diff options
| -rw-r--r-- | 0000_README | 2 | ||||
| -rw-r--r-- | 1000_linux-4.3.1.patch | 4386 |
2 files changed, 4388 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 4c2a4871..eb12e027 100644 --- a/0000_README +++ b/0000_README @@ -43,6 +43,8 @@ EXPERIMENTAL Individual Patch Descriptions: -------------------------------------------------------------------------- +Patch: 1000_linux-4.3.1.patch From: http://www.kernel.org Desc: Linux 4.3.1 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1000_linux-4.3.1.patch b/1000_linux-4.3.1.patch new file mode 100644 index 00000000..a9daca9e --- /dev/null +++ b/1000_linux-4.3.1.patch @@ -0,0 +1,4386 @@ +diff --git a/Documentation/devicetree/bindings/usb/dwc3.txt b/Documentation/devicetree/bindings/usb/dwc3.txt +index 0815eac5b185..e12f3448846a 100644 +--- a/Documentation/devicetree/bindings/usb/dwc3.txt ++++ b/Documentation/devicetree/bindings/usb/dwc3.txt +@@ -35,6 +35,8 @@ Optional properties: + LTSSM during USB3 Compliance mode. + - snps,dis_u3_susphy_quirk: when set core will disable USB3 suspend phy. + - snps,dis_u2_susphy_quirk: when set core will disable USB2 suspend phy. ++ - snps,dis_enblslpm_quirk: when set clears the enblslpm in GUSB2PHYCFG, ++ disabling the suspend signal to the PHY. + - snps,is-utmi-l1-suspend: true when DWC3 asserts output signal + utmi_l1_suspend_n, false when asserts utmi_sleep_n + - snps,hird-threshold: HIRD threshold +diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt +index d411ca63c8b6..3a9d65c912e7 100644 +--- a/Documentation/filesystems/proc.txt ++++ b/Documentation/filesystems/proc.txt +@@ -140,7 +140,8 @@ Table 1-1: Process specific entries in /proc + stat Process status + statm Process memory status information + status Process status in human readable form +- wchan If CONFIG_KALLSYMS is set, a pre-decoded wchan ++ wchan Present with CONFIG_KALLSYMS=y: it shows the kernel function ++ symbol the task is blocked in - or "0" if not blocked. + pagemap Page table + stack Report full stack trace, enable via CONFIG_STACKTRACE + smaps a extension based on maps, showing the memory consumption of +@@ -310,7 +311,7 @@ Table 1-4: Contents of the stat files (as of 2.6.30-rc7) + blocked bitmap of blocked signals + sigign bitmap of ignored signals + sigcatch bitmap of caught signals +- wchan address where process went to sleep ++ 0 (place holder, used to be the wchan address, use /proc/PID/wchan instead) + 0 (place holder) + 0 (place holder) + exit_signal signal to send to parent thread on exit +diff --git a/Makefile b/Makefile +index d5b37391195f..266eeacc1490 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 3 +-SUBLEVEL = 0 ++SUBLEVEL = 1 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts +index 540a0adf2be6..35b39d2255d3 100644 +--- a/arch/arm/boot/dts/exynos3250-monk.dts ++++ b/arch/arm/boot/dts/exynos3250-monk.dts +@@ -161,6 +161,7 @@ + }; + + &exynos_usbphy { ++ vbus-supply = <&safeout_reg>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts +index 41a5fafb9aa9..23623cd3ebd9 100644 +--- a/arch/arm/boot/dts/exynos3250-rinato.dts ++++ b/arch/arm/boot/dts/exynos3250-rinato.dts +@@ -153,6 +153,7 @@ + + &exynos_usbphy { + status = "okay"; ++ vbus-supply = <&safeout_reg>; + }; + + &hsotg { +diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts +index ba34886f8b65..01d38f2145b9 100644 +--- a/arch/arm/boot/dts/exynos4210-trats.dts ++++ b/arch/arm/boot/dts/exynos4210-trats.dts +@@ -251,6 +251,7 @@ + + &exynos_usbphy { + status = "okay"; ++ vbus-supply = <&safe1_sreg>; + }; + + &fimd { +@@ -448,7 +449,6 @@ + + safe1_sreg: ESAFEOUT1 { + regulator-name = "SAFEOUT1"; +- regulator-always-on; + }; + + safe2_sreg: ESAFEOUT2 { +diff --git a/arch/arm/boot/dts/exynos4210-universal_c210.dts b/arch/arm/boot/dts/exynos4210-universal_c210.dts +index eb379526e234..2c04297825fe 100644 +--- a/arch/arm/boot/dts/exynos4210-universal_c210.dts ++++ b/arch/arm/boot/dts/exynos4210-universal_c210.dts +@@ -248,6 +248,7 @@ + + &exynos_usbphy { + status = "okay"; ++ vbus-supply = <&safeout1_reg>; + }; + + &fimd { +@@ -486,7 +487,6 @@ + + safeout1_reg: ESAFEOUT1 { + regulator-name = "SAFEOUT1"; +- regulator-always-on; + }; + + safeout2_reg: ESAFEOUT2 { +diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts +index 2a1ebb76ebe0..50a5e8a85283 100644 +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -391,6 +391,7 @@ + }; + + &exynos_usbphy { ++ vbus-supply = <&esafeout1_reg>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index feb9d34b239c..f818ea483aeb 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -486,7 +486,10 @@ + compatible = "fsl,imx27-usb"; + reg = <0x10024000 0x200>; + interrupts = <56>; +- clocks = <&clks IMX27_CLK_USB_IPG_GATE>; ++ clocks = <&clks IMX27_CLK_USB_IPG_GATE>, ++ <&clks IMX27_CLK_USB_AHB_GATE>, ++ <&clks IMX27_CLK_USB_DIV>; ++ clock-names = "ipg", "ahb", "per"; + fsl,usbmisc = <&usbmisc 0>; + status = "disabled"; + }; +@@ -495,7 +498,10 @@ + compatible = "fsl,imx27-usb"; + reg = <0x10024200 0x200>; + interrupts = <54>; +- clocks = <&clks IMX27_CLK_USB_IPG_GATE>; ++ clocks = <&clks IMX27_CLK_USB_IPG_GATE>, ++ <&clks IMX27_CLK_USB_AHB_GATE>, ++ <&clks IMX27_CLK_USB_DIV>; ++ clock-names = "ipg", "ahb", "per"; + fsl,usbmisc = <&usbmisc 1>; + dr_mode = "host"; + status = "disabled"; +@@ -505,7 +511,10 @@ + compatible = "fsl,imx27-usb"; + reg = <0x10024400 0x200>; + interrupts = <55>; +- clocks = <&clks IMX27_CLK_USB_IPG_GATE>; ++ clocks = <&clks IMX27_CLK_USB_IPG_GATE>, ++ <&clks IMX27_CLK_USB_AHB_GATE>, ++ <&clks IMX27_CLK_USB_DIV>; ++ clock-names = "ipg", "ahb", "per"; + fsl,usbmisc = <&usbmisc 2>; + dr_mode = "host"; + status = "disabled"; +@@ -515,7 +524,6 @@ + #index-cells = <1>; + compatible = "fsl,imx27-usbmisc"; + reg = <0x10024600 0x200>; +- clocks = <&clks IMX27_CLK_USB_AHB_GATE>; + }; + + sahara2: sahara@10025000 { +diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts +index 3cb030f9d2c4..c85761212d90 100644 +--- a/arch/arm/boot/dts/omap5-uevm.dts ++++ b/arch/arm/boot/dts/omap5-uevm.dts +@@ -31,6 +31,24 @@ + regulator-max-microvolt = <3000000>; + }; + ++ mmc3_pwrseq: sdhci0_pwrseq { ++ compatible = "mmc-pwrseq-simple"; ++ clocks = <&clk32kgaudio>; ++ clock-names = "ext_clock"; ++ }; ++ ++ vmmcsdio_fixed: fixedregulator-mmcsdio { ++ compatible = "regulator-fixed"; ++ regulator-name = "vmmcsdio_fixed"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ gpio = <&gpio5 12 GPIO_ACTIVE_HIGH>; /* gpio140 WLAN_EN */ ++ enable-active-high; ++ startup-delay-us = <70000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wlan_pins>; ++ }; ++ + /* HS USB Host PHY on PORT 2 */ + hsusb2_phy: hsusb2_phy { + compatible = "usb-nop-xceiv"; +@@ -197,12 +215,20 @@ + >; + }; + +- mcspi4_pins: pinmux_mcspi4_pins { ++ mmc3_pins: pinmux_mmc3_pins { ++ pinctrl-single,pins = < ++ OMAP5_IOPAD(0x01a4, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_clk */ ++ OMAP5_IOPAD(0x01a6, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_cmd */ ++ OMAP5_IOPAD(0x01a8, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data0 */ ++ OMAP5_IOPAD(0x01aa, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data1 */ ++ OMAP5_IOPAD(0x01ac, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data2 */ ++ OMAP5_IOPAD(0x01ae, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data3 */ ++ >; ++ }; ++ ++ wlan_pins: pinmux_wlan_pins { + pinctrl-single,pins = < +- 0x164 (PIN_INPUT | MUX_MODE1) /* mcspi4_clk */ +- 0x168 (PIN_INPUT | MUX_MODE1) /* mcspi4_simo */ +- 0x16a (PIN_INPUT | MUX_MODE1) /* mcspi4_somi */ +- 0x16c (PIN_INPUT | MUX_MODE1) /* mcspi4_cs0 */ ++ OMAP5_IOPAD(0x1bc, PIN_OUTPUT | MUX_MODE6) /* mcspi1_clk.gpio5_140 */ + >; + }; + +@@ -276,6 +302,12 @@ + 0x1A (PIN_OUTPUT | MUX_MODE0) /* fref_clk1_out, USB hub clk */ + >; + }; ++ ++ wlcore_irq_pin: pinmux_wlcore_irq_pin { ++ pinctrl-single,pins = < ++ OMAP5_IOPAD(0x040, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE6) /* llia_wakereqin.gpio1_wk14 */ ++ >; ++ }; + }; + + &mmc1 { +@@ -290,8 +322,25 @@ + }; + + &mmc3 { ++ vmmc-supply = <&vmmcsdio_fixed>; ++ mmc-pwrseq = <&mmc3_pwrseq>; + bus-width = <4>; +- ti,non-removable; ++ non-removable; ++ cap-power-off-card; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mmc3_pins &wlcore_irq_pin>; ++ interrupts-extended = <&gic GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH ++ &omap5_pmx_core 0x168>; ++ ++ #address-cells = <1>; ++ #size-cells = <0>; ++ wlcore: wlcore@2 { ++ compatible = "ti,wl1271"; ++ reg = <2>; ++ interrupt-parent = <&gpio1>; ++ interrupts = <14 IRQ_TYPE_LEVEL_HIGH>; /* gpio 14 */ ++ ref-clock-frequency = <26000000>; ++ }; + }; + + &mmc4 { +@@ -598,11 +647,6 @@ + pinctrl-0 = <&mcspi3_pins>; + }; + +-&mcspi4 { +- pinctrl-names = "default"; +- pinctrl-0 = <&mcspi4_pins>; +-}; +- + &uart1 { + pinctrl-names = "default"; + pinctrl-0 = <&uart1_pins>; +diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi +index 8d1de29e8da1..fb92481e60d4 100644 +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -939,11 +939,11 @@ + reg = <0xf8018000 0x4000>; + interrupts = <33 IRQ_TYPE_LEVEL_HIGH 6>; + dmas = <&dma1 +- (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(4)>, ++ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(4))>, + <&dma1 +- (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) +- AT91_XDMAC_DT_PERID(5)>; ++ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) ++ | AT91_XDMAC_DT_PERID(5))>; + dma-names = "tx", "rx"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c1>; +diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts +index d0cfadac0691..18f26ca4e375 100644 +--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts ++++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts +@@ -184,18 +184,18 @@ + regulator-name = "vcc-3v0"; + }; + +- vdd_cpu: dcdc2 { ++ vdd_gpu: dcdc2 { + regulator-always-on; + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1320000>; +- regulator-name = "vdd-cpu"; ++ regulator-name = "vdd-gpu"; + }; + +- vdd_gpu: dcdc3 { ++ vdd_cpu: dcdc3 { + regulator-always-on; + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1320000>; +- regulator-name = "vdd-gpu"; ++ regulator-name = "vdd-cpu"; + }; + + vdd_sys_dll: dcdc4 { +diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c +index 873dbfcc7dc9..56fc339571f9 100644 +--- a/arch/arm/common/edma.c ++++ b/arch/arm/common/edma.c +@@ -406,7 +406,8 @@ static irqreturn_t dma_irq_handler(int irq, void *data) + BIT(slot)); + if (edma_cc[ctlr]->intr_data[channel].callback) + edma_cc[ctlr]->intr_data[channel].callback( +- channel, EDMA_DMA_COMPLETE, ++ EDMA_CTLR_CHAN(ctlr, channel), ++ EDMA_DMA_COMPLETE, + edma_cc[ctlr]->intr_data[channel].data); + } + } while (sh_ipr); +@@ -460,7 +461,8 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data) + if (edma_cc[ctlr]->intr_data[k]. + callback) { + edma_cc[ctlr]->intr_data[k]. +- callback(k, ++ callback( ++ EDMA_CTLR_CHAN(ctlr, k), + EDMA_DMA_CC_ERROR, + edma_cc[ctlr]->intr_data + [k].data); +diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h +index be1d07d59ee9..1bd9510de1b9 100644 +--- a/arch/arm/include/asm/irq.h ++++ b/arch/arm/include/asm/irq.h +@@ -40,6 +40,11 @@ extern void arch_trigger_all_cpu_backtrace(bool); + #define arch_trigger_all_cpu_backtrace(x) arch_trigger_all_cpu_backtrace(x) + #endif + ++static inline int nr_legacy_irqs(void) ++{ ++ return NR_IRQS_LEGACY; ++} ++ + #endif + + #endif +diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S +index 0d95f488b47a..a25defda3d22 100644 +--- a/arch/arm/mach-at91/pm_suspend.S ++++ b/arch/arm/mach-at91/pm_suspend.S +@@ -80,6 +80,8 @@ tmp2 .req r5 + * @r2: base address of second SDRAM Controller or 0 if not present + * @r3: pm information + */ ++/* at91_pm_suspend_in_sram must be 8-byte aligned per the requirements of fncpy() */ ++ .align 3 + ENTRY(at91_pm_suspend_in_sram) + /* Save registers on stack */ + stmfd sp!, {r4 - r12, lr} +diff --git a/arch/arm/mach-pxa/include/mach/pxa27x.h b/arch/arm/mach-pxa/include/mach/pxa27x.h +index 599b925a657c..1a4291936c58 100644 +--- a/arch/arm/mach-pxa/include/mach/pxa27x.h ++++ b/arch/arm/mach-pxa/include/mach/pxa27x.h +@@ -19,7 +19,7 @@ + #define ARB_CORE_PARK (1<<24) /* Be parked with core when idle */ + #define ARB_LOCK_FLAG (1<<23) /* Only Locking masters gain access to the bus */ + +-extern int __init pxa27x_set_pwrmode(unsigned int mode); ++extern int pxa27x_set_pwrmode(unsigned int mode); + extern void pxa27x_cpu_pm_enter(suspend_state_t state); + + #endif /* __MACH_PXA27x_H */ +diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c +index 221260d5d109..ffc424028557 100644 +--- a/arch/arm/mach-pxa/pxa27x.c ++++ b/arch/arm/mach-pxa/pxa27x.c +@@ -84,7 +84,7 @@ EXPORT_SYMBOL_GPL(pxa27x_configure_ac97reset); + */ + static unsigned int pwrmode = PWRMODE_SLEEP; + +-int __init pxa27x_set_pwrmode(unsigned int mode) ++int pxa27x_set_pwrmode(unsigned int mode) + { + switch (mode) { + case PWRMODE_SLEEP: +diff --git a/arch/arm/mach-tegra/board-paz00.c b/arch/arm/mach-tegra/board-paz00.c +index fbe74c6806f3..49d1110cff53 100644 +--- a/arch/arm/mach-tegra/board-paz00.c ++++ b/arch/arm/mach-tegra/board-paz00.c +@@ -39,8 +39,8 @@ static struct platform_device wifi_rfkill_device = { + static struct gpiod_lookup_table wifi_gpio_lookup = { + .dev_id = "rfkill_gpio", + .table = { +- GPIO_LOOKUP_IDX("tegra-gpio", 25, NULL, 0, 0), +- GPIO_LOOKUP_IDX("tegra-gpio", 85, NULL, 1, 0), ++ GPIO_LOOKUP("tegra-gpio", 25, "reset", 0), ++ GPIO_LOOKUP("tegra-gpio", 85, "shutdown", 0), + { }, + }, + }; +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index 1a7815e5421b..ad4eb2d26e16 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -1407,12 +1407,19 @@ static int arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma, + unsigned long uaddr = vma->vm_start; + unsigned long usize = vma->vm_end - vma->vm_start; + struct page **pages = __iommu_get_pages(cpu_addr, attrs); ++ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; ++ unsigned long off = vma->vm_pgoff; + + vma->vm_page_prot = __get_dma_pgprot(attrs, vma->vm_page_prot); + + if (!pages) + return -ENXIO; + ++ if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off) ++ return -ENXIO; ++ ++ pages += off; ++ + do { + int ret = vm_insert_page(vma, uaddr, *pages++); + if (ret) { +diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c +index 0cebd98cd88c..f6455273b2f8 100644 +--- a/arch/arm/vdso/vdsomunge.c ++++ b/arch/arm/vdso/vdsomunge.c +@@ -66,7 +66,7 @@ + ((((x) & 0x000000ff) << 24) | \ + (((x) & 0x0000ff00) << 8) | \ + (((x) & 0x00ff0000) >> 8) | \ +- (((x) & 0xff000000) << 24)) ++ (((x) & 0xff000000) >> 24)) + + #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + #define HOST_ORDER ELFDATA2LSB +diff --git a/arch/arm64/include/asm/irq.h b/arch/arm64/include/asm/irq.h +index bbb251b14746..8b9bf54105b3 100644 +--- a/arch/arm64/include/asm/irq.h ++++ b/arch/arm64/include/asm/irq.h +@@ -21,4 +21,9 @@ static inline void acpi_irq_init(void) + } + #define acpi_irq_init acpi_irq_init + ++static inline int nr_legacy_irqs(void) ++{ ++ return 0; ++} ++ + #endif +diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h +index 536274ed292e..e9e5467e0bf4 100644 +--- a/arch/arm64/include/asm/ptrace.h ++++ b/arch/arm64/include/asm/ptrace.h +@@ -83,14 +83,14 @@ + #define compat_sp regs[13] + #define compat_lr regs[14] + #define compat_sp_hyp regs[15] +-#define compat_sp_irq regs[16] +-#define compat_lr_irq regs[17] +-#define compat_sp_svc regs[18] +-#define compat_lr_svc regs[19] +-#define compat_sp_abt regs[20] +-#define compat_lr_abt regs[21] +-#define compat_sp_und regs[22] +-#define compat_lr_und regs[23] ++#define compat_lr_irq regs[16] ++#define compat_sp_irq regs[17] ++#define compat_lr_svc regs[18] ++#define compat_sp_svc regs[19] ++#define compat_lr_abt regs[20] ++#define compat_sp_abt regs[21] ++#define compat_lr_und regs[22] ++#define compat_sp_und regs[23] + #define compat_r8_fiq regs[24] + #define compat_r9_fiq regs[25] + #define compat_r10_fiq regs[26] +diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S +index 98073332e2d0..4d77757b5894 100644 +--- a/arch/arm64/kernel/vmlinux.lds.S ++++ b/arch/arm64/kernel/vmlinux.lds.S +@@ -60,9 +60,12 @@ PECOFF_FILE_ALIGNMENT = 0x200; + #define PECOFF_EDATA_PADDING + #endif + +-#ifdef CONFIG_DEBUG_ALIGN_RODATA ++#if defined(CONFIG_DEBUG_ALIGN_RODATA) + #define ALIGN_DEBUG_RO . = ALIGN(1<<SECTION_SHIFT); + #define ALIGN_DEBUG_RO_MIN(min) ALIGN_DEBUG_RO ++#elif defined(CONFIG_DEBUG_RODATA) ++#define ALIGN_DEBUG_RO . = ALIGN(1<<PAGE_SHIFT); ++#define ALIGN_DEBUG_RO_MIN(min) ALIGN_DEBUG_RO + #else + #define ALIGN_DEBUG_RO + #define ALIGN_DEBUG_RO_MIN(min) . = ALIGN(min); +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index 1ba21204ebe0..9a0013703579 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -216,9 +216,9 @@ void __init plat_mem_setup(void) + AR71XX_RESET_SIZE); + ath79_pll_base = ioremap_nocache(AR71XX_PLL_BASE, + AR71XX_PLL_SIZE); ++ ath79_detect_sys_type(); + ath79_ddr_ctrl_init(); + +- ath79_detect_sys_type(); + if (mips_machtype != ATH79_MACH_GENERIC_OF) + detect_memory_region(0, ATH79_MEM_SIZE_MIN, ATH79_MEM_SIZE_MAX); + +diff --git a/arch/mips/include/asm/cdmm.h b/arch/mips/include/asm/cdmm.h +index bece2064cc8c..c06dbf8ba937 100644 +--- a/arch/mips/include/asm/cdmm.h ++++ b/arch/mips/include/asm/cdmm.h +@@ -84,6 +84,17 @@ void mips_cdmm_driver_unregister(struct mips_cdmm_driver *); + module_driver(__mips_cdmm_driver, mips_cdmm_driver_register, \ + mips_cdmm_driver_unregister) + ++/* ++ * builtin_mips_cdmm_driver() - Helper macro for drivers that don't do anything ++ * special in init and have no exit. This eliminates some boilerplate. Each ++ * driver may only use this macro once, and calling it replaces device_initcall ++ * (or in some cases, the legacy __initcall). This is meant to be a direct ++ * parallel of module_mips_cdmm_driver() above but without the __exit stuff that ++ * is not used for builtin cases. ++ */ ++#define builtin_mips_cdmm_driver(__mips_cdmm_driver) \ ++ builtin_driver(__mips_cdmm_driver, mips_cdmm_driver_register) ++ + /* drivers/tty/mips_ejtag_fdc.c */ + + #ifdef CONFIG_MIPS_EJTAG_FDC_EARLYCON +diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c +index d5fa3eaf39a1..41b1b090f56f 100644 +--- a/arch/mips/kvm/emulate.c ++++ b/arch/mips/kvm/emulate.c +@@ -1581,7 +1581,7 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc, + + base = (inst >> 21) & 0x1f; + op_inst = (inst >> 16) & 0x1f; +- offset = inst & 0xffff; ++ offset = (int16_t)inst; + cache = (inst >> 16) & 0x3; + op = (inst >> 18) & 0x7; + +diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S +index c567240386a0..d1ee95a7f7dd 100644 +--- a/arch/mips/kvm/locore.S ++++ b/arch/mips/kvm/locore.S +@@ -165,9 +165,11 @@ FEXPORT(__kvm_mips_vcpu_run) + + FEXPORT(__kvm_mips_load_asid) + /* Set the ASID for the Guest Kernel */ +- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ +- /* addresses shift to 0x80000000 */ +- bltz t0, 1f /* If kernel */ ++ PTR_L t0, VCPU_COP0(k1) ++ LONG_L t0, COP0_STATUS(t0) ++ andi t0, KSU_USER | ST0_ERL | ST0_EXL ++ xori t0, KSU_USER ++ bnez t0, 1f /* If kernel */ + INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ + INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */ + 1: +@@ -482,9 +484,11 @@ __kvm_mips_return_to_guest: + mtc0 t0, CP0_EPC + + /* Set the ASID for the Guest Kernel */ +- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ +- /* addresses shift to 0x80000000 */ +- bltz t0, 1f /* If kernel */ ++ PTR_L t0, VCPU_COP0(k1) ++ LONG_L t0, COP0_STATUS(t0) ++ andi t0, KSU_USER | ST0_ERL | ST0_EXL ++ xori t0, KSU_USER ++ bnez t0, 1f /* If kernel */ + INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ + INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */ + 1: +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index 49ff3bfc007e..b9b803facdbf 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -279,7 +279,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + + if (!gebase) { + err = -ENOMEM; +- goto out_free_cpu; ++ goto out_uninit_cpu; + } + kvm_debug("Allocated %d bytes for KVM Exception Handlers @ %p\n", + ALIGN(size, PAGE_SIZE), gebase); +@@ -343,6 +343,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + out_free_gebase: + kfree(gebase); + ++out_uninit_cpu: ++ kvm_vcpu_uninit(vcpu); ++ + out_free_cpu: + kfree(vcpu); + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index 3fc2e6d70c77..a0706fd4ce0a 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -99,6 +99,23 @@ int clk_set_rate(struct clk *clk, unsigned long rate) + } + EXPORT_SYMBOL(clk_set_rate); + ++long clk_round_rate(struct clk *clk, unsigned long rate) ++{ ++ if (unlikely(!clk_good(clk))) ++ return 0; ++ if (clk->rates && *clk->rates) { ++ unsigned long *r = clk->rates; ++ ++ while (*r && (*r != rate)) ++ r++; ++ if (!*r) { ++ return clk->rate; ++ } ++ } ++ return rate; ++} ++EXPORT_SYMBOL(clk_round_rate); ++ + int clk_enable(struct clk *clk) + { + if (unlikely(!clk_good(clk))) +diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c +index 8b1c8e33f184..d319f36f7d1d 100644 +--- a/arch/s390/kernel/ptrace.c ++++ b/arch/s390/kernel/ptrace.c +@@ -244,7 +244,7 @@ static unsigned long __peek_user(struct task_struct *child, addr_t addr) + ((addr_t) child->thread.fpu.vxrs + 2*offset); + else + tmp = *(addr_t *) +- ((addr_t) &child->thread.fpu.fprs + offset); ++ ((addr_t) child->thread.fpu.fprs + offset); + + } else if (addr < (addr_t) (&dummy->regs.per_info + 1)) { + /* +@@ -388,7 +388,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) + child->thread.fpu.vxrs + 2*offset) = data; + else + *(addr_t *)((addr_t) +- &child->thread.fpu.fprs + offset) = data; ++ child->thread.fpu.fprs + offset) = data; + + } else if (addr < (addr_t) (&dummy->regs.per_info + 1)) { + /* +@@ -622,7 +622,7 @@ static u32 __peek_user_compat(struct task_struct *child, addr_t addr) + ((addr_t) child->thread.fpu.vxrs + 2*offset); + else + tmp = *(__u32 *) +- ((addr_t) &child->thread.fpu.fprs + offset); ++ ((addr_t) child->thread.fpu.fprs + offset); + + } else if (addr < (addr_t) (&dummy32->regs.per_info + 1)) { + /* +@@ -747,7 +747,7 @@ static int __poke_user_compat(struct task_struct *child, + child->thread.fpu.vxrs + 2*offset) = tmp; + else + *(__u32 *)((addr_t) +- &child->thread.fpu.fprs + offset) = tmp; ++ child->thread.fpu.fprs + offset) = tmp; + + } else if (addr < (addr_t) (&dummy32->regs.per_info + 1)) { + /* +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index 5c2c169395c3..08de785c9e63 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -1057,8 +1057,7 @@ static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq) + src_id, 0); + + /* sending vcpu invalid */ +- if (src_id >= KVM_MAX_VCPUS || +- kvm_get_vcpu(vcpu->kvm, src_id) == NULL) ++ if (kvm_get_vcpu_by_id(vcpu->kvm, src_id) == NULL) + return -EINVAL; + + if (sclp.has_sigpif) +@@ -1137,6 +1136,10 @@ static int __inject_sigp_emergency(struct kvm_vcpu *vcpu, + trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY, + irq->u.emerg.code, 0); + ++ /* sending vcpu invalid */ ++ if (kvm_get_vcpu_by_id(vcpu->kvm, irq->u.emerg.code) == NULL) ++ return -EINVAL; ++ + set_bit(irq->u.emerg.code, li->sigp_emerg_pending); + set_bit(IRQ_PEND_EXT_EMERGENCY, &li->pending_irqs); + atomic_or(CPUSTAT_EXT_INT, li->cpuflags); +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 0a67c40eece9..1290af83417a 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -342,12 +342,16 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap) + r = 0; + break; + case KVM_CAP_S390_VECTOR_REGISTERS: +- if (MACHINE_HAS_VX) { ++ mutex_lock(&kvm->lock); ++ if (atomic_read(&kvm->online_vcpus)) { ++ r = -EBUSY; ++ } else if (MACHINE_HAS_VX) { + set_kvm_facility(kvm->arch.model.fac->mask, 129); + set_kvm_facility(kvm->arch.model.fac->list, 129); + r = 0; + } else + r = -EINVAL; ++ mutex_unlock(&kvm->lock); + VM_EVENT(kvm, 3, "ENABLE: CAP_S390_VECTOR_REGISTERS %s", + r ? "(not available)" : "(success)"); + break; +@@ -1120,7 +1124,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) + if (!kvm->arch.sca) + goto out_err; + spin_lock(&kvm_lock); +- sca_offset = (sca_offset + 16) & 0x7f0; ++ sca_offset += 16; ++ if (sca_offset + sizeof(struct sca_block) > PAGE_SIZE) ++ sca_offset = 0; + kvm->arch.sca = (struct sca_block *) ((char *) kvm->arch.sca + sca_offset); + spin_unlock(&kvm_lock); + +diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c +index da690b69f9fe..77c22d685c7a 100644 +--- a/arch/s390/kvm/sigp.c ++++ b/arch/s390/kvm/sigp.c +@@ -291,12 +291,8 @@ static int handle_sigp_dst(struct kvm_vcpu *vcpu, u8 order_code, + u16 cpu_addr, u32 parameter, u64 *status_reg) + { + int rc; +- struct kvm_vcpu *dst_vcpu; ++ struct kvm_vcpu *dst_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr); + +- if (cpu_addr >= KVM_MAX_VCPUS) +- return SIGP_CC_NOT_OPERATIONAL; +- +- dst_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr); + if (!dst_vcpu) + return SIGP_CC_NOT_OPERATIONAL; + +@@ -478,7 +474,7 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu) + trace_kvm_s390_handle_sigp_pei(vcpu, order_code, cpu_addr); + + if (order_code == SIGP_EXTERNAL_CALL) { +- dest_vcpu = kvm_get_vcpu(vcpu->kvm, cpu_addr); ++ dest_vcpu = kvm_get_vcpu_by_id(vcpu->kvm, cpu_addr); + BUG_ON(dest_vcpu == NULL); + + kvm_s390_vcpu_wakeup(dest_vcpu); +diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c +index dcc2634ccbe2..10ca15dcab11 100644 +--- a/arch/s390/pci/pci_insn.c ++++ b/arch/s390/pci/pci_insn.c +@@ -16,11 +16,11 @@ + static inline void zpci_err_insn(u8 cc, u8 status, u64 req, u64 offset) + { + struct { +- u8 cc; +- u8 status; + u64 req; + u64 offset; +- } data = {cc, status, req, offset}; ++ u8 cc; ++ u8 status; ++ } __packed data = {req, offset, cc, status}; + + zpci_err_hex(&data, sizeof(data)); + } +diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h +index ccffa53750a8..39bcefc20de7 100644 +--- a/arch/x86/include/asm/i8259.h ++++ b/arch/x86/include/asm/i8259.h +@@ -60,6 +60,7 @@ struct legacy_pic { + void (*mask_all)(void); + void (*restore_mask)(void); + void (*init)(int auto_eoi); ++ int (*probe)(void); + int (*irq_pending)(unsigned int irq); + void (*make_irq)(unsigned int irq); + }; +diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h +index e16466ec473c..e9cd7befcb76 100644 +--- a/arch/x86/include/asm/kvm_emulate.h ++++ b/arch/x86/include/asm/kvm_emulate.h +@@ -112,6 +112,16 @@ struct x86_emulate_ops { + struct x86_exception *fault); + + /* ++ * read_phys: Read bytes of standard (non-emulated/special) memory. ++ * Used for descriptor reading. ++ * @addr: [IN ] Physical address from which to read. ++ * @val: [OUT] Value read from memory. ++ * @bytes: [IN ] Number of bytes to read from memory. ++ */ ++ int (*read_phys)(struct x86_emulate_ctxt *ctxt, unsigned long addr, ++ void *val, unsigned int bytes); ++ ++ /* + * write_std: Write bytes of standard (non-emulated/special) memory. + * Used for descriptor writing. + * @addr: [IN ] Linear address to which to write. +diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h +index b5d7640abc5d..8a4add8e4639 100644 +--- a/arch/x86/include/uapi/asm/svm.h ++++ b/arch/x86/include/uapi/asm/svm.h +@@ -100,6 +100,7 @@ + { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \ + { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \ + { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \ ++ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \ + { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \ + { SVM_EXIT_INTR, "interrupt" }, \ + { SVM_EXIT_NMI, "nmi" }, \ +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 836d11b92811..861bc59c8f25 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -361,7 +361,11 @@ int __init arch_probe_nr_irqs(void) + if (nr < nr_irqs) + nr_irqs = nr; + +- return nr_legacy_irqs(); ++ /* ++ * We don't know if PIC is present at this point so we need to do ++ * probe() to get the right number of legacy IRQs. ++ */ ++ return legacy_pic->probe(); + } + + #ifdef CONFIG_X86_IO_APIC +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index de22ea7ff82f..1a292573ddf7 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -273,10 +273,9 @@ __setup("nosmap", setup_disable_smap); + + static __always_inline void setup_smap(struct cpuinfo_x86 *c) + { +- unsigned long eflags; ++ unsigned long eflags = native_save_fl(); + + /* This should have been cleared long ago */ +- raw_local_save_flags(eflags); + BUG_ON(eflags & X86_EFLAGS_AC); + + if (cpu_has(c, X86_FEATURE_SMAP)) { +diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c +index 50ec9af1bd51..6545e6ddbfb1 100644 +--- a/arch/x86/kernel/fpu/signal.c ++++ b/arch/x86/kernel/fpu/signal.c +@@ -385,20 +385,19 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame, + */ + void fpu__init_prepare_fx_sw_frame(void) + { +- int fsave_header_size = sizeof(struct fregs_state); + int size = xstate_size + FP_XSTATE_MAGIC2_SIZE; + +- if (config_enabled(CONFIG_X86_32)) +- size += fsave_header_size; +- + fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1; + fx_sw_reserved.extended_size = size; + fx_sw_reserved.xfeatures = xfeatures_mask; + fx_sw_reserved.xstate_size = xstate_size; + +- if (config_enabled(CONFIG_IA32_EMULATION)) { ++ if (config_enabled(CONFIG_IA32_EMULATION) || ++ config_enabled(CONFIG_X86_32)) { ++ int fsave_header_size = sizeof(struct fregs_state); ++ + fx_sw_reserved_ia32 = fx_sw_reserved; +- fx_sw_reserved_ia32.extended_size += fsave_header_size; ++ fx_sw_reserved_ia32.extended_size = size + fsave_header_size; + } + } + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 62fc001c7846..2c4ac072a702 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -402,7 +402,6 @@ void *get_xsave_addr(struct xregs_state *xsave, int xstate_feature) + if (!boot_cpu_has(X86_FEATURE_XSAVE)) + return NULL; + +- xsave = ¤t->thread.fpu.state.xsave; + /* + * We should not ever be requesting features that we + * have not enabled. Remember that pcntxt_mask is +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index 1d40ca8a73f2..ffdc0e860390 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -65,6 +65,9 @@ startup_64: + * tables and then reload them. + */ + ++ /* Sanitize CPU configuration */ ++ call verify_cpu ++ + /* + * Compute the delta between the address I am compiled to run at and the + * address I am actually running at. +@@ -174,6 +177,9 @@ ENTRY(secondary_startup_64) + * after the boot processor executes this code. + */ + ++ /* Sanitize CPU configuration */ ++ call verify_cpu ++ + movq $(init_level4_pgt - __START_KERNEL_map), %rax + 1: + +@@ -288,6 +294,8 @@ ENTRY(secondary_startup_64) + pushq %rax # target address in negative space + lretq + ++#include "verify_cpu.S" ++ + #ifdef CONFIG_HOTPLUG_CPU + /* + * Boot CPU0 entry point. It's called from play_dead(). Everything has been set +diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c +index 16cb827a5b27..be22f5a2192e 100644 +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -295,16 +295,11 @@ static void unmask_8259A(void) + raw_spin_unlock_irqrestore(&i8259A_lock, flags); + } + +-static void init_8259A(int auto_eoi) ++static int probe_8259A(void) + { + unsigned long flags; + unsigned char probe_val = ~(1 << PIC_CASCADE_IR); + unsigned char new_val; +- +- i8259A_auto_eoi = auto_eoi; +- +- raw_spin_lock_irqsave(&i8259A_lock, flags); +- + /* + * Check to see if we have a PIC. + * Mask all except the cascade and read +@@ -312,16 +307,28 @@ static void init_8259A(int auto_eoi) + * have a PIC, we will read 0xff as opposed to the + * value we wrote. + */ ++ raw_spin_lock_irqsave(&i8259A_lock, flags); ++ + outb(0xff, PIC_SLAVE_IMR); /* mask all of 8259A-2 */ + outb(probe_val, PIC_MASTER_IMR); + new_val = inb(PIC_MASTER_IMR); + if (new_val != probe_val) { + printk(KERN_INFO "Using NULL legacy PIC\n"); + legacy_pic = &null_legacy_pic; +- raw_spin_unlock_irqrestore(&i8259A_lock, flags); +- return; + } + ++ raw_spin_unlock_irqrestore(&i8259A_lock, flags); ++ return nr_legacy_irqs(); ++} ++ ++static void init_8259A(int auto_eoi) ++{ ++ unsigned long flags; ++ ++ i8259A_auto_eoi = auto_eoi; ++ ++ raw_spin_lock_irqsave(&i8259A_lock, flags); ++ + outb(0xff, PIC_MASTER_IMR); /* mask all of 8259A-1 */ + + /* +@@ -379,6 +386,10 @@ static int legacy_pic_irq_pending_noop(unsigned int irq) + { + return 0; + } ++static int legacy_pic_probe(void) ++{ ++ return 0; ++} + + struct legacy_pic null_legacy_pic = { + .nr_legacy_irqs = 0, +@@ -388,6 +399,7 @@ struct legacy_pic null_legacy_pic = { + .mask_all = legacy_pic_noop, + .restore_mask = legacy_pic_noop, + .init = legacy_pic_int_noop, ++ .probe = legacy_pic_probe, + .irq_pending = legacy_pic_irq_pending_noop, + .make_irq = legacy_pic_uint_noop, + }; +@@ -400,6 +412,7 @@ struct legacy_pic default_legacy_pic = { + .mask_all = mask_8259A, + .restore_mask = unmask_8259A, + .init = init_8259A, ++ .probe = probe_8259A, + .irq_pending = i8259A_irq_pending, + .make_irq = make_8259A_irq, + }; +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index a3cccbfc5f77..37c8ea8e75ff 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1180,7 +1180,7 @@ void __init setup_arch(char **cmdline_p) + */ + clone_pgd_range(initial_page_table, + swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- KERNEL_PGD_PTRS); ++ min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); + #endif + + tboot_probe(); +diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S +index b9242bacbe59..4cf401f581e7 100644 +--- a/arch/x86/kernel/verify_cpu.S ++++ b/arch/x86/kernel/verify_cpu.S +@@ -34,10 +34,11 @@ + #include <asm/msr-index.h> + + verify_cpu: +- pushfl # Save caller passed flags +- pushl $0 # Kill any dangerous flags +- popfl ++ pushf # Save caller passed flags ++ push $0 # Kill any dangerous flags ++ popf + ++#ifndef __x86_64__ + pushfl # standard way to check for cpuid + popl %eax + movl %eax,%ebx +@@ -48,6 +49,7 @@ verify_cpu: + popl %eax + cmpl %eax,%ebx + jz verify_cpu_no_longmode # cpu has no cpuid ++#endif + + movl $0x0,%eax # See if cpuid 1 is implemented + cpuid +@@ -130,10 +132,10 @@ verify_cpu_sse_test: + jmp verify_cpu_sse_test # try again + + verify_cpu_no_longmode: +- popfl # Restore caller passed flags ++ popf # Restore caller passed flags + movl $1,%eax + ret + verify_cpu_sse_ok: +- popfl # Restore caller passed flags ++ popf # Restore caller passed flags + xorl %eax, %eax + ret +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 9da95b9daf8d..1505587d06e9 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2272,8 +2272,8 @@ static int emulator_has_longmode(struct x86_emulate_ctxt *ctxt) + #define GET_SMSTATE(type, smbase, offset) \ + ({ \ + type __val; \ +- int r = ctxt->ops->read_std(ctxt, smbase + offset, &__val, \ +- sizeof(__val), NULL); \ ++ int r = ctxt->ops->read_phys(ctxt, smbase + offset, &__val, \ ++ sizeof(__val)); \ + if (r != X86EMUL_CONTINUE) \ + return X86EMUL_UNHANDLEABLE; \ + __val; \ +@@ -2484,17 +2484,36 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) + + /* + * Get back to real mode, to prepare a safe state in which to load +- * CR0/CR3/CR4/EFER. Also this will ensure that addresses passed +- * to read_std/write_std are not virtual. +- * +- * CR4.PCIDE must be zero, because it is a 64-bit mode only feature. ++ * CR0/CR3/CR4/EFER. It's all a bit more complicated if the vCPU ++ * supports long mode. + */ ++ cr4 = ctxt->ops->get_cr(ctxt, 4); ++ if (emulator_has_longmode(ctxt)) { ++ struct desc_struct cs_desc; ++ ++ /* Zero CR4.PCIDE before CR0.PG. */ ++ if (cr4 & X86_CR4_PCIDE) { ++ ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE); ++ cr4 &= ~X86_CR4_PCIDE; ++ } ++ ++ /* A 32-bit code segment is required to clear EFER.LMA. */ ++ memset(&cs_desc, 0, sizeof(cs_desc)); ++ cs_desc.type = 0xb; ++ cs_desc.s = cs_desc.g = cs_desc.p = 1; ++ ctxt->ops->set_segment(ctxt, 0, &cs_desc, 0, VCPU_SREG_CS); ++ } ++ ++ /* For the 64-bit case, this will clear EFER.LMA. */ + cr0 = ctxt->ops->get_cr(ctxt, 0); + if (cr0 & X86_CR0_PE) + ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE)); +- cr4 = ctxt->ops->get_cr(ctxt, 4); ++ ++ /* Now clear CR4.PAE (which must be done before clearing EFER.LME). */ + if (cr4 & X86_CR4_PAE) + ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE); ++ ++ /* And finally go back to 32-bit mode. */ + efer = 0; + ctxt->ops->set_msr(ctxt, MSR_EFER, efer); + +@@ -4455,7 +4474,7 @@ static const struct opcode twobyte_table[256] = { + F(DstMem | SrcReg | Src2CL | ModRM, em_shld), N, N, + /* 0xA8 - 0xAF */ + I(Stack | Src2GS, em_push_sreg), I(Stack | Src2GS, em_pop_sreg), +- II(No64 | EmulateOnUD | ImplicitOps, em_rsm, rsm), ++ II(EmulateOnUD | ImplicitOps, em_rsm, rsm), + F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_bts), + F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shrd), + F(DstMem | SrcReg | Src2CL | ModRM, em_shrd), +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 8d9013c5e1ee..ae4483a3e1a7 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -348,6 +348,8 @@ void kvm_apic_update_irr(struct kvm_vcpu *vcpu, u32 *pir) + struct kvm_lapic *apic = vcpu->arch.apic; + + __kvm_apic_update_irr(pir, apic->regs); ++ ++ kvm_make_request(KVM_REQ_EVENT, vcpu); + } + EXPORT_SYMBOL_GPL(kvm_apic_update_irr); + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 2f9ed1ff0632..d7f89387ba0c 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1086,7 +1086,7 @@ static u64 svm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc) + return target_tsc - tsc; + } + +-static void init_vmcb(struct vcpu_svm *svm, bool init_event) ++static void init_vmcb(struct vcpu_svm *svm) + { + struct vmcb_control_area *control = &svm->vmcb->control; + struct vmcb_save_area *save = &svm->vmcb->save; +@@ -1107,6 +1107,7 @@ static void init_vmcb(struct vcpu_svm *svm, bool init_event) + set_exception_intercept(svm, PF_VECTOR); + set_exception_intercept(svm, UD_VECTOR); + set_exception_intercept(svm, MC_VECTOR); ++ set_exception_intercept(svm, AC_VECTOR); + + set_intercept(svm, INTERCEPT_INTR); + set_intercept(svm, INTERCEPT_NMI); +@@ -1157,8 +1158,7 @@ static void init_vmcb(struct vcpu_svm *svm, bool init_event) + init_sys_seg(&save->ldtr, SEG_TYPE_LDT); + init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16); + +- if (!init_event) +- svm_set_efer(&svm->vcpu, 0); ++ svm_set_efer(&svm->vcpu, 0); + save->dr6 = 0xffff0ff0; + kvm_set_rflags(&svm->vcpu, 2); + save->rip = 0x0000fff0; +@@ -1212,7 +1212,7 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + if (kvm_vcpu_is_reset_bsp(&svm->vcpu)) + svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP; + } +- init_vmcb(svm, init_event); ++ init_vmcb(svm); + + kvm_cpuid(vcpu, &eax, &dummy, &dummy, &dummy); + kvm_register_write(vcpu, VCPU_REGS_RDX, eax); +@@ -1268,7 +1268,7 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id) + clear_page(svm->vmcb); + svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT; + svm->asid_generation = 0; +- init_vmcb(svm, false); ++ init_vmcb(svm); + + svm_init_osvw(&svm->vcpu); + +@@ -1796,6 +1796,12 @@ static int ud_interception(struct vcpu_svm *svm) + return 1; + } + ++static int ac_interception(struct vcpu_svm *svm) ++{ ++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0); ++ return 1; ++} ++ + static void svm_fpu_activate(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); +@@ -1890,7 +1896,7 @@ static int shutdown_interception(struct vcpu_svm *svm) + * so reinitialize it. + */ + clear_page(svm->vmcb); +- init_vmcb(svm, false); ++ init_vmcb(svm); + + kvm_run->exit_reason = KVM_EXIT_SHUTDOWN; + return 0; +@@ -3371,6 +3377,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = { + [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception, + [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception, + [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception, ++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception, + [SVM_EXIT_INTR] = intr_interception, + [SVM_EXIT_NMI] = nmi_interception, + [SVM_EXIT_SMI] = nop_on_interception, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 6a8bc64566ab..343d3692dd65 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1567,7 +1567,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) + u32 eb; + + eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | +- (1u << NM_VECTOR) | (1u << DB_VECTOR); ++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR); + if ((vcpu->guest_debug & + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) +@@ -4771,8 +4771,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + vmx_set_cr0(vcpu, cr0); /* enter rmode */ + vmx->vcpu.arch.cr0 = cr0; + vmx_set_cr4(vcpu, 0); +- if (!init_event) +- vmx_set_efer(vcpu, 0); ++ vmx_set_efer(vcpu, 0); + vmx_fpu_activate(vcpu); + update_exception_bitmap(vcpu); + +@@ -5104,6 +5103,9 @@ static int handle_exception(struct kvm_vcpu *vcpu) + return handle_rmode_exception(vcpu, ex_no, error_code); + + switch (ex_no) { ++ case AC_VECTOR: ++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code); ++ return 1; + case DB_VECTOR: + dr6 = vmcs_readl(EXIT_QUALIFICATION); + if (!(vcpu->guest_debug & +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 9a9a19830321..43609af03283 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -622,7 +622,9 @@ int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) + if ((cr0 ^ old_cr0) & update_bits) + kvm_mmu_reset_context(vcpu); + +- if ((cr0 ^ old_cr0) & X86_CR0_CD) ++ if (((cr0 ^ old_cr0) & X86_CR0_CD) && ++ kvm_arch_has_noncoherent_dma(vcpu->kvm) && ++ !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED)) + kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL); + + return 0; +@@ -4059,6 +4061,15 @@ static int kvm_read_guest_virt_system(struct x86_emulate_ctxt *ctxt, + return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, 0, exception); + } + ++static int kvm_read_guest_phys_system(struct x86_emulate_ctxt *ctxt, ++ unsigned long addr, void *val, unsigned int bytes) ++{ ++ struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt); ++ int r = kvm_vcpu_read_guest(vcpu, addr, val, bytes); ++ ++ return r < 0 ? X86EMUL_IO_NEEDED : X86EMUL_CONTINUE; ++} ++ + int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, + gva_t addr, void *val, + unsigned int bytes, +@@ -4794,6 +4805,7 @@ static const struct x86_emulate_ops emulate_ops = { + .write_gpr = emulator_write_gpr, + .read_std = kvm_read_guest_virt_system, + .write_std = kvm_write_guest_virt_system, ++ .read_phys = kvm_read_guest_phys_system, + .fetch = kvm_fetch_guest_virt, + .read_emulated = emulator_read_emulated, + .write_emulated = emulator_write_emulated, +diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c +index 134948b0926f..71fc79a58a15 100644 +--- a/arch/x86/mm/mpx.c ++++ b/arch/x86/mm/mpx.c +@@ -585,6 +585,29 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm, + } + + /* ++ * We only want to do a 4-byte get_user() on 32-bit. Otherwise, ++ * we might run off the end of the bounds table if we are on ++ * a 64-bit kernel and try to get 8 bytes. ++ */ ++int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret, ++ long __user *bd_entry_ptr) ++{ ++ u32 bd_entry_32; ++ int ret; ++ ++ if (is_64bit_mm(mm)) ++ return get_user(*bd_entry_ret, bd_entry_ptr); ++ ++ /* ++ * Note that get_user() uses the type of the *pointer* to ++ * establish the size of the get, not the destination. ++ */ ++ ret = get_user(bd_entry_32, (u32 __user *)bd_entry_ptr); ++ *bd_entry_ret = bd_entry_32; ++ return ret; ++} ++ ++/* + * Get the base of bounds tables pointed by specific bounds + * directory entry. + */ +@@ -604,7 +627,7 @@ static int get_bt_addr(struct mm_struct *mm, + int need_write = 0; + + pagefault_disable(); +- ret = get_user(bd_entry, bd_entry_ptr); ++ ret = get_user_bd_entry(mm, &bd_entry, bd_entry_ptr); + pagefault_enable(); + if (!ret) + break; +@@ -699,11 +722,23 @@ static unsigned long mpx_get_bt_entry_offset_bytes(struct mm_struct *mm, + */ + static inline unsigned long bd_entry_virt_space(struct mm_struct *mm) + { +- unsigned long long virt_space = (1ULL << boot_cpu_data.x86_virt_bits); +- if (is_64bit_mm(mm)) +- return virt_space / MPX_BD_NR_ENTRIES_64; +- else +- return virt_space / MPX_BD_NR_ENTRIES_32; ++ unsigned long long virt_space; ++ unsigned long long GB = (1ULL << 30); ++ ++ /* ++ * This covers 32-bit emulation as well as 32-bit kernels ++ * running on 64-bit harware. ++ */ ++ if (!is_64bit_mm(mm)) ++ return (4ULL * GB) / MPX_BD_NR_ENTRIES_32; ++ ++ /* ++ * 'x86_virt_bits' returns what the hardware is capable ++ * of, and returns the full >32-bit adddress space when ++ * running 32-bit kernels on 64-bit hardware. ++ */ ++ virt_space = (1ULL << boot_cpu_data.x86_virt_bits); ++ return virt_space / MPX_BD_NR_ENTRIES_64; + } + + /* +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index e527a3e13939..fa893c3ec408 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -93,6 +93,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x04CA, 0x300f) }, + { USB_DEVICE(0x04CA, 0x3010) }, + { USB_DEVICE(0x0930, 0x0219) }, ++ { USB_DEVICE(0x0930, 0x021c) }, + { USB_DEVICE(0x0930, 0x0220) }, + { USB_DEVICE(0x0930, 0x0227) }, + { USB_DEVICE(0x0b05, 0x17d0) }, +@@ -104,6 +105,7 @@ static const struct usb_device_id ath3k_table[] = { + { USB_DEVICE(0x0CF3, 0x311F) }, + { USB_DEVICE(0x0cf3, 0x3121) }, + { USB_DEVICE(0x0CF3, 0x817a) }, ++ { USB_DEVICE(0x0CF3, 0x817b) }, + { USB_DEVICE(0x0cf3, 0xe003) }, + { USB_DEVICE(0x0CF3, 0xE004) }, + { USB_DEVICE(0x0CF3, 0xE005) }, +@@ -153,6 +155,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, +@@ -164,6 +167,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { + { USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0CF3, 0x817b), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b6aceaf82aa8..3d0d643c8bff 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -195,6 +195,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, +@@ -206,6 +207,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, +diff --git a/drivers/clk/bcm/clk-iproc-pll.c b/drivers/clk/bcm/clk-iproc-pll.c +index 2dda4e8295a9..d679ab869653 100644 +--- a/drivers/clk/bcm/clk-iproc-pll.c ++++ b/drivers/clk/bcm/clk-iproc-pll.c +@@ -345,8 +345,8 @@ static unsigned long iproc_pll_recalc_rate(struct clk_hw *hw, + struct iproc_pll *pll = clk->pll; + const struct iproc_pll_ctrl *ctrl = pll->ctrl; + u32 val; +- u64 ndiv; +- unsigned int ndiv_int, ndiv_frac, pdiv; ++ u64 ndiv, ndiv_int, ndiv_frac; ++ unsigned int pdiv; + + if (parent_rate == 0) + return 0; +@@ -366,22 +366,19 @@ static unsigned long iproc_pll_recalc_rate(struct clk_hw *hw, + val = readl(pll->pll_base + ctrl->ndiv_int.offset); + ndiv_int = (val >> ctrl->ndiv_int.shift) & + bit_mask(ctrl->ndiv_int.width); +- ndiv = (u64)ndiv_int << ctrl->ndiv_int.shift; ++ ndiv = ndiv_int << 20; + + if (ctrl->flags & IPROC_CLK_PLL_HAS_NDIV_FRAC) { + val = readl(pll->pll_base + ctrl->ndiv_frac.offset); + ndiv_frac = (val >> ctrl->ndiv_frac.shift) & + bit_mask(ctrl->ndiv_frac.width); +- +- if (ndiv_frac != 0) +- ndiv = ((u64)ndiv_int << ctrl->ndiv_int.shift) | +- ndiv_frac; ++ ndiv += ndiv_frac; + } + + val = readl(pll->pll_base + ctrl->pdiv.offset); + pdiv = (val >> ctrl->pdiv.shift) & bit_mask(ctrl->pdiv.width); + +- clk->rate = (ndiv * parent_rate) >> ctrl->ndiv_int.shift; ++ clk->rate = (ndiv * parent_rate) >> 20; + + if (pdiv == 0) + clk->rate *= 2; +diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c +index a3893ea2199d..08c5ee976879 100644 +--- a/drivers/clk/versatile/clk-icst.c ++++ b/drivers/clk/versatile/clk-icst.c +@@ -157,8 +157,10 @@ struct clk *icst_clk_register(struct device *dev, + icst->lockreg = base + desc->lock_offset; + + clk = clk_register(dev, &icst->hw); +- if (IS_ERR(clk)) ++ if (IS_ERR(clk)) { ++ kfree(pclone); + kfree(icst); ++ } + + return clk; + } +diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c +index a151ee2eed2a..08a693cd38cc 100644 +--- a/drivers/mfd/twl6040.c ++++ b/drivers/mfd/twl6040.c +@@ -647,6 +647,8 @@ static int twl6040_probe(struct i2c_client *client, + + twl6040->clk32k = devm_clk_get(&client->dev, "clk32k"); + if (IS_ERR(twl6040->clk32k)) { ++ if (PTR_ERR(twl6040->clk32k) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; + dev_info(&client->dev, "clk32k is not handled\n"); + twl6040->clk32k = NULL; + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 771a449d2f56..bcd7bddbe312 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1749,6 +1749,7 @@ err_undo_flags: + slave_dev->dev_addr)) + eth_hw_addr_random(bond_dev); + if (bond_dev->type != ARPHRD_ETHER) { ++ dev_close(bond_dev); + ether_setup(bond_dev); + bond_dev->flags |= IFF_MASTER; + bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING; +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index aede704605c6..141c2a42d7ed 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -915,7 +915,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev) + nla_put(skb, IFLA_CAN_BITTIMING_CONST, + sizeof(*priv->bittiming_const), priv->bittiming_const)) || + +- nla_put(skb, IFLA_CAN_CLOCK, sizeof(cm), &priv->clock) || ++ nla_put(skb, IFLA_CAN_CLOCK, sizeof(priv->clock), &priv->clock) || + nla_put_u32(skb, IFLA_CAN_STATE, state) || + nla_put(skb, IFLA_CAN_CTRLMODE, sizeof(cm), &cm) || + nla_put_u32(skb, IFLA_CAN_RESTART_MS, priv->restart_ms) || +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c +index 7b92e911a616..f10834be48a5 100644 +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -218,6 +218,9 @@ static void sja1000_start(struct net_device *dev) + priv->write_reg(priv, SJA1000_RXERR, 0x0); + priv->read_reg(priv, SJA1000_ECC); + ++ /* clear interrupt flags */ ++ priv->read_reg(priv, SJA1000_IR); ++ + /* leave reset mode */ + set_normal_mode(dev); + } +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 1805541b4240..5e3cd76cb69b 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -907,8 +907,10 @@ static void bcmgenet_power_up(struct bcmgenet_priv *priv, + } + + bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT); +- if (mode == GENET_POWER_PASSIVE) ++ if (mode == GENET_POWER_PASSIVE) { + bcmgenet_phy_power_set(priv->dev, true); ++ bcmgenet_mii_reset(priv->dev); ++ } + } + + /* ioctl handle special commands that are not present in ethtool. */ +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +index 7299d1075422..c739f7ebc992 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -674,6 +674,7 @@ int bcmgenet_mii_init(struct net_device *dev); + int bcmgenet_mii_config(struct net_device *dev); + int bcmgenet_mii_probe(struct net_device *dev); + void bcmgenet_mii_exit(struct net_device *dev); ++void bcmgenet_mii_reset(struct net_device *dev); + void bcmgenet_phy_power_set(struct net_device *dev, bool enable); + void bcmgenet_mii_setup(struct net_device *dev); + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index c8affad76f36..8bdfe53754ba 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -163,6 +163,7 @@ void bcmgenet_mii_setup(struct net_device *dev) + phy_print_status(phydev); + } + ++ + static int bcmgenet_fixed_phy_link_update(struct net_device *dev, + struct fixed_phy_status *status) + { +@@ -172,6 +173,22 @@ static int bcmgenet_fixed_phy_link_update(struct net_device *dev, + return 0; + } + ++/* Perform a voluntary PHY software reset, since the EPHY is very finicky about ++ * not doing it and will start corrupting packets ++ */ ++void bcmgenet_mii_reset(struct net_device *dev) ++{ ++ struct bcmgenet_priv *priv = netdev_priv(dev); ++ ++ if (GENET_IS_V4(priv)) ++ return; ++ ++ if (priv->phydev) { ++ phy_init_hw(priv->phydev); ++ phy_start_aneg(priv->phydev); ++ } ++} ++ + void bcmgenet_phy_power_set(struct net_device *dev, bool enable) + { + struct bcmgenet_priv *priv = netdev_priv(dev); +@@ -214,6 +231,7 @@ static void bcmgenet_internal_phy_setup(struct net_device *dev) + reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT); + reg |= EXT_PWR_DN_EN_LD; + bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT); ++ bcmgenet_mii_reset(dev); + } + + static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 514df76fc70f..0e49244981d6 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -949,7 +949,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp) + /* Set CPU queue access map - all CPUs have access to all RX + * queues and to all TX queues + */ +- for (cpu = 0; cpu < CONFIG_NR_CPUS; cpu++) ++ for_each_present_cpu(cpu) + mvreg_write(pp, MVNETA_CPU_MAP(cpu), + (MVNETA_CPU_RXQ_ACCESS_ALL_MASK | + MVNETA_CPU_TXQ_ACCESS_ALL_MASK)); +@@ -1533,12 +1533,16 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo, + } + + skb = build_skb(data, pp->frag_size > PAGE_SIZE ? 0 : pp->frag_size); +- if (!skb) +- goto err_drop_frame; + ++ /* After refill old buffer has to be unmapped regardless ++ * the skb is successfully built or not. ++ */ + dma_unmap_single(dev->dev.parent, phys_addr, + MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE); + ++ if (!skb) ++ goto err_drop_frame; ++ + rcvd_pkts++; + rcvd_bytes += rx_bytes; + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index ff649ebef637..286cc6b69d57 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1849,7 +1849,9 @@ static void efx_ef10_tx_write(struct efx_tx_queue *tx_queue) + unsigned int write_ptr; + efx_qword_t *txd; + +- BUG_ON(tx_queue->write_count == tx_queue->insert_count); ++ tx_queue->xmit_more_available = false; ++ if (unlikely(tx_queue->write_count == tx_queue->insert_count)) ++ return; + + do { + write_ptr = tx_queue->write_count & tx_queue->ptr_mask; +diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c +index f08266f0eca2..5a1c5a8f278a 100644 +--- a/drivers/net/ethernet/sfc/farch.c ++++ b/drivers/net/ethernet/sfc/farch.c +@@ -321,7 +321,9 @@ void efx_farch_tx_write(struct efx_tx_queue *tx_queue) + unsigned write_ptr; + unsigned old_write_count = tx_queue->write_count; + +- BUG_ON(tx_queue->write_count == tx_queue->insert_count); ++ tx_queue->xmit_more_available = false; ++ if (unlikely(tx_queue->write_count == tx_queue->insert_count)) ++ return; + + do { + write_ptr = tx_queue->write_count & tx_queue->ptr_mask; +diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h +index c530e1c4cb4f..24038ef96d9f 100644 +--- a/drivers/net/ethernet/sfc/net_driver.h ++++ b/drivers/net/ethernet/sfc/net_driver.h +@@ -219,6 +219,7 @@ struct efx_tx_buffer { + * @tso_packets: Number of packets via the TSO xmit path + * @pushes: Number of times the TX push feature has been used + * @pio_packets: Number of times the TX PIO feature has been used ++ * @xmit_more_available: Are any packets waiting to be pushed to the NIC + * @empty_read_count: If the completion path has seen the queue as empty + * and the transmission path has not yet checked this, the value of + * @read_count bitwise-added to %EFX_EMPTY_COUNT_VALID; otherwise 0. +@@ -253,6 +254,7 @@ struct efx_tx_queue { + unsigned int tso_packets; + unsigned int pushes; + unsigned int pio_packets; ++ bool xmit_more_available; + /* Statistics to supplement MAC stats */ + unsigned long tx_packets; + +diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c +index 1833a0146571..67f6afaa022f 100644 +--- a/drivers/net/ethernet/sfc/tx.c ++++ b/drivers/net/ethernet/sfc/tx.c +@@ -431,8 +431,20 @@ finish_packet: + efx_tx_maybe_stop_queue(tx_queue); + + /* Pass off to hardware */ +- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) ++ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { ++ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); ++ ++ /* There could be packets left on the partner queue if those ++ * SKBs had skb->xmit_more set. If we do not push those they ++ * could be left for a long time and cause a netdev watchdog. ++ */ ++ if (txq2->xmit_more_available) ++ efx_nic_push_buffers(txq2); ++ + efx_nic_push_buffers(tx_queue); ++ } else { ++ tx_queue->xmit_more_available = skb->xmit_more; ++ } + + tx_queue->tx_packets++; + +@@ -722,6 +734,7 @@ void efx_init_tx_queue(struct efx_tx_queue *tx_queue) + tx_queue->read_count = 0; + tx_queue->old_read_count = 0; + tx_queue->empty_read_count = 0 | EFX_EMPTY_COUNT_VALID; ++ tx_queue->xmit_more_available = false; + + /* Set up TX descriptor ring */ + efx_nic_init_tx(tx_queue); +@@ -747,6 +760,7 @@ void efx_fini_tx_queue(struct efx_tx_queue *tx_queue) + + ++tx_queue->read_count; + } ++ tx_queue->xmit_more_available = false; + netdev_tx_reset_queue(tx_queue->core_txq); + } + +@@ -1302,8 +1316,20 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue, + efx_tx_maybe_stop_queue(tx_queue); + + /* Pass off to hardware */ +- if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) ++ if (!skb->xmit_more || netif_xmit_stopped(tx_queue->core_txq)) { ++ struct efx_tx_queue *txq2 = efx_tx_queue_partner(tx_queue); ++ ++ /* There could be packets left on the partner queue if those ++ * SKBs had skb->xmit_more set. If we do not push those they ++ * could be left for a long time and cause a netdev watchdog. ++ */ ++ if (txq2->xmit_more_available) ++ efx_nic_push_buffers(txq2); ++ + efx_nic_push_buffers(tx_queue); ++ } else { ++ tx_queue->xmit_more_available = skb->xmit_more; ++ } + + tx_queue->tso_bursts++; + return NETDEV_TX_OK; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index 771cda2a48b2..2e51b816a7e8 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -721,10 +721,13 @@ static int stmmac_get_ts_info(struct net_device *dev, + { + struct stmmac_priv *priv = netdev_priv(dev); + +- if ((priv->hwts_tx_en) && (priv->hwts_rx_en)) { ++ if ((priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp)) { + +- info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | ++ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | ++ SOF_TIMESTAMPING_TX_HARDWARE | ++ SOF_TIMESTAMPING_RX_SOFTWARE | + SOF_TIMESTAMPING_RX_HARDWARE | ++ SOF_TIMESTAMPING_SOFTWARE | + SOF_TIMESTAMPING_RAW_HARDWARE; + + if (priv->ptp_clock) +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index b87b98617073..9e3d89d06445 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -142,12 +142,17 @@ static const char *const ath10k_core_fw_feature_str[] = { + [ATH10K_FW_FEATURE_IGNORE_OTP_RESULT] = "ignore-otp", + [ATH10K_FW_FEATURE_NO_NWIFI_DECAP_4ADDR_PADDING] = "no-4addr-pad", + [ATH10K_FW_FEATURE_SUPPORTS_SKIP_CLOCK_INIT] = "skip-clock-init", ++ [ATH10K_FW_FEATURE_RAW_MODE_SUPPORT] = "raw-mode", + }; + + static unsigned int ath10k_core_get_fw_feature_str(char *buf, + size_t buf_len, + enum ath10k_fw_features feat) + { ++ /* make sure that ath10k_core_fw_feature_str[] gets updated */ ++ BUILD_BUG_ON(ARRAY_SIZE(ath10k_core_fw_feature_str) != ++ ATH10K_FW_FEATURE_COUNT); ++ + if (feat >= ARRAY_SIZE(ath10k_core_fw_feature_str) || + WARN_ON(!ath10k_core_fw_feature_str[feat])) { + return scnprintf(buf, buf_len, "bit%d", feat); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 64674c955d44..e1d32de8b111 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2083,7 +2083,8 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar, + enum ieee80211_band band; + const u8 *ht_mcs_mask; + const u16 *vht_mcs_mask; +- int i, n, max_nss; ++ int i, n; ++ u8 max_nss; + u32 stbc; + + lockdep_assert_held(&ar->conf_mutex); +@@ -2168,7 +2169,7 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar, + arg->peer_ht_rates.rates[i] = i; + } else { + arg->peer_ht_rates.num_rates = n; +- arg->peer_num_spatial_streams = max_nss; ++ arg->peer_num_spatial_streams = min(sta->rx_nss, max_nss); + } + + ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ht peer %pM mcs cnt %d nss %d\n", +@@ -4055,7 +4056,7 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed) + + static u32 get_nss_from_chainmask(u16 chain_mask) + { +- if ((chain_mask & 0x15) == 0x15) ++ if ((chain_mask & 0xf) == 0xf) + return 4; + else if ((chain_mask & 0x7) == 0x7) + return 3; +diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c +index 644b58bc5226..639761fb2bfb 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c +@@ -423,14 +423,21 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + /* 8000 Series */ + {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1132, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0110, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x01F0, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0012, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1012, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0250, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0150, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)}, +- {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)}, +@@ -438,18 +445,28 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9132, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8050, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x9050, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0044, iwl8260_2n_cfg)}, + {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0810, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0910, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0850, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)}, + #endif /* CONFIG_IWLMVM */ + + {0} +diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c +index 6ba7d300b08f..90283453073c 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -592,10 +592,8 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + + do { + ret = iwl_pcie_set_hw_ready(trans); +- if (ret >= 0) { +- ret = 0; +- goto out; +- } ++ if (ret >= 0) ++ return 0; + + usleep_range(200, 1000); + t += 200; +@@ -605,10 +603,6 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + + IWL_ERR(trans, "Couldn't prepare the card\n"); + +-out: +- iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, +- CSR_RESET_LINK_PWR_MGMT_DISABLED); +- + return ret; + } + +diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c +index 5a0636d43a1b..5583856fc5c4 100644 +--- a/drivers/net/wireless/mwifiex/debugfs.c ++++ b/drivers/net/wireless/mwifiex/debugfs.c +@@ -731,7 +731,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, + (struct mwifiex_private *) file->private_data; + unsigned long addr = get_zeroed_page(GFP_KERNEL); + char *buf = (char *) addr; +- int pos = 0, ret = 0, i; ++ int pos, ret, i; + u8 value[MAX_EEPROM_DATA]; + + if (!buf) +@@ -739,7 +739,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, + + if (saved_offset == -1) { + /* No command has been given */ +- pos += snprintf(buf, PAGE_SIZE, "0"); ++ pos = snprintf(buf, PAGE_SIZE, "0"); + goto done; + } + +@@ -748,17 +748,17 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf, + (u16) saved_bytes, value); + if (ret) { + ret = -EINVAL; +- goto done; ++ goto out_free; + } + +- pos += snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); ++ pos = snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes); + + for (i = 0; i < saved_bytes; i++) +- pos += snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]); +- +- ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos); ++ pos += scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]); + + done: ++ ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos); ++out_free: + free_page(addr); + return ret; + } +diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c +index 408b68460716..21192b6f9c64 100644 +--- a/drivers/net/wireless/mwifiex/pcie.c ++++ b/drivers/net/wireless/mwifiex/pcie.c +@@ -1815,7 +1815,6 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter, + if (!card->evt_buf_list[rdptr]) { + skb_push(skb, INTF_HEADER_LEN); + skb_put(skb, MAX_EVENT_SIZE - skb->len); +- memset(skb->data, 0, MAX_EVENT_SIZE); + if (mwifiex_map_pci_memory(adapter, skb, + MAX_EVENT_SIZE, + PCI_DMA_FROMDEVICE)) +diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c +index 5847863a2d6b..278ec477fd90 100644 +--- a/drivers/net/wireless/mwifiex/scan.c ++++ b/drivers/net/wireless/mwifiex/scan.c +@@ -1889,7 +1889,7 @@ mwifiex_active_scan_req_for_passive_chan(struct mwifiex_private *priv) + u8 id = 0; + struct mwifiex_user_scan_cfg *user_scan_cfg; + +- if (adapter->active_scan_triggered) { ++ if (adapter->active_scan_triggered || !priv->scan_request) { + adapter->active_scan_triggered = false; + return 0; + } +diff --git a/drivers/nfc/st-nci/spi.c b/drivers/nfc/st-nci/spi.c +index 598a58c4d6d1..887d308c2ec8 100644 +--- a/drivers/nfc/st-nci/spi.c ++++ b/drivers/nfc/st-nci/spi.c +@@ -25,6 +25,7 @@ + #include <linux/interrupt.h> + #include <linux/delay.h> + #include <linux/nfc.h> ++#include <net/nfc/nci.h> + #include <linux/platform_data/st-nci.h> + + #include "ndlc.h" +@@ -94,7 +95,8 @@ static int st_nci_spi_write(void *phy_id, struct sk_buff *skb) + struct st_nci_spi_phy *phy = phy_id; + struct spi_device *dev = phy->spi_dev; + struct sk_buff *skb_rx; +- u8 buf[ST_NCI_SPI_MAX_SIZE]; ++ u8 buf[ST_NCI_SPI_MAX_SIZE + NCI_DATA_HDR_SIZE + ++ ST_NCI_FRAME_HEADROOM + ST_NCI_FRAME_TAILROOM]; + struct spi_transfer spi_xfer = { + .tx_buf = skb->data, + .rx_buf = buf, +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +index e1a3721bc8e5..d809c9eaa323 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -584,7 +584,7 @@ static void pm8xxx_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) + } + + #else +-#define msm_gpio_dbg_show NULL ++#define pm8xxx_gpio_dbg_show NULL + #endif + + static struct gpio_chip pm8xxx_gpio_template = { +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c +index 6652b8d7f707..8982027de8e8 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c +@@ -639,7 +639,7 @@ static void pm8xxx_mpp_dbg_show(struct seq_file *s, struct gpio_chip *chip) + } + + #else +-#define msm_mpp_dbg_show NULL ++#define pm8xxx_mpp_dbg_show NULL + #endif + + static struct gpio_chip pm8xxx_mpp_template = { +diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +index 918f3b643f1b..589872cc8adb 100644 +--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c ++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +@@ -539,6 +539,12 @@ static int uniphier_pmx_set_one_mux(struct pinctrl_dev *pctldev, unsigned pin, + unsigned reg, reg_end, shift, mask; + int ret; + ++ /* some pins need input-enabling */ ++ ret = uniphier_conf_pin_input_enable(pctldev, ++ &pctldev->desc->pins[pin], 1); ++ if (ret) ++ return ret; ++ + reg = UNIPHIER_PINCTRL_PINMUX_BASE + pin * mux_bits / 32 * reg_stride; + reg_end = reg + reg_stride; + shift = pin * mux_bits % 32; +@@ -563,9 +569,7 @@ static int uniphier_pmx_set_one_mux(struct pinctrl_dev *pctldev, unsigned pin, + return ret; + } + +- /* some pins need input-enabling */ +- return uniphier_conf_pin_input_enable(pctldev, +- &pctldev->desc->pins[pin], 1); ++ return 0; + } + + static int uniphier_pmx_set_mux(struct pinctrl_dev *pctldev, +diff --git a/drivers/staging/lustre/include/linux/lnet/lib-lnet.h b/drivers/staging/lustre/include/linux/lnet/lib-lnet.h +index a9c9a077c77d..bc3d907fd20f 100644 +--- a/drivers/staging/lustre/include/linux/lnet/lib-lnet.h ++++ b/drivers/staging/lustre/include/linux/lnet/lib-lnet.h +@@ -680,7 +680,7 @@ void lnet_debug_peer(lnet_nid_t nid); + static inline void + lnet_peer_set_alive(lnet_peer_t *lp) + { +- lp->lp_last_alive = lp->lp_last_query = get_seconds(); ++ lp->lp_last_alive = lp->lp_last_query = jiffies; + if (!lp->lp_alive) + lnet_notify_locked(lp, 0, 1, lp->lp_last_alive); + } +diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c +index f8b5b332e7c3..943a0e204532 100644 +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -144,6 +144,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = { + {USB_DEVICE(0x0DF6, 0x0058)}, + {USB_DEVICE(0x0DF6, 0x0049)}, + {USB_DEVICE(0x0DF6, 0x004C)}, ++ {USB_DEVICE(0x0DF6, 0x006C)}, + {USB_DEVICE(0x0DF6, 0x0064)}, + /* Skyworth */ + {USB_DEVICE(0x14b2, 0x3300)}, +diff --git a/drivers/tty/mips_ejtag_fdc.c b/drivers/tty/mips_ejtag_fdc.c +index a8c8cfd52a23..57ff5d3157a6 100644 +--- a/drivers/tty/mips_ejtag_fdc.c ++++ b/drivers/tty/mips_ejtag_fdc.c +@@ -1048,38 +1048,6 @@ err_destroy_ports: + return ret; + } + +-static int mips_ejtag_fdc_tty_remove(struct mips_cdmm_device *dev) +-{ +- struct mips_ejtag_fdc_tty *priv = mips_cdmm_get_drvdata(dev); +- struct mips_ejtag_fdc_tty_port *dport; +- int nport; +- unsigned int cfg; +- +- if (priv->irq >= 0) { +- raw_spin_lock_irq(&priv->lock); +- cfg = mips_ejtag_fdc_read(priv, REG_FDCFG); +- /* Disable interrupts */ +- cfg &= ~(REG_FDCFG_TXINTTHRES | REG_FDCFG_RXINTTHRES); +- cfg |= REG_FDCFG_TXINTTHRES_DISABLED; +- cfg |= REG_FDCFG_RXINTTHRES_DISABLED; +- mips_ejtag_fdc_write(priv, REG_FDCFG, cfg); +- raw_spin_unlock_irq(&priv->lock); +- } else { +- priv->removing = true; +- del_timer_sync(&priv->poll_timer); +- } +- kthread_stop(priv->thread); +- if (dev->cpu == 0) +- mips_ejtag_fdc_con.tty_drv = NULL; +- tty_unregister_driver(priv->driver); +- for (nport = 0; nport < NUM_TTY_CHANNELS; nport++) { +- dport = &priv->ports[nport]; +- tty_port_destroy(&dport->port); +- } +- put_tty_driver(priv->driver); +- return 0; +-} +- + static int mips_ejtag_fdc_tty_cpu_down(struct mips_cdmm_device *dev) + { + struct mips_ejtag_fdc_tty *priv = mips_cdmm_get_drvdata(dev); +@@ -1152,12 +1120,11 @@ static struct mips_cdmm_driver mips_ejtag_fdc_tty_driver = { + .name = "mips_ejtag_fdc", + }, + .probe = mips_ejtag_fdc_tty_probe, +- .remove = mips_ejtag_fdc_tty_remove, + .cpu_down = mips_ejtag_fdc_tty_cpu_down, + .cpu_up = mips_ejtag_fdc_tty_cpu_up, + .id_table = mips_ejtag_fdc_tty_ids, + }; +-module_mips_cdmm_driver(mips_ejtag_fdc_tty_driver); ++builtin_mips_cdmm_driver(mips_ejtag_fdc_tty_driver); + + static int __init mips_ejtag_fdc_init_console(void) + { +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index b09023b07169..a0285da0244c 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -169,7 +169,7 @@ static inline int tty_copy_to_user(struct tty_struct *tty, + { + struct n_tty_data *ldata = tty->disc_data; + +- tty_audit_add_data(tty, to, n, ldata->icanon); ++ tty_audit_add_data(tty, from, n, ldata->icanon); + return copy_to_user(to, from, n); + } + +diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c +index 90ca082935f6..3d245cd3d8e6 100644 +--- a/drivers/tty/tty_audit.c ++++ b/drivers/tty/tty_audit.c +@@ -265,7 +265,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty, + * + * Audit @data of @size from @tty, if necessary. + */ +-void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ++void tty_audit_add_data(struct tty_struct *tty, const void *data, + size_t size, unsigned icanon) + { + struct tty_audit_buf *buf; +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 2eefaa6e3e3a..f435977de740 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1282,18 +1282,22 @@ int tty_send_xchar(struct tty_struct *tty, char ch) + int was_stopped = tty->stopped; + + if (tty->ops->send_xchar) { ++ down_read(&tty->termios_rwsem); + tty->ops->send_xchar(tty, ch); ++ up_read(&tty->termios_rwsem); + return 0; + } + + if (tty_write_lock(tty, 0) < 0) + return -ERESTARTSYS; + ++ down_read(&tty->termios_rwsem); + if (was_stopped) + start_tty(tty); + tty->ops->write(tty, &ch, 1); + if (was_stopped) + stop_tty(tty); ++ up_read(&tty->termios_rwsem); + tty_write_unlock(tty); + return 0; + } +diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c +index 9c5aebfe7053..1445dd39aa62 100644 +--- a/drivers/tty/tty_ioctl.c ++++ b/drivers/tty/tty_ioctl.c +@@ -1147,16 +1147,12 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file, + spin_unlock_irq(&tty->flow_lock); + break; + case TCIOFF: +- down_read(&tty->termios_rwsem); + if (STOP_CHAR(tty) != __DISABLED_CHAR) + retval = tty_send_xchar(tty, STOP_CHAR(tty)); +- up_read(&tty->termios_rwsem); + break; + case TCION: +- down_read(&tty->termios_rwsem); + if (START_CHAR(tty) != __DISABLED_CHAR) + retval = tty_send_xchar(tty, START_CHAR(tty)); +- up_read(&tty->termios_rwsem); + break; + default: + return -EINVAL; +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index dcc50c878159..ad53aed9b280 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -73,6 +73,12 @@ struct ci_hdrc_imx_data { + struct imx_usbmisc_data *usbmisc_data; + bool supports_runtime_pm; + bool in_lpm; ++ /* SoC before i.mx6 (except imx23/imx28) needs three clks */ ++ bool need_three_clks; ++ struct clk *clk_ipg; ++ struct clk *clk_ahb; ++ struct clk *clk_per; ++ /* --------------------------------- */ + }; + + /* Common functions shared by usbmisc drivers */ +@@ -124,6 +130,102 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev) + } + + /* End of common functions shared by usbmisc drivers*/ ++static int imx_get_clks(struct device *dev) ++{ ++ struct ci_hdrc_imx_data *data = dev_get_drvdata(dev); ++ int ret = 0; ++ ++ data->clk_ipg = devm_clk_get(dev, "ipg"); ++ if (IS_ERR(data->clk_ipg)) { ++ /* If the platform only needs one clocks */ ++ data->clk = devm_clk_get(dev, NULL); ++ if (IS_ERR(data->clk)) { ++ ret = PTR_ERR(data->clk); ++ dev_err(dev, ++ "Failed to get clks, err=%ld,%ld\n", ++ PTR_ERR(data->clk), PTR_ERR(data->clk_ipg)); ++ return ret; ++ } ++ return ret; ++ } ++ ++ data->clk_ahb = devm_clk_get(dev, "ahb"); ++ if (IS_ERR(data->clk_ahb)) { ++ ret = PTR_ERR(data->clk_ahb); ++ dev_err(dev, ++ "Failed to get ahb clock, err=%d\n", ret); ++ return ret; ++ } ++ ++ data->clk_per = devm_clk_get(dev, "per"); ++ if (IS_ERR(data->clk_per)) { ++ ret = PTR_ERR(data->clk_per); ++ dev_err(dev, ++ "Failed to get per clock, err=%d\n", ret); ++ return ret; ++ } ++ ++ data->need_three_clks = true; ++ return ret; ++} ++ ++static int imx_prepare_enable_clks(struct device *dev) ++{ ++ struct ci_hdrc_imx_data *data = dev_get_drvdata(dev); ++ int ret = 0; ++ ++ if (data->need_three_clks) { ++ ret = clk_prepare_enable(data->clk_ipg); ++ if (ret) { ++ dev_err(dev, ++ "Failed to prepare/enable ipg clk, err=%d\n", ++ ret); ++ return ret; ++ } ++ ++ ret = clk_prepare_enable(data->clk_ahb); ++ if (ret) { ++ dev_err(dev, ++ "Failed to prepare/enable ahb clk, err=%d\n", ++ ret); ++ clk_disable_unprepare(data->clk_ipg); ++ return ret; ++ } ++ ++ ret = clk_prepare_enable(data->clk_per); ++ if (ret) { ++ dev_err(dev, ++ "Failed to prepare/enable per clk, err=%d\n", ++ ret); ++ clk_disable_unprepare(data->clk_ahb); ++ clk_disable_unprepare(data->clk_ipg); ++ return ret; ++ } ++ } else { ++ ret = clk_prepare_enable(data->clk); ++ if (ret) { ++ dev_err(dev, ++ "Failed to prepare/enable clk, err=%d\n", ++ ret); ++ return ret; ++ } ++ } ++ ++ return ret; ++} ++ ++static void imx_disable_unprepare_clks(struct device *dev) ++{ ++ struct ci_hdrc_imx_data *data = dev_get_drvdata(dev); ++ ++ if (data->need_three_clks) { ++ clk_disable_unprepare(data->clk_per); ++ clk_disable_unprepare(data->clk_ahb); ++ clk_disable_unprepare(data->clk_ipg); ++ } else { ++ clk_disable_unprepare(data->clk); ++ } ++} + + static int ci_hdrc_imx_probe(struct platform_device *pdev) + { +@@ -142,23 +244,18 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + ++ platform_set_drvdata(pdev, data); + data->usbmisc_data = usbmisc_get_init_data(&pdev->dev); + if (IS_ERR(data->usbmisc_data)) + return PTR_ERR(data->usbmisc_data); + +- data->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(data->clk)) { +- dev_err(&pdev->dev, +- "Failed to get clock, err=%ld\n", PTR_ERR(data->clk)); +- return PTR_ERR(data->clk); +- } ++ ret = imx_get_clks(&pdev->dev); ++ if (ret) ++ return ret; + +- ret = clk_prepare_enable(data->clk); +- if (ret) { +- dev_err(&pdev->dev, +- "Failed to prepare or enable clock, err=%d\n", ret); ++ ret = imx_prepare_enable_clks(&pdev->dev); ++ if (ret) + return ret; +- } + + data->phy = devm_usb_get_phy_by_phandle(&pdev->dev, "fsl,usbphy", 0); + if (IS_ERR(data->phy)) { +@@ -201,8 +298,6 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + goto disable_device; + } + +- platform_set_drvdata(pdev, data); +- + if (data->supports_runtime_pm) { + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); +@@ -215,7 +310,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) + disable_device: + ci_hdrc_remove_device(data->ci_pdev); + err_clk: +- clk_disable_unprepare(data->clk); ++ imx_disable_unprepare_clks(&pdev->dev); + return ret; + } + +@@ -229,7 +324,7 @@ static int ci_hdrc_imx_remove(struct platform_device *pdev) + pm_runtime_put_noidle(&pdev->dev); + } + ci_hdrc_remove_device(data->ci_pdev); +- clk_disable_unprepare(data->clk); ++ imx_disable_unprepare_clks(&pdev->dev); + + return 0; + } +@@ -241,7 +336,7 @@ static int imx_controller_suspend(struct device *dev) + + dev_dbg(dev, "at %s\n", __func__); + +- clk_disable_unprepare(data->clk); ++ imx_disable_unprepare_clks(dev); + data->in_lpm = true; + + return 0; +@@ -259,7 +354,7 @@ static int imx_controller_resume(struct device *dev) + return 0; + } + +- ret = clk_prepare_enable(data->clk); ++ ret = imx_prepare_enable_clks(dev); + if (ret) + return ret; + +@@ -274,7 +369,7 @@ static int imx_controller_resume(struct device *dev) + return 0; + + clk_disable: +- clk_disable_unprepare(data->clk); ++ imx_disable_unprepare_clks(dev); + return ret; + } + +diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c +index 080b7be3daf0..58c8485a0715 100644 +--- a/drivers/usb/chipidea/debug.c ++++ b/drivers/usb/chipidea/debug.c +@@ -322,8 +322,10 @@ static ssize_t ci_role_write(struct file *file, const char __user *ubuf, + return -EINVAL; + + pm_runtime_get_sync(ci->dev); ++ disable_irq(ci->irq); + ci_role_stop(ci); + ret = ci_role_start(ci, role); ++ enable_irq(ci->irq); + pm_runtime_put_sync(ci->dev); + + return ret ? ret : count; +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index 8223fe73ea85..391a1225b0ba 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1751,6 +1751,22 @@ static int ci_udc_start(struct usb_gadget *gadget, + return retval; + } + ++static void ci_udc_stop_for_otg_fsm(struct ci_hdrc *ci) ++{ ++ if (!ci_otg_is_fsm_mode(ci)) ++ return; ++ ++ mutex_lock(&ci->fsm.lock); ++ if (ci->fsm.otg->state == OTG_STATE_A_PERIPHERAL) { ++ ci->fsm.a_bidl_adis_tmout = 1; ++ ci_hdrc_otg_fsm_start(ci); ++ } else if (ci->fsm.otg->state == OTG_STATE_B_PERIPHERAL) { ++ ci->fsm.protocol = PROTO_UNDEF; ++ ci->fsm.otg->state = OTG_STATE_UNDEFINED; ++ } ++ mutex_unlock(&ci->fsm.lock); ++} ++ + /** + * ci_udc_stop: unregister a gadget driver + */ +@@ -1775,6 +1791,7 @@ static int ci_udc_stop(struct usb_gadget *gadget) + ci->driver = NULL; + spin_unlock_irqrestore(&ci->lock, flags); + ++ ci_udc_stop_for_otg_fsm(ci); + return 0; + } + +diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c +index 433bbc34a8a4..071964c7847f 100644 +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -884,11 +884,11 @@ static int usblp_wwait(struct usblp *usblp, int nonblock) + + add_wait_queue(&usblp->wwait, &waita); + for (;;) { +- set_current_state(TASK_INTERRUPTIBLE); + if (mutex_lock_interruptible(&usblp->mut)) { + rc = -EINTR; + break; + } ++ set_current_state(TASK_INTERRUPTIBLE); + rc = usblp_wtest(usblp, nonblock); + mutex_unlock(&usblp->mut); + if (rc <= 0) +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 064123e44566..51156ec91c78 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -488,6 +488,9 @@ static int dwc3_phy_setup(struct dwc3 *dwc) + if (dwc->dis_u2_susphy_quirk) + reg &= ~DWC3_GUSB2PHYCFG_SUSPHY; + ++ if (dwc->dis_enblslpm_quirk) ++ reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM; ++ + dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg); + + return 0; +@@ -507,12 +510,18 @@ static int dwc3_core_init(struct dwc3 *dwc) + + reg = dwc3_readl(dwc->regs, DWC3_GSNPSID); + /* This should read as U3 followed by revision number */ +- if ((reg & DWC3_GSNPSID_MASK) != 0x55330000) { ++ if ((reg & DWC3_GSNPSID_MASK) == 0x55330000) { ++ /* Detected DWC_usb3 IP */ ++ dwc->revision = reg; ++ } else if ((reg & DWC3_GSNPSID_MASK) == 0x33310000) { ++ /* Detected DWC_usb31 IP */ ++ dwc->revision = dwc3_readl(dwc->regs, DWC3_VER_NUMBER); ++ dwc->revision |= DWC3_REVISION_IS_DWC31; ++ } else { + dev_err(dwc->dev, "this is not a DesignWare USB3 DRD Core\n"); + ret = -ENODEV; + goto err0; + } +- dwc->revision = reg; + + /* + * Write Linux Version Code to our GUID register so it's easy to figure +@@ -879,6 +888,8 @@ static int dwc3_probe(struct platform_device *pdev) + "snps,dis_u3_susphy_quirk"); + dwc->dis_u2_susphy_quirk = of_property_read_bool(node, + "snps,dis_u2_susphy_quirk"); ++ dwc->dis_enblslpm_quirk = device_property_read_bool(dev, ++ "snps,dis_enblslpm_quirk"); + + dwc->tx_de_emphasis_quirk = of_property_read_bool(node, + "snps,tx_de_emphasis_quirk"); +@@ -909,6 +920,7 @@ static int dwc3_probe(struct platform_device *pdev) + dwc->rx_detect_poll_quirk = pdata->rx_detect_poll_quirk; + dwc->dis_u3_susphy_quirk = pdata->dis_u3_susphy_quirk; + dwc->dis_u2_susphy_quirk = pdata->dis_u2_susphy_quirk; ++ dwc->dis_enblslpm_quirk = pdata->dis_enblslpm_quirk; + + dwc->tx_de_emphasis_quirk = pdata->tx_de_emphasis_quirk; + if (pdata->tx_de_emphasis) +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 044778884585..6e53ce9ce320 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -108,6 +108,9 @@ + #define DWC3_GPRTBIMAP_FS0 0xc188 + #define DWC3_GPRTBIMAP_FS1 0xc18c + ++#define DWC3_VER_NUMBER 0xc1a0 ++#define DWC3_VER_TYPE 0xc1a4 ++ + #define DWC3_GUSB2PHYCFG(n) (0xc200 + (n * 0x04)) + #define DWC3_GUSB2I2CCTL(n) (0xc240 + (n * 0x04)) + +@@ -175,6 +178,7 @@ + #define DWC3_GUSB2PHYCFG_PHYSOFTRST (1 << 31) + #define DWC3_GUSB2PHYCFG_SUSPHY (1 << 6) + #define DWC3_GUSB2PHYCFG_ULPI_UTMI (1 << 4) ++#define DWC3_GUSB2PHYCFG_ENBLSLPM (1 << 8) + + /* Global USB2 PHY Vendor Control Register */ + #define DWC3_GUSB2PHYACC_NEWREGREQ (1 << 25) +@@ -712,6 +716,8 @@ struct dwc3_scratchpad_array { + * @rx_detect_poll_quirk: set if we enable rx_detect to polling lfps quirk + * @dis_u3_susphy_quirk: set if we disable usb3 suspend phy + * @dis_u2_susphy_quirk: set if we disable usb2 suspend phy ++ * @dis_enblslpm_quirk: set if we clear enblslpm in GUSB2PHYCFG, ++ * disabling the suspend signal to the PHY. + * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk + * @tx_de_emphasis: Tx de-emphasis value + * 0 - -6dB de-emphasis +@@ -766,6 +772,14 @@ struct dwc3 { + u32 num_event_buffers; + u32 u1u2; + u32 maximum_speed; ++ ++ /* ++ * All 3.1 IP version constants are greater than the 3.0 IP ++ * version constants. This works for most version checks in ++ * dwc3. However, in the future, this may not apply as ++ * features may be developed on newer versions of the 3.0 IP ++ * that are not in the 3.1 IP. ++ */ + u32 revision; + + #define DWC3_REVISION_173A 0x5533173a +@@ -788,6 +802,13 @@ struct dwc3 { + #define DWC3_REVISION_270A 0x5533270a + #define DWC3_REVISION_280A 0x5533280a + ++/* ++ * NOTICE: we're using bit 31 as a "is usb 3.1" flag. This is really ++ * just so dwc31 revisions are always larger than dwc3. ++ */ ++#define DWC3_REVISION_IS_DWC31 0x80000000 ++#define DWC3_USB31_REVISION_110A (0x3131302a | DWC3_REVISION_IS_USB31) ++ + enum dwc3_ep0_next ep0_next_event; + enum dwc3_ep0_state ep0state; + enum dwc3_link_state link_state; +@@ -841,6 +862,7 @@ struct dwc3 { + unsigned rx_detect_poll_quirk:1; + unsigned dis_u3_susphy_quirk:1; + unsigned dis_u2_susphy_quirk:1; ++ unsigned dis_enblslpm_quirk:1; + + unsigned tx_de_emphasis_quirk:1; + unsigned tx_de_emphasis:2; +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index f62617999f3c..2cd33cb07ed9 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -27,6 +27,8 @@ + #include "platform_data.h" + + #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce ++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf + #define PCI_DEVICE_ID_INTEL_BYT 0x0f37 + #define PCI_DEVICE_ID_INTEL_MRFLD 0x119e + #define PCI_DEVICE_ID_INTEL_BSW 0x22B7 +@@ -106,6 +108,22 @@ static int dwc3_pci_quirks(struct pci_dev *pdev) + } + } + ++ if (pdev->vendor == PCI_VENDOR_ID_SYNOPSYS && ++ (pdev->device == PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 || ++ pdev->device == PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI || ++ pdev->device == PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31)) { ++ ++ struct dwc3_platform_data pdata; ++ ++ memset(&pdata, 0, sizeof(pdata)); ++ pdata.usb3_lpm_capable = true; ++ pdata.has_lpm_erratum = true; ++ pdata.dis_enblslpm_quirk = true; ++ ++ return platform_device_add_data(pci_get_drvdata(pdev), &pdata, ++ sizeof(pdata)); ++ } ++ + return 0; + } + +@@ -178,6 +196,14 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, + PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3), + }, ++ { ++ PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, ++ PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI), ++ }, ++ { ++ PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, ++ PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31), ++ }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BSW), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), }, +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 1e8bdf817811..9c38e4b0a262 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1872,27 +1872,32 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep, + unsigned int i; + int ret; + +- req = next_request(&dep->req_queued); +- if (!req) { +- WARN_ON_ONCE(1); +- return 1; +- } +- i = 0; + do { +- slot = req->start_slot + i; +- if ((slot == DWC3_TRB_NUM - 1) && ++ req = next_request(&dep->req_queued); ++ if (!req) { ++ WARN_ON_ONCE(1); ++ return 1; ++ } ++ i = 0; ++ do { ++ slot = req->start_slot + i; ++ if ((slot == DWC3_TRB_NUM - 1) && + usb_endpoint_xfer_isoc(dep->endpoint.desc)) +- slot++; +- slot %= DWC3_TRB_NUM; +- trb = &dep->trb_pool[slot]; ++ slot++; ++ slot %= DWC3_TRB_NUM; ++ trb = &dep->trb_pool[slot]; ++ ++ ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, ++ event, status); ++ if (ret) ++ break; ++ } while (++i < req->request.num_mapped_sgs); ++ ++ dwc3_gadget_giveback(dep, req, status); + +- ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb, +- event, status); + if (ret) + break; +- } while (++i < req->request.num_mapped_sgs); +- +- dwc3_gadget_giveback(dep, req, status); ++ } while (1); + + if (usb_endpoint_xfer_isoc(dep->endpoint.desc) && + list_empty(&dep->req_queued)) { +@@ -2718,12 +2723,34 @@ int dwc3_gadget_init(struct dwc3 *dwc) + } + + dwc->gadget.ops = &dwc3_gadget_ops; +- dwc->gadget.max_speed = USB_SPEED_SUPER; + dwc->gadget.speed = USB_SPEED_UNKNOWN; + dwc->gadget.sg_supported = true; + dwc->gadget.name = "dwc3-gadget"; + + /* ++ * FIXME We might be setting max_speed to <SUPER, however versions ++ * <2.20a of dwc3 have an issue with metastability (documented ++ * elsewhere in this driver) which tells us we can't set max speed to ++ * anything lower than SUPER. ++ * ++ * Because gadget.max_speed is only used by composite.c and function ++ * drivers (i.e. it won't go into dwc3's registers) we are allowing this ++ * to happen so we avoid sending SuperSpeed Capability descriptor ++ * together with our BOS descriptor as that could confuse host into ++ * thinking we can handle super speed. ++ * ++ * Note that, in fact, we won't even support GetBOS requests when speed ++ * is less than super speed because we don't have means, yet, to tell ++ * composite.c that we are USB 2.0 + LPM ECN. ++ */ ++ if (dwc->revision < DWC3_REVISION_220A) ++ dwc3_trace(trace_dwc3_gadget, ++ "Changing max_speed on rev %08x\n", ++ dwc->revision); ++ ++ dwc->gadget.max_speed = dwc->maximum_speed; ++ ++ /* + * Per databook, DWC3 needs buffer size to be aligned to MaxPacketSize + * on ep out. + */ +diff --git a/drivers/usb/dwc3/platform_data.h b/drivers/usb/dwc3/platform_data.h +index d3614ecbb9ca..db2938002260 100644 +--- a/drivers/usb/dwc3/platform_data.h ++++ b/drivers/usb/dwc3/platform_data.h +@@ -42,6 +42,7 @@ struct dwc3_platform_data { + unsigned rx_detect_poll_quirk:1; + unsigned dis_u3_susphy_quirk:1; + unsigned dis_u2_susphy_quirk:1; ++ unsigned dis_enblslpm_quirk:1; + + unsigned tx_de_emphasis_quirk:1; + unsigned tx_de_emphasis:2; +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index f0f2b066ac08..f92f5aff0dd5 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -1633,7 +1633,7 @@ static irqreturn_t usba_udc_irq(int irq, void *devid) + spin_lock(&udc->lock); + + int_enb = usba_int_enb_get(udc); +- status = usba_readl(udc, INT_STA) & int_enb; ++ status = usba_readl(udc, INT_STA) & (int_enb | USBA_HIGH_SPEED); + DBG(DBG_INT, "irq, status=%#08x\n", status); + + if (status & USBA_DET_SUSPEND) { +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index cf0ed42f5591..6706aef907f4 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1913,7 +1913,7 @@ static void defect7374_disable_data_eps(struct net2280 *dev) + + for (i = 1; i < 5; i++) { + ep = &dev->ep[i]; +- writel(0, &ep->cfg->ep_cfg); ++ writel(i, &ep->cfg->ep_cfg); + } + + /* CSROUT, CSRIN, PCIOUT, PCIIN, STATIN, RCIN */ +diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c +index bfcbb9aa8816..ee8d5faa0194 100644 +--- a/drivers/usb/host/ehci-orion.c ++++ b/drivers/usb/host/ehci-orion.c +@@ -224,7 +224,8 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) + priv->phy = devm_phy_optional_get(&pdev->dev, "usb"); + if (IS_ERR(priv->phy)) { + err = PTR_ERR(priv->phy); +- goto err_phy_get; ++ if (err != -ENOSYS) ++ goto err_phy_get; + } else { + err = phy_init(priv->phy); + if (err) +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 97ffe3997273..fe9e2d3a223c 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3914,28 +3914,6 @@ cleanup: + return ret; + } + +-static int ep_ring_is_processing(struct xhci_hcd *xhci, +- int slot_id, unsigned int ep_index) +-{ +- struct xhci_virt_device *xdev; +- struct xhci_ring *ep_ring; +- struct xhci_ep_ctx *ep_ctx; +- struct xhci_virt_ep *xep; +- dma_addr_t hw_deq; +- +- xdev = xhci->devs[slot_id]; +- xep = &xhci->devs[slot_id]->eps[ep_index]; +- ep_ring = xep->ring; +- ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index); +- +- if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) != EP_STATE_RUNNING) +- return 0; +- +- hw_deq = le64_to_cpu(ep_ctx->deq) & ~EP_CTX_CYCLE_MASK; +- return (hw_deq != +- xhci_trb_virt_to_dma(ep_ring->enq_seg, ep_ring->enqueue)); +-} +- + /* + * Check transfer ring to guarantee there is enough room for the urb. + * Update ISO URB start_frame and interval. +@@ -4001,10 +3979,12 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags, + } + + /* Calculate the start frame and put it in urb->start_frame. */ +- if (HCC_CFC(xhci->hcc_params) && +- ep_ring_is_processing(xhci, slot_id, ep_index)) { +- urb->start_frame = xep->next_frame_id; +- goto skip_start_over; ++ if (HCC_CFC(xhci->hcc_params) && !list_empty(&ep_ring->td_list)) { ++ if ((le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK) == ++ EP_STATE_RUNNING) { ++ urb->start_frame = xep->next_frame_id; ++ goto skip_start_over; ++ } + } + + start_frame = readl(&xhci->run_regs->microframe_index); +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 9957bd96d4bc..385f9f5d6715 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -175,6 +175,16 @@ int xhci_reset(struct xhci_hcd *xhci) + command |= CMD_RESET; + writel(command, &xhci->op_regs->command); + ++ /* Existing Intel xHCI controllers require a delay of 1 mS, ++ * after setting the CMD_RESET bit, and before accessing any ++ * HC registers. This allows the HC to complete the ++ * reset operation and be ready for HC register access. ++ * Without this delay, the subsequent HC register access, ++ * may result in a system hang very rarely. ++ */ ++ if (xhci->quirks & XHCI_INTEL_HOST) ++ udelay(1000); ++ + ret = xhci_handshake(&xhci->op_regs->command, + CMD_RESET, 0, 10 * 1000 * 1000); + if (ret) +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index 4a518ff12310..2c624a10748d 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -132,7 +132,7 @@ static inline struct musb *dev_to_musb(struct device *dev) + /*-------------------------------------------------------------------------*/ + + #ifndef CONFIG_BLACKFIN +-static int musb_ulpi_read(struct usb_phy *phy, u32 offset) ++static int musb_ulpi_read(struct usb_phy *phy, u32 reg) + { + void __iomem *addr = phy->io_priv; + int i = 0; +@@ -151,7 +151,7 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset) + * ULPICarKitControlDisableUTMI after clearing POWER_SUSPENDM. + */ + +- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset); ++ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg); + musb_writeb(addr, MUSB_ULPI_REG_CONTROL, + MUSB_ULPI_REG_REQ | MUSB_ULPI_RDN_WR); + +@@ -176,7 +176,7 @@ out: + return ret; + } + +-static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data) ++static int musb_ulpi_write(struct usb_phy *phy, u32 val, u32 reg) + { + void __iomem *addr = phy->io_priv; + int i = 0; +@@ -191,8 +191,8 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data) + power &= ~MUSB_POWER_SUSPENDM; + musb_writeb(addr, MUSB_POWER, power); + +- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset); +- musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)data); ++ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg); ++ musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)val); + musb_writeb(addr, MUSB_ULPI_REG_CONTROL, MUSB_ULPI_REG_REQ); + + while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL) +diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c +index 1270906ccb95..c4bf2de6d14e 100644 +--- a/drivers/usb/phy/phy-omap-otg.c ++++ b/drivers/usb/phy/phy-omap-otg.c +@@ -105,7 +105,6 @@ static int omap_otg_probe(struct platform_device *pdev) + extcon = extcon_get_extcon_dev(config->extcon); + if (!extcon) + return -EPROBE_DEFER; +- otg_dev->extcon = extcon; + + otg_dev = devm_kzalloc(&pdev->dev, sizeof(*otg_dev), GFP_KERNEL); + if (!otg_dev) +@@ -115,6 +114,7 @@ static int omap_otg_probe(struct platform_device *pdev) + if (IS_ERR(otg_dev->base)) + return PTR_ERR(otg_dev->base); + ++ otg_dev->extcon = extcon; + otg_dev->id_nb.notifier_call = omap_otg_id_notifier; + otg_dev->vbus_nb.notifier_call = omap_otg_vbus_notifier; + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 6956c4f62216..e945b5195258 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -162,6 +162,7 @@ static void option_instat_callback(struct urb *urb); + #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001 + #define NOVATELWIRELESS_PRODUCT_E362 0x9010 + #define NOVATELWIRELESS_PRODUCT_E371 0x9011 ++#define NOVATELWIRELESS_PRODUCT_U620L 0x9022 + #define NOVATELWIRELESS_PRODUCT_G2 0xA010 + #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 + +@@ -357,6 +358,7 @@ static void option_instat_callback(struct urb *urb); + /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 ++#define FOUR_G_SYSTEMS_PRODUCT_W100 0x9b01 + + /* iBall 3.5G connect wireless modem */ + #define IBALL_3_5G_CONNECT 0x9605 +@@ -522,6 +524,11 @@ static const struct option_blacklist_info four_g_w14_blacklist = { + .sendsetup = BIT(0) | BIT(1), + }; + ++static const struct option_blacklist_info four_g_w100_blacklist = { ++ .sendsetup = BIT(1) | BIT(2), ++ .reserved = BIT(3), ++}; ++ + static const struct option_blacklist_info alcatel_x200_blacklist = { + .sendsetup = BIT(0) | BIT(1), + .reserved = BIT(4), +@@ -1060,6 +1067,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U620L, 0xff, 0x00, 0x00) }, + + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) }, + { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) }, +@@ -1653,6 +1661,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = (kernel_ulong_t)&four_g_w14_blacklist + }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), ++ .driver_info = (kernel_ulong_t)&four_g_w100_blacklist ++ }, + { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index ebcec8cda858..514fa91cf74e 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -22,6 +22,8 @@ + #define DRIVER_AUTHOR "Qualcomm Inc" + #define DRIVER_DESC "Qualcomm USB Serial driver" + ++#define QUECTEL_EC20_PID 0x9215 ++ + /* standard device layouts supported by this driver */ + enum qcserial_layouts { + QCSERIAL_G2K = 0, /* Gobi 2000 */ +@@ -153,6 +155,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ ++ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx/EM74xx */ ++ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx/EM74xx */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ +@@ -167,6 +171,38 @@ static const struct usb_device_id id_table[] = { + }; + MODULE_DEVICE_TABLE(usb, id_table); + ++static int handle_quectel_ec20(struct device *dev, int ifnum) ++{ ++ int altsetting = 0; ++ ++ /* ++ * Quectel EC20 Mini PCIe LTE module layout: ++ * 0: DM/DIAG (use libqcdm from ModemManager for communication) ++ * 1: NMEA ++ * 2: AT-capable modem port ++ * 3: Modem interface ++ * 4: NDIS ++ */ ++ switch (ifnum) { ++ case 0: ++ dev_dbg(dev, "Quectel EC20 DM/DIAG interface found\n"); ++ break; ++ case 1: ++ dev_dbg(dev, "Quectel EC20 NMEA GPS interface found\n"); ++ break; ++ case 2: ++ case 3: ++ dev_dbg(dev, "Quectel EC20 Modem port found\n"); ++ break; ++ case 4: ++ /* Don't claim the QMI/net interface */ ++ altsetting = -1; ++ break; ++ } ++ ++ return altsetting; ++} ++ + static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + { + struct usb_host_interface *intf = serial->interface->cur_altsetting; +@@ -176,6 +212,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + __u8 ifnum; + int altsetting = -1; + ++ /* we only support vendor specific functions */ ++ if (intf->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC) ++ goto done; ++ + nintf = serial->dev->actconfig->desc.bNumInterfaces; + dev_dbg(dev, "Num Interfaces = %d\n", nintf); + ifnum = intf->desc.bInterfaceNumber; +@@ -235,6 +275,12 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + altsetting = -1; + break; + case QCSERIAL_G2K: ++ /* handle non-standard layouts */ ++ if (nintf == 5 && id->idProduct == QUECTEL_EC20_PID) { ++ altsetting = handle_quectel_ec20(dev, ifnum); ++ goto done; ++ } ++ + /* + * Gobi 2K+ USB layout: + * 0: QMI/net +@@ -295,29 +341,39 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + break; + case QCSERIAL_HWI: + /* +- * Huawei layout: +- * 0: AT-capable modem port +- * 1: DM/DIAG +- * 2: AT-capable modem port +- * 3: CCID-compatible PCSC interface +- * 4: QMI/net +- * 5: NMEA ++ * Huawei devices map functions by subclass + protocol ++ * instead of interface numbers. The protocol identify ++ * a specific function, while the subclass indicate a ++ * specific firmware source ++ * ++ * This is a blacklist of functions known to be ++ * non-serial. The rest are assumed to be serial and ++ * will be handled by this driver + */ +- switch (ifnum) { +- case 0: +- case 2: +- dev_dbg(dev, "Modem port found\n"); +- break; +- case 1: +- dev_dbg(dev, "DM/DIAG interface found\n"); +- break; +- case 5: +- dev_dbg(dev, "NMEA GPS interface found\n"); +- break; +- default: +- /* don't claim any unsupported interface */ ++ switch (intf->desc.bInterfaceProtocol) { ++ /* QMI combined (qmi_wwan) */ ++ case 0x07: ++ case 0x37: ++ case 0x67: ++ /* QMI data (qmi_wwan) */ ++ case 0x08: ++ case 0x38: ++ case 0x68: ++ /* QMI control (qmi_wwan) */ ++ case 0x09: ++ case 0x39: ++ case 0x69: ++ /* NCM like (huawei_cdc_ncm) */ ++ case 0x16: ++ case 0x46: ++ case 0x76: + altsetting = -1; + break; ++ default: ++ dev_dbg(dev, "Huawei type serial port found (%02x/%02x/%02x)\n", ++ intf->desc.bInterfaceClass, ++ intf->desc.bInterfaceSubClass, ++ intf->desc.bInterfaceProtocol); + } + break; + default: +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c +index e9da41d9fe7f..2694df2f4559 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -159,6 +159,7 @@ static const struct usb_device_id ti_id_table_3410[] = { + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) }, + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, ++ { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) }, + { } /* terminator */ + }; + +@@ -191,6 +192,7 @@ static const struct usb_device_id ti_id_table_combined[] = { + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, ++ { USB_DEVICE(HONEYWELL_VENDOR_ID, HONEYWELL_HGI80_PRODUCT_ID) }, + { } /* terminator */ + }; + +diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h +index 4a2423e84d55..98f35c656c02 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.h ++++ b/drivers/usb/serial/ti_usb_3410_5052.h +@@ -56,6 +56,10 @@ + #define ABBOTT_PRODUCT_ID ABBOTT_STEREO_PLUG_ID + #define ABBOTT_STRIP_PORT_ID 0x3420 + ++/* Honeywell vendor and product IDs */ ++#define HONEYWELL_VENDOR_ID 0x10ac ++#define HONEYWELL_HGI80_PRODUCT_ID 0x0102 /* Honeywell HGI80 */ ++ + /* Commands */ + #define TI_GET_VERSION 0x01 + #define TI_GET_PORT_STATUS 0x02 +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 6cd5e65c4aff..fb236239972f 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -39,6 +39,7 @@ + #include <asm/irq.h> + #include <asm/idle.h> + #include <asm/io_apic.h> ++#include <asm/i8259.h> + #include <asm/xen/pci.h> + #include <xen/page.h> + #endif +@@ -420,7 +421,7 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) + return xen_allocate_irq_dynamic(); + + /* Legacy IRQ descriptors are already allocated by the arch. */ +- if (gsi < NR_IRQS_LEGACY) ++ if (gsi < nr_legacy_irqs()) + irq = gsi; + else + irq = irq_alloc_desc_at(gsi, -1); +@@ -446,7 +447,7 @@ static void xen_free_irq(unsigned irq) + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ +- if (irq < NR_IRQS_LEGACY) ++ if (irq < nr_legacy_irqs()) + return; + + irq_free_desc(irq); +diff --git a/fs/proc/array.c b/fs/proc/array.c +index f60f0121e331..eed2050db9be 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -375,7 +375,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, + static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, + struct pid *pid, struct task_struct *task, int whole) + { +- unsigned long vsize, eip, esp, wchan = ~0UL; ++ unsigned long vsize, eip, esp, wchan = 0; + int priority, nice; + int tty_pgrp = -1, tty_nr = 0; + sigset_t sigign, sigcatch; +@@ -507,7 +507,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, + seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL); + seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL); + seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL); +- seq_put_decimal_ull(m, ' ', wchan); ++ ++ /* ++ * We used to output the absolute kernel address, but that's an ++ * information leak - so instead we show a 0/1 flag here, to signal ++ * to user-space whether there's a wchan field in /proc/PID/wchan. ++ * ++ * This works with older implementations of procps as well. ++ */ ++ if (wchan) ++ seq_puts(m, " 1"); ++ else ++ seq_puts(m, " 0"); ++ + seq_put_decimal_ull(m, ' ', 0); + seq_put_decimal_ull(m, ' ', 0); + seq_put_decimal_ll(m, ' ', task->exit_signal); +diff --git a/fs/proc/base.c b/fs/proc/base.c +index b25eee4cead5..29595af32866 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -430,13 +430,10 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, + + wchan = get_wchan(task); + +- if (lookup_symbol_name(wchan, symname) < 0) { +- if (!ptrace_may_access(task, PTRACE_MODE_READ)) +- return 0; +- seq_printf(m, "%lu", wchan); +- } else { ++ if (wchan && ptrace_may_access(task, PTRACE_MODE_READ) && !lookup_symbol_name(wchan, symname)) + seq_printf(m, "%s", symname); +- } ++ else ++ seq_putc(m, '0'); + + return 0; + } +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 1bef9e21e725..e480f9fbdd62 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -442,6 +442,17 @@ static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i) + (vcpup = kvm_get_vcpu(kvm, idx)) != NULL; \ + idx++) + ++static inline struct kvm_vcpu *kvm_get_vcpu_by_id(struct kvm *kvm, int id) ++{ ++ struct kvm_vcpu *vcpu; ++ int i; ++ ++ kvm_for_each_vcpu(i, vcpu, kvm) ++ if (vcpu->vcpu_id == id) ++ return vcpu; ++ return NULL; ++} ++ + #define kvm_for_each_memslot(memslot, slots) \ + for (memslot = &slots->memslots[0]; \ + memslot < slots->memslots + KVM_MEM_SLOTS_NUM && memslot->npages;\ +diff --git a/include/linux/tty.h b/include/linux/tty.h +index d072ded41678..9bddda029b45 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -605,7 +605,7 @@ extern void n_tty_inherit_ops(struct tty_ldisc_ops *ops); + + /* tty_audit.c */ + #ifdef CONFIG_AUDIT +-extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ++extern void tty_audit_add_data(struct tty_struct *tty, const void *data, + size_t size, unsigned icanon); + extern void tty_audit_exit(void); + extern void tty_audit_fork(struct signal_struct *sig); +@@ -613,8 +613,8 @@ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch); + extern void tty_audit_push(struct tty_struct *tty); + extern int tty_audit_push_current(void); + #else +-static inline void tty_audit_add_data(struct tty_struct *tty, +- unsigned char *data, size_t size, unsigned icanon) ++static inline void tty_audit_add_data(struct tty_struct *tty, const void *data, ++ size_t size, unsigned icanon) + { + } + static inline void tty_audit_tiocsti(struct tty_struct *tty, char ch) +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 9e1a59e01fa2..544a0201abdb 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -469,6 +469,7 @@ struct hci_conn { + struct delayed_work auto_accept_work; + struct delayed_work idle_work; + struct delayed_work le_conn_timeout; ++ struct work_struct le_scan_cleanup; + + struct device dev; + struct dentry *debugfs; +diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h +index ce009710120c..6816f0fa5693 100644 +--- a/include/net/dst_metadata.h ++++ b/include/net/dst_metadata.h +@@ -63,12 +63,13 @@ static inline struct metadata_dst *tun_rx_dst(int md_size) + static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) + { + struct metadata_dst *md_dst = skb_metadata_dst(skb); +- int md_size = md_dst->u.tun_info.options_len; ++ int md_size; + struct metadata_dst *new_md; + + if (!md_dst) + return ERR_PTR(-EINVAL); + ++ md_size = md_dst->u.tun_info.options_len; + new_md = metadata_dst_alloc(md_size, GFP_ATOMIC); + if (!new_md) + return ERR_PTR(-ENOMEM); +diff --git a/include/net/inet_common.h b/include/net/inet_common.h +index 279f83591971..109e3ee9108c 100644 +--- a/include/net/inet_common.h ++++ b/include/net/inet_common.h +@@ -41,7 +41,8 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, + + static inline void inet_ctl_sock_destroy(struct sock *sk) + { +- sock_release(sk->sk_socket); ++ if (sk) ++ sock_release(sk->sk_socket); + } + + #endif +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 727d6e9a9685..965fa5b1a274 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -317,7 +317,7 @@ void fib_flush_external(struct net *net); + + /* Exported by fib_semantics.c */ + int ip_fib_check_default(__be32 gw, struct net_device *dev); +-int fib_sync_down_dev(struct net_device *dev, unsigned long event); ++int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); + int fib_sync_down_addr(struct net *net, __be32 local); + int fib_sync_up(struct net_device *dev, unsigned int nh_flags); + void fib_select_multipath(struct fib_result *res); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 2dda439c8cb8..ec4836f243bc 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -137,18 +137,51 @@ static void hci_conn_cleanup(struct hci_conn *conn) + hci_conn_put(conn); + } + +-/* This function requires the caller holds hdev->lock */ +-static void hci_connect_le_scan_remove(struct hci_conn *conn) ++static void le_scan_cleanup(struct work_struct *work) + { +- hci_connect_le_scan_cleanup(conn); ++ struct hci_conn *conn = container_of(work, struct hci_conn, ++ le_scan_cleanup); ++ struct hci_dev *hdev = conn->hdev; ++ struct hci_conn *c = NULL; + +- /* We can't call hci_conn_del here since that would deadlock +- * with trying to call cancel_delayed_work_sync(&conn->disc_work). +- * Instead, call just hci_conn_cleanup() which contains the bare +- * minimum cleanup operations needed for a connection in this +- * state. ++ BT_DBG("%s hcon %p", hdev->name, conn); ++ ++ hci_dev_lock(hdev); ++ ++ /* Check that the hci_conn is still around */ ++ rcu_read_lock(); ++ list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { ++ if (c == conn) ++ break; ++ } ++ rcu_read_unlock(); ++ ++ if (c == conn) { ++ hci_connect_le_scan_cleanup(conn); ++ hci_conn_cleanup(conn); ++ } ++ ++ hci_dev_unlock(hdev); ++ hci_dev_put(hdev); ++ hci_conn_put(conn); ++} ++ ++static void hci_connect_le_scan_remove(struct hci_conn *conn) ++{ ++ BT_DBG("%s hcon %p", conn->hdev->name, conn); ++ ++ /* We can't call hci_conn_del/hci_conn_cleanup here since that ++ * could deadlock with another hci_conn_del() call that's holding ++ * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work). ++ * Instead, grab temporary extra references to the hci_dev and ++ * hci_conn and perform the necessary cleanup in a separate work ++ * callback. + */ +- hci_conn_cleanup(conn); ++ ++ hci_dev_hold(conn->hdev); ++ hci_conn_get(conn); ++ ++ schedule_work(&conn->le_scan_cleanup); + } + + static void hci_acl_create_connection(struct hci_conn *conn) +@@ -580,6 +613,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, + INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept); + INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); + INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); ++ INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup); + + atomic_set(&conn->refcnt, 0); + +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index f1a117f8cad2..0bec4588c3c8 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -401,6 +401,20 @@ static void hidp_idle_timeout(unsigned long arg) + { + struct hidp_session *session = (struct hidp_session *) arg; + ++ /* The HIDP user-space API only contains calls to add and remove ++ * devices. There is no way to forward events of any kind. Therefore, ++ * we have to forcefully disconnect a device on idle-timeouts. This is ++ * unfortunate and weird API design, but it is spec-compliant and ++ * required for backwards-compatibility. Hence, on idle-timeout, we ++ * signal driver-detach events, so poll() will be woken up with an ++ * error-condition on both sockets. ++ */ ++ ++ session->intr_sock->sk->sk_err = EUNATCH; ++ session->ctrl_sock->sk->sk_err = EUNATCH; ++ wake_up_interruptible(sk_sleep(session->intr_sock->sk)); ++ wake_up_interruptible(sk_sleep(session->ctrl_sock->sk)); ++ + hidp_session_terminate(session); + } + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index c4fe2fee753f..72c9376ec03c 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -3090,6 +3090,11 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, + } else { + u8 addr_type; + ++ if (cp->addr.type == BDADDR_LE_PUBLIC) ++ addr_type = ADDR_LE_DEV_PUBLIC; ++ else ++ addr_type = ADDR_LE_DEV_RANDOM; ++ + conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, + &cp->addr.bdaddr); + if (conn) { +@@ -3105,13 +3110,10 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, + */ + if (!cp->disconnect) + conn = NULL; ++ } else { ++ hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); + } + +- if (cp->addr.type == BDADDR_LE_PUBLIC) +- addr_type = ADDR_LE_DEV_PUBLIC; +- else +- addr_type = ADDR_LE_DEV_RANDOM; +- + hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type); + + err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type); +diff --git a/net/core/dst.c b/net/core/dst.c +index 0771c8cb9307..d6a5a0bc7df5 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -306,7 +306,7 @@ void dst_release(struct dst_entry *dst) + if (unlikely(newrefcnt < 0)) + net_warn_ratelimited("%s: dst:%p refcnt:%d\n", + __func__, dst, newrefcnt); +- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) ++ if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) + call_rcu(&dst->rcu_head, dst_destroy_rcu); + } + } +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 690bcbc59f26..457b2cd75b85 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1110,9 +1110,10 @@ static void nl_fib_lookup_exit(struct net *net) + net->ipv4.fibnl = NULL; + } + +-static void fib_disable_ip(struct net_device *dev, unsigned long event) ++static void fib_disable_ip(struct net_device *dev, unsigned long event, ++ bool force) + { +- if (fib_sync_down_dev(dev, event)) ++ if (fib_sync_down_dev(dev, event, force)) + fib_flush(dev_net(dev)); + rt_cache_flush(dev_net(dev)); + arp_ifdown(dev); +@@ -1140,7 +1141,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, + /* Last address was deleted from this interface. + * Disable IP. + */ +- fib_disable_ip(dev, event); ++ fib_disable_ip(dev, event, true); + } else { + rt_cache_flush(dev_net(dev)); + } +@@ -1157,7 +1158,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo + unsigned int flags; + + if (event == NETDEV_UNREGISTER) { +- fib_disable_ip(dev, event); ++ fib_disable_ip(dev, event, true); + rt_flush_dev(dev); + return NOTIFY_DONE; + } +@@ -1178,14 +1179,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo + rt_cache_flush(net); + break; + case NETDEV_DOWN: +- fib_disable_ip(dev, event); ++ fib_disable_ip(dev, event, false); + break; + case NETDEV_CHANGE: + flags = dev_get_flags(dev); + if (flags & (IFF_RUNNING | IFF_LOWER_UP)) + fib_sync_up(dev, RTNH_F_LINKDOWN); + else +- fib_sync_down_dev(dev, event); ++ fib_sync_down_dev(dev, event, false); + /* fall through */ + case NETDEV_CHANGEMTU: + rt_cache_flush(net); +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 064bd3caaa4f..ef5892f5e046 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -864,14 +864,21 @@ static bool fib_valid_prefsrc(struct fib_config *cfg, __be32 fib_prefsrc) + if (cfg->fc_type != RTN_LOCAL || !cfg->fc_dst || + fib_prefsrc != cfg->fc_dst) { + u32 tb_id = cfg->fc_table; ++ int rc; + + if (tb_id == RT_TABLE_MAIN) + tb_id = RT_TABLE_LOCAL; + +- if (inet_addr_type_table(cfg->fc_nlinfo.nl_net, +- fib_prefsrc, tb_id) != RTN_LOCAL) { +- return false; ++ rc = inet_addr_type_table(cfg->fc_nlinfo.nl_net, ++ fib_prefsrc, tb_id); ++ ++ if (rc != RTN_LOCAL && tb_id != RT_TABLE_LOCAL) { ++ rc = inet_addr_type_table(cfg->fc_nlinfo.nl_net, ++ fib_prefsrc, RT_TABLE_LOCAL); + } ++ ++ if (rc != RTN_LOCAL) ++ return false; + } + return true; + } +@@ -1281,7 +1288,13 @@ int fib_sync_down_addr(struct net *net, __be32 local) + return ret; + } + +-int fib_sync_down_dev(struct net_device *dev, unsigned long event) ++/* Event force Flags Description ++ * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host ++ * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host ++ * NETDEV_DOWN 1 LINKDOWN|DEAD Last address removed ++ * NETDEV_UNREGISTER 1 LINKDOWN|DEAD Device removed ++ */ ++int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force) + { + int ret = 0; + int scope = RT_SCOPE_NOWHERE; +@@ -1290,8 +1303,7 @@ int fib_sync_down_dev(struct net_device *dev, unsigned long event) + struct hlist_head *head = &fib_info_devhash[hash]; + struct fib_nh *nh; + +- if (event == NETDEV_UNREGISTER || +- event == NETDEV_DOWN) ++ if (force) + scope = -1; + + hlist_for_each_entry(nh, head, nh_hash) { +@@ -1440,6 +1452,13 @@ int fib_sync_up(struct net_device *dev, unsigned int nh_flags) + if (!(dev->flags & IFF_UP)) + return 0; + ++ if (nh_flags & RTNH_F_DEAD) { ++ unsigned int flags = dev_get_flags(dev); ++ ++ if (flags & (IFF_RUNNING | IFF_LOWER_UP)) ++ nh_flags |= RTNH_F_LINKDOWN; ++ } ++ + prev_fi = NULL; + hash = fib_devindex_hashfn(dev->ifindex); + head = &fib_info_devhash[hash]; +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index 866ee89f5254..8e8203d5c520 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -1682,8 +1682,8 @@ static inline int ipmr_forward_finish(struct sock *sk, struct sk_buff *skb) + { + struct ip_options *opt = &(IPCB(skb)->opt); + +- IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); +- IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); ++ IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); ++ IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len); + + if (unlikely(opt->optlen)) + ip_forward_options(skb); +@@ -1745,7 +1745,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt, + * to blackhole. + */ + +- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS); ++ IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); + ip_rt_put(rt); + goto out_free; + } +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 894da3a70aff..ade773744b98 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -48,14 +48,14 @@ static void set_local_port_range(struct net *net, int range[2]) + { + bool same_parity = !((range[0] ^ range[1]) & 1); + +- write_seqlock(&net->ipv4.ip_local_ports.lock); ++ write_seqlock_bh(&net->ipv4.ip_local_ports.lock); + if (same_parity && !net->ipv4.ip_local_ports.warned) { + net->ipv4.ip_local_ports.warned = true; + pr_err_ratelimited("ip_local_port_range: prefer different parity for start/end values.\n"); + } + net->ipv4.ip_local_ports.range[0] = range[0]; + net->ipv4.ip_local_ports.range[1] = range[1]; +- write_sequnlock(&net->ipv4.ip_local_ports.lock); ++ write_sequnlock_bh(&net->ipv4.ip_local_ports.lock); + } + + /* Validate changes from /proc interface. */ +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 36b85bd05ac8..dd00828863a0 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -417,6 +417,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev) + if (err) { + ipv6_mc_destroy_dev(ndev); + del_timer(&ndev->regen_timer); ++ snmp6_unregister_dev(ndev); + goto err_release; + } + /* protected by rtnl_lock */ +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 94428fd85b2f..dcccae86190f 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1394,34 +1394,20 @@ static int ipip6_tunnel_init(struct net_device *dev) + return 0; + } + +-static int __net_init ipip6_fb_tunnel_init(struct net_device *dev) ++static void __net_init ipip6_fb_tunnel_init(struct net_device *dev) + { + struct ip_tunnel *tunnel = netdev_priv(dev); + struct iphdr *iph = &tunnel->parms.iph; + struct net *net = dev_net(dev); + struct sit_net *sitn = net_generic(net, sit_net_id); + +- tunnel->dev = dev; +- tunnel->net = dev_net(dev); +- + iph->version = 4; + iph->protocol = IPPROTO_IPV6; + iph->ihl = 5; + iph->ttl = 64; + +- dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); +- if (!dev->tstats) +- return -ENOMEM; +- +- tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst); +- if (!tunnel->dst_cache) { +- free_percpu(dev->tstats); +- return -ENOMEM; +- } +- + dev_hold(dev); + rcu_assign_pointer(sitn->tunnels_wc[0], tunnel); +- return 0; + } + + static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[]) +@@ -1831,23 +1817,19 @@ static int __net_init sit_init_net(struct net *net) + */ + sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL; + +- err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); +- if (err) +- goto err_dev_free; +- +- ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); + err = register_netdev(sitn->fb_tunnel_dev); + if (err) + goto err_reg_dev; + ++ ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn); ++ ipip6_fb_tunnel_init(sitn->fb_tunnel_dev); ++ + t = netdev_priv(sitn->fb_tunnel_dev); + + strcpy(t->parms.name, sitn->fb_tunnel_dev->name); + return 0; + + err_reg_dev: +- dev_put(sitn->fb_tunnel_dev); +-err_dev_free: + ipip6_dev_free(sitn->fb_tunnel_dev); + err_alloc_dev: + return err; +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index cd7e55e08a23..d011bc539197 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3391,7 +3391,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, + + if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold && + ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) { +- int sig = ifmgd->ave_beacon_signal; ++ int sig = ifmgd->ave_beacon_signal / 16; + int last_sig = ifmgd->last_ave_beacon_signal; + struct ieee80211_event event = { + .type = RSSI_EVENT, +@@ -5028,6 +5028,25 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + return 0; + } + ++ if (ifmgd->assoc_data && ++ ether_addr_equal(ifmgd->assoc_data->bss->bssid, req->bssid)) { ++ sdata_info(sdata, ++ "aborting association with %pM by local choice (Reason: %u=%s)\n", ++ req->bssid, req->reason_code, ++ ieee80211_get_reason_code_string(req->reason_code)); ++ ++ drv_mgd_prepare_tx(sdata->local, sdata); ++ ieee80211_send_deauth_disassoc(sdata, req->bssid, ++ IEEE80211_STYPE_DEAUTH, ++ req->reason_code, tx, ++ frame_buf); ++ ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_report_disconnect(sdata, frame_buf, ++ sizeof(frame_buf), true, ++ req->reason_code); ++ return 0; ++ } ++ + if (ifmgd->associated && + ether_addr_equal(ifmgd->associated->bssid, req->bssid)) { + sdata_info(sdata, +diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h +index 6f14591d8ca9..0b13bfa6f32f 100644 +--- a/net/mac80211/trace.h ++++ b/net/mac80211/trace.h +@@ -33,11 +33,11 @@ + __field(u32, chan_width) \ + __field(u32, center_freq1) \ + __field(u32, center_freq2) +-#define CHANDEF_ASSIGN(c) \ +- __entry->control_freq = (c)->chan ? (c)->chan->center_freq : 0; \ +- __entry->chan_width = (c)->width; \ +- __entry->center_freq1 = (c)->center_freq1; \ +- __entry->center_freq2 = (c)->center_freq2; ++#define CHANDEF_ASSIGN(c) \ ++ __entry->control_freq = (c) ? ((c)->chan ? (c)->chan->center_freq : 0) : 0; \ ++ __entry->chan_width = (c) ? (c)->width : 0; \ ++ __entry->center_freq1 = (c) ? (c)->center_freq1 : 0; \ ++ __entry->center_freq2 = (c) ? (c)->center_freq2 : 0; + #define CHANDEF_PR_FMT " control:%d MHz width:%d center: %d/%d MHz" + #define CHANDEF_PR_ARG __entry->control_freq, __entry->chan_width, \ + __entry->center_freq1, __entry->center_freq2 +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 1104421bc525..cd90ece80772 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2951,6 +2951,13 @@ ieee80211_extend_noa_desc(struct ieee80211_noa_data *data, u32 tsf, int i) + if (end > 0) + return false; + ++ /* One shot NOA */ ++ if (data->count[i] == 1) ++ return false; ++ ++ if (data->desc[i].interval == 0) ++ return false; ++ + /* End time is in the past, check for repetitions */ + skip = DIV_ROUND_UP(-end, data->desc[i].interval); + if (data->count[i] < 255) { +diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c +index 609f92283d1b..30b09f04c142 100644 +--- a/net/nfc/nci/hci.c ++++ b/net/nfc/nci/hci.c +@@ -101,6 +101,20 @@ struct nci_hcp_packet { + #define NCI_HCP_MSG_GET_CMD(header) (header & 0x3f) + #define NCI_HCP_MSG_GET_PIPE(header) (header & 0x7f) + ++static int nci_hci_result_to_errno(u8 result) ++{ ++ switch (result) { ++ case NCI_HCI_ANY_OK: ++ return 0; ++ case NCI_HCI_ANY_E_REG_PAR_UNKNOWN: ++ return -EOPNOTSUPP; ++ case NCI_HCI_ANY_E_TIMEOUT: ++ return -ETIME; ++ default: ++ return -1; ++ } ++} ++ + /* HCI core */ + static void nci_hci_reset_pipes(struct nci_hci_dev *hdev) + { +@@ -146,18 +160,18 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, + if (!conn_info) + return -EPROTO; + +- skb = nci_skb_alloc(ndev, 2 + conn_info->max_pkt_payload_len + ++ i = 0; ++ skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + + NCI_DATA_HDR_SIZE, GFP_KERNEL); + if (!skb) + return -ENOMEM; + +- skb_reserve(skb, 2 + NCI_DATA_HDR_SIZE); ++ skb_reserve(skb, NCI_DATA_HDR_SIZE + 2); + *skb_push(skb, 1) = data_type; + +- i = 0; +- len = conn_info->max_pkt_payload_len; +- + do { ++ len = conn_info->max_pkt_payload_len; ++ + /* If last packet add NCI_HFP_NO_CHAINING */ + if (i + conn_info->max_pkt_payload_len - + (skb->len + 1) >= data_len) { +@@ -177,9 +191,15 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe, + return r; + + i += len; ++ + if (i < data_len) { +- skb_trim(skb, 0); +- skb_pull(skb, len); ++ skb = nci_skb_alloc(ndev, ++ conn_info->max_pkt_payload_len + ++ NCI_DATA_HDR_SIZE, GFP_KERNEL); ++ if (!skb) ++ return -ENOMEM; ++ ++ skb_reserve(skb, NCI_DATA_HDR_SIZE + 1); + } + } while (i < data_len); + +@@ -212,7 +232,8 @@ int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, u8 cmd, + const u8 *param, size_t param_len, + struct sk_buff **skb) + { +- struct nci_conn_info *conn_info; ++ struct nci_hcp_message *message; ++ struct nci_conn_info *conn_info; + struct nci_data data; + int r; + u8 pipe = ndev->hci_dev->gate2pipe[gate]; +@@ -232,9 +253,15 @@ int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, u8 cmd, + + r = nci_request(ndev, nci_hci_send_data_req, (unsigned long)&data, + msecs_to_jiffies(NCI_DATA_TIMEOUT)); +- +- if (r == NCI_STATUS_OK && skb) +- *skb = conn_info->rx_skb; ++ if (r == NCI_STATUS_OK) { ++ message = (struct nci_hcp_message *)conn_info->rx_skb->data; ++ r = nci_hci_result_to_errno( ++ NCI_HCP_MSG_GET_CMD(message->header)); ++ skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN); ++ ++ if (!r && skb) ++ *skb = conn_info->rx_skb; ++ } + + return r; + } +@@ -328,9 +355,6 @@ static void nci_hci_resp_received(struct nci_dev *ndev, u8 pipe, + struct nci_conn_info *conn_info; + u8 status = result; + +- if (result != NCI_HCI_ANY_OK) +- goto exit; +- + conn_info = ndev->hci_dev->conn_info; + if (!conn_info) { + status = NCI_STATUS_REJECTED; +@@ -340,7 +364,7 @@ static void nci_hci_resp_received(struct nci_dev *ndev, u8 pipe, + conn_info->rx_skb = skb; + + exit: +- nci_req_complete(ndev, status); ++ nci_req_complete(ndev, NCI_STATUS_OK); + } + + /* Receive hcp message for pipe, with type and cmd. +@@ -378,7 +402,7 @@ static void nci_hci_msg_rx_work(struct work_struct *work) + u8 pipe, type, instruction; + + while ((skb = skb_dequeue(&hdev->msg_rx_queue)) != NULL) { +- pipe = skb->data[0]; ++ pipe = NCI_HCP_MSG_GET_PIPE(skb->data[0]); + skb_pull(skb, NCI_HCI_HCP_PACKET_HEADER_LEN); + message = (struct nci_hcp_message *)skb->data; + type = NCI_HCP_MSG_GET_TYPE(message->header); +@@ -395,7 +419,7 @@ void nci_hci_data_received_cb(void *context, + { + struct nci_dev *ndev = (struct nci_dev *)context; + struct nci_hcp_packet *packet; +- u8 pipe, type, instruction; ++ u8 pipe, type; + struct sk_buff *hcp_skb; + struct sk_buff *frag_skb; + int msg_len; +@@ -415,7 +439,7 @@ void nci_hci_data_received_cb(void *context, + + /* it's the last fragment. Does it need re-aggregation? */ + if (skb_queue_len(&ndev->hci_dev->rx_hcp_frags)) { +- pipe = packet->header & NCI_HCI_FRAGMENT; ++ pipe = NCI_HCP_MSG_GET_PIPE(packet->header); + skb_queue_tail(&ndev->hci_dev->rx_hcp_frags, skb); + + msg_len = 0; +@@ -434,7 +458,7 @@ void nci_hci_data_received_cb(void *context, + *skb_put(hcp_skb, NCI_HCI_HCP_PACKET_HEADER_LEN) = pipe; + + skb_queue_walk(&ndev->hci_dev->rx_hcp_frags, frag_skb) { +- msg_len = frag_skb->len - NCI_HCI_HCP_PACKET_HEADER_LEN; ++ msg_len = frag_skb->len - NCI_HCI_HCP_PACKET_HEADER_LEN; + memcpy(skb_put(hcp_skb, msg_len), frag_skb->data + + NCI_HCI_HCP_PACKET_HEADER_LEN, msg_len); + } +@@ -452,11 +476,10 @@ void nci_hci_data_received_cb(void *context, + packet = (struct nci_hcp_packet *)hcp_skb->data; + type = NCI_HCP_MSG_GET_TYPE(packet->message.header); + if (type == NCI_HCI_HCP_RESPONSE) { +- pipe = packet->header; +- instruction = NCI_HCP_MSG_GET_CMD(packet->message.header); +- skb_pull(hcp_skb, NCI_HCI_HCP_PACKET_HEADER_LEN + +- NCI_HCI_HCP_MESSAGE_HEADER_LEN); +- nci_hci_hcp_message_rx(ndev, pipe, type, instruction, hcp_skb); ++ pipe = NCI_HCP_MSG_GET_PIPE(packet->header); ++ skb_pull(hcp_skb, NCI_HCI_HCP_PACKET_HEADER_LEN); ++ nci_hci_hcp_message_rx(ndev, pipe, type, ++ NCI_STATUS_OK, hcp_skb); + } else { + skb_queue_tail(&ndev->hci_dev->msg_rx_queue, hcp_skb); + schedule_work(&ndev->hci_dev->msg_rx_work); +@@ -488,6 +511,7 @@ EXPORT_SYMBOL(nci_hci_open_pipe); + int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx, + const u8 *param, size_t param_len) + { ++ struct nci_hcp_message *message; + struct nci_conn_info *conn_info; + struct nci_data data; + int r; +@@ -520,6 +544,12 @@ int nci_hci_set_param(struct nci_dev *ndev, u8 gate, u8 idx, + r = nci_request(ndev, nci_hci_send_data_req, + (unsigned long)&data, + msecs_to_jiffies(NCI_DATA_TIMEOUT)); ++ if (r == NCI_STATUS_OK) { ++ message = (struct nci_hcp_message *)conn_info->rx_skb->data; ++ r = nci_hci_result_to_errno( ++ NCI_HCP_MSG_GET_CMD(message->header)); ++ skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN); ++ } + + kfree(tmp); + return r; +@@ -529,6 +559,7 @@ EXPORT_SYMBOL(nci_hci_set_param); + int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx, + struct sk_buff **skb) + { ++ struct nci_hcp_message *message; + struct nci_conn_info *conn_info; + struct nci_data data; + int r; +@@ -553,8 +584,15 @@ int nci_hci_get_param(struct nci_dev *ndev, u8 gate, u8 idx, + r = nci_request(ndev, nci_hci_send_data_req, (unsigned long)&data, + msecs_to_jiffies(NCI_DATA_TIMEOUT)); + +- if (r == NCI_STATUS_OK) +- *skb = conn_info->rx_skb; ++ if (r == NCI_STATUS_OK) { ++ message = (struct nci_hcp_message *)conn_info->rx_skb->data; ++ r = nci_hci_result_to_errno( ++ NCI_HCP_MSG_GET_CMD(message->header)); ++ skb_pull(conn_info->rx_skb, NCI_HCI_HCP_MESSAGE_HEADER_LEN); ++ ++ if (!r && skb) ++ *skb = conn_info->rx_skb; ++ } + + return r; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index aa4b15c35884..27b2898f275c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2903,22 +2903,40 @@ static int packet_release(struct socket *sock) + * Attach a packet hook. + */ + +-static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) ++static int packet_do_bind(struct sock *sk, const char *name, int ifindex, ++ __be16 proto) + { + struct packet_sock *po = pkt_sk(sk); + struct net_device *dev_curr; + __be16 proto_curr; + bool need_rehook; ++ struct net_device *dev = NULL; ++ int ret = 0; ++ bool unlisted = false; + +- if (po->fanout) { +- if (dev) +- dev_put(dev); +- ++ if (po->fanout) + return -EINVAL; +- } + + lock_sock(sk); + spin_lock(&po->bind_lock); ++ rcu_read_lock(); ++ ++ if (name) { ++ dev = dev_get_by_name_rcu(sock_net(sk), name); ++ if (!dev) { ++ ret = -ENODEV; ++ goto out_unlock; ++ } ++ } else if (ifindex) { ++ dev = dev_get_by_index_rcu(sock_net(sk), ifindex); ++ if (!dev) { ++ ret = -ENODEV; ++ goto out_unlock; ++ } ++ } ++ ++ if (dev) ++ dev_hold(dev); + + proto_curr = po->prot_hook.type; + dev_curr = po->prot_hook.dev; +@@ -2926,14 +2944,29 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) + need_rehook = proto_curr != proto || dev_curr != dev; + + if (need_rehook) { +- unregister_prot_hook(sk, true); ++ if (po->running) { ++ rcu_read_unlock(); ++ __unregister_prot_hook(sk, true); ++ rcu_read_lock(); ++ dev_curr = po->prot_hook.dev; ++ if (dev) ++ unlisted = !dev_get_by_index_rcu(sock_net(sk), ++ dev->ifindex); ++ } + + po->num = proto; + po->prot_hook.type = proto; +- po->prot_hook.dev = dev; + +- po->ifindex = dev ? dev->ifindex : 0; +- packet_cached_dev_assign(po, dev); ++ if (unlikely(unlisted)) { ++ dev_put(dev); ++ po->prot_hook.dev = NULL; ++ po->ifindex = -1; ++ packet_cached_dev_reset(po); ++ } else { ++ po->prot_hook.dev = dev; ++ po->ifindex = dev ? dev->ifindex : 0; ++ packet_cached_dev_assign(po, dev); ++ } + } + if (dev_curr) + dev_put(dev_curr); +@@ -2941,7 +2974,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) + if (proto == 0 || !need_rehook) + goto out_unlock; + +- if (!dev || (dev->flags & IFF_UP)) { ++ if (!unlisted && (!dev || (dev->flags & IFF_UP))) { + register_prot_hook(sk); + } else { + sk->sk_err = ENETDOWN; +@@ -2950,9 +2983,10 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) + } + + out_unlock: ++ rcu_read_unlock(); + spin_unlock(&po->bind_lock); + release_sock(sk); +- return 0; ++ return ret; + } + + /* +@@ -2964,8 +2998,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + { + struct sock *sk = sock->sk; + char name[15]; +- struct net_device *dev; +- int err = -ENODEV; + + /* + * Check legality +@@ -2975,19 +3007,13 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + return -EINVAL; + strlcpy(name, uaddr->sa_data, sizeof(name)); + +- dev = dev_get_by_name(sock_net(sk), name); +- if (dev) +- err = packet_do_bind(sk, dev, pkt_sk(sk)->num); +- return err; ++ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); + } + + static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + { + struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr; + struct sock *sk = sock->sk; +- struct net_device *dev = NULL; +- int err; +- + + /* + * Check legality +@@ -2998,16 +3024,8 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len + if (sll->sll_family != AF_PACKET) + return -EINVAL; + +- if (sll->sll_ifindex) { +- err = -ENODEV; +- dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex); +- if (dev == NULL) +- goto out; +- } +- err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); +- +-out: +- return err; ++ return packet_do_bind(sk, NULL, sll->sll_ifindex, ++ sll->sll_protocol ? : pkt_sk(sk)->num); + } + + static struct proto packet_proto = { +diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c +index 6e648d90297a..cd7c5f131e72 100644 +--- a/net/tipc/udp_media.c ++++ b/net/tipc/udp_media.c +@@ -48,6 +48,7 @@ + #include <linux/tipc_netlink.h> + #include "core.h" + #include "bearer.h" ++#include "msg.h" + + /* IANA assigned UDP port */ + #define UDP_PORT_DEFAULT 6118 +@@ -222,6 +223,10 @@ static int tipc_udp_recv(struct sock *sk, struct sk_buff *skb) + { + struct udp_bearer *ub; + struct tipc_bearer *b; ++ int usr = msg_user(buf_msg(skb)); ++ ++ if ((usr == LINK_PROTOCOL) || (usr == NAME_DISTRIBUTOR)) ++ skb_linearize(skb); + + ub = rcu_dereference_sk_user_data(sk); + if (!ub) { +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 5d8748b4c8a2..6a1040daa9b9 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3409,12 +3409,6 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) + wdev->iftype)) + return -EINVAL; + +- if (info->attrs[NL80211_ATTR_ACL_POLICY]) { +- params.acl = parse_acl_data(&rdev->wiphy, info); +- if (IS_ERR(params.acl)) +- return PTR_ERR(params.acl); +- } +- + if (info->attrs[NL80211_ATTR_SMPS_MODE]) { + params.smps_mode = + nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); +@@ -3438,6 +3432,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) + params.smps_mode = NL80211_SMPS_OFF; + } + ++ if (info->attrs[NL80211_ATTR_ACL_POLICY]) { ++ params.acl = parse_acl_data(&rdev->wiphy, info); ++ if (IS_ERR(params.acl)) ++ return PTR_ERR(params.acl); ++ } ++ + wdev_lock(wdev); + err = rdev_start_ap(rdev, dev, ¶ms); + if (!err) { +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index 417ebb11cf48..bec63e0d2605 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -174,6 +174,8 @@ struct snd_usb_midi_in_endpoint { + u8 running_status_length; + } ports[0x10]; + u8 seen_f5; ++ bool in_sysex; ++ u8 last_cin; + u8 error_resubmit; + int current_port; + }; +@@ -468,6 +470,39 @@ static void snd_usbmidi_maudio_broken_running_status_input( + } + + /* ++ * QinHeng CH345 is buggy: every second packet inside a SysEx has not CIN 4 ++ * but the previously seen CIN, but still with three data bytes. ++ */ ++static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep, ++ uint8_t *buffer, int buffer_length) ++{ ++ unsigned int i, cin, length; ++ ++ for (i = 0; i + 3 < buffer_length; i += 4) { ++ if (buffer[i] == 0 && i > 0) ++ break; ++ cin = buffer[i] & 0x0f; ++ if (ep->in_sysex && ++ cin == ep->last_cin && ++ (buffer[i + 1 + (cin == 0x6)] & 0x80) == 0) ++ cin = 0x4; ++#if 0 ++ if (buffer[i + 1] == 0x90) { ++ /* ++ * Either a corrupted running status or a real note-on ++ * message; impossible to detect reliably. ++ */ ++ } ++#endif ++ length = snd_usbmidi_cin_length[cin]; ++ snd_usbmidi_input_data(ep, 0, &buffer[i + 1], length); ++ ep->in_sysex = cin == 0x4; ++ if (!ep->in_sysex) ++ ep->last_cin = cin; ++ } ++} ++ ++/* + * CME protocol: like the standard protocol, but SysEx commands are sent as a + * single USB packet preceded by a 0x0F byte. + */ +@@ -660,6 +695,12 @@ static struct usb_protocol_ops snd_usbmidi_cme_ops = { + .output_packet = snd_usbmidi_output_standard_packet, + }; + ++static struct usb_protocol_ops snd_usbmidi_ch345_broken_sysex_ops = { ++ .input = ch345_broken_sysex_input, ++ .output = snd_usbmidi_standard_output, ++ .output_packet = snd_usbmidi_output_standard_packet, ++}; ++ + /* + * AKAI MPD16 protocol: + * +@@ -1341,6 +1382,7 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi *umidi, + * Various chips declare a packet size larger than 4 bytes, but + * do not actually work with larger packets: + */ ++ case USB_ID(0x0a67, 0x5011): /* Medeli DD305 */ + case USB_ID(0x0a92, 0x1020): /* ESI M4U */ + case USB_ID(0x1430, 0x474b): /* RedOctane GH MIDI INTERFACE */ + case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */ +@@ -2375,6 +2417,10 @@ int snd_usbmidi_create(struct snd_card *card, + + err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints); + break; ++ case QUIRK_MIDI_CH345: ++ umidi->usb_protocol_ops = &snd_usbmidi_ch345_broken_sysex_ops; ++ err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints); ++ break; + default: + dev_err(&umidi->dev->dev, "invalid quirk type %d\n", + quirk->type); +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index e4756651a52c..ecc2a4ea014d 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2820,6 +2820,17 @@ YAMAHA_DEVICE(0x7010, "UB99"), + .idProduct = 0x1020, + }, + ++/* QinHeng devices */ ++{ ++ USB_DEVICE(0x1a86, 0x752d), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .vendor_name = "QinHeng", ++ .product_name = "CH345", ++ .ifnum = 1, ++ .type = QUIRK_MIDI_CH345 ++ } ++}, ++ + /* KeithMcMillen Stringport */ + { + USB_DEVICE(0x1f38, 0x0001), +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 00ebc0ca008e..eef9b8e4b949 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -535,6 +535,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip, + [QUIRK_MIDI_CME] = create_any_midi_quirk, + [QUIRK_MIDI_AKAI] = create_any_midi_quirk, + [QUIRK_MIDI_FTDI] = create_any_midi_quirk, ++ [QUIRK_MIDI_CH345] = create_any_midi_quirk, + [QUIRK_AUDIO_STANDARD_INTERFACE] = create_standard_audio_quirk, + [QUIRK_AUDIO_FIXED_ENDPOINT] = create_fixed_stream_quirk, + [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk, +@@ -1271,6 +1272,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */ + case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ + case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */ ++ case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */ + if (fp->altsetting == 3) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index 33a176437e2e..4b4327b45606 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -94,6 +94,7 @@ enum quirk_type { + QUIRK_MIDI_AKAI, + QUIRK_MIDI_US122L, + QUIRK_MIDI_FTDI, ++ QUIRK_MIDI_CH345, + QUIRK_AUDIO_STANDARD_INTERFACE, + QUIRK_AUDIO_FIXED_ENDPOINT, + QUIRK_AUDIO_EDIROL_UAXX, |