commit: 592fd2b1122f91a49dfa702aeb350477ee3c7c5f Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Jan 2 20:13:36 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Jan 2 20:13:36 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=592fd2b1
Linux patch 4.9.74 0000_README | 4 + 1073_linux-4.9.74.patch | 2923 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2927 insertions(+) diff --git a/0000_README b/0000_README index a3e2751..350d2c5 100644 --- a/0000_README +++ b/0000_README @@ -335,6 +335,10 @@ Patch: 1072_linux-4.9.73.patch From: http://www.kernel.org Desc: Linux 4.9.73 +Patch: 1073_linux-4.9.74.patch +From: http://www.kernel.org +Desc: Linux 4.9.74 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1073_linux-4.9.74.patch b/1073_linux-4.9.74.patch new file mode 100644 index 0000000..7efaa13 --- /dev/null +++ b/1073_linux-4.9.74.patch @@ -0,0 +1,2923 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 86a6746f6833..152ec4e87b57 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2795,6 +2795,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + nopat [X86] Disable PAT (page attribute table extension of + pagetables) support. + ++ nopcid [X86-64] Disable the PCID cpu feature. ++ + norandmaps Don't use address space randomization. Equivalent to + echo 0 > /proc/sys/kernel/randomize_va_space + +diff --git a/Makefile b/Makefile +index 64eb0bf614ee..075e429732e7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 73 ++SUBLEVEL = 74 + EXTRAVERSION = + NAME = Roaring Lionus + +@@ -788,6 +788,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) + # disable invalid "can't wrap" optimizations for signed / pointers + KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) + ++# Make sure -fstack-check isn't enabled (like gentoo apparently did) ++KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,) ++ + # conserve stack if available + KBUILD_CFLAGS += $(call cc-option,-fconserve-stack) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index b9c546a305a4..da8156fd3d58 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -45,7 +45,7 @@ config X86 + select ARCH_USE_CMPXCHG_LOCKREF if X86_64 + select ARCH_USE_QUEUED_RWLOCKS + select ARCH_USE_QUEUED_SPINLOCKS +- select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH if SMP ++ select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH + select ARCH_WANTS_DYNAMIC_TASK_STRUCT + select ARCH_WANT_FRAME_POINTERS + select ARCH_WANT_IPC_PARSE_VERSION if X86_32 +diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h +index 85599ad4d024..21c5ac15657b 100644 +--- a/arch/x86/include/asm/disabled-features.h ++++ b/arch/x86/include/asm/disabled-features.h +@@ -21,11 +21,13 @@ + # define DISABLE_K6_MTRR (1<<(X86_FEATURE_K6_MTRR & 31)) + # define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31)) + # define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31)) ++# define DISABLE_PCID 0 + #else + # define DISABLE_VME 0 + # define DISABLE_K6_MTRR 0 + # define DISABLE_CYRIX_ARR 0 + # define DISABLE_CENTAUR_MCR 0 ++# define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31)) + #endif /* CONFIG_X86_64 */ + + #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS +@@ -43,7 +45,7 @@ + #define DISABLED_MASK1 0 + #define DISABLED_MASK2 0 + #define DISABLED_MASK3 (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR) +-#define DISABLED_MASK4 0 ++#define DISABLED_MASK4 (DISABLE_PCID) + #define DISABLED_MASK5 0 + #define DISABLED_MASK6 0 + #define DISABLED_MASK7 0 +diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h +index 59405a248fc2..9b76cd331990 100644 +--- a/arch/x86/include/asm/hardirq.h ++++ b/arch/x86/include/asm/hardirq.h +@@ -22,8 +22,8 @@ typedef struct { + #ifdef CONFIG_SMP + unsigned int irq_resched_count; + unsigned int irq_call_count; +- unsigned int irq_tlb_count; + #endif ++ unsigned int irq_tlb_count; + #ifdef CONFIG_X86_THERMAL_VECTOR + unsigned int irq_thermal_count; + #endif +diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h +index 72198c64e646..8b272a08d1a8 100644 +--- a/arch/x86/include/asm/mmu.h ++++ b/arch/x86/include/asm/mmu.h +@@ -33,12 +33,6 @@ typedef struct { + #endif + } mm_context_t; + +-#ifdef CONFIG_SMP + void leave_mm(int cpu); +-#else +-static inline void leave_mm(int cpu) +-{ +-} +-#endif + + #endif /* _ASM_X86_MMU_H */ +diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h +index f9dd22469388..d23e35584f15 100644 +--- a/arch/x86/include/asm/mmu_context.h ++++ b/arch/x86/include/asm/mmu_context.h +@@ -99,10 +99,8 @@ static inline void load_mm_ldt(struct mm_struct *mm) + + static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) + { +-#ifdef CONFIG_SMP + if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) + this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY); +-#endif + } + + static inline int init_new_context(struct task_struct *tsk, +diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h +index fc5abff9b7fd..7d2ea6b1f7d9 100644 +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -7,6 +7,7 @@ + #include <asm/processor.h> + #include <asm/cpufeature.h> + #include <asm/special_insns.h> ++#include <asm/smp.h> + + static inline void __invpcid(unsigned long pcid, unsigned long addr, + unsigned long type) +@@ -65,10 +66,8 @@ static inline void invpcid_flush_all_nonglobals(void) + #endif + + struct tlb_state { +-#ifdef CONFIG_SMP + struct mm_struct *active_mm; + int state; +-#endif + + /* + * Access to this CR4 shadow and to H/W CR4 is protected by +@@ -192,6 +191,14 @@ static inline void __flush_tlb_all(void) + __flush_tlb_global(); + else + __flush_tlb(); ++ ++ /* ++ * Note: if we somehow had PCID but not PGE, then this wouldn't work -- ++ * we'd end up flushing kernel translations for the current ASID but ++ * we might fail to flush kernel translations for other cached ASIDs. ++ * ++ * To avoid this issue, we force PCID off if PGE is off. ++ */ + } + + static inline void __flush_tlb_one(unsigned long addr) +@@ -205,7 +212,6 @@ static inline void __flush_tlb_one(unsigned long addr) + /* + * TLB flushing: + * +- * - flush_tlb() flushes the current mm struct TLBs + * - flush_tlb_all() flushes all processes TLBs + * - flush_tlb_mm(mm) flushes the specified mm context TLB's + * - flush_tlb_page(vma, vmaddr) flushes one page +@@ -217,84 +223,6 @@ static inline void __flush_tlb_one(unsigned long addr) + * and page-granular flushes are available only on i486 and up. + */ + +-#ifndef CONFIG_SMP +- +-/* "_up" is for UniProcessor. +- * +- * This is a helper for other header functions. *Not* intended to be called +- * directly. All global TLB flushes need to either call this, or to bump the +- * vm statistics themselves. +- */ +-static inline void __flush_tlb_up(void) +-{ +- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); +- __flush_tlb(); +-} +- +-static inline void flush_tlb_all(void) +-{ +- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); +- __flush_tlb_all(); +-} +- +-static inline void flush_tlb(void) +-{ +- __flush_tlb_up(); +-} +- +-static inline void local_flush_tlb(void) +-{ +- __flush_tlb_up(); +-} +- +-static inline void flush_tlb_mm(struct mm_struct *mm) +-{ +- if (mm == current->active_mm) +- __flush_tlb_up(); +-} +- +-static inline void flush_tlb_page(struct vm_area_struct *vma, +- unsigned long addr) +-{ +- if (vma->vm_mm == current->active_mm) +- __flush_tlb_one(addr); +-} +- +-static inline void flush_tlb_range(struct vm_area_struct *vma, +- unsigned long start, unsigned long end) +-{ +- if (vma->vm_mm == current->active_mm) +- __flush_tlb_up(); +-} +- +-static inline void flush_tlb_mm_range(struct mm_struct *mm, +- unsigned long start, unsigned long end, unsigned long vmflag) +-{ +- if (mm == current->active_mm) +- __flush_tlb_up(); +-} +- +-static inline void native_flush_tlb_others(const struct cpumask *cpumask, +- struct mm_struct *mm, +- unsigned long start, +- unsigned long end) +-{ +-} +- +-static inline void reset_lazy_tlbstate(void) +-{ +-} +- +-static inline void flush_tlb_kernel_range(unsigned long start, +- unsigned long end) +-{ +- flush_tlb_all(); +-} +- +-#else /* SMP */ +- +-#include <asm/smp.h> +- + #define local_flush_tlb() __flush_tlb() + + #define flush_tlb_mm(mm) flush_tlb_mm_range(mm, 0UL, TLB_FLUSH_ALL, 0UL) +@@ -303,13 +231,14 @@ static inline void flush_tlb_kernel_range(unsigned long start, + flush_tlb_mm_range(vma->vm_mm, start, end, vma->vm_flags) + + extern void flush_tlb_all(void); +-extern void flush_tlb_current_task(void); +-extern void flush_tlb_page(struct vm_area_struct *, unsigned long); + extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, + unsigned long end, unsigned long vmflag); + extern void flush_tlb_kernel_range(unsigned long start, unsigned long end); + +-#define flush_tlb() flush_tlb_current_task() ++static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a) ++{ ++ flush_tlb_mm_range(vma->vm_mm, a, a + PAGE_SIZE, VM_NONE); ++} + + void native_flush_tlb_others(const struct cpumask *cpumask, + struct mm_struct *mm, +@@ -324,8 +253,6 @@ static inline void reset_lazy_tlbstate(void) + this_cpu_write(cpu_tlbstate.active_mm, &init_mm); + } + +-#endif /* SMP */ +- + #ifndef CONFIG_PARAVIRT + #define flush_tlb_others(mask, mm, start, end) \ + native_flush_tlb_others(mask, mm, start, end) +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index bd17db15a2c1..0b6124315441 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -19,6 +19,14 @@ + + void __init check_bugs(void) + { ++#ifdef CONFIG_X86_32 ++ /* ++ * Regardless of whether PCID is enumerated, the SDM says ++ * that it can't be enabled in 32-bit mode. ++ */ ++ setup_clear_cpu_cap(X86_FEATURE_PCID); ++#endif ++ + identify_boot_cpu(); + #ifndef CONFIG_SMP + pr_info("CPU: "); +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 4eece91ada37..91588be529b9 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -163,6 +163,24 @@ static int __init x86_mpx_setup(char *s) + } + __setup("nompx", x86_mpx_setup); + ++#ifdef CONFIG_X86_64 ++static int __init x86_pcid_setup(char *s) ++{ ++ /* require an exact match without trailing characters */ ++ if (strlen(s)) ++ return 0; ++ ++ /* do not emit a message if the feature is not present */ ++ if (!boot_cpu_has(X86_FEATURE_PCID)) ++ return 1; ++ ++ setup_clear_cpu_cap(X86_FEATURE_PCID); ++ pr_info("nopcid: PCID feature disabled\n"); ++ return 1; ++} ++__setup("nopcid", x86_pcid_setup); ++#endif ++ + static int __init x86_noinvpcid_setup(char *s) + { + /* noinvpcid doesn't accept parameters */ +@@ -306,6 +324,25 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) + } + } + ++static void setup_pcid(struct cpuinfo_x86 *c) ++{ ++ if (cpu_has(c, X86_FEATURE_PCID)) { ++ if (cpu_has(c, X86_FEATURE_PGE)) { ++ cr4_set_bits(X86_CR4_PCIDE); ++ } else { ++ /* ++ * flush_tlb_all(), as currently implemented, won't ++ * work if PCID is on but PGE is not. Since that ++ * combination doesn't exist on real hardware, there's ++ * no reason to try to fully support it, but it's ++ * polite to avoid corrupting data if we're on ++ * an improperly configured VM. ++ */ ++ clear_cpu_cap(c, X86_FEATURE_PCID); ++ } ++ } ++} ++ + /* + * Protection Keys are not available in 32-bit mode. + */ +@@ -1064,6 +1101,9 @@ static void identify_cpu(struct cpuinfo_x86 *c) + setup_smep(c); + setup_smap(c); + ++ /* Set up PCID */ ++ setup_pcid(c); ++ + /* + * The vendor-specific functions might have changed features. + * Now we do "generic changes." +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index 067f9813fd2c..ce020a69bba9 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -106,6 +106,10 @@ void __noreturn machine_real_restart(unsigned int type) + load_cr3(initial_page_table); + #else + write_cr3(real_mode_header->trampoline_pgd); ++ ++ /* Exiting long mode will fail if CR4.PCIDE is set. */ ++ if (static_cpu_has(X86_FEATURE_PCID)) ++ cr4_clear_bits(X86_CR4_PCIDE); + #endif + + /* Jump to the identity-mapped low memory code */ +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 9fe7b9e1ae30..e803d72ef525 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -115,25 +115,16 @@ static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip) + spin_lock_irqsave(&rtc_lock, flags); + CMOS_WRITE(0xa, 0xf); + spin_unlock_irqrestore(&rtc_lock, flags); +- local_flush_tlb(); +- pr_debug("1.\n"); + *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) = + start_eip >> 4; +- pr_debug("2.\n"); + *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) = + start_eip & 0xf; +- pr_debug("3.\n"); + } + + static inline void smpboot_restore_warm_reset_vector(void) + { + unsigned long flags; + +- /* +- * Install writable page 0 entry to set BIOS data area. +- */ +- local_flush_tlb(); +- + /* + * Paranoid: Set warm reset code and vector here back + * to default values. +diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c +index 01f30e56f99e..4b3012888ada 100644 +--- a/arch/x86/kernel/vm86_32.c ++++ b/arch/x86/kernel/vm86_32.c +@@ -191,7 +191,7 @@ static void mark_screen_rdonly(struct mm_struct *mm) + pte_unmap_unlock(pte, ptl); + out: + up_write(&mm->mmap_sem); +- flush_tlb(); ++ flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, 0UL); + } + + +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 889e7619a091..0381638168d1 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -764,10 +764,8 @@ void __init zone_sizes_init(void) + } + + DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = { +-#ifdef CONFIG_SMP + .active_mm = &init_mm, + .state = 0, +-#endif + .cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */ + }; + EXPORT_SYMBOL_GPL(cpu_tlbstate); +diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c +index 75fb01109f94..53b72fb4e781 100644 +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -15,7 +15,7 @@ + #include <linux/debugfs.h> + + /* +- * Smarter SMP flushing macros. ++ * TLB flushing, formerly SMP-only + * c/o Linus Torvalds. + * + * These mean you can really definitely utterly forget about +@@ -28,8 +28,6 @@ + * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi + */ + +-#ifdef CONFIG_SMP +- + struct flush_tlb_info { + struct mm_struct *flush_mm; + unsigned long flush_start; +@@ -59,8 +57,6 @@ void leave_mm(int cpu) + } + EXPORT_SYMBOL_GPL(leave_mm); + +-#endif /* CONFIG_SMP */ +- + void switch_mm(struct mm_struct *prev, struct mm_struct *next, + struct task_struct *tsk) + { +@@ -91,10 +87,8 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, + set_pgd(pgd, init_mm.pgd[stack_pgd_index]); + } + +-#ifdef CONFIG_SMP + this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); + this_cpu_write(cpu_tlbstate.active_mm, next); +-#endif + + cpumask_set_cpu(cpu, mm_cpumask(next)); + +@@ -152,9 +146,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, + if (unlikely(prev->context.ldt != next->context.ldt)) + load_mm_ldt(next); + #endif +- } +-#ifdef CONFIG_SMP +- else { ++ } else { + this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); + BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); + +@@ -181,11 +173,8 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, + load_mm_ldt(next); + } + } +-#endif + } + +-#ifdef CONFIG_SMP +- + /* + * The flush IPI assumes that a thread switch happens in this order: + * [cpu0: the cpu that switches] +@@ -287,23 +276,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask, + smp_call_function_many(cpumask, flush_tlb_func, &info, 1); + } + +-void flush_tlb_current_task(void) +-{ +- struct mm_struct *mm = current->mm; +- +- preempt_disable(); +- +- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); +- +- /* This is an implicit full barrier that synchronizes with switch_mm. */ +- local_flush_tlb(); +- +- trace_tlb_flush(TLB_LOCAL_SHOOTDOWN, TLB_FLUSH_ALL); +- if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) +- flush_tlb_others(mm_cpumask(mm), mm, 0UL, TLB_FLUSH_ALL); +- preempt_enable(); +-} +- + /* + * See Documentation/x86/tlb.txt for details. We choose 33 + * because it is large enough to cover the vast majority (at +@@ -324,6 +296,12 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, + unsigned long base_pages_to_flush = TLB_FLUSH_ALL; + + preempt_disable(); ++ ++ if ((end != TLB_FLUSH_ALL) && !(vmflag & VM_HUGETLB)) ++ base_pages_to_flush = (end - start) >> PAGE_SHIFT; ++ if (base_pages_to_flush > tlb_single_page_flush_ceiling) ++ base_pages_to_flush = TLB_FLUSH_ALL; ++ + if (current->active_mm != mm) { + /* Synchronize with switch_mm. */ + smp_mb(); +@@ -340,15 +318,11 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, + goto out; + } + +- if ((end != TLB_FLUSH_ALL) && !(vmflag & VM_HUGETLB)) +- base_pages_to_flush = (end - start) >> PAGE_SHIFT; +- + /* + * Both branches below are implicit full barriers (MOV to CR or + * INVLPG) that synchronize with switch_mm. + */ +- if (base_pages_to_flush > tlb_single_page_flush_ceiling) { +- base_pages_to_flush = TLB_FLUSH_ALL; ++ if (base_pages_to_flush == TLB_FLUSH_ALL) { + count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); + local_flush_tlb(); + } else { +@@ -369,33 +343,6 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, + preempt_enable(); + } + +-void flush_tlb_page(struct vm_area_struct *vma, unsigned long start) +-{ +- struct mm_struct *mm = vma->vm_mm; +- +- preempt_disable(); +- +- if (current->active_mm == mm) { +- if (current->mm) { +- /* +- * Implicit full barrier (INVLPG) that synchronizes +- * with switch_mm. +- */ +- __flush_tlb_one(start); +- } else { +- leave_mm(smp_processor_id()); +- +- /* Synchronize with switch_mm. */ +- smp_mb(); +- } +- } +- +- if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) +- flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE); +- +- preempt_enable(); +-} +- + static void do_flush_tlb_all(void *info) + { + count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); +@@ -480,5 +427,3 @@ static int __init create_tlb_single_page_flush_ceiling(void) + return 0; + } + late_initcall(create_tlb_single_page_flush_ceiling); +- +-#endif /* CONFIG_SMP */ +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 8f1f7efa848c..2bea87cc0ff2 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -444,6 +444,12 @@ static void __init xen_init_cpuid_mask(void) + ~((1 << X86_FEATURE_MTRR) | /* disable MTRR */ + (1 << X86_FEATURE_ACC)); /* thermal monitoring */ + ++ /* ++ * Xen PV would need some work to support PCID: CR3 handling as well ++ * as xen_flush_tlb_others() would need updating. ++ */ ++ cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_PCID % 32)); /* disable PCID */ ++ + if (!xen_initial_domain()) + cpuid_leaf1_edx_mask &= + ~((1 << X86_FEATURE_ACPI)); /* disable ACPI */ +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index 19c6477af19f..a856371bbe58 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -575,10 +575,10 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe, + ret = -EAGAIN; + goto skip_cqe; + } +- if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) { ++ if (unlikely(!CQE_STATUS(hw_cqe) && ++ CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) { + t4_set_wq_in_error(wq); +- hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN)); +- goto proc_cqe; ++ hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN)); + } + goto proc_cqe; + } +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index edae2dcc4927..bb22d325e965 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -14226,7 +14226,9 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + /* Reset PHY, otherwise the read DMA engine will be in a mode that + * breaks all requests to 256 bytes. + */ +- if (tg3_asic_rev(tp) == ASIC_REV_57766) ++ if (tg3_asic_rev(tp) == ASIC_REV_57766 || ++ tg3_asic_rev(tp) == ASIC_REV_5717 || ++ tg3_asic_rev(tp) == ASIC_REV_5719) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 849b8712ec81..917091871259 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -172,10 +172,12 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address"); + #endif /* CONFIG_M5272 */ + + /* The FEC stores dest/src/type/vlan, data, and checksum for receive packets. ++ * ++ * 2048 byte skbufs are allocated. However, alignment requirements ++ * varies between FEC variants. Worst case is 64, so round down by 64. + */ +-#define PKT_MAXBUF_SIZE 1522 ++#define PKT_MAXBUF_SIZE (round_down(2048 - 64, 64)) + #define PKT_MINBUF_SIZE 64 +-#define PKT_MAXBLR_SIZE 1536 + + /* FEC receive acceleration */ + #define FEC_RACC_IPDIS (1 << 1) +@@ -813,6 +815,12 @@ static void fec_enet_bd_init(struct net_device *dev) + for (i = 0; i < txq->bd.ring_size; i++) { + /* Initialize the BD for every fragment in the page. */ + bdp->cbd_sc = cpu_to_fec16(0); ++ if (bdp->cbd_bufaddr && ++ !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr))) ++ dma_unmap_single(&fep->pdev->dev, ++ fec32_to_cpu(bdp->cbd_bufaddr), ++ fec16_to_cpu(bdp->cbd_datlen), ++ DMA_TO_DEVICE); + if (txq->tx_skbuff[i]) { + dev_kfree_skb_any(txq->tx_skbuff[i]); + txq->tx_skbuff[i] = NULL; +@@ -847,7 +855,7 @@ static void fec_enet_enable_ring(struct net_device *ndev) + for (i = 0; i < fep->num_rx_queues; i++) { + rxq = fep->rx_queue[i]; + writel(rxq->bd.dma, fep->hwp + FEC_R_DES_START(i)); +- writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE(i)); ++ writel(PKT_MAXBUF_SIZE, fep->hwp + FEC_R_BUFF_SIZE(i)); + + /* enable DMA1/2 */ + if (i) +diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c +index a0d1b084ecec..7aeb7fedb364 100644 +--- a/drivers/net/ethernet/marvell/mvmdio.c ++++ b/drivers/net/ethernet/marvell/mvmdio.c +@@ -232,7 +232,8 @@ static int orion_mdio_probe(struct platform_device *pdev) + dev->regs + MVMDIO_ERR_INT_MASK); + + } else if (dev->err_interrupt == -EPROBE_DEFER) { +- return -EPROBE_DEFER; ++ ret = -EPROBE_DEFER; ++ goto out_mdio; + } + + mutex_init(&dev->lock); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index f7fabecc104f..4c3f1cb7e2c9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -367,7 +367,7 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op, + case MLX5_CMD_OP_QUERY_VPORT_COUNTER: + case MLX5_CMD_OP_ALLOC_Q_COUNTER: + case MLX5_CMD_OP_QUERY_Q_COUNTER: +- case MLX5_CMD_OP_SET_RATE_LIMIT: ++ case MLX5_CMD_OP_SET_PP_RATE_LIMIT: + case MLX5_CMD_OP_QUERY_RATE_LIMIT: + case MLX5_CMD_OP_ALLOC_PD: + case MLX5_CMD_OP_ALLOC_UAR: +@@ -502,7 +502,7 @@ const char *mlx5_command_str(int command) + MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER); + MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER); + MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER); +- MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT); ++ MLX5_COMMAND_STR_CASE(SET_PP_RATE_LIMIT); + MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT); + MLX5_COMMAND_STR_CASE(ALLOC_PD); + MLX5_COMMAND_STR_CASE(DEALLOC_PD); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 9d3722930c95..38981db43bc3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3038,6 +3038,7 @@ static netdev_features_t mlx5e_vxlan_features_check(struct mlx5e_priv *priv, + struct sk_buff *skb, + netdev_features_t features) + { ++ unsigned int offset = 0; + struct udphdr *udph; + u16 proto; + u16 port = 0; +@@ -3047,7 +3048,7 @@ static netdev_features_t mlx5e_vxlan_features_check(struct mlx5e_priv *priv, + proto = ip_hdr(skb)->protocol; + break; + case htons(ETH_P_IPV6): +- proto = ipv6_hdr(skb)->nexthdr; ++ proto = ipv6_find_hdr(skb, &offset, -1, NULL, NULL); + break; + default: + goto out; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index d0a4005fe63a..9346f3985edf 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -303,8 +303,8 @@ int mlx5_core_create_qp(struct mlx5_core_dev *dev, + err_cmd: + memset(din, 0, sizeof(din)); + memset(dout, 0, sizeof(dout)); +- MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP); +- MLX5_SET(destroy_qp_in, in, qpn, qp->qpn); ++ MLX5_SET(destroy_qp_in, din, opcode, MLX5_CMD_OP_DESTROY_QP); ++ MLX5_SET(destroy_qp_in, din, qpn, qp->qpn); + mlx5_cmd_exec(dev, din, sizeof(din), dout, sizeof(dout)); + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/rl.c b/drivers/net/ethernet/mellanox/mlx5/core/rl.c +index 104902a93a0b..2be9ec5fd651 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/rl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/rl.c +@@ -60,16 +60,16 @@ static struct mlx5_rl_entry *find_rl_entry(struct mlx5_rl_table *table, + return ret_entry; + } + +-static int mlx5_set_rate_limit_cmd(struct mlx5_core_dev *dev, ++static int mlx5_set_pp_rate_limit_cmd(struct mlx5_core_dev *dev, + u32 rate, u16 index) + { +- u32 in[MLX5_ST_SZ_DW(set_rate_limit_in)] = {0}; +- u32 out[MLX5_ST_SZ_DW(set_rate_limit_out)] = {0}; ++ u32 in[MLX5_ST_SZ_DW(set_pp_rate_limit_in)] = {0}; ++ u32 out[MLX5_ST_SZ_DW(set_pp_rate_limit_out)] = {0}; + +- MLX5_SET(set_rate_limit_in, in, opcode, +- MLX5_CMD_OP_SET_RATE_LIMIT); +- MLX5_SET(set_rate_limit_in, in, rate_limit_index, index); +- MLX5_SET(set_rate_limit_in, in, rate_limit, rate); ++ MLX5_SET(set_pp_rate_limit_in, in, opcode, ++ MLX5_CMD_OP_SET_PP_RATE_LIMIT); ++ MLX5_SET(set_pp_rate_limit_in, in, rate_limit_index, index); ++ MLX5_SET(set_pp_rate_limit_in, in, rate_limit, rate); + return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); + } + +@@ -108,7 +108,7 @@ int mlx5_rl_add_rate(struct mlx5_core_dev *dev, u32 rate, u16 *index) + entry->refcount++; + } else { + /* new rate limit */ +- err = mlx5_set_rate_limit_cmd(dev, rate, entry->index); ++ err = mlx5_set_pp_rate_limit_cmd(dev, rate, entry->index); + if (err) { + mlx5_core_err(dev, "Failed configuring rate: %u (%d)\n", + rate, err); +@@ -144,7 +144,7 @@ void mlx5_rl_remove_rate(struct mlx5_core_dev *dev, u32 rate) + entry->refcount--; + if (!entry->refcount) { + /* need to remove rate */ +- mlx5_set_rate_limit_cmd(dev, 0, entry->index); ++ mlx5_set_pp_rate_limit_cmd(dev, 0, entry->index); + entry->rate = 0; + } + +@@ -197,8 +197,8 @@ void mlx5_cleanup_rl_table(struct mlx5_core_dev *dev) + /* Clear all configured rates */ + for (i = 0; i < table->max_size; i++) + if (table->rl_entry[i].rate) +- mlx5_set_rate_limit_cmd(dev, 0, +- table->rl_entry[i].index); ++ mlx5_set_pp_rate_limit_cmd(dev, 0, ++ table->rl_entry[i].index); + + kfree(dev->priv.rl_table.rl_entry); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c +index 07a9ba6cfc70..2f74953e4561 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c +@@ -71,9 +71,9 @@ struct mlx5e_vxlan *mlx5e_vxlan_lookup_port(struct mlx5e_priv *priv, u16 port) + struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan; + struct mlx5e_vxlan *vxlan; + +- spin_lock(&vxlan_db->lock); ++ spin_lock_bh(&vxlan_db->lock); + vxlan = radix_tree_lookup(&vxlan_db->tree, port); +- spin_unlock(&vxlan_db->lock); ++ spin_unlock_bh(&vxlan_db->lock); + + return vxlan; + } +@@ -88,8 +88,12 @@ static void mlx5e_vxlan_add_port(struct work_struct *work) + struct mlx5e_vxlan *vxlan; + int err; + +- if (mlx5e_vxlan_lookup_port(priv, port)) ++ mutex_lock(&priv->state_lock); ++ vxlan = mlx5e_vxlan_lookup_port(priv, port); ++ if (vxlan) { ++ atomic_inc(&vxlan->refcount); + goto free_work; ++ } + + if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port)) + goto free_work; +@@ -99,10 +103,11 @@ static void mlx5e_vxlan_add_port(struct work_struct *work) + goto err_delete_port; + + vxlan->udp_port = port; ++ atomic_set(&vxlan->refcount, 1); + +- spin_lock_irq(&vxlan_db->lock); ++ spin_lock_bh(&vxlan_db->lock); + err = radix_tree_insert(&vxlan_db->tree, vxlan->udp_port, vxlan); +- spin_unlock_irq(&vxlan_db->lock); ++ spin_unlock_bh(&vxlan_db->lock); + if (err) + goto err_free; + +@@ -113,35 +118,39 @@ static void mlx5e_vxlan_add_port(struct work_struct *work) + err_delete_port: + mlx5e_vxlan_core_del_port_cmd(priv->mdev, port); + free_work: ++ mutex_unlock(&priv->state_lock); + kfree(vxlan_work); + } + +-static void __mlx5e_vxlan_core_del_port(struct mlx5e_priv *priv, u16 port) ++static void mlx5e_vxlan_del_port(struct work_struct *work) + { ++ struct mlx5e_vxlan_work *vxlan_work = ++ container_of(work, struct mlx5e_vxlan_work, work); ++ struct mlx5e_priv *priv = vxlan_work->priv; + struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan; ++ u16 port = vxlan_work->port; + struct mlx5e_vxlan *vxlan; ++ bool remove = false; + +- spin_lock_irq(&vxlan_db->lock); +- vxlan = radix_tree_delete(&vxlan_db->tree, port); +- spin_unlock_irq(&vxlan_db->lock); +- ++ mutex_lock(&priv->state_lock); ++ spin_lock_bh(&vxlan_db->lock); ++ vxlan = radix_tree_lookup(&vxlan_db->tree, port); + if (!vxlan) +- return; +- +- mlx5e_vxlan_core_del_port_cmd(priv->mdev, vxlan->udp_port); +- +- kfree(vxlan); +-} ++ goto out_unlock; + +-static void mlx5e_vxlan_del_port(struct work_struct *work) +-{ +- struct mlx5e_vxlan_work *vxlan_work = +- container_of(work, struct mlx5e_vxlan_work, work); +- struct mlx5e_priv *priv = vxlan_work->priv; +- u16 port = vxlan_work->port; ++ if (atomic_dec_and_test(&vxlan->refcount)) { ++ radix_tree_delete(&vxlan_db->tree, port); ++ remove = true; ++ } + +- __mlx5e_vxlan_core_del_port(priv, port); ++out_unlock: ++ spin_unlock_bh(&vxlan_db->lock); + ++ if (remove) { ++ mlx5e_vxlan_core_del_port_cmd(priv->mdev, port); ++ kfree(vxlan); ++ } ++ mutex_unlock(&priv->state_lock); + kfree(vxlan_work); + } + +@@ -171,12 +180,11 @@ void mlx5e_vxlan_cleanup(struct mlx5e_priv *priv) + struct mlx5e_vxlan *vxlan; + unsigned int port = 0; + +- spin_lock_irq(&vxlan_db->lock); ++ /* Lockless since we are the only radix-tree consumers, wq is disabled */ + while (radix_tree_gang_lookup(&vxlan_db->tree, (void **)&vxlan, port, 1)) { + port = vxlan->udp_port; +- spin_unlock_irq(&vxlan_db->lock); +- __mlx5e_vxlan_core_del_port(priv, (u16)port); +- spin_lock_irq(&vxlan_db->lock); ++ radix_tree_delete(&vxlan_db->tree, port); ++ mlx5e_vxlan_core_del_port_cmd(priv->mdev, port); ++ kfree(vxlan); + } +- spin_unlock_irq(&vxlan_db->lock); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h +index 5def12c048e3..5ef6ae7d568a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h +@@ -36,6 +36,7 @@ + #include "en.h" + + struct mlx5e_vxlan { ++ atomic_t refcount; + u16 udp_port; + }; + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index fbf5945ce00d..2032a6de026b 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -624,6 +624,7 @@ static int ksz9031_read_status(struct phy_device *phydev) + phydev->link = 0; + if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev)) + phydev->drv->config_intr(phydev); ++ return genphy_config_aneg(phydev); + } + + return 0; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 105fbfb47e3a..db65d9ad4488 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -907,6 +907,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ + {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ + {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */ ++ {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index e72234efb648..9b5fc502f6a1 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -576,9 +576,9 @@ enum qeth_cq { + }; + + struct qeth_ipato { +- int enabled; +- int invert4; +- int invert6; ++ bool enabled; ++ bool invert4; ++ bool invert6; + struct list_head entries; + }; + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 838ed6213118..df8f74cb1406 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -1475,9 +1475,9 @@ static int qeth_setup_card(struct qeth_card *card) + qeth_set_intial_options(card); + /* IP address takeover */ + INIT_LIST_HEAD(&card->ipato.entries); +- card->ipato.enabled = 0; +- card->ipato.invert4 = 0; +- card->ipato.invert6 = 0; ++ card->ipato.enabled = false; ++ card->ipato.invert4 = false; ++ card->ipato.invert6 = false; + /* init QDIO stuff */ + qeth_init_qdio_info(card); + INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work); +diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h +index 26f79533e62e..eedf9b01a496 100644 +--- a/drivers/s390/net/qeth_l3.h ++++ b/drivers/s390/net/qeth_l3.h +@@ -80,7 +80,7 @@ void qeth_l3_del_vipa(struct qeth_card *, enum qeth_prot_versions, const u8 *); + int qeth_l3_add_rxip(struct qeth_card *, enum qeth_prot_versions, const u8 *); + void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions, + const u8 *); +-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *, struct qeth_ipaddr *); ++void qeth_l3_update_ipato(struct qeth_card *card); + struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions); + int qeth_l3_add_ip(struct qeth_card *, struct qeth_ipaddr *); + int qeth_l3_delete_ip(struct qeth_card *, struct qeth_ipaddr *); +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index f91e70c369ed..1487f8a0c575 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -168,8 +168,8 @@ static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len) + } + } + +-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card, +- struct qeth_ipaddr *addr) ++static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card, ++ struct qeth_ipaddr *addr) + { + struct qeth_ipato_entry *ipatoe; + u8 addr_bits[128] = {0, }; +@@ -178,6 +178,8 @@ int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card, + + if (!card->ipato.enabled) + return 0; ++ if (addr->type != QETH_IP_TYPE_NORMAL) ++ return 0; + + qeth_l3_convert_addr_to_bits((u8 *) &addr->u, addr_bits, + (addr->proto == QETH_PROT_IPV4)? 4:16); +@@ -293,8 +295,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + memcpy(addr, tmp_addr, sizeof(struct qeth_ipaddr)); + addr->ref_counter = 1; + +- if (addr->type == QETH_IP_TYPE_NORMAL && +- qeth_l3_is_addr_covered_by_ipato(card, addr)) { ++ if (qeth_l3_is_addr_covered_by_ipato(card, addr)) { + QETH_CARD_TEXT(card, 2, "tkovaddr"); + addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG; + } +@@ -607,6 +608,27 @@ int qeth_l3_setrouting_v6(struct qeth_card *card) + /* + * IP address takeover related functions + */ ++ ++/** ++ * qeth_l3_update_ipato() - Update 'takeover' property, for all NORMAL IPs. ++ * ++ * Caller must hold ip_lock. ++ */ ++void qeth_l3_update_ipato(struct qeth_card *card) ++{ ++ struct qeth_ipaddr *addr; ++ unsigned int i; ++ ++ hash_for_each(card->ip_htable, i, addr, hnode) { ++ if (addr->type != QETH_IP_TYPE_NORMAL) ++ continue; ++ if (qeth_l3_is_addr_covered_by_ipato(card, addr)) ++ addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG; ++ else ++ addr->set_flags &= ~QETH_IPA_SETIP_TAKEOVER_FLAG; ++ } ++} ++ + static void qeth_l3_clear_ipato_list(struct qeth_card *card) + { + struct qeth_ipato_entry *ipatoe, *tmp; +@@ -618,6 +640,7 @@ static void qeth_l3_clear_ipato_list(struct qeth_card *card) + kfree(ipatoe); + } + ++ qeth_l3_update_ipato(card); + spin_unlock_bh(&card->ip_lock); + } + +@@ -642,8 +665,10 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card, + } + } + +- if (!rc) ++ if (!rc) { + list_add_tail(&new->entry, &card->ipato.entries); ++ qeth_l3_update_ipato(card); ++ } + + spin_unlock_bh(&card->ip_lock); + +@@ -666,6 +691,7 @@ void qeth_l3_del_ipato_entry(struct qeth_card *card, + (proto == QETH_PROT_IPV4)? 4:16) && + (ipatoe->mask_bits == mask_bits)) { + list_del(&ipatoe->entry); ++ qeth_l3_update_ipato(card); + kfree(ipatoe); + } + } +diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c +index cffe42f5775d..d6bdfc6e905a 100644 +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -372,8 +372,8 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { + struct qeth_card *card = dev_get_drvdata(dev); +- struct qeth_ipaddr *addr; +- int i, rc = 0; ++ bool enable; ++ int rc = 0; + + if (!card) + return -EINVAL; +@@ -386,25 +386,18 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev, + } + + if (sysfs_streq(buf, "toggle")) { +- card->ipato.enabled = (card->ipato.enabled)? 0 : 1; +- } else if (sysfs_streq(buf, "1")) { +- card->ipato.enabled = 1; +- hash_for_each(card->ip_htable, i, addr, hnode) { +- if ((addr->type == QETH_IP_TYPE_NORMAL) && +- qeth_l3_is_addr_covered_by_ipato(card, addr)) +- addr->set_flags |= +- QETH_IPA_SETIP_TAKEOVER_FLAG; +- } +- } else if (sysfs_streq(buf, "0")) { +- card->ipato.enabled = 0; +- hash_for_each(card->ip_htable, i, addr, hnode) { +- if (addr->set_flags & +- QETH_IPA_SETIP_TAKEOVER_FLAG) +- addr->set_flags &= +- ~QETH_IPA_SETIP_TAKEOVER_FLAG; +- } +- } else ++ enable = !card->ipato.enabled; ++ } else if (kstrtobool(buf, &enable)) { + rc = -EINVAL; ++ goto out; ++ } ++ ++ if (card->ipato.enabled != enable) { ++ card->ipato.enabled = enable; ++ spin_lock_bh(&card->ip_lock); ++ qeth_l3_update_ipato(card); ++ spin_unlock_bh(&card->ip_lock); ++ } + out: + mutex_unlock(&card->conf_mutex); + return rc ? rc : count; +@@ -430,20 +423,27 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev, + const char *buf, size_t count) + { + struct qeth_card *card = dev_get_drvdata(dev); ++ bool invert; + int rc = 0; + + if (!card) + return -EINVAL; + + mutex_lock(&card->conf_mutex); +- if (sysfs_streq(buf, "toggle")) +- card->ipato.invert4 = (card->ipato.invert4)? 0 : 1; +- else if (sysfs_streq(buf, "1")) +- card->ipato.invert4 = 1; +- else if (sysfs_streq(buf, "0")) +- card->ipato.invert4 = 0; +- else ++ if (sysfs_streq(buf, "toggle")) { ++ invert = !card->ipato.invert4; ++ } else if (kstrtobool(buf, &invert)) { + rc = -EINVAL; ++ goto out; ++ } ++ ++ if (card->ipato.invert4 != invert) { ++ card->ipato.invert4 = invert; ++ spin_lock_bh(&card->ip_lock); ++ qeth_l3_update_ipato(card); ++ spin_unlock_bh(&card->ip_lock); ++ } ++out: + mutex_unlock(&card->conf_mutex); + return rc ? rc : count; + } +@@ -609,20 +609,27 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { + struct qeth_card *card = dev_get_drvdata(dev); ++ bool invert; + int rc = 0; + + if (!card) + return -EINVAL; + + mutex_lock(&card->conf_mutex); +- if (sysfs_streq(buf, "toggle")) +- card->ipato.invert6 = (card->ipato.invert6)? 0 : 1; +- else if (sysfs_streq(buf, "1")) +- card->ipato.invert6 = 1; +- else if (sysfs_streq(buf, "0")) +- card->ipato.invert6 = 0; +- else ++ if (sysfs_streq(buf, "toggle")) { ++ invert = !card->ipato.invert6; ++ } else if (kstrtobool(buf, &invert)) { + rc = -EINVAL; ++ goto out; ++ } ++ ++ if (card->ipato.invert6 != invert) { ++ card->ipato.invert6 = invert; ++ spin_lock_bh(&card->ip_lock); ++ qeth_l3_update_ipato(card); ++ spin_unlock_bh(&card->ip_lock); ++ } ++out: + mutex_unlock(&card->conf_mutex); + return rc ? rc : count; + } +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index bdf0e6e89991..faf50df81622 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1764,7 +1764,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old) + { + struct n_tty_data *ldata = tty->disc_data; + +- if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) { ++ if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) { + bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE); + ldata->line_start = ldata->read_tail; + if (!L_ICANON(tty) || !read_cnt(ldata)) { +@@ -2427,7 +2427,7 @@ static int n_tty_ioctl(struct tty_struct *tty, struct file *file, + return put_user(tty_chars_in_buffer(tty), (int __user *) arg); + case TIOCINQ: + down_write(&tty->termios_rwsem); +- if (L_ICANON(tty)) ++ if (L_ICANON(tty) && !L_EXTPROC(tty)) + retval = inq_canon(ldata); + else + retval = read_cnt(ldata); +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index c220c2c0893f..e99f1c5b1df6 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -446,7 +446,7 @@ EXPORT_SYMBOL_GPL(tty_prepare_flip_string); + * Callers other than flush_to_ldisc() need to exclude the kworker + * from concurrent use of the line discipline, see paste_selection(). + * +- * Returns the number of bytes not processed ++ * Returns the number of bytes processed + */ + int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p, + char *f, int count) +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index ba9b29bc441f..7c54a19b20e0 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -1002,7 +1002,7 @@ int usb_get_bos_descriptor(struct usb_device *dev) + case USB_SSP_CAP_TYPE: + ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; + ssac = (le32_to_cpu(ssp_cap->bmAttributes) & +- USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1; ++ USB_SSP_SUBLINK_SPEED_ATTRIBS); + if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) + dev->bos->ssp_cap = ssp_cap; + break; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 50010282c010..c05c4f877750 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -57,10 +57,11 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech HD Pro Webcams C920, C920-C and C930e */ ++ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Logitech ConferenceCam CC3000e */ + { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, +@@ -154,6 +155,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */ + { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* ELSA MicroLink 56K */ ++ { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ + { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index c87ef38e7416..f6782a347cde 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -189,6 +189,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + xhci->quirks |= XHCI_BROKEN_STREAMS; + } ++ if (pdev->vendor == PCI_VENDOR_ID_RENESAS && ++ pdev->device == 0x0014) ++ xhci->quirks |= XHCI_TRUST_TX_LENGTH; + if (pdev->vendor == PCI_VENDOR_ID_RENESAS && + pdev->device == 0x0015) + xhci->quirks |= XHCI_RESET_ON_RESUME; +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 3249f42b4b93..0c743e4cca1e 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1017,6 +1017,7 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, + { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, ++ { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index f9d15bd62785..543d2801632b 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -913,6 +913,12 @@ + #define ICPDAS_I7561U_PID 0x0104 + #define ICPDAS_I7563U_PID 0x0105 + ++/* ++ * Airbus Defence and Space ++ */ ++#define AIRBUS_DS_VID 0x1e8e /* Vendor ID */ ++#define AIRBUS_DS_P8GR 0x6001 /* Tetra P8GR */ ++ + /* + * RT Systems programming cables for various ham radios + */ +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index ffa8ec917ff5..a818c43a02ec 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -236,6 +236,8 @@ static void option_instat_callback(struct urb *urb); + /* These Quectel products use Qualcomm's vendor ID */ + #define QUECTEL_PRODUCT_UC20 0x9003 + #define QUECTEL_PRODUCT_UC15 0x9090 ++/* These Yuga products use Qualcomm's vendor ID */ ++#define YUGA_PRODUCT_CLM920_NC5 0x9625 + + #define QUECTEL_VENDOR_ID 0x2c7c + /* These Quectel products use Quectel's vendor ID */ +@@ -283,6 +285,7 @@ static void option_instat_callback(struct urb *urb); + #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 + #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 + #define TELIT_PRODUCT_ME910 0x1100 ++#define TELIT_PRODUCT_ME910_DUAL_MODEM 0x1101 + #define TELIT_PRODUCT_LE920 0x1200 + #define TELIT_PRODUCT_LE910 0x1201 + #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 +@@ -648,6 +651,11 @@ static const struct option_blacklist_info telit_me910_blacklist = { + .reserved = BIT(1) | BIT(3), + }; + ++static const struct option_blacklist_info telit_me910_dual_modem_blacklist = { ++ .sendsetup = BIT(0), ++ .reserved = BIT(3), ++}; ++ + static const struct option_blacklist_info telit_le910_blacklist = { + .sendsetup = BIT(0), + .reserved = BIT(1) | BIT(2), +@@ -677,6 +685,10 @@ static const struct option_blacklist_info cinterion_rmnet2_blacklist = { + .reserved = BIT(4) | BIT(5), + }; + ++static const struct option_blacklist_info yuga_clm920_nc5_blacklist = { ++ .reserved = BIT(1) | BIT(4), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1181,6 +1193,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ /* Yuga products use Qualcomm vendor ID */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), ++ .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist }, + /* Quectel products using Quectel vendor ID */ + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +@@ -1247,6 +1262,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), ++ .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 4516291df1b8..fb6dc16c754a 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */ + {DEVICE_SWI(0x1199, 0x907a)}, /* Sierra Wireless EM74xx QDL */ + {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */ ++ {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ ++ {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ +@@ -346,6 +348,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + break; + case 2: + dev_dbg(dev, "NMEA GPS interface found\n"); ++ sendsetup = true; + break; + case 3: + dev_dbg(dev, "Modem port found\n"); +diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c +index c653ce533430..1886d8e4f14e 100644 +--- a/drivers/usb/usbip/stub_dev.c ++++ b/drivers/usb/usbip/stub_dev.c +@@ -163,8 +163,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) + * step 1? + */ + if (ud->tcp_socket) { +- dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n", +- ud->tcp_socket); ++ dev_dbg(&sdev->udev->dev, "shutdown sockfd\n"); + kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR); + } + +diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c +index af10f7b131a4..325b4c05acdd 100644 +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -252,11 +252,12 @@ void stub_device_cleanup_urbs(struct stub_device *sdev) + struct stub_priv *priv; + struct urb *urb; + +- dev_dbg(&sdev->udev->dev, "free sdev %p\n", sdev); ++ dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n"); + + while ((priv = stub_priv_pop(sdev))) { + urb = priv->urb; +- dev_dbg(&sdev->udev->dev, "free urb %p\n", urb); ++ dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n", ++ priv->seqnum); + usb_kill_urb(urb); + + kmem_cache_free(stub_priv_cache, priv); +diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c +index 283a9be77a22..5b807185f79e 100644 +--- a/drivers/usb/usbip/stub_rx.c ++++ b/drivers/usb/usbip/stub_rx.c +@@ -225,9 +225,6 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev, + if (priv->seqnum != pdu->u.cmd_unlink.seqnum) + continue; + +- dev_info(&priv->urb->dev->dev, "unlink urb %p\n", +- priv->urb); +- + /* + * This matched urb is not completed yet (i.e., be in + * flight in usb hcd hardware/driver). Now we are +@@ -266,8 +263,8 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev, + ret = usb_unlink_urb(priv->urb); + if (ret != -EINPROGRESS) + dev_err(&priv->urb->dev->dev, +- "failed to unlink a urb %p, ret %d\n", +- priv->urb, ret); ++ "failed to unlink a urb # %lu, ret %d\n", ++ priv->seqnum, ret); + + return 0; + } +diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c +index 87ff94be4235..96aa375b80d9 100644 +--- a/drivers/usb/usbip/stub_tx.c ++++ b/drivers/usb/usbip/stub_tx.c +@@ -102,7 +102,7 @@ void stub_complete(struct urb *urb) + /* link a urb to the queue of tx. */ + spin_lock_irqsave(&sdev->priv_lock, flags); + if (sdev->ud.tcp_socket == NULL) { +- usbip_dbg_stub_tx("ignore urb for closed connection %p", urb); ++ usbip_dbg_stub_tx("ignore urb for closed connection\n"); + /* It will be freed in stub_device_cleanup_urbs(). */ + } else if (priv->unlinking) { + stub_enqueue_ret_unlink(sdev, priv->seqnum, urb->status); +@@ -204,8 +204,8 @@ static int stub_send_ret_submit(struct stub_device *sdev) + + /* 1. setup usbip_header */ + setup_ret_submit_pdu(&pdu_header, urb); +- usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n", +- pdu_header.base.seqnum, urb); ++ usbip_dbg_stub_tx("setup txdata seqnum: %d\n", ++ pdu_header.base.seqnum); + usbip_header_correct_endian(&pdu_header, 1); + + iov[iovnum].iov_base = &pdu_header; +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index 8b232290be6b..e24b24fa0f16 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -335,13 +335,10 @@ int usbip_recv(struct socket *sock, void *buf, int size) + char *bp = buf; + int osize = size; + +- usbip_dbg_xmit("enter\n"); +- +- if (!sock || !buf || !size) { +- pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf, +- size); ++ if (!sock || !buf || !size) + return -EINVAL; +- } ++ ++ usbip_dbg_xmit("enter\n"); + + do { + sock->sk->sk_allocation = GFP_NOIO; +@@ -354,11 +351,8 @@ int usbip_recv(struct socket *sock, void *buf, int size) + msg.msg_flags = MSG_NOSIGNAL; + + result = kernel_recvmsg(sock, &msg, &iov, 1, size, MSG_WAITALL); +- if (result <= 0) { +- pr_debug("receive sock %p buf %p size %u ret %d total %d\n", +- sock, buf, size, result, total); ++ if (result <= 0) + goto err; +- } + + size -= result; + buf += result; +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index d6dc165e924b..7f161b095176 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -506,9 +506,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, + struct vhci_device *vdev; + unsigned long flags; + +- usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n", +- hcd, urb, mem_flags); +- + if (portnum > VHCI_HC_PORTS) { + pr_err("invalid port number %d\n", portnum); + return -ENODEV; +@@ -671,8 +668,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + struct vhci_device *vdev; + unsigned long flags; + +- pr_info("dequeue a urb %p\n", urb); +- + spin_lock_irqsave(&vhci->lock, flags); + + priv = urb->hcpriv; +@@ -700,7 +695,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + /* tcp connection is closed */ + spin_lock(&vdev->priv_lock); + +- pr_info("device %p seems to be disconnected\n", vdev); + list_del(&priv->list); + kfree(priv); + urb->hcpriv = NULL; +@@ -712,8 +706,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + * vhci_rx will receive RET_UNLINK and give back the URB. + * Otherwise, we give back it here. + */ +- pr_info("gives back urb %p\n", urb); +- + usb_hcd_unlink_urb_from_ep(hcd, urb); + + spin_unlock_irqrestore(&vhci->lock, flags); +@@ -741,8 +733,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + + unlink->unlink_seqnum = priv->seqnum; + +- pr_info("device %p seems to be still connected\n", vdev); +- + /* send cmd_unlink and try to cancel the pending URB in the + * peer */ + list_add_tail(&unlink->list, &vdev->unlink_tx); +@@ -823,7 +813,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) + + /* need this? see stub_dev.c */ + if (ud->tcp_socket) { +- pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket); ++ pr_debug("shutdown tcp_socket\n"); + kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR); + } + +diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c +index fc2d319e2360..5943deeec115 100644 +--- a/drivers/usb/usbip/vhci_rx.c ++++ b/drivers/usb/usbip/vhci_rx.c +@@ -37,24 +37,23 @@ struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev, __u32 seqnum) + urb = priv->urb; + status = urb->status; + +- usbip_dbg_vhci_rx("find urb %p vurb %p seqnum %u\n", +- urb, priv, seqnum); ++ usbip_dbg_vhci_rx("find urb seqnum %u\n", seqnum); + + switch (status) { + case -ENOENT: + /* fall through */ + case -ECONNRESET: +- dev_info(&urb->dev->dev, +- "urb %p was unlinked %ssynchronuously.\n", urb, +- status == -ENOENT ? "" : "a"); ++ dev_dbg(&urb->dev->dev, ++ "urb seq# %u was unlinked %ssynchronuously\n", ++ seqnum, status == -ENOENT ? "" : "a"); + break; + case -EINPROGRESS: + /* no info output */ + break; + default: +- dev_info(&urb->dev->dev, +- "urb %p may be in a error, status %d\n", urb, +- status); ++ dev_dbg(&urb->dev->dev, ++ "urb seq# %u may be in a error, status %d\n", ++ seqnum, status); + } + + list_del(&priv->list); +@@ -80,8 +79,8 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + spin_unlock_irqrestore(&vdev->priv_lock, flags); + + if (!urb) { +- pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum); +- pr_info("max seqnum %d\n", ++ pr_err("cannot find a urb of seqnum %u max seqnum %d\n", ++ pdu->base.seqnum, + atomic_read(&vhci->seqnum)); + usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); + return; +@@ -104,7 +103,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + if (usbip_dbg_flag_vhci_rx) + usbip_dump_urb(urb); + +- usbip_dbg_vhci_rx("now giveback urb %p\n", urb); ++ usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum); + + spin_lock_irqsave(&vhci->lock, flags); + usb_hcd_unlink_urb_from_ep(vhci_to_hcd(vhci), urb); +@@ -170,7 +169,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, + pr_info("the urb (seqnum %d) was already given back\n", + pdu->base.seqnum); + } else { +- usbip_dbg_vhci_rx("now giveback urb %p\n", urb); ++ usbip_dbg_vhci_rx("now giveback urb %d\n", pdu->base.seqnum); + + /* If unlink is successful, status is -ECONNRESET */ + urb->status = pdu->u.ret_unlink.status; +diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c +index 3e7878fe2fd4..a9a663a578b6 100644 +--- a/drivers/usb/usbip/vhci_tx.c ++++ b/drivers/usb/usbip/vhci_tx.c +@@ -83,7 +83,8 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) + memset(&msg, 0, sizeof(msg)); + memset(&iov, 0, sizeof(iov)); + +- usbip_dbg_vhci_tx("setup txdata urb %p\n", urb); ++ usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n", ++ priv->seqnum); + + /* 1. setup usbip_header */ + setup_cmd_submit_pdu(&pdu_header, urb); +diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h +index 965cc5693a46..c9447a689522 100644 +--- a/include/linux/cpuhotplug.h ++++ b/include/linux/cpuhotplug.h +@@ -48,7 +48,7 @@ enum cpuhp_state { + CPUHP_ARM_SHMOBILE_SCU_PREPARE, + CPUHP_SH_SH3X_PREPARE, + CPUHP_BLK_MQ_PREPARE, +- CPUHP_TIMERS_DEAD, ++ CPUHP_TIMERS_PREPARE, + CPUHP_NOTF_ERR_INJ_PREPARE, + CPUHP_MIPS_SOC_PREPARE, + CPUHP_BRINGUP_CPU, +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index a0649973ee5b..b9dfca557a6c 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -246,7 +246,8 @@ struct ipv6_pinfo { + * 100: prefer care-of address + */ + dontfrag:1, +- autoflowlabel:1; ++ autoflowlabel:1, ++ autoflowlabel_set:1; + __u8 min_hopcount; + __u8 tclass; + __be32 rcv_flowinfo; +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index 6045d4d58065..25ed105bbcfb 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -143,7 +143,7 @@ enum { + MLX5_CMD_OP_ALLOC_Q_COUNTER = 0x771, + MLX5_CMD_OP_DEALLOC_Q_COUNTER = 0x772, + MLX5_CMD_OP_QUERY_Q_COUNTER = 0x773, +- MLX5_CMD_OP_SET_RATE_LIMIT = 0x780, ++ MLX5_CMD_OP_SET_PP_RATE_LIMIT = 0x780, + MLX5_CMD_OP_QUERY_RATE_LIMIT = 0x781, + MLX5_CMD_OP_ALLOC_PD = 0x800, + MLX5_CMD_OP_DEALLOC_PD = 0x801, +@@ -6689,7 +6689,7 @@ struct mlx5_ifc_add_vxlan_udp_dport_in_bits { + u8 vxlan_udp_port[0x10]; + }; + +-struct mlx5_ifc_set_rate_limit_out_bits { ++struct mlx5_ifc_set_pp_rate_limit_out_bits { + u8 status[0x8]; + u8 reserved_at_8[0x18]; + +@@ -6698,7 +6698,7 @@ struct mlx5_ifc_set_rate_limit_out_bits { + u8 reserved_at_40[0x40]; + }; + +-struct mlx5_ifc_set_rate_limit_in_bits { ++struct mlx5_ifc_set_pp_rate_limit_in_bits { + u8 opcode[0x10]; + u8 reserved_at_10[0x10]; + +@@ -6711,6 +6711,8 @@ struct mlx5_ifc_set_rate_limit_in_bits { + u8 reserved_at_60[0x20]; + + u8 rate_limit[0x20]; ++ ++ u8 reserved_at_a0[0x160]; + }; + + struct mlx5_ifc_access_register_out_bits { +diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h +index b83507c0640c..e38f471a5402 100644 +--- a/include/linux/ptr_ring.h ++++ b/include/linux/ptr_ring.h +@@ -99,12 +99,18 @@ static inline bool ptr_ring_full_bh(struct ptr_ring *r) + + /* Note: callers invoking this in a loop must use a compiler barrier, + * for example cpu_relax(). Callers must hold producer_lock. ++ * Callers are responsible for making sure pointer that is being queued ++ * points to a valid data. + */ + static inline int __ptr_ring_produce(struct ptr_ring *r, void *ptr) + { + if (unlikely(!r->size) || r->queue[r->producer]) + return -ENOSPC; + ++ /* Make sure the pointer we are storing points to a valid data. */ ++ /* Pairs with smp_read_barrier_depends in __ptr_ring_consume. */ ++ smp_wmb(); ++ + r->queue[r->producer++] = ptr; + if (unlikely(r->producer >= r->size)) + r->producer = 0; +@@ -244,6 +250,9 @@ static inline void *__ptr_ring_consume(struct ptr_ring *r) + if (ptr) + __ptr_ring_discard_one(r); + ++ /* Make sure anyone accessing data through the pointer is up to date. */ ++ /* Pairs with smp_wmb in __ptr_ring_produce. */ ++ smp_read_barrier_depends(); + return ptr; + } + +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index 647532b0eb03..f50b717ce644 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -219,7 +219,8 @@ struct tcp_sock { + } rack; + u16 advmss; /* Advertised MSS */ + u8 rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ +- unused:7; ++ is_sack_reneg:1, /* in recovery from loss with SACK reneg? */ ++ unused:6; + u8 nonagle : 4,/* Disable Nagle algorithm? */ + thin_lto : 1,/* Use linear timeouts for thin streams */ + thin_dupack : 1,/* Fast retransmit on first dupack */ +diff --git a/include/linux/timer.h b/include/linux/timer.h +index 51d601f192d4..ec86e4e55ea3 100644 +--- a/include/linux/timer.h ++++ b/include/linux/timer.h +@@ -274,9 +274,11 @@ unsigned long round_jiffies_up(unsigned long j); + unsigned long round_jiffies_up_relative(unsigned long j); + + #ifdef CONFIG_HOTPLUG_CPU ++int timers_prepare_cpu(unsigned int cpu); + int timers_dead_cpu(unsigned int cpu); + #else +-#define timers_dead_cpu NULL ++#define timers_prepare_cpu NULL ++#define timers_dead_cpu NULL + #endif + + #endif +diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h +index 4d6ec58a8d45..2edb150f1a4d 100644 +--- a/include/linux/vm_event_item.h ++++ b/include/linux/vm_event_item.h +@@ -89,10 +89,8 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, + #endif + #endif + #ifdef CONFIG_DEBUG_TLBFLUSH +-#ifdef CONFIG_SMP + NR_TLB_REMOTE_FLUSH, /* cpu tried to flush others' tlbs */ + NR_TLB_REMOTE_FLUSH_RECEIVED,/* cpu received ipi for flush */ +-#endif /* CONFIG_SMP */ + NR_TLB_LOCAL_FLUSH_ALL, + NR_TLB_LOCAL_FLUSH_ONE, + #endif /* CONFIG_DEBUG_TLBFLUSH */ +diff --git a/include/net/ip.h b/include/net/ip.h +index 51c6b9786c46..0e3dcd5a134d 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -33,6 +33,8 @@ + #include <net/flow.h> + #include <net/flow_dissector.h> + ++#define IPV4_MIN_MTU 68 /* RFC 791 */ ++ + struct sock; + + struct inet_skb_parm { +diff --git a/include/net/tcp.h b/include/net/tcp.h +index fba4fc46871d..caf35e062639 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1001,7 +1001,7 @@ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb); + void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, + struct rate_sample *rs); + void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, +- struct skb_mstamp *now, struct rate_sample *rs); ++ bool is_sack_reneg, struct skb_mstamp *now, struct rate_sample *rs); + void tcp_rate_check_app_limited(struct sock *sk); + + /* These functions determine how the current flow behaves in respect of SACK +diff --git a/kernel/cpu.c b/kernel/cpu.c +index e1436ca4aed0..802eb3361a0a 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -1309,9 +1309,9 @@ static struct cpuhp_step cpuhp_bp_states[] = { + * before blk_mq_queue_reinit_notify() from notify_dead(), + * otherwise a RCU stall occurs. + */ +- [CPUHP_TIMERS_DEAD] = { ++ [CPUHP_TIMERS_PREPARE] = { + .name = "timers:dead", +- .startup.single = NULL, ++ .startup.single = timers_prepare_cpu, + .teardown.single = timers_dead_cpu, + }, + /* Kicks the plugged cpu into life */ +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 3bcb61b52f6c..dae1a45be504 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -663,6 +663,11 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now) + tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1); + } + ++static inline bool local_timer_softirq_pending(void) ++{ ++ return local_softirq_pending() & TIMER_SOFTIRQ; ++} ++ + static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, + ktime_t now, int cpu) + { +@@ -679,8 +684,18 @@ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, + } while (read_seqretry(&jiffies_lock, seq)); + ts->last_jiffies = basejiff; + +- if (rcu_needs_cpu(basemono, &next_rcu) || +- arch_needs_cpu() || irq_work_needs_cpu()) { ++ /* ++ * Keep the periodic tick, when RCU, architecture or irq_work ++ * requests it. ++ * Aside of that check whether the local timer softirq is ++ * pending. If so its a bad idea to call get_next_timer_interrupt() ++ * because there is an already expired timer, so it will request ++ * immeditate expiry, which rearms the hardware timer with a ++ * minimal delta which brings us back to this place ++ * immediately. Lather, rinse and repeat... ++ */ ++ if (rcu_needs_cpu(basemono, &next_rcu) || arch_needs_cpu() || ++ irq_work_needs_cpu() || local_timer_softirq_pending()) { + next_tick = basemono + TICK_NSEC; + } else { + /* +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 7d670362891a..e872f7f05e8a 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -849,11 +849,10 @@ static inline struct timer_base *get_timer_cpu_base(u32 tflags, u32 cpu) + struct timer_base *base = per_cpu_ptr(&timer_bases[BASE_STD], cpu); + + /* +- * If the timer is deferrable and nohz is active then we need to use +- * the deferrable base. ++ * If the timer is deferrable and NO_HZ_COMMON is set then we need ++ * to use the deferrable base. + */ +- if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active && +- (tflags & TIMER_DEFERRABLE)) ++ if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && (tflags & TIMER_DEFERRABLE)) + base = per_cpu_ptr(&timer_bases[BASE_DEF], cpu); + return base; + } +@@ -863,11 +862,10 @@ static inline struct timer_base *get_timer_this_cpu_base(u32 tflags) + struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]); + + /* +- * If the timer is deferrable and nohz is active then we need to use +- * the deferrable base. ++ * If the timer is deferrable and NO_HZ_COMMON is set then we need ++ * to use the deferrable base. + */ +- if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active && +- (tflags & TIMER_DEFERRABLE)) ++ if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && (tflags & TIMER_DEFERRABLE)) + base = this_cpu_ptr(&timer_bases[BASE_DEF]); + return base; + } +@@ -1021,8 +1019,6 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only) + if (!ret && pending_only) + goto out_unlock; + +- debug_activate(timer, expires); +- + new_base = get_target_base(base, timer->flags); + + if (base != new_base) { +@@ -1046,6 +1042,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only) + } + } + ++ debug_activate(timer, expires); ++ + timer->expires = expires; + /* + * If 'idx' was calculated above and the base time did not advance +@@ -1684,7 +1682,7 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h) + base->must_forward_clk = false; + + __run_timers(base); +- if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active) ++ if (IS_ENABLED(CONFIG_NO_HZ_COMMON)) + __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF])); + } + +@@ -1853,6 +1851,21 @@ static void migrate_timer_list(struct timer_base *new_base, struct hlist_head *h + } + } + ++int timers_prepare_cpu(unsigned int cpu) ++{ ++ struct timer_base *base; ++ int b; ++ ++ for (b = 0; b < NR_BASES; b++) { ++ base = per_cpu_ptr(&timer_bases[b], cpu); ++ base->clk = jiffies; ++ base->next_expiry = base->clk + NEXT_TIMER_MAX_DELTA; ++ base->is_idle = false; ++ base->must_forward_clk = true; ++ } ++ return 0; ++} ++ + int timers_dead_cpu(unsigned int cpu) + { + struct timer_base *old_base; +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index f5c016e8fc88..3e1d11f4fe44 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -280,6 +280,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data); + /* Missed count stored at end */ + #define RB_MISSED_STORED (1 << 30) + ++#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED) ++ + struct buffer_data_page { + u64 time_stamp; /* page time stamp */ + local_t commit; /* write committed index */ +@@ -331,7 +333,9 @@ static void rb_init_page(struct buffer_data_page *bpage) + */ + size_t ring_buffer_page_len(void *page) + { +- return local_read(&((struct buffer_data_page *)page)->commit) ++ struct buffer_data_page *bpage = page; ++ ++ return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS) + + BUF_PAGE_HDR_SIZE; + } + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 4214cd960b8e..15b02645ce8b 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6181,7 +6181,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + .spd_release = buffer_spd_release, + }; + struct buffer_ref *ref; +- int entries, size, i; ++ int entries, i; + ssize_t ret = 0; + + #ifdef CONFIG_TRACER_MAX_TRACE +@@ -6232,14 +6232,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + break; + } + +- /* +- * zero out any left over data, this is going to +- * user land. +- */ +- size = ring_buffer_page_len(ref->page); +- if (size < PAGE_SIZE) +- memset(ref->page + size, 0, PAGE_SIZE - size); +- + page = virt_to_page(ref->page); + + spd.pages[i] = page; +@@ -6963,6 +6955,7 @@ allocate_trace_buffer(struct trace_array *tr, struct trace_buffer *buf, int size + buf->data = alloc_percpu(struct trace_array_cpu); + if (!buf->data) { + ring_buffer_free(buf->buffer); ++ buf->buffer = NULL; + return -ENOMEM; + } + +@@ -6986,7 +6979,9 @@ static int allocate_trace_buffers(struct trace_array *tr, int size) + allocate_snapshot ? size : 1); + if (WARN_ON(ret)) { + ring_buffer_free(tr->trace_buffer.buffer); ++ tr->trace_buffer.buffer = NULL; + free_percpu(tr->trace_buffer.data); ++ tr->trace_buffer.data = NULL; + return -ENOMEM; + } + tr->allocated_snapshot = allocate_snapshot; +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 5d4006e589cb..4f831225d34f 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -1092,19 +1092,20 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev, + struct net_bridge *br = netdev_priv(dev); + int err; + ++ err = register_netdevice(dev); ++ if (err) ++ return err; ++ + if (tb[IFLA_ADDRESS]) { + spin_lock_bh(&br->lock); + br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS])); + spin_unlock_bh(&br->lock); + } + +- err = register_netdevice(dev); +- if (err) +- return err; +- + err = br_changelink(dev, tb, data); + if (err) +- unregister_netdevice(dev); ++ br_dev_delete(dev, NULL); ++ + return err; + } + +diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c +index 7001da910c6b..b7efe2f19f83 100644 +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -263,7 +263,7 @@ struct net *get_net_ns_by_id(struct net *net, int id) + spin_lock_irqsave(&net->nsid_lock, flags); + peer = idr_find(&net->netns_ids, id); + if (peer) +- get_net(peer); ++ peer = maybe_get_net(peer); + spin_unlock_irqrestore(&net->nsid_lock, flags); + rcu_read_unlock(); + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index aec5605944d3..a64515583bc1 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3823,7 +3823,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, + struct sock *sk = skb->sk; + + if (!skb_may_tx_timestamp(sk, false)) +- return; ++ goto err; + + /* Take a reference to prevent skb_orphan() from freeing the socket, + * but only if the socket refcount is not zero. +@@ -3832,7 +3832,11 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, + *skb_hwtstamps(skb) = *hwtstamps; + __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); + sock_put(sk); ++ return; + } ++ ++err: ++ kfree_skb(skb); + } + EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); + +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index 062a67ca9a21..f08f984ebc56 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1380,7 +1380,7 @@ static void inetdev_changename(struct net_device *dev, struct in_device *in_dev) + + static bool inetdev_valid_mtu(unsigned int mtu) + { +- return mtu >= 68; ++ return mtu >= IPV4_MIN_MTU; + } + + static void inetdev_send_gratuitous_arp(struct net_device *dev, +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 968d8e165e3d..ffae472e250a 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1253,14 +1253,19 @@ static int __net_init ip_fib_net_init(struct net *net) + + static void ip_fib_net_exit(struct net *net) + { +- unsigned int i; ++ int i; + + rtnl_lock(); + #ifdef CONFIG_IP_MULTIPLE_TABLES + RCU_INIT_POINTER(net->ipv4.fib_main, NULL); + RCU_INIT_POINTER(net->ipv4.fib_default, NULL); + #endif +- for (i = 0; i < FIB_TABLE_HASHSZ; i++) { ++ /* Destroy the tables in reverse order to guarantee that the ++ * local table, ID 255, is destroyed before the main table, ID ++ * 254. This is necessary as the local table may contain ++ * references to data contained in the main table. ++ */ ++ for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) { + struct hlist_head *head = &net->ipv4.fib_table_hash[i]; + struct hlist_node *tmp; + struct fib_table *tb; +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 08575e3bd135..7bff0c65046f 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -89,6 +89,7 @@ + #include <linux/rtnetlink.h> + #include <linux/times.h> + #include <linux/pkt_sched.h> ++#include <linux/byteorder/generic.h> + + #include <net/net_namespace.h> + #include <net/arp.h> +@@ -321,6 +322,23 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted) + return scount; + } + ++/* source address selection per RFC 3376 section 4.2.13 */ ++static __be32 igmpv3_get_srcaddr(struct net_device *dev, ++ const struct flowi4 *fl4) ++{ ++ struct in_device *in_dev = __in_dev_get_rcu(dev); ++ ++ if (!in_dev) ++ return htonl(INADDR_ANY); ++ ++ for_ifa(in_dev) { ++ if (inet_ifa_match(fl4->saddr, ifa)) ++ return fl4->saddr; ++ } endfor_ifa(in_dev); ++ ++ return htonl(INADDR_ANY); ++} ++ + static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) + { + struct sk_buff *skb; +@@ -368,7 +386,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) + pip->frag_off = htons(IP_DF); + pip->ttl = 1; + pip->daddr = fl4.daddr; +- pip->saddr = fl4.saddr; ++ pip->saddr = igmpv3_get_srcaddr(dev, &fl4); + pip->protocol = IPPROTO_IGMP; + pip->tot_len = 0; /* filled in later */ + ip_select_ident(net, skb, NULL); +@@ -404,16 +422,17 @@ static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel) + } + + static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc, +- int type, struct igmpv3_grec **ppgr) ++ int type, struct igmpv3_grec **ppgr, unsigned int mtu) + { + struct net_device *dev = pmc->interface->dev; + struct igmpv3_report *pih; + struct igmpv3_grec *pgr; + +- if (!skb) +- skb = igmpv3_newpack(dev, dev->mtu); +- if (!skb) +- return NULL; ++ if (!skb) { ++ skb = igmpv3_newpack(dev, mtu); ++ if (!skb) ++ return NULL; ++ } + pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec)); + pgr->grec_type = type; + pgr->grec_auxwords = 0; +@@ -436,12 +455,17 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, + struct igmpv3_grec *pgr = NULL; + struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list; + int scount, stotal, first, isquery, truncate; ++ unsigned int mtu; + + if (pmc->multiaddr == IGMP_ALL_HOSTS) + return skb; + if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) + return skb; + ++ mtu = READ_ONCE(dev->mtu); ++ if (mtu < IPV4_MIN_MTU) ++ return skb; ++ + isquery = type == IGMPV3_MODE_IS_INCLUDE || + type == IGMPV3_MODE_IS_EXCLUDE; + truncate = type == IGMPV3_MODE_IS_EXCLUDE || +@@ -462,7 +486,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, + AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) { + if (skb) + igmpv3_sendpack(skb); +- skb = igmpv3_newpack(dev, dev->mtu); ++ skb = igmpv3_newpack(dev, mtu); + } + } + first = 1; +@@ -498,12 +522,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, + pgr->grec_nsrcs = htons(scount); + if (skb) + igmpv3_sendpack(skb); +- skb = igmpv3_newpack(dev, dev->mtu); ++ skb = igmpv3_newpack(dev, mtu); + first = 1; + scount = 0; + } + if (first) { +- skb = add_grhead(skb, pmc, type, &pgr); ++ skb = add_grhead(skb, pmc, type, &pgr, mtu); + first = 0; + } + if (!skb) +@@ -538,7 +562,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, + igmpv3_sendpack(skb); + skb = NULL; /* add_grhead will get a new one */ + } +- skb = add_grhead(skb, pmc, type, &pgr); ++ skb = add_grhead(skb, pmc, type, &pgr, mtu); + } + } + if (pgr) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index bd7f1836bb70..96536a0d6e2d 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -346,8 +346,8 @@ static int ip_tunnel_bind_dev(struct net_device *dev) + dev->needed_headroom = t_hlen + hlen; + mtu -= (dev->hard_header_len + t_hlen); + +- if (mtu < 68) +- mtu = 68; ++ if (mtu < IPV4_MIN_MTU) ++ mtu = IPV4_MIN_MTU; + + return mtu; + } +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 9879b73d5565..59d8770055ed 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -502,11 +502,16 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + int err; + struct ip_options_data opt_copy; + struct raw_frag_vec rfv; ++ int hdrincl; + + err = -EMSGSIZE; + if (len > 0xFFFF) + goto out; + ++ /* hdrincl should be READ_ONCE(inet->hdrincl) ++ * but READ_ONCE() doesn't work with bit fields ++ */ ++ hdrincl = inet->hdrincl; + /* + * Check the flags. + */ +@@ -582,7 +587,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + /* Linux does not mangle headers on raw sockets, + * so that IP options + IP_HDRINCL is non-sense. + */ +- if (inet->hdrincl) ++ if (hdrincl) + goto done; + if (ipc.opt->opt.srr) { + if (!daddr) +@@ -604,12 +609,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos, + RT_SCOPE_UNIVERSE, +- inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol, ++ hdrincl ? IPPROTO_RAW : sk->sk_protocol, + inet_sk_flowi_flags(sk) | +- (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), ++ (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), + daddr, saddr, 0, 0); + +- if (!inet->hdrincl) { ++ if (!hdrincl) { + rfv.msg = msg; + rfv.hlen = 0; + +@@ -634,7 +639,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + goto do_confirm; + back_from_confirm: + +- if (inet->hdrincl) ++ if (hdrincl) + err = raw_send_hdrinc(sk, &fl4, msg, len, + &rt, msg->msg_flags, &ipc.sockc); + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index dd33c785ce16..05d2bde00864 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2297,6 +2297,7 @@ int tcp_disconnect(struct sock *sk, int flags) + tp->snd_cwnd_cnt = 0; + tp->window_clamp = 0; + tcp_set_ca_state(sk, TCP_CA_Open); ++ tp->is_sack_reneg = 0; + tcp_clear_retrans(tp); + inet_csk_delack_init(sk); + /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index cb8db347c680..97f9cac98348 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -81,7 +81,8 @@ struct bbr { + u32 lt_last_lost; /* LT intvl start: tp->lost */ + u32 pacing_gain:10, /* current gain for setting pacing rate */ + cwnd_gain:10, /* current gain for setting cwnd */ +- full_bw_cnt:3, /* number of rounds without large bw gains */ ++ full_bw_reached:1, /* reached full bw in Startup? */ ++ full_bw_cnt:2, /* number of rounds without large bw gains */ + cycle_idx:3, /* current index in pacing_gain cycle array */ + has_seen_rtt:1, /* have we seen an RTT sample yet? */ + unused_b:5; +@@ -151,7 +152,7 @@ static bool bbr_full_bw_reached(const struct sock *sk) + { + const struct bbr *bbr = inet_csk_ca(sk); + +- return bbr->full_bw_cnt >= bbr_full_bw_cnt; ++ return bbr->full_bw_reached; + } + + /* Return the windowed max recent bandwidth sample, in pkts/uS << BW_SCALE. */ +@@ -688,6 +689,7 @@ static void bbr_check_full_bw_reached(struct sock *sk, + return; + } + ++bbr->full_bw_cnt; ++ bbr->full_bw_reached = bbr->full_bw_cnt >= bbr_full_bw_cnt; + } + + /* If pipe is probably full, drain the queue and then enter steady-state. */ +@@ -821,6 +823,7 @@ static void bbr_init(struct sock *sk) + bbr->restore_cwnd = 0; + bbr->round_start = 0; + bbr->idle_restart = 0; ++ bbr->full_bw_reached = 0; + bbr->full_bw = 0; + bbr->full_bw_cnt = 0; + bbr->cycle_mstamp.v64 = 0; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 05255a286888..2f107e46355c 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1966,6 +1966,8 @@ void tcp_enter_loss(struct sock *sk) + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSACKRENEGING); + tp->sacked_out = 0; + tp->fackets_out = 0; ++ /* Mark SACK reneging until we recover from this loss event. */ ++ tp->is_sack_reneg = 1; + } + tcp_clear_all_retrans_hints(tp); + +@@ -2463,6 +2465,7 @@ static bool tcp_try_undo_recovery(struct sock *sk) + return true; + } + tcp_set_ca_state(sk, TCP_CA_Open); ++ tp->is_sack_reneg = 0; + return false; + } + +@@ -2494,8 +2497,10 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo) + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPSPURIOUSRTOS); + inet_csk(sk)->icsk_retransmits = 0; +- if (frto_undo || tcp_is_sack(tp)) ++ if (frto_undo || tcp_is_sack(tp)) { + tcp_set_ca_state(sk, TCP_CA_Open); ++ tp->is_sack_reneg = 0; ++ } + return true; + } + return false; +@@ -3589,6 +3594,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + struct tcp_sacktag_state sack_state; + struct rate_sample rs = { .prior_delivered = 0 }; + u32 prior_snd_una = tp->snd_una; ++ bool is_sack_reneg = tp->is_sack_reneg; + u32 ack_seq = TCP_SKB_CB(skb)->seq; + u32 ack = TCP_SKB_CB(skb)->ack_seq; + bool is_dupack = false; +@@ -3711,7 +3717,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + tcp_schedule_loss_probe(sk); + delivered = tp->delivered - delivered; /* freshly ACKed or SACKed */ + lost = tp->lost - lost; /* freshly marked lost */ +- tcp_rate_gen(sk, delivered, lost, &now, &rs); ++ tcp_rate_gen(sk, delivered, lost, is_sack_reneg, &now, &rs); + tcp_cong_control(sk, ack, delivered, flag, &rs); + tcp_xmit_recovery(sk, rexmit); + return 1; +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index d577ec07a0d8..b3960738464e 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -828,7 +828,7 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + tcp_time_stamp, + req->ts_recent, + 0, +- tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr, ++ tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->saddr, + AF_INET), + inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0, + ip_hdr(skb)->tos); +diff --git a/net/ipv4/tcp_rate.c b/net/ipv4/tcp_rate.c +index 9be1581a5a08..18309f58ab8d 100644 +--- a/net/ipv4/tcp_rate.c ++++ b/net/ipv4/tcp_rate.c +@@ -106,7 +106,7 @@ void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, + + /* Update the connection delivery information and generate a rate sample. */ + void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, +- struct skb_mstamp *now, struct rate_sample *rs) ++ bool is_sack_reneg, struct skb_mstamp *now, struct rate_sample *rs) + { + struct tcp_sock *tp = tcp_sk(sk); + u32 snd_us, ack_us; +@@ -124,8 +124,12 @@ void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, + + rs->acked_sacked = delivered; /* freshly ACKed or SACKed */ + rs->losses = lost; /* freshly marked lost */ +- /* Return an invalid sample if no timing information is available. */ +- if (!rs->prior_mstamp.v64) { ++ /* Return an invalid sample if no timing information is available or ++ * in recovery from loss with SACK reneging. Rate samples taken during ++ * a SACK reneging event may overestimate bw by including packets that ++ * were SACKed before the reneg. ++ */ ++ if (!rs->prior_mstamp.v64 || is_sack_reneg) { + rs->delivered = -1; + rs->interval_us = -1; + return; +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 8285a1c108c9..5cad76f87536 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -209,7 +209,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + np->mcast_hops = IPV6_DEFAULT_MCASTHOPS; + np->mc_loop = 1; + np->pmtudisc = IPV6_PMTUDISC_WANT; +- np->autoflowlabel = ip6_default_np_autolabel(sock_net(sk)); + sk->sk_ipv6only = net->ipv6.sysctl.bindv6only; + + /* Init the ipv4 part of the socket since we can have sockets +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 6e01c9a8dfd3..506efba33a89 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -156,6 +156,14 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + !(IP6CB(skb)->flags & IP6SKB_REROUTED)); + } + ++static bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) ++{ ++ if (!np->autoflowlabel_set) ++ return ip6_default_np_autolabel(net); ++ else ++ return np->autoflowlabel; ++} ++ + /* + * xmit an sk_buff (used by TCP, SCTP and DCCP) + * Note : socket lock is not held for SYNACK packets, but might be modified +@@ -219,7 +227,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + hlimit = ip6_dst_hoplimit(dst); + + ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, +- np->autoflowlabel, fl6)); ++ ip6_autoflowlabel(net, np), fl6)); + + hdr->payload_len = htons(seg_len); + hdr->nexthdr = proto; +@@ -1691,7 +1699,7 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, + + ip6_flow_hdr(hdr, v6_cork->tclass, + ip6_make_flowlabel(net, skb, fl6->flowlabel, +- np->autoflowlabel, fl6)); ++ ip6_autoflowlabel(net, np), fl6)); + hdr->hop_limit = v6_cork->hop_limit; + hdr->nexthdr = proto; + hdr->saddr = fl6->saddr; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 12b2fd512f32..11d22d642488 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -911,7 +911,7 @@ static int ipxip6_rcv(struct sk_buff *skb, u8 ipproto, + if (t->parms.collect_md) { + tun_dst = ipv6_tun_rx_dst(skb, 0, 0, 0); + if (!tun_dst) +- return 0; ++ goto drop; + } + ret = __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate, + log_ecn_error); +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 38bee173dc2b..6e3871c7f8f7 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -874,6 +874,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + break; + case IPV6_AUTOFLOWLABEL: + np->autoflowlabel = valbool; ++ np->autoflowlabel_set = 1; + retv = 0; + break; + } +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 1bdc703cb966..ca8fac6e5a09 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -1682,16 +1682,16 @@ static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel) + } + + static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc, +- int type, struct mld2_grec **ppgr) ++ int type, struct mld2_grec **ppgr, unsigned int mtu) + { +- struct net_device *dev = pmc->idev->dev; + struct mld2_report *pmr; + struct mld2_grec *pgr; + +- if (!skb) +- skb = mld_newpack(pmc->idev, dev->mtu); +- if (!skb) +- return NULL; ++ if (!skb) { ++ skb = mld_newpack(pmc->idev, mtu); ++ if (!skb) ++ return NULL; ++ } + pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec)); + pgr->grec_type = type; + pgr->grec_auxwords = 0; +@@ -1714,10 +1714,15 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, + struct mld2_grec *pgr = NULL; + struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list; + int scount, stotal, first, isquery, truncate; ++ unsigned int mtu; + + if (pmc->mca_flags & MAF_NOREPORT) + return skb; + ++ mtu = READ_ONCE(dev->mtu); ++ if (mtu < IPV6_MIN_MTU) ++ return skb; ++ + isquery = type == MLD2_MODE_IS_INCLUDE || + type == MLD2_MODE_IS_EXCLUDE; + truncate = type == MLD2_MODE_IS_EXCLUDE || +@@ -1738,7 +1743,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, + AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) { + if (skb) + mld_sendpack(skb); +- skb = mld_newpack(idev, dev->mtu); ++ skb = mld_newpack(idev, mtu); + } + } + first = 1; +@@ -1774,12 +1779,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, + pgr->grec_nsrcs = htons(scount); + if (skb) + mld_sendpack(skb); +- skb = mld_newpack(idev, dev->mtu); ++ skb = mld_newpack(idev, mtu); + first = 1; + scount = 0; + } + if (first) { +- skb = add_grhead(skb, pmc, type, &pgr); ++ skb = add_grhead(skb, pmc, type, &pgr, mtu); + first = 0; + } + if (!skb) +@@ -1814,7 +1819,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, + mld_sendpack(skb); + skb = NULL; /* add_grhead will get a new one */ + } +- skb = add_grhead(skb, pmc, type, &pgr); ++ skb = add_grhead(skb, pmc, type, &pgr, mtu); + } + } + if (pgr) +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 7ac2365aa6fb..eb624547382f 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -962,7 +962,7 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + tcp_rsk(req)->rcv_nxt, + req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, + tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if, +- tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), ++ tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr), + 0, 0); + } + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 1ff497bd9c20..e1c123d4cdda 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -261,6 +261,9 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb, + struct sock *sk = skb->sk; + int ret = -ENOMEM; + ++ if (!net_eq(dev_net(dev), sock_net(sk))) ++ return 0; ++ + dev_hold(dev); + + if (is_vmalloc_addr(skb->head)) +diff --git a/net/rds/send.c b/net/rds/send.c +index ad247dc71ebb..ef53d164e146 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1006,6 +1006,9 @@ static int rds_rdma_bytes(struct msghdr *msg, size_t *rdma_bytes) + continue; + + if (cmsg->cmsg_type == RDS_CMSG_RDMA_ARGS) { ++ if (cmsg->cmsg_len < ++ CMSG_LEN(sizeof(struct rds_rdma_args))) ++ return -EINVAL; + args = CMSG_DATA(cmsg); + *rdma_bytes += args->remote_vec.bytes; + } +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index c2ab864da50d..7181ce6c62bf 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4246,7 +4246,7 @@ static int sctp_init_sock(struct sock *sk) + SCTP_DBG_OBJCNT_INC(sock); + + local_bh_disable(); +- percpu_counter_inc(&sctp_sockets_allocated); ++ sk_sockets_allocated_inc(sk); + sock_prot_inuse_add(net, sk->sk_prot, 1); + + /* Nothing can fail after this block, otherwise +@@ -4290,7 +4290,7 @@ static void sctp_destroy_sock(struct sock *sk) + } + sctp_endpoint_free(sp->ep); + local_bh_disable(); +- percpu_counter_dec(&sctp_sockets_allocated); ++ sk_sockets_allocated_dec(sk); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); + local_bh_enable(); + } +diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c +index c9af022676c2..47c3e97c3136 100644 +--- a/sound/hda/hdac_i915.c ++++ b/sound/hda/hdac_i915.c +@@ -319,7 +319,7 @@ static int hdac_component_master_match(struct device *dev, void *data) + */ + int snd_hdac_i915_register_notifier(const struct i915_audio_component_audio_ops *aops) + { +- if (WARN_ON(!hdac_acomp)) ++ if (!hdac_acomp) + return -ENODEV; + + hdac_acomp->audio_ops = aops; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ba40596b9d92..4ef3b0067876 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5971,6 +5971,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x1b, 0x01011020}, + {0x21, 0x02211010}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x1b, 0x01011020}, ++ {0x21, 0x0221101f}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60160}, + {0x14, 0x90170120}, +diff --git a/sound/soc/codecs/da7218.c b/sound/soc/codecs/da7218.c +index c69e97654fc6..f88632426c0a 100644 +--- a/sound/soc/codecs/da7218.c ++++ b/sound/soc/codecs/da7218.c +@@ -2519,7 +2519,7 @@ static struct da7218_pdata *da7218_of_to_pdata(struct snd_soc_codec *codec) + } + + if (da7218->dev_id == DA7218_DEV_ID) { +- hpldet_np = of_find_node_by_name(np, "da7218_hpldet"); ++ hpldet_np = of_get_child_by_name(np, "da7218_hpldet"); + if (!hpldet_np) + return pdata; + +diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h +index 5acd5b69fb83..f9b6c5a81b47 100644 +--- a/sound/soc/codecs/tlv320aic31xx.h ++++ b/sound/soc/codecs/tlv320aic31xx.h +@@ -115,7 +115,7 @@ struct aic31xx_pdata { + /* INT2 interrupt control */ + #define AIC31XX_INT2CTRL AIC31XX_REG(0, 49) + /* GPIO1 control */ +-#define AIC31XX_GPIO1 AIC31XX_REG(0, 50) ++#define AIC31XX_GPIO1 AIC31XX_REG(0, 51) + + #define AIC31XX_DACPRB AIC31XX_REG(0, 60) + /* ADC Instruction Set Register */ +diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c +index a2104d68169d..26fd6a664b9b 100644 +--- a/sound/soc/codecs/twl4030.c ++++ b/sound/soc/codecs/twl4030.c +@@ -232,7 +232,7 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec) + struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev); + struct device_node *twl4030_codec_node = NULL; + +- twl4030_codec_node = of_find_node_by_name(codec->dev->parent->of_node, ++ twl4030_codec_node = of_get_child_by_name(codec->dev->parent->of_node, + "codec"); + + if (!pdata && twl4030_codec_node) { +@@ -241,9 +241,11 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec) + GFP_KERNEL); + if (!pdata) { + dev_err(codec->dev, "Can not allocate memory\n"); ++ of_node_put(twl4030_codec_node); + return NULL; + } + twl4030_setup_pdata_of(pdata, twl4030_codec_node); ++ of_node_put(twl4030_codec_node); + } + + return pdata; +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 757af795cebd..c03c9da076c2 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1465,7 +1465,7 @@ static int wm_adsp_load(struct wm_adsp *dsp) + le64_to_cpu(footer->timestamp)); + + while (pos < firmware->size && +- pos - firmware->size > sizeof(*region)) { ++ sizeof(*region) < firmware->size - pos) { + region = (void *)&(firmware->data[pos]); + region_name = "Unknown"; + reg = 0; +@@ -1526,8 +1526,8 @@ static int wm_adsp_load(struct wm_adsp *dsp) + regions, le32_to_cpu(region->len), offset, + region_name); + +- if ((pos + le32_to_cpu(region->len) + sizeof(*region)) > +- firmware->size) { ++ if (le32_to_cpu(region->len) > ++ firmware->size - pos - sizeof(*region)) { + adsp_err(dsp, + "%s.%d: %s region len %d bytes exceeds file length %zu\n", + file, regions, region_name, +@@ -1992,7 +1992,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp) + + blocks = 0; + while (pos < firmware->size && +- pos - firmware->size > sizeof(*blk)) { ++ sizeof(*blk) < firmware->size - pos) { + blk = (void *)(&firmware->data[pos]); + + type = le16_to_cpu(blk->type); +@@ -2066,8 +2066,8 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp) + } + + if (reg) { +- if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) > +- firmware->size) { ++ if (le32_to_cpu(blk->len) > ++ firmware->size - pos - sizeof(*blk)) { + adsp_err(dsp, + "%s.%d: %s region len %d bytes exceeds file length %zu\n", + file, blocks, region_name, +diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c +index fde08660b63b..1c03490e1182 100644 +--- a/sound/soc/fsl/fsl_ssi.c ++++ b/sound/soc/fsl/fsl_ssi.c +@@ -1467,12 +1467,6 @@ static int fsl_ssi_probe(struct platform_device *pdev) + sizeof(fsl_ssi_ac97_dai)); + + fsl_ac97_data = ssi_private; +- +- ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev); +- if (ret) { +- dev_err(&pdev->dev, "could not set AC'97 ops\n"); +- return ret; +- } + } else { + /* Initialize this copy of the CPU DAI driver structure */ + memcpy(&ssi_private->cpu_dai_drv, &fsl_ssi_dai_template, +@@ -1583,6 +1577,14 @@ static int fsl_ssi_probe(struct platform_device *pdev) + return ret; + } + ++ if (fsl_ssi_is_ac97(ssi_private)) { ++ ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev); ++ if (ret) { ++ dev_err(&pdev->dev, "could not set AC'97 ops\n"); ++ goto error_ac97_ops; ++ } ++ } ++ + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_ssi_component, + &ssi_private->cpu_dai_drv, 1); + if (ret) { +@@ -1666,6 +1668,10 @@ static int fsl_ssi_probe(struct platform_device *pdev) + fsl_ssi_debugfs_remove(&ssi_private->dbg_stats); + + error_asoc_register: ++ if (fsl_ssi_is_ac97(ssi_private)) ++ snd_soc_set_ac97_ops(NULL); ++ ++error_ac97_ops: + if (ssi_private->soc->imx) + fsl_ssi_imx_clean(pdev, ssi_private); + +diff --git a/tools/objtool/arch/x86/insn/x86-opcode-map.txt b/tools/objtool/arch/x86/insn/x86-opcode-map.txt +index 767be7c76034..1754e094bc28 100644 +--- a/tools/objtool/arch/x86/insn/x86-opcode-map.txt ++++ b/tools/objtool/arch/x86/insn/x86-opcode-map.txt +@@ -896,7 +896,7 @@ EndTable + + GrpTable: Grp3_1 + 0: TEST Eb,Ib +-1: ++1: TEST Eb,Ib + 2: NOT Eb + 3: NEG Eb + 4: MUL AL,Eb +diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c +index 2b3d6d235015..3d7b42e77299 100644 +--- a/tools/usb/usbip/src/utils.c ++++ b/tools/usb/usbip/src/utils.c +@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add) + char command[SYSFS_BUS_ID_SIZE + 4]; + char match_busid_attr_path[SYSFS_PATH_MAX]; + int rc; ++ int cmd_size; + + snprintf(match_busid_attr_path, sizeof(match_busid_attr_path), + "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME, +@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add) + attr_name); + + if (add) +- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid); ++ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", ++ busid); + else +- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid); ++ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", ++ busid); + + rc = write_sysfs_attribute(match_busid_attr_path, command, +- sizeof(command)); ++ cmd_size); + if (rc < 0) { + dbg("failed to write match_busid: %s", strerror(errno)); + return -1;
