commit: 4465d65275166037e241c0f92c3d23d28c03bbe5 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Jul 28 10:41:00 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Jul 28 10:41:00 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4465d652
Linux patch 4.17.11 0000_README | 4 + 1010_linux-4.17.11.patch | 3321 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3325 insertions(+) diff --git a/0000_README b/0000_README index f2abee1..a0836f2 100644 --- a/0000_README +++ b/0000_README @@ -83,6 +83,10 @@ Patch: 1009_linux-4.17.10.patch From: http://www.kernel.org Desc: Linux 4.17.10 +Patch: 1010_linux-4.17.11.patch +From: http://www.kernel.org +Desc: Linux 4.17.11 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1010_linux-4.17.11.patch b/1010_linux-4.17.11.patch new file mode 100644 index 0000000..a9e2e1a --- /dev/null +++ b/1010_linux-4.17.11.patch @@ -0,0 +1,3321 @@ +diff --git a/Makefile b/Makefile +index 0ab689c38e82..e2664c641109 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 17 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = Merciless Moray + +diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c +index 10a405d593df..c782b10ddf50 100644 +--- a/arch/mips/ath79/common.c ++++ b/arch/mips/ath79/common.c +@@ -58,7 +58,7 @@ EXPORT_SYMBOL_GPL(ath79_ddr_ctrl_init); + + void ath79_ddr_wb_flush(u32 reg) + { +- void __iomem *flush_reg = ath79_ddr_wb_flush_base + reg; ++ void __iomem *flush_reg = ath79_ddr_wb_flush_base + (reg * 4); + + /* Flush the DDR write buffer. */ + __raw_writel(0x1, flush_reg); +diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c +index 9632436d74d7..c2e94cf5ecda 100644 +--- a/arch/mips/pci/pci.c ++++ b/arch/mips/pci/pci.c +@@ -54,5 +54,5 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar, + phys_addr_t size = resource_size(rsrc); + + *start = fixup_bigphys_addr(rsrc->start, size); +- *end = rsrc->start + size; ++ *end = rsrc->start + size - 1; + } +diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h +index 1835ca1505d6..7472ffa76fd0 100644 +--- a/arch/powerpc/include/asm/mmu_context.h ++++ b/arch/powerpc/include/asm/mmu_context.h +@@ -35,9 +35,9 @@ extern struct mm_iommu_table_group_mem_t *mm_iommu_lookup_rm( + extern struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm, + unsigned long ua, unsigned long entries); + extern long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa); ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa); + extern long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa); ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa); + extern long mm_iommu_mapped_inc(struct mm_iommu_table_group_mem_t *mem); + extern void mm_iommu_mapped_dec(struct mm_iommu_table_group_mem_t *mem); + #endif +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 4dffa611376d..e14cec6bc339 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -433,7 +433,7 @@ long kvmppc_tce_iommu_map(struct kvm *kvm, struct iommu_table *tbl, + /* This only handles v2 IOMMU type, v1 is handled via ioctl() */ + return H_TOO_HARD; + +- if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, &hpa))) ++ if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, tbl->it_page_shift, &hpa))) + return H_HARDWARE; + + if (mm_iommu_mapped_inc(mem)) +diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c +index 6651f736a0b1..eeb9e6651cc4 100644 +--- a/arch/powerpc/kvm/book3s_64_vio_hv.c ++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c +@@ -262,7 +262,8 @@ static long kvmppc_rm_tce_iommu_map(struct kvm *kvm, struct iommu_table *tbl, + if (!mem) + return H_TOO_HARD; + +- if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, &hpa))) ++ if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, tbl->it_page_shift, ++ &hpa))) + return H_HARDWARE; + + pua = (void *) vmalloc_to_phys(pua); +@@ -431,7 +432,8 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu, + + mem = mm_iommu_lookup_rm(vcpu->kvm->mm, ua, IOMMU_PAGE_SIZE_4K); + if (mem) +- prereg = mm_iommu_ua_to_hpa_rm(mem, ua, &tces) == 0; ++ prereg = mm_iommu_ua_to_hpa_rm(mem, ua, ++ IOMMU_PAGE_SHIFT_4K, &tces) == 0; + } + + if (!prereg) { +diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c +index 4c615fcb0cf0..4205ce92ee86 100644 +--- a/arch/powerpc/mm/mmu_context_iommu.c ++++ b/arch/powerpc/mm/mmu_context_iommu.c +@@ -19,6 +19,7 @@ + #include <linux/hugetlb.h> + #include <linux/swap.h> + #include <asm/mmu_context.h> ++#include <asm/pte-walk.h> + + static DEFINE_MUTEX(mem_list_mutex); + +@@ -27,6 +28,7 @@ struct mm_iommu_table_group_mem_t { + struct rcu_head rcu; + unsigned long used; + atomic64_t mapped; ++ unsigned int pageshift; + u64 ua; /* userspace address */ + u64 entries; /* number of entries in hpas[] */ + u64 *hpas; /* vmalloc'ed */ +@@ -125,6 +127,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + { + struct mm_iommu_table_group_mem_t *mem; + long i, j, ret = 0, locked_entries = 0; ++ unsigned int pageshift; ++ unsigned long flags; + struct page *page = NULL; + + mutex_lock(&mem_list_mutex); +@@ -159,6 +163,12 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + goto unlock_exit; + } + ++ /* ++ * For a starting point for a maximum page size calculation ++ * we use @ua and @entries natural alignment to allow IOMMU pages ++ * smaller than huge pages but still bigger than PAGE_SIZE. ++ */ ++ mem->pageshift = __ffs(ua | (entries << PAGE_SHIFT)); + mem->hpas = vzalloc(entries * sizeof(mem->hpas[0])); + if (!mem->hpas) { + kfree(mem); +@@ -199,6 +209,23 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + } + } + populate: ++ pageshift = PAGE_SHIFT; ++ if (PageCompound(page)) { ++ pte_t *pte; ++ struct page *head = compound_head(page); ++ unsigned int compshift = compound_order(head); ++ ++ local_irq_save(flags); /* disables as well */ ++ pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift); ++ local_irq_restore(flags); ++ ++ /* Double check it is still the same pinned page */ ++ if (pte && pte_page(*pte) == head && ++ pageshift == compshift) ++ pageshift = max_t(unsigned int, pageshift, ++ PAGE_SHIFT); ++ } ++ mem->pageshift = min(mem->pageshift, pageshift); + mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT; + } + +@@ -349,7 +376,7 @@ struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm, + EXPORT_SYMBOL_GPL(mm_iommu_find); + + long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa) ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa) + { + const long entry = (ua - mem->ua) >> PAGE_SHIFT; + u64 *va = &mem->hpas[entry]; +@@ -357,6 +384,9 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, + if (entry >= mem->entries) + return -EFAULT; + ++ if (pageshift > mem->pageshift) ++ return -EFAULT; ++ + *hpa = *va | (ua & ~PAGE_MASK); + + return 0; +@@ -364,7 +394,7 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, + EXPORT_SYMBOL_GPL(mm_iommu_ua_to_hpa); + + long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa) ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa) + { + const long entry = (ua - mem->ua) >> PAGE_SHIFT; + void *va = &mem->hpas[entry]; +@@ -373,6 +403,9 @@ long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, + if (entry >= mem->entries) + return -EFAULT; + ++ if (pageshift > mem->pageshift) ++ return -EFAULT; ++ + pa = (void *) vmalloc_to_phys(va); + if (!pa) + return -EFAULT; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index fbc4d17e3ecc..ac01341f2d1f 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1092,6 +1092,7 @@ static u32 msr_based_features[] = { + + MSR_F10H_DECFG, + MSR_IA32_UCODE_REV, ++ MSR_IA32_ARCH_CAPABILITIES, + }; + + static unsigned int num_msr_based_features; +@@ -1100,7 +1101,8 @@ static int kvm_get_msr_feature(struct kvm_msr_entry *msr) + { + switch (msr->index) { + case MSR_IA32_UCODE_REV: +- rdmsrl(msr->index, msr->data); ++ case MSR_IA32_ARCH_CAPABILITIES: ++ rdmsrl_safe(msr->index, &msr->data); + break; + default: + if (kvm_x86_ops->get_msr_feature(msr)) +diff --git a/arch/x86/xen/xen-pvh.S b/arch/x86/xen/xen-pvh.S +index e1a5fbeae08d..5d7554c025fd 100644 +--- a/arch/x86/xen/xen-pvh.S ++++ b/arch/x86/xen/xen-pvh.S +@@ -54,6 +54,9 @@ + * charge of setting up it's own stack, GDT and IDT. + */ + ++#define PVH_GDT_ENTRY_CANARY 4 ++#define PVH_CANARY_SEL (PVH_GDT_ENTRY_CANARY * 8) ++ + ENTRY(pvh_start_xen) + cld + +@@ -98,6 +101,12 @@ ENTRY(pvh_start_xen) + /* 64-bit entry point. */ + .code64 + 1: ++ /* Set base address in stack canary descriptor. */ ++ mov $MSR_GS_BASE,%ecx ++ mov $_pa(canary), %eax ++ xor %edx, %edx ++ wrmsr ++ + call xen_prepare_pvh + + /* startup_64 expects boot_params in %rsi. */ +@@ -107,6 +116,17 @@ ENTRY(pvh_start_xen) + + #else /* CONFIG_X86_64 */ + ++ /* Set base address in stack canary descriptor. */ ++ movl $_pa(gdt_start),%eax ++ movl $_pa(canary),%ecx ++ movw %cx, (PVH_GDT_ENTRY_CANARY * 8) + 2(%eax) ++ shrl $16, %ecx ++ movb %cl, (PVH_GDT_ENTRY_CANARY * 8) + 4(%eax) ++ movb %ch, (PVH_GDT_ENTRY_CANARY * 8) + 7(%eax) ++ ++ mov $PVH_CANARY_SEL,%eax ++ mov %eax,%gs ++ + call mk_early_pgtbl_32 + + mov $_pa(initial_page_table), %eax +@@ -150,9 +170,13 @@ gdt_start: + .quad GDT_ENTRY(0xc09a, 0, 0xfffff) /* __KERNEL_CS */ + #endif + .quad GDT_ENTRY(0xc092, 0, 0xfffff) /* __KERNEL_DS */ ++ .quad GDT_ENTRY(0x4090, 0, 0x18) /* PVH_CANARY_SEL */ + gdt_end: + +- .balign 4 ++ .balign 16 ++canary: ++ .fill 48, 1, 0 ++ + early_stack: + .fill 256, 1, 0 + early_stack_end: +diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c +index bc5f05906bd1..ee840be150b5 100644 +--- a/drivers/acpi/acpica/psloop.c ++++ b/drivers/acpi/acpica/psloop.c +@@ -497,6 +497,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) + status = + acpi_ps_create_op(walk_state, aml_op_start, &op); + if (ACPI_FAILURE(status)) { ++ /* ++ * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by ++ * executing it as a control method. However, if we encounter ++ * an error while loading the table, we need to keep trying to ++ * load the table rather than aborting the table load. Set the ++ * status to AE_OK to proceed with the table load. ++ */ ++ if ((walk_state-> ++ parse_flags & ACPI_PARSE_MODULE_LEVEL) ++ && status == AE_ALREADY_EXISTS) { ++ status = AE_OK; ++ } + if (status == AE_CTRL_PARSE_CONTINUE) { + continue; + } +@@ -694,6 +706,20 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) + acpi_ps_next_parse_state(walk_state, op, status); + if (status == AE_CTRL_PENDING) { + status = AE_OK; ++ } else ++ if ((walk_state-> ++ parse_flags & ACPI_PARSE_MODULE_LEVEL) ++ && ACPI_FAILURE(status)) { ++ /* ++ * ACPI_PARSE_MODULE_LEVEL means that we are loading a table by ++ * executing it as a control method. However, if we encounter ++ * an error while loading the table, we need to keep trying to ++ * load the table rather than aborting the table load. Set the ++ * status to AE_OK to proceed with the table load. If we get a ++ * failure at this point, it means that the dispatcher got an ++ * error while processing Op (most likely an AML operand error. ++ */ ++ status = AE_OK; + } + } + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index c9f54089429b..2cee8d0f3045 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -436,14 +436,6 @@ re_probe: + goto probe_failed; + } + +- /* +- * Ensure devices are listed in devices_kset in correct order +- * It's important to move Dev to the end of devices_kset before +- * calling .probe, because it could be recursive and parent Dev +- * should always go first +- */ +- devices_kset_move_last(dev); +- + if (dev->bus->probe) { + ret = dev->bus->probe(dev); + if (ret) +diff --git a/drivers/clk/clk-aspeed.c b/drivers/clk/clk-aspeed.c +index 2c23e7d7ba28..43e0c33ee648 100644 +--- a/drivers/clk/clk-aspeed.c ++++ b/drivers/clk/clk-aspeed.c +@@ -22,7 +22,7 @@ + #define ASPEED_MPLL_PARAM 0x20 + #define ASPEED_HPLL_PARAM 0x24 + #define AST2500_HPLL_BYPASS_EN BIT(20) +-#define AST2400_HPLL_STRAPPED BIT(18) ++#define AST2400_HPLL_PROGRAMMED BIT(18) + #define AST2400_HPLL_BYPASS_EN BIT(17) + #define ASPEED_MISC_CTRL 0x2c + #define UART_DIV13_EN BIT(12) +@@ -88,8 +88,8 @@ static const struct aspeed_gate_data aspeed_gates[] = { + [ASPEED_CLK_GATE_GCLK] = { 1, 7, "gclk-gate", NULL, 0 }, /* 2D engine */ + [ASPEED_CLK_GATE_MCLK] = { 2, -1, "mclk-gate", "mpll", CLK_IS_CRITICAL }, /* SDRAM */ + [ASPEED_CLK_GATE_VCLK] = { 3, 6, "vclk-gate", NULL, 0 }, /* Video Capture */ +- [ASPEED_CLK_GATE_BCLK] = { 4, 8, "bclk-gate", "bclk", 0 }, /* PCIe/PCI */ +- [ASPEED_CLK_GATE_DCLK] = { 5, -1, "dclk-gate", NULL, 0 }, /* DAC */ ++ [ASPEED_CLK_GATE_BCLK] = { 4, 8, "bclk-gate", "bclk", CLK_IS_CRITICAL }, /* PCIe/PCI */ ++ [ASPEED_CLK_GATE_DCLK] = { 5, -1, "dclk-gate", NULL, CLK_IS_CRITICAL }, /* DAC */ + [ASPEED_CLK_GATE_REFCLK] = { 6, -1, "refclk-gate", "clkin", CLK_IS_CRITICAL }, + [ASPEED_CLK_GATE_USBPORT2CLK] = { 7, 3, "usb-port2-gate", NULL, 0 }, /* USB2.0 Host port 2 */ + [ASPEED_CLK_GATE_LCLK] = { 8, 5, "lclk-gate", NULL, 0 }, /* LPC */ +@@ -530,29 +530,45 @@ builtin_platform_driver(aspeed_clk_driver); + static void __init aspeed_ast2400_cc(struct regmap *map) + { + struct clk_hw *hw; +- u32 val, freq, div; ++ u32 val, div, clkin, hpll; ++ const u16 hpll_rates[][4] = { ++ {384, 360, 336, 408}, ++ {400, 375, 350, 425}, ++ }; ++ int rate; + + /* + * CLKIN is the crystal oscillator, 24, 48 or 25MHz selected by + * strapping + */ + regmap_read(map, ASPEED_STRAP, &val); +- if (val & CLKIN_25MHZ_EN) +- freq = 25000000; +- else if (val & AST2400_CLK_SOURCE_SEL) +- freq = 48000000; +- else +- freq = 24000000; +- hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, freq); +- pr_debug("clkin @%u MHz\n", freq / 1000000); ++ rate = (val >> 8) & 3; ++ if (val & CLKIN_25MHZ_EN) { ++ clkin = 25000000; ++ hpll = hpll_rates[1][rate]; ++ } else if (val & AST2400_CLK_SOURCE_SEL) { ++ clkin = 48000000; ++ hpll = hpll_rates[0][rate]; ++ } else { ++ clkin = 24000000; ++ hpll = hpll_rates[0][rate]; ++ } ++ hw = clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, clkin); ++ pr_debug("clkin @%u MHz\n", clkin / 1000000); + + /* + * High-speed PLL clock derived from the crystal. This the CPU clock, +- * and we assume that it is enabled ++ * and we assume that it is enabled. It can be configured through the ++ * HPLL_PARAM register, or set to a specified frequency by strapping. + */ + regmap_read(map, ASPEED_HPLL_PARAM, &val); +- WARN(val & AST2400_HPLL_STRAPPED, "hpll is strapped not configured"); +- aspeed_clk_data->hws[ASPEED_CLK_HPLL] = aspeed_ast2400_calc_pll("hpll", val); ++ if (val & AST2400_HPLL_PROGRAMMED) ++ hw = aspeed_ast2400_calc_pll("hpll", val); ++ else ++ hw = clk_hw_register_fixed_rate(NULL, "hpll", "clkin", 0, ++ hpll * 1000000); ++ ++ aspeed_clk_data->hws[ASPEED_CLK_HPLL] = hw; + + /* + * Strap bits 11:10 define the CPU/AHB clock frequency ratio (aka HCLK) +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index b1e4d9557610..0e053c17d8ba 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -511,6 +511,7 @@ static struct clk_regmap gxbb_fclk_div2 = { + .ops = &clk_regmap_gate_ops, + .parent_names = (const char *[]){ "fclk_div2_div" }, + .num_parents = 1, ++ .flags = CLK_IS_CRITICAL, + }, + }; + +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index 87213ea7fc84..706dc80ad644 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -35,6 +35,7 @@ + #define CLK_SEL 0x10 + #define CLK_DIS 0x14 + ++#define ARMADA_37XX_DVFS_LOAD_1 1 + #define LOAD_LEVEL_NR 4 + + #define ARMADA_37XX_NB_L0L1 0x18 +@@ -507,6 +508,40 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate, + return -EINVAL; + } + ++/* ++ * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz ++ * respectively) to L0 frequency (1.2 Ghz) requires a significant ++ * amount of time to let VDD stabilize to the appropriate ++ * voltage. This amount of time is large enough that it cannot be ++ * covered by the hardware countdown register. Due to this, the CPU ++ * might start operating at L0 before the voltage is stabilized, ++ * leading to CPU stalls. ++ * ++ * To work around this problem, we prevent switching directly from the ++ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1 ++ * frequency in-between. The sequence therefore becomes: ++ * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ) ++ * 2. Sleep 20ms for stabling VDD voltage ++ * 3. Then switch from L1(600MHZ) to L0(1200Mhz). ++ */ ++static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base) ++{ ++ unsigned int cur_level; ++ ++ if (rate != 1200 * 1000 * 1000) ++ return; ++ ++ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level); ++ cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK; ++ if (cur_level <= ARMADA_37XX_DVFS_LOAD_1) ++ return; ++ ++ regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD, ++ ARMADA_37XX_NB_CPU_LOAD_MASK, ++ ARMADA_37XX_DVFS_LOAD_1); ++ msleep(20); ++} ++ + static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + unsigned long parent_rate) + { +@@ -537,6 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate, + */ + reg = ARMADA_37XX_NB_CPU_LOAD; + mask = ARMADA_37XX_NB_CPU_LOAD_MASK; ++ ++ clk_pm_cpu_set_rate_wa(rate, base); ++ + regmap_update_bits(base, reg, mask, load_level); + + return rate; +diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.c b/drivers/gpu/drm/nouveau/dispnv04/disp.c +index 501d2d290e9c..70dce544984e 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/disp.c +@@ -55,6 +55,9 @@ nv04_display_create(struct drm_device *dev) + nouveau_display(dev)->init = nv04_display_init; + nouveau_display(dev)->fini = nv04_display_fini; + ++ /* Pre-nv50 doesn't support atomic, so don't expose the ioctls */ ++ dev->driver->driver_features &= ~DRIVER_ATOMIC; ++ + nouveau_hw_save_vga_fonts(dev, 1); + + nv04_crtc_create(dev, 0); +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index 0bffeb95b072..591d9c29ede7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -79,6 +79,10 @@ MODULE_PARM_DESC(modeset, "enable driver (default: auto, " + int nouveau_modeset = -1; + module_param_named(modeset, nouveau_modeset, int, 0400); + ++MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)"); ++static int nouveau_atomic = 0; ++module_param_named(atomic, nouveau_atomic, int, 0400); ++ + MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)"); + static int nouveau_runtime_pm = -1; + module_param_named(runpm, nouveau_runtime_pm, int, 0400); +@@ -501,6 +505,9 @@ static int nouveau_drm_probe(struct pci_dev *pdev, + + pci_set_master(pdev); + ++ if (nouveau_atomic) ++ driver_pci.driver_features |= DRIVER_ATOMIC; ++ + ret = drm_get_pci_dev(pdev, pent, &driver_pci); + if (ret) { + nvkm_device_del(&device); +diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c +index 2b3ccd850750..abe297fda046 100644 +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -4198,7 +4198,7 @@ nv50_disp_atomic_commit(struct drm_device *dev, + nv50_disp_atomic_commit_tail(state); + + drm_for_each_crtc(crtc, dev) { +- if (crtc->state->enable) { ++ if (crtc->state->active) { + if (!drm->have_disp_power_ref) { + drm->have_disp_power_ref = true; + return 0; +@@ -4441,10 +4441,6 @@ nv50_display_destroy(struct drm_device *dev) + kfree(disp); + } + +-MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)"); +-static int nouveau_atomic = 0; +-module_param_named(atomic, nouveau_atomic, int, 0400); +- + int + nv50_display_create(struct drm_device *dev) + { +@@ -4469,8 +4465,6 @@ nv50_display_create(struct drm_device *dev) + disp->disp = &nouveau_display(dev)->disp; + dev->mode_config.funcs = &nv50_disp_func; + dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP; +- if (nouveau_atomic) +- dev->driver->driver_features |= DRIVER_ATOMIC; + + /* small shared memory area we use for notifiers and semaphores */ + ret = nouveau_bo_new(&drm->client, 4096, 0x1000, TTM_PL_FLAG_VRAM, +diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig +index b38798cc5288..f3a21343e636 100644 +--- a/drivers/iommu/Kconfig ++++ b/drivers/iommu/Kconfig +@@ -142,7 +142,6 @@ config DMAR_TABLE + config INTEL_IOMMU + bool "Support for Intel IOMMU using DMA Remapping Devices" + depends on PCI_MSI && ACPI && (X86 || IA64_GENERIC) +- select DMA_DIRECT_OPS + select IOMMU_API + select IOMMU_IOVA + select DMAR_TABLE +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 749d8f235346..6392a4964fc5 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -31,7 +31,6 @@ + #include <linux/pci.h> + #include <linux/dmar.h> + #include <linux/dma-mapping.h> +-#include <linux/dma-direct.h> + #include <linux/mempool.h> + #include <linux/memory.h> + #include <linux/cpu.h> +@@ -3709,30 +3708,61 @@ static void *intel_alloc_coherent(struct device *dev, size_t size, + dma_addr_t *dma_handle, gfp_t flags, + unsigned long attrs) + { +- void *vaddr; ++ struct page *page = NULL; ++ int order; + +- vaddr = dma_direct_alloc(dev, size, dma_handle, flags, attrs); +- if (iommu_no_mapping(dev) || !vaddr) +- return vaddr; ++ size = PAGE_ALIGN(size); ++ order = get_order(size); + +- *dma_handle = __intel_map_single(dev, virt_to_phys(vaddr), +- PAGE_ALIGN(size), DMA_BIDIRECTIONAL, +- dev->coherent_dma_mask); +- if (!*dma_handle) +- goto out_free_pages; +- return vaddr; ++ if (!iommu_no_mapping(dev)) ++ flags &= ~(GFP_DMA | GFP_DMA32); ++ else if (dev->coherent_dma_mask < dma_get_required_mask(dev)) { ++ if (dev->coherent_dma_mask < DMA_BIT_MASK(32)) ++ flags |= GFP_DMA; ++ else ++ flags |= GFP_DMA32; ++ } ++ ++ if (gfpflags_allow_blocking(flags)) { ++ unsigned int count = size >> PAGE_SHIFT; ++ ++ page = dma_alloc_from_contiguous(dev, count, order, flags); ++ if (page && iommu_no_mapping(dev) && ++ page_to_phys(page) + size > dev->coherent_dma_mask) { ++ dma_release_from_contiguous(dev, page, count); ++ page = NULL; ++ } ++ } ++ ++ if (!page) ++ page = alloc_pages(flags, order); ++ if (!page) ++ return NULL; ++ memset(page_address(page), 0, size); ++ ++ *dma_handle = __intel_map_single(dev, page_to_phys(page), size, ++ DMA_BIDIRECTIONAL, ++ dev->coherent_dma_mask); ++ if (*dma_handle) ++ return page_address(page); ++ if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT)) ++ __free_pages(page, order); + +-out_free_pages: +- dma_direct_free(dev, size, vaddr, *dma_handle, attrs); + return NULL; + } + + static void intel_free_coherent(struct device *dev, size_t size, void *vaddr, + dma_addr_t dma_handle, unsigned long attrs) + { +- if (!iommu_no_mapping(dev)) +- intel_unmap(dev, dma_handle, PAGE_ALIGN(size)); +- dma_direct_free(dev, size, vaddr, dma_handle, attrs); ++ int order; ++ struct page *page = virt_to_page(vaddr); ++ ++ size = PAGE_ALIGN(size); ++ order = get_order(size); ++ ++ intel_unmap(dev, dma_handle, size); ++ if (!dma_release_from_contiguous(dev, page, size >> PAGE_SHIFT)) ++ __free_pages(page, order); + } + + static void intel_unmap_sg(struct device *dev, struct scatterlist *sglist, +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index b594bae1adbd..cdc72b7e3d26 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -743,15 +743,20 @@ const struct bond_option *bond_opt_get(unsigned int option) + static int bond_option_mode_set(struct bonding *bond, + const struct bond_opt_value *newval) + { +- if (!bond_mode_uses_arp(newval->value) && bond->params.arp_interval) { +- netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", +- newval->string); +- /* disable arp monitoring */ +- bond->params.arp_interval = 0; +- /* set miimon to default value */ +- bond->params.miimon = BOND_DEFAULT_MIIMON; +- netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n", +- bond->params.miimon); ++ if (!bond_mode_uses_arp(newval->value)) { ++ if (bond->params.arp_interval) { ++ netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", ++ newval->string); ++ /* disable arp monitoring */ ++ bond->params.arp_interval = 0; ++ } ++ ++ if (!bond->params.miimon) { ++ /* set miimon to default value */ ++ bond->params.miimon = BOND_DEFAULT_MIIMON; ++ netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n", ++ bond->params.miimon); ++ } + } + + if (newval->value == BOND_MODE_ALB) +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index b397a33f3d32..e2f965c2e3aa 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -634,10 +634,12 @@ static int m_can_clk_start(struct m_can_priv *priv) + int err; + + err = pm_runtime_get_sync(priv->device); +- if (err) ++ if (err < 0) { + pm_runtime_put_noidle(priv->device); ++ return err; ++ } + +- return err; ++ return 0; + } + + static void m_can_clk_stop(struct m_can_priv *priv) +@@ -1109,7 +1111,8 @@ static void m_can_chip_config(struct net_device *dev) + + } else { + /* Version 3.1.x or 3.2.x */ +- cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE); ++ cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE | ++ CCCR_NISO); + + /* Only 3.2.x has NISO Bit implemented */ + if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) +@@ -1687,8 +1690,6 @@ failed_ret: + return ret; + } + +-/* TODO: runtime PM with power down or sleep mode */ +- + static __maybe_unused int m_can_suspend(struct device *dev) + { + struct net_device *ndev = dev_get_drvdata(dev); +diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c +index 3c51a884db87..fa689854f16b 100644 +--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c ++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c +@@ -58,6 +58,10 @@ MODULE_LICENSE("GPL v2"); + #define PCIEFD_REG_SYS_VER1 0x0040 /* version reg #1 */ + #define PCIEFD_REG_SYS_VER2 0x0044 /* version reg #2 */ + ++#define PCIEFD_FW_VERSION(x, y, z) (((u32)(x) << 24) | \ ++ ((u32)(y) << 16) | \ ++ ((u32)(z) << 8)) ++ + /* System Control Registers Bits */ + #define PCIEFD_SYS_CTL_TS_RST 0x00000001 /* timestamp clock */ + #define PCIEFD_SYS_CTL_CLK_EN 0x00000002 /* system clock */ +@@ -783,6 +787,21 @@ static int peak_pciefd_probe(struct pci_dev *pdev, + "%ux CAN-FD PCAN-PCIe FPGA v%u.%u.%u:\n", can_count, + hw_ver_major, hw_ver_minor, hw_ver_sub); + ++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT ++ /* FW < v3.3.0 DMA logic doesn't handle correctly the mix of 32-bit and ++ * 64-bit logical addresses: this workaround forces usage of 32-bit ++ * DMA addresses only when such a fw is detected. ++ */ ++ if (PCIEFD_FW_VERSION(hw_ver_major, hw_ver_minor, hw_ver_sub) < ++ PCIEFD_FW_VERSION(3, 3, 0)) { ++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); ++ if (err) ++ dev_warn(&pdev->dev, ++ "warning: can't set DMA mask %llxh (err %d)\n", ++ DMA_BIT_MASK(32), err); ++ } ++#endif ++ + /* stop system clock */ + pciefd_sys_writereg(pciefd, PCIEFD_SYS_CTL_CLK_EN, + PCIEFD_REG_SYS_CTL_CLR); +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 89aec07c225f..5a24039733ef 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -2,6 +2,7 @@ + * + * Copyright (C) 2012 - 2014 Xilinx, Inc. + * Copyright (C) 2009 PetaLogix. All rights reserved. ++ * Copyright (C) 2017 Sandvik Mining and Construction Oy + * + * Description: + * This driver is developed for Axi CAN IP and for Zynq CANPS Controller. +@@ -25,8 +26,10 @@ + #include <linux/module.h> + #include <linux/netdevice.h> + #include <linux/of.h> ++#include <linux/of_device.h> + #include <linux/platform_device.h> + #include <linux/skbuff.h> ++#include <linux/spinlock.h> + #include <linux/string.h> + #include <linux/types.h> + #include <linux/can/dev.h> +@@ -101,7 +104,7 @@ enum xcan_reg { + #define XCAN_INTR_ALL (XCAN_IXR_TXOK_MASK | XCAN_IXR_BSOFF_MASK |\ + XCAN_IXR_WKUP_MASK | XCAN_IXR_SLP_MASK | \ + XCAN_IXR_RXNEMP_MASK | XCAN_IXR_ERROR_MASK | \ +- XCAN_IXR_ARBLST_MASK | XCAN_IXR_RXOK_MASK) ++ XCAN_IXR_RXOFLW_MASK | XCAN_IXR_ARBLST_MASK) + + /* CAN register bit shift - XCAN_<REG>_<BIT>_SHIFT */ + #define XCAN_BTR_SJW_SHIFT 7 /* Synchronous jump width */ +@@ -118,6 +121,7 @@ enum xcan_reg { + /** + * struct xcan_priv - This definition define CAN driver instance + * @can: CAN private data structure. ++ * @tx_lock: Lock for synchronizing TX interrupt handling + * @tx_head: Tx CAN packets ready to send on the queue + * @tx_tail: Tx CAN packets successfully sended on the queue + * @tx_max: Maximum number packets the driver can send +@@ -132,6 +136,7 @@ enum xcan_reg { + */ + struct xcan_priv { + struct can_priv can; ++ spinlock_t tx_lock; + unsigned int tx_head; + unsigned int tx_tail; + unsigned int tx_max; +@@ -159,6 +164,11 @@ static const struct can_bittiming_const xcan_bittiming_const = { + .brp_inc = 1, + }; + ++#define XCAN_CAP_WATERMARK 0x0001 ++struct xcan_devtype_data { ++ unsigned int caps; ++}; ++ + /** + * xcan_write_reg_le - Write a value to the device register little endian + * @priv: Driver private data structure +@@ -238,6 +248,10 @@ static int set_reset_mode(struct net_device *ndev) + usleep_range(500, 10000); + } + ++ /* reset clears FIFOs */ ++ priv->tx_head = 0; ++ priv->tx_tail = 0; ++ + return 0; + } + +@@ -392,6 +406,7 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + struct net_device_stats *stats = &ndev->stats; + struct can_frame *cf = (struct can_frame *)skb->data; + u32 id, dlc, data[2] = {0, 0}; ++ unsigned long flags; + + if (can_dropped_invalid_skb(ndev, skb)) + return NETDEV_TX_OK; +@@ -439,6 +454,9 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + data[1] = be32_to_cpup((__be32 *)(cf->data + 4)); + + can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max); ++ ++ spin_lock_irqsave(&priv->tx_lock, flags); ++ + priv->tx_head++; + + /* Write the Frame to Xilinx CAN TX FIFO */ +@@ -454,10 +472,16 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + stats->tx_bytes += cf->can_dlc; + } + ++ /* Clear TX-FIFO-empty interrupt for xcan_tx_interrupt() */ ++ if (priv->tx_max > 1) ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXFEMP_MASK); ++ + /* Check if the TX buffer is full */ + if ((priv->tx_head - priv->tx_tail) == priv->tx_max) + netif_stop_queue(ndev); + ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ + return NETDEV_TX_OK; + } + +@@ -529,6 +553,123 @@ static int xcan_rx(struct net_device *ndev) + return 1; + } + ++/** ++ * xcan_current_error_state - Get current error state from HW ++ * @ndev: Pointer to net_device structure ++ * ++ * Checks the current CAN error state from the HW. Note that this ++ * only checks for ERROR_PASSIVE and ERROR_WARNING. ++ * ++ * Return: ++ * ERROR_PASSIVE or ERROR_WARNING if either is active, ERROR_ACTIVE ++ * otherwise. ++ */ ++static enum can_state xcan_current_error_state(struct net_device *ndev) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ u32 status = priv->read_reg(priv, XCAN_SR_OFFSET); ++ ++ if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) ++ return CAN_STATE_ERROR_PASSIVE; ++ else if (status & XCAN_SR_ERRWRN_MASK) ++ return CAN_STATE_ERROR_WARNING; ++ else ++ return CAN_STATE_ERROR_ACTIVE; ++} ++ ++/** ++ * xcan_set_error_state - Set new CAN error state ++ * @ndev: Pointer to net_device structure ++ * @new_state: The new CAN state to be set ++ * @cf: Error frame to be populated or NULL ++ * ++ * Set new CAN error state for the device, updating statistics and ++ * populating the error frame if given. ++ */ ++static void xcan_set_error_state(struct net_device *ndev, ++ enum can_state new_state, ++ struct can_frame *cf) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ u32 ecr = priv->read_reg(priv, XCAN_ECR_OFFSET); ++ u32 txerr = ecr & XCAN_ECR_TEC_MASK; ++ u32 rxerr = (ecr & XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT; ++ ++ priv->can.state = new_state; ++ ++ if (cf) { ++ cf->can_id |= CAN_ERR_CRTL; ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } ++ ++ switch (new_state) { ++ case CAN_STATE_ERROR_PASSIVE: ++ priv->can.can_stats.error_passive++; ++ if (cf) ++ cf->data[1] = (rxerr > 127) ? ++ CAN_ERR_CRTL_RX_PASSIVE : ++ CAN_ERR_CRTL_TX_PASSIVE; ++ break; ++ case CAN_STATE_ERROR_WARNING: ++ priv->can.can_stats.error_warning++; ++ if (cf) ++ cf->data[1] |= (txerr > rxerr) ? ++ CAN_ERR_CRTL_TX_WARNING : ++ CAN_ERR_CRTL_RX_WARNING; ++ break; ++ case CAN_STATE_ERROR_ACTIVE: ++ if (cf) ++ cf->data[1] |= CAN_ERR_CRTL_ACTIVE; ++ break; ++ default: ++ /* non-ERROR states are handled elsewhere */ ++ WARN_ON(1); ++ break; ++ } ++} ++ ++/** ++ * xcan_update_error_state_after_rxtx - Update CAN error state after RX/TX ++ * @ndev: Pointer to net_device structure ++ * ++ * If the device is in a ERROR-WARNING or ERROR-PASSIVE state, check if ++ * the performed RX/TX has caused it to drop to a lesser state and set ++ * the interface state accordingly. ++ */ ++static void xcan_update_error_state_after_rxtx(struct net_device *ndev) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ enum can_state old_state = priv->can.state; ++ enum can_state new_state; ++ ++ /* changing error state due to successful frame RX/TX can only ++ * occur from these states ++ */ ++ if (old_state != CAN_STATE_ERROR_WARNING && ++ old_state != CAN_STATE_ERROR_PASSIVE) ++ return; ++ ++ new_state = xcan_current_error_state(ndev); ++ ++ if (new_state != old_state) { ++ struct sk_buff *skb; ++ struct can_frame *cf; ++ ++ skb = alloc_can_err_skb(ndev, &cf); ++ ++ xcan_set_error_state(ndev, new_state, skb ? cf : NULL); ++ ++ if (skb) { ++ struct net_device_stats *stats = &ndev->stats; ++ ++ stats->rx_packets++; ++ stats->rx_bytes += cf->can_dlc; ++ netif_rx(skb); ++ } ++ } ++} ++ + /** + * xcan_err_interrupt - error frame Isr + * @ndev: net_device pointer +@@ -544,16 +685,12 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + struct net_device_stats *stats = &ndev->stats; + struct can_frame *cf; + struct sk_buff *skb; +- u32 err_status, status, txerr = 0, rxerr = 0; ++ u32 err_status; + + skb = alloc_can_err_skb(ndev, &cf); + + err_status = priv->read_reg(priv, XCAN_ESR_OFFSET); + priv->write_reg(priv, XCAN_ESR_OFFSET, err_status); +- txerr = priv->read_reg(priv, XCAN_ECR_OFFSET) & XCAN_ECR_TEC_MASK; +- rxerr = ((priv->read_reg(priv, XCAN_ECR_OFFSET) & +- XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT); +- status = priv->read_reg(priv, XCAN_SR_OFFSET); + + if (isr & XCAN_IXR_BSOFF_MASK) { + priv->can.state = CAN_STATE_BUS_OFF; +@@ -563,28 +700,10 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + can_bus_off(ndev); + if (skb) + cf->can_id |= CAN_ERR_BUSOFF; +- } else if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) { +- priv->can.state = CAN_STATE_ERROR_PASSIVE; +- priv->can.can_stats.error_passive++; +- if (skb) { +- cf->can_id |= CAN_ERR_CRTL; +- cf->data[1] = (rxerr > 127) ? +- CAN_ERR_CRTL_RX_PASSIVE : +- CAN_ERR_CRTL_TX_PASSIVE; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } +- } else if (status & XCAN_SR_ERRWRN_MASK) { +- priv->can.state = CAN_STATE_ERROR_WARNING; +- priv->can.can_stats.error_warning++; +- if (skb) { +- cf->can_id |= CAN_ERR_CRTL; +- cf->data[1] |= (txerr > rxerr) ? +- CAN_ERR_CRTL_TX_WARNING : +- CAN_ERR_CRTL_RX_WARNING; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } ++ } else { ++ enum can_state new_state = xcan_current_error_state(ndev); ++ ++ xcan_set_error_state(ndev, new_state, skb ? cf : NULL); + } + + /* Check for Arbitration lost interrupt */ +@@ -600,7 +719,6 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + if (isr & XCAN_IXR_RXOFLW_MASK) { + stats->rx_over_errors++; + stats->rx_errors++; +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); + if (skb) { + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] |= CAN_ERR_CRTL_RX_OVERFLOW; +@@ -709,26 +827,20 @@ static int xcan_rx_poll(struct napi_struct *napi, int quota) + + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + while ((isr & XCAN_IXR_RXNEMP_MASK) && (work_done < quota)) { +- if (isr & XCAN_IXR_RXOK_MASK) { +- priv->write_reg(priv, XCAN_ICR_OFFSET, +- XCAN_IXR_RXOK_MASK); +- work_done += xcan_rx(ndev); +- } else { +- priv->write_reg(priv, XCAN_ICR_OFFSET, +- XCAN_IXR_RXNEMP_MASK); +- break; +- } ++ work_done += xcan_rx(ndev); + priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_RXNEMP_MASK); + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + } + +- if (work_done) ++ if (work_done) { + can_led_event(ndev, CAN_LED_EVENT_RX); ++ xcan_update_error_state_after_rxtx(ndev); ++ } + + if (work_done < quota) { + napi_complete_done(napi, work_done); + ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier |= (XCAN_IXR_RXOK_MASK | XCAN_IXR_RXNEMP_MASK); ++ ier |= XCAN_IXR_RXNEMP_MASK; + priv->write_reg(priv, XCAN_IER_OFFSET, ier); + } + return work_done; +@@ -743,18 +855,71 @@ static void xcan_tx_interrupt(struct net_device *ndev, u32 isr) + { + struct xcan_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; ++ unsigned int frames_in_fifo; ++ int frames_sent = 1; /* TXOK => at least 1 frame was sent */ ++ unsigned long flags; ++ int retries = 0; ++ ++ /* Synchronize with xmit as we need to know the exact number ++ * of frames in the FIFO to stay in sync due to the TXFEMP ++ * handling. ++ * This also prevents a race between netif_wake_queue() and ++ * netif_stop_queue(). ++ */ ++ spin_lock_irqsave(&priv->tx_lock, flags); ++ ++ frames_in_fifo = priv->tx_head - priv->tx_tail; ++ ++ if (WARN_ON_ONCE(frames_in_fifo == 0)) { ++ /* clear TXOK anyway to avoid getting back here */ ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ return; ++ } ++ ++ /* Check if 2 frames were sent (TXOK only means that at least 1 ++ * frame was sent). ++ */ ++ if (frames_in_fifo > 1) { ++ WARN_ON(frames_in_fifo > priv->tx_max); ++ ++ /* Synchronize TXOK and isr so that after the loop: ++ * (1) isr variable is up-to-date at least up to TXOK clear ++ * time. This avoids us clearing a TXOK of a second frame ++ * but not noticing that the FIFO is now empty and thus ++ * marking only a single frame as sent. ++ * (2) No TXOK is left. Having one could mean leaving a ++ * stray TXOK as we might process the associated frame ++ * via TXFEMP handling as we read TXFEMP *after* TXOK ++ * clear to satisfy (1). ++ */ ++ while ((isr & XCAN_IXR_TXOK_MASK) && !WARN_ON(++retries == 100)) { ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ isr = priv->read_reg(priv, XCAN_ISR_OFFSET); ++ } + +- while ((priv->tx_head - priv->tx_tail > 0) && +- (isr & XCAN_IXR_TXOK_MASK)) { ++ if (isr & XCAN_IXR_TXFEMP_MASK) { ++ /* nothing in FIFO anymore */ ++ frames_sent = frames_in_fifo; ++ } ++ } else { ++ /* single frame in fifo, just clear TXOK */ + priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ } ++ ++ while (frames_sent--) { + can_get_echo_skb(ndev, priv->tx_tail % + priv->tx_max); + priv->tx_tail++; + stats->tx_packets++; +- isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + } +- can_led_event(ndev, CAN_LED_EVENT_TX); ++ + netif_wake_queue(ndev); ++ ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ ++ can_led_event(ndev, CAN_LED_EVENT_TX); ++ xcan_update_error_state_after_rxtx(ndev); + } + + /** +@@ -773,6 +938,7 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + struct net_device *ndev = (struct net_device *)dev_id; + struct xcan_priv *priv = netdev_priv(ndev); + u32 isr, ier; ++ u32 isr_errors; + + /* Get the interrupt status from Xilinx CAN */ + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); +@@ -791,18 +957,17 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + xcan_tx_interrupt(ndev, isr); + + /* Check for the type of error interrupt and Processing it */ +- if (isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK | +- XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK)) { +- priv->write_reg(priv, XCAN_ICR_OFFSET, (XCAN_IXR_ERROR_MASK | +- XCAN_IXR_RXOFLW_MASK | XCAN_IXR_BSOFF_MASK | +- XCAN_IXR_ARBLST_MASK)); ++ isr_errors = isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK | ++ XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK); ++ if (isr_errors) { ++ priv->write_reg(priv, XCAN_ICR_OFFSET, isr_errors); + xcan_err_interrupt(ndev, isr); + } + + /* Check for the type of receive interrupt and Processing it */ +- if (isr & (XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK)) { ++ if (isr & XCAN_IXR_RXNEMP_MASK) { + ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier &= ~(XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK); ++ ier &= ~XCAN_IXR_RXNEMP_MASK; + priv->write_reg(priv, XCAN_IER_OFFSET, ier); + napi_schedule(&priv->napi); + } +@@ -819,13 +984,9 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + static void xcan_chip_stop(struct net_device *ndev) + { + struct xcan_priv *priv = netdev_priv(ndev); +- u32 ier; + + /* Disable interrupts and leave the can in configuration mode */ +- ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier &= ~XCAN_INTR_ALL; +- priv->write_reg(priv, XCAN_IER_OFFSET, ier); +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); ++ set_reset_mode(ndev); + priv->can.state = CAN_STATE_STOPPED; + } + +@@ -958,10 +1119,15 @@ static const struct net_device_ops xcan_netdev_ops = { + */ + static int __maybe_unused xcan_suspend(struct device *dev) + { +- if (!device_may_wakeup(dev)) +- return pm_runtime_force_suspend(dev); ++ struct net_device *ndev = dev_get_drvdata(dev); + +- return 0; ++ if (netif_running(ndev)) { ++ netif_stop_queue(ndev); ++ netif_device_detach(ndev); ++ xcan_chip_stop(ndev); ++ } ++ ++ return pm_runtime_force_suspend(dev); + } + + /** +@@ -973,11 +1139,27 @@ static int __maybe_unused xcan_suspend(struct device *dev) + */ + static int __maybe_unused xcan_resume(struct device *dev) + { +- if (!device_may_wakeup(dev)) +- return pm_runtime_force_resume(dev); ++ struct net_device *ndev = dev_get_drvdata(dev); ++ int ret; + +- return 0; ++ ret = pm_runtime_force_resume(dev); ++ if (ret) { ++ dev_err(dev, "pm_runtime_force_resume failed on resume\n"); ++ return ret; ++ } ++ ++ if (netif_running(ndev)) { ++ ret = xcan_chip_start(ndev); ++ if (ret) { ++ dev_err(dev, "xcan_chip_start failed on resume\n"); ++ return ret; ++ } ++ ++ netif_device_attach(ndev); ++ netif_start_queue(ndev); ++ } + ++ return 0; + } + + /** +@@ -992,14 +1174,6 @@ static int __maybe_unused xcan_runtime_suspend(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct xcan_priv *priv = netdev_priv(ndev); + +- if (netif_running(ndev)) { +- netif_stop_queue(ndev); +- netif_device_detach(ndev); +- } +- +- priv->write_reg(priv, XCAN_MSR_OFFSET, XCAN_MSR_SLEEP_MASK); +- priv->can.state = CAN_STATE_SLEEPING; +- + clk_disable_unprepare(priv->bus_clk); + clk_disable_unprepare(priv->can_clk); + +@@ -1018,7 +1192,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct xcan_priv *priv = netdev_priv(ndev); + int ret; +- u32 isr, status; + + ret = clk_prepare_enable(priv->bus_clk); + if (ret) { +@@ -1032,27 +1205,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev) + return ret; + } + +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); +- isr = priv->read_reg(priv, XCAN_ISR_OFFSET); +- status = priv->read_reg(priv, XCAN_SR_OFFSET); +- +- if (netif_running(ndev)) { +- if (isr & XCAN_IXR_BSOFF_MASK) { +- priv->can.state = CAN_STATE_BUS_OFF; +- priv->write_reg(priv, XCAN_SRR_OFFSET, +- XCAN_SRR_RESET_MASK); +- } else if ((status & XCAN_SR_ESTAT_MASK) == +- XCAN_SR_ESTAT_MASK) { +- priv->can.state = CAN_STATE_ERROR_PASSIVE; +- } else if (status & XCAN_SR_ERRWRN_MASK) { +- priv->can.state = CAN_STATE_ERROR_WARNING; +- } else { +- priv->can.state = CAN_STATE_ERROR_ACTIVE; +- } +- netif_device_attach(ndev); +- netif_start_queue(ndev); +- } +- + return 0; + } + +@@ -1061,6 +1213,18 @@ static const struct dev_pm_ops xcan_dev_pm_ops = { + SET_RUNTIME_PM_OPS(xcan_runtime_suspend, xcan_runtime_resume, NULL) + }; + ++static const struct xcan_devtype_data xcan_zynq_data = { ++ .caps = XCAN_CAP_WATERMARK, ++}; ++ ++/* Match table for OF platform binding */ ++static const struct of_device_id xcan_of_match[] = { ++ { .compatible = "xlnx,zynq-can-1.0", .data = &xcan_zynq_data }, ++ { .compatible = "xlnx,axi-can-1.00.a", }, ++ { /* end of list */ }, ++}; ++MODULE_DEVICE_TABLE(of, xcan_of_match); ++ + /** + * xcan_probe - Platform registration call + * @pdev: Handle to the platform device structure +@@ -1075,8 +1239,10 @@ static int xcan_probe(struct platform_device *pdev) + struct resource *res; /* IO mem resources */ + struct net_device *ndev; + struct xcan_priv *priv; ++ const struct of_device_id *of_id; ++ int caps = 0; + void __iomem *addr; +- int ret, rx_max, tx_max; ++ int ret, rx_max, tx_max, tx_fifo_depth; + + /* Get the virtual base address for the device */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -1086,7 +1252,8 @@ static int xcan_probe(struct platform_device *pdev) + goto err; + } + +- ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", &tx_max); ++ ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", ++ &tx_fifo_depth); + if (ret < 0) + goto err; + +@@ -1094,6 +1261,30 @@ static int xcan_probe(struct platform_device *pdev) + if (ret < 0) + goto err; + ++ of_id = of_match_device(xcan_of_match, &pdev->dev); ++ if (of_id) { ++ const struct xcan_devtype_data *devtype_data = of_id->data; ++ ++ if (devtype_data) ++ caps = devtype_data->caps; ++ } ++ ++ /* There is no way to directly figure out how many frames have been ++ * sent when the TXOK interrupt is processed. If watermark programming ++ * is supported, we can have 2 frames in the FIFO and use TXFEMP ++ * to determine if 1 or 2 frames have been sent. ++ * Theoretically we should be able to use TXFWMEMP to determine up ++ * to 3 frames, but it seems that after putting a second frame in the ++ * FIFO, with watermark at 2 frames, it can happen that TXFWMEMP (less ++ * than 2 frames in FIFO) is set anyway with no TXOK (a frame was ++ * sent), which is not a sensible state - possibly TXFWMEMP is not ++ * completely synchronized with the rest of the bits? ++ */ ++ if (caps & XCAN_CAP_WATERMARK) ++ tx_max = min(tx_fifo_depth, 2); ++ else ++ tx_max = 1; ++ + /* Create a CAN device instance */ + ndev = alloc_candev(sizeof(struct xcan_priv), tx_max); + if (!ndev) +@@ -1108,6 +1299,7 @@ static int xcan_probe(struct platform_device *pdev) + CAN_CTRLMODE_BERR_REPORTING; + priv->reg_base = addr; + priv->tx_max = tx_max; ++ spin_lock_init(&priv->tx_lock); + + /* Get IRQ for the device */ + ndev->irq = platform_get_irq(pdev, 0); +@@ -1172,9 +1364,9 @@ static int xcan_probe(struct platform_device *pdev) + + pm_runtime_put(&pdev->dev); + +- netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth:%d\n", ++ netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth: actual %d, using %d\n", + priv->reg_base, ndev->irq, priv->can.clock.freq, +- priv->tx_max); ++ tx_fifo_depth, priv->tx_max); + + return 0; + +@@ -1208,14 +1400,6 @@ static int xcan_remove(struct platform_device *pdev) + return 0; + } + +-/* Match table for OF platform binding */ +-static const struct of_device_id xcan_of_match[] = { +- { .compatible = "xlnx,zynq-can-1.0", }, +- { .compatible = "xlnx,axi-can-1.00.a", }, +- { /* end of list */ }, +-}; +-MODULE_DEVICE_TABLE(of, xcan_of_match); +- + static struct platform_driver xcan_driver = { + .probe = xcan_probe, + .remove = xcan_remove, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 5b4374f21d76..04371b0bba80 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -341,6 +341,7 @@ static const struct irq_domain_ops mv88e6xxx_g1_irq_domain_ops = { + .xlate = irq_domain_xlate_twocell, + }; + ++/* To be called with reg_lock held */ + static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip) + { + int irq, virq; +@@ -360,9 +361,15 @@ static void mv88e6xxx_g1_irq_free_common(struct mv88e6xxx_chip *chip) + + static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip) + { +- mv88e6xxx_g1_irq_free_common(chip); +- ++ /* ++ * free_irq must be called without reg_lock taken because the irq ++ * handler takes this lock, too. ++ */ + free_irq(chip->irq, chip); ++ ++ mutex_lock(&chip->reg_lock); ++ mv88e6xxx_g1_irq_free_common(chip); ++ mutex_unlock(&chip->reg_lock); + } + + static int mv88e6xxx_g1_irq_setup_common(struct mv88e6xxx_chip *chip) +@@ -467,10 +474,12 @@ static int mv88e6xxx_irq_poll_setup(struct mv88e6xxx_chip *chip) + + static void mv88e6xxx_irq_poll_free(struct mv88e6xxx_chip *chip) + { +- mv88e6xxx_g1_irq_free_common(chip); +- + kthread_cancel_delayed_work_sync(&chip->irq_poll_work); + kthread_destroy_worker(chip->kworker); ++ ++ mutex_lock(&chip->reg_lock); ++ mv88e6xxx_g1_irq_free_common(chip); ++ mutex_unlock(&chip->reg_lock); + } + + int mv88e6xxx_wait(struct mv88e6xxx_chip *chip, int addr, int reg, u16 mask) +@@ -4286,12 +4295,10 @@ out_g2_irq: + if (chip->info->g2_irqs > 0) + mv88e6xxx_g2_irq_free(chip); + out_g1_irq: +- mutex_lock(&chip->reg_lock); + if (chip->irq > 0) + mv88e6xxx_g1_irq_free(chip); + else + mv88e6xxx_irq_poll_free(chip); +- mutex_unlock(&chip->reg_lock); + out: + return err; + } +@@ -4316,12 +4323,10 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) + if (chip->info->g2_irqs > 0) + mv88e6xxx_g2_irq_free(chip); + +- mutex_lock(&chip->reg_lock); + if (chip->irq > 0) + mv88e6xxx_g1_irq_free(chip); + else + mv88e6xxx_irq_poll_free(chip); +- mutex_unlock(&chip->reg_lock); + } + + static const struct of_device_id mv88e6xxx_of_match[] = { +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c +index 9128858479c4..2353ec829c04 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c +@@ -229,6 +229,7 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) + txq->txq_stats.tx_busy++; + u64_stats_update_end(&txq->txq_stats.syncp); + err = NETDEV_TX_BUSY; ++ wqe_size = 0; + goto flush_skbs; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index 29e50f787349..db63f0ec3d01 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -2956,7 +2956,7 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave, + u32 srqn = qp_get_srqn(qpc) & 0xffffff; + int use_srq = (qp_get_srqn(qpc) >> 24) & 1; + struct res_srq *srq; +- int local_qpn = be32_to_cpu(qpc->local_qpn) & 0xffffff; ++ int local_qpn = vhcr->in_modifier & 0xffffff; + + err = adjust_qp_sched_queue(dev, slave, qpc, inbox); + if (err) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 30cad07be2b5..065ff87f0bef 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -1092,9 +1092,6 @@ int mlx5e_ethtool_get_ts_info(struct mlx5e_priv *priv, + int mlx5e_ethtool_flash_device(struct mlx5e_priv *priv, + struct ethtool_flash *flash); + +-int mlx5e_setup_tc_block_cb(enum tc_setup_type type, void *type_data, +- void *cb_priv); +- + /* mlx5e generic netdev management API */ + struct net_device* + mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profile, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +index 610d485c4b03..dda281cff880 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +@@ -381,14 +381,14 @@ static void arfs_may_expire_flow(struct mlx5e_priv *priv) + HLIST_HEAD(del_list); + spin_lock_bh(&priv->fs.arfs.arfs_lock); + mlx5e_for_each_arfs_rule(arfs_rule, htmp, priv->fs.arfs.arfs_tables, i, j) { +- if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA) +- break; + if (!work_pending(&arfs_rule->arfs_work) && + rps_may_expire_flow(priv->netdev, + arfs_rule->rxq, arfs_rule->flow_id, + arfs_rule->filter_id)) { + hlist_del_init(&arfs_rule->hlist); + hlist_add_head(&arfs_rule->hlist, &del_list); ++ if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA) ++ break; + } + } + spin_unlock_bh(&priv->fs.arfs.arfs_lock); +@@ -711,6 +711,9 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, + skb->protocol != htons(ETH_P_IPV6)) + return -EPROTONOSUPPORT; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol); + if (!arfs_t) + return -EPROTONOSUPPORT; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +index c641d5656b2d..0c6015ce85fd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +@@ -272,7 +272,8 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets) + } + + static int mlx5e_dbcnl_validate_ets(struct net_device *netdev, +- struct ieee_ets *ets) ++ struct ieee_ets *ets, ++ bool zero_sum_allowed) + { + bool have_ets_tc = false; + int bw_sum = 0; +@@ -297,8 +298,9 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev, + } + + if (have_ets_tc && bw_sum != 100) { +- netdev_err(netdev, +- "Failed to validate ETS: BW sum is illegal\n"); ++ if (bw_sum || (!bw_sum && !zero_sum_allowed)) ++ netdev_err(netdev, ++ "Failed to validate ETS: BW sum is illegal\n"); + return -EINVAL; + } + return 0; +@@ -313,7 +315,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev, + if (!MLX5_CAP_GEN(priv->mdev, ets)) + return -EOPNOTSUPP; + +- err = mlx5e_dbcnl_validate_ets(netdev, ets); ++ err = mlx5e_dbcnl_validate_ets(netdev, ets, false); + if (err) + return err; + +@@ -613,12 +615,9 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev) + ets.prio_tc[i]); + } + +- err = mlx5e_dbcnl_validate_ets(netdev, &ets); +- if (err) { +- netdev_err(netdev, +- "%s, Failed to validate ETS: %d\n", __func__, err); ++ err = mlx5e_dbcnl_validate_ets(netdev, &ets, true); ++ if (err) + goto out; +- } + + err = mlx5e_dcbnl_ieee_setets_core(priv, &ets); + if (err) { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index d3a1a2281e77..fdf40812a2a9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3093,22 +3093,23 @@ out: + + #ifdef CONFIG_MLX5_ESWITCH + static int mlx5e_setup_tc_cls_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *cls_flower) ++ struct tc_cls_flower_offload *cls_flower, ++ int flags) + { + switch (cls_flower->command) { + case TC_CLSFLOWER_REPLACE: +- return mlx5e_configure_flower(priv, cls_flower); ++ return mlx5e_configure_flower(priv, cls_flower, flags); + case TC_CLSFLOWER_DESTROY: +- return mlx5e_delete_flower(priv, cls_flower); ++ return mlx5e_delete_flower(priv, cls_flower, flags); + case TC_CLSFLOWER_STATS: +- return mlx5e_stats_flower(priv, cls_flower); ++ return mlx5e_stats_flower(priv, cls_flower, flags); + default: + return -EOPNOTSUPP; + } + } + +-int mlx5e_setup_tc_block_cb(enum tc_setup_type type, void *type_data, +- void *cb_priv) ++static int mlx5e_setup_tc_block_cb(enum tc_setup_type type, void *type_data, ++ void *cb_priv) + { + struct mlx5e_priv *priv = cb_priv; + +@@ -3117,7 +3118,7 @@ int mlx5e_setup_tc_block_cb(enum tc_setup_type type, void *type_data, + + switch (type) { + case TC_SETUP_CLSFLOWER: +- return mlx5e_setup_tc_cls_flower(priv, type_data); ++ return mlx5e_setup_tc_cls_flower(priv, type_data, MLX5E_TC_INGRESS); + default: + return -EOPNOTSUPP; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 286565862341..c88eb80278dd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -723,15 +723,31 @@ static int mlx5e_rep_get_phys_port_name(struct net_device *dev, + + static int + mlx5e_rep_setup_tc_cls_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *cls_flower) ++ struct tc_cls_flower_offload *cls_flower, int flags) + { + switch (cls_flower->command) { + case TC_CLSFLOWER_REPLACE: +- return mlx5e_configure_flower(priv, cls_flower); ++ return mlx5e_configure_flower(priv, cls_flower, flags); + case TC_CLSFLOWER_DESTROY: +- return mlx5e_delete_flower(priv, cls_flower); ++ return mlx5e_delete_flower(priv, cls_flower, flags); + case TC_CLSFLOWER_STATS: +- return mlx5e_stats_flower(priv, cls_flower); ++ return mlx5e_stats_flower(priv, cls_flower, flags); ++ default: ++ return -EOPNOTSUPP; ++ } ++} ++ ++static int mlx5e_rep_setup_tc_cb_egdev(enum tc_setup_type type, void *type_data, ++ void *cb_priv) ++{ ++ struct mlx5e_priv *priv = cb_priv; ++ ++ if (!tc_cls_can_offload_and_chain0(priv->netdev, type_data)) ++ return -EOPNOTSUPP; ++ ++ switch (type) { ++ case TC_SETUP_CLSFLOWER: ++ return mlx5e_rep_setup_tc_cls_flower(priv, type_data, MLX5E_TC_EGRESS); + default: + return -EOPNOTSUPP; + } +@@ -747,7 +763,7 @@ static int mlx5e_rep_setup_tc_cb(enum tc_setup_type type, void *type_data, + + switch (type) { + case TC_SETUP_CLSFLOWER: +- return mlx5e_rep_setup_tc_cls_flower(priv, type_data); ++ return mlx5e_rep_setup_tc_cls_flower(priv, type_data, MLX5E_TC_INGRESS); + default: + return -EOPNOTSUPP; + } +@@ -1111,7 +1127,7 @@ mlx5e_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) + + uplink_rpriv = mlx5_eswitch_get_uplink_priv(dev->priv.eswitch, REP_ETH); + upriv = netdev_priv(uplink_rpriv->netdev); +- err = tc_setup_cb_egdev_register(netdev, mlx5e_setup_tc_block_cb, ++ err = tc_setup_cb_egdev_register(netdev, mlx5e_rep_setup_tc_cb_egdev, + upriv); + if (err) + goto err_neigh_cleanup; +@@ -1126,7 +1142,7 @@ mlx5e_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) + return 0; + + err_egdev_cleanup: +- tc_setup_cb_egdev_unregister(netdev, mlx5e_setup_tc_block_cb, ++ tc_setup_cb_egdev_unregister(netdev, mlx5e_rep_setup_tc_cb_egdev, + upriv); + + err_neigh_cleanup: +@@ -1155,7 +1171,7 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) + uplink_rpriv = mlx5_eswitch_get_uplink_priv(priv->mdev->priv.eswitch, + REP_ETH); + upriv = netdev_priv(uplink_rpriv->netdev); +- tc_setup_cb_egdev_unregister(netdev, mlx5e_setup_tc_block_cb, ++ tc_setup_cb_egdev_unregister(netdev, mlx5e_rep_setup_tc_cb_egdev, + upriv); + mlx5e_rep_neigh_cleanup(rpriv); + mlx5e_detach_netdev(priv); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index b94276db3ce9..a0ba6cfc9092 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -61,12 +61,16 @@ struct mlx5_nic_flow_attr { + struct mlx5_flow_table *hairpin_ft; + }; + ++#define MLX5E_TC_FLOW_BASE (MLX5E_TC_LAST_EXPORTED_BIT + 1) ++ + enum { +- MLX5E_TC_FLOW_ESWITCH = BIT(0), +- MLX5E_TC_FLOW_NIC = BIT(1), +- MLX5E_TC_FLOW_OFFLOADED = BIT(2), +- MLX5E_TC_FLOW_HAIRPIN = BIT(3), +- MLX5E_TC_FLOW_HAIRPIN_RSS = BIT(4), ++ MLX5E_TC_FLOW_INGRESS = MLX5E_TC_INGRESS, ++ MLX5E_TC_FLOW_EGRESS = MLX5E_TC_EGRESS, ++ MLX5E_TC_FLOW_ESWITCH = BIT(MLX5E_TC_FLOW_BASE), ++ MLX5E_TC_FLOW_NIC = BIT(MLX5E_TC_FLOW_BASE + 1), ++ MLX5E_TC_FLOW_OFFLOADED = BIT(MLX5E_TC_FLOW_BASE + 2), ++ MLX5E_TC_FLOW_HAIRPIN = BIT(MLX5E_TC_FLOW_BASE + 3), ++ MLX5E_TC_FLOW_HAIRPIN_RSS = BIT(MLX5E_TC_FLOW_BASE + 4), + }; + + struct mlx5e_tc_flow { +@@ -1890,6 +1894,10 @@ static bool actions_match_supported(struct mlx5e_priv *priv, + else + actions = flow->nic_attr->action; + ++ if (flow->flags & MLX5E_TC_FLOW_EGRESS && ++ !(actions & MLX5_FLOW_CONTEXT_ACTION_DECAP)) ++ return false; ++ + if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR) + return modify_header_match_supported(&parse_attr->spec, exts); + +@@ -2566,8 +2574,20 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts, + return err; + } + ++static void get_flags(int flags, u8 *flow_flags) ++{ ++ u8 __flow_flags = 0; ++ ++ if (flags & MLX5E_TC_INGRESS) ++ __flow_flags |= MLX5E_TC_FLOW_INGRESS; ++ if (flags & MLX5E_TC_EGRESS) ++ __flow_flags |= MLX5E_TC_FLOW_EGRESS; ++ ++ *flow_flags = __flow_flags; ++} ++ + int mlx5e_configure_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f) ++ struct tc_cls_flower_offload *f, int flags) + { + struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + struct mlx5e_tc_flow_parse_attr *parse_attr; +@@ -2576,11 +2596,13 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, + int attr_size, err = 0; + u8 flow_flags = 0; + ++ get_flags(flags, &flow_flags); ++ + if (esw && esw->mode == SRIOV_OFFLOADS) { +- flow_flags = MLX5E_TC_FLOW_ESWITCH; ++ flow_flags |= MLX5E_TC_FLOW_ESWITCH; + attr_size = sizeof(struct mlx5_esw_flow_attr); + } else { +- flow_flags = MLX5E_TC_FLOW_NIC; ++ flow_flags |= MLX5E_TC_FLOW_NIC; + attr_size = sizeof(struct mlx5_nic_flow_attr); + } + +@@ -2639,7 +2661,7 @@ err_free: + } + + int mlx5e_delete_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f) ++ struct tc_cls_flower_offload *f, int flags) + { + struct mlx5e_tc_flow *flow; + struct mlx5e_tc_table *tc = &priv->fs.tc; +@@ -2659,7 +2681,7 @@ int mlx5e_delete_flower(struct mlx5e_priv *priv, + } + + int mlx5e_stats_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f) ++ struct tc_cls_flower_offload *f, int flags) + { + struct mlx5e_tc_table *tc = &priv->fs.tc; + struct mlx5e_tc_flow *flow; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h +index c14c263a739b..2255345c2e18 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h +@@ -38,16 +38,23 @@ + #define MLX5E_TC_FLOW_ID_MASK 0x0000ffff + + #ifdef CONFIG_MLX5_ESWITCH ++ ++enum { ++ MLX5E_TC_INGRESS = BIT(0), ++ MLX5E_TC_EGRESS = BIT(1), ++ MLX5E_TC_LAST_EXPORTED_BIT = 1, ++}; ++ + int mlx5e_tc_init(struct mlx5e_priv *priv); + void mlx5e_tc_cleanup(struct mlx5e_priv *priv); + + int mlx5e_configure_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f); ++ struct tc_cls_flower_offload *f, int flags); + int mlx5e_delete_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f); ++ struct tc_cls_flower_offload *f, int flags); + + int mlx5e_stats_flower(struct mlx5e_priv *priv, +- struct tc_cls_flower_offload *f); ++ struct tc_cls_flower_offload *f, int flags); + + struct mlx5e_encap_entry; + void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index c3a18ddf5dba..0a75e9d441e6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -2221,6 +2221,6 @@ free_out: + + u8 mlx5_eswitch_mode(struct mlx5_eswitch *esw) + { +- return esw->mode; ++ return ESW_ALLOWED(esw) ? esw->mode : SRIOV_NONE; + } + EXPORT_SYMBOL_GPL(mlx5_eswitch_mode); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index 857035583ccd..c14e7fc11d8a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -487,6 +487,7 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev, + void mlx5_init_clock(struct mlx5_core_dev *mdev) + { + struct mlx5_clock *clock = &mdev->clock; ++ u64 overflow_cycles; + u64 ns; + u64 frac = 0; + u32 dev_freq; +@@ -510,10 +511,17 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev) + + /* Calculate period in seconds to call the overflow watchdog - to make + * sure counter is checked at least once every wrap around. ++ * The period is calculated as the minimum between max HW cycles count ++ * (The clock source mask) and max amount of cycles that can be ++ * multiplied by clock multiplier where the result doesn't exceed ++ * 64bits. + */ +- ns = cyclecounter_cyc2ns(&clock->cycles, clock->cycles.mask, ++ overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult); ++ overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1); ++ ++ ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles, + frac, &frac); +- do_div(ns, NSEC_PER_SEC / 2 / HZ); ++ do_div(ns, NSEC_PER_SEC / HZ); + clock->overflow_period = ns; + + mdev->clock_info_page = alloc_page(GFP_KERNEL); +diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +index ec524d97869d..5ef61132604e 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +@@ -317,7 +317,7 @@ nfp_tun_write_neigh(struct net_device *netdev, struct nfp_app *app, + payload.dst_ipv4 = flow->daddr; + + /* If entry has expired send dst IP with all other fields 0. */ +- if (!(neigh->nud_state & NUD_VALID)) { ++ if (!(neigh->nud_state & NUD_VALID) || neigh->dead) { + nfp_tun_del_route_from_cache(app, payload.dst_ipv4); + /* Trigger ARP to verify invalid neighbour state. */ + neigh_event_send(neigh, NULL); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index c7aac1fc99e8..764b25fa470c 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8272,8 +8272,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + return rc; + } + +- /* override BIOS settings, use userspace tools to enable WOL */ +- __rtl8169_set_wol(tp, 0); ++ tp->saved_wolopts = __rtl8169_get_wol(tp); + + if (rtl_tbi_enabled(tp)) { + tp->set_speed = rtl8169_set_speed_tbi; +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 05c1e8ef15e6..69a8106b9b98 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -514,7 +514,7 @@ static int phy_start_aneg_priv(struct phy_device *phydev, bool sync) + * negotiation may already be done and aneg interrupt may not be + * generated. + */ +- if (phy_interrupt_is_valid(phydev) && (phydev->state == PHY_AN)) { ++ if (phydev->irq != PHY_POLL && phydev->state == PHY_AN) { + err = phy_aneg_done(phydev); + if (err > 0) { + trigger = true; +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 4b170599fa5e..3b050817bbda 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -636,8 +636,61 @@ static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff) + return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr)); + } + +-/* Add new entry to forwarding table -- assumes lock held */ ++static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, ++ const u8 *mac, __u16 state, ++ __be32 src_vni, __u8 ndm_flags) ++{ ++ struct vxlan_fdb *f; ++ ++ f = kmalloc(sizeof(*f), GFP_ATOMIC); ++ if (!f) ++ return NULL; ++ f->state = state; ++ f->flags = ndm_flags; ++ f->updated = f->used = jiffies; ++ f->vni = src_vni; ++ INIT_LIST_HEAD(&f->remotes); ++ memcpy(f->eth_addr, mac, ETH_ALEN); ++ ++ return f; ++} ++ + static int vxlan_fdb_create(struct vxlan_dev *vxlan, ++ const u8 *mac, union vxlan_addr *ip, ++ __u16 state, __be16 port, __be32 src_vni, ++ __be32 vni, __u32 ifindex, __u8 ndm_flags, ++ struct vxlan_fdb **fdb) ++{ ++ struct vxlan_rdst *rd = NULL; ++ struct vxlan_fdb *f; ++ int rc; ++ ++ if (vxlan->cfg.addrmax && ++ vxlan->addrcnt >= vxlan->cfg.addrmax) ++ return -ENOSPC; ++ ++ netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); ++ f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags); ++ if (!f) ++ return -ENOMEM; ++ ++ rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); ++ if (rc < 0) { ++ kfree(f); ++ return rc; ++ } ++ ++ ++vxlan->addrcnt; ++ hlist_add_head_rcu(&f->hlist, ++ vxlan_fdb_head(vxlan, mac, src_vni)); ++ ++ *fdb = f; ++ ++ return 0; ++} ++ ++/* Add new entry to forwarding table -- assumes lock held */ ++static int vxlan_fdb_update(struct vxlan_dev *vxlan, + const u8 *mac, union vxlan_addr *ip, + __u16 state, __u16 flags, + __be16 port, __be32 src_vni, __be32 vni, +@@ -687,37 +740,17 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan, + if (!(flags & NLM_F_CREATE)) + return -ENOENT; + +- if (vxlan->cfg.addrmax && +- vxlan->addrcnt >= vxlan->cfg.addrmax) +- return -ENOSPC; +- + /* Disallow replace to add a multicast entry */ + if ((flags & NLM_F_REPLACE) && + (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac))) + return -EOPNOTSUPP; + + netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); +- f = kmalloc(sizeof(*f), GFP_ATOMIC); +- if (!f) +- return -ENOMEM; +- +- notify = 1; +- f->state = state; +- f->flags = ndm_flags; +- f->updated = f->used = jiffies; +- f->vni = src_vni; +- INIT_LIST_HEAD(&f->remotes); +- memcpy(f->eth_addr, mac, ETH_ALEN); +- +- rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); +- if (rc < 0) { +- kfree(f); ++ rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni, ++ vni, ifindex, ndm_flags, &f); ++ if (rc < 0) + return rc; +- } +- +- ++vxlan->addrcnt; +- hlist_add_head_rcu(&f->hlist, +- vxlan_fdb_head(vxlan, mac, src_vni)); ++ notify = 1; + } + + if (notify) { +@@ -741,13 +774,15 @@ static void vxlan_fdb_free(struct rcu_head *head) + kfree(f); + } + +-static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f) ++static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f, ++ bool do_notify) + { + netdev_dbg(vxlan->dev, + "delete %pM\n", f->eth_addr); + + --vxlan->addrcnt; +- vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH); ++ if (do_notify) ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH); + + hlist_del_rcu(&f->hlist); + call_rcu(&f->rcu, vxlan_fdb_free); +@@ -863,7 +898,7 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], + return -EAFNOSUPPORT; + + spin_lock_bh(&vxlan->hash_lock); +- err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags, ++ err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags, + port, src_vni, vni, ifindex, ndm->ndm_flags); + spin_unlock_bh(&vxlan->hash_lock); + +@@ -897,7 +932,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan, + goto out; + } + +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + + out: + return 0; +@@ -1006,7 +1041,7 @@ static bool vxlan_snoop(struct net_device *dev, + + /* close off race between vxlan_flush and incoming packets */ + if (netif_running(dev)) +- vxlan_fdb_create(vxlan, src_mac, src_ip, ++ vxlan_fdb_update(vxlan, src_mac, src_ip, + NUD_REACHABLE, + NLM_F_EXCL|NLM_F_CREATE, + vxlan->cfg.dst_port, +@@ -2360,7 +2395,7 @@ static void vxlan_cleanup(struct timer_list *t) + "garbage collect %pM\n", + f->eth_addr); + f->state = NUD_STALE; +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + } else if (time_before(timeout, next_timer)) + next_timer = timeout; + } +@@ -2411,7 +2446,7 @@ static void vxlan_fdb_delete_default(struct vxlan_dev *vxlan, __be32 vni) + spin_lock_bh(&vxlan->hash_lock); + f = __vxlan_find_mac(vxlan, all_zeros_mac, vni); + if (f) +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + spin_unlock_bh(&vxlan->hash_lock); + } + +@@ -2465,7 +2500,7 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all) + continue; + /* the all_zeros_mac entry is deleted at vxlan_uninit */ + if (!is_zero_ether_addr(f->eth_addr)) +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + } + } + spin_unlock_bh(&vxlan->hash_lock); +@@ -3155,6 +3190,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + { + struct vxlan_net *vn = net_generic(net, vxlan_net_id); + struct vxlan_dev *vxlan = netdev_priv(dev); ++ struct vxlan_fdb *f = NULL; + int err; + + err = vxlan_dev_configure(net, dev, conf, false, extack); +@@ -3168,24 +3204,35 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + err = vxlan_fdb_create(vxlan, all_zeros_mac, + &vxlan->default_dst.remote_ip, + NUD_REACHABLE | NUD_PERMANENT, +- NLM_F_EXCL | NLM_F_CREATE, + vxlan->cfg.dst_port, + vxlan->default_dst.remote_vni, + vxlan->default_dst.remote_vni, + vxlan->default_dst.remote_ifindex, +- NTF_SELF); ++ NTF_SELF, &f); + if (err) + return err; + } + + err = register_netdevice(dev); ++ if (err) ++ goto errout; ++ ++ err = rtnl_configure_link(dev, NULL); + if (err) { +- vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni); +- return err; ++ unregister_netdevice(dev); ++ goto errout; + } + ++ /* notify default fdb entry */ ++ if (f) ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH); ++ + list_add(&vxlan->next, &vn->vxlan_list); + return 0; ++errout: ++ if (f) ++ vxlan_fdb_destroy(vxlan, f, false); ++ return err; + } + + static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[], +@@ -3414,6 +3461,7 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + struct vxlan_rdst *dst = &vxlan->default_dst; + struct vxlan_rdst old_dst; + struct vxlan_config conf; ++ struct vxlan_fdb *f = NULL; + int err; + + err = vxlan_nl2conf(tb, data, +@@ -3442,16 +3490,16 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + err = vxlan_fdb_create(vxlan, all_zeros_mac, + &dst->remote_ip, + NUD_REACHABLE | NUD_PERMANENT, +- NLM_F_CREATE | NLM_F_APPEND, + vxlan->cfg.dst_port, + dst->remote_vni, + dst->remote_vni, + dst->remote_ifindex, +- NTF_SELF); ++ NTF_SELF, &f); + if (err) { + spin_unlock_bh(&vxlan->hash_lock); + return err; + } ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH); + } + spin_unlock_bh(&vxlan->hash_lock); + } +diff --git a/drivers/staging/rtl8188eu/Kconfig b/drivers/staging/rtl8188eu/Kconfig +index 673fdce25530..ff7832798a77 100644 +--- a/drivers/staging/rtl8188eu/Kconfig ++++ b/drivers/staging/rtl8188eu/Kconfig +@@ -7,7 +7,6 @@ config R8188EU + select LIB80211 + select LIB80211_CRYPT_WEP + select LIB80211_CRYPT_CCMP +- select LIB80211_CRYPT_TKIP + ---help--- + This option adds the Realtek RTL8188EU USB device such as TP-Link TL-WN725N. + If built as a module, it will be called r8188eu. +diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c +index 05936a45eb93..c6857a5be12a 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_recv.c ++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c +@@ -23,7 +23,6 @@ + #include <mon.h> + #include <wifi.h> + #include <linux/vmalloc.h> +-#include <net/lib80211.h> + + #define ETHERNET_HEADER_SIZE 14 /* Ethernet Header Length */ + #define LLC_HEADER_SIZE 6 /* LLC Header Length */ +@@ -221,20 +220,31 @@ u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter) + static int recvframe_chkmic(struct adapter *adapter, + struct recv_frame *precvframe) + { +- int res = _SUCCESS; +- struct rx_pkt_attrib *prxattrib = &precvframe->attrib; +- struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta); ++ int i, res = _SUCCESS; ++ u32 datalen; ++ u8 miccode[8]; ++ u8 bmic_err = false, brpt_micerror = true; ++ u8 *pframe, *payload, *pframemic; ++ u8 *mickey; ++ struct sta_info *stainfo; ++ struct rx_pkt_attrib *prxattrib = &precvframe->attrib; ++ struct security_priv *psecuritypriv = &adapter->securitypriv; ++ ++ struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv; ++ struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info); ++ ++ stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]); + + if (prxattrib->encrypt == _TKIP_) { ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ++ ("\n %s: prxattrib->encrypt==_TKIP_\n", __func__)); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ++ ("\n %s: da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", ++ __func__, prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2], ++ prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5])); ++ ++ /* calculate mic code */ + if (stainfo) { +- int key_idx; +- const int iv_len = 8, icv_len = 4, key_length = 32; +- struct sk_buff *skb = precvframe->pkt; +- u8 key[32], iv[8], icv[4], *pframe = skb->data; +- void *crypto_private = NULL; +- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip"); +- struct security_priv *psecuritypriv = &adapter->securitypriv; +- + if (IS_MCAST(prxattrib->ra)) { + if (!psecuritypriv) { + res = _FAIL; +@@ -243,58 +253,115 @@ static int recvframe_chkmic(struct adapter *adapter, + DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__); + goto exit; + } +- key_idx = prxattrib->key_index; +- memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16); +- memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16); ++ mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0]; ++ ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ++ ("\n %s: bcmc key\n", __func__)); + } else { +- key_idx = 0; +- memcpy(key, stainfo->dot118021x_UncstKey.skey, 16); +- memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16); ++ mickey = &stainfo->dot11tkiprxmickey.skey[0]; ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("\n %s: unicast key\n", __func__)); + } + +- if (!crypto_ops) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } ++ /* icv_len included the mic code */ ++ datalen = precvframe->pkt->len-prxattrib->hdrlen - ++ prxattrib->iv_len-prxattrib->icv_len-8; ++ pframe = precvframe->pkt->data; ++ payload = pframe+prxattrib->hdrlen+prxattrib->iv_len; + +- memcpy(iv, pframe + prxattrib->hdrlen, iv_len); +- memcpy(icv, pframe + skb->len - icv_len, icv_len); +- memmove(pframe + iv_len, pframe, prxattrib->hdrlen); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len)); ++ rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0], ++ (unsigned char)prxattrib->priority); /* care the length of the data */ + +- skb_pull(skb, iv_len); +- skb_trim(skb, skb->len - icv_len); ++ pframemic = payload+datalen; + +- crypto_private = crypto_ops->init(key_idx); +- if (!crypto_private) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } +- if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } +- if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) { +- res = _FAIL; +- goto exit_lib80211_tkip; ++ bmic_err = false; ++ ++ for (i = 0; i < 8; i++) { ++ if (miccode[i] != *(pframemic+i)) { ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("%s: miccode[%d](%02x)!=*(pframemic+%d)(%02x) ", ++ __func__, i, miccode[i], i, *(pframemic + i))); ++ bmic_err = true; ++ } + } + +- memmove(pframe, pframe + iv_len, prxattrib->hdrlen); +- skb_push(skb, iv_len); +- skb_put(skb, icv_len); ++ if (bmic_err) { ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", ++ *(pframemic-8), *(pframemic-7), *(pframemic-6), ++ *(pframemic-5), *(pframemic-4), *(pframemic-3), ++ *(pframemic-2), *(pframemic-1))); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n", ++ *(pframemic-16), *(pframemic-15), *(pframemic-14), ++ *(pframemic-13), *(pframemic-12), *(pframemic-11), ++ *(pframemic-10), *(pframemic-9))); ++ { ++ uint i; + +- memcpy(pframe + prxattrib->hdrlen, iv, iv_len); +- memcpy(pframe + skb->len - icv_len, icv, icv_len); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("\n ======demp packet (len=%d)======\n", ++ precvframe->pkt->len)); ++ for (i = 0; i < precvframe->pkt->len; i += 8) { ++ RT_TRACE(_module_rtl871x_recv_c_, ++ _drv_err_, ++ ("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x", ++ *(precvframe->pkt->data+i), ++ *(precvframe->pkt->data+i+1), ++ *(precvframe->pkt->data+i+2), ++ *(precvframe->pkt->data+i+3), ++ *(precvframe->pkt->data+i+4), ++ *(precvframe->pkt->data+i+5), ++ *(precvframe->pkt->data+i+6), ++ *(precvframe->pkt->data+i+7))); ++ } ++ RT_TRACE(_module_rtl871x_recv_c_, ++ _drv_err_, ++ ("\n ====== demp packet end [len=%d]======\n", ++ precvframe->pkt->len)); ++ RT_TRACE(_module_rtl871x_recv_c_, ++ _drv_err_, ++ ("\n hrdlen=%d,\n", ++ prxattrib->hdrlen)); ++ } + +-exit_lib80211_tkip: +- if (crypto_ops && crypto_private) +- crypto_ops->deinit(crypto_private); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ++ ("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ", ++ prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2], ++ prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey)); ++ ++ /* double check key_index for some timing issue , */ ++ /* cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */ ++ if ((IS_MCAST(prxattrib->ra) == true) && (prxattrib->key_index != pmlmeinfo->key_index)) ++ brpt_micerror = false; ++ ++ if ((prxattrib->bdecrypted) && (brpt_micerror)) { ++ rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra)); ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted)); ++ DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted); ++ } else { ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted)); ++ DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted); ++ } ++ res = _FAIL; ++ } else { ++ /* mic checked ok */ ++ if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) { ++ psecuritypriv->bcheck_grpkey = true; ++ RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true")); ++ } ++ } + } else { + RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, + ("%s: rtw_get_stainfo==NULL!!!\n", __func__)); + } ++ ++ skb_trim(precvframe->pkt, precvframe->pkt->len - 8); + } + + exit: ++ + return res; + } + +diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c +index bfe0b217e679..67a2490f055e 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_security.c ++++ b/drivers/staging/rtl8188eu/core/rtw_security.c +@@ -650,71 +650,71 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe) + return res; + } + ++/* The hlen isn't include the IV */ + u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) +-{ +- struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib; +- u32 res = _SUCCESS; ++{ /* exclude ICV */ ++ u16 pnl; ++ u32 pnh; ++ u8 rc4key[16]; ++ u8 ttkey[16]; ++ u8 crc[4]; ++ struct arc4context mycontext; ++ int length; ++ ++ u8 *pframe, *payload, *iv, *prwskey; ++ union pn48 dot11txpn; ++ struct sta_info *stainfo; ++ struct rx_pkt_attrib *prxattrib = &((struct recv_frame *)precvframe)->attrib; ++ struct security_priv *psecuritypriv = &padapter->securitypriv; ++ u32 res = _SUCCESS; ++ ++ ++ pframe = (unsigned char *)((struct recv_frame *)precvframe)->pkt->data; + + /* 4 start to decrypt recvframe */ + if (prxattrib->encrypt == _TKIP_) { +- struct sta_info *stainfo = rtw_get_stainfo(&padapter->stapriv, prxattrib->ta); +- ++ stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]); + if (stainfo) { +- int key_idx; +- const int iv_len = 8, icv_len = 4, key_length = 32; +- void *crypto_private = NULL; +- struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt; +- u8 key[32], iv[8], icv[4], *pframe = skb->data; +- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip"); +- struct security_priv *psecuritypriv = &padapter->securitypriv; +- + if (IS_MCAST(prxattrib->ra)) { + if (!psecuritypriv->binstallGrpkey) { + res = _FAIL; + DBG_88E("%s:rx bc/mc packets, but didn't install group key!!!!!!!!!!\n", __func__); + goto exit; + } +- key_idx = prxattrib->key_index; +- memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16); +- memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16); ++ prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey; + } else { +- key_idx = 0; +- memcpy(key, stainfo->dot118021x_UncstKey.skey, 16); +- memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16); ++ RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("%s: stainfo!= NULL!!!\n", __func__)); ++ prwskey = &stainfo->dot118021x_UncstKey.skey[0]; + } + +- if (!crypto_ops) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } ++ iv = pframe+prxattrib->hdrlen; ++ payload = pframe+prxattrib->iv_len+prxattrib->hdrlen; ++ length = ((struct recv_frame *)precvframe)->pkt->len-prxattrib->hdrlen-prxattrib->iv_len; + +- memcpy(iv, pframe + prxattrib->hdrlen, iv_len); +- memcpy(icv, pframe + skb->len - icv_len, icv_len); ++ GET_TKIP_PN(iv, dot11txpn); + +- crypto_private = crypto_ops->init(key_idx); +- if (!crypto_private) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } +- if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } +- if (crypto_ops->decrypt_mpdu(skb, prxattrib->hdrlen, crypto_private)) { +- res = _FAIL; +- goto exit_lib80211_tkip; +- } ++ pnl = (u16)(dot11txpn.val); ++ pnh = (u32)(dot11txpn.val>>16); + +- memmove(pframe, pframe + iv_len, prxattrib->hdrlen); +- skb_push(skb, iv_len); +- skb_put(skb, icv_len); ++ phase1((u16 *)&ttkey[0], prwskey, &prxattrib->ta[0], pnh); ++ phase2(&rc4key[0], prwskey, (unsigned short *)&ttkey[0], pnl); + +- memcpy(pframe + prxattrib->hdrlen, iv, iv_len); +- memcpy(pframe + skb->len - icv_len, icv, icv_len); ++ /* 4 decrypt payload include icv */ + +-exit_lib80211_tkip: +- if (crypto_ops && crypto_private) +- crypto_ops->deinit(crypto_private); ++ arcfour_init(&mycontext, rc4key, 16); ++ arcfour_encrypt(&mycontext, payload, payload, length); ++ ++ *((__le32 *)crc) = getcrc32(payload, length-4); ++ ++ if (crc[3] != payload[length-1] || ++ crc[2] != payload[length-2] || ++ crc[1] != payload[length-3] || ++ crc[0] != payload[length-4]) { ++ RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ++ ("rtw_wep_decrypt:icv error crc (%4ph)!=payload (%4ph)\n", ++ &crc, &payload[length-4])); ++ res = _FAIL; ++ } + } else { + RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_tkip_decrypt: stainfo==NULL!!!\n")); + res = _FAIL; +diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c +index 0a1a7c259ab0..2f8f4ed62e40 100644 +--- a/drivers/staging/speakup/speakup_soft.c ++++ b/drivers/staging/speakup/speakup_soft.c +@@ -197,11 +197,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + int chars_sent = 0; + char __user *cp; + char *init; ++ size_t bytes_per_ch = unicode ? 3 : 1; + u16 ch; + int empty; + unsigned long flags; + DEFINE_WAIT(wait); + ++ if (count < bytes_per_ch) ++ return -EINVAL; ++ + spin_lock_irqsave(&speakup_info.spinlock, flags); + while (1) { + prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE); +@@ -227,7 +231,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + init = get_initstring(); + + /* Keep 3 bytes available for a 16bit UTF-8-encoded character */ +- while (chars_sent <= count - 3) { ++ while (chars_sent <= count - bytes_per_ch) { + if (speakup_info.flushing) { + speakup_info.flushing = 0; + ch = '\x18'; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 998b32d0167e..75c4623ad779 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1831,6 +1831,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ + .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ + }, ++ { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ ++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ ++ }, + + { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ + .driver_info = CLEAR_HALT_CONDITIONS, +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index e3bf65e213cd..40c2d9878190 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1142,10 +1142,14 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + + if (!udev || udev->state == USB_STATE_NOTATTACHED) { + /* Tell hub_wq to disconnect the device or +- * check for a new connection ++ * check for a new connection or over current condition. ++ * Based on USB2.0 Spec Section 11.12.5, ++ * C_PORT_OVER_CURRENT could be set while ++ * PORT_OVER_CURRENT is not. So check for any of them. + */ + if (udev || (portstatus & USB_PORT_STAT_CONNECTION) || +- (portstatus & USB_PORT_STAT_OVERCURRENT)) ++ (portstatus & USB_PORT_STAT_OVERCURRENT) || ++ (portchange & USB_PORT_STAT_C_OVERCURRENT)) + set_bit(port1, hub->change_bits); + + } else if (portstatus & USB_PORT_STAT_ENABLE) { +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index c51b73b3e048..3a5f0005fae5 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -2627,34 +2627,29 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg, + + #define DWC2_USB_DMA_ALIGN 4 + +-struct dma_aligned_buffer { +- void *kmalloc_ptr; +- void *old_xfer_buffer; +- u8 data[0]; +-}; +- + static void dwc2_free_dma_aligned_buffer(struct urb *urb) + { +- struct dma_aligned_buffer *temp; ++ void *stored_xfer_buffer; + + if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER)) + return; + +- temp = container_of(urb->transfer_buffer, +- struct dma_aligned_buffer, data); ++ /* Restore urb->transfer_buffer from the end of the allocated area */ ++ memcpy(&stored_xfer_buffer, urb->transfer_buffer + ++ urb->transfer_buffer_length, sizeof(urb->transfer_buffer)); + + if (usb_urb_dir_in(urb)) +- memcpy(temp->old_xfer_buffer, temp->data, ++ memcpy(stored_xfer_buffer, urb->transfer_buffer, + urb->transfer_buffer_length); +- urb->transfer_buffer = temp->old_xfer_buffer; +- kfree(temp->kmalloc_ptr); ++ kfree(urb->transfer_buffer); ++ urb->transfer_buffer = stored_xfer_buffer; + + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER; + } + + static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) + { +- struct dma_aligned_buffer *temp, *kmalloc_ptr; ++ void *kmalloc_ptr; + size_t kmalloc_size; + + if (urb->num_sgs || urb->sg || +@@ -2662,22 +2657,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) + !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1))) + return 0; + +- /* Allocate a buffer with enough padding for alignment */ ++ /* ++ * Allocate a buffer with enough padding for original transfer_buffer ++ * pointer. This allocation is guaranteed to be aligned properly for ++ * DMA ++ */ + kmalloc_size = urb->transfer_buffer_length + +- sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1; ++ sizeof(urb->transfer_buffer); + + kmalloc_ptr = kmalloc(kmalloc_size, mem_flags); + if (!kmalloc_ptr) + return -ENOMEM; + +- /* Position our struct dma_aligned_buffer such that data is aligned */ +- temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1; +- temp->kmalloc_ptr = kmalloc_ptr; +- temp->old_xfer_buffer = urb->transfer_buffer; ++ /* ++ * Position value of original urb->transfer_buffer pointer to the end ++ * of allocation for later referencing ++ */ ++ memcpy(kmalloc_ptr + urb->transfer_buffer_length, ++ &urb->transfer_buffer, sizeof(urb->transfer_buffer)); ++ + if (usb_urb_dir_out(urb)) +- memcpy(temp->data, urb->transfer_buffer, ++ memcpy(kmalloc_ptr, urb->transfer_buffer, + urb->transfer_buffer_length); +- urb->transfer_buffer = temp->data; ++ urb->transfer_buffer = kmalloc_ptr; + + urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER; + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 63a7cb87514a..330c591fd7d6 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1816,7 +1816,6 @@ unknown: + if (cdev->use_os_string && cdev->os_desc_config && + (ctrl->bRequestType & USB_TYPE_VENDOR) && + ctrl->bRequest == cdev->b_vendor_code) { +- struct usb_request *req; + struct usb_configuration *os_desc_cfg; + u8 *buf; + int interface; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 0294e4f18873..7e57439ac282 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3242,7 +3242,7 @@ static int ffs_func_setup(struct usb_function *f, + __ffs_event_add(ffs, FUNCTIONFS_SETUP); + spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); + +- return USB_GADGET_DELAYED_STATUS; ++ return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; + } + + static bool ffs_func_req_match(struct usb_function *f, +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 61c3dc2f3be5..5fb4319d7fd1 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -2981,6 +2981,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd, + if (!list_empty(&ep->ring->td_list)) { + dev_err(&udev->dev, "EP not empty, refuse reset\n"); + spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_free_command(xhci, cfg_cmd); + goto cleanup; + } + xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0); +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index 2da5f054257a..7cd63b0c1a46 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -467,7 +467,7 @@ static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container, + if (!mem) + return -EINVAL; + +- ret = mm_iommu_ua_to_hpa(mem, tce, phpa); ++ ret = mm_iommu_ua_to_hpa(mem, tce, shift, phpa); + if (ret) + return -EINVAL; + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 9c9b3768b350..9cf770150539 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -342,6 +342,7 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); + ++void tcp_enter_quickack_mode(struct sock *sk); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +@@ -535,6 +536,7 @@ void tcp_send_fin(struct sock *sk); + void tcp_send_active_reset(struct sock *sk, gfp_t priority); + int tcp_send_synack(struct sock *); + void tcp_push_one(struct sock *, unsigned int mss_now); ++void __tcp_send_ack(struct sock *sk, u32 rcv_nxt); + void tcp_send_ack(struct sock *sk); + void tcp_send_delayed_ack(struct sock *sk); + void tcp_send_loss_probe(struct sock *sk); +@@ -826,6 +828,11 @@ struct tcp_skb_cb { + * as TCP moves IP6CB into a different location in skb->cb[] + */ + static inline int tcp_v6_iif(const struct sk_buff *skb) ++{ ++ return TCP_SKB_CB(skb)->header.h6.iif; ++} ++ ++static inline int tcp_v6_iif_l3_slave(const struct sk_buff *skb) + { + bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags); + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 19f6ab5de6e1..3dab3c7b6831 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2749,9 +2749,12 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm) + return err; + } + +- dev->rtnl_link_state = RTNL_LINK_INITIALIZED; +- +- __dev_notify_flags(dev, old_flags, ~0U); ++ if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) { ++ __dev_notify_flags(dev, old_flags, 0U); ++ } else { ++ dev->rtnl_link_state = RTNL_LINK_INITIALIZED; ++ __dev_notify_flags(dev, old_flags, ~0U); ++ } + return 0; + } + EXPORT_SYMBOL(rtnl_configure_link); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index a84d69c047ac..b2d457df7d86 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3705,6 +3705,7 @@ normal: + net_warn_ratelimited( + "skb_segment: too many frags: %u %u\n", + pos, mss); ++ err = -EINVAL; + goto err; + } + +@@ -3738,11 +3739,10 @@ skip_fraglist: + + perform_csum_check: + if (!csum) { +- if (skb_has_shared_frag(nskb)) { +- err = __skb_linearize(nskb); +- if (err) +- goto err; +- } ++ if (skb_has_shared_frag(nskb) && ++ __skb_linearize(nskb)) ++ goto err; ++ + if (!nskb->remcsum_offload) + nskb->ip_summed = CHECKSUM_NONE; + SKB_GSO_CB(nskb)->csum = +diff --git a/net/core/sock.c b/net/core/sock.c +index 3b6d02854e57..f82843756534 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2270,9 +2270,9 @@ int sk_alloc_sg(struct sock *sk, int len, struct scatterlist *sg, + pfrag->offset += use; + + sge = sg + sg_curr - 1; +- if (sg_curr > first_coalesce && sg_page(sg) == pfrag->page && +- sg->offset + sg->length == orig_offset) { +- sg->length += use; ++ if (sg_curr > first_coalesce && sg_page(sge) == pfrag->page && ++ sge->offset + sge->length == orig_offset) { ++ sge->length += use; + } else { + sge = sg + sg_curr; + sg_unmark_end(sge); +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index b26a81a7de42..4af0625344a0 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -1201,8 +1201,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im) + if (pmc) { + im->interface = pmc->interface; + im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv; +- im->sfmode = pmc->sfmode; +- if (pmc->sfmode == MCAST_INCLUDE) { ++ if (im->sfmode == MCAST_INCLUDE) { + im->tomb = pmc->tomb; + im->sources = pmc->sources; + for (psf = im->sources; psf; psf = psf->sf_next) +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index d54abc097800..267b69cfea71 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -523,6 +523,8 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) + to->dev = from->dev; + to->mark = from->mark; + ++ skb_copy_hash(to, from); ++ + /* Copy the flags to each fragment. */ + IPCB(to)->flags = IPCB(from)->flags; + +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 57bbb060faaf..7c14c7818ead 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -148,15 +148,18 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) + { + struct sockaddr_in sin; + const struct iphdr *iph = ip_hdr(skb); +- __be16 *ports = (__be16 *)skb_transport_header(skb); ++ __be16 *ports; ++ int end; + +- if (skb_transport_offset(skb) + 4 > (int)skb->len) ++ end = skb_transport_offset(skb) + 4; ++ if (end > 0 && !pskb_may_pull(skb, end)) + return; + + /* All current transport protocols have the port numbers in the + * first four bytes of the transport header and this function is + * written with this assumption in mind. + */ ++ ports = (__be16 *)skb_transport_header(skb); + + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = iph->daddr; +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index 5f5e5936760e..c78fb53988a1 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -131,23 +131,14 @@ static void dctcp_ce_state_0_to_1(struct sock *sk) + struct dctcp *ca = inet_csk_ca(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- /* State has changed from CE=0 to CE=1 and delayed +- * ACK has not sent yet. +- */ +- if (!ca->ce_state && ca->delayed_ack_reserved) { +- u32 tmp_rcv_nxt; +- +- /* Save current rcv_nxt. */ +- tmp_rcv_nxt = tp->rcv_nxt; +- +- /* Generate previous ack with CE=0. */ +- tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR; +- tp->rcv_nxt = ca->prior_rcv_nxt; +- +- tcp_send_ack(sk); +- +- /* Recover current rcv_nxt. */ +- tp->rcv_nxt = tmp_rcv_nxt; ++ if (!ca->ce_state) { ++ /* State has changed from CE=0 to CE=1, force an immediate ++ * ACK to reflect the new CE state. If an ACK was delayed, ++ * send that first to reflect the prior CE state. ++ */ ++ if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) ++ __tcp_send_ack(sk, ca->prior_rcv_nxt); ++ tcp_enter_quickack_mode(sk); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +@@ -161,23 +152,14 @@ static void dctcp_ce_state_1_to_0(struct sock *sk) + struct dctcp *ca = inet_csk_ca(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- /* State has changed from CE=1 to CE=0 and delayed +- * ACK has not sent yet. +- */ +- if (ca->ce_state && ca->delayed_ack_reserved) { +- u32 tmp_rcv_nxt; +- +- /* Save current rcv_nxt. */ +- tmp_rcv_nxt = tp->rcv_nxt; +- +- /* Generate previous ack with CE=1. */ +- tp->ecn_flags |= TCP_ECN_DEMAND_CWR; +- tp->rcv_nxt = ca->prior_rcv_nxt; +- +- tcp_send_ack(sk); +- +- /* Recover current rcv_nxt. */ +- tp->rcv_nxt = tmp_rcv_nxt; ++ if (ca->ce_state) { ++ /* State has changed from CE=1 to CE=0, force an immediate ++ * ACK to reflect the new CE state. If an ACK was delayed, ++ * send that first to reflect the prior CE state. ++ */ ++ if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) ++ __tcp_send_ack(sk, ca->prior_rcv_nxt); ++ tcp_enter_quickack_mode(sk); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 1f25ebab25d2..0f5e9510c3fa 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -195,13 +195,14 @@ static void tcp_incr_quickack(struct sock *sk) + icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS); + } + +-static void tcp_enter_quickack_mode(struct sock *sk) ++void tcp_enter_quickack_mode(struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); + tcp_incr_quickack(sk); + icsk->icsk_ack.pingpong = 0; + icsk->icsk_ack.ato = TCP_ATO_MIN; + } ++EXPORT_SYMBOL(tcp_enter_quickack_mode); + + /* Send ACKs quickly, if "quick" count is not exhausted + * and the session is not interactive. +@@ -4298,6 +4299,23 @@ static bool tcp_try_coalesce(struct sock *sk, + return true; + } + ++static bool tcp_ooo_try_coalesce(struct sock *sk, ++ struct sk_buff *to, ++ struct sk_buff *from, ++ bool *fragstolen) ++{ ++ bool res = tcp_try_coalesce(sk, to, from, fragstolen); ++ ++ /* In case tcp_drop() is called later, update to->gso_segs */ ++ if (res) { ++ u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) + ++ max_t(u16, 1, skb_shinfo(from)->gso_segs); ++ ++ skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF); ++ } ++ return res; ++} ++ + static void tcp_drop(struct sock *sk, struct sk_buff *skb) + { + sk_drops_add(sk, skb); +@@ -4421,8 +4439,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + /* In the typical case, we are adding an skb to the end of the list. + * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup. + */ +- if (tcp_try_coalesce(sk, tp->ooo_last_skb, +- skb, &fragstolen)) { ++ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, ++ skb, &fragstolen)) { + coalesce_done: + tcp_grow_window(sk, skb); + kfree_skb_partial(skb, fragstolen); +@@ -4450,7 +4468,7 @@ coalesce_done: + /* All the bits are present. Drop. */ + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + skb = NULL; + tcp_dsack_set(sk, seq, end_seq); + goto add_sack; +@@ -4469,11 +4487,11 @@ coalesce_done: + TCP_SKB_CB(skb1)->end_seq); + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb1); ++ tcp_drop(sk, skb1); + goto merge_right; + } +- } else if (tcp_try_coalesce(sk, skb1, +- skb, &fragstolen)) { ++ } else if (tcp_ooo_try_coalesce(sk, skb1, ++ skb, &fragstolen)) { + goto coalesce_done; + } + p = &parent->rb_right; +@@ -4833,6 +4851,7 @@ end: + static void tcp_collapse_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); ++ u32 range_truesize, sum_tiny = 0; + struct sk_buff *skb, *head; + u32 start, end; + +@@ -4844,6 +4863,7 @@ new_range: + } + start = TCP_SKB_CB(skb)->seq; + end = TCP_SKB_CB(skb)->end_seq; ++ range_truesize = skb->truesize; + + for (head = skb;;) { + skb = skb_rb_next(skb); +@@ -4854,11 +4874,20 @@ new_range: + if (!skb || + after(TCP_SKB_CB(skb)->seq, end) || + before(TCP_SKB_CB(skb)->end_seq, start)) { +- tcp_collapse(sk, NULL, &tp->out_of_order_queue, +- head, skb, start, end); ++ /* Do not attempt collapsing tiny skbs */ ++ if (range_truesize != head->truesize || ++ end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) { ++ tcp_collapse(sk, NULL, &tp->out_of_order_queue, ++ head, skb, start, end); ++ } else { ++ sum_tiny += range_truesize; ++ if (sum_tiny > sk->sk_rcvbuf >> 3) ++ return; ++ } + goto new_range; + } + ++ range_truesize += skb->truesize; + if (unlikely(before(TCP_SKB_CB(skb)->seq, start))) + start = TCP_SKB_CB(skb)->seq; + if (after(TCP_SKB_CB(skb)->end_seq, end)) +@@ -4873,6 +4902,7 @@ new_range: + * 2) not add too big latencies if thousands of packets sit there. + * (But if application shrinks SO_RCVBUF, we could still end up + * freeing whole queue here) ++ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks. + * + * Return true if queue has shrunk. + */ +@@ -4880,20 +4910,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + struct rb_node *node, *prev; ++ int goal; + + if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) + return false; + + NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED); ++ goal = sk->sk_rcvbuf >> 3; + node = &tp->ooo_last_skb->rbnode; + do { + prev = rb_prev(node); + rb_erase(node, &tp->out_of_order_queue); ++ goal -= rb_to_skb(node)->truesize; + tcp_drop(sk, rb_to_skb(node)); +- sk_mem_reclaim(sk); +- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && +- !tcp_under_memory_pressure(sk)) +- break; ++ if (!prev || goal <= 0) { ++ sk_mem_reclaim(sk); ++ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && ++ !tcp_under_memory_pressure(sk)) ++ break; ++ goal = sk->sk_rcvbuf >> 3; ++ } + node = prev; + } while (node); + tp->ooo_last_skb = rb_to_skb(prev); +@@ -4928,6 +4964,9 @@ static int tcp_prune_queue(struct sock *sk) + else if (tcp_under_memory_pressure(sk)) + tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss); + ++ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) ++ return 0; ++ + tcp_collapse_ofo_queue(sk); + if (!skb_queue_empty(&sk->sk_receive_queue)) + tcp_collapse(sk, &sk->sk_receive_queue, NULL, +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index d07e34f8e309..3049d10a1476 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -160,8 +160,13 @@ static void tcp_event_data_sent(struct tcp_sock *tp, + } + + /* Account for an ACK we sent. */ +-static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts) ++static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts, ++ u32 rcv_nxt) + { ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (unlikely(rcv_nxt != tp->rcv_nxt)) ++ return; /* Special ACK sent by DCTCP to reflect ECN */ + tcp_dec_quickack_mode(sk, pkts); + inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK); + } +@@ -1031,8 +1036,8 @@ static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb) + * We are working here with either a clone of the original + * SKB, or a fresh unique copy made by the retransmit engine. + */ +-static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, +- gfp_t gfp_mask) ++static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, ++ int clone_it, gfp_t gfp_mask, u32 rcv_nxt) + { + const struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet; +@@ -1108,7 +1113,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + th->source = inet->inet_sport; + th->dest = inet->inet_dport; + th->seq = htonl(tcb->seq); +- th->ack_seq = htonl(tp->rcv_nxt); ++ th->ack_seq = htonl(rcv_nxt); + *(((__be16 *)th) + 6) = htons(((tcp_header_size >> 2) << 12) | + tcb->tcp_flags); + +@@ -1149,7 +1154,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + icsk->icsk_af_ops->send_check(sk, skb); + + if (likely(tcb->tcp_flags & TCPHDR_ACK)) +- tcp_event_ack_sent(sk, tcp_skb_pcount(skb)); ++ tcp_event_ack_sent(sk, tcp_skb_pcount(skb), rcv_nxt); + + if (skb->len != tcp_header_size) { + tcp_event_data_sent(tp, sk); +@@ -1186,6 +1191,13 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + return err; + } + ++static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, ++ gfp_t gfp_mask) ++{ ++ return __tcp_transmit_skb(sk, skb, clone_it, gfp_mask, ++ tcp_sk(sk)->rcv_nxt); ++} ++ + /* This routine just queues the buffer for sending. + * + * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames, +@@ -3583,7 +3595,7 @@ void tcp_send_delayed_ack(struct sock *sk) + } + + /* This routine sends an ack and also updates the window. */ +-void tcp_send_ack(struct sock *sk) ++void __tcp_send_ack(struct sock *sk, u32 rcv_nxt) + { + struct sk_buff *buff; + +@@ -3618,9 +3630,14 @@ void tcp_send_ack(struct sock *sk) + skb_set_tcp_pure_ack(buff); + + /* Send it off, this clears delayed acks for us. */ +- tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0); ++ __tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0, rcv_nxt); ++} ++EXPORT_SYMBOL_GPL(__tcp_send_ack); ++ ++void tcp_send_ack(struct sock *sk) ++{ ++ __tcp_send_ack(sk, tcp_sk(sk)->rcv_nxt); + } +-EXPORT_SYMBOL_GPL(tcp_send_ack); + + /* This routine sends a packet with an out of date sequence + * number. It assumes the other end will try to ack it. +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 2ee08b6a86a4..1a1f876f8e28 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -700,13 +700,16 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg, + } + if (np->rxopt.bits.rxorigdstaddr) { + struct sockaddr_in6 sin6; +- __be16 *ports = (__be16 *) skb_transport_header(skb); ++ __be16 *ports; ++ int end; + +- if (skb_transport_offset(skb) + 4 <= (int)skb->len) { ++ end = skb_transport_offset(skb) + 4; ++ if (end <= 0 || pskb_may_pull(skb, end)) { + /* All current transport protocols have the port numbers in the + * first four bytes of the transport header and this function is + * written with this assumption in mind. + */ ++ ports = (__be16 *)skb_transport_header(skb); + + sin6.sin6_family = AF_INET6; + sin6.sin6_addr = ipv6_hdr(skb)->daddr; +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index d8c4b6374377..ca893a798d8a 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -402,9 +402,10 @@ static int icmp6_iif(const struct sk_buff *skb) + + /* for local traffic to local address, skb dev is the loopback + * device. Check if there is a dst attached to the skb and if so +- * get the real device index. ++ * get the real device index. Same is needed for replies to a link ++ * local address on a device enslaved to an L3 master device + */ +- if (unlikely(iif == LOOPBACK_IFINDEX)) { ++ if (unlikely(iif == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) { + const struct rt6_info *rt6 = skb_rt6_info(skb); + + if (rt6) +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index af49f6cb5d3e..8f4c596a683d 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -596,6 +596,8 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) + to->dev = from->dev; + to->mark = from->mark; + ++ skb_copy_hash(to, from); ++ + #ifdef CONFIG_NET_SCHED + to->tc_index = from->tc_index; + #endif +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 793159d77d8a..0604a737eecf 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -771,8 +771,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) + if (pmc) { + im->idev = pmc->idev; + im->mca_crcount = idev->mc_qrv; +- im->mca_sfmode = pmc->mca_sfmode; +- if (pmc->mca_sfmode == MCAST_INCLUDE) { ++ if (im->mca_sfmode == MCAST_INCLUDE) { + im->mca_tomb = pmc->mca_tomb; + im->mca_sources = pmc->mca_sources; + for (psf = im->mca_sources; psf; psf = psf->sf_next) +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 5d4eb9d2c3a7..1adf7eb80d03 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -934,7 +934,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb) + &tcp_hashinfo, NULL, 0, + &ipv6h->saddr, + th->source, &ipv6h->daddr, +- ntohs(th->source), tcp_v6_iif(skb), ++ ntohs(th->source), ++ tcp_v6_iif_l3_slave(skb), + tcp_v6_sdif(skb)); + if (!sk1) + goto out; +@@ -1605,7 +1606,8 @@ do_time_wait: + skb, __tcp_hdrlen(th), + &ipv6_hdr(skb)->saddr, th->source, + &ipv6_hdr(skb)->daddr, +- ntohs(th->dest), tcp_v6_iif(skb), ++ ntohs(th->dest), ++ tcp_v6_iif_l3_slave(skb), + sdif); + if (sk2) { + struct inet_timewait_sock *tw = inet_twsk(sk); +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 9a7f91232de8..60708a4ebed4 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -646,6 +646,9 @@ static struct sk_buff *tls_wait_data(struct sock *sk, int flags, + return NULL; + } + ++ if (sk->sk_shutdown & RCV_SHUTDOWN) ++ return NULL; ++ + if (sock_flag(sk, SOCK_DONE)) + return NULL; +
