commit:     b7b2db12cdfb5ce9ea00722820b26c7d019fc9b7
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 12 17:08:23 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 12 17:08:23 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b7b2db12

Linux patch 4.4.236

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1235_linux-4.4.236.patch | 2361 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2365 insertions(+)

diff --git a/0000_README b/0000_README
index d526939..5d33eba 100644
--- a/0000_README
+++ b/0000_README
@@ -983,6 +983,10 @@ Patch:  1234_linux-4.4.235.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.235
 
+Patch:  1235_linux-4.4.236.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.236
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1235_linux-4.4.236.patch b/1235_linux-4.4.236.patch
new file mode 100644
index 0000000..edf469e
--- /dev/null
+++ b/1235_linux-4.4.236.patch
@@ -0,0 +1,2361 @@
+diff --git a/Documentation/filesystems/affs.txt 
b/Documentation/filesystems/affs.txt
+index 71b63c2b98410..a8f1a58e36922 100644
+--- a/Documentation/filesystems/affs.txt
++++ b/Documentation/filesystems/affs.txt
+@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as 
follows:
+ 
+   - R maps to r for user, group and others. On directories, R implies x.
+ 
+-  - If both W and D are allowed, w will be set.
++  - W maps to w.
+ 
+   - E maps to x.
+ 
+-  - H and P are always retained and ignored under Linux.
++  - D is ignored.
+ 
+-  - A is always reset when a file is written to.
++  - H, S and P are always retained and ignored under Linux.
++
++  - A is cleared when a file is written to.
+ 
+ User id and group id will be used unless set[gu]id are given as mount
+ options. Since most of the Amiga file systems are single user systems
+@@ -111,11 +113,13 @@ Linux -> Amiga:
+ 
+ The Linux rwxrwxrwx file mode is handled as follows:
+ 
+-  - r permission will set R for user, group and others.
++  - r permission will allow R for user, group and others.
++
++  - w permission will allow W for user, group and others.
+ 
+-  - w permission will set W and D for user, group and others.
++  - x permission of the user will allow E for plain files.
+ 
+-  - x permission of the user will set E for plain files.
++  - D will be allowed for user, group and others.
+ 
+   - All other flags (suid, sgid, ...) are ignored and will
+     not be retained.
+diff --git a/Makefile b/Makefile
+index a32490d4471f3..b954cb21fddc7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 235
++SUBLEVEL = 236
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
+index 6d6556ca24aa2..f715419a72cf0 100644
+--- a/arch/s390/include/asm/percpu.h
++++ b/arch/s390/include/asm/percpu.h
+@@ -28,7 +28,7 @@
+       typedef typeof(pcp) pcp_op_T__;                                 \
+       pcp_op_T__ old__, new__, prev__;                                \
+       pcp_op_T__ *ptr__;                                              \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                                    \
+       prev__ = *ptr__;                                                \
+       do {                                                            \
+@@ -36,7 +36,7 @@
+               new__ = old__ op (val);                                 \
+               prev__ = cmpxchg(ptr__, old__, new__);                  \
+       } while (prev__ != old__);                                      \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+       new__;                                                          \
+ })
+ 
+@@ -67,7 +67,7 @@
+       typedef typeof(pcp) pcp_op_T__;                                 \
+       pcp_op_T__ val__ = (val);                                       \
+       pcp_op_T__ old__, *ptr__;                                       \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                            \
+       if (__builtin_constant_p(val__) &&                              \
+           ((szcast)val__ > -129) && ((szcast)val__ < 128)) {          \
+@@ -83,7 +83,7 @@
+                       : [val__] "d" (val__)                           \
+                       : "cc");                                        \
+       }                                                               \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+ }
+ 
+ #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", 
int)
+@@ -94,14 +94,14 @@
+       typedef typeof(pcp) pcp_op_T__;                                 \
+       pcp_op_T__ val__ = (val);                                       \
+       pcp_op_T__ old__, *ptr__;                                       \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                                    \
+       asm volatile(                                                   \
+               op "    %[old__],%[val__],%[ptr__]\n"                   \
+               : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__)           \
+               : [val__] "d" (val__)                                   \
+               : "cc");                                                \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                               
\
+       old__ + val__;                                                  \
+ })
+ 
+@@ -113,14 +113,14 @@
+       typedef typeof(pcp) pcp_op_T__;                                 \
+       pcp_op_T__ val__ = (val);                                       \
+       pcp_op_T__ old__, *ptr__;                                       \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                                    \
+       asm volatile(                                                   \
+               op "    %[old__],%[val__],%[ptr__]\n"                   \
+               : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__)           \
+               : [val__] "d" (val__)                                   \
+               : "cc");                                                \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+ }
+ 
+ #define this_cpu_and_4(pcp, val)      arch_this_cpu_to_op(pcp, val, "lan")
+@@ -135,10 +135,10 @@
+       typedef typeof(pcp) pcp_op_T__;                                 \
+       pcp_op_T__ ret__;                                               \
+       pcp_op_T__ *ptr__;                                              \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                                    \
+       ret__ = cmpxchg(ptr__, oval, nval);                             \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+       ret__;                                                          \
+ })
+ 
+@@ -151,10 +151,10 @@
+ ({                                                                    \
+       typeof(pcp) *ptr__;                                             \
+       typeof(pcp) ret__;                                              \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       ptr__ = raw_cpu_ptr(&(pcp));                                    \
+       ret__ = xchg(ptr__, nval);                                      \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+       ret__;                                                          \
+ })
+ 
+@@ -170,11 +170,11 @@
+       typeof(pcp1) *p1__;                                             \
+       typeof(pcp2) *p2__;                                             \
+       int ret__;                                                      \
+-      preempt_disable();                                              \
++      preempt_disable_notrace();                                      \
+       p1__ = raw_cpu_ptr(&(pcp1));                                    \
+       p2__ = raw_cpu_ptr(&(pcp2));                                    \
+       ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__);   \
+-      preempt_enable();                                               \
++      preempt_enable_notrace();                                       \
+       ret__;                                                          \
+ })
+ 
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index 941ace0521306..5276074d0e364 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1817,6 +1817,8 @@ static struct dma_chan *at_dma_xlate(struct 
of_phandle_args *dma_spec,
+               return NULL;
+ 
+       dmac_pdev = of_find_device_by_node(dma_spec->np);
++      if (!dmac_pdev)
++              return NULL;
+ 
+       dma_cap_zero(mask);
+       dma_cap_set(DMA_SLAVE, mask);
+diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
+index 1e1f2986eba8f..86c591481dfe9 100644
+--- a/drivers/dma/of-dma.c
++++ b/drivers/dma/of-dma.c
+@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct 
of_phandle_args *dma_spec,
+               return NULL;
+ 
+       chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
+-      if (chan) {
+-              chan->router = ofdma->dma_router;
+-              chan->route_data = route_data;
+-      } else {
++      if (IS_ERR_OR_NULL(chan)) {
+               ofdma->dma_router->route_free(ofdma->dma_router->dev,
+                                             route_data);
++      } else {
++              chan->router = ofdma->dma_router;
++              chan->route_data = route_data;
+       }
+ 
+       /*
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 799c182c3eacc..9aa57b37381a9 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2629,6 +2629,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t 
dst,
+       while (burst != (1 << desc->rqcfg.brst_size))
+               desc->rqcfg.brst_size++;
+ 
++      desc->rqcfg.brst_len = get_burst_len(desc, len);
+       /*
+        * If burst size is smaller than bus width then make sure we only
+        * transfer one at a time to avoid a burst stradling an MFIFO entry.
+@@ -2636,7 +2637,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t 
dst,
+       if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+               desc->rqcfg.brst_len = 1;
+ 
+-      desc->rqcfg.brst_len = get_burst_len(desc, len);
+       desc->bytes_requested = len;
+ 
+       desc->txd.flags = flags;
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 325adbef134cc..9425c789b0974 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1367,6 +1367,17 @@ static void hid_output_field(const struct hid_device 
*hid,
+       }
+ }
+ 
++/*
++ * Compute the size of a report.
++ */
++static size_t hid_compute_report_size(struct hid_report *report)
++{
++      if (report->size)
++              return ((report->size - 1) >> 3) + 1;
++
++      return 0;
++}
++
+ /*
+  * Create a report. 'data' has to be allocated using
+  * hid_alloc_report_buf() so that it has proper size.
+@@ -1379,7 +1390,7 @@ void hid_output_report(struct hid_report *report, __u8 
*data)
+       if (report->id > 0)
+               *data++ = report->id;
+ 
+-      memset(data, 0, ((report->size - 1) >> 3) + 1);
++      memset(data, 0, hid_compute_report_size(report));
+       for (n = 0; n < report->maxfield; n++)
+               hid_output_field(report->device, report->field[n], data);
+ }
+@@ -1506,7 +1517,7 @@ int hid_report_raw_event(struct hid_device *hid, int 
type, u8 *data, u32 size,
+               csize--;
+       }
+ 
+-      rsize = ((report->size - 1) >> 3) + 1;
++      rsize = hid_compute_report_size(report);
+ 
+       if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
+               rsize = HID_MAX_BUFFER_SIZE - 1;
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3331bf8ad85e6..c033d12070c3d 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -994,6 +994,10 @@ static void hidinput_configure_usage(struct hid_input 
*hidinput, struct hid_fiel
+       }
+ 
+ mapped:
++      /* Mapping failed, bail out */
++      if (!bit)
++              return;
++
+       if (device->driver->input_mapped &&
+           device->driver->input_mapped(device, hidinput, field, usage,
+                                        &bit, &max) < 0) {
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 56c4a81d3ea24..5187f3975c655 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -569,6 +569,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, 
struct hid_input *hi,
+       case HID_UP_BUTTON:
+               code = BTN_MOUSE + ((usage->hid - 1) & HID_USAGE);
+               hid_map_usage(hi, usage, bit, max, EV_KEY, code);
++              if (!*bit)
++                      return -1;
+               input_set_capability(hi->input, EV_KEY, code);
+               return 1;
+ 
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index 0af7fd311979d..587fc5c686b3c 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -758,15 +758,18 @@ static ssize_t applesmc_light_show(struct device *dev,
+       }
+ 
+       ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length);
++      if (ret)
++              goto out;
+       /* newer macbooks report a single 10-bit bigendian value */
+       if (data_length == 10) {
+               left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
+               goto out;
+       }
+       left = buffer[2];
++
++      ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+       if (ret)
+               goto out;
+-      ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+       right = buffer[2];
+ 
+ out:
+@@ -814,12 +817,11 @@ static ssize_t applesmc_show_fan_speed(struct device 
*dev,
+       sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
+ 
+       ret = applesmc_read_key(newkey, buffer, 2);
+-      speed = ((buffer[0] << 8 | buffer[1]) >> 2);
+-
+       if (ret)
+               return ret;
+-      else
+-              return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
++
++      speed = ((buffer[0] << 8 | buffer[1]) >> 2);
++      return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
+ }
+ 
+ static ssize_t applesmc_store_fan_speed(struct device *dev,
+@@ -854,12 +856,11 @@ static ssize_t applesmc_show_fan_manual(struct device 
*dev,
+       u8 buffer[2];
+ 
+       ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+-      manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
+-
+       if (ret)
+               return ret;
+-      else
+-              return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
++
++      manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
++      return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
+ }
+ 
+ static ssize_t applesmc_store_fan_manual(struct device *dev,
+@@ -875,10 +876,11 @@ static ssize_t applesmc_store_fan_manual(struct device 
*dev,
+               return -EINVAL;
+ 
+       ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+-      val = (buffer[0] << 8 | buffer[1]);
+       if (ret)
+               goto out;
+ 
++      val = (buffer[0] << 8 | buffer[1]);
++
+       if (input)
+               val = val | (0x01 << to_index(attr));
+       else
+@@ -954,13 +956,12 @@ static ssize_t applesmc_key_count_show(struct device 
*dev,
+       u32 count;
+ 
+       ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4);
+-      count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
+-                                              ((u32)buffer[2]<<8) + buffer[3];
+-
+       if (ret)
+               return ret;
+-      else
+-              return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
++
++      count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
++                                              ((u32)buffer[2]<<8) + buffer[3];
++      return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
+ }
+ 
+ static ssize_t applesmc_key_at_index_read_show(struct device *dev,
+diff --git a/drivers/iommu/intel_irq_remapping.c 
b/drivers/iommu/intel_irq_remapping.c
+index ac596928f6b40..ce125ec23d2a5 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -486,12 +486,18 @@ static void iommu_enable_irq_remapping(struct 
intel_iommu *iommu)
+ 
+       /* Enable interrupt-remapping */
+       iommu->gcmd |= DMA_GCMD_IRE;
+-      iommu->gcmd &= ~DMA_GCMD_CFI;  /* Block compatibility-format MSIs */
+       writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
+-
+       IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
+                     readl, (sts & DMA_GSTS_IRES), sts);
+ 
++      /* Block compatibility-format MSIs */
++      if (sts & DMA_GSTS_CFIS) {
++              iommu->gcmd &= ~DMA_GCMD_CFI;
++              writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
++              IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
++                            readl, !(sts & DMA_GSTS_CFIS), sts);
++      }
++
+       /*
+        * With CFI clear in the Global Command register, we should be
+        * protected from dangerous (i.e. compatibility) interrupts
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 905badc6cb179..216675b96e029 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -501,12 +501,16 @@ static int __create_persistent_data_objects(struct 
dm_cache_metadata *cmd,
+                                         CACHE_MAX_CONCURRENT_LOCKS);
+       if (IS_ERR(cmd->bm)) {
+               DMERR("could not create block manager");
+-              return PTR_ERR(cmd->bm);
++              r = PTR_ERR(cmd->bm);
++              cmd->bm = NULL;
++              return r;
+       }
+ 
+       r = __open_or_format_metadata(cmd, may_format_device);
+-      if (r)
++      if (r) {
+               dm_block_manager_destroy(cmd->bm);
++              cmd->bm = NULL;
++      }
+ 
+       return r;
+ }
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 2711aa965445c..266d366fc2f08 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -700,12 +700,16 @@ static int __create_persistent_data_objects(struct 
dm_pool_metadata *pmd, bool f
+                                         THIN_MAX_CONCURRENT_LOCKS);
+       if (IS_ERR(pmd->bm)) {
+               DMERR("could not create block manager");
+-              return PTR_ERR(pmd->bm);
++              r = PTR_ERR(pmd->bm);
++              pmd->bm = NULL;
++              return r;
+       }
+ 
+       r = __open_or_format_metadata(pmd, format_device);
+-      if (r)
++      if (r) {
+               dm_block_manager_destroy(pmd->bm);
++              pmd->bm = NULL;
++      }
+ 
+       return r;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index a3949c1a0c234..2da1c22946450 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4612,18 +4612,18 @@ static int __bnxt_open_nic(struct bnxt *bp, bool 
irq_re_init, bool link_re_init)
+               }
+       }
+ 
+-      bnxt_enable_napi(bp);
+-
+       rc = bnxt_init_nic(bp, irq_re_init);
+       if (rc) {
+               netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+-              goto open_err;
++              goto open_err_irq;
+       }
+ 
++      bnxt_enable_napi(bp);
++
+       if (link_re_init) {
+               rc = bnxt_update_phy_setting(bp);
+               if (rc)
+-                      goto open_err;
++                      netdev_warn(bp->dev, "failed to update phy settings\n");
+       }
+ 
+       if (irq_re_init) {
+@@ -4644,9 +4644,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool 
irq_re_init, bool link_re_init)
+ 
+       return 0;
+ 
+-open_err:
+-      bnxt_disable_napi(bp);
+-
+ open_err_irq:
+       bnxt_del_napi(bp);
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c 
b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 45bd628eaf3aa..416fb16686a61 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -991,6 +991,9 @@ static int bnxt_get_nvram_directory(struct net_device 
*dev, u32 len, u8 *data)
+       if (rc != 0)
+               return rc;
+ 
++      if (!dir_entries || !entry_length)
++              return -EIO;
++
+       /* Insert 2 bytes of directory info (count and size of entries) */
+       if (len < 2)
+               return -EINVAL;
+diff --git a/drivers/net/ethernet/broadcom/tg3.c 
b/drivers/net/ethernet/broadcom/tg3.c
+index e198427d0f292..2ee2b6e858283 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -7203,8 +7203,8 @@ static inline void tg3_reset_task_schedule(struct tg3 
*tp)
+ 
+ static inline void tg3_reset_task_cancel(struct tg3 *tp)
+ {
+-      cancel_work_sync(&tp->reset_task);
+-      tg3_flag_clear(tp, RESET_TASK_PENDING);
++      if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
++              cancel_work_sync(&tp->reset_task);
+       tg3_flag_clear(tp, TX_RECOVERY_PENDING);
+ }
+ 
+@@ -11176,18 +11176,27 @@ static void tg3_reset_task(struct work_struct *work)
+ 
+       tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
+       err = tg3_init_hw(tp, true);
+-      if (err)
++      if (err) {
++              tg3_full_unlock(tp);
++              tp->irq_sync = 0;
++              tg3_napi_enable(tp);
++              /* Clear this flag so that tg3_reset_task_cancel() will not
++               * call cancel_work_sync() and wait forever.
++               */
++              tg3_flag_clear(tp, RESET_TASK_PENDING);
++              dev_close(tp->dev);
+               goto out;
++      }
+ 
+       tg3_netif_start(tp);
+ 
+-out:
+       tg3_full_unlock(tp);
+ 
+       if (!err)
+               tg3_phy_start(tp);
+ 
+       tg3_flag_clear(tp, RESET_TASK_PENDING);
++out:
+       rtnl_unlock();
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c 
b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 53833c06696fb..00a105c63567f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int 
max_order)
+               goto err_out;
+ 
+       for (i = 0; i <= buddy->max_order; ++i) {
+-              s = BITS_TO_LONGS(1 << (buddy->max_order - i));
++              s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
+               buddy->bits[i] = kcalloc(s, sizeof (long), GFP_KERNEL | 
__GFP_NOWARN);
+               if (!buddy->bits[i]) {
+                       buddy->bits[i] = vzalloc(s * sizeof(long));
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c 
b/drivers/net/ethernet/renesas/ravb_main.c
+index 460b29ac5fd86..d5bf0f2753079 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1214,12 +1214,64 @@ static const struct ethtool_ops ravb_ethtool_ops = {
+       .get_ts_info            = ravb_get_ts_info,
+ };
+ 
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++      struct platform_device *pdev = priv->pdev;
++      struct device *dev = &pdev->dev;
++      int error;
++
++      /* Bitbang init */
++      priv->mdiobb.ops = &bb_ops;
++
++      /* MII controller setting */
++      priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++      if (!priv->mii_bus)
++              return -ENOMEM;
++
++      /* Hook up MII support for ethtool */
++      priv->mii_bus->name = "ravb_mii";
++      priv->mii_bus->parent = dev;
++      snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++               pdev->name, pdev->id);
++
++      /* Register MDIO bus */
++      error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++      if (error)
++              goto out_free_bus;
++
++      return 0;
++
++out_free_bus:
++      free_mdio_bitbang(priv->mii_bus);
++      return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++      /* Unregister mdio bus */
++      mdiobus_unregister(priv->mii_bus);
++
++      /* Free bitbang info */
++      free_mdio_bitbang(priv->mii_bus);
++
++      return 0;
++}
++
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+       struct ravb_private *priv = netdev_priv(ndev);
+       int error;
+ 
++      /* MDIO bus init */
++      error = ravb_mdio_init(priv);
++      if (error) {
++              netdev_err(ndev, "failed to initialize MDIO\n");
++              return error;
++      }
++
+       napi_enable(&priv->napi[RAVB_BE]);
+       napi_enable(&priv->napi[RAVB_NC]);
+ 
+@@ -1268,6 +1320,7 @@ out_free_irq:
+ out_napi_off:
+       napi_disable(&priv->napi[RAVB_NC]);
+       napi_disable(&priv->napi[RAVB_BE]);
++      ravb_mdio_release(priv);
+       return error;
+ }
+ 
+@@ -1561,6 +1614,8 @@ static int ravb_close(struct net_device *ndev)
+       ravb_ring_free(ndev, RAVB_BE);
+       ravb_ring_free(ndev, RAVB_NC);
+ 
++      ravb_mdio_release(priv);
++
+       return 0;
+ }
+ 
+@@ -1664,51 +1719,6 @@ static const struct net_device_ops ravb_netdev_ops = {
+       .ndo_change_mtu         = eth_change_mtu,
+ };
+ 
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+-      struct platform_device *pdev = priv->pdev;
+-      struct device *dev = &pdev->dev;
+-      int error;
+-
+-      /* Bitbang init */
+-      priv->mdiobb.ops = &bb_ops;
+-
+-      /* MII controller setting */
+-      priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+-      if (!priv->mii_bus)
+-              return -ENOMEM;
+-
+-      /* Hook up MII support for ethtool */
+-      priv->mii_bus->name = "ravb_mii";
+-      priv->mii_bus->parent = dev;
+-      snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+-               pdev->name, pdev->id);
+-
+-      /* Register MDIO bus */
+-      error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+-      if (error)
+-              goto out_free_bus;
+-
+-      return 0;
+-
+-out_free_bus:
+-      free_mdio_bitbang(priv->mii_bus);
+-      return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+-      /* Unregister mdio bus */
+-      mdiobus_unregister(priv->mii_bus);
+-
+-      /* Free bitbang info */
+-      free_mdio_bitbang(priv->mii_bus);
+-
+-      return 0;
+-}
+-
+ static const struct of_device_id ravb_match_table[] = {
+       { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+       { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -1847,13 +1857,6 @@ static int ravb_probe(struct platform_device *pdev)
+               eth_hw_addr_random(ndev);
+       }
+ 
+-      /* MDIO bus init */
+-      error = ravb_mdio_init(priv);
+-      if (error) {
+-              dev_err(&pdev->dev, "failed to initialize MDIO\n");
+-              goto out_dma_free;
+-      }
+-
+       netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+       netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+ 
+@@ -1873,8 +1876,6 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+       netif_napi_del(&priv->napi[RAVB_NC]);
+       netif_napi_del(&priv->napi[RAVB_BE]);
+-      ravb_mdio_release(priv);
+-out_dma_free:
+       dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+                         priv->desc_bat_dma);
+ out_release:
+@@ -1899,7 +1900,6 @@ static int ravb_remove(struct platform_device *pdev)
+       unregister_netdev(ndev);
+       netif_napi_del(&priv->napi[RAVB_NC]);
+       netif_napi_del(&priv->napi[RAVB_BE]);
+-      ravb_mdio_release(priv);
+       pm_runtime_disable(&pdev->dev);
+       free_netdev(ndev);
+       platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 2092ef6431f20..712765976a221 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -251,7 +251,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal)
+ 
+       netdev_dbg(dev->net, "asix_get_phy_addr()\n");
+ 
+-      if (ret < 0) {
++      if (ret < 2) {
+               netdev_err(dev->net, "Error reading PHYID register: %02x\n", 
ret);
+               goto out;
+       }
+diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
+index 0b4bdd39106b0..fb18801d0fe7b 100644
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -624,6 +624,10 @@ static const struct usb_device_id products[] = {
+        USB_DEVICE(0x0a46, 0x1269),    /* DM9621A USB to Fast Ethernet Adapter 
*/
+        .driver_info = (unsigned long)&dm9601_info,
+       },
++      {
++       USB_DEVICE(0x0586, 0x3427),    /* ZyXEL Keenetic Plus DSL xDSL modem */
++       .driver_info = (unsigned long)&dm9601_info,
++      },
+       {},                     // END
+ };
+ 
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 4391430e25273..14eca1f80ce36 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -14,7 +14,9 @@
+ #include <linux/netdevice.h>
+ #include <linux/ethtool.h>
+ #include <linux/etherdevice.h>
++#include <linux/if_arp.h>
+ #include <linux/mii.h>
++#include <linux/rtnetlink.h>
+ #include <linux/usb.h>
+ #include <linux/usb/cdc.h>
+ #include <linux/usb/usbnet.h>
+@@ -48,11 +50,104 @@
+ struct qmi_wwan_state {
+       struct usb_driver *subdriver;
+       atomic_t pmcount;
+-      unsigned long unused;
++      unsigned long flags;
+       struct usb_interface *control;
+       struct usb_interface *data;
+ };
+ 
++enum qmi_wwan_flags {
++      QMI_WWAN_FLAG_RAWIP = 1 << 0,
++};
++
++enum qmi_wwan_quirks {
++      QMI_WWAN_QUIRK_DTR = 1 << 0,    /* needs "set DTR" request */
++};
++
++static void qmi_wwan_netdev_setup(struct net_device *net)
++{
++      struct usbnet *dev = netdev_priv(net);
++      struct qmi_wwan_state *info = (void *)&dev->data;
++
++      if (info->flags & QMI_WWAN_FLAG_RAWIP) {
++              net->header_ops      = NULL;  /* No header */
++              net->type            = ARPHRD_NONE;
++              net->hard_header_len = 0;
++              net->addr_len        = 0;
++              net->flags           = IFF_POINTOPOINT | IFF_NOARP | 
IFF_MULTICAST;
++              netdev_dbg(net, "mode: raw IP\n");
++      } else if (!net->header_ops) { /* don't bother if already set */
++              ether_setup(net);
++              netdev_dbg(net, "mode: Ethernet\n");
++      }
++
++      /* recalculate buffers after changing hard_header_len */
++      usbnet_change_mtu(net, net->mtu);
++}
++
++static ssize_t raw_ip_show(struct device *d, struct device_attribute *attr, 
char *buf)
++{
++      struct usbnet *dev = netdev_priv(to_net_dev(d));
++      struct qmi_wwan_state *info = (void *)&dev->data;
++
++      return sprintf(buf, "%c\n", info->flags & QMI_WWAN_FLAG_RAWIP ? 'Y' : 
'N');
++}
++
++static ssize_t raw_ip_store(struct device *d,  struct device_attribute *attr, 
const char *buf, size_t len)
++{
++      struct usbnet *dev = netdev_priv(to_net_dev(d));
++      struct qmi_wwan_state *info = (void *)&dev->data;
++      bool enable;
++      int ret;
++
++      if (strtobool(buf, &enable))
++              return -EINVAL;
++
++      /* no change? */
++      if (enable == (info->flags & QMI_WWAN_FLAG_RAWIP))
++              return len;
++
++      if (!rtnl_trylock())
++              return restart_syscall();
++
++      /* we don't want to modify a running netdev */
++      if (netif_running(dev->net)) {
++              netdev_err(dev->net, "Cannot change a running device\n");
++              ret = -EBUSY;
++              goto err;
++      }
++
++      /* let other drivers deny the change */
++      ret = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, dev->net);
++      ret = notifier_to_errno(ret);
++      if (ret) {
++              netdev_err(dev->net, "Type change was refused\n");
++              goto err;
++      }
++
++      if (enable)
++              info->flags |= QMI_WWAN_FLAG_RAWIP;
++      else
++              info->flags &= ~QMI_WWAN_FLAG_RAWIP;
++      qmi_wwan_netdev_setup(dev->net);
++      call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev->net);
++      ret = len;
++err:
++      rtnl_unlock();
++      return ret;
++}
++
++static DEVICE_ATTR_RW(raw_ip);
++
++static struct attribute *qmi_wwan_sysfs_attrs[] = {
++      &dev_attr_raw_ip.attr,
++      NULL,
++};
++
++static struct attribute_group qmi_wwan_sysfs_attr_group = {
++      .name = "qmi",
++      .attrs = qmi_wwan_sysfs_attrs,
++};
++
+ /* default ethernet address used by the modem */
+ static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
+ 
+@@ -80,6 +175,8 @@ static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 
0xc6, 0x00, 0x00, 0x00};
+  */
+ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
++      struct qmi_wwan_state *info = (void *)&dev->data;
++      bool rawip = info->flags & QMI_WWAN_FLAG_RAWIP;
+       __be16 proto;
+ 
+       /* This check is no longer done by usbnet */
+@@ -94,15 +191,25 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct 
sk_buff *skb)
+               proto = htons(ETH_P_IPV6);
+               break;
+       case 0x00:
++              if (rawip)
++                      return 0;
+               if (is_multicast_ether_addr(skb->data))
+                       return 1;
+               /* possibly bogus destination - rewrite just in case */
+               skb_reset_mac_header(skb);
+               goto fix_dest;
+       default:
++              if (rawip)
++                      return 0;
+               /* pass along other packets without modifications */
+               return 1;
+       }
++      if (rawip) {
++              skb->dev = dev->net; /* normally set by eth_type_trans */
++              skb->protocol = proto;
++              return 1;
++      }
++
+       if (skb_headroom(skb) < ETH_HLEN)
+               return 0;
+       skb_push(skb, ETH_HLEN);
+@@ -223,6 +330,20 @@ err:
+       return rv;
+ }
+ 
++/* Send CDC SetControlLineState request, setting or clearing the DTR.
++ * "Required for Autoconnect and 9x30 to wake up" according to the
++ * GobiNet driver. The requirement has been verified on an MDM9230
++ * based Sierra Wireless MC7455
++ */
++static int qmi_wwan_change_dtr(struct usbnet *dev, bool on)
++{
++      u8 intf = dev->intf->cur_altsetting->desc.bInterfaceNumber;
++
++      return usbnet_write_cmd(dev, USB_CDC_REQ_SET_CONTROL_LINE_STATE,
++                              USB_DIR_OUT | USB_TYPE_CLASS | 
USB_RECIP_INTERFACE,
++                              on ? 0x01 : 0x00, intf, NULL, 0);
++}
++
+ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+       int status = -1;
+@@ -257,7 +378,10 @@ static int qmi_wwan_bind(struct usbnet *dev, struct 
usb_interface *intf)
+                               "bogus CDC Union: master=%u, slave=%u\n",
+                               cdc_union->bMasterInterface0,
+                               cdc_union->bSlaveInterface0);
+-                      goto err;
++
++                      /* ignore and continue... */
++                      cdc_union = NULL;
++                      info->data = intf;
+               }
+       }
+ 
+@@ -280,6 +404,29 @@ static int qmi_wwan_bind(struct usbnet *dev, struct 
usb_interface *intf)
+               usb_driver_release_interface(driver, info->data);
+       }
+ 
++      /* disabling remote wakeup on MDM9x30 devices has the same
++       * effect as clearing DTR. The device will not respond to QMI
++       * requests until we set DTR again.  This is similar to a
++       * QMI_CTL SYNC request, clearing a lot of firmware state
++       * including the client ID allocations.
++       *
++       * Our usage model allows a session to span multiple
++       * open/close events, so we must prevent the firmware from
++       * clearing out state the clients might need.
++       *
++       * MDM9x30 is the first QMI chipset with USB3 support. Abuse
++       * this fact to enable the quirk for all USB3 devices.
++       *
++       * There are also chipsets with the same "set DTR" requirement
++       * but without USB3 support.  Devices based on these chips
++       * need a quirk flag in the device ID table.
++       */
++      if (dev->driver_info->data & QMI_WWAN_QUIRK_DTR ||
++          le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
++              qmi_wwan_manage_power(dev, 1);
++              qmi_wwan_change_dtr(dev, true);
++      }
++
+       /* Never use the same address on both ends of the link, even if the
+        * buggy firmware told us to. Or, if device is assigned the well-known
+        * buggy firmware MAC address, replace it with a random address,
+@@ -294,6 +441,7 @@ static int qmi_wwan_bind(struct usbnet *dev, struct 
usb_interface *intf)
+               dev->net->dev_addr[0] &= 0xbf;  /* clear "IP" bit */
+       }
+       dev->net->netdev_ops = &qmi_wwan_netdev_ops;
++      dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
+ err:
+       return status;
+ }
+@@ -307,6 +455,12 @@ static void qmi_wwan_unbind(struct usbnet *dev, struct 
usb_interface *intf)
+       if (info->subdriver && info->subdriver->disconnect)
+               info->subdriver->disconnect(info->control);
+ 
++      /* disable MDM9x30 quirk */
++      if (le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
++              qmi_wwan_change_dtr(dev, false);
++              qmi_wwan_manage_power(dev, 0);
++      }
++
+       /* allow user to unbind using either control or data */
+       if (intf == info->control)
+               other = info->data;
+@@ -381,6 +535,16 @@ static const struct driver_info   qmi_wwan_info = {
+       .rx_fixup       = qmi_wwan_rx_fixup,
+ };
+ 
++static const struct driver_info       qmi_wwan_info_quirk_dtr = {
++      .description    = "WWAN/QMI device",
++      .flags          = FLAG_WWAN,
++      .bind           = qmi_wwan_bind,
++      .unbind         = qmi_wwan_unbind,
++      .manage_power   = qmi_wwan_manage_power,
++      .rx_fixup       = qmi_wwan_rx_fixup,
++      .data           = QMI_WWAN_QUIRK_DTR,
++};
++
+ #define HUAWEI_VENDOR_ID      0x12D1
+ 
+ /* map QMI/wwan function by a fixed interface number */
+@@ -388,6 +552,11 @@ static const struct driver_info   qmi_wwan_info = {
+       USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \
+       .driver_info = (unsigned long)&qmi_wwan_info
+ 
++/* devices requiring "set DTR" quirk */
++#define QMI_QUIRK_SET_DTR(vend, prod, num) \
++      USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \
++      .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr
++
+ /* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */
+ #define QMI_GOBI1K_DEVICE(vend, prod) \
+       QMI_FIXED_INTF(vend, prod, 3)
+@@ -717,6 +886,7 @@ static const struct usb_device_id products[] = {
+       {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
+       {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
+       {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
++      {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)},    /* D-Link DWM-222 A2 */
+       {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
+       {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
+       {QMI_FIXED_INTF(0x2020, 0x2060, 4)},    /* BroadMobi BM818 */
+@@ -750,8 +920,11 @@ static const struct usb_device_id products[] = {
+       {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
+       {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
+       {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
++      {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
++      {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
++      {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
+       {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
+-      {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
++      {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
+       {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G 
Systems */
+       {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
+       {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
+@@ -762,16 +935,22 @@ static const struct usb_device_id products[] = {
+       {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},    /* Olivetti Olicard 500 */
+       {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
+       {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
++      {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)},    /* Cinterion PHxx,PXxx (2 
RmNet) */
++      {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)},    /* Cinterion PHxx,PXxx (2 
RmNet) */
++      {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)},    /* Cinterion PHxx,PXxx (1 RmNet 
+ USB Audio)*/
+       {QMI_FIXED_INTF(0x413c, 0x81a2, 8)},    /* Dell Wireless 5806 Gobi(TM) 
4G LTE Mobile Broadband Card */
+       {QMI_FIXED_INTF(0x413c, 0x81a3, 8)},    /* Dell Wireless 5570 HSPA+ 
(42Mbps) Mobile Broadband Card */
+       {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ 
(42Mbps) Mobile Broadband Card */
+       {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 
4G LTE Mobile Broadband Card */
+       {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 
4G LTE Mobile Broadband Card */
+       {QMI_FIXED_INTF(0x413c, 0x81b1, 8)},    /* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card */
++      {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 
4G LTE Mobile Broadband Card (rev3) */
+       {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ 
Gobi 4G Module */
+       {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},    /* HP lt4120 Snapdragon X5 LTE 
*/
+       {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
+       {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
++      {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0  
Mini PCIe */
++      {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ 
+       /* 4. Gobi 1000 devices */
+       {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
+diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c 
b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+index d255d33da9eb3..02e71d461d5c5 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+@@ -49,20 +49,21 @@ static struct temp_sensor_data 
omap4430_mpu_temp_sensor_data = {
+ 
+ /*
+  * Temperature values in milli degree celsius
+- * ADC code values from 530 to 923
++ * ADC code values from 13 to 107, see TRM
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
+  */
+ static const int
+ omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = 
{
+-      -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000,
+-      -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000,
+-      -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000,
+-      13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000,
+-      32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000,
+-      48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000,
+-      66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000,
+-      83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000,
+-      100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000,
+-      117000, 118000, 120000, 122000, 123000,
++      -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000,
++      -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000,
++      -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000,
++      12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500,
++      30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000,
++      47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000,
++      64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000,
++      82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000,
++      98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000,
++      115000, 117000, 118500, 120000, 122000, 123500, 125000,
+ };
+ 
+ /* OMAP4430 data */
+diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h 
b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+index 6f2de3a3356d4..86850082b24b9 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+@@ -67,9 +67,13 @@
+  * and thresholds for OMAP4430.
+  */
+ 
+-/* ADC conversion table limits */
+-#define OMAP4430_ADC_START_VALUE                      0
+-#define OMAP4430_ADC_END_VALUE                                127
++/*
++ * ADC conversion table limits. Ignore values outside the TRM listed
++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
++ */
++#define OMAP4430_ADC_START_VALUE                      13
++#define OMAP4430_ADC_END_VALUE                                107
+ /* bandgap clock limits (no control on 4430) */
+ #define OMAP4430_MAX_FREQ                             32768
+ #define OMAP4430_MIN_FREQ                             32768
+diff --git a/drivers/xen/xenbus/xenbus_client.c 
b/drivers/xen/xenbus/xenbus_client.c
+index df27cefb2fa35..266f446ba331c 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -384,8 +384,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void 
*vaddr,
+       int i, j;
+ 
+       for (i = 0; i < nr_pages; i++) {
+-              err = gnttab_grant_foreign_access(dev->otherend_id,
+-                                                virt_to_gfn(vaddr), 0);
++              unsigned long gfn;
++
++              if (is_vmalloc_addr(vaddr))
++                      gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr));
++              else
++                      gfn = virt_to_gfn(vaddr);
++
++              err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0);
+               if (err < 0) {
+                       xenbus_dev_fatal(dev, err,
+                                        "granting access to ring page");
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index 5fa92bc790ef7..c1b344e56e855 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -390,23 +390,23 @@ prot_to_mode(u32 prot)
+       umode_t mode = 0;
+ 
+       if (!(prot & FIBF_NOWRITE))
+-              mode |= S_IWUSR;
++              mode |= 0200;
+       if (!(prot & FIBF_NOREAD))
+-              mode |= S_IRUSR;
++              mode |= 0400;
+       if (!(prot & FIBF_NOEXECUTE))
+-              mode |= S_IXUSR;
++              mode |= 0100;
+       if (prot & FIBF_GRP_WRITE)
+-              mode |= S_IWGRP;
++              mode |= 0020;
+       if (prot & FIBF_GRP_READ)
+-              mode |= S_IRGRP;
++              mode |= 0040;
+       if (prot & FIBF_GRP_EXECUTE)
+-              mode |= S_IXGRP;
++              mode |= 0010;
+       if (prot & FIBF_OTR_WRITE)
+-              mode |= S_IWOTH;
++              mode |= 0002;
+       if (prot & FIBF_OTR_READ)
+-              mode |= S_IROTH;
++              mode |= 0004;
+       if (prot & FIBF_OTR_EXECUTE)
+-              mode |= S_IXOTH;
++              mode |= 0001;
+ 
+       return mode;
+ }
+@@ -417,24 +417,51 @@ mode_to_prot(struct inode *inode)
+       u32 prot = AFFS_I(inode)->i_protect;
+       umode_t mode = inode->i_mode;
+ 
+-      if (!(mode & S_IXUSR))
++      /*
++       * First, clear all RWED bits for owner, group, other.
++       * Then, recalculate them afresh.
++       *
++       * We'll always clear the delete-inhibit bit for the owner, as that is
++       * the classic single-user mode AmigaOS protection bit and we need to
++       * stay compatible with all scenarios.
++       *
++       * Since multi-user AmigaOS is an extension, we'll only set the
++       * delete-allow bit if any of the other bits in the same user class
++       * (group/other) are used.
++       */
++      prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD
++                | FIBF_NOWRITE | FIBF_NODELETE
++                | FIBF_GRP_EXECUTE | FIBF_GRP_READ
++                | FIBF_GRP_WRITE   | FIBF_GRP_DELETE
++                | FIBF_OTR_EXECUTE | FIBF_OTR_READ
++                | FIBF_OTR_WRITE   | FIBF_OTR_DELETE);
++
++      /* Classic single-user AmigaOS flags. These are inverted. */
++      if (!(mode & 0100))
+               prot |= FIBF_NOEXECUTE;
+-      if (!(mode & S_IRUSR))
++      if (!(mode & 0400))
+               prot |= FIBF_NOREAD;
+-      if (!(mode & S_IWUSR))
++      if (!(mode & 0200))
+               prot |= FIBF_NOWRITE;
+-      if (mode & S_IXGRP)
++
++      /* Multi-user extended flags. Not inverted. */
++      if (mode & 0010)
+               prot |= FIBF_GRP_EXECUTE;
+-      if (mode & S_IRGRP)
++      if (mode & 0040)
+               prot |= FIBF_GRP_READ;
+-      if (mode & S_IWGRP)
++      if (mode & 0020)
+               prot |= FIBF_GRP_WRITE;
+-      if (mode & S_IXOTH)
++      if (mode & 0070)
++              prot |= FIBF_GRP_DELETE;
++
++      if (mode & 0001)
+               prot |= FIBF_OTR_EXECUTE;
+-      if (mode & S_IROTH)
++      if (mode & 0004)
+               prot |= FIBF_OTR_READ;
+-      if (mode & S_IWOTH)
++      if (mode & 0002)
+               prot |= FIBF_OTR_WRITE;
++      if (mode & 0007)
++              prot |= FIBF_OTR_DELETE;
+ 
+       AFFS_I(inode)->i_protect = prot;
+ }
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index 659c579c4588b..38e0fd4caf2bb 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -426,6 +426,24 @@ static int affs_write_begin(struct file *file, struct 
address_space *mapping,
+       return ret;
+ }
+ 
++static int affs_write_end(struct file *file, struct address_space *mapping,
++                        loff_t pos, unsigned int len, unsigned int copied,
++                        struct page *page, void *fsdata)
++{
++      struct inode *inode = mapping->host;
++      int ret;
++
++      ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata);
++
++      /* Clear Archived bit on file writes, as AmigaOS would do */
++      if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++              AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++              mark_inode_dirty(inode);
++      }
++
++      return ret;
++}
++
+ static sector_t _affs_bmap(struct address_space *mapping, sector_t block)
+ {
+       return generic_block_bmap(mapping,block,affs_get_block);
+@@ -435,7 +453,7 @@ const struct address_space_operations affs_aops = {
+       .readpage = affs_readpage,
+       .writepage = affs_writepage,
+       .write_begin = affs_write_begin,
+-      .write_end = generic_write_end,
++      .write_end = affs_write_end,
+       .direct_IO = affs_direct_IO,
+       .bmap = _affs_bmap
+ };
+@@ -793,6 +811,12 @@ done:
+       if (tmp > inode->i_size)
+               inode->i_size = AFFS_I(inode)->mmu_private = tmp;
+ 
++      /* Clear Archived bit on file writes, as AmigaOS would do */
++      if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++              AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++              mark_inode_dirty(inode);
++      }
++
+ err_first_bh:
+       unlock_page(page);
+       page_cache_release(page);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 8eac5f75bca36..3fa0515d76851 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1372,7 +1372,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, 
struct btrfs_path *path,
+       btrfs_tree_read_unlock_blocking(eb);
+       free_extent_buffer(eb);
+ 
+-      extent_buffer_get(eb_rewin);
++      btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin),
++                                     eb_rewin, btrfs_header_level(eb_rewin));
+       btrfs_tree_read_lock(eb_rewin);
+       __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
+       WARN_ON(btrfs_header_nritems(eb_rewin) >
+@@ -1441,8 +1442,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ 
+       if (!eb)
+               return NULL;
+-      extent_buffer_get(eb);
+-      btrfs_tree_read_lock(eb);
+       if (old_root) {
+               btrfs_set_header_bytenr(eb, eb->start);
+               btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
+@@ -1450,6 +1449,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+               btrfs_set_header_level(eb, old_root->level);
+               btrfs_set_header_generation(eb, old_generation);
+       }
++      btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb,
++                                     btrfs_header_level(eb));
++      btrfs_tree_read_lock(eb);
+       if (tm)
+               __tree_mod_log_rewind(root->fs_info, eb, time_seq, tm);
+       else
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 2f9f738ecf84a..97a80238fdee3 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -5431,9 +5431,9 @@ void read_extent_buffer(const struct extent_buffer *eb, 
void *dstv,
+       }
+ }
+ 
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+-                             void __user *dstv,
+-                             unsigned long start, unsigned long len)
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++                                     void __user *dstv,
++                                     unsigned long start, unsigned long len)
+ {
+       size_t cur;
+       size_t offset;
+@@ -5454,7 +5454,7 @@ int read_extent_buffer_to_user(const struct 
extent_buffer *eb,
+ 
+               cur = min(len, (PAGE_CACHE_SIZE - offset));
+               kaddr = page_address(page);
+-              if (copy_to_user(dst, kaddr + offset, cur)) {
++              if (probe_user_write(dst, kaddr + offset, cur)) {
+                       ret = -EFAULT;
+                       break;
+               }
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index 751435967724e..9631be7fc9e24 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -313,9 +313,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, 
const void *ptrv,
+ void read_extent_buffer(const struct extent_buffer *eb, void *dst,
+                       unsigned long start,
+                       unsigned long len);
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+-                             void __user *dst, unsigned long start,
+-                             unsigned long len);
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++                                     void __user *dst, unsigned long start,
++                                     unsigned long len);
+ void write_extent_buffer(struct extent_buffer *eb, const void *src,
+                        unsigned long start, unsigned long len);
+ void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 245a50f490f63..91a45ef69152d 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2017,9 +2017,14 @@ static noinline int copy_to_sk(struct btrfs_root *root,
+               sh.len = item_len;
+               sh.transid = found_transid;
+ 
+-              /* copy search result header */
+-              if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) {
+-                      ret = -EFAULT;
++              /*
++               * Copy search result header. If we fault then loop again so we
++               * can fault in the pages and -EFAULT there if there's a
++               * problem. Otherwise we'll fault and then copy the buffer in
++               * properly this next time through
++               */
++              if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) {
++                      ret = 0;
+                       goto out;
+               }
+ 
+@@ -2027,10 +2032,14 @@ static noinline int copy_to_sk(struct btrfs_root *root,
+ 
+               if (item_len) {
+                       char __user *up = ubuf + *sk_offset;
+-                      /* copy the item */
+-                      if (read_extent_buffer_to_user(leaf, up,
+-                                                     item_off, item_len)) {
+-                              ret = -EFAULT;
++                      /*
++                       * Copy the item, same behavior as above, but reset the
++                       * * sk_offset so we copy the full thing again.
++                       */
++                      if (read_extent_buffer_to_user_nofault(leaf, up,
++                                              item_off, item_len)) {
++                              ret = 0;
++                              *sk_offset -= sizeof(sh);
+                               goto out;
+                       }
+ 
+@@ -2120,6 +2129,10 @@ static noinline int search_ioctl(struct inode *inode,
+       key.offset = sk->min_offset;
+ 
+       while (1) {
++              ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
++              if (ret)
++                      break;
++
+               ret = btrfs_search_forward(root, &key, path, sk->min_transid);
+               if (ret != 0) {
+                       if (ret > 0)
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index dcae0cf4924b7..2d10b818399b1 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4065,6 +4065,7 @@ static int btrfs_uuid_scan_kthread(void *data)
+                       goto skip;
+               }
+ update_tree:
++              btrfs_release_path(path);
+               if (!btrfs_is_empty_uuid(root_item.uuid)) {
+                       ret = btrfs_uuid_tree_add(trans, fs_info->uuid_root,
+                                                 root_item.uuid,
+@@ -4090,6 +4091,7 @@ update_tree:
+               }
+ 
+ skip:
++              btrfs_release_path(path);
+               if (trans) {
+                       ret = btrfs_end_transaction(trans, fs_info->uuid_root);
+                       trans = NULL;
+@@ -4097,7 +4099,6 @@ skip:
+                               break;
+               }
+ 
+-              btrfs_release_path(path);
+               if (key.offset < (u64)-1) {
+                       key.offset++;
+               } else if (key.type < BTRFS_ROOT_ITEM_KEY) {
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index c8222bfe1e566..3e6ebe40f06fb 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1433,6 +1433,7 @@ const struct file_operations ceph_file_fops = {
+       .mmap = ceph_mmap,
+       .fsync = ceph_fsync,
+       .lock = ceph_lock,
++      .setlease = simple_nosetlease,
+       .flock = ceph_flock,
+       .splice_read = generic_file_splice_read,
+       .splice_write = iter_file_splice_write,
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index b8959d0d4c723..e5324642023d6 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1720,9 +1720,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, 
int call_nests)
+                        * during ep_insert().
+                        */
+                       if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+-                              get_file(epi->ffd.file);
+-                              list_add(&epi->ffd.file->f_tfile_llink,
+-                                       &tfile_check_list);
++                              if (get_file_rcu(epi->ffd.file))
++                                      list_add(&epi->ffd.file->f_tfile_llink,
++                                               &tfile_check_list);
+                       }
+               }
+       }
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 2149f650982ea..d93ba6014e3c5 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -866,34 +866,49 @@ static inline void hid_device_io_stop(struct hid_device 
*hid) {
+  * @max: maximal valid usage->code to consider later (out parameter)
+  * @type: input event type (EV_KEY, EV_REL, ...)
+  * @c: code which corresponds to this usage and type
++ *
++ * The value pointed to by @bit will be set to NULL if either @type is
++ * an unhandled event type, or if @c is out of range for @type. This
++ * can be used as an error condition.
+  */
+ static inline void hid_map_usage(struct hid_input *hidinput,
+               struct hid_usage *usage, unsigned long **bit, int *max,
+-              __u8 type, __u16 c)
++              __u8 type, unsigned int c)
+ {
+       struct input_dev *input = hidinput->input;
+-
+-      usage->type = type;
+-      usage->code = c;
++      unsigned long *bmap = NULL;
++      unsigned int limit = 0;
+ 
+       switch (type) {
+       case EV_ABS:
+-              *bit = input->absbit;
+-              *max = ABS_MAX;
++              bmap = input->absbit;
++              limit = ABS_MAX;
+               break;
+       case EV_REL:
+-              *bit = input->relbit;
+-              *max = REL_MAX;
++              bmap = input->relbit;
++              limit = REL_MAX;
+               break;
+       case EV_KEY:
+-              *bit = input->keybit;
+-              *max = KEY_MAX;
++              bmap = input->keybit;
++              limit = KEY_MAX;
+               break;
+       case EV_LED:
+-              *bit = input->ledbit;
+-              *max = LED_MAX;
++              bmap = input->ledbit;
++              limit = LED_MAX;
+               break;
+       }
++
++      if (unlikely(c > limit || !bmap)) {
++              pr_warn_ratelimited("%s: Invalid code %d type %d\n",
++                                  input->name, c, type);
++              *bit = NULL;
++              return;
++      }
++
++      usage->type = type;
++      usage->code = c;
++      *max = limit;
++      *bit = bmap;
+ }
+ 
+ /**
+@@ -907,7 +922,8 @@ static inline void hid_map_usage_clear(struct hid_input 
*hidinput,
+               __u8 type, __u16 c)
+ {
+       hid_map_usage(hidinput, usage, bit, max, type, c);
+-      clear_bit(c, *bit);
++      if (*bit)
++              clear_bit(usage->code, *bit);
+ }
+ 
+ /**
+diff --git a/include/linux/log2.h b/include/linux/log2.h
+index c373295f359fa..cca606609e1bc 100644
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -159,7 +159,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
+ #define roundup_pow_of_two(n)                 \
+ (                                             \
+       __builtin_constant_p(n) ? (             \
+-              (n == 1) ? 1 :                  \
++              ((n) == 1) ? 1 :                \
+               (1UL << (ilog2((n) - 1) + 1))   \
+                                  ) :          \
+       __roundup_pow_of_two(n)                 \
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index 15c7b5420d8aa..c82dcea216b15 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -90,6 +90,17 @@ static inline unsigned long __copy_from_user_nocache(void 
*to,
+ extern long probe_kernel_read(void *dst, const void *src, size_t size);
+ extern long __probe_kernel_read(void *dst, const void *src, size_t size);
+ 
++/*
++ * probe_user_read(): safely attempt to read from a location in user space
++ * @dst: pointer to the buffer that shall take the data
++ * @src: address to read from
++ * @size: size of the data chunk
++ *
++ * Safely read from address @src to the buffer at @dst.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++extern long probe_user_read(void *dst, const void __user *src, size_t size);
++
+ /*
+  * probe_kernel_write(): safely attempt to write to a location
+  * @dst: address to write to
+@@ -102,7 +113,22 @@ extern long __probe_kernel_read(void *dst, const void 
*src, size_t size);
+ extern long notrace probe_kernel_write(void *dst, const void *src, size_t 
size);
+ extern long notrace __probe_kernel_write(void *dst, const void *src, size_t 
size);
+ 
++/*
++ * probe_user_write(): safely attempt to write to a location in user space
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++extern long notrace probe_user_write(void __user *dst, const void *src, 
size_t size);
++extern long notrace __probe_user_write(void __user *dst, const void *src, 
size_t size);
++
+ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long 
count);
++extern long strncpy_from_unsafe_user(char *dst, const void __user 
*unsafe_addr,
++                                   long count);
++extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count);
+ 
+ /**
+  * probe_kernel_address(): safely attempt to read from a location
+diff --git a/include/net/inet_connection_sock.h 
b/include/net/inet_connection_sock.h
+index 72599bbc82558..a77a37c6349d9 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -319,5 +319,9 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, 
int optname,
+ int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
+                              char __user *optval, unsigned int optlen);
+ 
++/* update the fast reuse flag when adding a socket */
++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
++                             struct sock *sk);
++
+ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
+ #endif /* _INET_CONNECTION_SOCK_H */
+diff --git a/include/net/netfilter/nf_tables.h 
b/include/net/netfilter/nf_tables.h
+index b96df7499600f..bee9031a40066 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -74,6 +74,8 @@ struct nft_regs {
+ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
+                                unsigned int len)
+ {
++      if (len % NFT_REG32_SIZE)
++              dst[len / NFT_REG32_SIZE] = 0;
+       memcpy(dst, src, len);
+ }
+ 
+diff --git a/include/uapi/linux/netfilter/nf_tables.h 
b/include/uapi/linux/netfilter/nf_tables.h
+index d8c8a7c9d88a7..b0a1c33d4a153 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -111,7 +111,7 @@ enum nf_tables_msg_types {
+  * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+  */
+ enum nft_list_attributes {
+-      NFTA_LIST_UNPEC,
++      NFTA_LIST_UNSPEC,
+       NFTA_LIST_ELEM,
+       __NFTA_LIST_MAX
+ };
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index baac9a09ec0a1..44970b17f4fe7 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2812,6 +2812,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array)
+ }
+ 
+ #ifdef CONFIG_SYSCTL
++static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write,
++                                        void *buffer, size_t *length,
++                                        loff_t *ppos, unsigned long *out)
++{
++      struct ctl_table dup_table;
++
++      /*
++       * In order to avoid races with __do_proc_doulongvec_minmax(), we
++       * can duplicate the @table and alter the duplicate of it.
++       */
++      dup_table = *table;
++      dup_table.data = out;
++
++      return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos);
++}
++
+ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+                        struct ctl_table *table, int write,
+                        void __user *buffer, size_t *length, loff_t *ppos)
+@@ -2823,9 +2839,8 @@ static int hugetlb_sysctl_handler_common(bool 
obey_mempolicy,
+       if (!hugepages_supported())
+               return -ENOTSUPP;
+ 
+-      table->data = &tmp;
+-      table->maxlen = sizeof(unsigned long);
+-      ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++      ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++                                           &tmp);
+       if (ret)
+               goto out;
+ 
+@@ -2869,9 +2884,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, 
int write,
+       if (write && hstate_is_gigantic(h))
+               return -EINVAL;
+ 
+-      table->data = &tmp;
+-      table->maxlen = sizeof(unsigned long);
+-      ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++      ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++                                           &tmp);
+       if (ret)
+               goto out;
+ 
+diff --git a/mm/maccess.c b/mm/maccess.c
+index d159b1c96e484..18717e893a758 100644
+--- a/mm/maccess.c
++++ b/mm/maccess.c
+@@ -5,8 +5,32 @@
+ #include <linux/mm.h>
+ #include <linux/uaccess.h>
+ 
++static __always_inline long
++probe_read_common(void *dst, const void __user *src, size_t size)
++{
++      long ret;
++
++      pagefault_disable();
++      ret = __copy_from_user_inatomic(dst, src, size);
++      pagefault_enable();
++
++      return ret ? -EFAULT : 0;
++}
++
++static __always_inline long
++probe_write_common(void __user *dst, const void *src, size_t size)
++{
++      long ret;
++
++      pagefault_disable();
++      ret = __copy_to_user_inatomic(dst, src, size);
++      pagefault_enable();
++
++      return ret ? -EFAULT : 0;
++}
++
+ /**
+- * probe_kernel_read(): safely attempt to read from a location
++ * probe_kernel_read(): safely attempt to read from a kernel-space location
+  * @dst: pointer to the buffer that shall take the data
+  * @src: address to read from
+  * @size: size of the data chunk
+@@ -29,16 +53,40 @@ long __probe_kernel_read(void *dst, const void *src, 
size_t size)
+       mm_segment_t old_fs = get_fs();
+ 
+       set_fs(KERNEL_DS);
+-      pagefault_disable();
+-      ret = __copy_from_user_inatomic(dst,
+-                      (__force const void __user *)src, size);
+-      pagefault_enable();
++      ret = probe_read_common(dst, (__force const void __user *)src, size);
+       set_fs(old_fs);
+ 
+-      return ret ? -EFAULT : 0;
++      return ret;
+ }
+ EXPORT_SYMBOL_GPL(probe_kernel_read);
+ 
++/**
++ * probe_user_read(): safely attempt to read from a user-space location
++ * @dst: pointer to the buffer that shall take the data
++ * @src: address to read from. This must be a user address.
++ * @size: size of the data chunk
++ *
++ * Safely read from user address @src to the buffer at @dst. If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++
++long __weak probe_user_read(void *dst, const void __user *src, size_t size)
++    __attribute__((alias("__probe_user_read")));
++
++long __probe_user_read(void *dst, const void __user *src, size_t size)
++{
++      long ret = -EFAULT;
++      mm_segment_t old_fs = get_fs();
++
++      set_fs(USER_DS);
++      if (access_ok(VERIFY_READ, src, size))
++              ret = probe_read_common(dst, src, size);
++      set_fs(old_fs);
++
++      return ret;
++}
++EXPORT_SYMBOL_GPL(probe_user_read);
++
+ /**
+  * probe_kernel_write(): safely attempt to write to a location
+  * @dst: address to write to
+@@ -48,6 +96,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
++
+ long __weak probe_kernel_write(void *dst, const void *src, size_t size)
+     __attribute__((alias("__probe_kernel_write")));
+ 
+@@ -57,15 +106,40 @@ long __probe_kernel_write(void *dst, const void *src, 
size_t size)
+       mm_segment_t old_fs = get_fs();
+ 
+       set_fs(KERNEL_DS);
+-      pagefault_disable();
+-      ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
+-      pagefault_enable();
++      ret = probe_write_common((__force void __user *)dst, src, size);
+       set_fs(old_fs);
+ 
+-      return ret ? -EFAULT : 0;
++      return ret;
+ }
+ EXPORT_SYMBOL_GPL(probe_kernel_write);
+ 
++/**
++ * probe_user_write(): safely attempt to write to a user-space location
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++
++long __weak probe_user_write(void __user *dst, const void *src, size_t size)
++    __attribute__((alias("__probe_user_write")));
++
++long __probe_user_write(void __user *dst, const void *src, size_t size)
++{
++      long ret = -EFAULT;
++      mm_segment_t old_fs = get_fs();
++
++      set_fs(USER_DS);
++      if (access_ok(VERIFY_WRITE, dst, size))
++              ret = probe_write_common(dst, src, size);
++      set_fs(old_fs);
++
++      return ret;
++}
++EXPORT_SYMBOL_GPL(probe_user_write);
++
+ /**
+  * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address.
+  * @dst:   Destination address, in kernel space.  This buffer must be at
+@@ -106,3 +180,76 @@ long strncpy_from_unsafe(char *dst, const void 
*unsafe_addr, long count)
+ 
+       return ret ? -EFAULT : src - unsafe_addr;
+ }
++
++/**
++ * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user
++ *                            address.
++ * @dst:   Destination address, in kernel space.  This buffer must be at
++ *         least @count bytes long.
++ * @unsafe_addr: Unsafe user address.
++ * @count: Maximum number of bytes to copy, including the trailing NUL.
++ *
++ * Copies a NUL-terminated string from unsafe user address to kernel buffer.
++ *
++ * On success, returns the length of the string INCLUDING the trailing NUL.
++ *
++ * If access fails, returns -EFAULT (some data may have been copied
++ * and the trailing NUL added).
++ *
++ * If @count is smaller than the length of the string, copies @count-1 bytes,
++ * sets the last byte of @dst buffer to NUL and returns @count.
++ */
++long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
++                            long count)
++{
++      mm_segment_t old_fs = get_fs();
++      long ret;
++
++      if (unlikely(count <= 0))
++              return 0;
++
++      set_fs(USER_DS);
++      pagefault_disable();
++      ret = strncpy_from_user(dst, unsafe_addr, count);
++      pagefault_enable();
++      set_fs(old_fs);
++
++      if (ret >= count) {
++              ret = count;
++              dst[ret - 1] = '\0';
++      } else if (ret > 0) {
++              ret++;
++      }
++
++      return ret;
++}
++
++/**
++ * strnlen_unsafe_user: - Get the size of a user string INCLUDING final NUL.
++ * @unsafe_addr: The string to measure.
++ * @count: Maximum count (including NUL)
++ *
++ * Get the size of a NUL-terminated string in user space without pagefault.
++ *
++ * Returns the size of the string INCLUDING the terminating NUL.
++ *
++ * If the string is too long, returns a number larger than @count. User
++ * has to check the return value against "> count".
++ * On exception (or invalid count), returns 0.
++ *
++ * Unlike strnlen_user, this can be used from IRQ handler etc. because
++ * it disables pagefaults.
++ */
++long strnlen_unsafe_user(const void __user *unsafe_addr, long count)
++{
++      mm_segment_t old_fs = get_fs();
++      int ret;
++
++      set_fs(USER_DS);
++      pagefault_disable();
++      ret = strnlen_user(unsafe_addr, count);
++      pagefault_enable();
++      set_fs(old_fs);
++
++      return ret;
++}
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 14bab5fa1b656..3570aaf2a6204 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -835,7 +835,6 @@ static void free_pcppages_bulk(struct zone *zone, int 
count,
+ {
+       int migratetype = 0;
+       int batch_free = 0;
+-      int to_free = count;
+       unsigned long nr_scanned;
+ 
+       spin_lock(&zone->lock);
+@@ -848,7 +847,7 @@ static void free_pcppages_bulk(struct zone *zone, int 
count,
+        * below while (list_empty(list)) loop.
+        */
+       count = min(pcp->count, count);
+-      while (to_free) {
++      while (count) {
+               struct page *page;
+               struct list_head *list;
+ 
+@@ -868,7 +867,7 @@ static void free_pcppages_bulk(struct zone *zone, int 
count,
+ 
+               /* This is the only non-empty list. Free them all. */
+               if (batch_free == MIGRATE_PCPTYPES)
+-                      batch_free = to_free;
++                      batch_free = count;
+ 
+               do {
+                       int mt; /* migratetype of the to-be-freed page */
+@@ -886,7 +885,7 @@ static void free_pcppages_bulk(struct zone *zone, int 
count,
+ 
+                       __free_one_page(page, page_to_pfn(page), zone, 0, mt);
+                       trace_mm_page_pcpu_drain(page, 0, mt);
+-              } while (--to_free && --batch_free && !list_empty(list));
++              } while (--count && --batch_free && !list_empty(list));
+       }
+       spin_unlock(&zone->lock);
+ }
+diff --git a/net/batman-adv/bridge_loop_avoidance.c 
b/net/batman-adv/bridge_loop_avoidance.c
+index cea7fdeac5aa2..9aa5daa551273 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -380,7 +380,10 @@ static void batadv_bla_send_claim(struct batadv_priv 
*bat_priv, u8 *mac,
+                          skb->len + ETH_HLEN);
+       soft_iface->last_rx = jiffies;
+ 
+-      netif_rx(skb);
++      if (in_interrupt())
++              netif_rx(skb);
++      else
++              netif_rx_ni(skb);
+ out:
+       if (primary_if)
+               batadv_hardif_free_ref(primary_if);
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index a88b529b7ca08..5fdb88f72b68f 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -757,8 +757,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, 
unsigned int *header_len,
+ 
+       chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
+       /* store the client address if the message is going to a client */
+-      if (ret == BATADV_DHCP_TO_CLIENT &&
+-          pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
++      if (ret == BATADV_DHCP_TO_CLIENT) {
++              if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
++                      return BATADV_DHCP_NO;
++
+               /* check if the DHCP packet carries an Ethernet DHCP */
+               p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
+               if (*p != BATADV_DHCP_HTYPE_ETHERNET)
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 09115c68f29dc..59157e9686fb2 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4849,13 +4849,14 @@ void netif_napi_add(struct net_device *dev, struct 
napi_struct *napi,
+               pr_err_once("netif_napi_add() called with weight %d on device 
%s\n",
+                           weight, dev->name);
+       napi->weight = weight;
+-      list_add(&napi->dev_list, &dev->napi_list);
+       napi->dev = dev;
+ #ifdef CONFIG_NETPOLL
+       spin_lock_init(&napi->poll_lock);
+       napi->poll_owner = -1;
+ #endif
+       set_bit(NAPI_STATE_SCHED, &napi->state);
++      set_bit(NAPI_STATE_NPSVC, &napi->state);
++      list_add_rcu(&napi->dev_list, &dev->napi_list);
+ }
+ EXPORT_SYMBOL(netif_napi_add);
+ 
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index 0d7c2cc1ff09d..f2610f8f171ca 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -178,7 +178,7 @@ static void poll_napi(struct net_device *dev)
+ {
+       struct napi_struct *napi;
+ 
+-      list_for_each_entry(napi, &dev->napi_list, dev_list) {
++      list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
+               if (napi->poll_owner != smp_processor_id() &&
+                   spin_trylock(&napi->poll_lock)) {
+                       poll_one_napi(napi);
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 6c9158805b57d..9678dd8d70c3f 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -87,6 +87,31 @@ int inet_csk_bind_conflict(const struct sock *sk,
+ }
+ EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
+ 
++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
++                             struct sock *sk)
++{
++      kuid_t uid = sock_i_uid(sk);
++
++      if (hlist_empty(&tb->owners)) {
++              if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
++                      tb->fastreuse = 1;
++              else
++                      tb->fastreuse = 0;
++              if (sk->sk_reuseport) {
++                      tb->fastreuseport = 1;
++                      tb->fastuid = uid;
++              } else
++                      tb->fastreuseport = 0;
++      } else {
++              if (tb->fastreuse &&
++                  (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
++                      tb->fastreuse = 0;
++              if (tb->fastreuseport &&
++                  (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid)))
++                      tb->fastreuseport = 0;
++      }
++}
++
+ /* Obtain a reference to a local port for the given sock,
+  * if snum is zero it means select any available local port.
+  */
+@@ -216,24 +241,9 @@ tb_not_found:
+       if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep,
+                                       net, head, snum)) == NULL)
+               goto fail_unlock;
+-      if (hlist_empty(&tb->owners)) {
+-              if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
+-                      tb->fastreuse = 1;
+-              else
+-                      tb->fastreuse = 0;
+-              if (sk->sk_reuseport) {
+-                      tb->fastreuseport = 1;
+-                      tb->fastuid = uid;
+-              } else
+-                      tb->fastreuseport = 0;
+-      } else {
+-              if (tb->fastreuse &&
+-                  (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
+-                      tb->fastreuse = 0;
+-              if (tb->fastreuseport &&
+-                  (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid)))
+-                      tb->fastreuseport = 0;
+-      }
++
++      inet_csk_update_fastreuse(tb, sk);
++
+ success:
+       if (!inet_csk(sk)->icsk_bind_hash)
+               inet_bind_hash(sk, tb, snum);
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index ccc5980797fcd..738cd5c822b1b 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -160,6 +160,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock 
*child)
+                               return -ENOMEM;
+                       }
+               }
++              inet_csk_update_fastreuse(tb, child);
+       }
+       inet_bind_hash(child, tb, port);
+       spin_unlock(&head->lock);
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index 09b4b07eb6764..ab3e7b14de09b 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -74,7 +74,9 @@ static void nft_payload_eval(const struct nft_expr *expr,
+       u32 *dest = &regs->data[priv->dreg];
+       int offset;
+ 
+-      dest[priv->len / NFT_REG32_SIZE] = 0;
++      if (priv->len % NFT_REG32_SIZE)
++              dest[priv->len / NFT_REG32_SIZE] = 0;
++
+       switch (priv->base) {
+       case NFT_PAYLOAD_LL_HEADER:
+               if (!skb_mac_header_was_set(skb))
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 5803d0807e9a2..62ba9a49c1265 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -6206,8 +6206,6 @@ static long sctp_get_port_local(struct sock *sk, union 
sctp_addr *addr)
+ 
+       pr_debug("%s: begins, snum:%d\n", __func__, snum);
+ 
+-      local_bh_disable();
+-
+       if (snum == 0) {
+               /* Search for an available port. */
+               int low, high, remaining, index;
+@@ -6226,20 +6224,21 @@ static long sctp_get_port_local(struct sock *sk, union 
sctp_addr *addr)
+                               continue;
+                       index = sctp_phashfn(sock_net(sk), rover);
+                       head = &sctp_port_hashtable[index];
+-                      spin_lock(&head->lock);
++                      spin_lock_bh(&head->lock);
+                       sctp_for_each_hentry(pp, &head->chain)
+                               if ((pp->port == rover) &&
+                                   net_eq(sock_net(sk), pp->net))
+                                       goto next;
+                       break;
+               next:
+-                      spin_unlock(&head->lock);
++                      spin_unlock_bh(&head->lock);
++                      cond_resched();
+               } while (--remaining > 0);
+ 
+               /* Exhausted local port range during search? */
+               ret = 1;
+               if (remaining <= 0)
+-                      goto fail;
++                      return ret;
+ 
+               /* OK, here is the one we will use.  HEAD (the port
+                * hash table list entry) is non-NULL and we hold it's
+@@ -6254,7 +6253,7 @@ static long sctp_get_port_local(struct sock *sk, union 
sctp_addr *addr)
+                * port iterator, pp being NULL.
+                */
+               head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
+-              spin_lock(&head->lock);
++              spin_lock_bh(&head->lock);
+               sctp_for_each_hentry(pp, &head->chain) {
+                       if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
+                               goto pp_found;
+@@ -6338,10 +6337,7 @@ success:
+       ret = 0;
+ 
+ fail_unlock:
+-      spin_unlock(&head->lock);
+-
+-fail:
+-      local_bh_enable();
++      spin_unlock_bh(&head->lock);
+       return ret;
+ }
+ 
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 437ec52d5e71f..474923175b108 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2383,6 +2383,9 @@ int regulatory_hint_user(const char *alpha2,
+       if (WARN_ON(!alpha2))
+               return -EINVAL;
+ 
++      if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2))
++              return -EINVAL;
++
+       request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+       if (!request)
+               return -ENOMEM;
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 6ac6550d751c1..8835a4775d205 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -2195,8 +2195,8 @@ sub process {
+ 
+ # Check if the commit log has what seems like a diff which can confuse patch
+               if ($in_commit_log && !$commit_log_has_diff &&
+-                  (($line =~ m@^\s+diff\b.*a/[\w/]+@ &&
+-                    $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) ||
++                  (($line =~ m@^\s+diff\b.*a/([\w/]+)@ &&
++                    $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) ||
+                    $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ ||
+                    $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) {
+                       ERROR("DIFF_IN_COMMIT_MSG",
+diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c
+index 3788906421a73..fe27034f28460 100644
+--- a/sound/core/oss/mulaw.c
++++ b/sound/core/oss/mulaw.c
+@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream 
*plug,
+               snd_BUG();
+               return -EINVAL;
+       }
+-      if (snd_BUG_ON(!snd_pcm_format_linear(format->format)))
+-              return -ENXIO;
++      if (!snd_pcm_format_linear(format->format))
++              return -EINVAL;
+ 
+       err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion",
+                                  src_format, dst_format,
+diff --git a/sound/firewire/digi00x/digi00x.c 
b/sound/firewire/digi00x/digi00x.c
+index 1f33b7a1fca4c..659e8224a4dee 100644
+--- a/sound/firewire/digi00x/digi00x.c
++++ b/sound/firewire/digi00x/digi00x.c
+@@ -13,7 +13,9 @@ MODULE_AUTHOR("Takashi Sakamoto <o-taka...@sakamocchi.jp>");
+ MODULE_LICENSE("GPL v2");
+ 
+ #define VENDOR_DIGIDESIGN     0x00a07e
+-#define MODEL_DIGI00X         0x000002
++#define MODEL_CONSOLE         0x000001
++#define MODEL_RACK            0x000002
++#define SPEC_VERSION          0x000001
+ 
+ static int name_card(struct snd_dg00x *dg00x)
+ {
+@@ -75,6 +77,8 @@ static int snd_dg00x_probe(struct fw_unit *unit,
+       spin_lock_init(&dg00x->lock);
+       init_waitqueue_head(&dg00x->hwdep_wait);
+ 
++      dg00x->is_console = entry->model_id == MODEL_CONSOLE;
++
+       err = name_card(dg00x);
+       if (err < 0)
+               goto error;
+@@ -136,9 +140,19 @@ static const struct ieee1394_device_id 
snd_dg00x_id_table[] = {
+       /* Both of 002/003 use the same ID. */
+       {
+               .match_flags = IEEE1394_MATCH_VENDOR_ID |
++                             IEEE1394_MATCH_VERSION |
++                             IEEE1394_MATCH_MODEL_ID,
++              .vendor_id = VENDOR_DIGIDESIGN,
++              .version = SPEC_VERSION,
++              .model_id = MODEL_CONSOLE,
++      },
++      {
++              .match_flags = IEEE1394_MATCH_VENDOR_ID |
++                             IEEE1394_MATCH_VERSION |
+                              IEEE1394_MATCH_MODEL_ID,
+               .vendor_id = VENDOR_DIGIDESIGN,
+-              .model_id = MODEL_DIGI00X,
++              .version = SPEC_VERSION,
++              .model_id = MODEL_RACK,
+       },
+       {}
+ };
+diff --git a/sound/firewire/digi00x/digi00x.h 
b/sound/firewire/digi00x/digi00x.h
+index 907e739936777..d641a0cf077a3 100644
+--- a/sound/firewire/digi00x/digi00x.h
++++ b/sound/firewire/digi00x/digi00x.h
+@@ -57,6 +57,7 @@ struct snd_dg00x {
+       /* For asynchronous MIDI controls. */
+       struct snd_rawmidi_substream *in_control;
+       struct snd_fw_async_midi_port out_control;
++      bool is_console;
+ };
+ 
+ #define DG00X_ADDR_BASE               0xffffe0000000ull
+diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
+index ee0bc18395088..a4143f45c7f7a 100644
+--- a/sound/firewire/tascam/tascam.c
++++ b/sound/firewire/tascam/tascam.c
+@@ -172,11 +172,39 @@ static void snd_tscm_remove(struct fw_unit *unit)
+ }
+ 
+ static const struct ieee1394_device_id snd_tscm_id_table[] = {
++      // Tascam, FW-1884.
+       {
+               .match_flags = IEEE1394_MATCH_VENDOR_ID |
+-                             IEEE1394_MATCH_SPECIFIER_ID,
++                             IEEE1394_MATCH_SPECIFIER_ID |
++                             IEEE1394_MATCH_VERSION,
+               .vendor_id = 0x00022e,
+               .specifier_id = 0x00022e,
++              .version = 0x800000,
++      },
++      // Tascam, FE-8 (.version = 0x800001)
++      // This kernel module doesn't support FE-8 because the most of features
++      // can be implemented in userspace without any specific support of this
++      // module.
++      //
++      // .version = 0x800002 is unknown.
++      //
++      // Tascam, FW-1082.
++      {
++              .match_flags = IEEE1394_MATCH_VENDOR_ID |
++                             IEEE1394_MATCH_SPECIFIER_ID |
++                             IEEE1394_MATCH_VERSION,
++              .vendor_id = 0x00022e,
++              .specifier_id = 0x00022e,
++              .version = 0x800003,
++      },
++      // Tascam, FW-1804.
++      {
++              .match_flags = IEEE1394_MATCH_VENDOR_ID |
++                             IEEE1394_MATCH_SPECIFIER_ID |
++                             IEEE1394_MATCH_VERSION,
++              .vendor_id = 0x00022e,
++              .specifier_id = 0x00022e,
++              .version = 0x800004,
+       },
+       /* FE-08 requires reverse-engineering because it just has faders. */
+       {}
+diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
+index d3cd95633ee2c..e7ee51b7aa6b0 100644
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 
*chip, int channel_id,
+               else
+                       /* Power down */
+                       chip->spi_dac_reg[reg] |= bit;
+-              return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]);
++              if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0)
++                      return -ENXIO;
+       }
+       return 0;
+ }
+diff --git a/tools/perf/Documentation/perf-record.txt 
b/tools/perf/Documentation/perf-record.txt
+index e630a7d2c3483..e4eee57ad2299 100644
+--- a/tools/perf/Documentation/perf-record.txt
++++ b/tools/perf/Documentation/perf-record.txt
+@@ -33,6 +33,10 @@ OPTIONS
+         - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
+         hexadecimal event descriptor.
+ 
++        - a symbolic or raw PMU event followed by an optional colon
++        and a list of event modifiers, e.g., cpu-cycles:p.  See the
++        linkperf:perf-list[1] man page for details on event modifiers.
++
+       - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where
+         'param1', 'param2', etc are defined as formats for the PMU in
+         /sys/bus/event_sources/devices/<pmu>/format/*.
+diff --git a/tools/perf/Documentation/perf-stat.txt 
b/tools/perf/Documentation/perf-stat.txt
+index 90c3558c2c12f..ee7fe04fc4b6c 100644
+--- a/tools/perf/Documentation/perf-stat.txt
++++ b/tools/perf/Documentation/perf-stat.txt
+@@ -32,6 +32,10 @@ OPTIONS
+       - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
+         hexadecimal event descriptor.
+ 
++        - a symbolic or raw PMU event followed by an optional colon
++        and a list of event modifiers, e.g., cpu-cycles:p.  See the
++        linkperf:perf-list[1] man page for details on event modifiers.
++
+       - a symbolically formed event like 'pmu/param1=0x3,param2/' where
+         param1 and param2 are defined as formats for the PMU in
+         /sys/bus/event_sources/devices/<pmu>/format/*

Reply via email to