commit: 31dc94d27031b69ce9ee6a4acb3974a4e64a98b4 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Dec 1 15:01:51 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Dec 1 15:01:51 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=31dc94d2
proj/linux-patches: Linux patch 4.4.166 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1165_linux-4.4.166.patch | 2967 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2971 insertions(+) diff --git a/0000_README b/0000_README index d3f97eb..d122069 100644 --- a/0000_README +++ b/0000_README @@ -703,6 +703,10 @@ Patch: 1164_linux-4.4.165.patch From: http://www.kernel.org Desc: Linux 4.4.165 +Patch: 1165_linux-4.4.166.patch +From: http://www.kernel.org +Desc: Linux 4.4.166 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1165_linux-4.4.166.patch b/1165_linux-4.4.166.patch new file mode 100644 index 0000000..f5a8669 --- /dev/null +++ b/1165_linux-4.4.166.patch @@ -0,0 +1,2967 @@ +diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt +index 35e17f748ca7..af5859b2d0f9 100644 +--- a/Documentation/sysctl/fs.txt ++++ b/Documentation/sysctl/fs.txt +@@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/fs: + - overflowgid + - pipe-user-pages-hard + - pipe-user-pages-soft ++- protected_fifos + - protected_hardlinks ++- protected_regular + - protected_symlinks + - suid_dumpable + - super-max +@@ -182,6 +184,24 @@ applied. + + ============================================================== + ++protected_fifos: ++ ++The intent of this protection is to avoid unintentional writes to ++an attacker-controlled FIFO, where a program expected to create a regular ++file. ++ ++When set to "0", writing to FIFOs is unrestricted. ++ ++When set to "1" don't allow O_CREAT open on FIFOs that we don't own ++in world writable sticky directories, unless they are owned by the ++owner of the directory. ++ ++When set to "2" it also applies to group writable sticky directories. ++ ++This protection is based on the restrictions in Openwall. ++ ++============================================================== ++ + protected_hardlinks: + + A long-standing class of security issues is the hardlink-based +@@ -202,6 +222,22 @@ This protection is based on the restrictions in Openwall and grsecurity. + + ============================================================== + ++protected_regular: ++ ++This protection is similar to protected_fifos, but it ++avoids writes to an attacker-controlled regular file, where a program ++expected to create one. ++ ++When set to "0", writing to regular files is unrestricted. ++ ++When set to "1" don't allow O_CREAT open on regular files that we ++don't own in world writable sticky directories, unless they are ++owned by the owner of the directory. ++ ++When set to "2" it also applies to group writable sticky directories. ++ ++============================================================== ++ + protected_symlinks: + + A long-standing class of security issues is the symlink-based +diff --git a/MAINTAINERS b/MAINTAINERS +index ab65bbecb159..f4d4a5544dc1 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -10135,6 +10135,7 @@ F: arch/alpha/kernel/srm_env.c + + STABLE BRANCH + M: Greg Kroah-Hartman <gre...@linuxfoundation.org> ++M: Sasha Levin <sas...@kernel.org> + L: sta...@vger.kernel.org + S: Supported + F: Documentation/stable_kernel_rules.txt +diff --git a/Makefile b/Makefile +index 441a760dc5a4..64521458d35e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 165 ++SUBLEVEL = 166 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index c10bb98144b0..fb4ac87fc398 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -10,7 +10,7 @@ + # + # Copyright (C) 1995-2001 by Russell King + +-LDFLAGS_vmlinux :=-p --no-undefined -X ++LDFLAGS_vmlinux :=--no-undefined -X + CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) + OBJCOPYFLAGS :=-O binary -R .note -R .note.gnu.build-id -R .comment -S + GZFLAGS :=-9 +diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h +index 2e0e67ef3544..e8cedf32345a 100644 +--- a/arch/powerpc/kvm/trace.h ++++ b/arch/powerpc/kvm/trace.h +@@ -5,8 +5,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace + + /* + * Tracepoint for guest mode entry. +@@ -119,4 +117,10 @@ TRACE_EVENT(kvm_check_requests, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace ++ + #include <trace/define_trace.h> +diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h +index 7ec534d1db9f..7eadbf449a1f 100644 +--- a/arch/powerpc/kvm/trace_booke.h ++++ b/arch/powerpc/kvm/trace_booke.h +@@ -5,8 +5,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_booke +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_booke + + #define kvm_trace_symbol_exit \ + {0, "CRITICAL"}, \ +@@ -217,4 +215,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio, + #endif + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_booke ++ + #include <trace/define_trace.h> +diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h +index 33d9daff5783..d1bfe017d751 100644 +--- a/arch/powerpc/kvm/trace_hv.h ++++ b/arch/powerpc/kvm/trace_hv.h +@@ -8,8 +8,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_hv +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_hv + + #define kvm_trace_symbol_hcall \ + {H_REMOVE, "H_REMOVE"}, \ +@@ -474,4 +472,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit, + #endif /* _TRACE_KVM_HV_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_hv ++ + #include <trace/define_trace.h> +diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h +index 810507cb688a..1e40aa2aa5af 100644 +--- a/arch/powerpc/kvm/trace_pr.h ++++ b/arch/powerpc/kvm/trace_pr.h +@@ -7,8 +7,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_pr +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_pr + + TRACE_EVENT(kvm_book3s_reenter, + TP_PROTO(int r, struct kvm_vcpu *vcpu), +@@ -271,4 +269,11 @@ TRACE_EVENT(kvm_unmap_hva, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_pr ++ + #include <trace/define_trace.h> +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 3c4faa4c2742..bb3df222ae71 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1319,7 +1319,7 @@ static long vphn_get_associativity(unsigned long cpu, + + switch (rc) { + case H_FUNCTION: +- printk(KERN_INFO ++ printk_once(KERN_INFO + "VPHN is not supported. Disabling polling...\n"); + stop_topology_update(); + break; +diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c +index 05ae254f84cf..1866b6a5171a 100644 +--- a/arch/s390/mm/pgtable.c ++++ b/arch/s390/mm/pgtable.c +@@ -637,6 +637,8 @@ void gmap_discard(struct gmap *gmap, unsigned long from, unsigned long to) + vmaddr |= gaddr & ~PMD_MASK; + /* Find vma in the parent mm */ + vma = find_vma(gmap->mm, vmaddr); ++ if (!vma) ++ continue; + size = min(to - gaddr, PMD_SIZE - (gaddr & ~PMD_MASK)); + zap_page_range(vma, vmaddr, size, NULL); + } +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 8be48b1d7596..375ed605c83d 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -856,7 +856,7 @@ ENTRY(\sym) + + call \do_sym + +- jmp error_exit /* %ebx: no swapgs flag */ ++ jmp error_exit + .endif + END(\sym) + .endm +@@ -1118,7 +1118,6 @@ END(paranoid_exit) + + /* + * Save all registers in pt_regs, and switch gs if needed. +- * Return: EBX=0: came from user mode; EBX=1: otherwise + */ + ENTRY(error_entry) + cld +@@ -1131,7 +1130,6 @@ ENTRY(error_entry) + * the kernel CR3 here. + */ + SWITCH_KERNEL_CR3 +- xorl %ebx, %ebx + testb $3, CS+8(%rsp) + jz .Lerror_kernelspace + +@@ -1165,7 +1163,6 @@ ENTRY(error_entry) + * for these here too. + */ + .Lerror_kernelspace: +- incl %ebx + leaq native_irq_return_iret(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) + je .Lerror_bad_iret +@@ -1196,28 +1193,19 @@ ENTRY(error_entry) + + /* + * Pretend that the exception came from user mode: set up pt_regs +- * as if we faulted immediately after IRET and clear EBX so that +- * error_exit knows that we will be returning to user mode. ++ * as if we faulted immediately after IRET. + */ + mov %rsp, %rdi + call fixup_bad_iret + mov %rax, %rsp +- decl %ebx + jmp .Lerror_entry_from_usermode_after_swapgs + END(error_entry) + +- +-/* +- * On entry, EBS is a "return to kernel mode" flag: +- * 1: already in kernel mode, don't need SWAPGS +- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode +- */ + ENTRY(error_exit) +- movl %ebx, %eax + DISABLE_INTERRUPTS(CLBR_NONE) + TRACE_IRQS_OFF +- testl %eax, %eax +- jnz retint_kernel ++ testb $3, CS(%rsp) ++ jz retint_kernel + jmp retint_user + END(error_exit) + +diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c +index ef1fa8145419..fa86946d12aa 100644 +--- a/drivers/cpufreq/imx6q-cpufreq.c ++++ b/drivers/cpufreq/imx6q-cpufreq.c +@@ -130,8 +130,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index) + /* Ensure the arm clock divider is what we expect */ + ret = clk_set_rate(arm_clk, new_freq * 1000); + if (ret) { ++ int ret1; ++ + dev_err(cpu_dev, "failed to set clock rate: %d\n", ret); +- regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ if (ret1) ++ dev_warn(cpu_dev, ++ "failed to restore vddarm voltage: %d\n", ret1); + return ret; + } + +diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c +index 9a32d9dfdd26..011700262824 100644 +--- a/drivers/gpu/drm/ast/ast_drv.c ++++ b/drivers/gpu/drm/ast/ast_drv.c +@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = { + + MODULE_DEVICE_TABLE(pci, pciidlist); + ++static void ast_kick_out_firmware_fb(struct pci_dev *pdev) ++{ ++ struct apertures_struct *ap; ++ bool primary = false; ++ ++ ap = alloc_apertures(1); ++ if (!ap) ++ return; ++ ++ ap->ranges[0].base = pci_resource_start(pdev, 0); ++ ap->ranges[0].size = pci_resource_len(pdev, 0); ++ ++#ifdef CONFIG_X86 ++ primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW; ++#endif ++ remove_conflicting_framebuffers(ap, "astdrmfb", primary); ++ kfree(ap); ++} ++ + static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { ++ ast_kick_out_firmware_fb(pdev); ++ + return drm_get_pci_dev(pdev, ent, &driver); + } + +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 69d19f3304a5..21085f669e21 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -552,6 +552,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc, + } + ast_bo_unreserve(bo); + ++ ast_set_offset_reg(crtc); + ast_set_start_address_crt1(crtc, (u32)gpu_addr); + + return 0; +@@ -1249,7 +1250,7 @@ static int ast_cursor_move(struct drm_crtc *crtc, + ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07)); + + /* dummy write to fire HWC */ +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00); ++ ast_show_cursor(crtc); + + return 0; + } +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 3258baf3282e..2e52015634f9 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -76,18 +76,23 @@ + */ + + #include <linux/kernel.h> ++#include <linux/input.h> ++#include <linux/rcupdate.h> + #include <linux/slab.h> + #include <linux/stat.h> + #include <linux/module.h> + #include <linux/usb/input.h> ++#include <linux/usb/quirks.h> + + #define DRIVER_AUTHOR "Marko Friedemann <m...@bmx-chemnitz.de>" + #define DRIVER_DESC "X-Box pad driver" + +-#define XPAD_PKT_LEN 32 ++#define XPAD_PKT_LEN 64 + +-/* xbox d-pads should map to buttons, as is required for DDR pads +- but we map them to axes when possible to simplify things */ ++/* ++ * xbox d-pads should map to buttons, as is required for DDR pads ++ * but we map them to axes when possible to simplify things ++ */ + #define MAP_DPAD_TO_BUTTONS (1 << 0) + #define MAP_TRIGGERS_TO_BUTTONS (1 << 1) + #define MAP_STICKS_TO_NULL (1 << 2) +@@ -112,6 +117,10 @@ static bool sticks_to_null; + module_param(sticks_to_null, bool, S_IRUGO); + MODULE_PARM_DESC(sticks_to_null, "Do not map sticks at all for unknown pads"); + ++static bool auto_poweroff = true; ++module_param(auto_poweroff, bool, S_IWUSR | S_IRUGO); ++MODULE_PARM_DESC(auto_poweroff, "Power off wireless controllers on suspend"); ++ + static const struct xpad_device { + u16 idVendor; + u16 idProduct; +@@ -119,43 +128,77 @@ static const struct xpad_device { + u8 mapping; + u8 xtype; + } xpad_device[] = { ++ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 }, ++ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, ++ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, ++ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, ++ { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX }, ++ { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, + { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX }, + { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX }, + { 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX }, ++ { 0x045e, 0x0288, "Microsoft Xbox Controller S v2", 0, XTYPE_XBOX }, + { 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX }, + { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, +- { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, +- { 0x045e, 0x02dd, "Microsoft X-Box One pad (Covert Forces)", 0, XTYPE_XBOXONE }, ++ { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 }, + { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, ++ { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, ++ { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, ++ { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", 0, XTYPE_XBOXONE }, ++ { 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE }, + { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, +- { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, +- { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 }, + { 0x046d, 0xc242, "Logitech Chillstream Controller", 0, XTYPE_XBOX360 }, + { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", 0, XTYPE_XBOX }, + { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, ++ { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, ++ { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, ++ { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, + { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, + { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, ++ { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, ++ { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, ++ { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, ++ { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, ++ { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, ++ { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX }, ++ { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 }, ++ { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX }, + { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX }, ++ { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, + { 0x0738, 0x4522, "Mad Catz LumiCON", 0, XTYPE_XBOX }, + { 0x0738, 0x4526, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, ++ { 0x0738, 0x4530, "Mad Catz Universal MC2 Racing Wheel and Pedals", 0, XTYPE_XBOX }, + { 0x0738, 0x4536, "Mad Catz MicroCON", 0, XTYPE_XBOX }, + { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", 0, XTYPE_XBOX }, ++ { 0x0738, 0x4586, "Mad Catz MicroCon Wireless Controller", 0, XTYPE_XBOX }, ++ { 0x0738, 0x4588, "Mad Catz Blaster", 0, XTYPE_XBOX }, ++ { 0x0738, 0x45ff, "Mad Catz Beat Pad (w/ Handle)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4718, "Mad Catz Street Fighter IV FightStick SE", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4726, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x0738, 0x4736, "Mad Catz MicroCon Gamepad", 0, XTYPE_XBOX360 }, + { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 }, ++ { 0x0738, 0x4743, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, ++ { 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, ++ { 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 }, + { 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 }, ++ { 0x0738, 0xb738, "Mad Catz MVC2TE Stick 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 }, + { 0x0738, 0xcb02, "Saitek Cyborg Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0738, 0xcb03, "Saitek P3200 Rumble Pad - PC/Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 }, + { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, ++ { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 }, ++ { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX }, ++ { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", DANCEPAD_MAP_CONFIG, XTYPE_XBOX }, + { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX }, +@@ -163,32 +206,66 @@ static const struct xpad_device { + { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX }, + { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX }, ++ { 0x0e4c, 0x1103, "Radica Gamester Reflex", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX }, + { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX }, ++ { 0x0e4c, 0x3510, "Radica Gamester", 0, XTYPE_XBOX }, + { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", 0, XTYPE_XBOX }, + { 0x0e6f, 0x0005, "Eclipse wireless Controller", 0, XTYPE_XBOX }, + { 0x0e6f, 0x0006, "Edge wireless Controller", 0, XTYPE_XBOX }, ++ { 0x0e6f, 0x0008, "After Glow Pro Controller", 0, XTYPE_XBOX }, + { 0x0e6f, 0x0105, "HSM3 Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0e6f, 0x0113, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0131, "PDP EA Sports Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0133, "Xbox 360 Wired Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0164, "PDP Battlefield One", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x0165, "PDP Titanfall 2", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, + { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0x0501, "PDP Xbox 360 Controller", 0, XTYPE_XBOX360 }, ++ { 0x0e6f, 0xf900, "PDP Afterglow AX.1", 0, XTYPE_XBOX360 }, + { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", 0, XTYPE_XBOX }, + { 0x0e8f, 0x3008, "Generic xbox control (dealextreme)", 0, XTYPE_XBOX }, + { 0x0f0d, 0x000a, "Hori Co. DOA4 FightStick", 0, XTYPE_XBOX360 }, ++ { 0x0f0d, 0x000c, "Hori PadEX Turbo", 0, XTYPE_XBOX360 }, + { 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x0f0d, 0x001b, "Hori Real Arcade Pro VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, ++ { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE }, ++ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, ++ { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX }, + { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, + { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, + { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, ++ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, + { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, ++ { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x12ab, 0x8809, "Xbox DDR dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, + { 0x1430, 0x4748, "RedOctane Guitar Hero X-plorer", 0, XTYPE_XBOX360 }, + { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, ++ { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, + { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, +@@ -196,24 +273,67 @@ static const struct xpad_device { + { 0x162e, 0xbeef, "Joytech Neo-Se Take2", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd00, "Razer Onza Tournament Edition", 0, XTYPE_XBOX360 }, + { 0x1689, 0xfd01, "Razer Onza Classic Edition", 0, XTYPE_XBOX360 }, +- { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1bad, 0xf016, "Mad Catz Xbox 360 Controller", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf018, "Mad Catz Street Fighter IV SE Fighting Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf019, "Mad Catz Brawlstick for Xbox 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf021, "Mad Cats Ghost Recon FS GamePad", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf023, "MLG Pro Circuit Controller (Xbox)", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf025, "Mad Catz Call Of Duty", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf027, "Mad Catz FPS Pro", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf028, "Street Fighter IV FightPad", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf02e, "Mad Catz Fightpad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf030, "Mad Catz Xbox 360 MC2 MicroCon Racing Wheel", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf036, "Mad Catz MicroCon GamePad Pro", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf038, "Street Fighter IV FightStick TE", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf039, "Mad Catz MvC2 TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf03a, "Mad Catz SFxT Fightstick Pro", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf03d, "Street Fighter IV Arcade Stick TE - Chun Li", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf03e, "Mad Catz MLG FightStick TE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf03f, "Mad Catz FightStick SoulCaliber", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf042, "Mad Catz FightStick TES+", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf080, "Mad Catz FightStick TE2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf501, "HoriPad EX2 Turbo", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf502, "Hori Real Arcade Pro.VX SA", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf503, "Hori Fighting Stick VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf504, "Hori Real Arcade Pro. EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf505, "Hori Fighting Stick EX2B", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf506, "Hori Real Arcade Pro.EX Premium VLX", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf900, "Harmonix Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf901, "Gamestop Xbox 360 Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xf903, "Tron Xbox 360 controller", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf904, "PDP Versus Fighting Pad", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xf906, "MortalKombat FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, ++ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x530a, "Xbox 360 Pro EX Controller", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x531a, "PowerA Pro Ex", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x5397, "FUS1ON Tournament Controller", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x541a, "PowerA Xbox One Mini Wired Controller", 0, XTYPE_XBOXONE }, ++ { 0x24c6, 0x542a, "Xbox ONE spectra", 0, XTYPE_XBOXONE }, ++ { 0x24c6, 0x543a, "PowerA Xbox One wired controller", 0, XTYPE_XBOXONE }, + { 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE }, ++ { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE }, ++ { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, ++ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, + { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } + }; +@@ -274,15 +394,15 @@ static const signed short xpad_abs_triggers[] = { + * match against vendor id as well. Wired Xbox 360 devices have protocol 1, + * wireless controllers have protocol 129. + */ +-#define XPAD_XBOX360_VENDOR_PROTOCOL(vend,pr) \ ++#define XPAD_XBOX360_VENDOR_PROTOCOL(vend, pr) \ + .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \ + .idVendor = (vend), \ + .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \ + .bInterfaceSubClass = 93, \ + .bInterfaceProtocol = (pr) + #define XPAD_XBOX360_VENDOR(vend) \ +- { XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \ +- { XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) } ++ { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 1) }, \ ++ { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 129) } + + /* The Xbox One controller uses subclass 71 and protocol 208. */ + #define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \ +@@ -292,33 +412,138 @@ static const signed short xpad_abs_triggers[] = { + .bInterfaceSubClass = 71, \ + .bInterfaceProtocol = (pr) + #define XPAD_XBOXONE_VENDOR(vend) \ +- { XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) } ++ { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) } + +-static struct usb_device_id xpad_table[] = { ++static const struct usb_device_id xpad_table[] = { + { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */ ++ XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */ + XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ + XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ + XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */ ++ XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */ ++ XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */ + XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */ + { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */ ++ XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */ ++ XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz GamePad */ + XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f X-Box 360 controllers */ ++ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */ ++ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ ++ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ ++ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ + XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ + XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */ +- XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ +- XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */ +- XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ +- XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */ + XPAD_XBOX360_VENDOR(0x1532), /* Razer Sabertooth */ + XPAD_XBOXONE_VENDOR(0x1532), /* Razer Wildcat */ + XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ ++ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ ++ XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ ++ XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */ ++ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */ + { } + }; + + MODULE_DEVICE_TABLE(usb, xpad_table); + ++struct xboxone_init_packet { ++ u16 idVendor; ++ u16 idProduct; ++ const u8 *data; ++ u8 len; ++}; ++ ++#define XBOXONE_INIT_PKT(_vid, _pid, _data) \ ++ { \ ++ .idVendor = (_vid), \ ++ .idProduct = (_pid), \ ++ .data = (_data), \ ++ .len = ARRAY_SIZE(_data), \ ++ } ++ ++ ++/* ++ * This packet is required for all Xbox One pads with 2015 ++ * or later firmware installed (or present from the factory). ++ */ ++static const u8 xboxone_fw2015_init[] = { ++ 0x05, 0x20, 0x00, 0x01, 0x00 ++}; ++ ++/* ++ * This packet is required for the Titanfall 2 Xbox One pads ++ * (0x0e6f:0x0165) to finish initialization and for Hori pads ++ * (0x0f0d:0x0067) to make the analog sticks work. ++ */ ++static const u8 xboxone_hori_init[] = { ++ 0x01, 0x20, 0x00, 0x09, 0x00, 0x04, 0x20, 0x3a, ++ 0x00, 0x00, 0x00, 0x80, 0x00 ++}; ++ ++/* ++ * This packet is required for some of the PDP pads to start ++ * sending input reports. These pads include: (0x0e6f:0x02ab), ++ * (0x0e6f:0x02a4). ++ */ ++static const u8 xboxone_pdp_init1[] = { ++ 0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14 ++}; ++ ++/* ++ * This packet is required for some of the PDP pads to start ++ * sending input reports. These pads include: (0x0e6f:0x02ab), ++ * (0x0e6f:0x02a4). ++ */ ++static const u8 xboxone_pdp_init2[] = { ++ 0x06, 0x20, 0x00, 0x02, 0x01, 0x00 ++}; ++ ++/* ++ * A specific rumble packet is required for some PowerA pads to start ++ * sending input reports. One of those pads is (0x24c6:0x543a). ++ */ ++static const u8 xboxone_rumblebegin_init[] = { ++ 0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00, ++ 0x1D, 0x1D, 0xFF, 0x00, 0x00 ++}; ++ ++/* ++ * A rumble packet with zero FF intensity will immediately ++ * terminate the rumbling required to init PowerA pads. ++ * This should happen fast enough that the motors don't ++ * spin up to enough speed to actually vibrate the gamepad. ++ */ ++static const u8 xboxone_rumbleend_init[] = { ++ 0x09, 0x00, 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00 ++}; ++ ++/* ++ * This specifies the selection of init packets that a gamepad ++ * will be sent on init *and* the order in which they will be ++ * sent. The correct sequence number will be added when the ++ * packet is going to be sent. ++ */ ++static const struct xboxone_init_packet xboxone_init_packets[] = { ++ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), ++ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), ++ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1), ++ XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2), ++ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), ++ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), ++ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), ++ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumbleend_init), ++ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumbleend_init), ++ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumbleend_init), ++}; ++ + struct xpad_output_packet { + u8 data[XPAD_PKT_LEN]; + u8 len; +@@ -334,23 +559,28 @@ struct xpad_output_packet { + + struct usb_xpad { + struct input_dev *dev; /* input device interface */ ++ struct input_dev __rcu *x360w_dev; + struct usb_device *udev; /* usb device */ + struct usb_interface *intf; /* usb interface */ + +- int pad_present; ++ bool pad_present; ++ bool input_created; + + struct urb *irq_in; /* urb for interrupt in report */ + unsigned char *idata; /* input data */ + dma_addr_t idata_dma; + + struct urb *irq_out; /* urb for interrupt out report */ ++ struct usb_anchor irq_out_anchor; + bool irq_out_active; /* we must not use an active URB */ ++ u8 odata_serial; /* serial number for xbox one protocol */ + unsigned char *odata; /* output data */ + dma_addr_t odata_dma; + spinlock_t odata_lock; + + struct xpad_output_packet out_packets[XPAD_NUM_OUT_PACKETS]; + int last_out_packet; ++ int init_seq; + + #if defined(CONFIG_JOYSTICK_XPAD_LEDS) + struct xpad_led *led; +@@ -362,8 +592,13 @@ struct usb_xpad { + int xtype; /* type of xbox device */ + int pad_nr; /* the order x360 pads were attached */ + const char *name; /* name of the device */ ++ struct work_struct work; /* init/remove device from callback */ + }; + ++static int xpad_init_input(struct usb_xpad *xpad); ++static void xpad_deinit_input(struct usb_xpad *xpad); ++static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num); ++ + /* + * xpad_process_packet + * +@@ -443,10 +678,12 @@ static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *d + * http://www.free60.org/wiki/Gamepad + */ + +-static void xpad360_process_packet(struct usb_xpad *xpad, ++static void xpad360_process_packet(struct usb_xpad *xpad, struct input_dev *dev, + u16 cmd, unsigned char *data) + { +- struct input_dev *dev = xpad->dev; ++ /* valid pad data */ ++ if (data[0] != 0x00) ++ return; + + /* digital pad */ + if (xpad->mapping & MAP_DPAD_TO_BUTTONS) { +@@ -514,7 +751,30 @@ static void xpad360_process_packet(struct usb_xpad *xpad, + input_sync(dev); + } + +-static void xpad_identify_controller(struct usb_xpad *xpad); ++static void xpad_presence_work(struct work_struct *work) ++{ ++ struct usb_xpad *xpad = container_of(work, struct usb_xpad, work); ++ int error; ++ ++ if (xpad->pad_present) { ++ error = xpad_init_input(xpad); ++ if (error) { ++ /* complain only, not much else we can do here */ ++ dev_err(&xpad->dev->dev, ++ "unable to init device: %d\n", error); ++ } else { ++ rcu_assign_pointer(xpad->x360w_dev, xpad->dev); ++ } ++ } else { ++ RCU_INIT_POINTER(xpad->x360w_dev, NULL); ++ synchronize_rcu(); ++ /* ++ * Now that we are sure xpad360w_process_packet is not ++ * using input device we can get rid of it. ++ */ ++ xpad_deinit_input(xpad); ++ } ++} + + /* + * xpad360w_process_packet +@@ -532,35 +792,61 @@ static void xpad_identify_controller(struct usb_xpad *xpad); + */ + static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data) + { ++ struct input_dev *dev; ++ bool present; ++ + /* Presence change */ + if (data[0] & 0x08) { +- if (data[1] & 0x80) { +- xpad->pad_present = 1; +- /* +- * Light up the segment corresponding to +- * controller number. +- */ +- xpad_identify_controller(xpad); +- } else +- xpad->pad_present = 0; ++ present = (data[1] & 0x80) != 0; ++ ++ if (xpad->pad_present != present) { ++ xpad->pad_present = present; ++ schedule_work(&xpad->work); ++ } + } + + /* Valid pad data */ +- if (!(data[1] & 0x1)) ++ if (data[1] != 0x1) + return; + +- xpad360_process_packet(xpad, cmd, &data[4]); ++ rcu_read_lock(); ++ dev = rcu_dereference(xpad->x360w_dev); ++ if (dev) ++ xpad360_process_packet(xpad, dev, cmd, &data[4]); ++ rcu_read_unlock(); + } + + /* +- * xpadone_process_buttons ++ * xpadone_process_packet + * +- * Process a button update packet from an Xbox one controller. ++ * Completes a request by converting the data into events for the ++ * input subsystem. This version is for the Xbox One controller. ++ * ++ * The report format was gleaned from ++ * https://github.com/kylelemons/xbox/blob/master/xbox.go + */ +-static void xpadone_process_buttons(struct usb_xpad *xpad, +- struct input_dev *dev, +- unsigned char *data) ++static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data) + { ++ struct input_dev *dev = xpad->dev; ++ ++ /* the xbox button has its own special report */ ++ if (data[0] == 0X07) { ++ /* ++ * The Xbox One S controller requires these reports to be ++ * acked otherwise it continues sending them forever and ++ * won't report further mode button events. ++ */ ++ if (data[1] == 0x30) ++ xpadone_ack_mode_report(xpad, data[2]); ++ ++ input_report_key(dev, BTN_MODE, data[4] & 0x01); ++ input_sync(dev); ++ return; ++ } ++ /* check invalid packet */ ++ else if (data[0] != 0X20) ++ return; ++ + /* menu/view buttons */ + input_report_key(dev, BTN_START, data[4] & 0x04); + input_report_key(dev, BTN_SELECT, data[4] & 0x08); +@@ -623,34 +909,6 @@ static void xpadone_process_buttons(struct usb_xpad *xpad, + input_sync(dev); + } + +-/* +- * xpadone_process_packet +- * +- * Completes a request by converting the data into events for the +- * input subsystem. This version is for the Xbox One controller. +- * +- * The report format was gleaned from +- * https://github.com/kylelemons/xbox/blob/master/xbox.go +- */ +- +-static void xpadone_process_packet(struct usb_xpad *xpad, +- u16 cmd, unsigned char *data) +-{ +- struct input_dev *dev = xpad->dev; +- +- switch (data[0]) { +- case 0x20: +- xpadone_process_buttons(xpad, dev, data); +- break; +- +- case 0x07: +- /* the xbox button has its own special report */ +- input_report_key(dev, BTN_MODE, data[4] & 0x01); +- input_sync(dev); +- break; +- } +-} +- + static void xpad_irq_in(struct urb *urb) + { + struct usb_xpad *xpad = urb->context; +@@ -678,7 +936,7 @@ static void xpad_irq_in(struct urb *urb) + + switch (xpad->xtype) { + case XTYPE_XBOX360: +- xpad360_process_packet(xpad, 0, xpad->idata); ++ xpad360_process_packet(xpad, xpad->dev, 0, xpad->idata); + break; + case XTYPE_XBOX360W: + xpad360w_process_packet(xpad, 0, xpad->idata); +@@ -697,12 +955,48 @@ exit: + __func__, retval); + } + ++/* Callers must hold xpad->odata_lock spinlock */ ++static bool xpad_prepare_next_init_packet(struct usb_xpad *xpad) ++{ ++ const struct xboxone_init_packet *init_packet; ++ ++ if (xpad->xtype != XTYPE_XBOXONE) ++ return false; ++ ++ /* Perform initialization sequence for Xbox One pads that require it */ ++ while (xpad->init_seq < ARRAY_SIZE(xboxone_init_packets)) { ++ init_packet = &xboxone_init_packets[xpad->init_seq++]; ++ ++ if (init_packet->idVendor != 0 && ++ init_packet->idVendor != xpad->dev->id.vendor) ++ continue; ++ ++ if (init_packet->idProduct != 0 && ++ init_packet->idProduct != xpad->dev->id.product) ++ continue; ++ ++ /* This packet applies to our device, so prepare to send it */ ++ memcpy(xpad->odata, init_packet->data, init_packet->len); ++ xpad->irq_out->transfer_buffer_length = init_packet->len; ++ ++ /* Update packet with current sequence number */ ++ xpad->odata[2] = xpad->odata_serial++; ++ return true; ++ } ++ ++ return false; ++} ++ + /* Callers must hold xpad->odata_lock spinlock */ + static bool xpad_prepare_next_out_packet(struct usb_xpad *xpad) + { + struct xpad_output_packet *pkt, *packet = NULL; + int i; + ++ /* We may have init packets to send before we can send user commands */ ++ if (xpad_prepare_next_init_packet(xpad)) ++ return true; ++ + for (i = 0; i < XPAD_NUM_OUT_PACKETS; i++) { + if (++xpad->last_out_packet >= XPAD_NUM_OUT_PACKETS) + xpad->last_out_packet = 0; +@@ -733,11 +1027,13 @@ static int xpad_try_sending_next_out_packet(struct usb_xpad *xpad) + int error; + + if (!xpad->irq_out_active && xpad_prepare_next_out_packet(xpad)) { ++ usb_anchor_urb(xpad->irq_out, &xpad->irq_out_anchor); + error = usb_submit_urb(xpad->irq_out, GFP_ATOMIC); + if (error) { + dev_err(&xpad->intf->dev, + "%s - usb_submit_urb failed with result %d\n", + __func__, error); ++ usb_unanchor_urb(xpad->irq_out); + return -EIO; + } + +@@ -779,11 +1075,13 @@ static void xpad_irq_out(struct urb *urb) + } + + if (xpad->irq_out_active) { ++ usb_anchor_urb(urb, &xpad->irq_out_anchor); + error = usb_submit_urb(urb, GFP_ATOMIC); + if (error) { + dev_err(dev, + "%s - usb_submit_urb failed with result %d\n", + __func__, error); ++ usb_unanchor_urb(urb); + xpad->irq_out_active = false; + } + } +@@ -791,34 +1089,29 @@ static void xpad_irq_out(struct urb *urb) + spin_unlock_irqrestore(&xpad->odata_lock, flags); + } + +-static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) ++static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad, ++ struct usb_endpoint_descriptor *ep_irq_out) + { +- struct usb_endpoint_descriptor *ep_irq_out; +- int ep_irq_out_idx; + int error; + + if (xpad->xtype == XTYPE_UNKNOWN) + return 0; + ++ init_usb_anchor(&xpad->irq_out_anchor); ++ + xpad->odata = usb_alloc_coherent(xpad->udev, XPAD_PKT_LEN, + GFP_KERNEL, &xpad->odata_dma); +- if (!xpad->odata) { +- error = -ENOMEM; +- goto fail1; +- } ++ if (!xpad->odata) ++ return -ENOMEM; + + spin_lock_init(&xpad->odata_lock); + + xpad->irq_out = usb_alloc_urb(0, GFP_KERNEL); + if (!xpad->irq_out) { + error = -ENOMEM; +- goto fail2; ++ goto err_free_coherent; + } + +- /* Xbox One controller has in/out endpoints swapped. */ +- ep_irq_out_idx = xpad->xtype == XTYPE_XBOXONE ? 0 : 1; +- ep_irq_out = &intf->cur_altsetting->endpoint[ep_irq_out_idx].desc; +- + usb_fill_int_urb(xpad->irq_out, xpad->udev, + usb_sndintpipe(xpad->udev, ep_irq_out->bEndpointAddress), + xpad->odata, XPAD_PKT_LEN, +@@ -828,14 +1121,21 @@ static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) + + return 0; + +- fail2: usb_free_coherent(xpad->udev, XPAD_PKT_LEN, xpad->odata, xpad->odata_dma); +- fail1: return error; ++err_free_coherent: ++ usb_free_coherent(xpad->udev, XPAD_PKT_LEN, xpad->odata, xpad->odata_dma); ++ return error; + } + + static void xpad_stop_output(struct usb_xpad *xpad) + { +- if (xpad->xtype != XTYPE_UNKNOWN) +- usb_kill_urb(xpad->irq_out); ++ if (xpad->xtype != XTYPE_UNKNOWN) { ++ if (!usb_wait_anchor_empty_timeout(&xpad->irq_out_anchor, ++ 5000)) { ++ dev_warn(&xpad->intf->dev, ++ "timed out waiting for output URB to complete, killing\n"); ++ usb_kill_anchored_urbs(&xpad->irq_out_anchor); ++ } ++ } + } + + static void xpad_deinit_output(struct usb_xpad *xpad) +@@ -882,21 +1182,17 @@ static int xpad_inquiry_pad_presence(struct usb_xpad *xpad) + + static int xpad_start_xbox_one(struct usb_xpad *xpad) + { +- struct xpad_output_packet *packet = +- &xpad->out_packets[XPAD_OUT_CMD_IDX]; + unsigned long flags; + int retval; + + spin_lock_irqsave(&xpad->odata_lock, flags); + +- /* Xbox one controller needs to be initialized. */ +- packet->data[0] = 0x05; +- packet->data[1] = 0x20; +- packet->len = 2; +- packet->pending = true; +- +- /* Reset the sequence so we send out start packet first */ +- xpad->last_out_packet = -1; ++ /* ++ * Begin the init sequence by attempting to send a packet. ++ * We will cycle through the init packet sequence before ++ * sending any packets from the output ring. ++ */ ++ xpad->init_seq = 0; + retval = xpad_try_sending_next_out_packet(xpad); + + spin_unlock_irqrestore(&xpad->odata_lock, flags); +@@ -904,6 +1200,30 @@ static int xpad_start_xbox_one(struct usb_xpad *xpad) + return retval; + } + ++static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num) ++{ ++ unsigned long flags; ++ struct xpad_output_packet *packet = ++ &xpad->out_packets[XPAD_OUT_CMD_IDX]; ++ static const u8 mode_report_ack[] = { ++ 0x01, 0x20, 0x00, 0x09, 0x00, 0x07, 0x20, 0x02, ++ 0x00, 0x00, 0x00, 0x00, 0x00 ++ }; ++ ++ spin_lock_irqsave(&xpad->odata_lock, flags); ++ ++ packet->len = sizeof(mode_report_ack); ++ memcpy(packet->data, mode_report_ack, packet->len); ++ packet->data[2] = seq_num; ++ packet->pending = true; ++ ++ /* Reset the sequence so we send out the ack now */ ++ xpad->last_out_packet = -1; ++ xpad_try_sending_next_out_packet(xpad); ++ ++ spin_unlock_irqrestore(&xpad->odata_lock, flags); ++} ++ + #ifdef CONFIG_JOYSTICK_XPAD_FF + static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect) + { +@@ -966,18 +1286,19 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect + + case XTYPE_XBOXONE: + packet->data[0] = 0x09; /* activate rumble */ +- packet->data[1] = 0x08; +- packet->data[2] = 0x00; +- packet->data[3] = 0x08; /* continuous effect */ +- packet->data[4] = 0x00; /* simple rumble mode */ +- packet->data[5] = 0x03; /* L and R actuator only */ +- packet->data[6] = 0x00; /* TODO: LT actuator */ +- packet->data[7] = 0x00; /* TODO: RT actuator */ +- packet->data[8] = strong / 256; /* left actuator */ +- packet->data[9] = weak / 256; /* right actuator */ +- packet->data[10] = 0x80; /* length of pulse */ +- packet->data[11] = 0x00; /* stop period of pulse */ +- packet->len = 12; ++ packet->data[1] = 0x00; ++ packet->data[2] = xpad->odata_serial++; ++ packet->data[3] = 0x09; ++ packet->data[4] = 0x00; ++ packet->data[5] = 0x0F; ++ packet->data[6] = 0x00; ++ packet->data[7] = 0x00; ++ packet->data[8] = strong / 512; /* left actuator */ ++ packet->data[9] = weak / 512; /* right actuator */ ++ packet->data[10] = 0xFF; /* on period */ ++ packet->data[11] = 0x00; /* off period */ ++ packet->data[12] = 0xFF; /* repeat count */ ++ packet->len = 13; + packet->pending = true; + break; + +@@ -1090,7 +1411,7 @@ static void xpad_send_led_command(struct usb_xpad *xpad, int command) + */ + static void xpad_identify_controller(struct usb_xpad *xpad) + { +- xpad_send_led_command(xpad, (xpad->pad_nr % 4) + 2); ++ led_set_brightness(&xpad->led->led_cdev, (xpad->pad_nr % 4) + 2); + } + + static void xpad_led_set(struct led_classdev *led_cdev, +@@ -1127,19 +1448,13 @@ static int xpad_led_probe(struct usb_xpad *xpad) + led_cdev = &led->led_cdev; + led_cdev->name = led->name; + led_cdev->brightness_set = xpad_led_set; ++ led_cdev->flags = LED_CORE_SUSPENDRESUME; + + error = led_classdev_register(&xpad->udev->dev, led_cdev); + if (error) + goto err_free_id; + +- if (xpad->xtype == XTYPE_XBOX360) { +- /* +- * Light up the segment corresponding to controller +- * number on wired devices. On wireless we'll do that +- * when they respond to "presence" packet. +- */ +- xpad_identify_controller(xpad); +- } ++ xpad_identify_controller(xpad); + + return 0; + +@@ -1164,41 +1479,110 @@ static void xpad_led_disconnect(struct usb_xpad *xpad) + #else + static int xpad_led_probe(struct usb_xpad *xpad) { return 0; } + static void xpad_led_disconnect(struct usb_xpad *xpad) { } +-static void xpad_identify_controller(struct usb_xpad *xpad) { } + #endif + +-static int xpad_open(struct input_dev *dev) ++static int xpad_start_input(struct usb_xpad *xpad) + { +- struct usb_xpad *xpad = input_get_drvdata(dev); +- +- /* URB was submitted in probe */ +- if (xpad->xtype == XTYPE_XBOX360W) +- return 0; ++ int error; + +- xpad->irq_in->dev = xpad->udev; + if (usb_submit_urb(xpad->irq_in, GFP_KERNEL)) + return -EIO; + +- if (xpad->xtype == XTYPE_XBOXONE) +- return xpad_start_xbox_one(xpad); ++ if (xpad->xtype == XTYPE_XBOXONE) { ++ error = xpad_start_xbox_one(xpad); ++ if (error) { ++ usb_kill_urb(xpad->irq_in); ++ return error; ++ } ++ } + + return 0; + } + +-static void xpad_close(struct input_dev *dev) ++static void xpad_stop_input(struct usb_xpad *xpad) + { +- struct usb_xpad *xpad = input_get_drvdata(dev); ++ usb_kill_urb(xpad->irq_in); ++} + +- if (xpad->xtype != XTYPE_XBOX360W) ++static void xpad360w_poweroff_controller(struct usb_xpad *xpad) ++{ ++ unsigned long flags; ++ struct xpad_output_packet *packet = ++ &xpad->out_packets[XPAD_OUT_CMD_IDX]; ++ ++ spin_lock_irqsave(&xpad->odata_lock, flags); ++ ++ packet->data[0] = 0x00; ++ packet->data[1] = 0x00; ++ packet->data[2] = 0x08; ++ packet->data[3] = 0xC0; ++ packet->data[4] = 0x00; ++ packet->data[5] = 0x00; ++ packet->data[6] = 0x00; ++ packet->data[7] = 0x00; ++ packet->data[8] = 0x00; ++ packet->data[9] = 0x00; ++ packet->data[10] = 0x00; ++ packet->data[11] = 0x00; ++ packet->len = 12; ++ packet->pending = true; ++ ++ /* Reset the sequence so we send out poweroff now */ ++ xpad->last_out_packet = -1; ++ xpad_try_sending_next_out_packet(xpad); ++ ++ spin_unlock_irqrestore(&xpad->odata_lock, flags); ++} ++ ++static int xpad360w_start_input(struct usb_xpad *xpad) ++{ ++ int error; ++ ++ error = usb_submit_urb(xpad->irq_in, GFP_KERNEL); ++ if (error) ++ return -EIO; ++ ++ /* ++ * Send presence packet. ++ * This will force the controller to resend connection packets. ++ * This is useful in the case we activate the module after the ++ * adapter has been plugged in, as it won't automatically ++ * send us info about the controllers. ++ */ ++ error = xpad_inquiry_pad_presence(xpad); ++ if (error) { + usb_kill_urb(xpad->irq_in); ++ return error; ++ } + +- xpad_stop_output(xpad); ++ return 0; ++} ++ ++static void xpad360w_stop_input(struct usb_xpad *xpad) ++{ ++ usb_kill_urb(xpad->irq_in); ++ ++ /* Make sure we are done with presence work if it was scheduled */ ++ flush_work(&xpad->work); ++} ++ ++static int xpad_open(struct input_dev *dev) ++{ ++ struct usb_xpad *xpad = input_get_drvdata(dev); ++ ++ return xpad_start_input(xpad); ++} ++ ++static void xpad_close(struct input_dev *dev) ++{ ++ struct usb_xpad *xpad = input_get_drvdata(dev); ++ ++ xpad_stop_input(xpad); + } + + static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) + { + struct usb_xpad *xpad = input_get_drvdata(input_dev); +- set_bit(abs, input_dev->absbit); + + switch (abs) { + case ABS_X: +@@ -1218,13 +1602,19 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) + case ABS_HAT0Y: /* the d-pad (only if dpad is mapped to axes */ + input_set_abs_params(input_dev, abs, -1, 1, 0, 0); + break; ++ default: ++ input_set_abs_params(input_dev, abs, 0, 0, 0, 0); ++ break; + } + } + + static void xpad_deinit_input(struct usb_xpad *xpad) + { +- xpad_led_disconnect(xpad); +- input_unregister_device(xpad->dev); ++ if (xpad->input_created) { ++ xpad->input_created = false; ++ xpad_led_disconnect(xpad); ++ input_unregister_device(xpad->dev); ++ } + } + + static int xpad_init_input(struct usb_xpad *xpad) +@@ -1250,13 +1640,12 @@ static int xpad_init_input(struct usb_xpad *xpad) + + input_set_drvdata(input_dev, xpad); + +- input_dev->open = xpad_open; +- input_dev->close = xpad_close; +- +- __set_bit(EV_KEY, input_dev->evbit); ++ if (xpad->xtype != XTYPE_XBOX360W) { ++ input_dev->open = xpad_open; ++ input_dev->close = xpad_close; ++ } + + if (!(xpad->mapping & MAP_STICKS_TO_NULL)) { +- __set_bit(EV_ABS, input_dev->evbit); + /* set up axes */ + for (i = 0; xpad_abs[i] >= 0; i++) + xpad_set_up_abs(input_dev, xpad_abs[i]); +@@ -1264,21 +1653,22 @@ static int xpad_init_input(struct usb_xpad *xpad) + + /* set up standard buttons */ + for (i = 0; xpad_common_btn[i] >= 0; i++) +- __set_bit(xpad_common_btn[i], input_dev->keybit); ++ input_set_capability(input_dev, EV_KEY, xpad_common_btn[i]); + + /* set up model-specific ones */ + if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W || + xpad->xtype == XTYPE_XBOXONE) { + for (i = 0; xpad360_btn[i] >= 0; i++) +- __set_bit(xpad360_btn[i], input_dev->keybit); ++ input_set_capability(input_dev, EV_KEY, xpad360_btn[i]); + } else { + for (i = 0; xpad_btn[i] >= 0; i++) +- __set_bit(xpad_btn[i], input_dev->keybit); ++ input_set_capability(input_dev, EV_KEY, xpad_btn[i]); + } + + if (xpad->mapping & MAP_DPAD_TO_BUTTONS) { + for (i = 0; xpad_btn_pad[i] >= 0; i++) +- __set_bit(xpad_btn_pad[i], input_dev->keybit); ++ input_set_capability(input_dev, EV_KEY, ++ xpad_btn_pad[i]); + } + + /* +@@ -1295,7 +1685,8 @@ static int xpad_init_input(struct usb_xpad *xpad) + + if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) { + for (i = 0; xpad_btn_triggers[i] >= 0; i++) +- __set_bit(xpad_btn_triggers[i], input_dev->keybit); ++ input_set_capability(input_dev, EV_KEY, ++ xpad_btn_triggers[i]); + } else { + for (i = 0; xpad_abs_triggers[i] >= 0; i++) + xpad_set_up_abs(input_dev, xpad_abs_triggers[i]); +@@ -1313,6 +1704,7 @@ static int xpad_init_input(struct usb_xpad *xpad) + if (error) + goto err_disconnect_led; + ++ xpad->input_created = true; + return 0; + + err_disconnect_led: +@@ -1328,8 +1720,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + { + struct usb_device *udev = interface_to_usbdev(intf); + struct usb_xpad *xpad; +- struct usb_endpoint_descriptor *ep_irq_in; +- int ep_irq_in_idx; ++ struct usb_endpoint_descriptor *ep_irq_in, *ep_irq_out; + int i, error; + + if (intf->cur_altsetting->desc.bNumEndpoints != 2) +@@ -1366,6 +1757,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + xpad->mapping = xpad_device[i].mapping; + xpad->xtype = xpad_device[i].xtype; + xpad->name = xpad_device[i].name; ++ INIT_WORK(&xpad->work, xpad_presence_work); + + if (xpad->xtype == XTYPE_UNKNOWN) { + if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) { +@@ -1398,13 +1790,28 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + goto err_free_in_urb; + } + +- error = xpad_init_output(intf, xpad); +- if (error) ++ ep_irq_in = ep_irq_out = NULL; ++ ++ for (i = 0; i < 2; i++) { ++ struct usb_endpoint_descriptor *ep = ++ &intf->cur_altsetting->endpoint[i].desc; ++ ++ if (usb_endpoint_xfer_int(ep)) { ++ if (usb_endpoint_dir_in(ep)) ++ ep_irq_in = ep; ++ else ++ ep_irq_out = ep; ++ } ++ } ++ ++ if (!ep_irq_in || !ep_irq_out) { ++ error = -ENODEV; + goto err_free_in_urb; ++ } + +- /* Xbox One controller has in/out endpoints swapped. */ +- ep_irq_in_idx = xpad->xtype == XTYPE_XBOXONE ? 1 : 0; +- ep_irq_in = &intf->cur_altsetting->endpoint[ep_irq_in_idx].desc; ++ error = xpad_init_output(intf, xpad, ep_irq_out); ++ if (error) ++ goto err_free_in_urb; + + usb_fill_int_urb(xpad->irq_in, udev, + usb_rcvintpipe(udev, ep_irq_in->bEndpointAddress), +@@ -1415,10 +1822,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + + usb_set_intfdata(intf, xpad); + +- error = xpad_init_input(xpad); +- if (error) +- goto err_deinit_output; +- + if (xpad->xtype == XTYPE_XBOX360W) { + /* + * Submit the int URB immediately rather than waiting for open +@@ -1427,28 +1830,24 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + * exactly the message that a controller has arrived that + * we're waiting for. + */ +- xpad->irq_in->dev = xpad->udev; +- error = usb_submit_urb(xpad->irq_in, GFP_KERNEL); ++ error = xpad360w_start_input(xpad); + if (error) +- goto err_deinit_input; +- ++ goto err_deinit_output; + /* +- * Send presence packet. +- * This will force the controller to resend connection packets. +- * This is useful in the case we activate the module after the +- * adapter has been plugged in, as it won't automatically +- * send us info about the controllers. ++ * Wireless controllers require RESET_RESUME to work properly ++ * after suspend. Ideally this quirk should be in usb core ++ * quirk list, but we have too many vendors producing these ++ * controllers and we'd need to maintain 2 identical lists ++ * here in this driver and in usb core. + */ +- error = xpad_inquiry_pad_presence(xpad); ++ udev->quirks |= USB_QUIRK_RESET_RESUME; ++ } else { ++ error = xpad_init_input(xpad); + if (error) +- goto err_kill_in_urb; ++ goto err_deinit_output; + } + return 0; + +-err_kill_in_urb: +- usb_kill_urb(xpad->irq_in); +-err_deinit_input: +- xpad_deinit_input(xpad); + err_deinit_output: + xpad_deinit_output(xpad); + err_free_in_urb: +@@ -1458,19 +1857,24 @@ err_free_idata: + err_free_mem: + kfree(xpad); + return error; +- + } + + static void xpad_disconnect(struct usb_interface *intf) + { +- struct usb_xpad *xpad = usb_get_intfdata (intf); ++ struct usb_xpad *xpad = usb_get_intfdata(intf); ++ ++ if (xpad->xtype == XTYPE_XBOX360W) ++ xpad360w_stop_input(xpad); + + xpad_deinit_input(xpad); +- xpad_deinit_output(xpad); + +- if (xpad->xtype == XTYPE_XBOX360W) { +- usb_kill_urb(xpad->irq_in); +- } ++ /* ++ * Now that both input device and LED device are gone we can ++ * stop output URB. ++ */ ++ xpad_stop_output(xpad); ++ ++ xpad_deinit_output(xpad); + + usb_free_urb(xpad->irq_in); + usb_free_coherent(xpad->udev, XPAD_PKT_LEN, +@@ -1481,10 +1885,72 @@ static void xpad_disconnect(struct usb_interface *intf) + usb_set_intfdata(intf, NULL); + } + ++static int xpad_suspend(struct usb_interface *intf, pm_message_t message) ++{ ++ struct usb_xpad *xpad = usb_get_intfdata(intf); ++ struct input_dev *input = xpad->dev; ++ ++ if (xpad->xtype == XTYPE_XBOX360W) { ++ /* ++ * Wireless controllers always listen to input so ++ * they are notified when controller shows up ++ * or goes away. ++ */ ++ xpad360w_stop_input(xpad); ++ ++ /* ++ * The wireless adapter is going off now, so the ++ * gamepads are going to become disconnected. ++ * Unless explicitly disabled, power them down ++ * so they don't just sit there flashing. ++ */ ++ if (auto_poweroff && xpad->pad_present) ++ xpad360w_poweroff_controller(xpad); ++ } else { ++ mutex_lock(&input->mutex); ++ if (input->users) ++ xpad_stop_input(xpad); ++ mutex_unlock(&input->mutex); ++ } ++ ++ xpad_stop_output(xpad); ++ ++ return 0; ++} ++ ++static int xpad_resume(struct usb_interface *intf) ++{ ++ struct usb_xpad *xpad = usb_get_intfdata(intf); ++ struct input_dev *input = xpad->dev; ++ int retval = 0; ++ ++ if (xpad->xtype == XTYPE_XBOX360W) { ++ retval = xpad360w_start_input(xpad); ++ } else { ++ mutex_lock(&input->mutex); ++ if (input->users) { ++ retval = xpad_start_input(xpad); ++ } else if (xpad->xtype == XTYPE_XBOXONE) { ++ /* ++ * Even if there are no users, we'll send Xbox One pads ++ * the startup sequence so they don't sit there and ++ * blink until somebody opens the input device again. ++ */ ++ retval = xpad_start_xbox_one(xpad); ++ } ++ mutex_unlock(&input->mutex); ++ } ++ ++ return retval; ++} ++ + static struct usb_driver xpad_driver = { + .name = "xpad", + .probe = xpad_probe, + .disconnect = xpad_disconnect, ++ .suspend = xpad_suspend, ++ .resume = xpad_resume, ++ .reset_resume = xpad_resume, + .id_table = xpad_table, + }; + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index eab132778e67..1dbee1cb3df9 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -423,6 +423,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, + } + EXPORT_SYMBOL_GPL(can_put_echo_skb); + ++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) ++{ ++ struct can_priv *priv = netdev_priv(dev); ++ struct sk_buff *skb = priv->echo_skb[idx]; ++ struct canfd_frame *cf; ++ ++ if (idx >= priv->echo_skb_max) { ++ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", ++ __func__, idx, priv->echo_skb_max); ++ return NULL; ++ } ++ ++ if (!skb) { ++ netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", ++ __func__, idx); ++ return NULL; ++ } ++ ++ /* Using "struct canfd_frame::len" for the frame ++ * length is supported on both CAN and CANFD frames. ++ */ ++ cf = (struct canfd_frame *)skb->data; ++ *len_ptr = cf->len; ++ priv->echo_skb[idx] = NULL; ++ ++ return skb; ++} ++ + /* + * Get the skb from the stack and loop it back locally + * +@@ -432,22 +460,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); + */ + unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx) + { +- struct can_priv *priv = netdev_priv(dev); +- +- BUG_ON(idx >= priv->echo_skb_max); +- +- if (priv->echo_skb[idx]) { +- struct sk_buff *skb = priv->echo_skb[idx]; +- struct can_frame *cf = (struct can_frame *)skb->data; +- u8 dlc = cf->can_dlc; ++ struct sk_buff *skb; ++ u8 len; + +- netif_rx(priv->echo_skb[idx]); +- priv->echo_skb[idx] = NULL; ++ skb = __can_get_echo_skb(dev, idx, &len); ++ if (!skb) ++ return 0; + +- return dlc; +- } ++ netif_rx(skb); + +- return 0; ++ return len; + } + EXPORT_SYMBOL_GPL(can_get_echo_skb); + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index 4c73feca4842..0565efad6e6e 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -491,7 +491,7 @@ static int bcmgenet_mii_of_init(struct bcmgenet_priv *priv) + if (!compat) + return -ENOMEM; + +- priv->mdio_dn = of_find_compatible_node(dn, NULL, compat); ++ priv->mdio_dn = of_get_compatible_child(dn, compat); + kfree(compat); + if (!priv->mdio_dn) { + dev_err(kdev, "unable to find MDIO bus node\n"); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 4644357d291a..398068ad0b62 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -4470,7 +4470,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, + } + + ar->free_vdev_map &= ~(1LL << arvif->vdev_id); ++ spin_lock_bh(&ar->data_lock); + list_add(&arvif->list, &ar->arvifs); ++ spin_unlock_bh(&ar->data_lock); + + /* It makes no sense to have firmware do keepalives. mac80211 already + * takes care of this with idle connection polling. +@@ -4603,7 +4605,9 @@ err_peer_delete: + err_vdev_delete: + ath10k_wmi_vdev_delete(ar, arvif->vdev_id); + ar->free_vdev_map |= 1LL << arvif->vdev_id; ++ spin_lock_bh(&ar->data_lock); + list_del(&arvif->list); ++ spin_unlock_bh(&ar->data_lock); + + err: + if (arvif->beacon_buf) { +@@ -4647,7 +4651,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw, + arvif->vdev_id, ret); + + ar->free_vdev_map |= 1LL << arvif->vdev_id; ++ spin_lock_bh(&ar->data_lock); + list_del(&arvif->list); ++ spin_unlock_bh(&ar->data_lock); + + if (arvif->vdev_type == WMI_VDEV_TYPE_AP || + arvif->vdev_type == WMI_VDEV_TYPE_IBSS) { +diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c +index 3dd46c78c1cc..5a595f9f47ff 100644 +--- a/drivers/net/wireless/cw1200/wsm.c ++++ b/drivers/net/wireless/cw1200/wsm.c +@@ -1805,16 +1805,18 @@ static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size) + { + size_t pos = buf->data - buf->begin; + size_t size = pos + extra_size; ++ u8 *tmp; + + size = round_up(size, FWLOAD_BLOCK_SIZE); + +- buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); +- if (buf->begin) { +- buf->data = &buf->begin[pos]; +- buf->end = &buf->begin[size]; +- return 0; +- } else { +- buf->end = buf->data = buf->begin; ++ tmp = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); ++ if (!tmp) { ++ wsm_buf_deinit(buf); + return -ENOMEM; + } ++ ++ buf->begin = tmp; ++ buf->data = &buf->begin[pos]; ++ buf->end = &buf->begin[size]; ++ return 0; + } +diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +index 984cd2f05c4a..7b2a7d848a56 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -322,8 +322,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy, + goto out; + } + +- if (changed) +- *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE); ++ if (changed) { ++ u32 status = le32_to_cpu(resp->status); ++ ++ *changed = (status == MCC_RESP_NEW_CHAN_PROFILE || ++ status == MCC_RESP_ILLEGAL); ++ } + + regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg, + __le32_to_cpu(resp->n_channels), +@@ -4050,10 +4054,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw, + struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + +- if (!fw_has_capa(&mvm->fw->ucode_capa, +- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) +- return; +- + /* if beacon filtering isn't on mac80211 does it anyway */ + if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER)) + return; +diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c +index 2ee0f6fe56a1..5509c5024352 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c +@@ -667,9 +667,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, + + n_channels = __le32_to_cpu(mcc_resp->n_channels); + IWL_DEBUG_LAR(mvm, +- "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n", +- status, mcc, mcc >> 8, mcc & 0xff, +- !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels); ++ "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n", ++ status, mcc, mcc >> 8, mcc & 0xff, n_channels); + + resp_len = sizeof(*mcc_resp) + n_channels * sizeof(__le32); + resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL); +diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c +index 9a8982f581c5..1e074eaf613d 100644 +--- a/drivers/net/wireless/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/mwifiex/cfg80211.c +@@ -1150,6 +1150,12 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy, + priv->adapter->curr_iface_comb.p2p_intf--; + priv->adapter->curr_iface_comb.sta_intf++; + dev->ieee80211_ptr->iftype = type; ++ if (mwifiex_deinit_priv_params(priv)) ++ return -1; ++ if (mwifiex_init_new_priv_params(priv, dev, type)) ++ return -1; ++ if (mwifiex_sta_init_cmd(priv, false, false)) ++ return -1; + break; + case NL80211_IFTYPE_ADHOC: + if (mwifiex_cfg80211_deinit_p2p(priv)) +@@ -2839,8 +2845,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev) + + mwifiex_stop_net_dev_queue(priv->netdev, adapter); + +- skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) ++ skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { ++ skb_unlink(skb, &priv->bypass_txq); + mwifiex_write_data_complete(priv->adapter, skb, 0, -1); ++ } + + if (netif_carrier_ok(priv->netdev)) + netif_carrier_off(priv->netdev); +diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c +index acccd6734e3b..ed8b69d1d65c 100644 +--- a/drivers/net/wireless/mwifiex/wmm.c ++++ b/drivers/net/wireless/mwifiex/wmm.c +@@ -501,8 +501,10 @@ mwifiex_wmm_del_pkts_in_ralist_node(struct mwifiex_private *priv, + struct mwifiex_adapter *adapter = priv->adapter; + struct sk_buff *skb, *tmp; + +- skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) ++ skb_queue_walk_safe(&ra_list->skb_head, skb, tmp) { ++ skb_unlink(skb, &ra_list->skb_head); + mwifiex_write_data_complete(adapter, skb, 0, -1); ++ } + } + + /* +@@ -598,11 +600,15 @@ mwifiex_clean_txrx(struct mwifiex_private *priv) + priv->adapter->if_ops.clean_pcie_ring(priv->adapter); + spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); + +- skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) ++ skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) { ++ skb_unlink(skb, &priv->tdls_txq); + mwifiex_write_data_complete(priv->adapter, skb, 0, -1); ++ } + +- skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) ++ skb_queue_walk_safe(&priv->bypass_txq, skb, tmp) { ++ skb_unlink(skb, &priv->bypass_txq); + mwifiex_write_data_complete(priv->adapter, skb, 0, -1); ++ } + atomic_set(&priv->adapter->bypass_tx_pending, 0); + + idr_for_each(&priv->ack_status_frames, mwifiex_free_ack_frame, NULL); +diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c +index 6c0c301611c4..1b11ded79c4f 100644 +--- a/drivers/nfc/nfcmrvl/uart.c ++++ b/drivers/nfc/nfcmrvl/uart.c +@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node, + struct device_node *matched_node; + int ret; + +- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart"); ++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart"); + if (!matched_node) { +- matched_node = of_find_compatible_node(node, NULL, +- "mrvl,nfc-uart"); ++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart"); + if (!matched_node) + return -ENODEV; + } +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 31341290cd91..c6e019208d17 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -712,6 +712,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node, + } + EXPORT_SYMBOL(of_get_next_available_child); + ++/** ++ * of_get_compatible_child - Find compatible child node ++ * @parent: parent node ++ * @compatible: compatible string ++ * ++ * Lookup child node whose compatible property contains the given compatible ++ * string. ++ * ++ * Returns a node pointer with refcount incremented, use of_node_put() on it ++ * when done; or NULL if not found. ++ */ ++struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible) ++{ ++ struct device_node *child; ++ ++ for_each_child_of_node(parent, child) { ++ if (of_device_is_compatible(child, compatible)) ++ break; ++ } ++ ++ return child; ++} ++EXPORT_SYMBOL(of_get_compatible_child); ++ + /** + * of_get_child_by_name - Find the child node by name for a given parent + * @node: parent node +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 18b19744398a..ff5df33fc740 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -685,6 +685,11 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd) + srb_t *sp; + int rval; + ++ if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) { ++ cmd->result = DID_NO_CONNECT << 16; ++ goto qc24_fail_command; ++ } ++ + if (ha->flags.eeh_busy) { + if (ha->flags.pci_channel_io_perm_failure) { + ql_dbg(ql_dbg_aer, vha, 0x9010, +diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h +index 42c459a9d3fe..ce5234555cc9 100644 +--- a/drivers/scsi/ufs/ufs.h ++++ b/drivers/scsi/ufs/ufs.h +@@ -45,6 +45,7 @@ + #define QUERY_DESC_MIN_SIZE 2 + #define QUERY_OSF_SIZE (GENERAL_UPIU_REQUEST_SIZE - \ + (sizeof(struct utp_upiu_header))) ++#define RESPONSE_UPIU_SENSE_DATA_LENGTH 18 + + #define UPIU_HEADER_DWORD(byte3, byte2, byte1, byte0)\ + cpu_to_be32((byte3 << 24) | (byte2 << 16) |\ +@@ -383,7 +384,7 @@ struct utp_cmd_rsp { + __be32 residual_transfer_count; + __be32 reserved[4]; + __be16 sense_data_len; +- u8 sense_data[18]; ++ u8 sense_data[RESPONSE_UPIU_SENSE_DATA_LENGTH]; + }; + + /** +diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c +index d15eaa466c59..52b546fb509b 100644 +--- a/drivers/scsi/ufs/ufshcd-pci.c ++++ b/drivers/scsi/ufs/ufshcd-pci.c +@@ -104,6 +104,7 @@ static void ufshcd_pci_remove(struct pci_dev *pdev) + pm_runtime_forbid(&pdev->dev); + pm_runtime_get_noresume(&pdev->dev); + ufshcd_remove(hba); ++ ufshcd_dealloc_host(hba); + } + + /** +@@ -147,6 +148,7 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + err = ufshcd_init(hba, mmio_base, pdev->irq); + if (err) { + dev_err(&pdev->dev, "Initialization failed\n"); ++ ufshcd_dealloc_host(hba); + return err; + } + +diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c +index 9714f2a8b329..f58abfcdfe81 100644 +--- a/drivers/scsi/ufs/ufshcd-pltfrm.c ++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c +@@ -161,7 +161,7 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name, + if (ret) { + dev_err(dev, "%s: unable to find %s err %d\n", + __func__, prop_name, ret); +- goto out_free; ++ goto out; + } + + vreg->min_uA = 0; +@@ -183,9 +183,6 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name, + + goto out; + +-out_free: +- devm_kfree(dev, vreg); +- vreg = NULL; + out: + if (!ret) + *out_vreg = vreg; +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 8c58adadb728..c94d465de941 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -585,6 +585,21 @@ int ufshcd_hold(struct ufs_hba *hba, bool async) + start: + switch (hba->clk_gating.state) { + case CLKS_ON: ++ /* ++ * Wait for the ungate work to complete if in progress. ++ * Though the clocks may be in ON state, the link could ++ * still be in hibner8 state if hibern8 is allowed ++ * during clock gating. ++ * Make sure we exit hibern8 state also in addition to ++ * clocks being ON. ++ */ ++ if (ufshcd_can_hibern8_during_gating(hba) && ++ ufshcd_is_link_hibern8(hba)) { ++ spin_unlock_irqrestore(hba->host->host_lock, flags); ++ flush_work(&hba->clk_gating.ungate_work); ++ spin_lock_irqsave(hba->host->host_lock, flags); ++ goto start; ++ } + break; + case REQ_CLKS_OFF: + if (cancel_delayed_work(&hba->clk_gating.gate_work)) { +@@ -813,10 +828,14 @@ static inline void ufshcd_copy_sense_data(struct ufshcd_lrb *lrbp) + int len; + if (lrbp->sense_buffer && + ufshcd_get_rsp_upiu_data_seg_len(lrbp->ucd_rsp_ptr)) { ++ int len_to_copy; ++ + len = be16_to_cpu(lrbp->ucd_rsp_ptr->sr.sense_data_len); ++ len_to_copy = min_t(int, RESPONSE_UPIU_SENSE_DATA_LENGTH, len); ++ + memcpy(lrbp->sense_buffer, + lrbp->ucd_rsp_ptr->sr.sense_data, +- min_t(int, len, SCSI_SENSE_BUFFERSIZE)); ++ min_t(int, len_to_copy, SCSI_SENSE_BUFFERSIZE)); + } + } + +@@ -5251,7 +5270,10 @@ EXPORT_SYMBOL(ufshcd_system_suspend); + + int ufshcd_system_resume(struct ufs_hba *hba) + { +- if (!hba || !hba->is_powered || pm_runtime_suspended(hba->dev)) ++ if (!hba) ++ return -EINVAL; ++ ++ if (!hba->is_powered || pm_runtime_suspended(hba->dev)) + /* + * Let the runtime resume take care of resuming + * if runtime suspended. +@@ -5272,7 +5294,10 @@ EXPORT_SYMBOL(ufshcd_system_resume); + */ + int ufshcd_runtime_suspend(struct ufs_hba *hba) + { +- if (!hba || !hba->is_powered) ++ if (!hba) ++ return -EINVAL; ++ ++ if (!hba->is_powered) + return 0; + + return ufshcd_suspend(hba, UFS_RUNTIME_PM); +@@ -5302,10 +5327,13 @@ EXPORT_SYMBOL(ufshcd_runtime_suspend); + */ + int ufshcd_runtime_resume(struct ufs_hba *hba) + { +- if (!hba || !hba->is_powered) ++ if (!hba) ++ return -EINVAL; ++ ++ if (!hba->is_powered) + return 0; +- else +- return ufshcd_resume(hba, UFS_RUNTIME_PM); ++ ++ return ufshcd_resume(hba, UFS_RUNTIME_PM); + } + EXPORT_SYMBOL(ufshcd_runtime_resume); + +@@ -5357,8 +5385,6 @@ void ufshcd_remove(struct ufs_hba *hba) + ufshcd_disable_intr(hba, hba->intr_mask); + ufshcd_hba_stop(hba); + +- scsi_host_put(hba->host); +- + ufshcd_exit_clk_gating(hba); + if (ufshcd_is_clkscaling_enabled(hba)) + devfreq_remove_device(hba->devfreq); +@@ -5483,15 +5509,47 @@ static int ufshcd_devfreq_target(struct device *dev, + { + int err = 0; + struct ufs_hba *hba = dev_get_drvdata(dev); ++ bool release_clk_hold = false; ++ unsigned long irq_flags; + + if (!ufshcd_is_clkscaling_enabled(hba)) + return -EINVAL; + ++ spin_lock_irqsave(hba->host->host_lock, irq_flags); ++ if (ufshcd_eh_in_progress(hba)) { ++ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); ++ return 0; ++ } ++ ++ if (ufshcd_is_clkgating_allowed(hba) && ++ (hba->clk_gating.state != CLKS_ON)) { ++ if (cancel_delayed_work(&hba->clk_gating.gate_work)) { ++ /* hold the vote until the scaling work is completed */ ++ hba->clk_gating.active_reqs++; ++ release_clk_hold = true; ++ hba->clk_gating.state = CLKS_ON; ++ } else { ++ /* ++ * Clock gating work seems to be running in parallel ++ * hence skip scaling work to avoid deadlock between ++ * current scaling work and gating work. ++ */ ++ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); ++ return 0; ++ } ++ } ++ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); ++ + if (*freq == UINT_MAX) + err = ufshcd_scale_clks(hba, true); + else if (*freq == 0) + err = ufshcd_scale_clks(hba, false); + ++ spin_lock_irqsave(hba->host->host_lock, irq_flags); ++ if (release_clk_hold) ++ __ufshcd_release(hba); ++ spin_unlock_irqrestore(hba->host->host_lock, irq_flags); ++ + return err; + } + +@@ -5673,7 +5731,6 @@ exit_gating: + ufshcd_exit_clk_gating(hba); + out_disable: + hba->is_irq_enabled = false; +- scsi_host_put(host); + ufshcd_hba_exit(hba); + out_error: + return err; +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index b1ec202099b2..b74de014cef1 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -165,15 +165,29 @@ static inline int tty_put_user(struct tty_struct *tty, unsigned char x, + return put_user(x, ptr); + } + ++/* If we are not echoing the data, perhaps this is a secret so erase it */ ++static inline void zero_buffer(struct tty_struct *tty, u8 *buffer, int size) ++{ ++ bool icanon = !!L_ICANON(tty); ++ bool no_echo = !L_ECHO(tty); ++ ++ if (icanon && no_echo) ++ memset(buffer, 0x00, size); ++} ++ + static inline int tty_copy_to_user(struct tty_struct *tty, + void __user *to, +- const void *from, ++ void *from, + unsigned long n) + { + struct n_tty_data *ldata = tty->disc_data; ++ int retval; + + tty_audit_add_data(tty, from, n, ldata->icanon); +- return copy_to_user(to, from, n); ++ retval = copy_to_user(to, from, n); ++ if (!retval) ++ zero_buffer(tty, from, n); ++ return retval; + } + + /** +@@ -2005,6 +2019,7 @@ static int copy_from_read_buf(struct tty_struct *tty, + is_eof = n == 1 && read_buf(ldata, tail) == EOF_CHAR(tty); + tty_audit_add_data(tty, read_buf_addr(ldata, tail), n, + ldata->icanon); ++ zero_buffer(tty, read_buf_addr(ldata, tail), n); + smp_store_release(&ldata->read_tail, ldata->read_tail + n); + /* Turn single EOF into zero-length read */ + if (L_EXTPROC(tty) && ldata->icanon && is_eof && +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index 8f3566cde3eb..355e9cad680d 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -454,6 +454,8 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count) + if (count && disc->ops->receive_buf) + disc->ops->receive_buf(tty, p, f, count); + } ++ if (count > 0) ++ memset(p, 0, count); + return count; + } + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 2facffea2ee0..f7af730aae82 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2757,7 +2757,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1, + USB_PORT_FEAT_C_BH_PORT_RESET); + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_PORT_LINK_STATE); +- usb_clear_port_feature(hub->hdev, port1, ++ ++ if (udev) ++ usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_CONNECTION); + + /* +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index aee29604bd79..5d21cd8359d4 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -744,7 +744,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + status |= USB_PORT_STAT_SUSPEND; + } + if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME && +- !DEV_SUPERSPEED_ANY(raw_port_status)) { ++ !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) { + if ((raw_port_status & PORT_RESET) || + !(raw_port_status & PORT_PE)) + return 0xffffffff; +@@ -790,7 +790,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies( +- XHCI_MAX_REXIT_TIMEOUT)); ++ XHCI_MAX_REXIT_TIMEOUT_MS)); + spin_lock_irqsave(&xhci->lock, flags); + + if (time_left) { +@@ -804,7 +804,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + } else { + int port_status = readl(port_array[wIndex]); + xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n", +- XHCI_MAX_REXIT_TIMEOUT, ++ XHCI_MAX_REXIT_TIMEOUT_MS, + port_status); + status |= USB_PORT_STAT_SUSPEND; + clear_bit(wIndex, &bus_state->rexit_ports); +@@ -1298,13 +1298,16 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + __le32 __iomem **port_array; + struct xhci_bus_state *bus_state; + unsigned long flags; ++ u32 portsc_buf[USB_MAXCHILDREN]; ++ bool wake_enabled; + + max_ports = xhci_get_ports(hcd, &port_array); + bus_state = &xhci->bus_state[hcd_index(hcd)]; ++ wake_enabled = hcd->self.root_hub->do_remote_wakeup; + + spin_lock_irqsave(&xhci->lock, flags); + +- if (hcd->self.root_hub->do_remote_wakeup) { ++ if (wake_enabled) { + if (bus_state->resuming_ports || /* USB2 */ + bus_state->port_remote_wakeup) { /* USB3 */ + spin_unlock_irqrestore(&xhci->lock, flags); +@@ -1312,26 +1315,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + return -EBUSY; + } + } +- +- port_index = max_ports; ++ /* ++ * Prepare ports for suspend, but don't write anything before all ports ++ * are checked and we know bus suspend can proceed ++ */ + bus_state->bus_suspended = 0; ++ port_index = max_ports; + while (port_index--) { +- /* suspend the port if the port is not suspended */ + u32 t1, t2; +- int slot_id; + + t1 = readl(port_array[port_index]); + t2 = xhci_port_state_to_neutral(t1); ++ portsc_buf[port_index] = 0; + +- if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) { +- xhci_dbg(xhci, "port %d not suspended\n", port_index); +- slot_id = xhci_find_slot_id_by_port(hcd, xhci, +- port_index + 1); +- if (slot_id) { ++ /* Bail out if a USB3 port has a new device in link training */ ++ if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) { ++ bus_state->bus_suspended = 0; ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n"); ++ return -EBUSY; ++ } ++ ++ /* suspend ports in U0, or bail out for new connect changes */ ++ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { ++ if ((t1 & PORT_CSC) && wake_enabled) { ++ bus_state->bus_suspended = 0; + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_stop_device(xhci, slot_id, 1); +- spin_lock_irqsave(&xhci->lock, flags); ++ xhci_dbg(xhci, "Bus suspend bailout, port connect change\n"); ++ return -EBUSY; + } ++ xhci_dbg(xhci, "port %d not suspended\n", port_index); + t2 &= ~PORT_PLS_MASK; + t2 |= PORT_LINK_STROBE | XDEV_U3; + set_bit(port_index, &bus_state->bus_suspended); +@@ -1340,7 +1353,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + * including the USB 3.0 roothub, but only if CONFIG_PM + * is enabled, so also enable remote wake here. + */ +- if (hcd->self.root_hub->do_remote_wakeup) { ++ if (wake_enabled) { + if (t1 & PORT_CONNECT) { + t2 |= PORT_WKOC_E | PORT_WKDISC_E; + t2 &= ~PORT_WKCONN_E; +@@ -1353,7 +1366,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + + t1 = xhci_port_state_to_neutral(t1); + if (t1 != t2) +- writel(t2, port_array[port_index]); ++ portsc_buf[port_index] = t2; ++ } ++ ++ /* write port settings, stopping and suspending ports if needed */ ++ port_index = max_ports; ++ while (port_index--) { ++ if (!portsc_buf[port_index]) ++ continue; ++ if (test_bit(port_index, &bus_state->bus_suspended)) { ++ int slot_id; ++ ++ slot_id = xhci_find_slot_id_by_port(hcd, xhci, ++ port_index + 1); ++ if (slot_id) { ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_stop_device(xhci, slot_id, 1); ++ spin_lock_irqsave(&xhci->lock, flags); ++ } ++ } ++ writel(portsc_buf[port_index], port_array[port_index]); + } + hcd->state = HC_STATE_SUSPENDED; + bus_state->next_statechange = jiffies + msecs_to_jiffies(10); +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index ece0787d62bf..845fa426fa0d 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1673,7 +1673,7 @@ static void handle_port_status(struct xhci_hcd *xhci, + * RExit to a disconnect state). If so, let the the driver know it's + * out of the RExit state. + */ +- if (!DEV_SUPERSPEED_ANY(temp) && ++ if (!DEV_SUPERSPEED_ANY(temp) && hcd->speed < HCD_USB3 && + test_and_clear_bit(faked_port_index, + &bus_state->rexit_ports)) { + complete(&bus_state->rexit_done[faked_port_index]); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 84d8871755b7..0635cea42e6f 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1490,7 +1490,7 @@ struct xhci_bus_state { + * It can take up to 20 ms to transition from RExit to U0 on the + * Intel Lynx Point LP xHCI host. + */ +-#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000) ++#define XHCI_MAX_REXIT_TIMEOUT_MS 20 + + static inline unsigned int hcd_index(struct usb_hcd *hcd) + { +diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c +index 5cc00e56206e..7d889f56b8e7 100644 +--- a/fs/9p/vfs_dir.c ++++ b/fs/9p/vfs_dir.c +@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstat *mistat) + return rettype; + } + +-static void p9stat_init(struct p9_wstat *stbuf) +-{ +- stbuf->name = NULL; +- stbuf->uid = NULL; +- stbuf->gid = NULL; +- stbuf->muid = NULL; +- stbuf->extension = NULL; +-} +- + /** + * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir + * @filp: opened file structure +@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) + rdir->tail = n; + } + while (rdir->head < rdir->tail) { +- p9stat_init(&st); + err = p9stat_read(fid->clnt, rdir->buf + rdir->head, + rdir->tail - rdir->head, &st); + if (err) { + p9_debug(P9_DEBUG_VFS, "returned %d\n", err); +- p9stat_free(&st); + return -EIO; + } + reclen = st.size+2; +diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c +index fdcb4d69f430..4714c55c1ae5 100644 +--- a/fs/bfs/inode.c ++++ b/fs/bfs/inode.c +@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) + + s->s_magic = BFS_MAGIC; + +- if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) { ++ if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) || ++ le32_to_cpu(bfs_sb->s_start) < BFS_BSIZE) { + printf("Superblock is corrupted\n"); + goto out1; + } +@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent) + sizeof(struct bfs_inode) + + BFS_ROOT_INO - 1; + imap_len = (info->si_lasti / 8) + 1; +- info->si_imap = kzalloc(imap_len, GFP_KERNEL); +- if (!info->si_imap) ++ info->si_imap = kzalloc(imap_len, GFP_KERNEL | __GFP_NOWARN); ++ if (!info->si_imap) { ++ printf("Cannot allocate %u bytes\n", imap_len); + goto out1; ++ } + for (i = 0; i < BFS_ROOT_INO; i++) + set_bit(i, info->si_imap); + +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 80cd28456f08..13ff0fdae03e 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -10708,17 +10708,9 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range) + u64 start; + u64 end; + u64 trimmed = 0; +- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); + int ret = 0; + +- /* +- * try to trim all FS space, our block group may start from non-zero. +- */ +- if (range->len == total_bytes) +- cache = btrfs_lookup_first_block_group(fs_info, range->start); +- else +- cache = btrfs_lookup_block_group(fs_info, range->start); +- ++ cache = btrfs_lookup_first_block_group(fs_info, range->start); + while (cache) { + if (cache->key.objectid >= (range->start + range->len)) { + btrfs_put_block_group(cache); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 150d3c891815..3379490ce54d 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -378,7 +378,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) + struct fstrim_range range; + u64 minlen = ULLONG_MAX; + u64 num_devices = 0; +- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy); + int ret; + + if (!capable(CAP_SYS_ADMIN)) +@@ -402,11 +401,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg) + return -EOPNOTSUPP; + if (copy_from_user(&range, arg, sizeof(range))) + return -EFAULT; +- if (range.start > total_bytes || +- range.len < fs_info->sb->s_blocksize) ++ ++ /* ++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of ++ * block group is in the logical address space, which can be any ++ * sectorsize aligned bytenr in the range [0, U64_MAX]. ++ */ ++ if (range.len < fs_info->sb->s_blocksize) + return -EINVAL; + +- range.len = min(range.len, total_bytes - range.start); + range.minlen = max(range.minlen, minlen); + ret = btrfs_trim_fs(fs_info->tree_root, &range); + if (ret < 0) +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index d9178388cf48..de7143e2b361 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -71,13 +71,13 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb) + if (!sdp) + return NULL; + +- sb->s_fs_info = sdp; + sdp->sd_vfs = sb; + sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats); + if (!sdp->sd_lkstats) { + kfree(sdp); + return NULL; + } ++ sb->s_fs_info = sdp; + + set_bit(SDF_NOJOURNALID, &sdp->sd_flags); + gfs2_tune_init(&sdp->sd_tune); +diff --git a/fs/namei.c b/fs/namei.c +index de57dd59d95f..40049d61ef37 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -869,6 +869,8 @@ static inline void put_link(struct nameidata *nd) + + int sysctl_protected_symlinks __read_mostly = 0; + int sysctl_protected_hardlinks __read_mostly = 0; ++int sysctl_protected_fifos __read_mostly; ++int sysctl_protected_regular __read_mostly; + + /** + * may_follow_link - Check symlink following for unsafe situations +@@ -982,6 +984,45 @@ static int may_linkat(struct path *link) + return -EPERM; + } + ++/** ++ * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory ++ * should be allowed, or not, on files that already ++ * exist. ++ * @dir: the sticky parent directory ++ * @inode: the inode of the file to open ++ * ++ * Block an O_CREAT open of a FIFO (or a regular file) when: ++ * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled ++ * - the file already exists ++ * - we are in a sticky directory ++ * - we don't own the file ++ * - the owner of the directory doesn't own the file ++ * - the directory is world writable ++ * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 ++ * the directory doesn't have to be world writable: being group writable will ++ * be enough. ++ * ++ * Returns 0 if the open is allowed, -ve on error. ++ */ ++static int may_create_in_sticky(struct dentry * const dir, ++ struct inode * const inode) ++{ ++ if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || ++ (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || ++ likely(!(dir->d_inode->i_mode & S_ISVTX)) || ++ uid_eq(inode->i_uid, dir->d_inode->i_uid) || ++ uid_eq(current_fsuid(), inode->i_uid)) ++ return 0; ++ ++ if (likely(dir->d_inode->i_mode & 0002) || ++ (dir->d_inode->i_mode & 0020 && ++ ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || ++ (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { ++ return -EACCES; ++ } ++ return 0; ++} ++ + static __always_inline + const char *get_link(struct nameidata *nd) + { +@@ -3166,9 +3207,15 @@ finish_open: + error = -ELOOP; + goto out; + } +- error = -EISDIR; +- if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) +- goto out; ++ if (open_flag & O_CREAT) { ++ error = -EISDIR; ++ if (d_is_dir(nd->path.dentry)) ++ goto out; ++ error = may_create_in_sticky(dir, ++ d_backing_inode(nd->path.dentry)); ++ if (unlikely(error)) ++ goto out; ++ } + error = -ENOTDIR; + if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) + goto out; +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index 5f5270941ba0..f7178f44825b 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -154,6 +154,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf, + + void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, + unsigned int idx); ++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr); + unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx); + void can_free_echo_skb(struct net_device *dev, unsigned int idx); + +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 240cbaee819f..13277d2715df 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -65,6 +65,8 @@ extern struct inodes_stat_t inodes_stat; + extern int leases_enable, lease_break_time; + extern int sysctl_protected_symlinks; + extern int sysctl_protected_hardlinks; ++extern int sysctl_protected_fifos; ++extern int sysctl_protected_regular; + + struct buffer_head; + typedef int (get_block_t)(struct inode *inode, sector_t iblock, +diff --git a/include/linux/of.h b/include/linux/of.h +index dd10626a615f..d9371c9cd88a 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -265,6 +265,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node, + extern struct device_node *of_get_next_available_child( + const struct device_node *node, struct device_node *prev); + ++extern struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible); + extern struct device_node *of_get_child_by_name(const struct device_node *node, + const char *name); + +@@ -462,6 +464,12 @@ static inline bool of_have_populated_dt(void) + return false; + } + ++static inline struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible) ++{ ++ return NULL; ++} ++ + static inline struct device_node *of_get_child_by_name( + const struct device_node *node, + const char *name) +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index 77777d918676..cc892a9e109d 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -215,7 +215,7 @@ static char *kdb_read(char *buffer, size_t bufsize) + int count; + int i; + int diag, dtab_count; +- int key; ++ int key, buf_size, ret; + + + diag = kdbgetintenv("DTABCOUNT", &dtab_count); +@@ -335,9 +335,8 @@ poll_again: + else + p_tmp = tmpbuffer; + len = strlen(p_tmp); +- count = kallsyms_symbol_complete(p_tmp, +- sizeof(tmpbuffer) - +- (p_tmp - tmpbuffer)); ++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer); ++ count = kallsyms_symbol_complete(p_tmp, buf_size); + if (tab == 2 && count > 0) { + kdb_printf("\n%d symbols are found.", count); + if (count > dtab_count) { +@@ -349,9 +348,13 @@ poll_again: + } + kdb_printf("\n"); + for (i = 0; i < count; i++) { +- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) ++ ret = kallsyms_symbol_next(p_tmp, i, buf_size); ++ if (WARN_ON(!ret)) + break; +- kdb_printf("%s ", p_tmp); ++ if (ret != -E2BIG) ++ kdb_printf("%s ", p_tmp); ++ else ++ kdb_printf("%s... ", p_tmp); + *(p_tmp + len) = '\0'; + } + if (i >= dtab_count) +diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h +index 75014d7f4568..533e04e75a9c 100644 +--- a/kernel/debug/kdb/kdb_private.h ++++ b/kernel/debug/kdb/kdb_private.h +@@ -83,7 +83,7 @@ typedef struct __ksymtab { + unsigned long sym_start; + unsigned long sym_end; + } kdb_symtab_t; +-extern int kallsyms_symbol_next(char *prefix_name, int flag); ++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size); + extern int kallsyms_symbol_complete(char *prefix_name, int max_len); + + /* Exported Symbols for kernel loadable modules to use. */ +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index d35cc2d3a4cc..2aed4a33521b 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len) + * Parameters: + * prefix_name prefix of a symbol name to lookup + * flag 0 means search from the head, 1 means continue search. ++ * buf_size maximum length that can be written to prefix_name ++ * buffer + * Returns: + * 1 if a symbol matches the given prefix. + * 0 if no string found + */ +-int kallsyms_symbol_next(char *prefix_name, int flag) ++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size) + { + int prefix_len = strlen(prefix_name); + static loff_t pos; +@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag) + pos = 0; + + while ((name = kdb_walk_kallsyms(&pos))) { +- if (strncmp(name, prefix_name, prefix_len) == 0) { +- strncpy(prefix_name, name, strlen(name)+1); +- return 1; +- } ++ if (!strncmp(name, prefix_name, prefix_len)) ++ return strscpy(prefix_name, name, buf_size); + } + return 0; + } +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 4743e1f2a3d1..d0618951014b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3822,8 +3822,8 @@ static int __sched_setscheduler(struct task_struct *p, + struct rq *rq; + int reset_on_fork; + +- /* may grab non-irq protected spin_locks */ +- BUG_ON(in_interrupt()); ++ /* The pi code expects interrupts enabled */ ++ BUG_ON(pi && in_interrupt()); + recheck: + /* double check policy once rq lock held */ + if (policy < 0) { +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 66100d1bc3f7..7e832f9a8f42 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1715,6 +1715,24 @@ static struct ctl_table fs_table[] = { + .extra1 = &zero, + .extra2 = &one, + }, ++ { ++ .procname = "protected_fifos", ++ .data = &sysctl_protected_fifos, ++ .maxlen = sizeof(int), ++ .mode = 0600, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &zero, ++ .extra2 = &two, ++ }, ++ { ++ .procname = "protected_regular", ++ .data = &sysctl_protected_regular, ++ .maxlen = sizeof(int), ++ .mode = 0600, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &zero, ++ .extra2 = &two, ++ }, + { + .procname = "suid_dumpable", + .data = &suid_dumpable, +diff --git a/mm/shmem.c b/mm/shmem.c +index 8e506a45a6ef..d902b413941a 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1818,9 +1818,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence) + mutex_lock(&inode->i_mutex); + /* We're holding i_mutex so we can access i_size directly */ + +- if (offset < 0) +- offset = -EINVAL; +- else if (offset >= inode->i_size) ++ if (offset < 0 || offset >= inode->i_size) + offset = -ENXIO; + else { + start = offset >> PAGE_CACHE_SHIFT; +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 83e8a295c806..c153fc2883a8 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -726,7 +726,6 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + struct sk_buff *skb = NULL; + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); +- unsigned long cpu_flags; + size_t copied = 0; + u32 peek_seq = 0; + u32 *seq, skb_len; +@@ -851,9 +850,8 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + goto copy_uaddr; + + if (!(flags & MSG_PEEK)) { +- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); +- sk_eat_skb(sk, skb); +- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); ++ skb_unlink(skb, &sk->sk_receive_queue); ++ kfree_skb(skb); + *seq = 0; + } + +@@ -874,9 +872,8 @@ copy_uaddr: + llc_cmsg_rcv(msg, skb); + + if (!(flags & MSG_PEEK)) { +- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags); +- sk_eat_skb(sk, skb); +- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags); ++ skb_unlink(skb, &sk->sk_receive_queue); ++ kfree_skb(skb); + *seq = 0; + } + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 120e9ae04db3..a7967af0da82 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3452,6 +3452,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + dreg = nft_type_to_reg(set->dtype); + list_for_each_entry(binding, &set->bindings, list) { + struct nft_ctx bind_ctx = { ++ .net = ctx->net, + .afi = ctx->afi, + .table = ctx->table, + .chain = (struct nft_chain *)binding->chain, +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index a40b8b0ef0d5..f085b01b6603 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -486,8 +486,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc, + void sctp_assoc_rm_peer(struct sctp_association *asoc, + struct sctp_transport *peer) + { +- struct list_head *pos; +- struct sctp_transport *transport; ++ struct sctp_transport *transport; ++ struct list_head *pos; ++ struct sctp_chunk *ch; + + pr_debug("%s: association:%p addr:%pISpc\n", + __func__, asoc, &peer->ipaddr.sa); +@@ -543,7 +544,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, + */ + if (!list_empty(&peer->transmitted)) { + struct sctp_transport *active = asoc->peer.active_path; +- struct sctp_chunk *ch; + + /* Reset the transport of each chunk on this list */ + list_for_each_entry(ch, &peer->transmitted, +@@ -565,6 +565,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc, + sctp_transport_hold(active); + } + ++ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) ++ if (ch->transport == peer) ++ ch->transport = NULL; ++ + asoc->peer.transport_count--; + + sctp_transport_free(peer); +diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c +index 41248b1820c7..cc27e38392ea 100644 +--- a/net/sunrpc/auth_generic.c ++++ b/net/sunrpc/auth_generic.c +@@ -272,13 +272,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred) + { + struct auth_cred *acred = &container_of(cred, struct generic_cred, + gc_base)->acred; +- bool ret; +- +- get_rpccred(cred); +- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); +- put_rpccred(cred); +- +- return ret; ++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); + } + + static const struct rpc_credops generic_credops = {
