloc_vextent( - xfs_agblock_t agsize; /* allocation group size */ - int error; - int flags; /* XFS_ALLOC_FLAG_... locking flags */ -- xfs_extlen_t minleft;/* minimum left value, temp copy */ - xfs_mount_t *mp; /* mount structure pointer */ - xfs_agnumber_t sagno; /* starting allocation group number */ - xfs_alloctype_t type; /* input allocation type */ - int bump_rotor = 0; -- int no_min = 0; - xfs_agnumber_t rotorstep = xfs_rotorstep; /* inode32 agf stepper */ - - mp = args->mp; -@@ -2672,7 +2621,6 @@ xfs_alloc_vextent( - trace_xfs_alloc_vextent_badargs(args); - return 0; - } -- minleft = args->minleft; - - switch (type) { - case XFS_ALLOCTYPE_THIS_AG: -@@ -2683,9 +2631,7 @@ xfs_alloc_vextent( - */ - args->agno = XFS_FSB_TO_AGNO(mp, args->fsbno); - args->pag = xfs_perag_get(mp, args->agno); -- args->minleft = 0; - error = xfs_alloc_fix_freelist(args, 0); -- args->minleft = minleft; - if (error) { - trace_xfs_alloc_vextent_nofix(args); - goto error0; -@@ -2750,9 +2696,7 @@ xfs_alloc_vextent( - */ - for (;;) { - args->pag = xfs_perag_get(mp, args->agno); -- if (no_min) args->minleft = 0; - error = xfs_alloc_fix_freelist(args, flags); -- args->minleft = minleft; - if (error) { - trace_xfs_alloc_vextent_nofix(args); - goto error0; -@@ -2792,20 +2736,17 @@ xfs_alloc_vextent( - * or switch to non-trylock mode. - */ - if (args->agno == sagno) { -- if (no_min == 1) { -+ if (flags == 0) { - args->agbno = NULLAGBLOCK; - trace_xfs_alloc_vextent_allfailed(args); - break; - } -- if (flags == 0) { -- no_min = 1; -- } else { -- flags = 0; -- if (type == XFS_ALLOCTYPE_START_BNO) { -- args->agbno = XFS_FSB_TO_AGBNO(mp, -- args->fsbno); -- args->type = XFS_ALLOCTYPE_NEAR_BNO; -- } -+ -+ flags = 0; -+ if (type == XFS_ALLOCTYPE_START_BNO) { -+ args->agbno = XFS_FSB_TO_AGBNO(mp, -+ args->fsbno); -+ args->type = XFS_ALLOCTYPE_NEAR_BNO; - } - } - xfs_perag_put(args->pag); -diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h -index 7c404a6..1d0f48a 100644 ---- a/fs/xfs/libxfs/xfs_alloc.h -+++ b/fs/xfs/libxfs/xfs_alloc.h -@@ -56,7 +56,7 @@ typedef unsigned int xfs_alloctype_t; - #define XFS_ALLOC_FLAG_FREEING 0x00000002 /* indicate caller is freeing extents*/ - #define XFS_ALLOC_FLAG_NORMAP 0x00000004 /* don't modify the rmapbt */ - #define XFS_ALLOC_FLAG_NOSHRINK 0x00000008 /* don't shrink the freelist */ -- -+#define XFS_ALLOC_FLAG_CHECK 0x00000010 /* test only, don't modify args */ - - /* - * Argument structure for xfs_alloc routines. -diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c -index af1ecb1..6622d46 100644 ---- a/fs/xfs/libxfs/xfs_attr.c -+++ b/fs/xfs/libxfs/xfs_attr.c -@@ -131,9 +131,6 @@ xfs_attr_get( - if (XFS_FORCED_SHUTDOWN(ip->i_mount)) - return -EIO; - -- if (!xfs_inode_hasattr(ip)) -- return -ENOATTR; -- - error = xfs_attr_args_init(&args, ip, name, flags); - if (error) - return error; -@@ -392,9 +389,6 @@ xfs_attr_remove( - if (XFS_FORCED_SHUTDOWN(dp->i_mount)) - return -EIO; - -- if (!xfs_inode_hasattr(dp)) -- return -ENOATTR; -- - error = xfs_attr_args_init(&args, dp, name, flags); - if (error) - return error; -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index 89d727b..f52fd63 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -3720,7 +3720,7 @@ xfs_bmap_btalloc( - align = xfs_get_cowextsz_hint(ap->ip); - else if (xfs_alloc_is_userdata(ap->datatype)) - align = xfs_get_extsz_hint(ap->ip); -- if (unlikely(align)) { -+ if (align) { - error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev, - align, 0, ap->eof, 0, ap->conv, - &ap->offset, &ap->length); -@@ -3792,7 +3792,7 @@ xfs_bmap_btalloc( - args.minlen = ap->minlen; - } - /* apply extent size hints if obtained earlier */ -- if (unlikely(align)) { -+ if (align) { - args.prod = align; - if ((args.mod = (xfs_extlen_t)do_mod(ap->offset, args.prod))) - args.mod = (xfs_extlen_t)(args.prod - args.mod); -@@ -3903,7 +3903,6 @@ xfs_bmap_btalloc( - args.fsbno = 0; - args.type = XFS_ALLOCTYPE_FIRST_AG; - args.total = ap->minlen; -- args.minleft = 0; - if ((error = xfs_alloc_vextent(&args))) - return error; - ap->dfops->dop_low = true; -@@ -4437,8 +4436,6 @@ xfs_bmapi_allocate( - if (error) - return error; - -- if (bma->dfops->dop_low) -- bma->minleft = 0; - if (bma->cur) - bma->cur->bc_private.b.firstblock = *bma->firstblock; - if (bma->blkno == NULLFSBLOCK) -@@ -4610,8 +4607,6 @@ xfs_bmapi_write( - int n; /* current extent index */ - xfs_fileoff_t obno; /* old block number (offset) */ - int whichfork; /* data or attr fork */ -- char inhole; /* current location is hole in file */ -- char wasdelay; /* old extent was delayed */ - - #ifdef DEBUG - xfs_fileoff_t orig_bno; /* original block number value */ -@@ -4697,22 +4692,44 @@ xfs_bmapi_write( - bma.firstblock = firstblock; - - while (bno < end && n < *nmap) { -- inhole = eof || bma.got.br_startoff > bno; -- wasdelay = !inhole && isnullstartblock(bma.got.br_startblock); -+ bool need_alloc = false, wasdelay = false; - -- /* -- * Make sure we only reflink into a hole. -- */ -- if (flags & XFS_BMAPI_REMAP) -- ASSERT(inhole); -- if (flags & XFS_BMAPI_COWFORK) -- ASSERT(!inhole); -+ /* in hole or beyoned EOF? */ -+ if (eof || bma.got.br_startoff > bno) { -+ if (flags & XFS_BMAPI_DELALLOC) { -+ /* -+ * For the COW fork we can reasonably get a -+ * request for converting an extent that races -+ * with other threads already having converted -+ * part of it, as there converting COW to -+ * regular blocks is not protected using the -+ * IOLOCK. -+ */ -+ ASSERT(flags & XFS_BMAPI_COWFORK); -+ if (!(flags & XFS_BMAPI_COWFORK)) { -+ error = -EIO; -+ goto error0; -+ } -+ -+ if (eof || bno >= end) -+ break; -+ } else { -+ need_alloc = true; -+ } -+ } else { -+ /* -+ * Make sure we only reflink into a hole. -+ */ -+ ASSERT(!(flags & XFS_BMAPI_REMAP)); -+ if (isnullstartblock(bma.got.br_startblock)) -+ wasdelay = true; -+ } - - /* - * First, deal with the hole before the allocated space - * that we found, if any. - */ -- if (inhole || wasdelay) { -+ if (need_alloc || wasdelay) { - bma.eof = eof; - bma.conv = !!(flags & XFS_BMAPI_CONVERT); - bma.wasdel = wasdelay; -diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h -index d6d175a..e7d40b3 100644 ---- a/fs/xfs/libxfs/xfs_bmap.h -+++ b/fs/xfs/libxfs/xfs_bmap.h -@@ -110,6 +110,9 @@ struct xfs_extent_free_item - /* Map something in the CoW fork. */ - #define XFS_BMAPI_COWFORK 0x200 - -+/* Only convert delalloc space, don't allocate entirely new extents */ -+#define XFS_BMAPI_DELALLOC 0x400 -+ - #define XFS_BMAPI_FLAGS \ - { XFS_BMAPI_ENTIRE, "ENTIRE" }, \ - { XFS_BMAPI_METADATA, "METADATA" }, \ -@@ -120,7 +123,8 @@ struct xfs_extent_free_item - { XFS_BMAPI_CONVERT, "CONVERT" }, \ - { XFS_BMAPI_ZERO, "ZERO" }, \ - { XFS_BMAPI_REMAP, "REMAP" }, \ -- { XFS_BMAPI_COWFORK, "COWFORK" } -+ { XFS_BMAPI_COWFORK, "COWFORK" }, \ -+ { XFS_BMAPI_DELALLOC, "DELALLOC" } - - - static inline int xfs_bmapi_aflag(int w) -diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c -index 049fa59..f76c169 100644 ---- a/fs/xfs/libxfs/xfs_bmap_btree.c -+++ b/fs/xfs/libxfs/xfs_bmap_btree.c -@@ -502,12 +502,11 @@ xfs_bmbt_alloc_block( - if (args.fsbno == NULLFSBLOCK && args.minleft) { - /* - * Could not find an AG with enough free space to satisfy -- * a full btree split. Try again without minleft and if -+ * a full btree split. Try again and if - * successful activate the lowspace algorithm. - */ - args.fsbno = 0; - args.type = XFS_ALLOCTYPE_FIRST_AG; -- args.minleft = 0; - error = xfs_alloc_vextent(&args); - if (error) - goto error0; -diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c -index 20a96dd..7825d78 100644 ---- a/fs/xfs/libxfs/xfs_dir2.c -+++ b/fs/xfs/libxfs/xfs_dir2.c -@@ -36,21 +36,29 @@ - struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2, XFS_DIR3_FT_DIR }; - - /* -- * @mode, if set, indicates that the type field needs to be set up. -- * This uses the transformation from file mode to DT_* as defined in linux/fs.h -- * for file type specification. This will be propagated into the directory -- * structure if appropriate for the given operation and filesystem config. -+ * Convert inode mode to directory entry filetype - */ --const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = { -- [0] = XFS_DIR3_FT_UNKNOWN, -- [S_IFREG >> S_SHIFT] = XFS_DIR3_FT_REG_FILE, -- [S_IFDIR >> S_SHIFT] = XFS_DIR3_FT_DIR, -- [S_IFCHR >> S_SHIFT] = XFS_DIR3_FT_CHRDEV, -- [S_IFBLK >> S_SHIFT] = XFS_DIR3_FT_BLKDEV, -- [S_IFIFO >> S_SHIFT] = XFS_DIR3_FT_FIFO, -- [S_IFSOCK >> S_SHIFT] = XFS_DIR3_FT_SOCK, -- [S_IFLNK >> S_SHIFT] = XFS_DIR3_FT_SYMLINK, --}; -+unsigned char xfs_mode_to_ftype(int mode) -+{ -+ switch (mode & S_IFMT) { -+ case S_IFREG: -+ return XFS_DIR3_FT_REG_FILE; -+ case S_IFDIR: -+ return XFS_DIR3_FT_DIR; -+ case S_IFCHR: -+ return XFS_DIR3_FT_CHRDEV; -+ case S_IFBLK: -+ return XFS_DIR3_FT_BLKDEV; -+ case S_IFIFO: -+ return XFS_DIR3_FT_FIFO; -+ case S_IFSOCK: -+ return XFS_DIR3_FT_SOCK; -+ case S_IFLNK: -+ return XFS_DIR3_FT_SYMLINK; -+ default: -+ return XFS_DIR3_FT_UNKNOWN; -+ } -+} - - /* - * ASCII case-insensitive (ie. A-Z) support for directories that was -@@ -631,7 +639,8 @@ xfs_dir2_isblock( - if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK))) - return rval; - rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize; -- ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize); -+ if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize) -+ return -EFSCORRUPTED; - *vp = rval; - return 0; - } -diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h -index becc926..ae0d55b 100644 ---- a/fs/xfs/libxfs/xfs_dir2.h -+++ b/fs/xfs/libxfs/xfs_dir2.h -@@ -18,6 +18,9 @@ - #ifndef __XFS_DIR2_H__ - #define __XFS_DIR2_H__ - -+#include "xfs_da_format.h" -+#include "xfs_da_btree.h" -+ - struct xfs_defer_ops; - struct xfs_da_args; - struct xfs_inode; -@@ -32,10 +35,9 @@ struct xfs_dir2_data_unused; - extern struct xfs_name xfs_name_dotdot; - - /* -- * directory filetype conversion tables. -+ * Convert inode mode to directory entry filetype - */ --#define S_SHIFT 12 --extern const unsigned char xfs_mode_to_ftype[]; -+extern unsigned char xfs_mode_to_ftype(int mode); - - /* - * directory operations vector for encode/decode routines -diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c -index c906e50..37ee7f0 100644 ---- a/fs/xfs/libxfs/xfs_inode_buf.c -+++ b/fs/xfs/libxfs/xfs_inode_buf.c -@@ -29,6 +29,7 @@ - #include "xfs_icache.h" - #include "xfs_trans.h" - #include "xfs_ialloc.h" -+#include "xfs_dir2.h" - - /* - * Check that none of the inode's in the buffer have a next -@@ -386,6 +387,7 @@ xfs_dinode_verify( - struct xfs_inode *ip, - struct xfs_dinode *dip) - { -+ uint16_t mode; - uint16_t flags; - uint64_t flags2; - -@@ -396,8 +398,12 @@ xfs_dinode_verify( - if (be64_to_cpu(dip->di_size) & (1ULL << 63)) - return false; - -- /* No zero-length symlinks. */ -- if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0) -+ mode = be16_to_cpu(dip->di_mode); -+ if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN) -+ return false; -+ -+ /* No zero-length symlinks/dirs. */ -+ if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0) - return false; - - /* only version 3 or greater inodes are extensively verified here */ -diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c -index 2580262..584ec89 100644 ---- a/fs/xfs/libxfs/xfs_sb.c -+++ b/fs/xfs/libxfs/xfs_sb.c -@@ -242,7 +242,7 @@ xfs_mount_validate_sb( - sbp->sb_blocklog < XFS_MIN_BLOCKSIZE_LOG || - sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG || - sbp->sb_blocksize != (1 << sbp->sb_blocklog) || -- sbp->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG || -+ sbp->sb_dirblklog + sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG || - sbp->sb_inodesize < XFS_DINODE_MIN_SIZE || - sbp->sb_inodesize > XFS_DINODE_MAX_SIZE || - sbp->sb_inodelog < XFS_DINODE_MIN_LOG || -diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c -index 0670a8b..efb8ccd 100644 ---- a/fs/xfs/xfs_bmap_util.c -+++ b/fs/xfs/xfs_bmap_util.c -@@ -528,7 +528,6 @@ xfs_getbmap( - xfs_bmbt_irec_t *map; /* buffer for user's data */ - xfs_mount_t *mp; /* file system mount point */ - int nex; /* # of user extents can do */ -- int nexleft; /* # of user extents left */ - int subnex; /* # of bmapi's can do */ - int nmap; /* number of map entries */ - struct getbmapx *out; /* output structure */ -@@ -686,10 +685,8 @@ xfs_getbmap( - goto out_free_map; - } - -- nexleft = nex; -- - do { -- nmap = (nexleft > subnex) ? subnex : nexleft; -+ nmap = (nex> subnex) ? subnex : nex; - error = xfs_bmapi_read(ip, XFS_BB_TO_FSBT(mp, bmv->bmv_offset), - XFS_BB_TO_FSB(mp, bmv->bmv_length), - map, &nmap, bmapi_flags); -@@ -697,8 +694,8 @@ xfs_getbmap( - goto out_free_map; - ASSERT(nmap <= subnex); - -- for (i = 0; i < nmap && nexleft && bmv->bmv_length && -- cur_ext < bmv->bmv_count; i++) { -+ for (i = 0; i < nmap && bmv->bmv_length && -+ cur_ext < bmv->bmv_count - 1; i++) { - out[cur_ext].bmv_oflags = 0; - if (map[i].br_state == XFS_EXT_UNWRITTEN) - out[cur_ext].bmv_oflags |= BMV_OF_PREALLOC; -@@ -760,16 +757,27 @@ xfs_getbmap( - continue; - } - -+ /* -+ * In order to report shared extents accurately, -+ * we report each distinct shared/unshared part -+ * of a single bmbt record using multiple bmap -+ * extents. To make that happen, we iterate the -+ * same map array item multiple times, each -+ * time trimming out the subextent that we just -+ * reported. -+ * -+ * Because of this, we must check the out array -+ * index (cur_ext) directly against bmv_count-1 -+ * to avoid overflows. -+ */ - if (inject_map.br_startblock != NULLFSBLOCK) { - map[i] = inject_map; - i--; -- } else -- nexleft--; -+ } - bmv->bmv_entries++; - cur_ext++; - } -- } while (nmap && nexleft && bmv->bmv_length && -- cur_ext < bmv->bmv_count); -+ } while (nmap && bmv->bmv_length && cur_ext < bmv->bmv_count - 1); - - out_free_map: - kmem_free(map); -diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c -index b5b9bff..d7a67d7 100644 ---- a/fs/xfs/xfs_buf.c -+++ b/fs/xfs/xfs_buf.c -@@ -423,6 +423,7 @@ xfs_buf_allocate_memory( - out_free_pages: - for (i = 0; i < bp->b_page_count; i++) - __free_page(bp->b_pages[i]); -+ bp->b_flags &= ~_XBF_PAGES; - return error; - } - -diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c -index 7a30b8f..9d06cc3 100644 ---- a/fs/xfs/xfs_dquot.c -+++ b/fs/xfs/xfs_dquot.c -@@ -710,6 +710,10 @@ xfs_dq_get_next_id( - /* Simple advance */ - next_id = *id + 1; - -+ /* If we'd wrap past the max ID, stop */ -+ if (next_id < *id) -+ return -ENOENT; -+ - /* If new ID is within the current chunk, advancing it sufficed */ - if (next_id % mp->m_quotainfo->qi_dqperchunk) { - *id = next_id; -diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c -index 15a83813..cdc6bdd 100644 ---- a/fs/xfs/xfs_iomap.c -+++ b/fs/xfs/xfs_iomap.c -@@ -681,7 +681,7 @@ xfs_iomap_write_allocate( - xfs_trans_t *tp; - int nimaps; - int error = 0; -- int flags = 0; -+ int flags = XFS_BMAPI_DELALLOC; - int nres; - - if (whichfork == XFS_COW_FORK) -diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c -index 405a65c..f5e0f60 100644 ---- a/fs/xfs/xfs_iops.c -+++ b/fs/xfs/xfs_iops.c -@@ -98,12 +98,27 @@ xfs_init_security( - static void - xfs_dentry_to_name( - struct xfs_name *namep, -+ struct dentry *dentry) -+{ -+ namep->name = dentry->d_name.name; -+ namep->len = dentry->d_name.len; -+ namep->type = XFS_DIR3_FT_UNKNOWN; -+} -+ -+static int -+xfs_dentry_mode_to_name( -+ struct xfs_name *namep, - struct dentry *dentry, - int mode) - { - namep->name = dentry->d_name.name; - namep->len = dentry->d_name.len; -- namep->type = xfs_mode_to_ftype[(mode & S_IFMT) >> S_SHIFT]; -+ namep->type = xfs_mode_to_ftype(mode); -+ -+ if (unlikely(namep->type == XFS_DIR3_FT_UNKNOWN)) -+ return -EFSCORRUPTED; -+ -+ return 0; - } - - STATIC void -@@ -119,7 +134,7 @@ xfs_cleanup_inode( - * xfs_init_security we must back out. - * ENOSPC can hit here, among other things. - */ -- xfs_dentry_to_name(&teardown, dentry, 0); -+ xfs_dentry_to_name(&teardown, dentry); - - xfs_remove(XFS_I(dir), &teardown, XFS_I(inode)); - } -@@ -154,8 +169,12 @@ xfs_generic_create( - if (error) - return error; - -+ /* Verify mode is valid also for tmpfile case */ -+ error = xfs_dentry_mode_to_name(&name, dentry, mode); -+ if (unlikely(error)) -+ goto out_free_acl; -+ - if (!tmpfile) { -- xfs_dentry_to_name(&name, dentry, mode); - error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip); - } else { - error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip); -@@ -248,7 +267,7 @@ xfs_vn_lookup( - if (dentry->d_name.len >= MAXNAMELEN) - return ERR_PTR(-ENAMETOOLONG); - -- xfs_dentry_to_name(&name, dentry, 0); -+ xfs_dentry_to_name(&name, dentry); - error = xfs_lookup(XFS_I(dir), &name, &cip, NULL); - if (unlikely(error)) { - if (unlikely(error != -ENOENT)) -@@ -275,7 +294,7 @@ xfs_vn_ci_lookup( - if (dentry->d_name.len >= MAXNAMELEN) - return ERR_PTR(-ENAMETOOLONG); - -- xfs_dentry_to_name(&xname, dentry, 0); -+ xfs_dentry_to_name(&xname, dentry); - error = xfs_lookup(XFS_I(dir), &xname, &ip, &ci_name); - if (unlikely(error)) { - if (unlikely(error != -ENOENT)) -@@ -310,7 +329,9 @@ xfs_vn_link( - struct xfs_name name; - int error; - -- xfs_dentry_to_name(&name, dentry, inode->i_mode); -+ error = xfs_dentry_mode_to_name(&name, dentry, inode->i_mode); -+ if (unlikely(error)) -+ return error; - - error = xfs_link(XFS_I(dir), XFS_I(inode), &name); - if (unlikely(error)) -@@ -329,7 +350,7 @@ xfs_vn_unlink( - struct xfs_name name; - int error; - -- xfs_dentry_to_name(&name, dentry, 0); -+ xfs_dentry_to_name(&name, dentry); - - error = xfs_remove(XFS_I(dir), &name, XFS_I(d_inode(dentry))); - if (error) -@@ -359,7 +380,9 @@ xfs_vn_symlink( - - mode = S_IFLNK | - (irix_symlink_mode ? 0777 & ~current_umask() : S_IRWXUGO); -- xfs_dentry_to_name(&name, dentry, mode); -+ error = xfs_dentry_mode_to_name(&name, dentry, mode); -+ if (unlikely(error)) -+ goto out; - - error = xfs_symlink(XFS_I(dir), &name, symname, mode, &cip); - if (unlikely(error)) -@@ -395,6 +418,7 @@ xfs_vn_rename( - { - struct inode *new_inode = d_inode(ndentry); - int omode = 0; -+ int error; - struct xfs_name oname; - struct xfs_name nname; - -@@ -405,8 +429,14 @@ xfs_vn_rename( - if (flags & RENAME_EXCHANGE) - omode = d_inode(ndentry)->i_mode; - -- xfs_dentry_to_name(&oname, odentry, omode); -- xfs_dentry_to_name(&nname, ndentry, d_inode(odentry)->i_mode); -+ error = xfs_dentry_mode_to_name(&oname, odentry, omode); -+ if (omode && unlikely(error)) -+ return error; -+ -+ error = xfs_dentry_mode_to_name(&nname, ndentry, -+ d_inode(odentry)->i_mode); -+ if (unlikely(error)) -+ return error; - - return xfs_rename(XFS_I(odir), &oname, XFS_I(d_inode(odentry)), - XFS_I(ndir), &nname, -diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h -index 68640fb..1455b2520 100644 ---- a/fs/xfs/xfs_linux.h -+++ b/fs/xfs/xfs_linux.h -@@ -330,11 +330,11 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y) - } - - #define ASSERT_ALWAYS(expr) \ -- (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__)) -+ (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__)) - - #ifdef DEBUG - #define ASSERT(expr) \ -- (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__)) -+ (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__)) - - #ifndef STATIC - # define STATIC noinline -@@ -345,7 +345,7 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y) - #ifdef XFS_WARN - - #define ASSERT(expr) \ -- (unlikely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__)) -+ (likely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__)) - - #ifndef STATIC - # define STATIC static noinline -diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c -index 3b74fa0..4017aa9 100644 ---- a/fs/xfs/xfs_log.c -+++ b/fs/xfs/xfs_log.c -@@ -3324,12 +3324,8 @@ xfs_log_force( - xfs_mount_t *mp, - uint flags) - { -- int error; -- - trace_xfs_log_force(mp, 0, _RET_IP_); -- error = _xfs_log_force(mp, flags, NULL); -- if (error) -- xfs_warn(mp, "%s: error %d returned.", __func__, error); -+ _xfs_log_force(mp, flags, NULL); - } - - /* -@@ -3473,12 +3469,8 @@ xfs_log_force_lsn( - xfs_lsn_t lsn, - uint flags) - { -- int error; -- - trace_xfs_log_force(mp, lsn, _RET_IP_); -- error = _xfs_log_force_lsn(mp, lsn, flags, NULL); -- if (error) -- xfs_warn(mp, "%s: error %d returned.", __func__, error); -+ _xfs_log_force_lsn(mp, lsn, flags, NULL); - } - - /* -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index a17ae7b..647532b 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -62,8 +62,13 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb) - - /* TCP Fast Open Cookie as stored in memory */ - struct tcp_fastopen_cookie { -+ union { -+ u8 val[TCP_FASTOPEN_COOKIE_MAX]; -+#if IS_ENABLED(CONFIG_IPV6) -+ struct in6_addr addr; -+#endif -+ }; - s8 len; -- u8 val[TCP_FASTOPEN_COOKIE_MAX]; - bool exp; /* In RFC6994 experimental option format */ - }; - -diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h -index 1c912f8..f211c34 100644 ---- a/include/linux/virtio_net.h -+++ b/include/linux/virtio_net.h -@@ -56,7 +56,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, - - static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, - struct virtio_net_hdr *hdr, -- bool little_endian) -+ bool little_endian, -+ bool has_data_valid) - { - memset(hdr, 0, sizeof(*hdr)); - -@@ -91,7 +92,8 @@ static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, - skb_checksum_start_offset(skb)); - hdr->csum_offset = __cpu_to_virtio16(little_endian, - skb->csum_offset); -- } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) { -+ } else if (has_data_valid && -+ skb->ip_summed == CHECKSUM_UNNECESSARY) { - hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID; - } /* else everything is zero */ - -diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h -index ea3f80f..fc7c0db 100644 ---- a/include/net/lwtunnel.h -+++ b/include/net/lwtunnel.h -@@ -43,13 +43,12 @@ struct lwtunnel_encap_ops { - int (*get_encap_size)(struct lwtunnel_state *lwtstate); - int (*cmp_encap)(struct lwtunnel_state *a, struct lwtunnel_state *b); - int (*xmit)(struct sk_buff *skb); -+ -+ struct module *owner; - }; - - #ifdef CONFIG_LWTUNNEL --static inline void lwtstate_free(struct lwtunnel_state *lws) --{ -- kfree(lws); --} -+void lwtstate_free(struct lwtunnel_state *lws); - - static inline struct lwtunnel_state * - lwtstate_get(struct lwtunnel_state *lws) -@@ -106,6 +105,8 @@ int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *op, - unsigned int num); - int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op, - unsigned int num); -+int lwtunnel_valid_encap_type(u16 encap_type); -+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len); - int lwtunnel_build_state(struct net_device *dev, u16 encap_type, - struct nlattr *encap, - unsigned int family, const void *cfg, -@@ -169,6 +170,15 @@ static inline int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op, - return -EOPNOTSUPP; - } - -+static inline int lwtunnel_valid_encap_type(u16 encap_type) -+{ -+ return -EOPNOTSUPP; -+} -+static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len) -+{ -+ return -EOPNOTSUPP; -+} -+ - static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type, - struct nlattr *encap, - unsigned int family, const void *cfg, -diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c -index 655a7d4..983f0b5 100644 ---- a/net/ax25/ax25_subr.c -+++ b/net/ax25/ax25_subr.c -@@ -264,7 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason) - { - ax25_clear_queues(ax25); - -- if (!sock_flag(ax25->sk, SOCK_DESTROY)) -+ if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) - ax25_stop_heartbeat(ax25); - ax25_stop_t1timer(ax25); - ax25_stop_t2timer(ax25); -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index e99037c..0474106 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -781,20 +781,6 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[]) - return 0; - } - --static int br_dev_newlink(struct net *src_net, struct net_device *dev, -- struct nlattr *tb[], struct nlattr *data[]) --{ -- struct net_bridge *br = netdev_priv(dev); -- -- if (tb[IFLA_ADDRESS]) { -- spin_lock_bh(&br->lock); -- br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS])); -- spin_unlock_bh(&br->lock); -- } -- -- return register_netdevice(dev); --} -- - static int br_port_slave_changelink(struct net_device *brdev, - struct net_device *dev, - struct nlattr *tb[], -@@ -1093,6 +1079,25 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[], - return 0; - } - -+static int br_dev_newlink(struct net *src_net, struct net_device *dev, -+ struct nlattr *tb[], struct nlattr *data[]) -+{ -+ struct net_bridge *br = netdev_priv(dev); -+ int err; -+ -+ if (tb[IFLA_ADDRESS]) { -+ spin_lock_bh(&br->lock); -+ br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS])); -+ spin_unlock_bh(&br->lock); -+ } -+ -+ err = br_changelink(dev, tb, data); -+ if (err) -+ return err; -+ -+ return register_netdevice(dev); -+} -+ - static size_t br_get_size(const struct net_device *brdev) - { - return nla_total_size(sizeof(u32)) + /* IFLA_BR_FORWARD_DELAY */ -diff --git a/net/core/dev.c b/net/core/dev.c -index e1d731f..df51c50 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2815,9 +2815,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb, - if (skb->ip_summed != CHECKSUM_NONE && - !can_checksum_protocol(features, type)) { - features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); -- } else if (illegal_highdma(skb->dev, skb)) { -- features &= ~NETIF_F_SG; - } -+ if (illegal_highdma(skb->dev, skb)) -+ features &= ~NETIF_F_SG; - - return features; - } -diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c -index e5f84c2..afa64f0 100644 ---- a/net/core/lwtunnel.c -+++ b/net/core/lwtunnel.c -@@ -26,6 +26,7 @@ - #include <net/lwtunnel.h> - #include <net/rtnetlink.h> - #include <net/ip6_fib.h> -+#include <net/nexthop.h> - - #ifdef CONFIG_MODULES - -@@ -65,6 +66,15 @@ EXPORT_SYMBOL(lwtunnel_state_alloc); - static const struct lwtunnel_encap_ops __rcu * - lwtun_encaps[LWTUNNEL_ENCAP_MAX + 1] __read_mostly; - -+void lwtstate_free(struct lwtunnel_state *lws) -+{ -+ const struct lwtunnel_encap_ops *ops = lwtun_encaps[lws->type]; -+ -+ kfree(lws); -+ module_put(ops->owner); -+} -+EXPORT_SYMBOL(lwtstate_free); -+ - int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *ops, - unsigned int num) - { -@@ -110,25 +120,77 @@ int lwtunnel_build_state(struct net_device *dev, u16 encap_type, - ret = -EOPNOTSUPP; - rcu_read_lock(); - ops = rcu_dereference(lwtun_encaps[encap_type]); -+ if (likely(ops && ops->build_state && try_module_get(ops->owner))) { -+ ret = ops->build_state(dev, encap, family, cfg, lws); -+ if (ret) -+ module_put(ops->owner); -+ } -+ rcu_read_unlock(); -+ -+ return ret; -+} -+EXPORT_SYMBOL(lwtunnel_build_state); -+ -+int lwtunnel_valid_encap_type(u16 encap_type) -+{ -+ const struct lwtunnel_encap_ops *ops; -+ int ret = -EINVAL; -+ -+ if (encap_type == LWTUNNEL_ENCAP_NONE || -+ encap_type > LWTUNNEL_ENCAP_MAX) -+ return ret; -+ -+ rcu_read_lock(); -+ ops = rcu_dereference(lwtun_encaps[encap_type]); -+ rcu_read_unlock(); - #ifdef CONFIG_MODULES - if (!ops) { - const char *encap_type_str = lwtunnel_encap_str(encap_type); - - if (encap_type_str) { -- rcu_read_unlock(); -+ __rtnl_unlock(); - request_module("rtnl-lwt-%s", encap_type_str); -+ rtnl_lock(); -+ - rcu_read_lock(); - ops = rcu_dereference(lwtun_encaps[encap_type]); -+ rcu_read_unlock(); - } - } - #endif -- if (likely(ops && ops->build_state)) -- ret = ops->build_state(dev, encap, family, cfg, lws); -- rcu_read_unlock(); -+ return ops ? 0 : -EOPNOTSUPP; -+} -+EXPORT_SYMBOL(lwtunnel_valid_encap_type); - -- return ret; -+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining) -+{ -+ struct rtnexthop *rtnh = (struct rtnexthop *)attr; -+ struct nlattr *nla_entype; -+ struct nlattr *attrs; -+ struct nlattr *nla; -+ u16 encap_type; -+ int attrlen; -+ -+ while (rtnh_ok(rtnh, remaining)) { -+ attrlen = rtnh_attrlen(rtnh); -+ if (attrlen > 0) { -+ attrs = rtnh_attrs(rtnh); -+ nla = nla_find(attrs, attrlen, RTA_ENCAP); -+ nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); -+ -+ if (nla_entype) { -+ encap_type = nla_get_u16(nla_entype); -+ -+ if (lwtunnel_valid_encap_type(encap_type) != 0) -+ return -EOPNOTSUPP; -+ } -+ } -+ rtnh = rtnh_next(rtnh, &remaining); -+ } -+ -+ return 0; - } --EXPORT_SYMBOL(lwtunnel_build_state); -+EXPORT_SYMBOL(lwtunnel_valid_encap_type_attr); - - int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate) - { -diff --git a/net/dsa/slave.c b/net/dsa/slave.c -index 30e2e21..3ff9d97 100644 ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -1201,6 +1201,8 @@ int dsa_slave_suspend(struct net_device *slave_dev) - { - struct dsa_slave_priv *p = netdev_priv(slave_dev); - -+ netif_device_detach(slave_dev); -+ - if (p->phy) { - phy_stop(p->phy); - p->old_pause = -1; -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 3e4f183..5b03d7f 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -46,6 +46,7 @@ - #include <net/rtnetlink.h> - #include <net/xfrm.h> - #include <net/l3mdev.h> -+#include <net/lwtunnel.h> - #include <trace/events/fib.h> - - #ifndef CONFIG_IP_MULTIPLE_TABLES -@@ -676,6 +677,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, - cfg->fc_mx_len = nla_len(attr); - break; - case RTA_MULTIPATH: -+ err = lwtunnel_valid_encap_type_attr(nla_data(attr), -+ nla_len(attr)); -+ if (err < 0) -+ goto errout; - cfg->fc_mp = nla_data(attr); - cfg->fc_mp_len = nla_len(attr); - break; -@@ -690,6 +695,9 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, - break; - case RTA_ENCAP_TYPE: - cfg->fc_encap_type = nla_get_u16(attr); -+ err = lwtunnel_valid_encap_type(cfg->fc_encap_type); -+ if (err < 0) -+ goto errout; - break; - } - } -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index a8508b7..6a40680 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -1278,8 +1278,9 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event, - nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid)) - goto nla_put_failure; - #endif -- if (fi->fib_nh->nh_lwtstate) -- lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate); -+ if (fi->fib_nh->nh_lwtstate && -+ lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate) < 0) -+ goto nla_put_failure; - } - #ifdef CONFIG_IP_ROUTE_MULTIPATH - if (fi->fib_nhs > 1) { -@@ -1315,8 +1316,10 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event, - nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid)) - goto nla_put_failure; - #endif -- if (nh->nh_lwtstate) -- lwtunnel_fill_encap(skb, nh->nh_lwtstate); -+ if (nh->nh_lwtstate && -+ lwtunnel_fill_encap(skb, nh->nh_lwtstate) < 0) -+ goto nla_put_failure; -+ - /* length of rtnetlink header + attributes */ - rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh; - } endfor_nexthops(fi); -diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c -index fed3d29..0fd1976 100644 ---- a/net/ipv4/ip_tunnel_core.c -+++ b/net/ipv4/ip_tunnel_core.c -@@ -313,6 +313,7 @@ static const struct lwtunnel_encap_ops ip_tun_lwt_ops = { - .fill_encap = ip_tun_fill_encap_info, - .get_encap_size = ip_tun_encap_nlsize, - .cmp_encap = ip_tun_cmp_encap, -+ .owner = THIS_MODULE, - }; - - static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = { -@@ -403,6 +404,7 @@ static const struct lwtunnel_encap_ops ip6_tun_lwt_ops = { - .fill_encap = ip6_tun_fill_encap_info, - .get_encap_size = ip6_tun_encap_nlsize, - .cmp_encap = ip_tun_cmp_encap, -+ .owner = THIS_MODULE, - }; - - void __init ip_tunnel_core_init(void) -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 8197b06..d851cae 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2440,7 +2440,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id, - r->rtm_dst_len = 32; - r->rtm_src_len = 0; - r->rtm_tos = fl4->flowi4_tos; -- r->rtm_table = table_id; -+ r->rtm_table = table_id < 256 ? table_id : RT_TABLE_COMPAT; - if (nla_put_u32(skb, RTA_TABLE, table_id)) - goto nla_put_failure; - r->rtm_type = rt->rt_type; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 4e777a3..dd2560c 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -113,7 +113,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req, - struct tcp_fastopen_cookie tmp; - - if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) { -- struct in6_addr *buf = (struct in6_addr *) tmp.val; -+ struct in6_addr *buf = &tmp.addr; - int i; - - for (i = 0; i < 4; i++) -@@ -205,6 +205,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, - * scaled. So correct it appropriately. - */ - tp->snd_wnd = ntohs(tcp_hdr(skb)->window); -+ tp->max_window = tp->snd_wnd; - - /* Activate the retrans timer so that SYNACK can be retransmitted. - * The request socket is not added to the ehash -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 4bc5ba3..95dfcba 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -5515,8 +5515,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf) - struct net_device *dev; - struct inet6_dev *idev; - -- rcu_read_lock(); -- for_each_netdev_rcu(net, dev) { -+ for_each_netdev(net, dev) { - idev = __in6_dev_get(dev); - if (idev) { - int changed = (!idev->cnf.disable_ipv6) ^ (!newf); -@@ -5525,7 +5524,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf) - dev_disable_change(idev); - } - } -- rcu_read_unlock(); - } - - static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf) -diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c -index e50c27a..f3db364 100644 ---- a/net/ipv6/ila/ila_lwt.c -+++ b/net/ipv6/ila/ila_lwt.c -@@ -164,6 +164,7 @@ static const struct lwtunnel_encap_ops ila_encap_ops = { - .fill_encap = ila_fill_encap_info, - .get_encap_size = ila_encap_nlsize, - .cmp_encap = ila_encap_cmp, -+ .owner = THIS_MODULE, - }; - - int ila_lwt_init(void) -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index d76674e..f95437f 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1108,7 +1108,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, - t->parms.name); - goto tx_err_dst_release; - } -- mtu = dst_mtu(dst) - psh_hlen; -+ mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen; - if (encap_limit >= 0) { - max_headroom += 8; - mtu -= 8; -@@ -1117,7 +1117,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, - mtu = IPV6_MIN_MTU; - if (skb_dst(skb) && !t->parms.collect_md) - skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); -- if (skb->len > mtu && !skb_is_gso(skb)) { -+ if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) { - *pmtu = mtu; - err = -EMSGSIZE; - goto tx_err_dst_release; -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 1b57e11..bff4460 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -2885,6 +2885,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, - if (tb[RTA_MULTIPATH]) { - cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]); - cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]); -+ -+ err = lwtunnel_valid_encap_type_attr(cfg->fc_mp, -+ cfg->fc_mp_len); -+ if (err < 0) -+ goto errout; - } - - if (tb[RTA_PREF]) { -@@ -2898,9 +2903,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, - if (tb[RTA_ENCAP]) - cfg->fc_encap = tb[RTA_ENCAP]; - -- if (tb[RTA_ENCAP_TYPE]) -+ if (tb[RTA_ENCAP_TYPE]) { - cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]); - -+ err = lwtunnel_valid_encap_type(cfg->fc_encap_type); -+ if (err < 0) -+ goto errout; -+ } -+ - if (tb[RTA_EXPIRES]) { - unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ); - -@@ -3306,7 +3316,8 @@ static int rt6_fill_node(struct net *net, - if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags))) - goto nla_put_failure; - -- lwtunnel_fill_encap(skb, rt->dst.lwtstate); -+ if (lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0) -+ goto nla_put_failure; - - nlmsg_end(skb, nlh); - return 0; -diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c -index 15fe976..5b77377 100644 ---- a/net/mpls/af_mpls.c -+++ b/net/mpls/af_mpls.c -@@ -98,18 +98,19 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) - } - EXPORT_SYMBOL_GPL(mpls_pkt_too_big); - --static u32 mpls_multipath_hash(struct mpls_route *rt, -- struct sk_buff *skb, bool bos) -+static u32 mpls_multipath_hash(struct mpls_route *rt, struct sk_buff *skb) - { - struct mpls_entry_decoded dec; -+ unsigned int mpls_hdr_len = 0; - struct mpls_shim_hdr *hdr; - bool eli_seen = false; - int label_index; - u32 hash = 0; - -- for (label_index = 0; label_index < MAX_MP_SELECT_LABELS && !bos; -+ for (label_index = 0; label_index < MAX_MP_SELECT_LABELS; - label_index++) { -- if (!pskb_may_pull(skb, sizeof(*hdr) * label_index)) -+ mpls_hdr_len += sizeof(*hdr); -+ if (!pskb_may_pull(skb, mpls_hdr_len)) - break; - - /* Read and decode the current label */ -@@ -134,37 +135,38 @@ static u32 mpls_multipath_hash(struct mpls_route *rt, - eli_seen = true; - } - -- bos = dec.bos; -- if (bos && pskb_may_pull(skb, sizeof(*hdr) * label_index + -- sizeof(struct iphdr))) { -+ if (!dec.bos) -+ continue; -+ -+ /* found bottom label; does skb have room for a header? */ -+ if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) { - const struct iphdr *v4hdr; - -- v4hdr = (const struct iphdr *)(mpls_hdr(skb) + -- label_index); -+ v4hdr = (const struct iphdr *)(hdr + 1); - if (v4hdr->version == 4) { - hash = jhash_3words(ntohl(v4hdr->saddr), - ntohl(v4hdr->daddr), - v4hdr->protocol, hash); - } else if (v4hdr->version == 6 && -- pskb_may_pull(skb, sizeof(*hdr) * label_index + -- sizeof(struct ipv6hdr))) { -+ pskb_may_pull(skb, mpls_hdr_len + -+ sizeof(struct ipv6hdr))) { - const struct ipv6hdr *v6hdr; - -- v6hdr = (const struct ipv6hdr *)(mpls_hdr(skb) + -- label_index); -- -+ v6hdr = (const struct ipv6hdr *)(hdr + 1); - hash = __ipv6_addr_jhash(&v6hdr->saddr, hash); - hash = __ipv6_addr_jhash(&v6hdr->daddr, hash); - hash = jhash_1word(v6hdr->nexthdr, hash); - } - } -+ -+ break; - } - - return hash; - } - - static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt, -- struct sk_buff *skb, bool bos) -+ struct sk_buff *skb) - { - int alive = ACCESS_ONCE(rt->rt_nhn_alive); - u32 hash = 0; -@@ -180,7 +182,7 @@ static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt, - if (alive <= 0) - return NULL; - -- hash = mpls_multipath_hash(rt, skb, bos); -+ hash = mpls_multipath_hash(rt, skb); - nh_index = hash % alive; - if (alive == rt->rt_nhn) - goto out; -@@ -278,17 +280,11 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev, - hdr = mpls_hdr(skb); - dec = mpls_entry_decode(hdr); - -- /* Pop the label */ -- skb_pull(skb, sizeof(*hdr)); -- skb_reset_network_header(skb); -- -- skb_orphan(skb); -- - rt = mpls_route_input_rcu(net, dec.label); - if (!rt) - goto drop; - -- nh = mpls_select_multipath(rt, skb, dec.bos); -+ nh = mpls_select_multipath(rt, skb); - if (!nh) - goto drop; - -@@ -297,6 +293,12 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev, - if (!mpls_output_possible(out_dev)) - goto drop; - -+ /* Pop the label */ -+ skb_pull(skb, sizeof(*hdr)); -+ skb_reset_network_header(skb); -+ -+ skb_orphan(skb); -+ - if (skb_warn_if_lro(skb)) - goto drop; - -diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c -index cf52cf3..bc9aaf5 100644 ---- a/net/mpls/mpls_iptunnel.c -+++ b/net/mpls/mpls_iptunnel.c -@@ -218,6 +218,7 @@ static const struct lwtunnel_encap_ops mpls_iptun_ops = { - .fill_encap = mpls_fill_encap_info, - .get_encap_size = mpls_encap_nlsize, - .cmp_encap = mpls_encap_cmp, -+ .owner = THIS_MODULE, - }; - - static int __init mpls_iptunnel_init(void) -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index fecefa2..eab210b 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -514,7 +514,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, - int hooknum, nh_off, err = NF_ACCEPT; - - nh_off = skb_network_offset(skb); -- skb_pull(skb, nh_off); -+ skb_pull_rcsum(skb, nh_off); - - /* See HOOK2MANIP(). */ - if (maniptype == NF_NAT_MANIP_SRC) -@@ -579,6 +579,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, - err = nf_nat_packet(ct, ctinfo, hooknum, skb); - push: - skb_push(skb, nh_off); -+ skb_postpush_rcsum(skb, skb->data, nh_off); - - return err; - } -@@ -890,7 +891,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb, - - /* The conntrack module expects to be working at L3. */ - nh_ofs = skb_network_offset(skb); -- skb_pull(skb, nh_ofs); -+ skb_pull_rcsum(skb, nh_ofs); - - if (key->ip.frag != OVS_FRAG_TYPE_NONE) { - err = handle_fragments(net, key, info->zone.id, skb); -@@ -904,6 +905,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb, - err = ovs_ct_lookup(net, key, info, skb); - - skb_push(skb, nh_ofs); -+ skb_postpush_rcsum(skb, skb->data, nh_ofs); - if (err) - kfree_skb(skb); - return err; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index dd23323..94e4a59 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1972,7 +1972,7 @@ static int __packet_rcv_vnet(const struct sk_buff *skb, - { - *vnet_hdr = (const struct virtio_net_hdr) { 0 }; - -- if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le())) -+ if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le(), true)) - BUG(); - - return 0; -diff --git a/net/sched/act_api.c b/net/sched/act_api.c -index f893d18..c6c2a93 100644 ---- a/net/sched/act_api.c -+++ b/net/sched/act_api.c -@@ -903,8 +903,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n, - goto err; - } - act->order = i; -- if (event == RTM_GETACTION) -- act->tcfa_refcnt++; - list_add_tail(&act->list, &actions); - } - -@@ -917,7 +915,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n, - return ret; - } - err: -- tcf_action_destroy(&actions, 0); -+ if (event != RTM_GETACTION) -+ tcf_action_destroy(&actions, 0); - return ret; - } - -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 2358f26..2d03d5b 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -995,6 +995,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - unsigned int hash; - struct unix_address *addr; - struct hlist_head *list; -+ struct path path = { NULL, NULL }; - - err = -EINVAL; - if (sunaddr->sun_family != AF_UNIX) -@@ -1010,9 +1011,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - goto out; - addr_len = err; - -+ if (sun_path[0]) { -+ umode_t mode = S_IFSOCK | -+ (SOCK_INODE(sock)->i_mode & ~current_umask()); -+ err = unix_mknod(sun_path, mode, &path); -+ if (err) { -+ if (err == -EEXIST) -+ err = -EADDRINUSE; -+ goto out; -+ } -+ } -+ - err = mutex_lock_interruptible(&u->bindlock); - if (err) -- goto out; -+ goto out_put; - - err = -EINVAL; - if (u->addr) -@@ -1029,16 +1041,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - atomic_set(&addr->refcnt, 1); - - if (sun_path[0]) { -- struct path path; -- umode_t mode = S_IFSOCK | -- (SOCK_INODE(sock)->i_mode & ~current_umask()); -- err = unix_mknod(sun_path, mode, &path); -- if (err) { -- if (err == -EEXIST) -- err = -EADDRINUSE; -- unix_release_addr(addr); -- goto out_up; -- } - addr->hash = UNIX_HASH_SIZE; - hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1); - spin_lock(&unix_table_lock); -@@ -1065,6 +1067,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - spin_unlock(&unix_table_lock); - out_up: - mutex_unlock(&u->bindlock); -+out_put: -+ if (err) -+ path_put(&path); - out: - return err; - } diff --git a/4.9.9/1008_linux-4.9.9.patch b/4.9.9/1008_linux-4.9.9.patch deleted file mode 100644 index 411ce9b..0000000 --- a/4.9.9/1008_linux-4.9.9.patch +++ /dev/null @@ -1,2333 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1130803..c0c41c9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 9 --SUBLEVEL = 8 -+SUBLEVEL = 9 - EXTRAVERSION = - NAME = Roaring Lionus - -diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S -index c53dbea..838dad5 100644 ---- a/arch/arm64/crypto/aes-modes.S -+++ b/arch/arm64/crypto/aes-modes.S -@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt) - cbz w6, .Lcbcencloop - - ld1 {v0.16b}, [x5] /* get iv */ -- enc_prepare w3, x2, x5 -+ enc_prepare w3, x2, x6 - - .Lcbcencloop: - ld1 {v1.16b}, [x1], #16 /* get next pt block */ - eor v0.16b, v0.16b, v1.16b /* ..and xor with iv */ -- encrypt_block v0, w3, x2, x5, w6 -+ encrypt_block v0, w3, x2, x6, w7 - st1 {v0.16b}, [x0], #16 - subs w4, w4, #1 - bne .Lcbcencloop -+ st1 {v0.16b}, [x5] /* return iv */ - ret - AES_ENDPROC(aes_cbc_encrypt) - -@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt) - cbz w6, .LcbcdecloopNx - - ld1 {v7.16b}, [x5] /* get iv */ -- dec_prepare w3, x2, x5 -+ dec_prepare w3, x2, x6 - - .LcbcdecloopNx: - #if INTERLEAVE >= 2 -@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt) - .Lcbcdecloop: - ld1 {v1.16b}, [x1], #16 /* get next ct block */ - mov v0.16b, v1.16b /* ...and copy to v0 */ -- decrypt_block v0, w3, x2, x5, w6 -+ decrypt_block v0, w3, x2, x6, w7 - eor v0.16b, v0.16b, v7.16b /* xor with iv => pt */ - mov v7.16b, v1.16b /* ct is next iv */ - st1 {v0.16b}, [x0], #16 -@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt) - bne .Lcbcdecloop - .Lcbcdecout: - FRAME_POP -+ st1 {v7.16b}, [x5] /* return iv */ - ret - AES_ENDPROC(aes_cbc_decrypt) - -@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt) - - AES_ENTRY(aes_ctr_encrypt) - FRAME_PUSH -- cbnz w6, .Lctrfirst /* 1st time around? */ -- umov x5, v4.d[1] /* keep swabbed ctr in reg */ -- rev x5, x5 --#if INTERLEAVE >= 2 -- cmn w5, w4 /* 32 bit overflow? */ -- bcs .Lctrinc -- add x5, x5, #1 /* increment BE ctr */ -- b .LctrincNx --#else -- b .Lctrinc --#endif --.Lctrfirst: -+ cbz w6, .Lctrnotfirst /* 1st time around? */ - enc_prepare w3, x2, x6 - ld1 {v4.16b}, [x5] -- umov x5, v4.d[1] /* keep swabbed ctr in reg */ -- rev x5, x5 -+ -+.Lctrnotfirst: -+ umov x8, v4.d[1] /* keep swabbed ctr in reg */ -+ rev x8, x8 - #if INTERLEAVE >= 2 -- cmn w5, w4 /* 32 bit overflow? */ -+ cmn w8, w4 /* 32 bit overflow? */ - bcs .Lctrloop - .LctrloopNx: - subs w4, w4, #INTERLEAVE -@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt) - #if INTERLEAVE == 2 - mov v0.8b, v4.8b - mov v1.8b, v4.8b -- rev x7, x5 -- add x5, x5, #1 -+ rev x7, x8 -+ add x8, x8, #1 - ins v0.d[1], x7 -- rev x7, x5 -- add x5, x5, #1 -+ rev x7, x8 -+ add x8, x8, #1 - ins v1.d[1], x7 - ld1 {v2.16b-v3.16b}, [x1], #32 /* get 2 input blocks */ - do_encrypt_block2x -@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt) - st1 {v0.16b-v1.16b}, [x0], #32 - #else - ldr q8, =0x30000000200000001 /* addends 1,2,3[,0] */ -- dup v7.4s, w5 -+ dup v7.4s, w8 - mov v0.16b, v4.16b - add v7.4s, v7.4s, v8.4s - mov v1.16b, v4.16b -@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt) - eor v2.16b, v7.16b, v2.16b - eor v3.16b, v5.16b, v3.16b - st1 {v0.16b-v3.16b}, [x0], #64 -- add x5, x5, #INTERLEAVE -+ add x8, x8, #INTERLEAVE - #endif -- cbz w4, .LctroutNx --.LctrincNx: -- rev x7, x5 -+ rev x7, x8 - ins v4.d[1], x7 -+ cbz w4, .Lctrout - b .LctrloopNx --.LctroutNx: -- sub x5, x5, #1 -- rev x7, x5 -- ins v4.d[1], x7 -- b .Lctrout - .Lctr1x: - adds w4, w4, #INTERLEAVE - beq .Lctrout -@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt) - .Lctrloop: - mov v0.16b, v4.16b - encrypt_block v0, w3, x2, x6, w7 -+ -+ adds x8, x8, #1 /* increment BE ctr */ -+ rev x7, x8 -+ ins v4.d[1], x7 -+ bcs .Lctrcarry /* overflow? */ -+ -+.Lctrcarrydone: - subs w4, w4, #1 - bmi .Lctrhalfblock /* blocks < 0 means 1/2 block */ - ld1 {v3.16b}, [x1], #16 - eor v3.16b, v0.16b, v3.16b - st1 {v3.16b}, [x0], #16 -- beq .Lctrout --.Lctrinc: -- adds x5, x5, #1 /* increment BE ctr */ -- rev x7, x5 -- ins v4.d[1], x7 -- bcc .Lctrloop /* no overflow? */ -- umov x7, v4.d[0] /* load upper word of ctr */ -- rev x7, x7 /* ... to handle the carry */ -- add x7, x7, #1 -- rev x7, x7 -- ins v4.d[0], x7 -- b .Lctrloop -+ bne .Lctrloop -+ -+.Lctrout: -+ st1 {v4.16b}, [x5] /* return next CTR value */ -+ FRAME_POP -+ ret -+ - .Lctrhalfblock: - ld1 {v3.8b}, [x1] - eor v3.8b, v0.8b, v3.8b - st1 {v3.8b}, [x0] --.Lctrout: - FRAME_POP - ret -+ -+.Lctrcarry: -+ umov x7, v4.d[0] /* load upper word of ctr */ -+ rev x7, x7 /* ... to handle the carry */ -+ add x7, x7, #1 -+ rev x7, x7 -+ ins v4.d[0], x7 -+ b .Lctrcarrydone - AES_ENDPROC(aes_ctr_encrypt) - .ltorg - -diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h -index b312b15..6e834ca 100644 ---- a/arch/powerpc/include/asm/cpu_has_feature.h -+++ b/arch/powerpc/include/asm/cpu_has_feature.h -@@ -23,7 +23,9 @@ static __always_inline bool cpu_has_feature(unsigned long feature) - { - int i; - -+#ifndef __clang__ /* clang can't cope with this */ - BUILD_BUG_ON(!__builtin_constant_p(feature)); -+#endif - - #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG - if (!static_key_initialized) { -diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h -index e311c25..a244e09 100644 ---- a/arch/powerpc/include/asm/mmu.h -+++ b/arch/powerpc/include/asm/mmu.h -@@ -160,7 +160,9 @@ static __always_inline bool mmu_has_feature(unsigned long feature) - { - int i; - -+#ifndef __clang__ /* clang can't cope with this */ - BUILD_BUG_ON(!__builtin_constant_p(feature)); -+#endif - - #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG - if (!static_key_initialized) { -diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c -index 5c31369..a5dd493 100644 ---- a/arch/powerpc/kernel/eeh_driver.c -+++ b/arch/powerpc/kernel/eeh_driver.c -@@ -545,7 +545,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata) - static void *__eeh_clear_pe_frozen_state(void *data, void *flag) - { - struct eeh_pe *pe = (struct eeh_pe *)data; -- bool *clear_sw_state = flag; -+ bool clear_sw_state = *(bool *)flag; - int i, rc = 1; - - for (i = 0; rc && i < 3; i++) -diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c -index 88ac964..1e8c572 100644 ---- a/arch/powerpc/kernel/prom_init.c -+++ b/arch/powerpc/kernel/prom_init.c -@@ -2747,6 +2747,9 @@ static void __init prom_find_boot_cpu(void) - - cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu); - -+ if (!PHANDLE_VALID(cpu_pkg)) -+ return; -+ - prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval)); - prom.cpu = be32_to_cpu(rval); - -diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c -index ebb7f46..9a25dce 100644 ---- a/arch/powerpc/mm/pgtable-radix.c -+++ b/arch/powerpc/mm/pgtable-radix.c -@@ -65,7 +65,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa, - if (!pmdp) - return -ENOMEM; - if (map_page_size == PMD_SIZE) { -- ptep = (pte_t *)pudp; -+ ptep = pmdp_ptep(pmdp); - goto set_the_pte; - } - ptep = pte_alloc_kernel(pmdp, ea); -@@ -90,7 +90,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa, - } - pmdp = pmd_offset(pudp, ea); - if (map_page_size == PMD_SIZE) { -- ptep = (pte_t *)pudp; -+ ptep = pmdp_ptep(pmdp); - goto set_the_pte; - } - if (!pmd_present(*pmdp)) { -diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c -index dbaaf7dc..19d646a 100644 ---- a/arch/x86/events/intel/uncore.c -+++ b/arch/x86/events/intel/uncore.c -@@ -763,30 +763,6 @@ static void uncore_pmu_unregister(struct intel_uncore_pmu *pmu) - pmu->registered = false; - } - --static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu) --{ -- struct intel_uncore_pmu *pmu = type->pmus; -- struct intel_uncore_box *box; -- int i, pkg; -- -- if (pmu) { -- pkg = topology_physical_package_id(cpu); -- for (i = 0; i < type->num_boxes; i++, pmu++) { -- box = pmu->boxes[pkg]; -- if (box) -- uncore_box_exit(box); -- } -- } --} -- --static void uncore_exit_boxes(void *dummy) --{ -- struct intel_uncore_type **types; -- -- for (types = uncore_msr_uncores; *types; types++) -- __uncore_exit_boxes(*types++, smp_processor_id()); --} -- - static void uncore_free_boxes(struct intel_uncore_pmu *pmu) - { - int pkg; -@@ -1077,22 +1053,12 @@ static int uncore_cpu_dying(unsigned int cpu) - return 0; - } - --static int first_init; -- - static int uncore_cpu_starting(unsigned int cpu) - { - struct intel_uncore_type *type, **types = uncore_msr_uncores; - struct intel_uncore_pmu *pmu; - struct intel_uncore_box *box; -- int i, pkg, ncpus = 1; -- -- if (first_init) { -- /* -- * On init we get the number of online cpus in the package -- * and set refcount for all of them. -- */ -- ncpus = cpumask_weight(topology_core_cpumask(cpu)); -- } -+ int i, pkg; - - pkg = topology_logical_package_id(cpu); - for (; *types; types++) { -@@ -1103,7 +1069,7 @@ static int uncore_cpu_starting(unsigned int cpu) - if (!box) - continue; - /* The first cpu on a package activates the box */ -- if (atomic_add_return(ncpus, &box->refcnt) == ncpus) -+ if (atomic_inc_return(&box->refcnt) == 1) - uncore_box_init(box); - } - } -@@ -1407,19 +1373,17 @@ static int __init intel_uncore_init(void) - "PERF_X86_UNCORE_PREP", - uncore_cpu_prepare, NULL); - } -- first_init = 1; -+ - cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING, - "AP_PERF_X86_UNCORE_STARTING", - uncore_cpu_starting, uncore_cpu_dying); -- first_init = 0; -+ - cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE, - "AP_PERF_X86_UNCORE_ONLINE", - uncore_event_cpu_online, uncore_event_cpu_offline); - return 0; - - err: -- /* Undo box->init_box() */ -- on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1); - uncore_types_exit(uncore_msr_uncores); - uncore_pci_exit(); - return ret; -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 3d8ff40..7249f15 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2118,6 +2118,7 @@ static inline void __init check_timer(void) - if (idx != -1 && irq_trigger(idx)) - unmask_ioapic_irq(irq_get_chip_data(0)); - } -+ irq_domain_deactivate_irq(irq_data); - irq_domain_activate_irq(irq_data); - if (timer_irq_works()) { - if (disable_timer_pin_1 > 0) -@@ -2139,6 +2140,7 @@ static inline void __init check_timer(void) - * legacy devices should be connected to IO APIC #0 - */ - replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2); -+ irq_domain_deactivate_irq(irq_data); - irq_domain_activate_irq(irq_data); - legacy_pic->unmask(0); - if (timer_irq_works()) { -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index 274fab9..932348fb 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -352,6 +352,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer) - } else { - struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt); - -+ irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq)); - irq_domain_activate_irq(irq_get_irq_data(hdev->irq)); - disable_irq(hdev->irq); - irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu)); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 487b957..731044e 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -3148,6 +3148,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu) - memcpy(dest, xsave, XSAVE_HDR_OFFSET); - - /* Set XSTATE_BV */ -+ xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE; - *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv; - - /* -diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c -index 319148b..2f25a36 100644 ---- a/arch/x86/platform/efi/efi_64.c -+++ b/arch/x86/platform/efi/efi_64.c -@@ -269,6 +269,22 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - efi_scratch.use_pgd = true; - - /* -+ * Certain firmware versions are way too sentimential and still believe -+ * they are exclusive and unquestionable owners of the first physical page, -+ * even though they explicitly mark it as EFI_CONVENTIONAL_MEMORY -+ * (but then write-access it later during SetVirtualAddressMap()). -+ * -+ * Create a 1:1 mapping for this page, to avoid triple faults during early -+ * boot with such firmware. We are free to hand this page to the BIOS, -+ * as trim_bios_range() will reserve the first page and isolate it away -+ * from memory allocators anyway. -+ */ -+ if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) { -+ pr_err("Failed to create 1:1 mapping for the first page!\n"); -+ return 1; -+ } -+ -+ /* - * When making calls to the firmware everything needs to be 1:1 - * mapped and addressable with 32-bit pointers. Map the kernel - * text and allocate a new stack because we can't rely on the -diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c -index 88a044a..32cdc2c 100644 ---- a/arch/xtensa/kernel/setup.c -+++ b/arch/xtensa/kernel/setup.c -@@ -540,7 +540,7 @@ subsys_initcall(topology_init); - - void cpu_reset(void) - { --#if XCHAL_HAVE_PTP_MMU -+#if XCHAL_HAVE_PTP_MMU && IS_ENABLED(CONFIG_MMU) - local_irq_disable(); - /* - * We have full MMU: all autoload ways, ways 7, 8 and 9 of DTLB must -diff --git a/crypto/algapi.c b/crypto/algapi.c -index df939b5..1fad2a6 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -356,6 +356,7 @@ int crypto_register_alg(struct crypto_alg *alg) - struct crypto_larval *larval; - int err; - -+ alg->cra_flags &= ~CRYPTO_ALG_DEAD; - err = crypto_check_alg(alg); - if (err) - return err; -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 223a770..33e363d 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -1695,6 +1695,8 @@ unsigned ata_exec_internal_sg(struct ata_device *dev, - - if (qc->err_mask & ~AC_ERR_OTHER) - qc->err_mask &= ~AC_ERR_OTHER; -+ } else if (qc->tf.command == ATA_CMD_REQ_SENSE_DATA) { -+ qc->result_tf.command |= ATA_SENSE; - } - - /* finish up */ -@@ -4316,10 +4318,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 }, - - /* -- * Device times out with higher max sects. -+ * These devices time out with higher max sects. - * https://bugzilla.kernel.org/show_bug.cgi?id=121671 - */ -- { "LITEON CX1-JB256-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 }, -+ { "LITEON CX1-JB*-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 }, - - /* Devices we expect to fail diagnostics */ - -diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c -index 823e938..2f32782 100644 ---- a/drivers/ata/sata_mv.c -+++ b/drivers/ata/sata_mv.c -@@ -4132,6 +4132,9 @@ static int mv_platform_probe(struct platform_device *pdev) - host->iomap = NULL; - hpriv->base = devm_ioremap(&pdev->dev, res->start, - resource_size(res)); -+ if (!hpriv->base) -+ return -ENOMEM; -+ - hpriv->base -= SATAHC0_REG_BASE; - - hpriv->clk = clk_get(&pdev->dev, NULL); -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index e7f86a8..c5cdd19 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -391,33 +391,33 @@ static ssize_t show_valid_zones(struct device *dev, - { - struct memory_block *mem = to_memory_block(dev); - unsigned long start_pfn, end_pfn; -+ unsigned long valid_start, valid_end, valid_pages; - unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block; -- struct page *first_page; - struct zone *zone; - int zone_shift = 0; - - start_pfn = section_nr_to_pfn(mem->start_section_nr); - end_pfn = start_pfn + nr_pages; -- first_page = pfn_to_page(start_pfn); - - /* The block contains more than one zone can not be offlined. */ -- if (!test_pages_in_a_zone(start_pfn, end_pfn)) -+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end)) - return sprintf(buf, "none\n"); - -- zone = page_zone(first_page); -+ zone = page_zone(pfn_to_page(valid_start)); -+ valid_pages = valid_end - valid_start; - - /* MMOP_ONLINE_KEEP */ - sprintf(buf, "%s", zone->name); - - /* MMOP_ONLINE_KERNEL */ -- zone_can_shift(start_pfn, nr_pages, ZONE_NORMAL, &zone_shift); -+ zone_can_shift(valid_start, valid_pages, ZONE_NORMAL, &zone_shift); - if (zone_shift) { - strcat(buf, " "); - strcat(buf, (zone + zone_shift)->name); - } - - /* MMOP_ONLINE_MOVABLE */ -- zone_can_shift(start_pfn, nr_pages, ZONE_MOVABLE, &zone_shift); -+ zone_can_shift(valid_start, valid_pages, ZONE_MOVABLE, &zone_shift); - if (zone_shift) { - strcat(buf, " "); - strcat(buf, (zone + zone_shift)->name); -diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h -index f642c42..168fa17 100644 ---- a/drivers/bcma/bcma_private.h -+++ b/drivers/bcma/bcma_private.h -@@ -45,6 +45,9 @@ int bcma_sprom_get(struct bcma_bus *bus); - void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc); - void bcma_core_chipcommon_init(struct bcma_drv_cc *cc); - void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable); -+#ifdef CONFIG_BCMA_DRIVER_MIPS -+void bcma_chipco_serial_init(struct bcma_drv_cc *cc); -+#endif /* CONFIG_BCMA_DRIVER_MIPS */ - - /* driver_chipcommon_b.c */ - int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb); -diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c -index b4f6520..62f5bfa 100644 ---- a/drivers/bcma/driver_chipcommon.c -+++ b/drivers/bcma/driver_chipcommon.c -@@ -15,8 +15,6 @@ - #include <linux/platform_device.h> - #include <linux/bcma/bcma.h> - --static void bcma_chipco_serial_init(struct bcma_drv_cc *cc); -- - static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset, - u32 mask, u32 value) - { -@@ -186,9 +184,6 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc) - if (cc->capabilities & BCMA_CC_CAP_PMU) - bcma_pmu_early_init(cc); - -- if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC) -- bcma_chipco_serial_init(cc); -- - if (bus->hosttype == BCMA_HOSTTYPE_SOC) - bcma_core_chipcommon_flash_detect(cc); - -@@ -378,9 +373,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value) - return res; - } - --static void bcma_chipco_serial_init(struct bcma_drv_cc *cc) -+#ifdef CONFIG_BCMA_DRIVER_MIPS -+void bcma_chipco_serial_init(struct bcma_drv_cc *cc) - { --#if IS_BUILTIN(CONFIG_BCM47XX) - unsigned int irq; - u32 baud_base; - u32 i; -@@ -422,5 +417,5 @@ static void bcma_chipco_serial_init(struct bcma_drv_cc *cc) - ports[i].baud_base = baud_base; - ports[i].reg_shift = 0; - } --#endif /* CONFIG_BCM47XX */ - } -+#endif /* CONFIG_BCMA_DRIVER_MIPS */ -diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c -index 96f1713..89af807 100644 ---- a/drivers/bcma/driver_mips.c -+++ b/drivers/bcma/driver_mips.c -@@ -278,9 +278,12 @@ static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore) - - void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) - { -+ struct bcma_bus *bus = mcore->core->bus; -+ - if (mcore->early_setup_done) - return; - -+ bcma_chipco_serial_init(&bus->drv_cc); - bcma_core_mips_nvram_init(mcore); - - mcore->early_setup_done = true; -diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c -index d5ba43a..55c1782 100644 ---- a/drivers/dma/cppi41.c -+++ b/drivers/dma/cppi41.c -@@ -153,6 +153,8 @@ struct cppi41_dd { - - /* context for suspend/resume */ - unsigned int dma_tdfdq; -+ -+ bool is_suspended; - }; - - #define FIST_COMPLETION_QUEUE 93 -@@ -257,6 +259,10 @@ static struct cppi41_channel *desc_to_chan(struct cppi41_dd *cdd, u32 desc) - BUG_ON(desc_num >= ALLOC_DECS_NUM); - c = cdd->chan_busy[desc_num]; - cdd->chan_busy[desc_num] = NULL; -+ -+ /* Usecount for chan_busy[], paired with push_desc_queue() */ -+ pm_runtime_put(cdd->ddev.dev); -+ - return c; - } - -@@ -447,6 +453,15 @@ static void push_desc_queue(struct cppi41_channel *c) - */ - __iowmb(); - -+ /* -+ * DMA transfers can take at least 200ms to complete with USB mass -+ * storage connected. To prevent autosuspend timeouts, we must use -+ * pm_runtime_get/put() when chan_busy[] is modified. This will get -+ * cleared in desc_to_chan() or cppi41_stop_chan() depending on the -+ * outcome of the transfer. -+ */ -+ pm_runtime_get(cdd->ddev.dev); -+ - desc_phys = lower_32_bits(c->desc_phys); - desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc); - WARN_ON(cdd->chan_busy[desc_num]); -@@ -457,20 +472,26 @@ static void push_desc_queue(struct cppi41_channel *c) - cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num)); - } - --static void pending_desc(struct cppi41_channel *c) -+/* -+ * Caller must hold cdd->lock to prevent push_desc_queue() -+ * getting called out of order. We have both cppi41_dma_issue_pending() -+ * and cppi41_runtime_resume() call this function. -+ */ -+static void cppi41_run_queue(struct cppi41_dd *cdd) - { -- struct cppi41_dd *cdd = c->cdd; -- unsigned long flags; -+ struct cppi41_channel *c, *_c; - -- spin_lock_irqsave(&cdd->lock, flags); -- list_add_tail(&c->node, &cdd->pending); -- spin_unlock_irqrestore(&cdd->lock, flags); -+ list_for_each_entry_safe(c, _c, &cdd->pending, node) { -+ push_desc_queue(c); -+ list_del(&c->node); -+ } - } - - static void cppi41_dma_issue_pending(struct dma_chan *chan) - { - struct cppi41_channel *c = to_cpp41_chan(chan); - struct cppi41_dd *cdd = c->cdd; -+ unsigned long flags; - int error; - - error = pm_runtime_get(cdd->ddev.dev); -@@ -482,10 +503,11 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan) - return; - } - -- if (likely(pm_runtime_active(cdd->ddev.dev))) -- push_desc_queue(c); -- else -- pending_desc(c); -+ spin_lock_irqsave(&cdd->lock, flags); -+ list_add_tail(&c->node, &cdd->pending); -+ if (!cdd->is_suspended) -+ cppi41_run_queue(cdd); -+ spin_unlock_irqrestore(&cdd->lock, flags); - - pm_runtime_mark_last_busy(cdd->ddev.dev); - pm_runtime_put_autosuspend(cdd->ddev.dev); -@@ -705,6 +727,9 @@ static int cppi41_stop_chan(struct dma_chan *chan) - WARN_ON(!cdd->chan_busy[desc_num]); - cdd->chan_busy[desc_num] = NULL; - -+ /* Usecount for chan_busy[], paired with push_desc_queue() */ -+ pm_runtime_put(cdd->ddev.dev); -+ - return 0; - } - -@@ -1150,8 +1175,12 @@ static int __maybe_unused cppi41_resume(struct device *dev) - static int __maybe_unused cppi41_runtime_suspend(struct device *dev) - { - struct cppi41_dd *cdd = dev_get_drvdata(dev); -+ unsigned long flags; - -+ spin_lock_irqsave(&cdd->lock, flags); -+ cdd->is_suspended = true; - WARN_ON(!list_empty(&cdd->pending)); -+ spin_unlock_irqrestore(&cdd->lock, flags); - - return 0; - } -@@ -1159,14 +1188,11 @@ static int __maybe_unused cppi41_runtime_suspend(struct device *dev) - static int __maybe_unused cppi41_runtime_resume(struct device *dev) - { - struct cppi41_dd *cdd = dev_get_drvdata(dev); -- struct cppi41_channel *c, *_c; - unsigned long flags; - - spin_lock_irqsave(&cdd->lock, flags); -- list_for_each_entry_safe(c, _c, &cdd->pending, node) { -- push_desc_queue(c); -- list_del(&c->node); -- } -+ cdd->is_suspended = false; -+ cppi41_run_queue(cdd); - spin_unlock_irqrestore(&cdd->lock, flags); - - return 0; -diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c -index 921dfa0..260c4b4 100644 ---- a/drivers/firmware/efi/libstub/fdt.c -+++ b/drivers/firmware/efi/libstub/fdt.c -@@ -187,6 +187,7 @@ static efi_status_t update_fdt_memmap(void *fdt, struct efi_boot_memmap *map) - struct exit_boot_struct { - efi_memory_desc_t *runtime_map; - int *runtime_entry_count; -+ void *new_fdt_addr; - }; - - static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg, -@@ -202,7 +203,7 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg, - efi_get_virtmap(*map->map, *map->map_size, *map->desc_size, - p->runtime_map, p->runtime_entry_count); - -- return EFI_SUCCESS; -+ return update_fdt_memmap(p->new_fdt_addr, map); - } - - /* -@@ -300,22 +301,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table, - - priv.runtime_map = runtime_map; - priv.runtime_entry_count = &runtime_entry_count; -+ priv.new_fdt_addr = (void *)*new_fdt_addr; - status = efi_exit_boot_services(sys_table, handle, &map, &priv, - exit_boot_func); - - if (status == EFI_SUCCESS) { - efi_set_virtual_address_map_t *svam; - -- status = update_fdt_memmap((void *)*new_fdt_addr, &map); -- if (status != EFI_SUCCESS) { -- /* -- * The kernel won't get far without the memory map, but -- * may still be able to print something meaningful so -- * return success here. -- */ -- return EFI_SUCCESS; -- } -- - /* Install the new virtual address map */ - svam = sys_table->runtime->set_virtual_address_map; - status = svam(runtime_entry_count * desc_size, desc_size, -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -index b13c8aa..6df924f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -@@ -227,6 +227,9 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev) - } - WREG32(HDP_REG_COHERENCY_FLUSH_CNTL, 0); - -+ if (adev->mode_info.num_crtc) -+ amdgpu_display_set_vga_render_state(adev, false); -+ - gmc_v6_0_mc_stop(adev, &save); - - if (gmc_v6_0_wait_for_idle((void *)adev)) { -@@ -256,7 +259,6 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev) - dev_warn(adev->dev, "Wait for MC idle timedout !\n"); - } - gmc_v6_0_mc_resume(adev, &save); -- amdgpu_display_set_vga_render_state(adev, false); - } - - static int gmc_v6_0_mc_init(struct amdgpu_device *adev) -diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c -index 67db157..4147e51 100644 ---- a/drivers/gpu/drm/i915/intel_lrc.c -+++ b/drivers/gpu/drm/i915/intel_lrc.c -@@ -2152,30 +2152,42 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx, - - void intel_lr_context_resume(struct drm_i915_private *dev_priv) - { -- struct i915_gem_context *ctx = dev_priv->kernel_context; - struct intel_engine_cs *engine; -+ struct i915_gem_context *ctx; -+ -+ /* Because we emit WA_TAIL_DWORDS there may be a disparity -+ * between our bookkeeping in ce->ring->head and ce->ring->tail and -+ * that stored in context. As we only write new commands from -+ * ce->ring->tail onwards, everything before that is junk. If the GPU -+ * starts reading from its RING_HEAD from the context, it may try to -+ * execute that junk and die. -+ * -+ * So to avoid that we reset the context images upon resume. For -+ * simplicity, we just zero everything out. -+ */ -+ list_for_each_entry(ctx, &dev_priv->context_list, link) { -+ for_each_engine(engine, dev_priv) { -+ struct intel_context *ce = &ctx->engine[engine->id]; -+ u32 *reg; - -- for_each_engine(engine, dev_priv) { -- struct intel_context *ce = &ctx->engine[engine->id]; -- void *vaddr; -- uint32_t *reg_state; -- -- if (!ce->state) -- continue; -- -- vaddr = i915_gem_object_pin_map(ce->state->obj, I915_MAP_WB); -- if (WARN_ON(IS_ERR(vaddr))) -- continue; -+ if (!ce->state) -+ continue; - -- reg_state = vaddr + LRC_STATE_PN * PAGE_SIZE; -+ reg = i915_gem_object_pin_map(ce->state->obj, -+ I915_MAP_WB); -+ if (WARN_ON(IS_ERR(reg))) -+ continue; - -- reg_state[CTX_RING_HEAD+1] = 0; -- reg_state[CTX_RING_TAIL+1] = 0; -+ reg += LRC_STATE_PN * PAGE_SIZE / sizeof(*reg); -+ reg[CTX_RING_HEAD+1] = 0; -+ reg[CTX_RING_TAIL+1] = 0; - -- ce->state->obj->dirty = true; -- i915_gem_object_unpin_map(ce->state->obj); -+ ce->state->obj->dirty = true; -+ i915_gem_object_unpin_map(ce->state->obj); - -- ce->ring->head = 0; -- ce->ring->tail = 0; -+ ce->ring->head = ce->ring->tail = 0; -+ ce->ring->last_retired_head = -1; -+ intel_ring_update_space(ce->ring); -+ } - } - } -diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c -index 74856a8..e64f524 100644 ---- a/drivers/gpu/drm/nouveau/dispnv04/hw.c -+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c -@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) - uint32_t mpllP; - - pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP); -+ mpllP = (mpllP >> 8) & 0xf; - if (!mpllP) - mpllP = 4; - -@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) - uint32_t clock; - - pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock); -- return clock; -+ return clock / 1000; - } - - ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals); -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -index 6f0436d..f8f2f16 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1) - ); - } - for (i = 0; i < size; i++) -- nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]); -+ nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]); - for (; i < 0x60; i++) - nvkm_wr32(device, 0x61c440 + soff, (i << 8)); - nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003); -diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c -index 60d3020..e06c134 100644 ---- a/drivers/hid/hid-cp2112.c -+++ b/drivers/hid/hid-cp2112.c -@@ -167,7 +167,7 @@ struct cp2112_device { - atomic_t xfer_avail; - struct gpio_chip gc; - u8 *in_out_buffer; -- spinlock_t lock; -+ struct mutex lock; - }; - - static int gpio_push_pull = 0xFF; -@@ -179,10 +179,9 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset) - struct cp2112_device *dev = gpiochip_get_data(chip); - struct hid_device *hdev = dev->hdev; - u8 *buf = dev->in_out_buffer; -- unsigned long flags; - int ret; - -- spin_lock_irqsave(&dev->lock, flags); -+ mutex_lock(&dev->lock); - - ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, - CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, -@@ -206,8 +205,8 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset) - ret = 0; - - exit: -- spin_unlock_irqrestore(&dev->lock, flags); -- return ret <= 0 ? ret : -EIO; -+ mutex_unlock(&dev->lock); -+ return ret < 0 ? ret : -EIO; - } - - static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value) -@@ -215,10 +214,9 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - struct cp2112_device *dev = gpiochip_get_data(chip); - struct hid_device *hdev = dev->hdev; - u8 *buf = dev->in_out_buffer; -- unsigned long flags; - int ret; - -- spin_lock_irqsave(&dev->lock, flags); -+ mutex_lock(&dev->lock); - - buf[0] = CP2112_GPIO_SET; - buf[1] = value ? 0xff : 0; -@@ -230,7 +228,7 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - if (ret < 0) - hid_err(hdev, "error setting GPIO values: %d\n", ret); - -- spin_unlock_irqrestore(&dev->lock, flags); -+ mutex_unlock(&dev->lock); - } - - static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset) -@@ -238,10 +236,9 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset) - struct cp2112_device *dev = gpiochip_get_data(chip); - struct hid_device *hdev = dev->hdev; - u8 *buf = dev->in_out_buffer; -- unsigned long flags; - int ret; - -- spin_lock_irqsave(&dev->lock, flags); -+ mutex_lock(&dev->lock); - - ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf, - CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT, -@@ -255,7 +252,7 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset) - ret = (buf[1] >> offset) & 1; - - exit: -- spin_unlock_irqrestore(&dev->lock, flags); -+ mutex_unlock(&dev->lock); - - return ret; - } -@@ -266,10 +263,9 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip, - struct cp2112_device *dev = gpiochip_get_data(chip); - struct hid_device *hdev = dev->hdev; - u8 *buf = dev->in_out_buffer; -- unsigned long flags; - int ret; - -- spin_lock_irqsave(&dev->lock, flags); -+ mutex_lock(&dev->lock); - - ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf, - CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT, -@@ -290,7 +286,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip, - goto fail; - } - -- spin_unlock_irqrestore(&dev->lock, flags); -+ mutex_unlock(&dev->lock); - - /* - * Set gpio value when output direction is already set, -@@ -301,7 +297,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip, - return 0; - - fail: -- spin_unlock_irqrestore(&dev->lock, flags); -+ mutex_unlock(&dev->lock); - return ret < 0 ? ret : -EIO; - } - -@@ -1057,7 +1053,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) - if (!dev->in_out_buffer) - return -ENOMEM; - -- spin_lock_init(&dev->lock); -+ mutex_init(&dev->lock); - - ret = hid_parse(hdev); - if (ret) { -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 575aa65..9845189 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -76,6 +76,9 @@ - #define USB_VENDOR_ID_ALPS_JP 0x044E - #define HID_DEVICE_ID_ALPS_U1_DUAL 0x120B - -+#define USB_VENDOR_ID_AMI 0x046b -+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10 -+ - #define USB_VENDOR_ID_ANTON 0x1130 - #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101 - -diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c -index c5c5fbe..52026dc 100644 ---- a/drivers/hid/hid-lg.c -+++ b/drivers/hid/hid-lg.c -@@ -872,7 +872,7 @@ static const struct hid_device_id lg_devices[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG), - .driver_data = LG_NOGET | LG_FF4 }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2), -- .driver_data = LG_FF2 }, -+ .driver_data = LG_NOGET | LG_FF2 }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940), - .driver_data = LG_FF3 }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR), -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index e6cfd32..cde060f 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -57,6 +57,7 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS }, - { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS }, -+ { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET }, -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 1cb7992..623be90 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -164,19 +164,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom) - wacom->id[0] = STYLUS_DEVICE_ID; - } - -- pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); -- if (features->pressure_max > 255) -- pressure = (pressure << 1) | ((data[4] >> 6) & 1); -- pressure += (features->pressure_max + 1) / 2; -- -- input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); -- input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); -- input_report_abs(input, ABS_PRESSURE, pressure); -- -- input_report_key(input, BTN_TOUCH, data[4] & 0x08); -- input_report_key(input, BTN_STYLUS, data[4] & 0x10); -- /* Only allow the stylus2 button to be reported for the pen tool. */ -- input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); -+ if (prox) { -+ pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); -+ if (features->pressure_max > 255) -+ pressure = (pressure << 1) | ((data[4] >> 6) & 1); -+ pressure += (features->pressure_max + 1) / 2; -+ -+ input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); -+ input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); -+ input_report_abs(input, ABS_PRESSURE, pressure); -+ -+ input_report_key(input, BTN_TOUCH, data[4] & 0x08); -+ input_report_key(input, BTN_STYLUS, data[4] & 0x10); -+ /* Only allow the stylus2 button to be reported for the pen tool. */ -+ input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); -+ } - - if (!prox) - wacom->id[0] = 0; -diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c -index 2bbf0c5..7d61b56 100644 ---- a/drivers/iio/adc/palmas_gpadc.c -+++ b/drivers/iio/adc/palmas_gpadc.c -@@ -775,7 +775,7 @@ static int palmas_adc_wakeup_reset(struct palmas_gpadc *adc) - - static int palmas_gpadc_suspend(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = dev_get_drvdata(dev); - struct palmas_gpadc *adc = iio_priv(indio_dev); - int wakeup = adc->wakeup1_enable || adc->wakeup2_enable; - int ret; -@@ -798,7 +798,7 @@ static int palmas_gpadc_suspend(struct device *dev) - - static int palmas_gpadc_resume(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = dev_get_drvdata(dev); - struct palmas_gpadc *adc = iio_priv(indio_dev); - int wakeup = adc->wakeup1_enable || adc->wakeup2_enable; - int ret; -diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c -index 9a08146..6bb23a4 100644 ---- a/drivers/iio/health/afe4403.c -+++ b/drivers/iio/health/afe4403.c -@@ -422,7 +422,7 @@ MODULE_DEVICE_TABLE(of, afe4403_of_match); - - static int __maybe_unused afe4403_suspend(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev)); - struct afe4403_data *afe = iio_priv(indio_dev); - int ret; - -@@ -443,7 +443,7 @@ static int __maybe_unused afe4403_suspend(struct device *dev) - - static int __maybe_unused afe4403_resume(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev)); - struct afe4403_data *afe = iio_priv(indio_dev); - int ret; - -diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c -index 4526640..964f523 100644 ---- a/drivers/iio/health/afe4404.c -+++ b/drivers/iio/health/afe4404.c -@@ -428,7 +428,7 @@ MODULE_DEVICE_TABLE(of, afe4404_of_match); - - static int __maybe_unused afe4404_suspend(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct afe4404_data *afe = iio_priv(indio_dev); - int ret; - -@@ -449,7 +449,7 @@ static int __maybe_unused afe4404_suspend(struct device *dev) - - static int __maybe_unused afe4404_resume(struct device *dev) - { -- struct iio_dev *indio_dev = dev_to_iio_dev(dev); -+ struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct afe4404_data *afe = iio_priv(indio_dev); - int ret; - -diff --git a/drivers/iio/health/max30100.c b/drivers/iio/health/max30100.c -index 90ab8a2d..183c143 100644 ---- a/drivers/iio/health/max30100.c -+++ b/drivers/iio/health/max30100.c -@@ -238,7 +238,7 @@ static irqreturn_t max30100_interrupt_handler(int irq, void *private) - - mutex_lock(&data->lock); - -- while (cnt || (cnt = max30100_fifo_count(data) > 0)) { -+ while (cnt || (cnt = max30100_fifo_count(data)) > 0) { - ret = max30100_read_measurement(data); - if (ret) - break; -diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c -index 9c47bc9..2a22ad9 100644 ---- a/drivers/iio/humidity/dht11.c -+++ b/drivers/iio/humidity/dht11.c -@@ -71,7 +71,8 @@ - * a) select an implementation using busy loop polling on those systems - * b) use the checksum to do some probabilistic decoding - */ --#define DHT11_START_TRANSMISSION 18 /* ms */ -+#define DHT11_START_TRANSMISSION_MIN 18000 /* us */ -+#define DHT11_START_TRANSMISSION_MAX 20000 /* us */ - #define DHT11_MIN_TIMERES 34000 /* ns */ - #define DHT11_THRESHOLD 49000 /* ns */ - #define DHT11_AMBIG_LOW 23000 /* ns */ -@@ -228,7 +229,8 @@ static int dht11_read_raw(struct iio_dev *iio_dev, - ret = gpio_direction_output(dht11->gpio, 0); - if (ret) - goto err; -- msleep(DHT11_START_TRANSMISSION); -+ usleep_range(DHT11_START_TRANSMISSION_MIN, -+ DHT11_START_TRANSMISSION_MAX); - ret = gpio_direction_input(dht11->gpio); - if (ret) - goto err; -diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c -index bb0fde6..cc2243f 100644 ---- a/drivers/infiniband/hw/cxgb4/qp.c -+++ b/drivers/infiniband/hw/cxgb4/qp.c -@@ -321,7 +321,8 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, - FW_RI_RES_WR_DCAEN_V(0) | - FW_RI_RES_WR_DCACPU_V(0) | - FW_RI_RES_WR_FBMIN_V(2) | -- FW_RI_RES_WR_FBMAX_V(2) | -+ (t4_sq_onchip(&wq->sq) ? FW_RI_RES_WR_FBMAX_V(2) : -+ FW_RI_RES_WR_FBMAX_V(3)) | - FW_RI_RES_WR_CIDXFTHRESHO_V(0) | - FW_RI_RES_WR_CIDXFTHRESH_V(0) | - FW_RI_RES_WR_EQSIZE_V(eqsize)); -@@ -345,7 +346,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, - FW_RI_RES_WR_DCAEN_V(0) | - FW_RI_RES_WR_DCACPU_V(0) | - FW_RI_RES_WR_FBMIN_V(2) | -- FW_RI_RES_WR_FBMAX_V(2) | -+ FW_RI_RES_WR_FBMAX_V(3) | - FW_RI_RES_WR_CIDXFTHRESHO_V(0) | - FW_RI_RES_WR_CIDXFTHRESH_V(0) | - FW_RI_RES_WR_EQSIZE_V(eqsize)); -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index e1e274a..ba637ff 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2719,7 +2719,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id) - if (intmask & SDHCI_INT_RETUNE) - mmc_retune_needed(host->mmc); - -- if (intmask & SDHCI_INT_CARD_INT) { -+ if ((intmask & SDHCI_INT_CARD_INT) && -+ (host->ier & SDHCI_INT_CARD_INT)) { - sdhci_enable_sdio_irq_nolock(host, false); - host->thread_isr |= SDHCI_INT_CARD_INT; - result = IRQ_WAKE_THREAD; -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c -index d02ca14..8d3e53f 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c -@@ -91,7 +91,7 @@ - - #define IWL8000_FW_PRE "iwlwifi-8000C-" - #define IWL8000_MODULE_FIRMWARE(api) \ -- IWL8000_FW_PRE "-" __stringify(api) ".ucode" -+ IWL8000_FW_PRE __stringify(api) ".ucode" - - #define IWL8265_FW_PRE "iwlwifi-8265-" - #define IWL8265_MODULE_FIRMWARE(api) \ -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -index fc77188..52de3c6 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -@@ -1144,9 +1144,10 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm, - .frame_limit = IWL_FRAME_LIMIT, - }; - -- /* Make sure reserved queue is still marked as such (or allocated) */ -- mvm->queue_info[mvm_sta->reserved_queue].status = -- IWL_MVM_QUEUE_RESERVED; -+ /* Make sure reserved queue is still marked as such (if allocated) */ -+ if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE) -+ mvm->queue_info[mvm_sta->reserved_queue].status = -+ IWL_MVM_QUEUE_RESERVED; - - for (i = 0; i <= IWL_MAX_TID_COUNT; i++) { - struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i]; -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 0ec649d..b0916b1 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -518,25 +518,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev) - link = kzalloc(sizeof(*link), GFP_KERNEL); - if (!link) - return NULL; -+ - INIT_LIST_HEAD(&link->sibling); - INIT_LIST_HEAD(&link->children); - INIT_LIST_HEAD(&link->link); - link->pdev = pdev; -- if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) { -+ -+ /* -+ * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe -+ * hierarchies. -+ */ -+ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT || -+ pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) { -+ link->root = link; -+ } else { - struct pcie_link_state *parent; -+ - parent = pdev->bus->parent->self->link_state; - if (!parent) { - kfree(link); - return NULL; - } -+ - link->parent = parent; -+ link->root = link->parent->root; - list_add(&link->link, &parent->children); - } -- /* Setup a pointer to the root port link */ -- if (!link->parent) -- link->root = link; -- else -- link->root = link->parent->root; - - list_add(&link->sibling, &link_list); - pdev->link_state = link; -diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c -index 0790153..583ae3f 100644 ---- a/drivers/pinctrl/intel/pinctrl-baytrail.c -+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c -@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct byt_gpio *vg, unsigned int offset, - int reg) - { - struct byt_community *comm = byt_get_community(vg, offset); -- u32 reg_offset = 0; -+ u32 reg_offset; - - if (!comm) - return NULL; - - offset -= comm->pin_base; -- if (reg == BYT_INT_STAT_REG) -+ switch (reg) { -+ case BYT_INT_STAT_REG: - reg_offset = (offset / 32) * 4; -- else -+ break; -+ case BYT_DEBOUNCE_REG: -+ reg_offset = 0; -+ break; -+ default: - reg_offset = comm->pad_map[offset] * 16; -+ break; -+ } - - return comm->reg_base + reg_offset + reg; - } -@@ -1612,7 +1619,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc) - continue; - } - -+ raw_spin_lock(&vg->lock); - pending = readl(reg); -+ raw_spin_unlock(&vg->lock); - for_each_set_bit(pin, &pending, 32) { - virq = irq_find_mapping(vg->chip.irqdomain, base + pin); - generic_handle_irq(virq); -diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c -index 7826c7f..9931be6 100644 ---- a/drivers/pinctrl/intel/pinctrl-merrifield.c -+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c -@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinctrl_dev *pctldev, unsigned int pin, - unsigned int i; - int ret; - -+ if (!mrfld_buf_available(mp, pin)) -+ return -ENOTSUPP; -+ - for (i = 0; i < nconfigs; i++) { - switch (pinconf_to_config_param(configs[i])) { - case PIN_CONFIG_BIAS_DISABLE: -diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c -index e6a512e..a3ade9e 100644 ---- a/drivers/regulator/axp20x-regulator.c -+++ b/drivers/regulator/axp20x-regulator.c -@@ -272,7 +272,7 @@ static const struct regulator_desc axp806_regulators[] = { - 64, AXP806_DCDCD_V_CTRL, 0x3f, AXP806_PWR_OUT_CTRL1, - BIT(3)), - AXP_DESC(AXP806, DCDCE, "dcdce", "vine", 1100, 3400, 100, -- AXP806_DCDCB_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)), -+ AXP806_DCDCE_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)), - AXP_DESC(AXP806, ALDO1, "aldo1", "aldoin", 700, 3300, 100, - AXP806_ALDO1_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(5)), - AXP_DESC(AXP806, ALDO2, "aldo2", "aldoin", 700, 3400, 100, -diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c -index 113f3d6..27f75b1 100644 ---- a/drivers/staging/greybus/timesync_platform.c -+++ b/drivers/staging/greybus/timesync_platform.c -@@ -45,12 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void) - - int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata) - { -+ if (!arche_platform_change_state_cb) -+ return 0; -+ - return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC, - pdata); - } - - void gb_timesync_platform_unlock_bus(void) - { -+ if (!arche_platform_change_state_cb) -+ return; -+ - arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL); - } - -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index d2e50a2..24f9f98 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* CBM - Flash disk */ - { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* WORLDE easy key (easykey.25) MIDI controller */ -+ { USB_DEVICE(0x0218, 0x0401), .driver_info = -+ USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* HP 5300/5370C scanner */ - { USB_DEVICE(0x03f0, 0x0701), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 17989b7..8d412d8 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -2269,6 +2269,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, - if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) - return -EINVAL; - length = le32_to_cpu(d->dwSize); -+ if (len < length) -+ return -EINVAL; - type = le32_to_cpu(d->dwPropertyDataType); - if (type < USB_EXT_PROP_UNICODE || - type > USB_EXT_PROP_UNICODE_MULTI) { -@@ -2277,6 +2279,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, - return -EINVAL; - } - pnl = le16_to_cpu(d->wPropertyNameLength); -+ if (length < 14 + pnl) { -+ pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n", -+ length, pnl, type); -+ return -EINVAL; -+ } - pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl)); - if (length != 14 + pnl + pdl) { - pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", -@@ -2363,6 +2370,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs, - } - } - if (flags & (1 << i)) { -+ if (len < 4) { -+ goto error; -+ } - os_descs_count = get_unaligned_le32(data); - data += 4; - len -= 4; -@@ -2435,7 +2445,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs, - - ENTER(); - -- if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || -+ if (unlikely(len < 16 || -+ get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || - get_unaligned_le32(data + 4) != len)) - goto error; - str_count = get_unaligned_le32(data + 8); -diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c -index c3e172e..338575f 100644 ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -578,11 +578,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb, - | MUSB_PORT_STAT_RESUME; - musb->rh_timer = jiffies - + msecs_to_jiffies(USB_RESUME_TIMEOUT); -- musb->need_finish_resume = 1; -- - musb->xceiv->otg->state = OTG_STATE_A_HOST; - musb->is_active = 1; - musb_host_resume_root_hub(musb); -+ schedule_delayed_work(&musb->finish_resume_work, -+ msecs_to_jiffies(USB_RESUME_TIMEOUT)); - break; - case OTG_STATE_B_WAIT_ACON: - musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL; -@@ -2691,11 +2691,6 @@ static int musb_resume(struct device *dev) - mask = MUSB_DEVCTL_BDEVICE | MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV; - if ((devctl & mask) != (musb->context.devctl & mask)) - musb->port1_status = 0; -- if (musb->need_finish_resume) { -- musb->need_finish_resume = 0; -- schedule_delayed_work(&musb->finish_resume_work, -- msecs_to_jiffies(USB_RESUME_TIMEOUT)); -- } - - /* - * The USB HUB code expects the device to be in RPM_ACTIVE once it came -@@ -2747,12 +2742,6 @@ static int musb_runtime_resume(struct device *dev) - - musb_restore_context(musb); - -- if (musb->need_finish_resume) { -- musb->need_finish_resume = 0; -- schedule_delayed_work(&musb->finish_resume_work, -- msecs_to_jiffies(USB_RESUME_TIMEOUT)); -- } -- - spin_lock_irqsave(&musb->lock, flags); - error = musb_run_resume_work(musb); - if (error) -diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h -index 47331db..854fbf7 100644 ---- a/drivers/usb/musb/musb_core.h -+++ b/drivers/usb/musb/musb_core.h -@@ -410,7 +410,6 @@ struct musb { - - /* is_suspended means USB B_PERIPHERAL suspend */ - unsigned is_suspended:1; -- unsigned need_finish_resume :1; - - /* may_wakeup means remote wakeup is enabled */ - unsigned may_wakeup:1; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 7ce31a4..42cc72e 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 46fca6b..1db4b61 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, - { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, -+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, - { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, - { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, - { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index e3b7af8..09d9be8 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -27,6 +27,7 @@ - #define ATEN_VENDOR_ID 0x0557 - #define ATEN_VENDOR_ID2 0x0547 - #define ATEN_PRODUCT_ID 0x2008 -+#define ATEN_PRODUCT_ID2 0x2118 - - #define IODATA_VENDOR_ID 0x04bb - #define IODATA_PRODUCT_ID 0x0a03 -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 1bc6089..696458d 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = { - {USB_DEVICE(0x1410, 0xa021)}, /* Novatel Gobi 3000 Composite */ - {USB_DEVICE(0x413c, 0x8193)}, /* Dell Gobi 3000 QDL */ - {USB_DEVICE(0x413c, 0x8194)}, /* Dell Gobi 3000 Composite */ -+ {USB_DEVICE(0x413c, 0x81a6)}, /* Dell DW5570 QDL (MC8805) */ - {USB_DEVICE(0x1199, 0x68a4)}, /* Sierra Wireless QDL */ - {USB_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */ - {USB_DEVICE(0x1199, 0x68a8)}, /* Sierra Wireless QDL */ -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index c6f2d89..64613fb 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -130,14 +130,14 @@ static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx, - - static void vhost_init_is_le(struct vhost_virtqueue *vq) - { -- if (vhost_has_feature(vq, VIRTIO_F_VERSION_1)) -- vq->is_le = true; -+ vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1) -+ || virtio_legacy_is_little_endian(); - } - #endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */ - - static void vhost_reset_is_le(struct vhost_virtqueue *vq) - { -- vq->is_le = virtio_legacy_is_little_endian(); -+ vhost_init_is_le(vq); - } - - struct vhost_flush_struct { -@@ -1713,10 +1713,8 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq) - int r; - bool is_le = vq->is_le; - -- if (!vq->private_data) { -- vhost_reset_is_le(vq); -+ if (!vq->private_data) - return 0; -- } - - vhost_init_is_le(vq); - -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index f136048..489bfc6 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -159,13 +159,6 @@ static bool vring_use_dma_api(struct virtio_device *vdev) - if (xen_domain()) - return true; - -- /* -- * On ARM-based machines, the DMA ops will do the right thing, -- * so always use them with legacy devices. -- */ -- if (IS_ENABLED(CONFIG_ARM) || IS_ENABLED(CONFIG_ARM64)) -- return !virtio_has_feature(vdev, VIRTIO_F_VERSION_1); -- - return false; - } - -diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c -index 8f6a2a5..a27fc87 100644 ---- a/fs/cifs/readdir.c -+++ b/fs/cifs/readdir.c -@@ -285,6 +285,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file) - rc = -ENOMEM; - goto error_exit; - } -+ spin_lock_init(&cifsFile->file_info_lock); - file->private_data = cifsFile; - cifsFile->tlink = cifs_get_tlink(tlink); - tcon = tlink_tcon(tlink); -diff --git a/fs/dax.c b/fs/dax.c -index 014defd..bf6218d 100644 ---- a/fs/dax.c -+++ b/fs/dax.c -@@ -1270,6 +1270,11 @@ iomap_dax_actor(struct inode *inode, loff_t pos, loff_t length, void *data, - struct blk_dax_ctl dax = { 0 }; - ssize_t map_len; - -+ if (fatal_signal_pending(current)) { -+ ret = -EINTR; -+ break; -+ } -+ - dax.sector = iomap->blkno + - (((pos & PAGE_MASK) - iomap->offset) >> 9); - dax.size = (length + offset + PAGE_SIZE - 1) & PAGE_MASK; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 478630a..bbc316d 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3827,6 +3827,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); - db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / - EXT4_DESC_PER_BLOCK(sb); -+ if (ext4_has_feature_meta_bg(sb)) { -+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) { -+ ext4_msg(sb, KERN_WARNING, -+ "first meta block group too large: %u " -+ "(group descriptor block count %u)", -+ le32_to_cpu(es->s_first_meta_bg), db_count); -+ goto failed_mount; -+ } -+ } - sbi->s_group_desc = ext4_kvmalloc(db_count * - sizeof(struct buffer_head *), - GFP_KERNEL); -diff --git a/fs/iomap.c b/fs/iomap.c -index a8ee8c3..814ae8f 100644 ---- a/fs/iomap.c -+++ b/fs/iomap.c -@@ -113,6 +113,9 @@ iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, unsigned flags, - - BUG_ON(pos + len > iomap->offset + iomap->length); - -+ if (fatal_signal_pending(current)) -+ return -EINTR; -+ - page = grab_cache_page_write_begin(inode->i_mapping, index, flags); - if (!page) - return -ENOMEM; -diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c -index 42aace4..6481369 100644 ---- a/fs/nfsd/nfs4layouts.c -+++ b/fs/nfsd/nfs4layouts.c -@@ -223,10 +223,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, - struct nfs4_layout_stateid *ls; - struct nfs4_stid *stp; - -- stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache); -+ stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache, -+ nfsd4_free_layout_stateid); - if (!stp) - return NULL; -- stp->sc_free = nfsd4_free_layout_stateid; -+ - get_nfs4_file(fp); - stp->sc_file = fp; - -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 4b4beaa..a0dee8a 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -633,8 +633,8 @@ find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new) - return co; - } - --struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, -- struct kmem_cache *slab) -+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, -+ void (*sc_free)(struct nfs4_stid *)) - { - struct nfs4_stid *stid; - int new_id; -@@ -650,6 +650,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, - idr_preload_end(); - if (new_id < 0) - goto out_free; -+ -+ stid->sc_free = sc_free; - stid->sc_client = cl; - stid->sc_stateid.si_opaque.so_id = new_id; - stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid; -@@ -675,15 +677,12 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, - static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp) - { - struct nfs4_stid *stid; -- struct nfs4_ol_stateid *stp; - -- stid = nfs4_alloc_stid(clp, stateid_slab); -+ stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid); - if (!stid) - return NULL; - -- stp = openlockstateid(stid); -- stp->st_stid.sc_free = nfs4_free_ol_stateid; -- return stp; -+ return openlockstateid(stid); - } - - static void nfs4_free_deleg(struct nfs4_stid *stid) -@@ -781,11 +780,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh, - goto out_dec; - if (delegation_blocked(¤t_fh->fh_handle)) - goto out_dec; -- dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab)); -+ dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg)); - if (dp == NULL) - goto out_dec; - -- dp->dl_stid.sc_free = nfs4_free_deleg; - /* - * delegation seqid's are never incremented. The 4.1 special - * meaning of seqid 0 isn't meaningful, really, but let's avoid -@@ -5580,7 +5578,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo, - stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner); - get_nfs4_file(fp); - stp->st_stid.sc_file = fp; -- stp->st_stid.sc_free = nfs4_free_lock_stateid; - stp->st_access_bmap = 0; - stp->st_deny_bmap = open_stp->st_deny_bmap; - stp->st_openstp = open_stp; -@@ -5623,7 +5620,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi, - lst = find_lock_stateid(lo, fi); - if (lst == NULL) { - spin_unlock(&clp->cl_lock); -- ns = nfs4_alloc_stid(clp, stateid_slab); -+ ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid); - if (ns == NULL) - return NULL; - -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index c939936..4516e8b 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, - __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, - stateid_t *stateid, unsigned char typemask, - struct nfs4_stid **s, struct nfsd_net *nn); --struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, -- struct kmem_cache *slab); -+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, -+ void (*sc_free)(struct nfs4_stid *)); - void nfs4_unhash_stid(struct nfs4_stid *s); - void nfs4_put_stid(struct nfs4_stid *s); - void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid); -diff --git a/include/linux/irq.h b/include/linux/irq.h -index e798755..39e3254 100644 ---- a/include/linux/irq.h -+++ b/include/linux/irq.h -@@ -184,6 +184,7 @@ struct irq_data { - * - * IRQD_TRIGGER_MASK - Mask for the trigger type bits - * IRQD_SETAFFINITY_PENDING - Affinity setting is pending -+ * IRQD_ACTIVATED - Interrupt has already been activated - * IRQD_NO_BALANCING - Balancing disabled for this IRQ - * IRQD_PER_CPU - Interrupt is per cpu - * IRQD_AFFINITY_SET - Interrupt affinity was set -@@ -202,6 +203,7 @@ struct irq_data { - enum { - IRQD_TRIGGER_MASK = 0xf, - IRQD_SETAFFINITY_PENDING = (1 << 8), -+ IRQD_ACTIVATED = (1 << 9), - IRQD_NO_BALANCING = (1 << 10), - IRQD_PER_CPU = (1 << 11), - IRQD_AFFINITY_SET = (1 << 12), -@@ -312,6 +314,21 @@ static inline bool irqd_affinity_is_managed(struct irq_data *d) - return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED; - } - -+static inline bool irqd_is_activated(struct irq_data *d) -+{ -+ return __irqd_to_state(d) & IRQD_ACTIVATED; -+} -+ -+static inline void irqd_set_activated(struct irq_data *d) -+{ -+ __irqd_to_state(d) |= IRQD_ACTIVATED; -+} -+ -+static inline void irqd_clr_activated(struct irq_data *d) -+{ -+ __irqd_to_state(d) &= ~IRQD_ACTIVATED; -+} -+ - #undef __irqd_to_state - - static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d) -diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h -index c1784c0..134a2f6 100644 ---- a/include/linux/memory_hotplug.h -+++ b/include/linux/memory_hotplug.h -@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages); - extern int add_one_highpage(struct page *page, int pfn, int bad_ppro); - /* VM interface that may be used by firmware interface */ - extern int online_pages(unsigned long, unsigned long, int); --extern int test_pages_in_a_zone(unsigned long, unsigned long); -+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, -+ unsigned long *valid_start, unsigned long *valid_end); - extern void __offline_isolated_pages(unsigned long, unsigned long); - - typedef void (*online_page_callback_t)(struct page *page); -diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h -index 1c7eec0..3a481a4 100644 ---- a/include/linux/percpu-refcount.h -+++ b/include/linux/percpu-refcount.h -@@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) - static inline bool percpu_ref_tryget(struct percpu_ref *ref) - { - unsigned long __percpu *percpu_count; -- int ret; -+ bool ret; - - rcu_read_lock_sched(); - -@@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) - static inline bool percpu_ref_tryget_live(struct percpu_ref *ref) - { - unsigned long __percpu *percpu_count; -- int ret = false; -+ bool ret = false; - - rcu_read_lock_sched(); - -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 85bc9be..4e2f3de 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -5219,6 +5219,11 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp, - return ERR_PTR(err); - } - -+/* -+ * The returned cgroup is fully initialized including its control mask, but -+ * it isn't associated with its kernfs_node and doesn't have the control -+ * mask applied. -+ */ - static struct cgroup *cgroup_create(struct cgroup *parent) - { - struct cgroup_root *root = parent->root; -@@ -5283,11 +5288,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent) - - cgroup_propagate_control(cgrp); - -- /* @cgrp doesn't have dir yet so the following will only create csses */ -- ret = cgroup_apply_control_enable(cgrp); -- if (ret) -- goto out_destroy; -- - return cgrp; - - out_cancel_ref: -@@ -5295,9 +5295,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent) - out_free_cgrp: - kfree(cgrp); - return ERR_PTR(ret); --out_destroy: -- cgroup_destroy_locked(cgrp); -- return ERR_PTR(ret); - } - - static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name, -diff --git a/kernel/events/core.c b/kernel/events/core.c -index e5a8839..b1cfd74 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -1469,7 +1469,6 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx) - static void - list_add_event(struct perf_event *event, struct perf_event_context *ctx) - { -- - lockdep_assert_held(&ctx->lock); - - WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT); -@@ -1624,6 +1623,8 @@ static void perf_group_attach(struct perf_event *event) - { - struct perf_event *group_leader = event->group_leader, *pos; - -+ lockdep_assert_held(&event->ctx->lock); -+ - /* - * We can have double attach due to group movement in perf_event_open. - */ -@@ -1697,6 +1698,8 @@ static void perf_group_detach(struct perf_event *event) - struct perf_event *sibling, *tmp; - struct list_head *list = NULL; - -+ lockdep_assert_held(&event->ctx->lock); -+ - /* - * We can have double detach due to exit/hot-unplug + close. - */ -@@ -1895,9 +1898,29 @@ __perf_remove_from_context(struct perf_event *event, - */ - static void perf_remove_from_context(struct perf_event *event, unsigned long flags) - { -- lockdep_assert_held(&event->ctx->mutex); -+ struct perf_event_context *ctx = event->ctx; -+ -+ lockdep_assert_held(&ctx->mutex); - - event_function_call(event, __perf_remove_from_context, (void *)flags); -+ -+ /* -+ * The above event_function_call() can NO-OP when it hits -+ * TASK_TOMBSTONE. In that case we must already have been detached -+ * from the context (by perf_event_exit_event()) but the grouping -+ * might still be in-tact. -+ */ -+ WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT); -+ if ((flags & DETACH_GROUP) && -+ (event->attach_state & PERF_ATTACH_GROUP)) { -+ /* -+ * Since in that case we cannot possibly be scheduled, simply -+ * detach now. -+ */ -+ raw_spin_lock_irq(&ctx->lock); -+ perf_group_detach(event); -+ raw_spin_unlock_irq(&ctx->lock); -+ } - } - - /* -@@ -6583,6 +6606,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) - char *buf = NULL; - char *name; - -+ if (vma->vm_flags & VM_READ) -+ prot |= PROT_READ; -+ if (vma->vm_flags & VM_WRITE) -+ prot |= PROT_WRITE; -+ if (vma->vm_flags & VM_EXEC) -+ prot |= PROT_EXEC; -+ -+ if (vma->vm_flags & VM_MAYSHARE) -+ flags = MAP_SHARED; -+ else -+ flags = MAP_PRIVATE; -+ -+ if (vma->vm_flags & VM_DENYWRITE) -+ flags |= MAP_DENYWRITE; -+ if (vma->vm_flags & VM_MAYEXEC) -+ flags |= MAP_EXECUTABLE; -+ if (vma->vm_flags & VM_LOCKED) -+ flags |= MAP_LOCKED; -+ if (vma->vm_flags & VM_HUGETLB) -+ flags |= MAP_HUGETLB; -+ - if (file) { - struct inode *inode; - dev_t dev; -@@ -6609,27 +6653,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) - maj = MAJOR(dev); - min = MINOR(dev); - -- if (vma->vm_flags & VM_READ) -- prot |= PROT_READ; -- if (vma->vm_flags & VM_WRITE) -- prot |= PROT_WRITE; -- if (vma->vm_flags & VM_EXEC) -- prot |= PROT_EXEC; -- -- if (vma->vm_flags & VM_MAYSHARE) -- flags = MAP_SHARED; -- else -- flags = MAP_PRIVATE; -- -- if (vma->vm_flags & VM_DENYWRITE) -- flags |= MAP_DENYWRITE; -- if (vma->vm_flags & VM_MAYEXEC) -- flags |= MAP_EXECUTABLE; -- if (vma->vm_flags & VM_LOCKED) -- flags |= MAP_LOCKED; -- if (vma->vm_flags & VM_HUGETLB) -- flags |= MAP_HUGETLB; -- - goto got_name; - } else { - if (vma->vm_ops && vma->vm_ops->name) { -diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c -index 8c0a0ae..b59e676 100644 ---- a/kernel/irq/irqdomain.c -+++ b/kernel/irq/irqdomain.c -@@ -1346,6 +1346,30 @@ void irq_domain_free_irqs_parent(struct irq_domain *domain, - } - EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent); - -+static void __irq_domain_activate_irq(struct irq_data *irq_data) -+{ -+ if (irq_data && irq_data->domain) { -+ struct irq_domain *domain = irq_data->domain; -+ -+ if (irq_data->parent_data) -+ __irq_domain_activate_irq(irq_data->parent_data); -+ if (domain->ops->activate) -+ domain->ops->activate(domain, irq_data); -+ } -+} -+ -+static void __irq_domain_deactivate_irq(struct irq_data *irq_data) -+{ -+ if (irq_data && irq_data->domain) { -+ struct irq_domain *domain = irq_data->domain; -+ -+ if (domain->ops->deactivate) -+ domain->ops->deactivate(domain, irq_data); -+ if (irq_data->parent_data) -+ __irq_domain_deactivate_irq(irq_data->parent_data); -+ } -+} -+ - /** - * irq_domain_activate_irq - Call domain_ops->activate recursively to activate - * interrupt -@@ -1356,13 +1380,9 @@ EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent); - */ - void irq_domain_activate_irq(struct irq_data *irq_data) - { -- if (irq_data && irq_data->domain) { -- struct irq_domain *domain = irq_data->domain; -- -- if (irq_data->parent_data) -- irq_domain_activate_irq(irq_data->parent_data); -- if (domain->ops->activate) -- domain->ops->activate(domain, irq_data); -+ if (!irqd_is_activated(irq_data)) { -+ __irq_domain_activate_irq(irq_data); -+ irqd_set_activated(irq_data); - } - } - -@@ -1376,13 +1396,9 @@ void irq_domain_activate_irq(struct irq_data *irq_data) - */ - void irq_domain_deactivate_irq(struct irq_data *irq_data) - { -- if (irq_data && irq_data->domain) { -- struct irq_domain *domain = irq_data->domain; -- -- if (domain->ops->deactivate) -- domain->ops->deactivate(domain, irq_data); -- if (irq_data->parent_data) -- irq_domain_deactivate_irq(irq_data->parent_data); -+ if (irqd_is_activated(irq_data)) { -+ __irq_domain_deactivate_irq(irq_data); -+ irqd_clr_activated(irq_data); - } - } - -diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c -index b97286c..f00b013 100644 ---- a/kernel/trace/trace_hwlat.c -+++ b/kernel/trace/trace_hwlat.c -@@ -266,7 +266,7 @@ static int get_sample(void) - static struct cpumask save_cpumask; - static bool disable_migrate; - --static void move_to_next_cpu(void) -+static void move_to_next_cpu(bool initmask) - { - static struct cpumask *current_mask; - int next_cpu; -@@ -275,7 +275,7 @@ static void move_to_next_cpu(void) - return; - - /* Just pick the first CPU on first iteration */ -- if (!current_mask) { -+ if (initmask) { - current_mask = &save_cpumask; - get_online_cpus(); - cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); -@@ -330,10 +330,12 @@ static void move_to_next_cpu(void) - static int kthread_fn(void *data) - { - u64 interval; -+ bool initmask = true; - - while (!kthread_should_stop()) { - -- move_to_next_cpu(); -+ move_to_next_cpu(initmask); -+ initmask = false; - - local_irq_disable(); - get_sample(); -diff --git a/mm/filemap.c b/mm/filemap.c -index 7798010..d8d7df8 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -1703,6 +1703,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos, - - cond_resched(); - find_page: -+ if (fatal_signal_pending(current)) { -+ error = -EINTR; -+ goto out; -+ } -+ - page = find_get_page(mapping, index); - if (!page) { - page_cache_sync_readahead(mapping, -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index c3a8141..ede13734 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1483,17 +1483,20 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) - } - - /* -- * Confirm all pages in a range [start, end) is belongs to the same zone. -+ * Confirm all pages in a range [start, end) belong to the same zone. -+ * When true, return its valid [start, end). - */ --int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) -+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, -+ unsigned long *valid_start, unsigned long *valid_end) - { - unsigned long pfn, sec_end_pfn; -+ unsigned long start, end; - struct zone *zone = NULL; - struct page *page; - int i; -- for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn); -+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1); - pfn < end_pfn; -- pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) { -+ pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) { - /* Make sure the memory section is present first */ - if (!present_section_nr(pfn_to_section_nr(pfn))) - continue; -@@ -1509,10 +1512,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) - page = pfn_to_page(pfn + i); - if (zone && page_zone(page) != zone) - return 0; -+ if (!zone) -+ start = pfn + i; - zone = page_zone(page); -+ end = pfn + MAX_ORDER_NR_PAGES; - } - } -- return 1; -+ -+ if (zone) { -+ *valid_start = start; -+ *valid_end = end; -+ return 1; -+ } else { -+ return 0; -+ } - } - - /* -@@ -1859,6 +1872,7 @@ static int __ref __offline_pages(unsigned long start_pfn, - long offlined_pages; - int ret, drain, retry_max, node; - unsigned long flags; -+ unsigned long valid_start, valid_end; - struct zone *zone; - struct memory_notify arg; - -@@ -1869,10 +1883,10 @@ static int __ref __offline_pages(unsigned long start_pfn, - return -EINVAL; - /* This makes hotplug much easier...and readable. - we assume this for now. .*/ -- if (!test_pages_in_a_zone(start_pfn, end_pfn)) -+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end)) - return -EINVAL; - -- zone = page_zone(pfn_to_page(start_pfn)); -+ zone = page_zone(pfn_to_page(valid_start)); - node = zone_to_nid(zone); - nr_pages = end_pfn - start_pfn; - -diff --git a/mm/zswap.c b/mm/zswap.c -index 275b22c..dbef278 100644 ---- a/mm/zswap.c -+++ b/mm/zswap.c -@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry; - - /* Enable/disable zswap (disabled by default) */ - static bool zswap_enabled; --module_param_named(enabled, zswap_enabled, bool, 0644); -+static int zswap_enabled_param_set(const char *, -+ const struct kernel_param *); -+static struct kernel_param_ops zswap_enabled_param_ops = { -+ .set = zswap_enabled_param_set, -+ .get = param_get_bool, -+}; -+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644); - - /* Crypto compressor to use */ - #define ZSWAP_COMPRESSOR_DEFAULT "lzo" -@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0); - /* used by param callback function */ - static bool zswap_init_started; - -+/* fatal error during init */ -+static bool zswap_init_failed; -+ - /********************************* - * helpers and fwd declarations - **********************************/ -@@ -706,6 +715,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp, - char *s = strstrip((char *)val); - int ret; - -+ if (zswap_init_failed) { -+ pr_err("can't set param, initialization failed\n"); -+ return -ENODEV; -+ } -+ - /* no change required */ - if (!strcmp(s, *(char **)kp->arg)) - return 0; -@@ -785,6 +799,17 @@ static int zswap_zpool_param_set(const char *val, - return __zswap_param_set(val, kp, NULL, zswap_compressor); - } - -+static int zswap_enabled_param_set(const char *val, -+ const struct kernel_param *kp) -+{ -+ if (zswap_init_failed) { -+ pr_err("can't enable, initialization failed\n"); -+ return -ENODEV; -+ } -+ -+ return param_set_bool(val, kp); -+} -+ - /********************************* - * writeback code - **********************************/ -@@ -1271,6 +1296,9 @@ static int __init init_zswap(void) - dstmem_fail: - zswap_entry_cache_destroy(); - cache_fail: -+ /* if built-in, we aren't unloaded on failure; don't allow use */ -+ zswap_init_failed = true; -+ zswap_enabled = false; - return -ENOMEM; - } - /* must be late so crypto has time to come up */ -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 436a753..5e9ed5e 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, - - static void bcm_remove_op(struct bcm_op *op) - { -- hrtimer_cancel(&op->timer); -- hrtimer_cancel(&op->thrtimer); -- -- if (op->tsklet.func) -- tasklet_kill(&op->tsklet); -+ if (op->tsklet.func) { -+ while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) || -+ test_bit(TASKLET_STATE_RUN, &op->tsklet.state) || -+ hrtimer_active(&op->timer)) { -+ hrtimer_cancel(&op->timer); -+ tasklet_kill(&op->tsklet); -+ } -+ } - -- if (op->thrtsklet.func) -- tasklet_kill(&op->thrtsklet); -+ if (op->thrtsklet.func) { -+ while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) || -+ test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) || -+ hrtimer_active(&op->thrtimer)) { -+ hrtimer_cancel(&op->thrtimer); -+ tasklet_kill(&op->thrtsklet); -+ } -+ } - - if ((op->frames) && (op->frames != &op->sframe)) - kfree(op->frames); -diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c -index dc6fb79..25d9a9c 100644 ---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c -+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c -@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, - if (!oa->data) - return -ENOMEM; - -- creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL); -+ creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL); - if (!creds) { - kfree(oa->data); - return -ENOMEM; |