* [gentoo-commits] proj/hardened-patchset:master commit in: 4.5.2/, 4.5.3/
@ 2016-05-08 18:54 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2016-05-08 18:54 UTC (permalink / raw
To: gentoo-commits
commit: 63351ee9470841f04d279820a4e7c29302e8bd69
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sun May 8 18:54:35 2016 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sun May 8 18:54:35 2016 +0000
URL: https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=63351ee9
grsecurity-3.1-4.5.3-201605080858
4.5.2/1001_linux-4.5.2.patch | 5011 --------------------
{4.5.2 => 4.5.3}/0000_README | 6 +-
.../4420_grsecurity-3.1-4.5.3-201605080858.patch | 2251 ++++++---
{4.5.2 => 4.5.3}/4425_grsec_remove_EI_PAX.patch | 0
{4.5.2 => 4.5.3}/4427_force_XATTR_PAX_tmpfs.patch | 17 +-
.../4430_grsec-remove-localversion-grsec.patch | 0
{4.5.2 => 4.5.3}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{4.5.2 => 4.5.3}/4470_disable-compat_vdso.patch | 0
{4.5.2 => 4.5.3}/4475_emutramp_default_on.patch | 0
12 files changed, 1672 insertions(+), 5613 deletions(-)
diff --git a/4.5.2/1001_linux-4.5.2.patch b/4.5.2/1001_linux-4.5.2.patch
deleted file mode 100644
index 2c2064e..0000000
--- a/4.5.2/1001_linux-4.5.2.patch
+++ /dev/null
@@ -1,5011 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
-index 08a4a32..0326154 100644
---- a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
-@@ -134,12 +134,12 @@ mfio80 ddr_debug, mips_trace_data, mips_debug
- mfio81 dreq0, mips_trace_data, eth_debug
- mfio82 dreq1, mips_trace_data, eth_debug
- mfio83 mips_pll_lock, mips_trace_data, usb_debug
--mfio84 sys_pll_lock, mips_trace_data, usb_debug
--mfio85 wifi_pll_lock, mips_trace_data, sdhost_debug
--mfio86 bt_pll_lock, mips_trace_data, sdhost_debug
--mfio87 rpu_v_pll_lock, dreq2, socif_debug
--mfio88 rpu_l_pll_lock, dreq3, socif_debug
--mfio89 audio_pll_lock, dreq4, dreq5
-+mfio84 audio_pll_lock, mips_trace_data, usb_debug
-+mfio85 rpu_v_pll_lock, mips_trace_data, sdhost_debug
-+mfio86 rpu_l_pll_lock, mips_trace_data, sdhost_debug
-+mfio87 sys_pll_lock, dreq2, socif_debug
-+mfio88 wifi_pll_lock, dreq3, socif_debug
-+mfio89 bt_pll_lock, dreq4, dreq5
- tck
- trstn
- tdi
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 9a53c92..21e4b48 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -4016,6 +4016,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- sector if the number is odd);
- i = IGNORE_DEVICE (don't bind to this
- device);
-+ j = NO_REPORT_LUNS (don't use report luns
-+ command, uas only);
- l = NOT_LOCKABLE (don't try to lock and
- unlock ejectable media);
- m = MAX_SECTORS_64 (don't transfer more
-diff --git a/Makefile b/Makefile
-index c621889..1ecaaeb 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 5
--SUBLEVEL = 1
-+SUBLEVEL = 2
- EXTRAVERSION =
- NAME = Blurry Fish Butt
-
-diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index 7d0cba6f..c86ea8a 100644
---- a/arch/arm/kernel/setup.c
-+++ b/arch/arm/kernel/setup.c
-@@ -430,11 +430,13 @@ static void __init patch_aeabi_idiv(void)
- pr_info("CPU: div instructions available: patching division code\n");
-
- fn_addr = ((uintptr_t)&__aeabi_uidiv) & ~1;
-+ asm ("" : "+g" (fn_addr));
- ((u32 *)fn_addr)[0] = udiv_instruction();
- ((u32 *)fn_addr)[1] = bx_lr_instruction();
- flush_icache_range(fn_addr, fn_addr + 8);
-
- fn_addr = ((uintptr_t)&__aeabi_idiv) & ~1;
-+ asm ("" : "+g" (fn_addr));
- ((u32 *)fn_addr)[0] = sdiv_instruction();
- ((u32 *)fn_addr)[1] = bx_lr_instruction();
- flush_icache_range(fn_addr, fn_addr + 8);
-diff --git a/arch/arm64/include/asm/opcodes.h b/arch/arm64/include/asm/opcodes.h
-index 4e603ea..123f45d 100644
---- a/arch/arm64/include/asm/opcodes.h
-+++ b/arch/arm64/include/asm/opcodes.h
-@@ -1 +1,5 @@
-+#ifdef CONFIG_CPU_BIG_ENDIAN
-+#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN
-+#endif
-+
- #include <../../arm/include/asm/opcodes.h>
-diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
-index c536c9e..0931155 100644
---- a/arch/arm64/kernel/debug-monitors.c
-+++ b/arch/arm64/kernel/debug-monitors.c
-@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt_regs *regs)
-
- /* EL1 Single Step Handler hooks */
- static LIST_HEAD(step_hook);
--static DEFINE_RWLOCK(step_hook_lock);
-+static DEFINE_SPINLOCK(step_hook_lock);
-
- void register_step_hook(struct step_hook *hook)
- {
-- write_lock(&step_hook_lock);
-- list_add(&hook->node, &step_hook);
-- write_unlock(&step_hook_lock);
-+ spin_lock(&step_hook_lock);
-+ list_add_rcu(&hook->node, &step_hook);
-+ spin_unlock(&step_hook_lock);
- }
-
- void unregister_step_hook(struct step_hook *hook)
- {
-- write_lock(&step_hook_lock);
-- list_del(&hook->node);
-- write_unlock(&step_hook_lock);
-+ spin_lock(&step_hook_lock);
-+ list_del_rcu(&hook->node);
-+ spin_unlock(&step_hook_lock);
-+ synchronize_rcu();
- }
-
- /*
-@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr)
- struct step_hook *hook;
- int retval = DBG_HOOK_ERROR;
-
-- read_lock(&step_hook_lock);
-+ rcu_read_lock();
-
-- list_for_each_entry(hook, &step_hook, node) {
-+ list_for_each_entry_rcu(hook, &step_hook, node) {
- retval = hook->fn(regs, esr);
- if (retval == DBG_HOOK_HANDLED)
- break;
- }
-
-- read_unlock(&step_hook_lock);
-+ rcu_read_unlock();
-
- return retval;
- }
-diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c
-index bdeed9d..433c4b9 100644
---- a/arch/mips/alchemy/devboards/db1000.c
-+++ b/arch/mips/alchemy/devboards/db1000.c
-@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void)
- if (board == BCSR_WHOAMI_DB1500) {
- c0 = AU1500_GPIO2_INT;
- c1 = AU1500_GPIO5_INT;
-- d0 = AU1500_GPIO0_INT;
-- d1 = AU1500_GPIO3_INT;
-+ d0 = 0; /* GPIO number, NOT irq! */
-+ d1 = 3; /* GPIO number, NOT irq! */
- s0 = AU1500_GPIO1_INT;
- s1 = AU1500_GPIO4_INT;
- } else if (board == BCSR_WHOAMI_DB1100) {
- c0 = AU1100_GPIO2_INT;
- c1 = AU1100_GPIO5_INT;
-- d0 = AU1100_GPIO0_INT;
-- d1 = AU1100_GPIO3_INT;
-+ d0 = 0; /* GPIO number, NOT irq! */
-+ d1 = 3; /* GPIO number, NOT irq! */
- s0 = AU1100_GPIO1_INT;
- s1 = AU1100_GPIO4_INT;
-
-@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void)
- } else if (board == BCSR_WHOAMI_DB1000) {
- c0 = AU1000_GPIO2_INT;
- c1 = AU1000_GPIO5_INT;
-- d0 = AU1000_GPIO0_INT;
-- d1 = AU1000_GPIO3_INT;
-+ d0 = 0; /* GPIO number, NOT irq! */
-+ d1 = 3; /* GPIO number, NOT irq! */
- s0 = AU1000_GPIO1_INT;
- s1 = AU1000_GPIO4_INT;
- platform_add_devices(db1000_devs, ARRAY_SIZE(db1000_devs));
- } else if ((board == BCSR_WHOAMI_PB1500) ||
- (board == BCSR_WHOAMI_PB1500R2)) {
- c0 = AU1500_GPIO203_INT;
-- d0 = AU1500_GPIO201_INT;
-+ d0 = 1; /* GPIO number, NOT irq! */
- s0 = AU1500_GPIO202_INT;
- twosocks = 0;
- flashsize = 64;
-@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void)
- */
- } else if (board == BCSR_WHOAMI_PB1100) {
- c0 = AU1100_GPIO11_INT;
-- d0 = AU1100_GPIO9_INT;
-+ d0 = 9; /* GPIO number, NOT irq! */
- s0 = AU1100_GPIO10_INT;
- twosocks = 0;
- flashsize = 64;
-@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void)
- } else
- return 0; /* unknown board, no further dev setup to do */
-
-- irq_set_irq_type(d0, IRQ_TYPE_EDGE_BOTH);
- irq_set_irq_type(c0, IRQ_TYPE_LEVEL_LOW);
- irq_set_irq_type(s0, IRQ_TYPE_LEVEL_LOW);
-
-@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void)
- c0, d0, /*s0*/0, 0, 0);
-
- if (twosocks) {
-- irq_set_irq_type(d1, IRQ_TYPE_EDGE_BOTH);
- irq_set_irq_type(c1, IRQ_TYPE_LEVEL_LOW);
- irq_set_irq_type(s1, IRQ_TYPE_LEVEL_LOW);
-
-diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c
-index b518f02..1c01d6e 100644
---- a/arch/mips/alchemy/devboards/db1550.c
-+++ b/arch/mips/alchemy/devboards/db1550.c
-@@ -514,7 +514,7 @@ static void __init db1550_devices(void)
- AU1000_PCMCIA_MEM_PHYS_ADDR + 0x000400000 - 1,
- AU1000_PCMCIA_IO_PHYS_ADDR,
- AU1000_PCMCIA_IO_PHYS_ADDR + 0x000010000 - 1,
-- AU1550_GPIO3_INT, AU1550_GPIO0_INT,
-+ AU1550_GPIO3_INT, 0,
- /*AU1550_GPIO21_INT*/0, 0, 0);
-
- db1x_register_pcmcia_socket(
-@@ -524,7 +524,7 @@ static void __init db1550_devices(void)
- AU1000_PCMCIA_MEM_PHYS_ADDR + 0x004400000 - 1,
- AU1000_PCMCIA_IO_PHYS_ADDR + 0x004000000,
- AU1000_PCMCIA_IO_PHYS_ADDR + 0x004010000 - 1,
-- AU1550_GPIO5_INT, AU1550_GPIO1_INT,
-+ AU1550_GPIO5_INT, 1,
- /*AU1550_GPIO22_INT*/0, 0, 1);
-
- platform_device_register(&db1550_nand_dev);
-diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c
-index 490cea5..5c62065 100644
---- a/arch/mips/kernel/unaligned.c
-+++ b/arch/mips/kernel/unaligned.c
-@@ -885,7 +885,7 @@ static void emulate_load_store_insn(struct pt_regs *regs,
- {
- union mips_instruction insn;
- unsigned long value;
-- unsigned int res;
-+ unsigned int res, preempted;
- unsigned long origpc;
- unsigned long orig31;
- void __user *fault_addr = NULL;
-@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struct pt_regs *regs,
- if (!access_ok(VERIFY_READ, addr, sizeof(*fpr)))
- goto sigbus;
-
-- /*
-- * Disable preemption to avoid a race between copying
-- * state from userland, migrating to another CPU and
-- * updating the hardware vector register below.
-- */
-- preempt_disable();
--
-- res = __copy_from_user_inatomic(fpr, addr,
-- sizeof(*fpr));
-- if (res)
-- goto fault;
--
-- /*
-- * Update the hardware register if it is in use by the
-- * task in this quantum, in order to avoid having to
-- * save & restore the whole vector context.
-- */
-- if (test_thread_flag(TIF_USEDMSA))
-- write_msa_wr(wd, fpr, df);
-+ do {
-+ /*
-+ * If we have live MSA context keep track of
-+ * whether we get preempted in order to avoid
-+ * the register context we load being clobbered
-+ * by the live context as it's saved during
-+ * preemption. If we don't have live context
-+ * then it can't be saved to clobber the value
-+ * we load.
-+ */
-+ preempted = test_thread_flag(TIF_USEDMSA);
-+
-+ res = __copy_from_user_inatomic(fpr, addr,
-+ sizeof(*fpr));
-+ if (res)
-+ goto fault;
-
-- preempt_enable();
-+ /*
-+ * Update the hardware register if it is in use
-+ * by the task in this quantum, in order to
-+ * avoid having to save & restore the whole
-+ * vector context.
-+ */
-+ preempt_disable();
-+ if (test_thread_flag(TIF_USEDMSA)) {
-+ write_msa_wr(wd, fpr, df);
-+ preempted = 0;
-+ }
-+ preempt_enable();
-+ } while (preempted);
- break;
-
- case msa_st_op:
-diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
-index 14f655c..86ed376 100644
---- a/arch/parisc/Kconfig
-+++ b/arch/parisc/Kconfig
-@@ -29,6 +29,7 @@ config PARISC
- select TTY # Needed for pdc_cons.c
- select HAVE_DEBUG_STACKOVERFLOW
- select HAVE_ARCH_AUDITSYSCALL
-+ select HAVE_ARCH_SECCOMP_FILTER
- select ARCH_NO_COHERENT_DMA_MMAP
-
- help
-diff --git a/arch/parisc/include/asm/compat.h b/arch/parisc/include/asm/compat.h
-index 0448a2c..3387307 100644
---- a/arch/parisc/include/asm/compat.h
-+++ b/arch/parisc/include/asm/compat.h
-@@ -183,6 +183,13 @@ typedef struct compat_siginfo {
- int _band; /* POLL_IN, POLL_OUT, POLL_MSG */
- int _fd;
- } _sigpoll;
-+
-+ /* SIGSYS */
-+ struct {
-+ compat_uptr_t _call_addr; /* calling user insn */
-+ int _syscall; /* triggering system call number */
-+ compat_uint_t _arch; /* AUDIT_ARCH_* of syscall */
-+ } _sigsys;
- } _sifields;
- } compat_siginfo_t;
-
-diff --git a/arch/parisc/include/asm/syscall.h b/arch/parisc/include/asm/syscall.h
-index a5eba95..637ce8d 100644
---- a/arch/parisc/include/asm/syscall.h
-+++ b/arch/parisc/include/asm/syscall.h
-@@ -39,6 +39,19 @@ static inline void syscall_get_arguments(struct task_struct *tsk,
- }
- }
-
-+static inline void syscall_set_return_value(struct task_struct *task,
-+ struct pt_regs *regs,
-+ int error, long val)
-+{
-+ regs->gr[28] = error ? error : val;
-+}
-+
-+static inline void syscall_rollback(struct task_struct *task,
-+ struct pt_regs *regs)
-+{
-+ /* do nothing */
-+}
-+
- static inline int syscall_get_arch(void)
- {
- int arch = AUDIT_ARCH_PARISC;
-diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 0abdd4c..1960b87 100644
---- a/arch/parisc/include/asm/uaccess.h
-+++ b/arch/parisc/include/asm/uaccess.h
-@@ -76,6 +76,7 @@ struct exception_table_entry {
- */
- struct exception_data {
- unsigned long fault_ip;
-+ unsigned long fault_gp;
- unsigned long fault_space;
- unsigned long fault_addr;
- };
-diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
-index d2f6257..78d30d2 100644
---- a/arch/parisc/kernel/asm-offsets.c
-+++ b/arch/parisc/kernel/asm-offsets.c
-@@ -299,6 +299,7 @@ int main(void)
- #endif
- BLANK();
- DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
-+ DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp));
- DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
- DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
- BLANK();
-diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
-index 568b2c6..3cad8aa 100644
---- a/arch/parisc/kernel/parisc_ksyms.c
-+++ b/arch/parisc/kernel/parisc_ksyms.c
-@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64);
- EXPORT_SYMBOL(lclear_user);
- EXPORT_SYMBOL(lstrnlen_user);
-
--/* Global fixups */
--extern void fixup_get_user_skip_1(void);
--extern void fixup_get_user_skip_2(void);
--extern void fixup_put_user_skip_1(void);
--extern void fixup_put_user_skip_2(void);
-+/* Global fixups - defined as int to avoid creation of function pointers */
-+extern int fixup_get_user_skip_1;
-+extern int fixup_get_user_skip_2;
-+extern int fixup_put_user_skip_1;
-+extern int fixup_put_user_skip_2;
- EXPORT_SYMBOL(fixup_get_user_skip_1);
- EXPORT_SYMBOL(fixup_get_user_skip_2);
- EXPORT_SYMBOL(fixup_put_user_skip_1);
-diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
-index ce0b2b4..8fb81a3 100644
---- a/arch/parisc/kernel/ptrace.c
-+++ b/arch/parisc/kernel/ptrace.c
-@@ -270,7 +270,8 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
- long do_syscall_trace_enter(struct pt_regs *regs)
- {
- /* Do the secure computing check first. */
-- secure_computing_strict(regs->gr[20]);
-+ if (secure_computing() == -1)
-+ return -1;
-
- if (test_thread_flag(TIF_SYSCALL_TRACE) &&
- tracehook_report_syscall_entry(regs)) {
-@@ -296,7 +297,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
- regs->gr[23] & 0xffffffff);
-
- out:
-- return regs->gr[20];
-+ /*
-+ * Sign extend the syscall number to 64bit since it may have been
-+ * modified by a compat ptrace call
-+ */
-+ return (int) ((u32) regs->gr[20]);
- }
-
- void do_syscall_trace_exit(struct pt_regs *regs)
-diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
-index 984abbe..c342b2e 100644
---- a/arch/parisc/kernel/signal32.c
-+++ b/arch/parisc/kernel/signal32.c
-@@ -371,6 +371,11 @@ copy_siginfo_to_user32 (compat_siginfo_t __user *to, const siginfo_t *from)
- val = (compat_int_t)from->si_int;
- err |= __put_user(val, &to->si_int);
- break;
-+ case __SI_SYS >> 16:
-+ err |= __put_user(ptr_to_compat(from->si_call_addr), &to->si_call_addr);
-+ err |= __put_user(from->si_syscall, &to->si_syscall);
-+ err |= __put_user(from->si_arch, &to->si_arch);
-+ break;
- }
- }
- return err;
-diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
-index fbafa0d..c976ebf 100644
---- a/arch/parisc/kernel/syscall.S
-+++ b/arch/parisc/kernel/syscall.S
-@@ -329,6 +329,7 @@ tracesys_next:
-
- ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
- LDREG TI_TASK(%r1), %r1
-+ LDREG TASK_PT_GR28(%r1), %r28 /* Restore return value */
- LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */
- LDREG TASK_PT_GR25(%r1), %r25
- LDREG TASK_PT_GR24(%r1), %r24
-@@ -342,6 +343,7 @@ tracesys_next:
- stw %r21, -56(%r30) /* 6th argument */
- #endif
-
-+ cmpib,COND(=),n -1,%r20,tracesys_exit /* seccomp may have returned -1 */
- comiclr,>>= __NR_Linux_syscalls, %r20, %r0
- b,n .Ltracesys_nosys
-
-diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 553b098..77e2262 100644
---- a/arch/parisc/kernel/traps.c
-+++ b/arch/parisc/kernel/traps.c
-@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
-
- if (fault_space == 0 && !faulthandler_disabled())
- {
-+ /* Clean up and return if in exception table. */
-+ if (fixup_exception(regs))
-+ return;
- pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
- parisc_terminate("Kernel Fault", regs, code, fault_address);
- }
-diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
-index 536ef66..1052b74 100644
---- a/arch/parisc/lib/fixup.S
-+++ b/arch/parisc/lib/fixup.S
-@@ -26,6 +26,7 @@
-
- #ifdef CONFIG_SMP
- .macro get_fault_ip t1 t2
-+ loadgp
- addil LT%__per_cpu_offset,%r27
- LDREG RT%__per_cpu_offset(%r1),\t1
- /* t2 = smp_processor_id() */
-@@ -40,14 +41,19 @@
- LDREG RT%exception_data(%r1),\t1
- /* t1 = this_cpu_ptr(&exception_data) */
- add,l \t1,\t2,\t1
-+ /* %r27 = t1->fault_gp - restore gp */
-+ LDREG EXCDATA_GP(\t1), %r27
- /* t1 = t1->fault_ip */
- LDREG EXCDATA_IP(\t1), \t1
- .endm
- #else
- .macro get_fault_ip t1 t2
-+ loadgp
- /* t1 = this_cpu_ptr(&exception_data) */
- addil LT%exception_data,%r27
- LDREG RT%exception_data(%r1),\t2
-+ /* %r27 = t2->fault_gp - restore gp */
-+ LDREG EXCDATA_GP(\t2), %r27
- /* t1 = t2->fault_ip */
- LDREG EXCDATA_IP(\t2), \t1
- .endm
-diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index a762864..f906444 100644
---- a/arch/parisc/mm/fault.c
-+++ b/arch/parisc/mm/fault.c
-@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs)
- struct exception_data *d;
- d = this_cpu_ptr(&exception_data);
- d->fault_ip = regs->iaoq[0];
-+ d->fault_gp = regs->gr[27];
- d->fault_space = regs->isr;
- d->fault_addr = regs->ior;
-
-diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 3c5736e..54ed9c7 100644
---- a/arch/powerpc/kernel/process.c
-+++ b/arch/powerpc/kernel/process.c
-@@ -854,7 +854,7 @@ void restore_tm_state(struct pt_regs *regs)
- static inline void save_sprs(struct thread_struct *t)
- {
- #ifdef CONFIG_ALTIVEC
-- if (cpu_has_feature(cpu_has_feature(CPU_FTR_ALTIVEC)))
-+ if (cpu_has_feature(CPU_FTR_ALTIVEC))
- t->vrsave = mfspr(SPRN_VRSAVE);
- #endif
- #ifdef CONFIG_PPC_BOOK3S_64
-diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
-index 744e24b..4a811ca 100644
---- a/arch/powerpc/mm/hugetlbpage.c
-+++ b/arch/powerpc/mm/hugetlbpage.c
-@@ -414,13 +414,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte)
- {
- struct hugepd_freelist **batchp;
-
-- batchp = this_cpu_ptr(&hugepd_freelist_cur);
-+ batchp = &get_cpu_var(hugepd_freelist_cur);
-
- if (atomic_read(&tlb->mm->mm_users) < 2 ||
- cpumask_equal(mm_cpumask(tlb->mm),
- cpumask_of(smp_processor_id()))) {
- kmem_cache_free(hugepte_cache, hugepte);
-- put_cpu_var(hugepd_freelist_cur);
-+ put_cpu_var(hugepd_freelist_cur);
- return;
- }
-
-diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
-index 13dab0c..3776aca 100644
---- a/arch/s390/mm/gup.c
-+++ b/arch/s390/mm/gup.c
-@@ -20,9 +20,9 @@
- static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
- unsigned long end, int write, struct page **pages, int *nr)
- {
-+ struct page *head, *page;
- unsigned long mask;
- pte_t *ptep, pte;
-- struct page *page;
-
- mask = (write ? _PAGE_PROTECT : 0) | _PAGE_INVALID | _PAGE_SPECIAL;
-
-@@ -37,12 +37,14 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
- return 0;
- VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
- page = pte_page(pte);
-- if (!page_cache_get_speculative(page))
-+ head = compound_head(page);
-+ if (!page_cache_get_speculative(head))
- return 0;
- if (unlikely(pte_val(pte) != pte_val(*ptep))) {
-- put_page(page);
-+ put_page(head);
- return 0;
- }
-+ VM_BUG_ON_PAGE(compound_head(page) != head, page);
- pages[*nr] = page;
- (*nr)++;
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index 44adbb8..f8dba20 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -42,7 +42,7 @@
-
- #define KVM_PIO_PAGE_OFFSET 1
- #define KVM_COALESCED_MMIO_PAGE_OFFSET 2
--#define KVM_HALT_POLL_NS_DEFAULT 500000
-+#define KVM_HALT_POLL_NS_DEFAULT 400000
-
- #define KVM_IRQCHIP_NUM_PINS KVM_IOAPIC_NUM_PINS
-
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index d47d231..eca5bd9 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -6074,12 +6074,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
- }
-
- /* try to inject new event if pending */
-- if (vcpu->arch.nmi_pending) {
-- if (kvm_x86_ops->nmi_allowed(vcpu)) {
-- --vcpu->arch.nmi_pending;
-- vcpu->arch.nmi_injected = true;
-- kvm_x86_ops->set_nmi(vcpu);
-- }
-+ if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
-+ --vcpu->arch.nmi_pending;
-+ vcpu->arch.nmi_injected = true;
-+ kvm_x86_ops->set_nmi(vcpu);
- } else if (kvm_cpu_has_injectable_intr(vcpu)) {
- /*
- * Because interrupts can be injected asynchronously, we are
-@@ -6548,10 +6546,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
- if (inject_pending_event(vcpu, req_int_win) != 0)
- req_immediate_exit = true;
- /* enable NMI/IRQ window open exits if needed */
-- else if (vcpu->arch.nmi_pending)
-- kvm_x86_ops->enable_nmi_window(vcpu);
-- else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
-- kvm_x86_ops->enable_irq_window(vcpu);
-+ else {
-+ if (vcpu->arch.nmi_pending)
-+ kvm_x86_ops->enable_nmi_window(vcpu);
-+ if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
-+ kvm_x86_ops->enable_irq_window(vcpu);
-+ }
-
- if (kvm_lapic_enabled(vcpu)) {
- update_cr8_intercept(vcpu);
-diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
-index 90d6d47..ecdb5a2 100644
---- a/crypto/asymmetric_keys/pkcs7_trust.c
-+++ b/crypto/asymmetric_keys/pkcs7_trust.c
-@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
- int cached_ret = -ENOKEY;
- int ret;
-
-+ *_trusted = false;
-+
- for (p = pkcs7->certs; p; p = p->next)
- p->seen = false;
-
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 4a87678..9745cf9 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_req_create(
-
- osdc = &rbd_dev->rbd_client->client->osdc;
- osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false,
-- GFP_ATOMIC);
-+ GFP_NOIO);
- if (!osd_req)
- return NULL; /* ENOMEM */
-
-@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request)
- rbd_dev = img_request->rbd_dev;
- osdc = &rbd_dev->rbd_client->client->osdc;
- osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops,
-- false, GFP_ATOMIC);
-+ false, GFP_NOIO);
- if (!osd_req)
- return NULL; /* ENOMEM */
-
-@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
- bio_chain_clone_range(&bio_list,
- &bio_offset,
- clone_size,
-- GFP_ATOMIC);
-+ GFP_NOIO);
- if (!obj_request->bio_list)
- goto out_unwind;
- } else if (type == OBJ_REQUEST_PAGES) {
-diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
-index 99b375c..90c1511 100644
---- a/drivers/gpio/gpio-pca953x.c
-+++ b/drivers/gpio/gpio-pca953x.c
-@@ -18,6 +18,7 @@
- #include <linux/i2c.h>
- #include <linux/platform_data/pca953x.h>
- #include <linux/slab.h>
-+#include <asm/unaligned.h>
- #include <linux/of_platform.h>
- #include <linux/acpi.h>
-
-@@ -159,7 +160,7 @@ static int pca953x_write_regs(struct pca953x_chip *chip, int reg, u8 *val)
- switch (chip->chip_type) {
- case PCA953X_TYPE:
- ret = i2c_smbus_write_word_data(chip->client,
-- reg << 1, (u16) *val);
-+ reg << 1, cpu_to_le16(get_unaligned((u16 *)val)));
- break;
- case PCA957X_TYPE:
- ret = i2c_smbus_write_byte_data(chip->client, reg << 1,
-diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
-index b2b7b78..76ac906 100644
---- a/drivers/gpio/gpio-pxa.c
-+++ b/drivers/gpio/gpio-pxa.c
-@@ -283,8 +283,8 @@ static int pxa_gpio_direction_output(struct gpio_chip *chip,
- writel_relaxed(mask, base + (value ? GPSR_OFFSET : GPCR_OFFSET));
-
- ret = pinctrl_gpio_direction_output(chip->base + offset);
-- if (!ret)
-- return 0;
-+ if (ret)
-+ return ret;
-
- spin_lock_irqsave(&gpio_lock, flags);
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
-index 7a4b101..75cb5b9 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
-@@ -816,10 +816,13 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device,
- struct drm_device *ddev = adev->ddev;
- struct drm_crtc *crtc;
- uint32_t line_time_us, vblank_lines;
-+ struct cgs_mode_info *mode_info;
-
- if (info == NULL)
- return -EINVAL;
-
-+ mode_info = info->mode_info;
-+
- if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) {
- list_for_each_entry(crtc,
- &ddev->mode_config.crtc_list, head) {
-@@ -828,7 +831,7 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device,
- info->active_display_mask |= (1 << amdgpu_crtc->crtc_id);
- info->display_count++;
- }
-- if (info->mode_info != NULL &&
-+ if (mode_info != NULL &&
- crtc->enabled && amdgpu_crtc->enabled &&
- amdgpu_crtc->hw_mode.clock) {
- line_time_us = (amdgpu_crtc->hw_mode.crtc_htotal * 1000) /
-@@ -836,10 +839,10 @@ static int amdgpu_cgs_get_active_displays_info(void *cgs_device,
- vblank_lines = amdgpu_crtc->hw_mode.crtc_vblank_end -
- amdgpu_crtc->hw_mode.crtc_vdisplay +
- (amdgpu_crtc->v_border * 2);
-- info->mode_info->vblank_time_us = vblank_lines * line_time_us;
-- info->mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
-- info->mode_info->ref_clock = adev->clock.spll.reference_freq;
-- info->mode_info++;
-+ mode_info->vblank_time_us = vblank_lines * line_time_us;
-+ mode_info->refresh_rate = drm_mode_vrefresh(&amdgpu_crtc->hw_mode);
-+ mode_info->ref_clock = adev->clock.spll.reference_freq;
-+ mode_info = NULL;
- }
- }
- }
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-index b806079..53964b1 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-@@ -902,14 +902,6 @@ static int gmc_v7_0_early_init(void *handle)
- gmc_v7_0_set_gart_funcs(adev);
- gmc_v7_0_set_irq_funcs(adev);
-
-- if (adev->flags & AMD_IS_APU) {
-- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
-- } else {
-- u32 tmp = RREG32(mmMC_SEQ_MISC0);
-- tmp &= MC_SEQ_MISC0__MT__MASK;
-- adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp);
-- }
--
- return 0;
- }
-
-@@ -930,6 +922,14 @@ static int gmc_v7_0_sw_init(void *handle)
- if (r)
- return r;
-
-+ if (adev->flags & AMD_IS_APU) {
-+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
-+ } else {
-+ u32 tmp = RREG32(mmMC_SEQ_MISC0);
-+ tmp &= MC_SEQ_MISC0__MT__MASK;
-+ adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp);
-+ }
-+
- r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault);
- if (r)
- return r;
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
-index 3efd455..e59251f 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
-@@ -856,14 +856,6 @@ static int gmc_v8_0_early_init(void *handle)
- gmc_v8_0_set_gart_funcs(adev);
- gmc_v8_0_set_irq_funcs(adev);
-
-- if (adev->flags & AMD_IS_APU) {
-- adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
-- } else {
-- u32 tmp = RREG32(mmMC_SEQ_MISC0);
-- tmp &= MC_SEQ_MISC0__MT__MASK;
-- adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp);
-- }
--
- return 0;
- }
-
-@@ -874,6 +866,8 @@ static int gmc_v8_0_late_init(void *handle)
- return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
- }
-
-+#define mmMC_SEQ_MISC0_FIJI 0xA71
-+
- static int gmc_v8_0_sw_init(void *handle)
- {
- int r;
-@@ -884,6 +878,19 @@ static int gmc_v8_0_sw_init(void *handle)
- if (r)
- return r;
-
-+ if (adev->flags & AMD_IS_APU) {
-+ adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
-+ } else {
-+ u32 tmp;
-+
-+ if (adev->asic_type == CHIP_FIJI)
-+ tmp = RREG32(mmMC_SEQ_MISC0_FIJI);
-+ else
-+ tmp = RREG32(mmMC_SEQ_MISC0);
-+ tmp &= MC_SEQ_MISC0__MT__MASK;
-+ adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp);
-+ }
-+
- r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault);
- if (r)
- return r;
-diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
-index 9535c5b..7e5a972 100644
---- a/drivers/gpu/drm/drm_dp_helper.c
-+++ b/drivers/gpu/drm/drm_dp_helper.c
-@@ -178,7 +178,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
- {
- struct drm_dp_aux_msg msg;
- unsigned int retry;
-- int err;
-+ int err = 0;
-
- memset(&msg, 0, sizeof(msg));
- msg.address = offset;
-@@ -186,6 +186,8 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
- msg.buffer = buffer;
- msg.size = size;
-
-+ mutex_lock(&aux->hw_mutex);
-+
- /*
- * The specification doesn't give any recommendation on how often to
- * retry native transactions. We used to retry 7 times like for
-@@ -194,25 +196,24 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
- */
- for (retry = 0; retry < 32; retry++) {
-
-- mutex_lock(&aux->hw_mutex);
- err = aux->transfer(aux, &msg);
-- mutex_unlock(&aux->hw_mutex);
- if (err < 0) {
- if (err == -EBUSY)
- continue;
-
-- return err;
-+ goto unlock;
- }
-
-
- switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) {
- case DP_AUX_NATIVE_REPLY_ACK:
- if (err < size)
-- return -EPROTO;
-- return err;
-+ err = -EPROTO;
-+ goto unlock;
-
- case DP_AUX_NATIVE_REPLY_NACK:
-- return -EIO;
-+ err = -EIO;
-+ goto unlock;
-
- case DP_AUX_NATIVE_REPLY_DEFER:
- usleep_range(AUX_RETRY_INTERVAL, AUX_RETRY_INTERVAL + 100);
-@@ -221,7 +222,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
- }
-
- DRM_DEBUG_KMS("too many retries, giving up\n");
-- return -EIO;
-+ err = -EIO;
-+
-+unlock:
-+ mutex_unlock(&aux->hw_mutex);
-+ return err;
- }
-
- /**
-@@ -543,9 +548,7 @@ static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
- int max_retries = max(7, drm_dp_i2c_retry_count(msg, dp_aux_i2c_speed_khz));
-
- for (retry = 0, defer_i2c = 0; retry < (max_retries + defer_i2c); retry++) {
-- mutex_lock(&aux->hw_mutex);
- ret = aux->transfer(aux, msg);
-- mutex_unlock(&aux->hw_mutex);
- if (ret < 0) {
- if (ret == -EBUSY)
- continue;
-@@ -684,6 +687,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
-
- memset(&msg, 0, sizeof(msg));
-
-+ mutex_lock(&aux->hw_mutex);
-+
- for (i = 0; i < num; i++) {
- msg.address = msgs[i].addr;
- drm_dp_i2c_msg_set_request(&msg, &msgs[i]);
-@@ -738,6 +743,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
- msg.size = 0;
- (void)drm_dp_i2c_do_msg(aux, &msg);
-
-+ mutex_unlock(&aux->hw_mutex);
-+
- return err;
- }
-
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index a82b891..7285adb 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2926,9 +2926,11 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
-+ { PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
- { 0, 0, 0, 0 },
- };
-
-@@ -3008,6 +3010,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
- }
- ++p;
- }
-+ /* limit mclk on all R7 370 parts for stability */
-+ if (rdev->pdev->device == 0x6811 &&
-+ rdev->pdev->revision == 0x81)
-+ max_mclk = 120000;
-
- if (rps->vce_active) {
- rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index 200419d..18a2acb 100644
---- a/drivers/gpu/drm/udl/udl_fb.c
-+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -538,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper,
- out_destroy_fbi:
- drm_fb_helper_release_fbi(helper);
- out_gfree:
-- drm_gem_object_unreference(&ufbdev->ufb.obj->base);
-+ drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
- out:
- return ret;
- }
-diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
-index 2a0a784..d7528e0 100644
---- a/drivers/gpu/drm/udl/udl_gem.c
-+++ b/drivers/gpu/drm/udl/udl_gem.c
-@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file,
- return ret;
- }
-
-- drm_gem_object_unreference(&obj->base);
-+ drm_gem_object_unreference_unlocked(&obj->base);
- *handle_p = handle;
- return 0;
- }
-diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
-index ad71160..ae83af6 100644
---- a/drivers/hid/usbhid/hid-core.c
-+++ b/drivers/hid/usbhid/hid-core.c
-@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count)
- return ret;
- }
-
--static void usbhid_restart_queues(struct usbhid_device *usbhid)
--{
-- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
-- usbhid_restart_out_queue(usbhid);
-- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
-- usbhid_restart_ctrl_queue(usbhid);
--}
--
- static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
- {
- struct usbhid_device *usbhid = hid->driver_data;
-@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_device *usbhid)
- usb_kill_urb(usbhid->urbout);
- }
-
-+static void hid_restart_io(struct hid_device *hid)
-+{
-+ struct usbhid_device *usbhid = hid->driver_data;
-+ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
-+ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
-+
-+ spin_lock_irq(&usbhid->lock);
-+ clear_bit(HID_SUSPENDED, &usbhid->iofl);
-+ usbhid_mark_busy(usbhid);
-+
-+ if (clear_halt || reset_pending)
-+ schedule_work(&usbhid->reset_work);
-+ usbhid->retry_delay = 0;
-+ spin_unlock_irq(&usbhid->lock);
-+
-+ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
-+ return;
-+
-+ if (!clear_halt) {
-+ if (hid_start_in(hid) < 0)
-+ hid_io_error(hid);
-+ }
-+
-+ spin_lock_irq(&usbhid->lock);
-+ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
-+ usbhid_restart_out_queue(usbhid);
-+ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
-+ usbhid_restart_ctrl_queue(usbhid);
-+ spin_unlock_irq(&usbhid->lock);
-+}
-+
- /* Treat USB reset pretty much the same as suspend/resume */
- static int hid_pre_reset(struct usb_interface *intf)
- {
-@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_interface *intf)
- return 1;
- }
-
-+ /* No need to do another reset or clear a halted endpoint */
- spin_lock_irq(&usbhid->lock);
- clear_bit(HID_RESET_PENDING, &usbhid->iofl);
-+ clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
- spin_unlock_irq(&usbhid->lock);
- hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
-- status = hid_start_in(hid);
-- if (status < 0)
-- hid_io_error(hid);
-- usbhid_restart_queues(usbhid);
-+
-+ hid_restart_io(hid);
-
- return 0;
- }
-@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device *hid)
- #ifdef CONFIG_PM
- static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
- {
-- struct usbhid_device *usbhid = hid->driver_data;
-- int status;
--
-- spin_lock_irq(&usbhid->lock);
-- clear_bit(HID_SUSPENDED, &usbhid->iofl);
-- usbhid_mark_busy(usbhid);
--
-- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
-- test_bit(HID_RESET_PENDING, &usbhid->iofl))
-- schedule_work(&usbhid->reset_work);
-- usbhid->retry_delay = 0;
--
-- usbhid_restart_queues(usbhid);
-- spin_unlock_irq(&usbhid->lock);
--
-- status = hid_start_in(hid);
-- if (status < 0)
-- hid_io_error(hid);
-+ int status = 0;
-
-+ hid_restart_io(hid);
- if (driver_suspended && hid->driver && hid->driver->resume)
- status = hid->driver->resume(hid);
- return status;
-@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
- static int hid_resume(struct usb_interface *intf)
- {
- struct hid_device *hid = usb_get_intfdata (intf);
-- struct usbhid_device *usbhid = hid->driver_data;
- int status;
-
-- if (!test_bit(HID_STARTED, &usbhid->iofl))
-- return 0;
--
- status = hid_resume_common(hid, true);
- dev_dbg(&intf->dev, "resume status %d\n", status);
- return 0;
-@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interface *intf)
- static int hid_reset_resume(struct usb_interface *intf)
- {
- struct hid_device *hid = usb_get_intfdata(intf);
-- struct usbhid_device *usbhid = hid->driver_data;
- int status;
-
-- clear_bit(HID_SUSPENDED, &usbhid->iofl);
- status = hid_post_reset(intf);
- if (status >= 0 && hid->driver && hid->driver->reset_resume) {
- int ret = hid->driver->reset_resume(hid);
-diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
-index 99ef77f..94a8875 100644
---- a/drivers/hid/wacom_wac.c
-+++ b/drivers/hid/wacom_wac.c
-@@ -2409,6 +2409,17 @@ void wacom_setup_device_quirks(struct wacom *wacom)
- }
-
- /*
-+ * Hack for the Bamboo One:
-+ * the device presents a PAD/Touch interface as most Bamboos and even
-+ * sends ghosts PAD data on it. However, later, we must disable this
-+ * ghost interface, and we can not detect it unless we set it here
-+ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH.
-+ */
-+ if (features->type == BAMBOO_PEN &&
-+ features->pktlen == WACOM_PKGLEN_BBTOUCH3)
-+ features->device_type |= WACOM_DEVICETYPE_PAD;
-+
-+ /*
- * Raw Wacom-mode pen and touch events both come from interface
- * 0, whose HID descriptor has an application usage of 0xFF0D
- * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
-diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
-index 36544c4..303d0c9 100644
---- a/drivers/hwmon/max1111.c
-+++ b/drivers/hwmon/max1111.c
-@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;
-
- int max1111_read_channel(int channel)
- {
-+ if (!the_max1111 || !the_max1111->spi)
-+ return -ENODEV;
-+
- return max1111_read(&the_max1111->spi->dev, channel);
- }
- EXPORT_SYMBOL(max1111_read_channel);
-@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi)
- {
- struct max1111_data *data = spi_get_drvdata(spi);
-
-+#ifdef CONFIG_SHARPSL_PM
-+ the_max1111 = NULL;
-+#endif
- hwmon_device_unregister(data->hwmon_dev);
- sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group);
- sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
-diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
-index c73331f7..2072a31 100644
---- a/drivers/iio/accel/bmc150-accel-core.c
-+++ b/drivers/iio/accel/bmc150-accel-core.c
-@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data,
- {
- int ret;
- int axis = chan->scan_index;
-- unsigned int raw_val;
-+ __le16 raw_val;
-
- mutex_lock(&data->mutex);
- ret = bmc150_accel_set_power_state(data, true);
-@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data,
- }
-
- ret = regmap_bulk_read(data->regmap, BMC150_ACCEL_AXIS_TO_REG(axis),
-- &raw_val, 2);
-+ &raw_val, sizeof(raw_val));
- if (ret < 0) {
- dev_err(data->dev, "Error reading axis %d\n", axis);
- bmc150_accel_set_power_state(data, false);
- mutex_unlock(&data->mutex);
- return ret;
- }
-- *val = sign_extend32(raw_val >> chan->scan_type.shift,
-+ *val = sign_extend32(le16_to_cpu(raw_val) >> chan->scan_type.shift,
- chan->scan_type.realbits - 1);
- ret = bmc150_accel_set_power_state(data, false);
- mutex_unlock(&data->mutex);
-@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc150_accel_event = {
- .realbits = (bits), \
- .storagebits = 16, \
- .shift = 16 - (bits), \
-+ .endianness = IIO_LE, \
- }, \
- .event_spec = &bmc150_accel_event, \
- .num_event_specs = 1 \
-diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
-index bbce3b0..4dac567 100644
---- a/drivers/iio/gyro/bmg160_core.c
-+++ b/drivers/iio/gyro/bmg160_core.c
-@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160_data *data, int *val)
- static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
- {
- int ret;
-- unsigned int raw_val;
-+ __le16 raw_val;
-
- mutex_lock(&data->mutex);
- ret = bmg160_set_power_state(data, true);
-@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
- }
-
- ret = regmap_bulk_read(data->regmap, BMG160_AXIS_TO_REG(axis), &raw_val,
-- 2);
-+ sizeof(raw_val));
- if (ret < 0) {
- dev_err(data->dev, "Error reading axis %d\n", axis);
- bmg160_set_power_state(data, false);
-@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
- return ret;
- }
-
-- *val = sign_extend32(raw_val, 15);
-+ *val = sign_extend32(le16_to_cpu(raw_val), 15);
- ret = bmg160_set_power_state(data, false);
- mutex_unlock(&data->mutex);
- if (ret < 0)
-@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg160_event = {
- .sign = 's', \
- .realbits = 16, \
- .storagebits = 16, \
-+ .endianness = IIO_LE, \
- }, \
- .event_spec = &bmg160_event, \
- .num_event_specs = 1 \
-@@ -780,7 +781,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p)
- mutex_unlock(&data->mutex);
- goto err;
- }
-- data->buffer[i++] = ret;
-+ data->buffer[i++] = val;
- }
- mutex_unlock(&data->mutex);
-
-diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
-index 139ae91..5b6abc5 100644
---- a/drivers/iio/industrialio-buffer.c
-+++ b/drivers/iio/industrialio-buffer.c
-@@ -645,6 +645,7 @@ static int iio_verify_update(struct iio_dev *indio_dev,
- unsigned int modes;
-
- memset(config, 0, sizeof(*config));
-+ config->watermark = ~0;
-
- /*
- * If there is just one buffer and we are removing it there is nothing
-diff --git a/drivers/iio/magnetometer/st_magn.h b/drivers/iio/magnetometer/st_magn.h
-index 06a4d9c..9daca46 100644
---- a/drivers/iio/magnetometer/st_magn.h
-+++ b/drivers/iio/magnetometer/st_magn.h
-@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(struct iio_dev *indio_dev)
- static inline void st_magn_deallocate_ring(struct iio_dev *indio_dev)
- {
- }
-+#define ST_MAGN_TRIGGER_SET_STATE NULL
- #endif /* CONFIG_IIO_BUFFER */
-
- #endif /* ST_MAGN_H */
-diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
-index 0e3b009..515bb8b 100644
---- a/drivers/iommu/iommu.c
-+++ b/drivers/iommu/iommu.c
-@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev)
- if (!group->default_domain) {
- group->default_domain = __iommu_domain_alloc(dev->bus,
- IOMMU_DOMAIN_DMA);
-- group->domain = group->default_domain;
-+ if (!group->domain)
-+ group->domain = group->default_domain;
- }
-
- ret = iommu_group_add_device(group, dev);
-diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
-index 2d782ce..7ae89c6 100644
---- a/drivers/media/platform/coda/coda-common.c
-+++ b/drivers/media/platform/coda/coda-common.c
-@@ -2118,14 +2118,12 @@ static int coda_probe(struct platform_device *pdev)
-
- pdev_id = of_id ? of_id->data : platform_get_device_id(pdev);
-
-- if (of_id) {
-+ if (of_id)
- dev->devtype = of_id->data;
-- } else if (pdev_id) {
-+ else if (pdev_id)
- dev->devtype = &coda_devdata[pdev_id->driver_data];
-- } else {
-- ret = -EINVAL;
-- goto err_v4l2_register;
-- }
-+ else
-+ return -EINVAL;
-
- spin_lock_init(&dev->irqlock);
- INIT_LIST_HEAD(&dev->instances);
-diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c
-index 6310aca..d41ae95 100644
---- a/drivers/media/platform/vsp1/vsp1_sru.c
-+++ b/drivers/media/platform/vsp1/vsp1_sru.c
-@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable)
- mutex_lock(sru->ctrls.lock);
- ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0)
- & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK);
-+ vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0);
- mutex_unlock(sru->ctrls.lock);
-
- vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5);
-diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
-index 9e29e70..d898880 100644
---- a/drivers/media/usb/au0828/au0828-core.c
-+++ b/drivers/media/usb/au0828/au0828-core.c
-@@ -192,7 +192,7 @@ static void au0828_usb_disconnect(struct usb_interface *interface)
- Set the status so poll routines can check and avoid
- access after disconnect.
- */
-- dev->dev_state = DEV_DISCONNECTED;
-+ set_bit(DEV_DISCONNECTED, &dev->dev_state);
-
- au0828_rc_unregister(dev);
- /* Digital TV */
-diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c
-index b0f0679..3d6687f 100644
---- a/drivers/media/usb/au0828/au0828-input.c
-+++ b/drivers/media/usb/au0828/au0828-input.c
-@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(struct au0828_rc *ir)
- bool first = true;
-
- /* do nothing if device is disconnected */
-- if (ir->dev->dev_state == DEV_DISCONNECTED)
-+ if (test_bit(DEV_DISCONNECTED, &ir->dev->dev_state))
- return 0;
-
- /* Check IR int */
-@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_dev *rc)
- cancel_delayed_work_sync(&ir->work);
-
- /* do nothing if device is disconnected */
-- if (ir->dev->dev_state != DEV_DISCONNECTED) {
-+ if (!test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) {
- /* Disable IR */
- au8522_rc_clear(ir, 0xe0, 1 << 4);
- }
-diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
-index a136257..8bc69af 100644
---- a/drivers/media/usb/au0828/au0828-video.c
-+++ b/drivers/media/usb/au0828/au0828-video.c
-@@ -104,14 +104,13 @@ static inline void print_err_status(struct au0828_dev *dev,
-
- static int check_dev(struct au0828_dev *dev)
- {
-- if (dev->dev_state & DEV_DISCONNECTED) {
-+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) {
- pr_info("v4l2 ioctl: device not present\n");
- return -ENODEV;
- }
-
-- if (dev->dev_state & DEV_MISCONFIGURED) {
-- pr_info("v4l2 ioctl: device is misconfigured; "
-- "close and open it again\n");
-+ if (test_bit(DEV_MISCONFIGURED, &dev->dev_state)) {
-+ pr_info("v4l2 ioctl: device is misconfigured; close and open it again\n");
- return -EIO;
- }
- return 0;
-@@ -519,8 +518,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb)
- if (!dev)
- return 0;
-
-- if ((dev->dev_state & DEV_DISCONNECTED) ||
-- (dev->dev_state & DEV_MISCONFIGURED))
-+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state) ||
-+ test_bit(DEV_MISCONFIGURED, &dev->dev_state))
- return 0;
-
- if (urb->status < 0) {
-@@ -822,10 +821,10 @@ static int au0828_stream_interrupt(struct au0828_dev *dev)
- int ret = 0;
-
- dev->stream_state = STREAM_INTERRUPT;
-- if (dev->dev_state == DEV_DISCONNECTED)
-+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state))
- return -ENODEV;
- else if (ret) {
-- dev->dev_state = DEV_MISCONFIGURED;
-+ set_bit(DEV_MISCONFIGURED, &dev->dev_state);
- dprintk(1, "%s device is misconfigured!\n", __func__);
- return ret;
- }
-@@ -1014,7 +1013,7 @@ static int au0828_v4l2_open(struct file *filp)
- int ret;
-
- dprintk(1,
-- "%s called std_set %d dev_state %d stream users %d users %d\n",
-+ "%s called std_set %d dev_state %ld stream users %d users %d\n",
- __func__, dev->std_set_in_tuner_core, dev->dev_state,
- dev->streaming_users, dev->users);
-
-@@ -1033,7 +1032,7 @@ static int au0828_v4l2_open(struct file *filp)
- au0828_analog_stream_enable(dev);
- au0828_analog_stream_reset(dev);
- dev->stream_state = STREAM_OFF;
-- dev->dev_state |= DEV_INITIALIZED;
-+ set_bit(DEV_INITIALIZED, &dev->dev_state);
- }
- dev->users++;
- mutex_unlock(&dev->lock);
-@@ -1047,7 +1046,7 @@ static int au0828_v4l2_close(struct file *filp)
- struct video_device *vdev = video_devdata(filp);
-
- dprintk(1,
-- "%s called std_set %d dev_state %d stream users %d users %d\n",
-+ "%s called std_set %d dev_state %ld stream users %d users %d\n",
- __func__, dev->std_set_in_tuner_core, dev->dev_state,
- dev->streaming_users, dev->users);
-
-@@ -1063,7 +1062,7 @@ static int au0828_v4l2_close(struct file *filp)
- del_timer_sync(&dev->vbi_timeout);
- }
-
-- if (dev->dev_state == DEV_DISCONNECTED)
-+ if (test_bit(DEV_DISCONNECTED, &dev->dev_state))
- goto end;
-
- if (dev->users == 1) {
-@@ -1092,7 +1091,7 @@ static void au0828_init_tuner(struct au0828_dev *dev)
- .type = V4L2_TUNER_ANALOG_TV,
- };
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- if (dev->std_set_in_tuner_core)
-@@ -1164,7 +1163,7 @@ static int vidioc_querycap(struct file *file, void *priv,
- struct video_device *vdev = video_devdata(file);
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- strlcpy(cap->driver, "au0828", sizeof(cap->driver));
-@@ -1207,7 +1206,7 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- f->fmt.pix.width = dev->width;
-@@ -1226,7 +1225,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- return au0828_set_format(dev, VIDIOC_TRY_FMT, f);
-@@ -1238,7 +1237,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
- struct au0828_dev *dev = video_drvdata(file);
- int rc;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- rc = check_dev(dev);
-@@ -1260,7 +1259,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id norm)
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- if (norm == dev->std)
-@@ -1292,7 +1291,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *norm)
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- *norm = dev->std;
-@@ -1315,7 +1314,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
- [AU0828_VMUX_DEBUG] = "tv debug"
- };
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- tmp = input->index;
-@@ -1345,7 +1344,7 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i)
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- *i = dev->ctrl_input;
-@@ -1356,7 +1355,7 @@ static void au0828_s_input(struct au0828_dev *dev, int index)
- {
- int i;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- switch (AUVI_INPUT(index).type) {
-@@ -1441,7 +1440,7 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- a->index = dev->ctrl_ainput;
-@@ -1461,7 +1460,7 @@ static int vidioc_s_audio(struct file *file, void *priv, const struct v4l2_audio
- if (a->index != dev->ctrl_ainput)
- return -EINVAL;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
- return 0;
- }
-@@ -1473,7 +1472,7 @@ static int vidioc_g_tuner(struct file *file, void *priv, struct v4l2_tuner *t)
- if (t->index != 0)
- return -EINVAL;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- strcpy(t->name, "Auvitek tuner");
-@@ -1493,7 +1492,7 @@ static int vidioc_s_tuner(struct file *file, void *priv,
- if (t->index != 0)
- return -EINVAL;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- au0828_init_tuner(dev);
-@@ -1515,7 +1514,7 @@ static int vidioc_g_frequency(struct file *file, void *priv,
-
- if (freq->tuner != 0)
- return -EINVAL;
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
- freq->frequency = dev->ctrl_freq;
- return 0;
-@@ -1530,7 +1529,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
- if (freq->tuner != 0)
- return -EINVAL;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- au0828_init_tuner(dev);
-@@ -1556,7 +1555,7 @@ static int vidioc_g_fmt_vbi_cap(struct file *file, void *priv,
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- format->fmt.vbi.samples_per_line = dev->vbi_width;
-@@ -1582,7 +1581,7 @@ static int vidioc_cropcap(struct file *file, void *priv,
- if (cc->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
- return -EINVAL;
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- cc->bounds.left = 0;
-@@ -1604,7 +1603,7 @@ static int vidioc_g_register(struct file *file, void *priv,
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- reg->val = au0828_read(dev, reg->reg);
-@@ -1617,7 +1616,7 @@ static int vidioc_s_register(struct file *file, void *priv,
- {
- struct au0828_dev *dev = video_drvdata(file);
-
-- dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
-+ dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
- dev->std_set_in_tuner_core, dev->dev_state);
-
- return au0828_writereg(dev, reg->reg, reg->val);
-diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h
-index 8276072..b28a05d 100644
---- a/drivers/media/usb/au0828/au0828.h
-+++ b/drivers/media/usb/au0828/au0828.h
-@@ -21,6 +21,7 @@
-
- #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-+#include <linux/bitops.h>
- #include <linux/usb.h>
- #include <linux/i2c.h>
- #include <linux/i2c-algo-bit.h>
-@@ -122,9 +123,9 @@ enum au0828_stream_state {
-
- /* device state */
- enum au0828_dev_state {
-- DEV_INITIALIZED = 0x01,
-- DEV_DISCONNECTED = 0x02,
-- DEV_MISCONFIGURED = 0x04
-+ DEV_INITIALIZED = 0,
-+ DEV_DISCONNECTED = 1,
-+ DEV_MISCONFIGURED = 2
- };
-
- struct au0828_dev;
-@@ -248,7 +249,7 @@ struct au0828_dev {
- int input_type;
- int std_set_in_tuner_core;
- unsigned int ctrl_input;
-- enum au0828_dev_state dev_state;
-+ long unsigned int dev_state; /* defined at enum au0828_dev_state */;
- enum au0828_stream_state stream_state;
- wait_queue_head_t open;
-
-diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
-index df3b8ec..a04d0f7 100644
---- a/drivers/mmc/host/sdhci-pci-core.c
-+++ b/drivers/mmc/host/sdhci-pci-core.c
-@@ -390,6 +390,7 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
- slot->cd_idx = 0;
- slot->cd_override_level = true;
- if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
-+ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXTM_SD ||
- slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
- slot->host->mmc_host_ops.get_cd = bxt_get_cd;
-
-@@ -1173,6 +1174,30 @@ static const struct pci_device_id pci_ids[] = {
-
- {
- .vendor = PCI_VENDOR_ID_INTEL,
-+ .device = PCI_DEVICE_ID_INTEL_BXTM_EMMC,
-+ .subvendor = PCI_ANY_ID,
-+ .subdevice = PCI_ANY_ID,
-+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_emmc,
-+ },
-+
-+ {
-+ .vendor = PCI_VENDOR_ID_INTEL,
-+ .device = PCI_DEVICE_ID_INTEL_BXTM_SDIO,
-+ .subvendor = PCI_ANY_ID,
-+ .subdevice = PCI_ANY_ID,
-+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sdio,
-+ },
-+
-+ {
-+ .vendor = PCI_VENDOR_ID_INTEL,
-+ .device = PCI_DEVICE_ID_INTEL_BXTM_SD,
-+ .subvendor = PCI_ANY_ID,
-+ .subdevice = PCI_ANY_ID,
-+ .driver_data = (kernel_ulong_t)&sdhci_intel_byt_sd,
-+ },
-+
-+ {
-+ .vendor = PCI_VENDOR_ID_INTEL,
- .device = PCI_DEVICE_ID_INTEL_APL_EMMC,
- .subvendor = PCI_ANY_ID,
- .subdevice = PCI_ANY_ID,
-diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
-index d1a0b4d..89e7151 100644
---- a/drivers/mmc/host/sdhci-pci.h
-+++ b/drivers/mmc/host/sdhci-pci.h
-@@ -28,6 +28,9 @@
- #define PCI_DEVICE_ID_INTEL_BXT_SD 0x0aca
- #define PCI_DEVICE_ID_INTEL_BXT_EMMC 0x0acc
- #define PCI_DEVICE_ID_INTEL_BXT_SDIO 0x0ad0
-+#define PCI_DEVICE_ID_INTEL_BXTM_SD 0x1aca
-+#define PCI_DEVICE_ID_INTEL_BXTM_EMMC 0x1acc
-+#define PCI_DEVICE_ID_INTEL_BXTM_SDIO 0x1ad0
- #define PCI_DEVICE_ID_INTEL_APL_SD 0x5aca
- #define PCI_DEVICE_ID_INTEL_APL_EMMC 0x5acc
- #define PCI_DEVICE_ID_INTEL_APL_SDIO 0x5ad0
-diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
-index c7f27fe..452bf500 100644
---- a/drivers/mmc/host/sdhci-pxav3.c
-+++ b/drivers/mmc/host/sdhci-pxav3.c
-@@ -309,8 +309,30 @@ static void pxav3_set_uhs_signaling(struct sdhci_host *host, unsigned int uhs)
- __func__, uhs, ctrl_2);
- }
-
-+static void pxav3_set_power(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd)
-+{
-+ struct mmc_host *mmc = host->mmc;
-+ u8 pwr = host->pwr;
-+
-+ sdhci_set_power(host, mode, vdd);
-+
-+ if (host->pwr == pwr)
-+ return;
-+
-+ if (host->pwr == 0)
-+ vdd = 0;
-+
-+ if (!IS_ERR(mmc->supply.vmmc)) {
-+ spin_unlock_irq(&host->lock);
-+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
-+ spin_lock_irq(&host->lock);
-+ }
-+}
-+
- static const struct sdhci_ops pxav3_sdhci_ops = {
- .set_clock = sdhci_set_clock,
-+ .set_power = pxav3_set_power,
- .platform_send_init_74_clocks = pxav3_gen_init_74_clocks,
- .get_max_clock = sdhci_pltfm_clk_get_max_clock,
- .set_bus_width = sdhci_set_bus_width,
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index 8059d72..6d485b5 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -1250,10 +1250,24 @@ clock_set:
- }
- EXPORT_SYMBOL_GPL(sdhci_set_clock);
-
--static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-- unsigned short vdd)
-+static void sdhci_set_power_reg(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd)
- {
- struct mmc_host *mmc = host->mmc;
-+
-+ spin_unlock_irq(&host->lock);
-+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
-+ spin_lock_irq(&host->lock);
-+
-+ if (mode != MMC_POWER_OFF)
-+ sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
-+ else
-+ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
-+}
-+
-+void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd)
-+{
- u8 pwr = 0;
-
- if (mode != MMC_POWER_OFF) {
-@@ -1285,7 +1299,6 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
- sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
- if (host->quirks2 & SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON)
- sdhci_runtime_pm_bus_off(host);
-- vdd = 0;
- } else {
- /*
- * Spec says that we should clear the power reg before setting
-@@ -1316,12 +1329,20 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
- if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER)
- mdelay(10);
- }
-+}
-+EXPORT_SYMBOL_GPL(sdhci_set_power);
-
-- if (!IS_ERR(mmc->supply.vmmc)) {
-- spin_unlock_irq(&host->lock);
-- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
-- spin_lock_irq(&host->lock);
-- }
-+static void __sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd)
-+{
-+ struct mmc_host *mmc = host->mmc;
-+
-+ if (host->ops->set_power)
-+ host->ops->set_power(host, mode, vdd);
-+ else if (!IS_ERR(mmc->supply.vmmc))
-+ sdhci_set_power_reg(host, mode, vdd);
-+ else
-+ sdhci_set_power(host, mode, vdd);
- }
-
- /*****************************************************************************\
-@@ -1471,7 +1492,7 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios)
- }
- }
-
-- sdhci_set_power(host, ios->power_mode, ios->vdd);
-+ __sdhci_set_power(host, ios->power_mode, ios->vdd);
-
- if (host->ops->platform_send_init_74_clocks)
- host->ops->platform_send_init_74_clocks(host, ios->power_mode);
-diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
-index 0115e99..033d72b 100644
---- a/drivers/mmc/host/sdhci.h
-+++ b/drivers/mmc/host/sdhci.h
-@@ -529,6 +529,8 @@ struct sdhci_ops {
- #endif
-
- void (*set_clock)(struct sdhci_host *host, unsigned int clock);
-+ void (*set_power)(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd);
-
- int (*enable_dma)(struct sdhci_host *host);
- unsigned int (*get_max_clock)(struct sdhci_host *host);
-@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enabled(struct sdhci_host *host)
- }
-
- void sdhci_set_clock(struct sdhci_host *host, unsigned int clock);
-+void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-+ unsigned short vdd);
- void sdhci_set_bus_width(struct sdhci_host *host, int width);
- void sdhci_reset(struct sdhci_host *host, u8 mask);
- void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing);
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index b7f1a99..5ec8195 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -3308,6 +3308,30 @@ static int bond_close(struct net_device *bond_dev)
- return 0;
- }
-
-+/* fold stats, assuming all rtnl_link_stats64 fields are u64, but
-+ * that some drivers can provide 32bit values only.
-+ */
-+static void bond_fold_stats(struct rtnl_link_stats64 *_res,
-+ const struct rtnl_link_stats64 *_new,
-+ const struct rtnl_link_stats64 *_old)
-+{
-+ const u64 *new = (const u64 *)_new;
-+ const u64 *old = (const u64 *)_old;
-+ u64 *res = (u64 *)_res;
-+ int i;
-+
-+ for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) {
-+ u64 nv = new[i];
-+ u64 ov = old[i];
-+
-+ /* detects if this particular field is 32bit only */
-+ if (((nv | ov) >> 32) == 0)
-+ res[i] += (u32)nv - (u32)ov;
-+ else
-+ res[i] += nv - ov;
-+ }
-+}
-+
- static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
- struct rtnl_link_stats64 *stats)
- {
-@@ -3316,43 +3340,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
- struct list_head *iter;
- struct slave *slave;
-
-+ spin_lock(&bond->stats_lock);
- memcpy(stats, &bond->bond_stats, sizeof(*stats));
-
-- bond_for_each_slave(bond, slave, iter) {
-- const struct rtnl_link_stats64 *sstats =
-+ rcu_read_lock();
-+ bond_for_each_slave_rcu(bond, slave, iter) {
-+ const struct rtnl_link_stats64 *new =
- dev_get_stats(slave->dev, &temp);
-- struct rtnl_link_stats64 *pstats = &slave->slave_stats;
--
-- stats->rx_packets += sstats->rx_packets - pstats->rx_packets;
-- stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes;
-- stats->rx_errors += sstats->rx_errors - pstats->rx_errors;
-- stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped;
--
-- stats->tx_packets += sstats->tx_packets - pstats->tx_packets;;
-- stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes;
-- stats->tx_errors += sstats->tx_errors - pstats->tx_errors;
-- stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped;
--
-- stats->multicast += sstats->multicast - pstats->multicast;
-- stats->collisions += sstats->collisions - pstats->collisions;
--
-- stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors;
-- stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors;
-- stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors;
-- stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors;
-- stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors;
-- stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors;
--
-- stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors;
-- stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors;
-- stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors;
-- stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors;
-- stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors;
-+
-+ bond_fold_stats(stats, new, &slave->slave_stats);
-
- /* save off the slave stats for the next run */
-- memcpy(pstats, sstats, sizeof(*sstats));
-+ memcpy(&slave->slave_stats, new, sizeof(*new));
- }
-+ rcu_read_unlock();
-+
- memcpy(&bond->bond_stats, stats, sizeof(*stats));
-+ spin_unlock(&bond->stats_lock);
-
- return stats;
- }
-@@ -4166,6 +4170,7 @@ void bond_setup(struct net_device *bond_dev)
- struct bonding *bond = netdev_priv(bond_dev);
-
- spin_lock_init(&bond->mode_lock);
-+ spin_lock_init(&bond->stats_lock);
- bond->params = bonding_defaults;
-
- /* Initialize pointers */
-diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-index d7e01a7..6746fd0 100644
---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
- dev->stats.tx_bytes += tx_cb_ptr->skb->len;
- dma_unmap_single(&dev->dev,
- dma_unmap_addr(tx_cb_ptr, dma_addr),
-- tx_cb_ptr->skb->len,
-+ dma_unmap_len(tx_cb_ptr, dma_len),
- DMA_TO_DEVICE);
- bcmgenet_free_cb(tx_cb_ptr);
- } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
-@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct net_device *dev,
- }
-
- dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
-- dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len);
-+ dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len);
- length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags |
- (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) |
- DMA_TX_APPEND_CRC;
-diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
-index acb1c5b..2ee05ce 100644
---- a/drivers/net/ethernet/marvell/mvneta.c
-+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -3070,17 +3070,17 @@ static int mvneta_stop(struct net_device *dev)
- struct mvneta_port *pp = netdev_priv(dev);
-
- /* Inform that we are stopping so we don't want to setup the
-- * driver for new CPUs in the notifiers
-+ * driver for new CPUs in the notifiers. The code of the
-+ * notifier for CPU online is protected by the same spinlock,
-+ * so when we get the lock, the notifer work is done.
- */
- spin_lock(&pp->lock);
- pp->is_stopped = true;
-+ spin_unlock(&pp->lock);
-+
- mvneta_stop_dev(pp);
- mvneta_mdio_remove(pp);
- unregister_cpu_notifier(&pp->cpu_notifier);
-- /* Now that the notifier are unregistered, we can release le
-- * lock
-- */
-- spin_unlock(&pp->lock);
- on_each_cpu(mvneta_percpu_disable, pp, true);
- free_percpu_irq(dev->irq, pp->ports);
- mvneta_cleanup_rxqs(pp);
-@@ -3612,6 +3612,7 @@ static int mvneta_probe(struct platform_device *pdev)
- dev->ethtool_ops = &mvneta_eth_tool_ops;
-
- pp = netdev_priv(dev);
-+ spin_lock_init(&pp->lock);
- pp->phy_node = phy_node;
- pp->phy_interface = phy_mode;
-
-diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-index 25ce1b0..cd9b2b2 100644
---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-@@ -3141,7 +3141,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
- case QP_TRANS_RTS2RTS:
- case QP_TRANS_SQD2SQD:
- case QP_TRANS_SQD2RTS:
-- if (slave != mlx4_master_func_num(dev))
-+ if (slave != mlx4_master_func_num(dev)) {
- if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) {
- port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1;
- if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB)
-@@ -3160,6 +3160,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
- if (qp_ctx->alt_path.mgid_index >= num_gids)
- return -EINVAL;
- }
-+ }
- break;
- default:
- break;
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
-index 3b89ed2..65a115f 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
-+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
-@@ -118,6 +118,8 @@ struct mlxsw_sp {
- #define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100
- unsigned int interval; /* ms */
- } fdb_notify;
-+#define MLXSW_SP_MIN_AGEING_TIME 10
-+#define MLXSW_SP_MAX_AGEING_TIME 1000000
- #define MLXSW_SP_DEFAULT_AGEING_TIME 300
- u32 ageing_time;
- struct mlxsw_sp_upper master_bridge;
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
-index 7b56098..e1c74ef 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
-+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
-@@ -311,8 +311,13 @@ static int mlxsw_sp_port_attr_br_ageing_set(struct mlxsw_sp_port *mlxsw_sp_port,
- unsigned long ageing_jiffies = clock_t_to_jiffies(ageing_clock_t);
- u32 ageing_time = jiffies_to_msecs(ageing_jiffies) / 1000;
-
-- if (switchdev_trans_ph_prepare(trans))
-- return 0;
-+ if (switchdev_trans_ph_prepare(trans)) {
-+ if (ageing_time < MLXSW_SP_MIN_AGEING_TIME ||
-+ ageing_time > MLXSW_SP_MAX_AGEING_TIME)
-+ return -ERANGE;
-+ else
-+ return 0;
-+ }
-
- return mlxsw_sp_ageing_set(mlxsw_sp, ageing_time);
- }
-diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
-index 46bbea8..55007f1 100644
---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
-+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
-@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats {
- u64 tx_dma_map_error;
- u64 spurious_intr;
- u64 mac_filter_limit_overrun;
-+ u64 mbx_spurious_intr;
- };
-
- /*
-@@ -1099,7 +1100,7 @@ struct qlcnic_mailbox {
- unsigned long status;
- spinlock_t queue_lock; /* Mailbox queue lock */
- spinlock_t aen_lock; /* Mailbox response/AEN lock */
-- atomic_t rsp_status;
-+ u32 rsp_status;
- u32 num_cmds;
- };
-
-diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
-index 37a731b..f9640d5ce 100644
---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
-+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
-@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter)
-
- static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx)
- {
-- atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED);
-+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
- complete(&mbx->completion);
- }
-
-@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter)
- if (event & QLCNIC_MBX_ASYNC_EVENT) {
- __qlcnic_83xx_process_aen(adapter);
- } else {
-- if (atomic_read(&mbx->rsp_status) != rsp_status)
-+ if (mbx->rsp_status != rsp_status)
- qlcnic_83xx_notify_mbx_response(mbx);
- }
- out:
-@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter)
- if (event & QLCNIC_MBX_ASYNC_EVENT) {
- __qlcnic_83xx_process_aen(adapter);
- } else {
-- if (atomic_read(&mbx->rsp_status) != rsp_status)
-+ if (mbx->rsp_status != rsp_status)
- qlcnic_83xx_notify_mbx_response(mbx);
- }
- }
-@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
-
- static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
- {
-+ u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
- struct qlcnic_adapter *adapter = data;
- struct qlcnic_mailbox *mbx;
-- u32 mask, resp, event;
- unsigned long flags;
-
- mbx = adapter->ahw->mailbox;
-@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
- goto out;
-
- event = readl(QLCNIC_MBX_FW(adapter->ahw, 0));
-- if (event & QLCNIC_MBX_ASYNC_EVENT)
-+ if (event & QLCNIC_MBX_ASYNC_EVENT) {
- __qlcnic_83xx_process_aen(adapter);
-- else
-- qlcnic_83xx_notify_mbx_response(mbx);
-+ } else {
-+ if (mbx->rsp_status != rsp_status)
-+ qlcnic_83xx_notify_mbx_response(mbx);
-+ else
-+ adapter->stats.mbx_spurious_intr++;
-+ }
-
- out:
- mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK);
-@@ -4050,10 +4054,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
- struct qlcnic_adapter *adapter = mbx->adapter;
- const struct qlcnic_mbx_ops *mbx_ops = mbx->ops;
- struct device *dev = &adapter->pdev->dev;
-- atomic_t *rsp_status = &mbx->rsp_status;
- struct list_head *head = &mbx->cmd_q;
- struct qlcnic_hardware_context *ahw;
- struct qlcnic_cmd_args *cmd = NULL;
-+ unsigned long flags;
-
- ahw = adapter->ahw;
-
-@@ -4063,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
- return;
- }
-
-- atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT);
-+ spin_lock_irqsave(&mbx->aen_lock, flags);
-+ mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT;
-+ spin_unlock_irqrestore(&mbx->aen_lock, flags);
-
- spin_lock(&mbx->queue_lock);
-
-diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
-index 494e810..0a2318c 100644
---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
-+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
-@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
- QLC_OFF(stats.mac_filter_limit_overrun)},
- {"spurious intr", QLC_SIZEOF(stats.spurious_intr),
- QLC_OFF(stats.spurious_intr)},
--
-+ {"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr),
-+ QLC_OFF(stats.mbx_spurious_intr)},
- };
-
- static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
-diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
-index 9979764..b28e73e 100644
---- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
-+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
-@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev,
- return;
- }
- skb_reserve(new_skb, NET_IP_ALIGN);
-+
-+ pci_dma_sync_single_for_cpu(qdev->pdev,
-+ dma_unmap_addr(sbq_desc, mapaddr),
-+ dma_unmap_len(sbq_desc, maplen),
-+ PCI_DMA_FROMDEVICE);
-+
- memcpy(skb_put(new_skb, length), skb->data, length);
-+
-+ pci_dma_sync_single_for_device(qdev->pdev,
-+ dma_unmap_addr(sbq_desc, mapaddr),
-+ dma_unmap_len(sbq_desc, maplen),
-+ PCI_DMA_FROMDEVICE);
- skb = new_skb;
-
- /* Frame error, so drop the packet. */
-diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
-index 7384499..01f6d5b 100644
---- a/drivers/net/ethernet/renesas/sh_eth.c
-+++ b/drivers/net/ethernet/renesas/sh_eth.c
-@@ -1136,11 +1136,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
- break;
- sh_eth_set_receive_align(skb);
-
-- /* RX descriptor */
-- rxdesc = &mdp->rx_ring[i];
- /* The size of the buffer is a multiple of 32 bytes. */
- buf_len = ALIGN(mdp->rx_buf_sz, 32);
-- rxdesc->len = cpu_to_le32(buf_len << 16);
- dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
- DMA_FROM_DEVICE);
- if (dma_mapping_error(&ndev->dev, dma_addr)) {
-@@ -1148,6 +1145,10 @@ static void sh_eth_ring_format(struct net_device *ndev)
- break;
- }
- mdp->rx_skbuff[i] = skb;
-+
-+ /* RX descriptor */
-+ rxdesc = &mdp->rx_ring[i];
-+ rxdesc->len = cpu_to_le32(buf_len << 16);
- rxdesc->addr = cpu_to_le32(dma_addr);
- rxdesc->status = cpu_to_le32(RD_RACT | RD_RFP);
-
-@@ -1163,7 +1164,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
- mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);
-
- /* Mark the last entry as wrapping the ring. */
-- rxdesc->status |= cpu_to_le32(RD_RDLE);
-+ if (rxdesc)
-+ rxdesc->status |= cpu_to_le32(RD_RDLE);
-
- memset(mdp->tx_ring, 0, tx_ringsize);
-
-diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
-index 166a7fc..f39e719 100644
---- a/drivers/net/ethernet/rocker/rocker.c
-+++ b/drivers/net/ethernet/rocker/rocker.c
-@@ -239,6 +239,7 @@ struct rocker {
- struct {
- u64 id;
- } hw;
-+ unsigned long ageing_time;
- spinlock_t cmd_ring_lock; /* for cmd ring accesses */
- struct rocker_dma_ring_info cmd_ring;
- struct rocker_dma_ring_info event_ring;
-@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned long data)
- struct rocker_port *rocker_port;
- struct rocker_fdb_tbl_entry *entry;
- struct hlist_node *tmp;
-- unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME;
-+ unsigned long next_timer = jiffies + rocker->ageing_time;
- unsigned long expires;
- unsigned long lock_flags;
- int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE |
-@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_time(struct rocker_port *rocker_port,
- struct switchdev_trans *trans,
- u32 ageing_time)
- {
-+ struct rocker *rocker = rocker_port->rocker;
-+
- if (!switchdev_trans_ph_prepare(trans)) {
- rocker_port->ageing_time = clock_t_to_jiffies(ageing_time);
-+ if (rocker_port->ageing_time < rocker->ageing_time)
-+ rocker->ageing_time = rocker_port->ageing_time;
- mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies);
- }
-
-@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- goto err_init_tbls;
- }
-
-+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
- setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup,
- (unsigned long) rocker);
- mod_timer(&rocker->fdb_cleanup_timer, jiffies);
-
-+ rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
-+
- err = rocker_probe_ports(rocker);
- if (err) {
- dev_err(&pdev->dev, "failed to probe ports\n");
-diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index d636d05..95394ed 100644
---- a/drivers/net/macvtap.c
-+++ b/drivers/net/macvtap.c
-@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
- macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN;
- if (copylen > good_linear)
- copylen = good_linear;
-+ else if (copylen < ETH_HLEN)
-+ copylen = ETH_HLEN;
- linear = copylen;
- i = *from;
- iov_iter_advance(&i, copylen);
-@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
-
- if (!zerocopy) {
- copylen = len;
-- if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear)
-+ linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
-+ if (linear > good_linear)
- linear = good_linear;
-- else
-- linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
-+ else if (linear < ETH_HLEN)
-+ linear = ETH_HLEN;
- }
-
- skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
-diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
-index d61da9ec..aafe237 100644
---- a/drivers/net/ppp/ppp_generic.c
-+++ b/drivers/net/ppp/ppp_generic.c
-@@ -575,7 +575,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
-
- static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- {
-- struct ppp_file *pf = file->private_data;
-+ struct ppp_file *pf;
- struct ppp *ppp;
- int err = -EFAULT, val, val2, i;
- struct ppp_idle idle;
-@@ -585,9 +585,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- void __user *argp = (void __user *)arg;
- int __user *p = argp;
-
-- if (!pf)
-- return ppp_unattached_ioctl(current->nsproxy->net_ns,
-- pf, file, cmd, arg);
-+ mutex_lock(&ppp_mutex);
-+
-+ pf = file->private_data;
-+ if (!pf) {
-+ err = ppp_unattached_ioctl(current->nsproxy->net_ns,
-+ pf, file, cmd, arg);
-+ goto out;
-+ }
-
- if (cmd == PPPIOCDETACH) {
- /*
-@@ -602,7 +607,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- * this fd and reopening /dev/ppp.
- */
- err = -EINVAL;
-- mutex_lock(&ppp_mutex);
- if (pf->kind == INTERFACE) {
- ppp = PF_TO_PPP(pf);
- rtnl_lock();
-@@ -616,15 +620,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- } else
- pr_warn("PPPIOCDETACH file->f_count=%ld\n",
- atomic_long_read(&file->f_count));
-- mutex_unlock(&ppp_mutex);
-- return err;
-+ goto out;
- }
-
- if (pf->kind == CHANNEL) {
- struct channel *pch;
- struct ppp_channel *chan;
-
-- mutex_lock(&ppp_mutex);
- pch = PF_TO_CHANNEL(pf);
-
- switch (cmd) {
-@@ -646,17 +648,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- err = chan->ops->ioctl(chan, cmd, arg);
- up_read(&pch->chan_sem);
- }
-- mutex_unlock(&ppp_mutex);
-- return err;
-+ goto out;
- }
-
- if (pf->kind != INTERFACE) {
- /* can't happen */
- pr_err("PPP: not interface or channel??\n");
-- return -EINVAL;
-+ err = -EINVAL;
-+ goto out;
- }
-
-- mutex_lock(&ppp_mutex);
- ppp = PF_TO_PPP(pf);
- switch (cmd) {
- case PPPIOCSMRU:
-@@ -831,7 +832,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- default:
- err = -ENOTTY;
- }
-+
-+out:
- mutex_unlock(&ppp_mutex);
-+
- return err;
- }
-
-@@ -844,7 +848,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
- struct ppp_net *pn;
- int __user *p = (int __user *)arg;
-
-- mutex_lock(&ppp_mutex);
- switch (cmd) {
- case PPPIOCNEWUNIT:
- /* Create a new ppp unit */
-@@ -894,7 +897,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
- default:
- err = -ENOTTY;
- }
-- mutex_unlock(&ppp_mutex);
-+
- return err;
- }
-
-@@ -2304,7 +2307,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
-
- pch->ppp = NULL;
- pch->chan = chan;
-- pch->chan_net = net;
-+ pch->chan_net = get_net(net);
- chan->ppp = pch;
- init_ppp_file(&pch->file, CHANNEL);
- pch->file.hdrlen = chan->hdrlen;
-@@ -2401,6 +2404,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
- spin_lock_bh(&pn->all_channels_lock);
- list_del(&pch->list);
- spin_unlock_bh(&pn->all_channels_lock);
-+ put_net(pch->chan_net);
-+ pch->chan_net = NULL;
-
- pch->file.dead = 1;
- wake_up_interruptible(&pch->file.rwait);
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 88bb8cc..81ecc2e 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte
-
- /* Re-attach the filter to persist device */
- if (!skip_filter && (tun->filter_attached == true)) {
-- err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
-+ err = __sk_attach_filter(&tun->fprog, tfile->socket.sk,
-+ lockdep_rtnl_is_held());
- if (!err)
- goto out;
- }
-@@ -1000,7 +1001,6 @@ static void tun_net_init(struct net_device *dev)
- /* Zero header length */
- dev->type = ARPHRD_NONE;
- dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
-- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */
- break;
-
- case IFF_TAP:
-@@ -1012,7 +1012,6 @@ static void tun_net_init(struct net_device *dev)
-
- eth_hw_addr_random(dev);
-
-- dev->tx_queue_len = TUN_READQ_SIZE; /* We prefer our own queue length */
- break;
- }
- }
-@@ -1466,6 +1465,8 @@ static void tun_setup(struct net_device *dev)
-
- dev->ethtool_ops = &tun_ethtool_ops;
- dev->destructor = tun_free_netdev;
-+ /* We prefer our own queue length */
-+ dev->tx_queue_len = TUN_READQ_SIZE;
- }
-
- /* Trivial set of netlink ops to allow deleting tun or tap
-@@ -1807,7 +1808,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n)
-
- for (i = 0; i < n; i++) {
- tfile = rtnl_dereference(tun->tfiles[i]);
-- sk_detach_filter(tfile->socket.sk);
-+ __sk_detach_filter(tfile->socket.sk, lockdep_rtnl_is_held());
- }
-
- tun->filter_attached = false;
-@@ -1820,7 +1821,8 @@ static int tun_attach_filter(struct tun_struct *tun)
-
- for (i = 0; i < tun->numqueues; i++) {
- tfile = rtnl_dereference(tun->tfiles[i]);
-- ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
-+ ret = __sk_attach_filter(&tun->fprog, tfile->socket.sk,
-+ lockdep_rtnl_is_held());
- if (ret) {
- tun_detach_filter(tun, i);
- return ret;
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index a3a4ccf..1232a8c6 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -844,6 +844,7 @@ static const struct usb_device_id products[] = {
- {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */
- {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */
- {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
-+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
- {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
- {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
- {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
-diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
-index 44541dbc..69b994f 100644
---- a/drivers/net/wan/farsync.c
-+++ b/drivers/net/wan/farsync.c
-@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
- dev->mem_start = card->phys_mem
- + BUF_OFFSET ( txBuffer[i][0][0]);
- dev->mem_end = card->phys_mem
-- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]);
-+ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]);
- dev->base_addr = card->pci_conf;
- dev->irq = card->irq;
-
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
-index 73fb423..a794157 100644
---- a/drivers/net/wireless/ath/ath9k/eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
-@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
-
- if (match) {
- if (AR_SREV_9287(ah)) {
-- /* FIXME: array overrun? */
- for (i = 0; i < numXpdGains; i++) {
- minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
-- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
-+ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
- ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- data_9287[idxL].pwrPdg[i],
- data_9287[idxL].vpdPdg[i],
-@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
- } else if (eeprom_4k) {
- for (i = 0; i < numXpdGains; i++) {
- minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
-- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
-+ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
- ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- data_4k[idxL].pwrPdg[i],
- data_4k[idxL].vpdPdg[i],
-@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
- } else {
- for (i = 0; i < numXpdGains; i++) {
- minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
-- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
-+ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
- ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- data_def[idxL].pwrPdg[i],
- data_def[idxL].vpdPdg[i],
-diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
-index 576eb70..cdbab06 100644
---- a/drivers/nvdimm/bus.c
-+++ b/drivers/nvdimm/bus.c
-@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd_dimm_descs[] = {
- [ND_CMD_IMPLEMENTED] = { },
- [ND_CMD_SMART] = {
- .out_num = 2,
-- .out_sizes = { 4, 8, },
-+ .out_sizes = { 4, 128, },
- },
- [ND_CMD_SMART_THRESHOLD] = {
- .out_num = 2,
-diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
-index ae81a2f..f0b56b3 100644
---- a/drivers/nvdimm/pfn_devs.c
-+++ b/drivers/nvdimm/pfn_devs.c
-@@ -315,7 +315,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn)
- } else {
- /* from init we validate */
- if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
-- return -EINVAL;
-+ return -ENODEV;
- }
-
- if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) {
-diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
-index 4c2fa05..944674e 100644
---- a/drivers/pcmcia/db1xxx_ss.c
-+++ b/drivers/pcmcia/db1xxx_ss.c
-@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock {
- int stschg_irq; /* card-status-change irq */
- int card_irq; /* card irq */
- int eject_irq; /* db1200/pb1200 have these */
-+ int insert_gpio; /* db1000 carddetect gpio */
-
- #define BOARD_TYPE_DEFAULT 0 /* most boards */
- #define BOARD_TYPE_DB1200 1 /* IRQs aren't gpios */
-@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct db1x_pcmcia_sock *sock)
- /* carddetect gpio: low-active */
- static int db1000_card_inserted(struct db1x_pcmcia_sock *sock)
- {
-- return !gpio_get_value(irq_to_gpio(sock->insert_irq));
-+ return !gpio_get_value(sock->insert_gpio);
- }
-
- static int db1x_card_inserted(struct db1x_pcmcia_sock *sock)
-@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(struct platform_device *pdev)
- r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "card");
- sock->card_irq = r ? r->start : 0;
-
-- /* insert: irq which triggers on card insertion/ejection */
-+ /* insert: irq which triggers on card insertion/ejection
-+ * BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here!
-+ */
- r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "insert");
- sock->insert_irq = r ? r->start : -1;
-+ if (sock->board_type == BOARD_TYPE_DEFAULT) {
-+ sock->insert_gpio = r ? r->start : -1;
-+ sock->insert_irq = r ? gpio_to_irq(r->start) : -1;
-+ }
-
- /* stschg: irq which trigger on card status change (optional) */
- r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "stschg");
-diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
-index a5bb939..1029aa7 100644
---- a/drivers/pinctrl/freescale/pinctrl-imx.c
-+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
-@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_device *pdev,
-
- if (of_property_read_bool(dev_np, "fsl,input-sel")) {
- np = of_parse_phandle(dev_np, "fsl,input-sel", 0);
-- if (np) {
-- ipctl->input_sel_base = of_iomap(np, 0);
-- if (IS_ERR(ipctl->input_sel_base)) {
-- of_node_put(np);
-- dev_err(&pdev->dev,
-- "iomuxc input select base address not found\n");
-- return PTR_ERR(ipctl->input_sel_base);
-- }
-- } else {
-+ if (!np) {
- dev_err(&pdev->dev, "iomuxc fsl,input-sel property not found\n");
- return -EINVAL;
- }
-+
-+ ipctl->input_sel_base = of_iomap(np, 0);
- of_node_put(np);
-+ if (!ipctl->input_sel_base) {
-+ dev_err(&pdev->dev,
-+ "iomuxc input select base address not found\n");
-+ return -ENOMEM;
-+ }
- }
-
- imx_pinctrl_desc.name = dev_name(&pdev->dev);
-diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
-index 3524061..c8969dd 100644
---- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
-+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
-@@ -990,7 +990,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s,
- int val;
-
- if (pull)
-- pullidx = data_out ? 1 : 2;
-+ pullidx = data_out ? 2 : 1;
-
- seq_printf(s, " gpio-%-3d (%-20.20s) in %s %s",
- gpio,
-diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
-index 856f736..2673cd9 100644
---- a/drivers/pinctrl/pinctrl-pistachio.c
-+++ b/drivers/pinctrl/pinctrl-pistachio.c
-@@ -469,27 +469,27 @@ static const char * const pistachio_mips_pll_lock_groups[] = {
- "mfio83",
- };
-
--static const char * const pistachio_sys_pll_lock_groups[] = {
-+static const char * const pistachio_audio_pll_lock_groups[] = {
- "mfio84",
- };
-
--static const char * const pistachio_wifi_pll_lock_groups[] = {
-+static const char * const pistachio_rpu_v_pll_lock_groups[] = {
- "mfio85",
- };
-
--static const char * const pistachio_bt_pll_lock_groups[] = {
-+static const char * const pistachio_rpu_l_pll_lock_groups[] = {
- "mfio86",
- };
-
--static const char * const pistachio_rpu_v_pll_lock_groups[] = {
-+static const char * const pistachio_sys_pll_lock_groups[] = {
- "mfio87",
- };
-
--static const char * const pistachio_rpu_l_pll_lock_groups[] = {
-+static const char * const pistachio_wifi_pll_lock_groups[] = {
- "mfio88",
- };
-
--static const char * const pistachio_audio_pll_lock_groups[] = {
-+static const char * const pistachio_bt_pll_lock_groups[] = {
- "mfio89",
- };
-
-@@ -559,12 +559,12 @@ enum pistachio_mux_option {
- PISTACHIO_FUNCTION_DREQ4,
- PISTACHIO_FUNCTION_DREQ5,
- PISTACHIO_FUNCTION_MIPS_PLL_LOCK,
-+ PISTACHIO_FUNCTION_AUDIO_PLL_LOCK,
-+ PISTACHIO_FUNCTION_RPU_V_PLL_LOCK,
-+ PISTACHIO_FUNCTION_RPU_L_PLL_LOCK,
- PISTACHIO_FUNCTION_SYS_PLL_LOCK,
- PISTACHIO_FUNCTION_WIFI_PLL_LOCK,
- PISTACHIO_FUNCTION_BT_PLL_LOCK,
-- PISTACHIO_FUNCTION_RPU_V_PLL_LOCK,
-- PISTACHIO_FUNCTION_RPU_L_PLL_LOCK,
-- PISTACHIO_FUNCTION_AUDIO_PLL_LOCK,
- PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND,
- PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND,
- PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND,
-@@ -620,12 +620,12 @@ static const struct pistachio_function pistachio_functions[] = {
- FUNCTION(dreq4),
- FUNCTION(dreq5),
- FUNCTION(mips_pll_lock),
-+ FUNCTION(audio_pll_lock),
-+ FUNCTION(rpu_v_pll_lock),
-+ FUNCTION(rpu_l_pll_lock),
- FUNCTION(sys_pll_lock),
- FUNCTION(wifi_pll_lock),
- FUNCTION(bt_pll_lock),
-- FUNCTION(rpu_v_pll_lock),
-- FUNCTION(rpu_l_pll_lock),
-- FUNCTION(audio_pll_lock),
- FUNCTION(debug_raw_cca_ind),
- FUNCTION(debug_ed_sec20_cca_ind),
- FUNCTION(debug_ed_sec40_cca_ind),
-diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c
-index 181ea98..2b0d702 100644
---- a/drivers/pinctrl/sh-pfc/core.c
-+++ b/drivers/pinctrl/sh-pfc/core.c
-@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_device *pdev)
- return ret;
- }
-
-- pinctrl_provide_dummies();
-+ /* Enable dummy states for those platforms without pinctrl support */
-+ if (!of_have_populated_dt())
-+ pinctrl_provide_dummies();
-
- ret = sh_pfc_init_ranges(pfc);
- if (ret < 0)
-diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
-index 00265f0..8b381d6 100644
---- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
-+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
-@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc sun8i_a33_pinctrl_data = {
- .pins = sun8i_a33_pins,
- .npins = ARRAY_SIZE(sun8i_a33_pins),
- .irq_banks = 2,
-+ .irq_bank_base = 1,
- };
-
- static int sun8i_a33_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
-index 7a2465f..884c2b3 100644
---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
-+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
-@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_resources(struct irq_data *d)
- static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type)
- {
- struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
-- u32 reg = sunxi_irq_cfg_reg(d->hwirq);
-+ u32 reg = sunxi_irq_cfg_reg(d->hwirq, pctl->desc->irq_bank_base);
- u8 index = sunxi_irq_cfg_offset(d->hwirq);
- unsigned long flags;
- u32 regval;
-@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type)
- static void sunxi_pinctrl_irq_ack(struct irq_data *d)
- {
- struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
-- u32 status_reg = sunxi_irq_status_reg(d->hwirq);
-+ u32 status_reg = sunxi_irq_status_reg(d->hwirq,
-+ pctl->desc->irq_bank_base);
- u8 status_idx = sunxi_irq_status_offset(d->hwirq);
-
- /* Clear the IRQ */
-@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(struct irq_data *d)
- static void sunxi_pinctrl_irq_mask(struct irq_data *d)
- {
- struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
-- u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
-+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base);
- u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
- unsigned long flags;
- u32 val;
-@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
- static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
- {
- struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
-- u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
-+ u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base);
- u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
- unsigned long flags;
- u32 val;
-@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc)
- if (bank == pctl->desc->irq_banks)
- return;
-
-- reg = sunxi_irq_status_reg_from_bank(bank);
-+ reg = sunxi_irq_status_reg_from_bank(bank, pctl->desc->irq_bank_base);
- val = readl(pctl->membase + reg);
-
- if (val) {
-@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_device *pdev,
-
- for (i = 0; i < pctl->desc->irq_banks; i++) {
- /* Mask and clear all IRQs before registering a handler */
-- writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i));
-+ writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i,
-+ pctl->desc->irq_bank_base));
- writel(0xffffffff,
-- pctl->membase + sunxi_irq_status_reg_from_bank(i));
-+ pctl->membase + sunxi_irq_status_reg_from_bank(i,
-+ pctl->desc->irq_bank_base));
-
- irq_set_chained_handler_and_data(pctl->irq[i],
- sunxi_pinctrl_irq_handler,
-diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
-index e248e81..0afce1a 100644
---- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
-+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
-@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc {
- int npins;
- unsigned pin_base;
- unsigned irq_banks;
-+ unsigned irq_bank_base;
- bool irq_read_needs_mux;
- };
-
-@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16 pin)
- return pin_num * PULL_PINS_BITS;
- }
-
--static inline u32 sunxi_irq_cfg_reg(u16 irq)
-+static inline u32 sunxi_irq_cfg_reg(u16 irq, unsigned bank_base)
- {
- u8 bank = irq / IRQ_PER_BANK;
- u8 reg = (irq % IRQ_PER_BANK) / IRQ_CFG_IRQ_PER_REG * 0x04;
-
-- return IRQ_CFG_REG + bank * IRQ_MEM_SIZE + reg;
-+ return IRQ_CFG_REG + (bank_base + bank) * IRQ_MEM_SIZE + reg;
- }
-
- static inline u32 sunxi_irq_cfg_offset(u16 irq)
-@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
- return irq_num * IRQ_CFG_IRQ_BITS;
- }
-
--static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank)
-+static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank, unsigned bank_base)
- {
-- return IRQ_CTRL_REG + bank * IRQ_MEM_SIZE;
-+ return IRQ_CTRL_REG + (bank_base + bank) * IRQ_MEM_SIZE;
- }
-
--static inline u32 sunxi_irq_ctrl_reg(u16 irq)
-+static inline u32 sunxi_irq_ctrl_reg(u16 irq, unsigned bank_base)
- {
- u8 bank = irq / IRQ_PER_BANK;
-
-- return sunxi_irq_ctrl_reg_from_bank(bank);
-+ return sunxi_irq_ctrl_reg_from_bank(bank, bank_base);
- }
-
- static inline u32 sunxi_irq_ctrl_offset(u16 irq)
-@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
- return irq_num * IRQ_CTRL_IRQ_BITS;
- }
-
--static inline u32 sunxi_irq_status_reg_from_bank(u8 bank)
-+static inline u32 sunxi_irq_status_reg_from_bank(u8 bank, unsigned bank_base)
- {
-- return IRQ_STATUS_REG + bank * IRQ_MEM_SIZE;
-+ return IRQ_STATUS_REG + (bank_base + bank) * IRQ_MEM_SIZE;
- }
-
--static inline u32 sunxi_irq_status_reg(u16 irq)
-+static inline u32 sunxi_irq_status_reg(u16 irq, unsigned bank_base)
- {
- u8 bank = irq / IRQ_PER_BANK;
-
-- return sunxi_irq_status_reg_from_bank(bank);
-+ return sunxi_irq_status_reg_from_bank(bank, bank_base);
- }
-
- static inline u32 sunxi_irq_status_offset(u16 irq)
-diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
-index b1bf42b..1deb6ad 100644
---- a/drivers/scsi/scsi.c
-+++ b/drivers/scsi/scsi.c
-@@ -784,8 +784,9 @@ void scsi_attach_vpd(struct scsi_device *sdev)
- int pg83_supported = 0;
- unsigned char __rcu *vpd_buf, *orig_vpd_buf = NULL;
-
-- if (sdev->skip_vpd_pages)
-+ if (!scsi_device_supports_vpd(sdev))
- return;
-+
- retry_pg0:
- vpd_buf = kmalloc(vpd_len, GFP_KERNEL);
- if (!vpd_buf)
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5a5457a..974ca5b 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
- struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk);
- struct scsi_device *sdp = sdkp->device;
- struct Scsi_Host *host = sdp->host;
-+ sector_t capacity = logical_to_sectors(sdp, sdkp->capacity);
- int diskinfo[4];
-
- /* default to most commonly used values */
-- diskinfo[0] = 0x40; /* 1 << 6 */
-- diskinfo[1] = 0x20; /* 1 << 5 */
-- diskinfo[2] = sdkp->capacity >> 11;
--
-+ diskinfo[0] = 0x40; /* 1 << 6 */
-+ diskinfo[1] = 0x20; /* 1 << 5 */
-+ diskinfo[2] = capacity >> 11;
-+
- /* override with calculated, extended default, or driver values */
- if (host->hostt->bios_param)
-- host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo);
-+ host->hostt->bios_param(sdp, bdev, capacity, diskinfo);
- else
-- scsicam_bios_param(bdev, sdkp->capacity, diskinfo);
-+ scsicam_bios_param(bdev, capacity, diskinfo);
-
- geo->heads = diskinfo[0];
- geo->sectors = diskinfo[1];
-@@ -2337,14 +2338,6 @@ got_data:
- if (sdkp->capacity > 0xffffffff)
- sdp->use_16_for_rw = 1;
-
-- /* Rescale capacity to 512-byte units */
-- if (sector_size == 4096)
-- sdkp->capacity <<= 3;
-- else if (sector_size == 2048)
-- sdkp->capacity <<= 2;
-- else if (sector_size == 1024)
-- sdkp->capacity <<= 1;
--
- blk_queue_physical_block_size(sdp->request_queue,
- sdkp->physical_block_size);
- sdkp->device->sector_size = sector_size;
-@@ -2795,28 +2788,6 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
- sdkp->ws10 = 1;
- }
-
--static int sd_try_extended_inquiry(struct scsi_device *sdp)
--{
-- /* Attempt VPD inquiry if the device blacklist explicitly calls
-- * for it.
-- */
-- if (sdp->try_vpd_pages)
-- return 1;
-- /*
-- * Although VPD inquiries can go to SCSI-2 type devices,
-- * some USB ones crash on receiving them, and the pages
-- * we currently ask for are for SPC-3 and beyond
-- */
-- if (sdp->scsi_level > SCSI_SPC_2 && !sdp->skip_vpd_pages)
-- return 1;
-- return 0;
--}
--
--static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks)
--{
-- return blocks << (ilog2(sdev->sector_size) - 9);
--}
--
- /**
- * sd_revalidate_disk - called the first time a new disk is seen,
- * performs disk spin up, read_capacity, etc.
-@@ -2856,7 +2827,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
- if (sdkp->media_present) {
- sd_read_capacity(sdkp, buffer);
-
-- if (sd_try_extended_inquiry(sdp)) {
-+ if (scsi_device_supports_vpd(sdp)) {
- sd_read_block_provisioning(sdkp);
- sd_read_block_limits(sdkp);
- sd_read_block_characteristics(sdkp);
-@@ -2900,7 +2871,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
- /* Combine with controller limits */
- q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
-
-- set_capacity(disk, sdkp->capacity);
-+ set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
- sd_config_write_same(sdkp);
- kfree(buffer);
-
-diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
-index 5f2a84a..654630b 100644
---- a/drivers/scsi/sd.h
-+++ b/drivers/scsi/sd.h
-@@ -65,7 +65,7 @@ struct scsi_disk {
- struct device dev;
- struct gendisk *disk;
- atomic_t openers;
-- sector_t capacity; /* size in 512-byte sectors */
-+ sector_t capacity; /* size in logical blocks */
- u32 max_xfer_blocks;
- u32 opt_xfer_blocks;
- u32 max_ws_blocks;
-@@ -146,6 +146,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd)
- return 0;
- }
-
-+static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks)
-+{
-+ return blocks << (ilog2(sdev->sector_size) - 9);
-+}
-+
- /*
- * A DIF-capable target device can be formatted with different
- * protection schemes. Currently 0 through 3 are defined:
-diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
-index e237e9f..df56021 100644
---- a/drivers/staging/android/ion/ion.c
-+++ b/drivers/staging/android/ion/ion.c
-@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
- * memory coming from the heaps is ready for dma, ie if it has a
- * cached mapping that mapping has been invalidated
- */
-- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i)
-+ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {
- sg_dma_address(sg) = sg_phys(sg);
-+ sg_dma_len(sg) = sg->length;
-+ }
- mutex_lock(&dev->buffer_lock);
- ion_buffer_add(dev, buffer);
- mutex_unlock(&dev->buffer_lock);
-diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
-index c0f5c65..f1893e0 100644
---- a/drivers/usb/renesas_usbhs/fifo.c
-+++ b/drivers/usb/renesas_usbhs/fifo.c
-@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type)
- goto __usbhs_pkt_handler_end;
- }
-
-- ret = func(pkt, &is_done);
-+ if (likely(func))
-+ ret = func(pkt, &is_done);
-
- if (is_done)
- __usbhsf_pkt_del(pkt);
-@@ -889,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
-
- pkt->trans = len;
-
-+ usbhsf_tx_irq_ctrl(pipe, 0);
- INIT_WORK(&pkt->work, xfer_work);
- schedule_work(&pkt->work);
-
-diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
-index 657f967..2510535 100644
---- a/drivers/usb/renesas_usbhs/mod_gadget.c
-+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
-@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
- struct usbhs_pipe *pipe = pkt->pipe;
- struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe);
- struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
-+ unsigned long flags;
-
- ureq->req.actual = pkt->actual;
-
-- usbhsg_queue_pop(uep, ureq, 0);
-+ usbhs_lock(priv, flags);
-+ if (uep)
-+ __usbhsg_queue_pop(uep, ureq, 0);
-+ usbhs_unlock(priv, flags);
- }
-
- static void usbhsg_queue_push(struct usbhsg_uep *uep,
-diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
-index c90a7e4..e4ade8d 100644
---- a/drivers/usb/storage/uas.c
-+++ b/drivers/usb/storage/uas.c
-@@ -2,7 +2,7 @@
- * USB Attached SCSI
- * Note that this is not the same as the USB Mass Storage driver
- *
-- * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014
-+ * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016
- * Copyright Matthew Wilcox for Intel Corp, 2010
- * Copyright Sarah Sharp for Intel Corp, 2010
- *
-@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
- return SUCCESS;
- }
-
-+static int uas_target_alloc(struct scsi_target *starget)
-+{
-+ struct uas_dev_info *devinfo = (struct uas_dev_info *)
-+ dev_to_shost(starget->dev.parent)->hostdata;
-+
-+ if (devinfo->flags & US_FL_NO_REPORT_LUNS)
-+ starget->no_report_luns = 1;
-+
-+ return 0;
-+}
-+
- static int uas_slave_alloc(struct scsi_device *sdev)
- {
- struct uas_dev_info *devinfo =
-@@ -800,7 +811,6 @@ static int uas_slave_configure(struct scsi_device *sdev)
- if (devinfo->flags & US_FL_BROKEN_FUA)
- sdev->broken_fua = 1;
-
-- scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
- return 0;
- }
-
-@@ -808,6 +818,7 @@ static struct scsi_host_template uas_host_template = {
- .module = THIS_MODULE,
- .name = "uas",
- .queuecommand = uas_queuecommand,
-+ .target_alloc = uas_target_alloc,
- .slave_alloc = uas_slave_alloc,
- .slave_configure = uas_slave_configure,
- .eh_abort_handler = uas_eh_abort_handler,
-@@ -932,6 +943,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
- if (result)
- goto set_alt0;
-
-+ /*
-+ * 1 tag is reserved for untagged commands +
-+ * 1 tag to avoid off by one errors in some bridge firmwares
-+ */
-+ shost->can_queue = devinfo->qdepth - 2;
-+
- usb_set_intfdata(intf, shost);
- result = scsi_add_host(shost, &intf->dev);
- if (result)
-diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
-index ccc113e..53341a7 100644
---- a/drivers/usb/storage/unusual_uas.h
-+++ b/drivers/usb/storage/unusual_uas.h
-@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_NO_ATA_1X),
-
-+/* Reported-by: David Webb <djw@noc.ac.uk> */
-+UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
-+ "Seagate",
-+ "Expansion Desk",
-+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-+ US_FL_NO_REPORT_LUNS),
-+
- /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
- UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
- "Seagate",
-diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
-index 43576ed..9de988a 100644
---- a/drivers/usb/storage/usb.c
-+++ b/drivers/usb/storage/usb.c
-@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
- US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 |
- US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
- US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
-- US_FL_MAX_SECTORS_240);
-+ US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS);
-
- p = quirks;
- while (*p) {
-@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
- case 'i':
- f |= US_FL_IGNORE_DEVICE;
- break;
-+ case 'j':
-+ f |= US_FL_NO_REPORT_LUNS;
-+ break;
- case 'l':
- f |= US_FL_NOT_LOCKABLE;
- break;
-diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
-index 7760fc1..1f413a2 100644
---- a/drivers/virtio/virtio_pci_modern.c
-+++ b/drivers/virtio/virtio_pci_modern.c
-@@ -17,6 +17,7 @@
- *
- */
-
-+#include <linux/delay.h>
- #define VIRTIO_PCI_NO_LEGACY
- #include "virtio_pci_common.h"
-
-@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_device *vdev)
- struct virtio_pci_device *vp_dev = to_vp_device(vdev);
- /* 0 status means a reset. */
- vp_iowrite8(0, &vp_dev->common->device_status);
-- /* Flush out the status write, and flush in device writes,
-- * including MSI-X interrupts, if any. */
-- vp_ioread8(&vp_dev->common->device_status);
-+ /* After writing 0 to device_status, the driver MUST wait for a read of
-+ * device_status to return 0 before reinitializing the device.
-+ * This will flush out the status write, and flush in device writes,
-+ * including MSI-X interrupts, if any.
-+ */
-+ while (vp_ioread8(&vp_dev->common->device_status))
-+ msleep(1);
- /* Flush pending VQ/configuration callbacks. */
- vp_synchronize_vectors(vdev);
- }
-diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index 524c221..4436778 100644
---- a/drivers/xen/events/events_base.c
-+++ b/drivers/xen/events/events_base.c
-@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *data)
- struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
- int rc = 0;
-
-- irq_move_irq(data);
-+ if (!VALID_EVTCHN(evtchn))
-+ return;
-
-- if (VALID_EVTCHN(evtchn))
-+ if (unlikely(irqd_is_setaffinity_pending(data))) {
-+ int masked = test_and_set_mask(evtchn);
-+
-+ clear_evtchn(evtchn);
-+
-+ irq_move_masked_irq(data);
-+
-+ if (!masked)
-+ unmask_evtchn(evtchn);
-+ } else
- clear_evtchn(evtchn);
-
- if (pirq_needs_eoi(data->irq)) {
-@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *data)
- {
- int evtchn = evtchn_from_irq(data->irq);
-
-- irq_move_irq(data);
-+ if (!VALID_EVTCHN(evtchn))
-+ return;
-
-- if (VALID_EVTCHN(evtchn))
-+ if (unlikely(irqd_is_setaffinity_pending(data))) {
-+ int masked = test_and_set_mask(evtchn);
-+
-+ clear_evtchn(evtchn);
-+
-+ irq_move_masked_irq(data);
-+
-+ if (!masked)
-+ unmask_evtchn(evtchn);
-+ } else
- clear_evtchn(evtchn);
- }
-
-diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 098bb8f..9a30ca6 100644
---- a/fs/btrfs/file.c
-+++ b/fs/btrfs/file.c
-@@ -1883,7 +1883,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end)
- */
- int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
- {
-- struct dentry *dentry = file->f_path.dentry;
-+ struct dentry *dentry = file_dentry(file);
- struct inode *inode = d_inode(dentry);
- struct btrfs_root *root = BTRFS_I(inode)->root;
- struct btrfs_trans_handle *trans;
-diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index 978c3a8..849a30a 100644
---- a/fs/btrfs/tree-log.c
-+++ b/fs/btrfs/tree-log.c
-@@ -4414,6 +4414,127 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
- return ret;
- }
-
-+/*
-+ * When we are logging a new inode X, check if it doesn't have a reference that
-+ * matches the reference from some other inode Y created in a past transaction
-+ * and that was renamed in the current transaction. If we don't do this, then at
-+ * log replay time we can lose inode Y (and all its files if it's a directory):
-+ *
-+ * mkdir /mnt/x
-+ * echo "hello world" > /mnt/x/foobar
-+ * sync
-+ * mv /mnt/x /mnt/y
-+ * mkdir /mnt/x # or touch /mnt/x
-+ * xfs_io -c fsync /mnt/x
-+ * <power fail>
-+ * mount fs, trigger log replay
-+ *
-+ * After the log replay procedure, we would lose the first directory and all its
-+ * files (file foobar).
-+ * For the case where inode Y is not a directory we simply end up losing it:
-+ *
-+ * echo "123" > /mnt/foo
-+ * sync
-+ * mv /mnt/foo /mnt/bar
-+ * echo "abc" > /mnt/foo
-+ * xfs_io -c fsync /mnt/foo
-+ * <power fail>
-+ *
-+ * We also need this for cases where a snapshot entry is replaced by some other
-+ * entry (file or directory) otherwise we end up with an unreplayable log due to
-+ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as
-+ * if it were a regular entry:
-+ *
-+ * mkdir /mnt/x
-+ * btrfs subvolume snapshot /mnt /mnt/x/snap
-+ * btrfs subvolume delete /mnt/x/snap
-+ * rmdir /mnt/x
-+ * mkdir /mnt/x
-+ * fsync /mnt/x or fsync some new file inside it
-+ * <power fail>
-+ *
-+ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in
-+ * the same transaction.
-+ */
-+static int btrfs_check_ref_name_override(struct extent_buffer *eb,
-+ const int slot,
-+ const struct btrfs_key *key,
-+ struct inode *inode)
-+{
-+ int ret;
-+ struct btrfs_path *search_path;
-+ char *name = NULL;
-+ u32 name_len = 0;
-+ u32 item_size = btrfs_item_size_nr(eb, slot);
-+ u32 cur_offset = 0;
-+ unsigned long ptr = btrfs_item_ptr_offset(eb, slot);
-+
-+ search_path = btrfs_alloc_path();
-+ if (!search_path)
-+ return -ENOMEM;
-+ search_path->search_commit_root = 1;
-+ search_path->skip_locking = 1;
-+
-+ while (cur_offset < item_size) {
-+ u64 parent;
-+ u32 this_name_len;
-+ u32 this_len;
-+ unsigned long name_ptr;
-+ struct btrfs_dir_item *di;
-+
-+ if (key->type == BTRFS_INODE_REF_KEY) {
-+ struct btrfs_inode_ref *iref;
-+
-+ iref = (struct btrfs_inode_ref *)(ptr + cur_offset);
-+ parent = key->offset;
-+ this_name_len = btrfs_inode_ref_name_len(eb, iref);
-+ name_ptr = (unsigned long)(iref + 1);
-+ this_len = sizeof(*iref) + this_name_len;
-+ } else {
-+ struct btrfs_inode_extref *extref;
-+
-+ extref = (struct btrfs_inode_extref *)(ptr +
-+ cur_offset);
-+ parent = btrfs_inode_extref_parent(eb, extref);
-+ this_name_len = btrfs_inode_extref_name_len(eb, extref);
-+ name_ptr = (unsigned long)&extref->name;
-+ this_len = sizeof(*extref) + this_name_len;
-+ }
-+
-+ if (this_name_len > name_len) {
-+ char *new_name;
-+
-+ new_name = krealloc(name, this_name_len, GFP_NOFS);
-+ if (!new_name) {
-+ ret = -ENOMEM;
-+ goto out;
-+ }
-+ name_len = this_name_len;
-+ name = new_name;
-+ }
-+
-+ read_extent_buffer(eb, name, name_ptr, this_name_len);
-+ di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root,
-+ search_path, parent,
-+ name, this_name_len, 0);
-+ if (di && !IS_ERR(di)) {
-+ ret = 1;
-+ goto out;
-+ } else if (IS_ERR(di)) {
-+ ret = PTR_ERR(di);
-+ goto out;
-+ }
-+ btrfs_release_path(search_path);
-+
-+ cur_offset += this_len;
-+ }
-+ ret = 0;
-+out:
-+ btrfs_free_path(search_path);
-+ kfree(name);
-+ return ret;
-+}
-+
- /* log a single inode in the tree log.
- * At least one parent directory for this inode must exist in the tree
- * or be logged already.
-@@ -4586,6 +4707,22 @@ again:
- if (min_key.type == BTRFS_INODE_ITEM_KEY)
- need_log_inode_item = false;
-
-+ if ((min_key.type == BTRFS_INODE_REF_KEY ||
-+ min_key.type == BTRFS_INODE_EXTREF_KEY) &&
-+ BTRFS_I(inode)->generation == trans->transid) {
-+ ret = btrfs_check_ref_name_override(path->nodes[0],
-+ path->slots[0],
-+ &min_key, inode);
-+ if (ret < 0) {
-+ err = ret;
-+ goto out_unlock;
-+ } else if (ret > 0) {
-+ err = 1;
-+ btrfs_set_log_full_commit(root->fs_info, trans);
-+ goto out_unlock;
-+ }
-+ }
-+
- /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */
- if (min_key.type == BTRFS_XATTR_ITEM_KEY) {
- if (ins_nr == 0)
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 2398f9f9..7566b26 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -1667,7 +1667,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
- DCACHE_OP_REVALIDATE |
- DCACHE_OP_WEAK_REVALIDATE |
- DCACHE_OP_DELETE |
-- DCACHE_OP_SELECT_INODE));
-+ DCACHE_OP_SELECT_INODE |
-+ DCACHE_OP_REAL));
- dentry->d_op = op;
- if (!op)
- return;
-@@ -1685,6 +1686,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
- dentry->d_flags |= DCACHE_OP_PRUNE;
- if (op->d_select_inode)
- dentry->d_flags |= DCACHE_OP_SELECT_INODE;
-+ if (op->d_real)
-+ dentry->d_flags |= DCACHE_OP_REAL;
-
- }
- EXPORT_SYMBOL(d_set_d_op);
-diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
-index 38f7562..ecb5439 100644
---- a/fs/ext4/crypto.c
-+++ b/fs/ext4/crypto.c
-@@ -475,13 +475,16 @@ uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size)
- */
- static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags)
- {
-- struct inode *dir = d_inode(dentry->d_parent);
-- struct ext4_crypt_info *ci = EXT4_I(dir)->i_crypt_info;
-+ struct dentry *dir;
-+ struct ext4_crypt_info *ci;
- int dir_has_key, cached_with_key;
-
-- if (!ext4_encrypted_inode(dir))
-+ dir = dget_parent(dentry);
-+ if (!ext4_encrypted_inode(d_inode(dir))) {
-+ dput(dir);
- return 0;
--
-+ }
-+ ci = EXT4_I(d_inode(dir))->i_crypt_info;
- if (ci && ci->ci_keyring_key &&
- (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
- (1 << KEY_FLAG_REVOKED) |
-@@ -491,6 +494,7 @@ static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags)
- /* this should eventually be an flag in d_flags */
- cached_with_key = dentry->d_fsdata != NULL;
- dir_has_key = (ci != NULL);
-+ dput(dir);
-
- /*
- * If the dentry was cached without the key, and it is a
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 157b458a..b213449 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -900,6 +900,29 @@ do { \
- #include "extents_status.h"
-
- /*
-+ * Lock subclasses for i_data_sem in the ext4_inode_info structure.
-+ *
-+ * These are needed to avoid lockdep false positives when we need to
-+ * allocate blocks to the quota inode during ext4_map_blocks(), while
-+ * holding i_data_sem for a normal (non-quota) inode. Since we don't
-+ * do quota tracking for the quota inode, this avoids deadlock (as
-+ * well as infinite recursion, since it isn't turtles all the way
-+ * down...)
-+ *
-+ * I_DATA_SEM_NORMAL - Used for most inodes
-+ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode
-+ * where the second inode has larger inode number
-+ * than the first
-+ * I_DATA_SEM_QUOTA - Used for quota inodes only
-+ */
-+enum {
-+ I_DATA_SEM_NORMAL = 0,
-+ I_DATA_SEM_OTHER,
-+ I_DATA_SEM_QUOTA,
-+};
-+
-+
-+/*
- * fourth extended file system inode data in memory
- */
- struct ext4_inode_info {
-diff --git a/fs/ext4/file.c b/fs/ext4/file.c
-index 4cd318f..38847f3 100644
---- a/fs/ext4/file.c
-+++ b/fs/ext4/file.c
-@@ -335,7 +335,7 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
- struct super_block *sb = inode->i_sb;
- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- struct vfsmount *mnt = filp->f_path.mnt;
-- struct inode *dir = filp->f_path.dentry->d_parent->d_inode;
-+ struct dentry *dir;
- struct path path;
- char buf[64], *cp;
- int ret;
-@@ -379,14 +379,18 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
- if (ext4_encryption_info(inode) == NULL)
- return -ENOKEY;
- }
-- if (ext4_encrypted_inode(dir) &&
-- !ext4_is_child_context_consistent_with_parent(dir, inode)) {
-+
-+ dir = dget_parent(file_dentry(filp));
-+ if (ext4_encrypted_inode(d_inode(dir)) &&
-+ !ext4_is_child_context_consistent_with_parent(d_inode(dir), inode)) {
- ext4_warning(inode->i_sb,
- "Inconsistent encryption contexts: %lu/%lu\n",
-- (unsigned long) dir->i_ino,
-+ (unsigned long) d_inode(dir)->i_ino,
- (unsigned long) inode->i_ino);
-+ dput(dir);
- return -EPERM;
- }
-+ dput(dir);
- /*
- * Set up the jbd2_inode if we are opening the inode for
- * writing and the journal is present
-diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
-index 4098acc..796ff0e 100644
---- a/fs/ext4/move_extent.c
-+++ b/fs/ext4/move_extent.c
-@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second)
- {
- if (first < second) {
- down_write(&EXT4_I(first)->i_data_sem);
-- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING);
-+ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER);
- } else {
- down_write(&EXT4_I(second)->i_data_sem);
-- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING);
-+ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER);
-
- }
- }
-@@ -484,6 +484,13 @@ mext_check_arguments(struct inode *orig_inode,
- return -EBUSY;
- }
-
-+ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) {
-+ ext4_debug("ext4 move extent: The argument files should "
-+ "not be quota files [ino:orig %lu, donor %lu]\n",
-+ orig_inode->i_ino, donor_inode->i_ino);
-+ return -EBUSY;
-+ }
-+
- /* Ext4 move extent supports only extent based file */
- if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) {
- ext4_debug("ext4 move extent: orig file is not extents "
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 3ed01ec..a76ca67 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -1324,9 +1324,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
- return -1;
- }
- if (ext4_has_feature_quota(sb)) {
-- ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options "
-- "when QUOTA feature is enabled");
-- return -1;
-+ ext4_msg(sb, KERN_INFO, "Journaled quota options "
-+ "ignored when QUOTA feature is enabled");
-+ return 1;
- }
- qname = match_strdup(args);
- if (!qname) {
-@@ -1689,10 +1689,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
- return -1;
- }
- if (ext4_has_feature_quota(sb)) {
-- ext4_msg(sb, KERN_ERR,
-- "Cannot set journaled quota options "
-+ ext4_msg(sb, KERN_INFO,
-+ "Quota format mount options ignored "
- "when QUOTA feature is enabled");
-- return -1;
-+ return 1;
- }
- sbi->s_jquota_fmt = m->mount_opt;
- #endif
-@@ -1753,11 +1753,11 @@ static int parse_options(char *options, struct super_block *sb,
- #ifdef CONFIG_QUOTA
- if (ext4_has_feature_quota(sb) &&
- (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) {
-- ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA "
-- "feature is enabled");
-- return 0;
-- }
-- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
-+ ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota "
-+ "mount options ignored.");
-+ clear_opt(sb, USRQUOTA);
-+ clear_opt(sb, GRPQUOTA);
-+ } else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
- if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
- clear_opt(sb, USRQUOTA);
-
-@@ -5021,6 +5021,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type)
- EXT4_SB(sb)->s_jquota_fmt, type);
- }
-
-+static void lockdep_set_quota_inode(struct inode *inode, int subclass)
-+{
-+ struct ext4_inode_info *ei = EXT4_I(inode);
-+
-+ /* The first argument of lockdep_set_subclass has to be
-+ * *exactly* the same as the argument to init_rwsem() --- in
-+ * this case, in init_once() --- or lockdep gets unhappy
-+ * because the name of the lock is set using the
-+ * stringification of the argument to init_rwsem().
-+ */
-+ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */
-+ lockdep_set_subclass(&ei->i_data_sem, subclass);
-+}
-+
- /*
- * Standard function to be called on quota_on
- */
-@@ -5060,8 +5074,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
- if (err)
- return err;
- }
--
-- return dquot_quota_on(sb, type, format_id, path);
-+ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA);
-+ err = dquot_quota_on(sb, type, format_id, path);
-+ if (err)
-+ lockdep_set_quota_inode(path->dentry->d_inode,
-+ I_DATA_SEM_NORMAL);
-+ return err;
- }
-
- static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
-@@ -5088,8 +5106,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
-
- /* Don't account quota for quota files to avoid recursion */
- qf_inode->i_flags |= S_NOQUOTA;
-+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA);
- err = dquot_enable(qf_inode, type, format_id, flags);
- iput(qf_inode);
-+ if (err)
-+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL);
-
- return err;
- }
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 9cce670..7ded177 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page **pages, nfs_readdir_descriptor_t *desc,
- again:
- timestamp = jiffies;
- gencount = nfs_inc_attr_generation_counter();
-- error = NFS_PROTO(inode)->readdir(file->f_path.dentry, cred, entry->cookie, pages,
-+ error = NFS_PROTO(inode)->readdir(file_dentry(file), cred, entry->cookie, pages,
- NFS_SERVER(inode)->dtsize, desc->plus);
- if (error < 0) {
- /* We requested READDIRPLUS, but the server doesn't grok it */
-@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
- count++;
-
- if (desc->plus != 0)
-- nfs_prime_dcache(desc->file->f_path.dentry, entry);
-+ nfs_prime_dcache(file_dentry(desc->file), entry);
-
- status = nfs_readdir_add_to_array(entry, page);
- if (status != 0)
-@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalidate(struct inode *dir)
- */
- static int nfs_readdir(struct file *file, struct dir_context *ctx)
- {
-- struct dentry *dentry = file->f_path.dentry;
-+ struct dentry *dentry = file_dentry(file);
- struct inode *inode = d_inode(dentry);
- nfs_readdir_descriptor_t my_desc,
- *desc = &my_desc;
-diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index 86faecf..847b678 100644
---- a/fs/nfs/inode.c
-+++ b/fs/nfs/inode.c
-@@ -940,7 +940,7 @@ int nfs_open(struct inode *inode, struct file *filp)
- {
- struct nfs_open_context *ctx;
-
-- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode);
-+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode);
- if (IS_ERR(ctx))
- return PTR_ERR(ctx);
- nfs_file_set_open_context(filp, ctx);
-diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
-index 57ca1c8..2a9ff14 100644
---- a/fs/nfs/nfs4file.c
-+++ b/fs/nfs/nfs4file.c
-@@ -26,7 +26,7 @@ static int
- nfs4_file_open(struct inode *inode, struct file *filp)
- {
- struct nfs_open_context *ctx;
-- struct dentry *dentry = filp->f_path.dentry;
-+ struct dentry *dentry = file_dentry(filp);
- struct dentry *parent = NULL;
- struct inode *dir;
- unsigned openflags = filp->f_flags;
-@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
- parent = dget_parent(dentry);
- dir = d_inode(parent);
-
-- ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode);
-+ ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode);
- err = PTR_ERR(ctx);
- if (IS_ERR(ctx))
- goto out;
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 619ad4b..4399ea8 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -295,6 +295,37 @@ static void ovl_dentry_release(struct dentry *dentry)
- }
- }
-
-+static struct dentry *ovl_d_real(struct dentry *dentry, struct inode *inode)
-+{
-+ struct dentry *real;
-+
-+ if (d_is_dir(dentry)) {
-+ if (!inode || inode == d_inode(dentry))
-+ return dentry;
-+ goto bug;
-+ }
-+
-+ real = ovl_dentry_upper(dentry);
-+ if (real && (!inode || inode == d_inode(real)))
-+ return real;
-+
-+ real = ovl_dentry_lower(dentry);
-+ if (!real)
-+ goto bug;
-+
-+ if (!inode || inode == d_inode(real))
-+ return real;
-+
-+ /* Handle recursion */
-+ if (real->d_flags & DCACHE_OP_REAL)
-+ return real->d_op->d_real(real, inode);
-+
-+bug:
-+ WARN(1, "ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n", dentry,
-+ inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
-+ return dentry;
-+}
-+
- static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags)
- {
- struct ovl_entry *oe = dentry->d_fsdata;
-@@ -339,11 +370,13 @@ static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags)
- static const struct dentry_operations ovl_dentry_operations = {
- .d_release = ovl_dentry_release,
- .d_select_inode = ovl_d_select_inode,
-+ .d_real = ovl_d_real,
- };
-
- static const struct dentry_operations ovl_reval_dentry_operations = {
- .d_release = ovl_dentry_release,
- .d_select_inode = ovl_d_select_inode,
-+ .d_real = ovl_d_real,
- .d_revalidate = ovl_dentry_revalidate,
- .d_weak_revalidate = ovl_dentry_weak_revalidate,
- };
-diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index 22ab246..eeae401 100644
---- a/include/linux/compiler-gcc.h
-+++ b/include/linux/compiler-gcc.h
-@@ -199,7 +199,7 @@
- #define unreachable() __builtin_unreachable()
-
- /* Mark a function definition as prohibited from being cloned. */
--#define __noclone __attribute__((__noclone__))
-+#define __noclone __attribute__((__noclone__, __optimize__("no-tracer")))
-
- #endif /* GCC_VERSION >= 40500 */
-
-diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index c4b5f4b..03dda7b 100644
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -161,6 +161,7 @@ struct dentry_operations {
- struct vfsmount *(*d_automount)(struct path *);
- int (*d_manage)(struct dentry *, bool);
- struct inode *(*d_select_inode)(struct dentry *, unsigned);
-+ struct dentry *(*d_real)(struct dentry *, struct inode *);
- } ____cacheline_aligned;
-
- /*
-@@ -227,6 +228,7 @@ struct dentry_operations {
- #define DCACHE_MAY_FREE 0x00800000
- #define DCACHE_FALLTHRU 0x01000000 /* Fall through to lower layer */
- #define DCACHE_OP_SELECT_INODE 0x02000000 /* Unioned entry: dcache op selects inode */
-+#define DCACHE_OP_REAL 0x08000000
-
- extern seqlock_t rename_lock;
-
-@@ -582,4 +584,12 @@ static inline struct dentry *d_backing_dentry(struct dentry *upper)
- return upper;
- }
-
-+static inline struct dentry *d_real(struct dentry *dentry)
-+{
-+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL))
-+ return dentry->d_op->d_real(dentry, NULL);
-+ else
-+ return dentry;
-+}
-+
- #endif /* __LINUX_DCACHE_H */
-diff --git a/include/linux/filter.h b/include/linux/filter.h
-index 43aa1f8..a51a536 100644
---- a/include/linux/filter.h
-+++ b/include/linux/filter.h
-@@ -465,10 +465,14 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog,
- void bpf_prog_destroy(struct bpf_prog *fp);
-
- int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
-+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
-+ bool locked);
- int sk_attach_bpf(u32 ufd, struct sock *sk);
- int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk);
- int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk);
- int sk_detach_filter(struct sock *sk);
-+int __sk_detach_filter(struct sock *sk, bool locked);
-+
- int sk_get_filter(struct sock *sk, struct sock_filter __user *filter,
- unsigned int len);
-
-diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 2c7f8d9..83c77b0 100644
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -1234,6 +1234,16 @@ static inline struct inode *file_inode(const struct file *f)
- return f->f_inode;
- }
-
-+static inline struct dentry *file_dentry(const struct file *file)
-+{
-+ struct dentry *dentry = file->f_path.dentry;
-+
-+ if (unlikely(dentry->d_flags & DCACHE_OP_REAL))
-+ return dentry->d_op->d_real(dentry, file_inode(file));
-+ else
-+ return dentry;
-+}
-+
- static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl)
- {
- return locks_lock_inode_wait(file_inode(filp), fl);
-diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
-index a338a688..dcb89e3 100644
---- a/include/linux/if_bridge.h
-+++ b/include/linux/if_bridge.h
-@@ -46,10 +46,6 @@ struct br_ip_list {
- #define BR_LEARNING_SYNC BIT(9)
- #define BR_PROXYARP_WIFI BIT(10)
-
--/* values as per ieee8021QBridgeFdbAgingTime */
--#define BR_MIN_AGEING_TIME (10 * HZ)
--#define BR_MAX_AGEING_TIME (1000000 * HZ)
--
- #define BR_DEFAULT_AGEING_TIME (300 * HZ)
-
- extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 5440b7b..6d1d8f4 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -267,6 +267,7 @@ struct header_ops {
- void (*cache_update)(struct hh_cache *hh,
- const struct net_device *dev,
- const unsigned char *haddr);
-+ bool (*validate)(const char *ll_header, unsigned int len);
- };
-
- /* These flag bits are private to the generic network queueing
-@@ -1420,8 +1421,7 @@ enum netdev_priv_flags {
- * @dma: DMA channel
- * @mtu: Interface MTU value
- * @type: Interface hardware type
-- * @hard_header_len: Hardware header length, which means that this is the
-- * minimum size of a packet.
-+ * @hard_header_len: Maximum hardware header length.
- *
- * @needed_headroom: Extra headroom the hardware may need, but not in all
- * cases can this be guaranteed
-@@ -2627,6 +2627,24 @@ static inline int dev_parse_header(const struct sk_buff *skb,
- return dev->header_ops->parse(skb, haddr);
- }
-
-+/* ll_header must have at least hard_header_len allocated */
-+static inline bool dev_validate_header(const struct net_device *dev,
-+ char *ll_header, int len)
-+{
-+ if (likely(len >= dev->hard_header_len))
-+ return true;
-+
-+ if (capable(CAP_SYS_RAWIO)) {
-+ memset(ll_header + len, 0, dev->hard_header_len - len);
-+ return true;
-+ }
-+
-+ if (dev->header_ops && dev->header_ops->validate)
-+ return dev->header_ops->validate(ll_header, len);
-+
-+ return false;
-+}
-+
- typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len);
- int register_gifconf(unsigned int family, gifconf_func_t *gifconf);
- static inline int unregister_gifconf(unsigned int family)
-diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
-index 7f5f78b..245f57d 100644
---- a/include/linux/usb_usual.h
-+++ b/include/linux/usb_usual.h
-@@ -79,6 +79,8 @@
- /* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */ \
- US_FLAG(MAX_SECTORS_240, 0x08000000) \
- /* Sets max_sectors to 240 */ \
-+ US_FLAG(NO_REPORT_LUNS, 0x10000000) \
-+ /* Cannot handle REPORT_LUNS */ \
-
- #define US_FLAG(name, value) US_FL_##name = value ,
- enum { US_DO_ALL_FLAGS };
-diff --git a/include/net/bonding.h b/include/net/bonding.h
-index ee6c520..791800d 100644
---- a/include/net/bonding.h
-+++ b/include/net/bonding.h
-@@ -215,6 +215,7 @@ struct bonding {
- * ALB mode (6) - to sync the use and modifications of its hash table
- */
- spinlock_t mode_lock;
-+ spinlock_t stats_lock;
- u8 send_peer_notif;
- u8 igmp_retrans;
- #ifdef CONFIG_PROC_FS
-diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
-index f63a167..ba93c0f 100644
---- a/include/scsi/scsi_device.h
-+++ b/include/scsi/scsi_device.h
-@@ -513,6 +513,31 @@ static inline int scsi_device_tpgs(struct scsi_device *sdev)
- return sdev->inquiry ? (sdev->inquiry[5] >> 4) & 0x3 : 0;
- }
-
-+/**
-+ * scsi_device_supports_vpd - test if a device supports VPD pages
-+ * @sdev: the &struct scsi_device to test
-+ *
-+ * If the 'try_vpd_pages' flag is set it takes precedence.
-+ * Otherwise we will assume VPD pages are supported if the
-+ * SCSI level is at least SPC-3 and 'skip_vpd_pages' is not set.
-+ */
-+static inline int scsi_device_supports_vpd(struct scsi_device *sdev)
-+{
-+ /* Attempt VPD inquiry if the device blacklist explicitly calls
-+ * for it.
-+ */
-+ if (sdev->try_vpd_pages)
-+ return 1;
-+ /*
-+ * Although VPD inquiries can go to SCSI-2 type devices,
-+ * some USB ones crash on receiving them, and the pages
-+ * we currently ask for are for SPC-3 and beyond
-+ */
-+ if (sdev->scsi_level > SCSI_SPC_2 && !sdev->skip_vpd_pages)
-+ return 1;
-+ return 0;
-+}
-+
- #define MODULE_ALIAS_SCSI_DEVICE(type) \
- MODULE_ALIAS("scsi:t-" __stringify(type) "*")
- #define SCSI_DEVICE_MODALIAS_FMT "scsi:t-0x%02x"
-diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
-index 4504ca6..50da680 100644
---- a/kernel/bpf/helpers.c
-+++ b/kernel/bpf/helpers.c
-@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5)
- if (!task)
- return -EINVAL;
-
-- memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm)));
-+ strlcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm)));
- return 0;
- }
-
-diff --git a/mm/page_isolation.c b/mm/page_isolation.c
-index 92c4c36..31555b6 100644
---- a/mm/page_isolation.c
-+++ b/mm/page_isolation.c
-@@ -289,11 +289,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private,
- * now as a simple work-around, we use the next node for destination.
- */
- if (PageHuge(page)) {
-- nodemask_t src = nodemask_of_node(page_to_nid(page));
-- nodemask_t dst;
-- nodes_complement(dst, src);
-+ int node = next_online_node(page_to_nid(page));
-+ if (node == MAX_NUMNODES)
-+ node = first_online_node;
- return alloc_huge_page_node(page_hstate(compound_head(page)),
-- next_node(page_to_nid(page), dst));
-+ node);
- }
-
- if (PageHighMem(page))
-diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
-index b563a3f..2fa3be9 100644
---- a/net/ax25/ax25_ip.c
-+++ b/net/ax25/ax25_ip.c
-@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
- }
- #endif
-
-+static bool ax25_validate_header(const char *header, unsigned int len)
-+{
-+ ax25_digi digi;
-+
-+ if (!len)
-+ return false;
-+
-+ if (header[0])
-+ return true;
-+
-+ return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL,
-+ NULL);
-+}
-+
- const struct header_ops ax25_header_ops = {
- .create = ax25_hard_header,
-+ .validate = ax25_validate_header,
- };
-
- EXPORT_SYMBOL(ax25_header_ops);
-diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
-index b3cca12..e2670c5 100644
---- a/net/bridge/br_stp.c
-+++ b/net/bridge/br_stp.c
-@@ -568,6 +568,14 @@ int br_set_max_age(struct net_bridge *br, unsigned long val)
-
- }
-
-+/* Set time interval that dynamic forwarding entries live
-+ * For pure software bridge, allow values outside the 802.1
-+ * standard specification for special cases:
-+ * 0 - entry never ages (all permanant)
-+ * 1 - entry disappears (no persistance)
-+ *
-+ * Offloaded switch entries maybe more restrictive
-+ */
- int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
- {
- struct switchdev_attr attr = {
-@@ -579,11 +587,8 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
- unsigned long t = clock_t_to_jiffies(ageing_time);
- int err;
-
-- if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME)
-- return -ERANGE;
--
- err = switchdev_port_attr_set(br->dev, &attr);
-- if (err)
-+ if (err && err != -EOPNOTSUPP)
- return err;
-
- br->ageing_time = t;
-diff --git a/net/core/filter.c b/net/core/filter.c
-index bba502f..fb2951c 100644
---- a/net/core/filter.c
-+++ b/net/core/filter.c
-@@ -1147,7 +1147,8 @@ void bpf_prog_destroy(struct bpf_prog *fp)
- }
- EXPORT_SYMBOL_GPL(bpf_prog_destroy);
-
--static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
-+static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk,
-+ bool locked)
- {
- struct sk_filter *fp, *old_fp;
-
-@@ -1163,10 +1164,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
- return -ENOMEM;
- }
-
-- old_fp = rcu_dereference_protected(sk->sk_filter,
-- sock_owned_by_user(sk));
-+ old_fp = rcu_dereference_protected(sk->sk_filter, locked);
- rcu_assign_pointer(sk->sk_filter, fp);
--
- if (old_fp)
- sk_filter_uncharge(sk, old_fp);
-
-@@ -1245,7 +1244,8 @@ struct bpf_prog *__get_filter(struct sock_fprog *fprog, struct sock *sk)
- * occurs or there is insufficient memory for the filter a negative
- * errno code is returned. On success the return is zero.
- */
--int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
-+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
-+ bool locked)
- {
- struct bpf_prog *prog = __get_filter(fprog, sk);
- int err;
-@@ -1253,7 +1253,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
- if (IS_ERR(prog))
- return PTR_ERR(prog);
-
-- err = __sk_attach_prog(prog, sk);
-+ err = __sk_attach_prog(prog, sk, locked);
- if (err < 0) {
- __bpf_prog_release(prog);
- return err;
-@@ -1261,7 +1261,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
-
- return 0;
- }
--EXPORT_SYMBOL_GPL(sk_attach_filter);
-+EXPORT_SYMBOL_GPL(__sk_attach_filter);
-+
-+int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
-+{
-+ return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk));
-+}
-
- int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk)
- {
-@@ -1307,7 +1312,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk)
- if (IS_ERR(prog))
- return PTR_ERR(prog);
-
-- err = __sk_attach_prog(prog, sk);
-+ err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk));
- if (err < 0) {
- bpf_prog_put(prog);
- return err;
-@@ -2105,7 +2110,7 @@ static int __init register_sk_filter_ops(void)
- }
- late_initcall(register_sk_filter_ops);
-
--int sk_detach_filter(struct sock *sk)
-+int __sk_detach_filter(struct sock *sk, bool locked)
- {
- int ret = -ENOENT;
- struct sk_filter *filter;
-@@ -2113,8 +2118,7 @@ int sk_detach_filter(struct sock *sk)
- if (sock_flag(sk, SOCK_FILTER_LOCKED))
- return -EPERM;
-
-- filter = rcu_dereference_protected(sk->sk_filter,
-- sock_owned_by_user(sk));
-+ filter = rcu_dereference_protected(sk->sk_filter, locked);
- if (filter) {
- RCU_INIT_POINTER(sk->sk_filter, NULL);
- sk_filter_uncharge(sk, filter);
-@@ -2123,7 +2127,12 @@ int sk_detach_filter(struct sock *sk)
-
- return ret;
- }
--EXPORT_SYMBOL_GPL(sk_detach_filter);
-+EXPORT_SYMBOL_GPL(__sk_detach_filter);
-+
-+int sk_detach_filter(struct sock *sk)
-+{
-+ return __sk_detach_filter(sk, sock_owned_by_user(sk));
-+}
-
- int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
- unsigned int len)
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 8261d95..215e613 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
- + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */
- + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */
- + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */
-+ + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */
- + nla_total_size(1); /* IFLA_PROTO_DOWN */
-
- }
-diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
-index 902d606..8be8f27 100644
---- a/net/dccp/ipv4.c
-+++ b/net/dccp/ipv4.c
-@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 seq)
- * ICMPs are not backlogged, hence we cannot get an established
- * socket here.
- */
-- WARN_ON(req->sk);
--
- if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) {
- NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
- } else {
-diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
-index fa4daba..d8fb47f 100644
---- a/net/dsa/dsa.c
-+++ b/net/dsa/dsa.c
-@@ -935,6 +935,14 @@ static void dsa_remove_dst(struct dsa_switch_tree *dst)
- {
- int i;
-
-+ dst->master_netdev->dsa_ptr = NULL;
-+
-+ /* If we used a tagging format that doesn't have an ethertype
-+ * field, make sure that all packets from this point get sent
-+ * without the tag and go through the regular receive path.
-+ */
-+ wmb();
-+
- for (i = 0; i < dst->pd->nr_chips; i++) {
- struct dsa_switch *ds = dst->ds[i];
-
-@@ -988,14 +996,6 @@ static int dsa_suspend(struct device *d)
- struct dsa_switch_tree *dst = platform_get_drvdata(pdev);
- int i, ret = 0;
-
-- dst->master_netdev->dsa_ptr = NULL;
--
-- /* If we used a tagging format that doesn't have an ethertype
-- * field, make sure that all packets from this point get sent
-- * without the tag and go through the regular receive path.
-- */
-- wmb();
--
- for (i = 0; i < dst->pd->nr_chips; i++) {
- struct dsa_switch *ds = dst->ds[i];
-
-diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index f6303b1..0212591 100644
---- a/net/ipv4/devinet.c
-+++ b/net/ipv4/devinet.c
-@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
-
- ASSERT_RTNL();
-
-+ if (in_dev->dead)
-+ goto no_promotions;
-+
- /* 1. Deleting primary ifaddr forces deletion all secondaries
- * unless alias promotion is set
- **/
-@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
- fib_del_ifaddr(ifa, ifa1);
- }
-
-+no_promotions:
- /* 2. Unlink it */
-
- *ifap = ifa1->ifa_next;
-diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 4734475..8a9246d 100644
---- a/net/ipv4/fib_frontend.c
-+++ b/net/ipv4/fib_frontend.c
-@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
- struct in_device *in_dev;
- struct fib_result res;
- struct rtable *rt;
-- struct flowi4 fl4;
- struct net *net;
- int scope;
-
-@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
-
- scope = RT_SCOPE_UNIVERSE;
- if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
-- fl4.flowi4_oif = 0;
-- fl4.flowi4_iif = LOOPBACK_IFINDEX;
-- fl4.daddr = ip_hdr(skb)->saddr;
-- fl4.saddr = 0;
-- fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
-- fl4.flowi4_scope = scope;
-- fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0;
-- fl4.flowi4_tun_key.tun_id = 0;
-+ struct flowi4 fl4 = {
-+ .flowi4_iif = LOOPBACK_IFINDEX,
-+ .daddr = ip_hdr(skb)->saddr,
-+ .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
-+ .flowi4_scope = scope,
-+ .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
-+ };
- if (!fib_lookup(net, &fl4, &res, 0))
- return FIB_RES_PREFSRC(net, res);
- } else {
-@@ -922,6 +920,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
- subnet = 1;
- }
-
-+ if (in_dev->dead)
-+ goto no_promotions;
-+
- /* Deletion is more complicated than add.
- * We should take care of not to delete too much :-)
- *
-@@ -997,6 +998,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
- }
- }
-
-+no_promotions:
- if (!(ok & BRD_OK))
- fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
- if (subnet && ifa->ifa_prefixlen < 31) {
-diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-index c6eb421..ea91058 100644
---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this,
- unsigned long event,
- void *ptr)
- {
-- struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
-+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
- struct netdev_notifier_info info;
-
-- netdev_notifier_info_init(&info, dev);
-+ /* The masq_dev_notifier will catch the case of the device going
-+ * down. So if the inetdev is dead and being destroyed we have
-+ * no work to do. Otherwise this is an individual address removal
-+ * and we have to perform the flush.
-+ */
-+ if (idev->dead)
-+ return NOTIFY_DONE;
-+
-+ netdev_notifier_info_init(&info, idev->dev);
- return masq_device_event(this, event, &info);
- }
-
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 487ac67..a7b1a90 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -319,8 +319,6 @@ void tcp_req_err(struct sock *sk, u32 seq, bool abort)
- /* ICMPs are not backlogged, hence we cannot get
- * an established socket here.
- */
-- WARN_ON(req->sk);
--
- if (seq != tcp_rsk(req)->snt_isn) {
- NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
- } else if (abort) {
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 95d2f19..eb8933b 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -2082,10 +2082,14 @@ void udp_v4_early_demux(struct sk_buff *skb)
- if (!in_dev)
- return;
-
-- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-- iph->protocol);
-- if (!ours)
-- return;
-+ /* we are supposed to accept bcast packets */
-+ if (skb->pkt_type == PACKET_MULTICAST) {
-+ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-+ iph->protocol);
-+ if (!ours)
-+ return;
-+ }
-+
- sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
- uh->source, iph->saddr, dif);
- } else if (skb->pkt_type == PACKET_HOST) {
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index a163102..2a6606c 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- int getfrag(void *from, char *to, int offset, int len,
- int odd, struct sk_buff *skb),
- void *from, int length, int hh_len, int fragheaderlen,
-- int transhdrlen, int mtu, unsigned int flags,
-- const struct flowi6 *fl6)
-+ int exthdrlen, int transhdrlen, int mtu,
-+ unsigned int flags, const struct flowi6 *fl6)
-
- {
- struct sk_buff *skb;
-@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- skb_put(skb, fragheaderlen + transhdrlen);
-
- /* initialize network header pointer */
-- skb_reset_network_header(skb);
-+ skb_set_network_header(skb, exthdrlen);
-
- /* initialize protocol header pointer */
- skb->transport_header = skb->network_header + fragheaderlen;
-@@ -1359,7 +1359,7 @@ emsgsize:
- (rt->dst.dev->features & NETIF_F_UFO) &&
- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
- err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
-- hh_len, fragheaderlen,
-+ hh_len, fragheaderlen, exthdrlen,
- transhdrlen, mtu, flags, fl6);
- if (err)
- goto error;
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 6c5dfec..3991b21 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev)
-
- t = netdev_priv(dev);
-
-+ dev->rtnl_link_ops = &ip6_link_ops;
- err = register_netdevice(dev);
- if (err < 0)
- goto out;
-
- strcpy(t->parms.name, dev->name);
-- dev->rtnl_link_ops = &ip6_link_ops;
-
- dev_hold(dev);
- ip6_tnl_link(ip6n, t);
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 422dd01..6794120 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -883,8 +883,8 @@ start_lookup:
- flush_stack(stack, count, skb, count - 1);
- } else {
- if (!inner_flushed)
-- UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
-- proto == IPPROTO_UDPLITE);
-+ UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
-+ proto == IPPROTO_UDPLITE);
- consume_skb(skb);
- }
- return 0;
-diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index ec22078..42de4cc 100644
---- a/net/l2tp/l2tp_ip.c
-+++ b/net/l2tp/l2tp_ip.c
-@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb)
- struct l2tp_tunnel *tunnel = NULL;
- int length;
-
-- /* Point to L2TP header */
-- optr = ptr = skb->data;
--
- if (!pskb_may_pull(skb, 4))
- goto discard;
-
-+ /* Point to L2TP header */
-+ optr = ptr = skb->data;
- session_id = ntohl(*((__be32 *) ptr));
- ptr += 4;
-
-@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
- if (!pskb_may_pull(skb, length))
- goto discard;
-
-+ /* Point to L2TP header */
-+ optr = ptr = skb->data;
-+ ptr += 4;
- pr_debug("%s: ip recv\n", tunnel->name);
- print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
- }
-diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
-index a2c8747..9ee4ddb 100644
---- a/net/l2tp/l2tp_ip6.c
-+++ b/net/l2tp/l2tp_ip6.c
-@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
- struct l2tp_tunnel *tunnel = NULL;
- int length;
-
-- /* Point to L2TP header */
-- optr = ptr = skb->data;
--
- if (!pskb_may_pull(skb, 4))
- goto discard;
-
-+ /* Point to L2TP header */
-+ optr = ptr = skb->data;
- session_id = ntohl(*((__be32 *) ptr));
- ptr += 4;
-
-@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
- if (!pskb_may_pull(skb, length))
- goto discard;
-
-+ /* Point to L2TP header */
-+ optr = ptr = skb->data;
-+ ptr += 4;
- pr_debug("%s: ip recv\n", tunnel->name);
- print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
- }
-diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
-index 978d3bc..1b33d89 100644
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -7,6 +7,7 @@
- * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
- * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
- * Copyright 2013-2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2016 Intel Deutschland GmbH
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
-@@ -1485,14 +1486,21 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
-
- sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
-
-- num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
-- &ifibss->chandef,
-- channels,
-- ARRAY_SIZE(channels));
- scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
-- ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-- ifibss->ssid_len, channels, num,
-- scan_width);
-+
-+ if (ifibss->fixed_channel) {
-+ num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
-+ &ifibss->chandef,
-+ channels,
-+ ARRAY_SIZE(channels));
-+ ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-+ ifibss->ssid_len, channels,
-+ num, scan_width);
-+ } else {
-+ ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-+ ifibss->ssid_len, NULL,
-+ 0, scan_width);
-+ }
- } else {
- int interval = IEEE80211_SCAN_INTERVAL;
-
-diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index c9e325d..7a2b791 100644
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
- if (sdata->vif.txq) {
- struct txq_info *txqi = to_txq_info(sdata->vif.txq);
-
-+ spin_lock_bh(&txqi->queue.lock);
- ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
-+ spin_unlock_bh(&txqi->queue.lock);
-+
- atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
- }
-
-diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
-index 60d093f..261df74 100644
---- a/net/mac80211/rx.c
-+++ b/net/mac80211/rx.c
-@@ -2249,7 +2249,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
- struct ieee80211_local *local = rx->local;
- struct ieee80211_sub_if_data *sdata = rx->sdata;
- struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-- u16 q, hdrlen;
-+ u16 ac, q, hdrlen;
-
- hdr = (struct ieee80211_hdr *) skb->data;
- hdrlen = ieee80211_hdrlen(hdr->frame_control);
-@@ -2318,7 +2318,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
- ether_addr_equal(sdata->vif.addr, hdr->addr3))
- return RX_CONTINUE;
-
-- q = ieee80211_select_queue_80211(sdata, skb, hdr);
-+ ac = ieee80211_select_queue_80211(sdata, skb, hdr);
-+ q = sdata->vif.hw_queue[ac];
- if (ieee80211_queue_stopped(&local->hw, q)) {
- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
- return RX_DROP_MONITOR;
-diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index a4a4f89..23ed038 100644
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -257,11 +257,11 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
- }
-
- /* Caller must hold local->sta_mtx */
--static void sta_info_hash_add(struct ieee80211_local *local,
-- struct sta_info *sta)
-+static int sta_info_hash_add(struct ieee80211_local *local,
-+ struct sta_info *sta)
- {
-- rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
-- sta_rht_params);
-+ return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
-+ sta_rht_params);
- }
-
- static void sta_deliver_ps_frames(struct work_struct *wk)
-@@ -498,11 +498,17 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
- {
- struct ieee80211_local *local = sta->local;
- struct ieee80211_sub_if_data *sdata = sta->sdata;
-- struct station_info sinfo;
-+ struct station_info *sinfo;
- int err = 0;
-
- lockdep_assert_held(&local->sta_mtx);
-
-+ sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
-+ if (!sinfo) {
-+ err = -ENOMEM;
-+ goto out_err;
-+ }
-+
- /* check if STA exists already */
- if (sta_info_get_bss(sdata, sta->sta.addr)) {
- err = -EEXIST;
-@@ -517,7 +523,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
- set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-
- /* make the station visible */
-- sta_info_hash_add(local, sta);
-+ err = sta_info_hash_add(local, sta);
-+ if (err)
-+ goto out_drop_sta;
-
- list_add_tail_rcu(&sta->list, &local->sta_list);
-
-@@ -534,10 +542,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
- ieee80211_sta_debugfs_add(sta);
- rate_control_add_sta_debugfs(sta);
-
-- memset(&sinfo, 0, sizeof(sinfo));
-- sinfo.filled = 0;
-- sinfo.generation = local->sta_generation;
-- cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
-+ sinfo->generation = local->sta_generation;
-+ cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
-+ kfree(sinfo);
-
- sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
-
-@@ -552,6 +559,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
- out_remove:
- sta_info_hash_del(local, sta);
- list_del_rcu(&sta->list);
-+ out_drop_sta:
- local->num_sta--;
- synchronize_net();
- __cleanup_single_sta(sta);
-@@ -898,7 +906,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
- {
- struct ieee80211_local *local = sta->local;
- struct ieee80211_sub_if_data *sdata = sta->sdata;
-- struct station_info sinfo = {};
-+ struct station_info *sinfo;
- int ret;
-
- /*
-@@ -936,8 +944,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
-
- sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
-
-- sta_set_sinfo(sta, &sinfo);
-- cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
-+ sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
-+ if (sinfo)
-+ sta_set_sinfo(sta, sinfo);
-+ cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
-+ kfree(sinfo);
-
- rate_control_remove_sta_debugfs(sta);
- ieee80211_sta_debugfs_remove(sta);
-diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
-index b18c5ed..0b80a71 100644
---- a/net/mpls/af_mpls.c
-+++ b/net/mpls/af_mpls.c
-@@ -543,6 +543,9 @@ static struct net_device *find_outdev(struct net *net,
- if (!dev)
- return ERR_PTR(-ENODEV);
-
-+ if (IS_ERR(dev))
-+ return dev;
-+
- /* The caller is holding rtnl anyways, so release the dev reference */
- dev_put(dev);
-
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 992396a..da1ae0e1 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1916,6 +1916,10 @@ retry:
- goto retry;
- }
-
-+ if (!dev_validate_header(dev, skb->data, len)) {
-+ err = -EINVAL;
-+ goto out_unlock;
-+ }
- if (len > (dev->mtu + dev->hard_header_len + extra_len) &&
- !packet_extra_vlan_len_allowed(dev, skb)) {
- err = -EMSGSIZE;
-@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
- sock_wfree(skb);
- }
-
--static bool ll_header_truncated(const struct net_device *dev, int len)
--{
-- /* net device doesn't like empty head */
-- if (unlikely(len < dev->hard_header_len)) {
-- net_warn_ratelimited("%s: packet size is too short (%d < %d)\n",
-- current->comm, len, dev->hard_header_len);
-- return true;
-- }
--
-- return false;
--}
--
- static void tpacket_set_protocol(const struct net_device *dev,
- struct sk_buff *skb)
- {
-@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
- if (unlikely(err < 0))
- return -EINVAL;
- } else if (dev->hard_header_len) {
-- if (ll_header_truncated(dev, tp_len))
-- return -EINVAL;
-+ int hdrlen = min_t(int, dev->hard_header_len, tp_len);
-
- skb_push(skb, dev->hard_header_len);
-- err = skb_store_bits(skb, 0, data,
-- dev->hard_header_len);
-+ err = skb_store_bits(skb, 0, data, hdrlen);
- if (unlikely(err))
- return err;
-+ if (!dev_validate_header(dev, skb->data, hdrlen))
-+ return -EINVAL;
- if (!skb->protocol)
- tpacket_set_protocol(dev, skb);
-
-- data += dev->hard_header_len;
-- to_write -= dev->hard_header_len;
-+ data += hdrlen;
-+ to_write -= hdrlen;
- }
-
- offset = offset_in_page(data);
-@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
- offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
- if (unlikely(offset < 0))
- goto out_free;
-- } else {
-- if (ll_header_truncated(dev, len))
-- goto out_free;
- }
-
- /* Returns -EFAULT on error */
-@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
- if (err)
- goto out_free;
-
-+ if (sock->type == SOCK_RAW &&
-+ !dev_validate_header(dev, skb->data, len)) {
-+ err = -EINVAL;
-+ goto out_free;
-+ }
-+
- sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
-
- if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
-diff --git a/net/socket.c b/net/socket.c
-index c044d1e..db13ae8 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -2240,31 +2240,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
- cond_resched();
- }
-
--out_put:
-- fput_light(sock->file, fput_needed);
--
- if (err == 0)
-- return datagrams;
-+ goto out_put;
-
-- if (datagrams != 0) {
-+ if (datagrams == 0) {
-+ datagrams = err;
-+ goto out_put;
-+ }
-+
-+ /*
-+ * We may return less entries than requested (vlen) if the
-+ * sock is non block and there aren't enough datagrams...
-+ */
-+ if (err != -EAGAIN) {
- /*
-- * We may return less entries than requested (vlen) if the
-- * sock is non block and there aren't enough datagrams...
-+ * ... or if recvmsg returns an error after we
-+ * received some datagrams, where we record the
-+ * error to return on the next call or if the
-+ * app asks about it using getsockopt(SO_ERROR).
- */
-- if (err != -EAGAIN) {
-- /*
-- * ... or if recvmsg returns an error after we
-- * received some datagrams, where we record the
-- * error to return on the next call or if the
-- * app asks about it using getsockopt(SO_ERROR).
-- */
-- sock->sk->sk_err = -err;
-- }
--
-- return datagrams;
-+ sock->sk->sk_err = -err;
- }
-+out_put:
-+ fput_light(sock->file, fput_needed);
-
-- return err;
-+ return datagrams;
- }
-
- SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
-diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
-index ad7f5b3..1c4ad47 100644
---- a/net/xfrm/xfrm_input.c
-+++ b/net/xfrm/xfrm_input.c
-@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
- XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
-
- skb_dst_force(skb);
-+ dev_hold(skb->dev);
-
- nexthdr = x->type->input(x, skb);
-
- if (nexthdr == -EINPROGRESS)
- return 0;
- resume:
-+ dev_put(skb->dev);
-+
- spin_lock(&x->lock);
- if (nexthdr <= 0) {
- if (nexthdr == -EBADMSG) {
-diff --git a/sound/core/timer.c b/sound/core/timer.c
-index dca817f..e5e7e43 100644
---- a/sound/core/timer.c
-+++ b/sound/core/timer.c
-@@ -1041,8 +1041,8 @@ static int snd_timer_s_start(struct snd_timer * timer)
- njiff += timer->sticks - priv->correction;
- priv->correction = 0;
- }
-- priv->last_expires = priv->tlist.expires = njiff;
-- add_timer(&priv->tlist);
-+ priv->last_expires = njiff;
-+ mod_timer(&priv->tlist, njiff);
- return 0;
- }
-
-diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
-index e68fa44..0c95856 100644
---- a/sound/pci/hda/patch_hdmi.c
-+++ b/sound/pci/hda/patch_hdmi.c
-@@ -1623,6 +1623,8 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
-
- mutex_lock(&per_pin->lock);
- pin_eld->monitor_present = !!(present & AC_PINSENSE_PRESENCE);
-+ eld->monitor_present = pin_eld->monitor_present;
-+
- if (pin_eld->monitor_present)
- eld->eld_valid = !!(present & AC_PINSENSE_ELDV);
- else
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 4f5ca0b..1402ba9 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4759,6 +4759,8 @@ enum {
- ALC255_FIXUP_DELL_SPK_NOISE,
- ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
- ALC280_FIXUP_HP_HEADSET_MIC,
-+ ALC221_FIXUP_HP_FRONT_MIC,
-+ ALC292_FIXUP_TPT460,
- };
-
- static const struct hda_fixup alc269_fixups[] = {
-@@ -5401,6 +5403,19 @@ static const struct hda_fixup alc269_fixups[] = {
- .chained = true,
- .chain_id = ALC269_FIXUP_HEADSET_MIC,
- },
-+ [ALC221_FIXUP_HP_FRONT_MIC] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x19, 0x02a19020 }, /* Front Mic */
-+ { }
-+ },
-+ },
-+ [ALC292_FIXUP_TPT460] = {
-+ .type = HDA_FIXUP_FUNC,
-+ .v.func = alc_fixup_tpt440_dock,
-+ .chained = true,
-+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
-+ },
- };
-
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-@@ -5506,6 +5521,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
- SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
- SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
-+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
- SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
- SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
- SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-@@ -5554,7 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
- SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
- SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
-- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
-+ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
- SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
- SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
- SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
-@@ -5649,6 +5665,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
- {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
- {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
- {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
-+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
- {}
- };
- #define ALC225_STANDARD_PINS \
-@@ -6406,6 +6423,7 @@ enum {
- ALC668_FIXUP_AUTO_MUTE,
- ALC668_FIXUP_DELL_DISABLE_AAMIX,
- ALC668_FIXUP_DELL_XPS13,
-+ ALC662_FIXUP_ASUS_Nx50,
- };
-
- static const struct hda_fixup alc662_fixups[] = {
-@@ -6646,6 +6664,12 @@ static const struct hda_fixup alc662_fixups[] = {
- .type = HDA_FIXUP_FUNC,
- .v.func = alc_fixup_bass_chmap,
- },
-+ [ALC662_FIXUP_ASUS_Nx50] = {
-+ .type = HDA_FIXUP_FUNC,
-+ .v.func = alc_fixup_auto_mute_via_amp,
-+ .chained = true,
-+ .chain_id = ALC662_FIXUP_BASS_1A
-+ },
- };
-
- static const struct snd_pci_quirk alc662_fixup_tbl[] = {
-@@ -6668,8 +6692,9 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
-- SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
-+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
- SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
-+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
- SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
- SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
- SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
-diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
-index ddca654..1f8fb0d9 100644
---- a/sound/usb/mixer_maps.c
-+++ b/sound/usb/mixer_maps.c
-@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = {
- };
-
- /*
-+ * Dell usb dock with ALC4020 codec had a firmware problem where it got
-+ * screwed up when zero volume is passed; just skip it as a workaround
-+ */
-+static const struct usbmix_name_map dell_alc4020_map[] = {
-+ { 16, NULL },
-+ { 19, NULL },
-+ { 0 }
-+};
-+
-+/*
- * Control map entries
- */
-
-@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
- .map = aureon_51_2_map,
- },
- {
-+ .id = USB_ID(0x0bda, 0x4014),
-+ .map = dell_alc4020_map,
-+ },
-+ {
- .id = USB_ID(0x0dba, 0x1000),
- .map = mbox1_map,
- },
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index cd7eac2..001fb4d 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -1135,9 +1135,11 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
- case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
- case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
-+ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
- case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
- case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
- case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
-+ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
- case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
- return true;
- }
diff --git a/4.5.2/0000_README b/4.5.3/0000_README
similarity index 92%
rename from 4.5.2/0000_README
rename to 4.5.3/0000_README
index 53f08f8..8d5157e 100644
--- a/4.5.2/0000_README
+++ b/4.5.3/0000_README
@@ -2,11 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1001_linux-4.5.2.patch
-From: http://www.kernel.org
-Desc: Linux 4.5.2
-
-Patch: 4420_grsecurity-3.1-4.5.2-201604290633.patch
+Patch: 4420_grsecurity-3.1-4.5.3-201605080858.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch b/4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch
similarity index 99%
rename from 4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch
rename to 4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch
index 89fb9b5..c17a23a 100644
--- a/4.5.2/4420_grsecurity-3.1-4.5.2-201604290633.patch
+++ b/4.5.3/4420_grsecurity-3.1-4.5.3-201605080858.patch
@@ -408,7 +408,7 @@ index a93b414..f50a50b 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 1ecaaeb..8e81686 100644
+index 9b56a6c..98a3817 100644
--- a/Makefile
+++ b/Makefile
@@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -928,7 +928,7 @@ index 8a188bc..26608f1 100644
Counts number of I and D TLB Misses and exports them via Debugfs
The counters can be cleared via Debugfs as well
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 4f799e5..261490f 100644
+index 4f799e5..cc1200e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1622,6 +1622,7 @@ config HIGHPTE
@@ -956,6 +956,15 @@ index 4f799e5..261490f 100644
help
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
+@@ -1997,7 +1999,7 @@ config EFI_STUB
+
+ config EFI
+ bool "UEFI runtime support"
+- depends on OF && !CPU_BIG_ENDIAN && MMU && AUTO_ZRELADDR && !XIP_KERNEL
++ depends on OF && !CPU_BIG_ENDIAN && MMU && AUTO_ZRELADDR && !XIP_KERNEL && !PAX_KERNEXEC
+ select UCS2_STRING
+ select EFI_PARAMS_FROM_FDT
+ select EFI_STUB
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index c6b6175..2884505 100644
--- a/arch/arm/Kconfig.debug
@@ -1635,7 +1644,7 @@ index 3848259..bee9d84 100644
struct of_cpuidle_method {
const char *method;
diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
-index fc8ba16..0c20017 100644
+index fc8ba16..d20fbde 100644
--- a/arch/arm/include/asm/domain.h
+++ b/arch/arm/include/asm/domain.h
@@ -42,7 +42,6 @@
@@ -1681,7 +1690,7 @@ index fc8ba16..0c20017 100644
- domain_val(DOMAIN_IO, DOMAIN_CLIENT) | \
+ domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT) | \
domain_val(DOMAIN_VECTORS, DOMAIN_CLIENT))
-+#elif CONFIG_PAX_MEMORY_UDEREF
++#elif defined(CONFIG_PAX_MEMORY_UDEREF)
+ /* DOMAIN_VECTORS is defined to DOMAIN_KERNEL */
+#define DACR_INIT \
+ (domain_val(DOMAIN_USER, DOMAIN_USERCLIENT) | \
@@ -2077,6 +2086,35 @@ index 3d6dc8b..1262ad3 100644
struct of_cpu_method {
const char *method;
+diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h
+index cf4f3aa..3f68273 100644
+--- a/arch/arm/include/asm/string.h
++++ b/arch/arm/include/asm/string.h
+@@ -7,19 +7,19 @@
+ */
+
+ #define __HAVE_ARCH_STRRCHR
+-extern char * strrchr(const char * s, int c);
++extern char * strrchr(const char * s, int c) __nocapture(1);
+
+ #define __HAVE_ARCH_STRCHR
+-extern char * strchr(const char * s, int c);
++extern char * strchr(const char * s, int c) __nocapture(1);
+
+ #define __HAVE_ARCH_MEMCPY
+-extern void * memcpy(void *, const void *, __kernel_size_t);
++extern void * memcpy(void *, const void *, __kernel_size_t) __nocapture(2);
+
+ #define __HAVE_ARCH_MEMMOVE
+-extern void * memmove(void *, const void *, __kernel_size_t);
++extern void * memmove(void *, const void *, __kernel_size_t) __nocapture(2);
+
+ #define __HAVE_ARCH_MEMCHR
+-extern void * memchr(const void *, int, __kernel_size_t);
++extern void * memchr(const void *, int, __kernel_size_t) __nocapture(1);
+
+ #define __HAVE_ARCH_MEMSET
+ extern void * memset(void *, int, __kernel_size_t);
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 776757d..a552c1d 100644
--- a/arch/arm/include/asm/thread_info.h
@@ -2849,7 +2887,7 @@ index 69bda1a..755113a 100644
if (waddr != addr) {
flush_kernel_vmap_range(waddr, twopage ? size / 2 : size);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 4adfb46..1cf6cb9 100644
+index 4adfb46..65a3b13 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -114,8 +114,8 @@ void __show_regs(struct pt_regs *regs)
@@ -2872,20 +2910,7 @@ index 4adfb46..1cf6cb9 100644
/*
* Copy the initial value of the domain access control register
* from the current thread: thread->addr_limit will have been
-@@ -312,12 +312,6 @@ unsigned long get_wchan(struct task_struct *p)
- return 0;
- }
-
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long range_end = mm->brk + 0x02000000;
-- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
--}
--
- #ifdef CONFIG_MMU
- #ifdef CONFIG_KUSER_HELPERS
- /*
-@@ -333,7 +327,7 @@ static struct vm_area_struct gate_vma = {
+@@ -333,7 +333,7 @@ static struct vm_area_struct gate_vma = {
static int __init gate_vma_init(void)
{
@@ -2894,7 +2919,7 @@ index 4adfb46..1cf6cb9 100644
return 0;
}
arch_initcall(gate_vma_init);
-@@ -362,91 +356,13 @@ const char *arch_vma_name(struct vm_area_struct *vma)
+@@ -362,91 +362,13 @@ const char *arch_vma_name(struct vm_area_struct *vma)
return is_gate_vma(vma) ? "[vectors]" : NULL;
}
@@ -3459,7 +3484,7 @@ index 78c02b3..c94109a 100644
struct omap_device *omap_device_alloc(struct platform_device *pdev,
struct omap_hwmod **ohs, int oh_cnt);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
-index b6d62e4..6ba9f74 100644
+index 2af6ff6..1f2959f 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -200,10 +200,10 @@ struct omap_hwmod_soc_ops {
@@ -4703,6 +4728,62 @@ index c150539..45f5724 100644
#endif /* CONFIG_PGTABLE_LEVELS > 2 */
#if CONFIG_PGTABLE_LEVELS > 3
+diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h
+index 2eb714c..6c0fdb7 100644
+--- a/arch/arm64/include/asm/string.h
++++ b/arch/arm64/include/asm/string.h
+@@ -17,40 +17,40 @@
+ #define __ASM_STRING_H
+
+ #define __HAVE_ARCH_STRRCHR
+-extern char *strrchr(const char *, int c);
++extern char *strrchr(const char *, int c) __nocapture(1);
+
+ #define __HAVE_ARCH_STRCHR
+-extern char *strchr(const char *, int c);
++extern char *strchr(const char *, int c) __nocapture(1);
+
+ #define __HAVE_ARCH_STRCMP
+-extern int strcmp(const char *, const char *);
++extern int strcmp(const char *, const char *) __nocapture(1, 2);
+
+ #define __HAVE_ARCH_STRNCMP
+-extern int strncmp(const char *, const char *, __kernel_size_t);
++extern int strncmp(const char *, const char *, __kernel_size_t) __nocapture(1, 2);
+
+ #define __HAVE_ARCH_STRLEN
+ extern __kernel_size_t strlen(const char *);
+
+ #define __HAVE_ARCH_STRNLEN
+-extern __kernel_size_t strnlen(const char *, __kernel_size_t);
++extern __kernel_size_t strnlen(const char *, __kernel_size_t) __nocapture(1);
+
+ #define __HAVE_ARCH_MEMCPY
+-extern void *memcpy(void *, const void *, __kernel_size_t);
+-extern void *__memcpy(void *, const void *, __kernel_size_t);
++extern void *memcpy(void *, const void *, __kernel_size_t) __nocapture(2);
++extern void *__memcpy(void *, const void *, __kernel_size_t) __nocapture(2);
+
+ #define __HAVE_ARCH_MEMMOVE
+-extern void *memmove(void *, const void *, __kernel_size_t);
+-extern void *__memmove(void *, const void *, __kernel_size_t);
++extern void *memmove(void *, const void *, __kernel_size_t) __nocapture(2);
++extern void *__memmove(void *, const void *, __kernel_size_t) __nocapture(2);
+
+ #define __HAVE_ARCH_MEMCHR
+-extern void *memchr(const void *, int, __kernel_size_t);
++extern void *memchr(const void *, int, __kernel_size_t) __nocapture(1);
+
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *, int, __kernel_size_t);
+ extern void *__memset(void *, int, __kernel_size_t);
+
+ #define __HAVE_ARCH_MEMCMP
+-extern int memcmp(const void *, const void *, size_t);
++extern int memcmp(const void *, const void *, size_t) __nocapture(1, 2);
+
+
+ #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index b2ede967..865eed5 100644
--- a/arch/arm64/include/asm/uaccess.h
@@ -6848,7 +6929,7 @@ index 7e5fa09..65c1072 100644
}
#endif /* !CONFIG_NEED_MULTIPLE_NODES */
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
-index 3530376..81fb96b 100644
+index 3530376..754dde3 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -59,6 +59,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
@@ -6888,7 +6969,7 @@ index 3530376..81fb96b 100644
if (dir == DOWN) {
info.flags = VM_UNMAPPED_AREA_TOPDOWN;
-@@ -160,45 +166,34 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -160,14 +166,30 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
@@ -6919,37 +7000,6 @@ index 3530376..81fb96b 100644
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
}
}
-
--static inline unsigned long brk_rnd(void)
--{
-- unsigned long rnd = get_random_long();
--
-- rnd = rnd << PAGE_SHIFT;
-- /* 8MB for 32bit, 256MB for 64bit */
-- if (TASK_IS_32BIT_ADDR)
-- rnd = rnd & 0x7ffffful;
-- else
-- rnd = rnd & 0xffffffful;
--
-- return rnd;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long base = mm->brk;
-- unsigned long ret;
--
-- ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < mm->brk)
-- return mm->brk;
--
-- return ret;
--}
--
- int __virt_addr_valid(const volatile void *kaddr)
- {
- return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c
index a2358b4..7cead4f 100644
--- a/arch/mips/sgi-ip27/ip27-nmi.c
@@ -8774,7 +8824,7 @@ index 2c01665..85a54a8 100644
sechdrs, module);
#endif
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 54ed9c7..f7d6e72 100644
+index 54ed9c7..681162e 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1185,8 +1185,8 @@ void show_regs(struct pt_regs * regs)
@@ -8810,11 +8860,10 @@ index 54ed9c7..f7d6e72 100644
regs->trap, (void *)regs->nip, (void *)lr);
firstframe = 1;
}
-@@ -1754,49 +1754,3 @@ void notrace __ppc64_runlatch_off(void)
- mtspr(SPRN_CTRLT, ctrl);
+@@ -1755,13 +1755,6 @@ void notrace __ppc64_runlatch_off(void)
}
#endif /* CONFIG_PPC64 */
--
+
-unsigned long arch_align_stack(unsigned long sp)
-{
- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
@@ -8822,44 +8871,9 @@ index 54ed9c7..f7d6e72 100644
- return sp & ~0xf;
-}
-
--static inline unsigned long brk_rnd(void)
--{
-- unsigned long rnd = 0;
--
-- /* 8MB for 32bit, 1GB for 64bit */
-- if (is_32bit_task())
-- rnd = (get_random_long() % (1UL<<(23-PAGE_SHIFT)));
-- else
-- rnd = (get_random_long() % (1UL<<(30-PAGE_SHIFT)));
--
-- return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long base = mm->brk;
-- unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
-- /*
-- * If we are using 1TB segments and we are allowed to randomise
-- * the heap, we can put it above 1TB so it is backed by a 1TB
-- * segment. Otherwise the heap will be in the bottom 1TB
-- * which always uses 256MB segments and this may result in a
-- * performance penalty.
-- */
-- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
-- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
-- ret = PAGE_ALIGN(base + brk_rnd());
--
-- if (ret < mm->brk)
-- return mm->brk;
--
-- return ret;
--}
--
+ static inline unsigned long brk_rnd(void)
+ {
+ unsigned long rnd = 0;
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 30a03c0..e2d507b 100644
--- a/arch/powerpc/kernel/ptrace.c
@@ -9447,14 +9461,13 @@ index 7873e17..d21af5b 100644
if (r_type == R_390_GOTPC)
rc = apply_rela_bits(loc, val, 1, 32, 0);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index 2bba7df..587489f 100644
+index 2bba7df..8f1e6b5 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
-@@ -233,23 +233,3 @@ unsigned long get_wchan(struct task_struct *p)
- }
+@@ -234,13 +234,6 @@ unsigned long get_wchan(struct task_struct *p)
return 0;
}
--
+
-unsigned long arch_align_stack(unsigned long sp)
-{
- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
@@ -9462,18 +9475,9 @@ index 2bba7df..587489f 100644
- return sp & ~0xf;
-}
-
--static inline unsigned long brk_rnd(void)
--{
-- return (get_random_int() & BRK_RND_MASK) << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
-- unsigned long ret;
--
-- ret = PAGE_ALIGN(mm->brk + brk_rnd());
-- return (ret > mm->brk) ? ret : mm->brk;
--}
+ static inline unsigned long brk_rnd(void)
+ {
+ return (get_random_int() & BRK_RND_MASK) << PAGE_SHIFT;
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 45c4daa..42703fb 100644
--- a/arch/s390/mm/mmap.c
@@ -12928,6 +12932,22 @@ index db75d07..8e6d0af 100644
struct biosregs ireg, oreg;
struct e820entry *desc = boot_params.e820_map;
static struct e820entry buf; /* static so it is zeroed */
+diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h
+index 725e820..d7ea2759 100644
+--- a/arch/x86/boot/string.h
++++ b/arch/x86/boot/string.h
+@@ -6,9 +6,9 @@
+ #undef memset
+ #undef memcmp
+
+-void *memcpy(void *dst, const void *src, size_t len);
++void *memcpy(void *dst, const void *src, size_t len) __nocapture(2);
+ void *memset(void *dst, int c, size_t len);
+-int memcmp(const void *s1, const void *s2, size_t len);
++int memcmp(const void *s1, const void *s2, size_t len) __nocapture(1, 2);
+
+ /*
+ * Access builtin version by default. If one needs to use optimized version,
diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
index ba3e100..6501b8f 100644
--- a/arch/x86/boot/video-vesa.c
@@ -14663,23 +14683,6 @@ index 3643dd5..17d5e30 100644
u128 ivs[SERPENT_PARALLEL_BLOCKS - 1];
unsigned int j;
-diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
-index a841e97..8381c09d 100644
---- a/arch/x86/crypto/sha-mb/sha1_mb.c
-+++ b/arch/x86/crypto/sha-mb/sha1_mb.c
-@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
-
- req = cast_mcryptd_ctx_to_req(req_ctx);
- if (irqs_disabled())
-- rctx->complete(&req->base, ret);
-+ req_ctx->complete(&req->base, ret);
- else {
- local_bh_disable();
-- rctx->complete(&req->base, ret);
-+ req_ctx->complete(&req->base, ret);
- local_bh_enable();
- }
- }
diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
index a410950..02d2056 100644
--- a/arch/x86/crypto/sha1_ssse3_asm.S
@@ -19979,6 +19982,19 @@ index 77a99ac..39ff7f5 100644
+extern void machine_emergency_restart(void) __noreturn;
#endif /* _ASM_X86_EMERGENCY_RESTART_H */
+diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
+index 6d7d0e5..bce15a1 100644
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -142,7 +142,7 @@ extern pgprot_t kmap_prot;
+ extern pte_t *pkmap_page_table;
+
+ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte);
+-void native_set_fixmap(enum fixed_addresses idx,
++void native_set_fixmap(unsigned int idx,
+ phys_addr_t phys, pgprot_t flags);
+
+ #ifndef CONFIG_PARAVIRT
diff --git a/arch/x86/include/asm/floppy.h b/arch/x86/include/asm/floppy.h
index 1c7eefe..d0e4702 100644
--- a/arch/x86/include/asm/floppy.h
@@ -22650,6 +22666,103 @@ index 70bbe39..4ae2bd4 100644
};
void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
+diff --git a/arch/x86/include/asm/string_32.h b/arch/x86/include/asm/string_32.h
+index 3d3e835..5cc6d8d 100644
+--- a/arch/x86/include/asm/string_32.h
++++ b/arch/x86/include/asm/string_32.h
+@@ -6,25 +6,25 @@
+ /* Let gcc decide whether to inline or use the out of line functions */
+
+ #define __HAVE_ARCH_STRCPY
+-extern char *strcpy(char *dest, const char *src);
++extern char *strcpy(char *dest, const char *src) __nocapture(2);
+
+ #define __HAVE_ARCH_STRNCPY
+-extern char *strncpy(char *dest, const char *src, size_t count);
++extern char *strncpy(char *dest, const char *src, size_t count) __nocapture(2);
+
+ #define __HAVE_ARCH_STRCAT
+-extern char *strcat(char *dest, const char *src);
++extern char *strcat(char *dest, const char *src) __nocapture(2);
+
+ #define __HAVE_ARCH_STRNCAT
+-extern char *strncat(char *dest, const char *src, size_t count);
++extern char *strncat(char *dest, const char *src, size_t count) __nocapture(2);
+
+ #define __HAVE_ARCH_STRCMP
+-extern int strcmp(const char *cs, const char *ct);
++extern int strcmp(const char *cs, const char *ct) __nocapture(1, 2);
+
+ #define __HAVE_ARCH_STRNCMP
+-extern int strncmp(const char *cs, const char *ct, size_t count);
++extern int strncmp(const char *cs, const char *ct, size_t count) __nocapture(1, 2);
+
+ #define __HAVE_ARCH_STRCHR
+-extern char *strchr(const char *s, int c);
++extern char *strchr(const char *s, int c) __nocapture(1);
+
+ #define __HAVE_ARCH_STRLEN
+ extern size_t strlen(const char *s);
+@@ -197,12 +197,12 @@ static inline void *__memcpy3d(void *to, const void *from, size_t len)
+ #endif
+
+ #define __HAVE_ARCH_MEMMOVE
+-void *memmove(void *dest, const void *src, size_t n);
++void *memmove(void *dest, const void *src, size_t n) __nocapture(2);
+
+ #define memcmp __builtin_memcmp
+
+ #define __HAVE_ARCH_MEMCHR
+-extern void *memchr(const void *cs, int c, size_t count);
++extern void *memchr(const void *cs, int c, size_t count) __nocapture(1);
+
+ static inline void *__memset_generic(void *s, char c, size_t count)
+ {
+@@ -247,7 +247,7 @@ extern size_t strnlen(const char *s, size_t count);
+ /* end of additional stuff */
+
+ #define __HAVE_ARCH_STRSTR
+-extern char *strstr(const char *cs, const char *ct);
++extern char *strstr(const char *cs, const char *ct) __nocapture(1, 2);
+
+ /*
+ * This looks horribly ugly, but the compiler can optimize it totally,
+diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h
+index ff8b9a1..01d4b80 100644
+--- a/arch/x86/include/asm/string_64.h
++++ b/arch/x86/include/asm/string_64.h
+@@ -27,8 +27,8 @@ static __always_inline void *__inline_memcpy(void *to, const void *from, size_t
+ function. */
+
+ #define __HAVE_ARCH_MEMCPY 1
+-extern void *memcpy(void *to, const void *from, size_t len);
+-extern void *__memcpy(void *to, const void *from, size_t len);
++extern void *memcpy(void *to, const void *from, size_t len) __nocapture(2);
++extern void *__memcpy(void *to, const void *from, size_t len) __nocapture(2);
+
+ #ifndef CONFIG_KMEMCHECK
+ #if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4
+@@ -56,14 +56,14 @@ void *memset(void *s, int c, size_t n);
+ void *__memset(void *s, int c, size_t n);
+
+ #define __HAVE_ARCH_MEMMOVE
+-void *memmove(void *dest, const void *src, size_t count);
+-void *__memmove(void *dest, const void *src, size_t count);
++void *memmove(void *dest, const void *src, size_t count) __nocapture(2);
++void *__memmove(void *dest, const void *src, size_t count) __nocapture(2);
+
+-int memcmp(const void *cs, const void *ct, size_t count);
++int memcmp(const void *cs, const void *ct, size_t count) __nocapture(1, 2);
+ size_t strlen(const char *s);
+-char *strcpy(char *dest, const char *src);
+-char *strcat(char *dest, const char *src);
+-int strcmp(const char *cs, const char *ct);
++char *strcpy(char *dest, const char *src) __nocapture(2);
++char *strcat(char *dest, const char *src) __nocapture(2);
++int strcmp(const char *cs, const char *ct) __nocapture(1, 2);
+
+ #if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__)
+
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index 751bf4b..a1278b5 100644
--- a/arch/x86/include/asm/switch_to.h
@@ -24455,7 +24568,7 @@ index f316e34..48c21c5 100644
static int cmdline_apic __initdata;
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
-index ad59d70..c3570b7 100644
+index ef49551..ba2e857 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -37,6 +37,7 @@ static struct irq_chip lapic_controller;
@@ -28859,20 +28972,48 @@ index 6d9582e..f746287 100644
return;
}
diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
-index 33ee3e0..da3519a 100644
+index 33ee3e0..ca43dee 100644
--- a/arch/x86/kernel/paravirt-spinlocks.c
+++ b/arch/x86/kernel/paravirt-spinlocks.c
-@@ -23,7 +23,7 @@ bool pv_is_native_spin_unlock(void)
+@@ -23,16 +23,32 @@ bool pv_is_native_spin_unlock(void)
}
#endif
-struct pv_lock_ops pv_lock_ops = {
++#ifdef CONFIG_SMP
++#ifdef CONFIG_QUEUED_SPINLOCKS
++static void native_wait(u8 *ptr, u8 val)
++{
++}
++
++static void native_kick(int cpu)
++{
++}
++//#else /* !CONFIG_QUEUED_SPINLOCKS */
++static void native_unlock_kick(struct arch_spinlock *lock, __ticket_t ticket)
++{
++}
++#endif /* !CONFIG_QUEUED_SPINLOCKS */
++#endif /* SMP */
++
+struct pv_lock_ops pv_lock_ops __read_only = {
#ifdef CONFIG_SMP
#ifdef CONFIG_QUEUED_SPINLOCKS
.queued_spin_lock_slowpath = native_queued_spin_lock_slowpath,
+ .queued_spin_unlock = PV_CALLEE_SAVE(__native_queued_spin_unlock),
+- .wait = paravirt_nop,
+- .kick = paravirt_nop,
++ .wait = native_wait,
++ .kick = native_kick,
+ #else /* !CONFIG_QUEUED_SPINLOCKS */
+ .lock_spinning = __PV_IS_CALLEE_SAVE(paravirt_nop),
+- .unlock_kick = paravirt_nop,
++ .unlock_kick = native_unlock_kick,
+ #endif /* !CONFIG_QUEUED_SPINLOCKS */
+ #endif /* SMP */
+ };
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index f08ac28..0151389 100644
+index f08ac28..4599189 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -64,6 +64,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -28947,16 +29088,54 @@ index f08ac28..0151389 100644
.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -324,7 +331,7 @@ __visible struct pv_irq_ops pv_irq_ops = {
+@@ -324,7 +331,23 @@ __visible struct pv_irq_ops pv_irq_ops = {
#endif
};
-__visible struct pv_cpu_ops pv_cpu_ops = {
++static void native_alloc_ldt(struct desc_struct *ldt, unsigned entries)
++{
++}
++
++static void native_free_ldt(struct desc_struct *ldt, unsigned entries)
++{
++}
++
++static void native_start_context_switch(struct task_struct *prev)
++{
++}
++
++static void native_end_context_switch(struct task_struct *next)
++{
++}
++
+__visible struct pv_cpu_ops pv_cpu_ops __read_only = {
.cpuid = native_cpuid,
.get_debugreg = native_get_debugreg,
.set_debugreg = native_set_debugreg,
-@@ -379,15 +386,20 @@ NOKPROBE_SYMBOL(native_get_debugreg);
+@@ -356,8 +379,8 @@ __visible struct pv_cpu_ops pv_cpu_ops = {
+ .write_gdt_entry = native_write_gdt_entry,
+ .write_idt_entry = native_write_idt_entry,
+
+- .alloc_ldt = paravirt_nop,
+- .free_ldt = paravirt_nop,
++ .alloc_ldt = native_alloc_ldt,
++ .free_ldt = native_free_ldt,
+
+ .load_sp0 = native_load_sp0,
+
+@@ -370,8 +393,8 @@ __visible struct pv_cpu_ops pv_cpu_ops = {
+ .set_iopl_mask = native_set_iopl_mask,
+ .io_delay = native_io_delay,
+
+- .start_context_switch = paravirt_nop,
+- .end_context_switch = paravirt_nop,
++ .start_context_switch = native_start_context_switch,
++ .end_context_switch = native_end_context_switch,
+ };
+
+ /* At this point, native_get/set_debugreg has real function entries */
+@@ -379,15 +402,64 @@ NOKPROBE_SYMBOL(native_get_debugreg);
NOKPROBE_SYMBOL(native_set_debugreg);
NOKPROBE_SYMBOL(native_load_idt);
@@ -28975,11 +29154,84 @@ index f08ac28..0151389 100644
#endif
-struct pv_mmu_ops pv_mmu_ops = {
++static void native_pgd_free(struct mm_struct *mm, pgd_t *pgd)
++{
++}
++
++static void native_alloc_pte(struct mm_struct *mm, unsigned long pfn)
++{
++}
++
++static void native_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
++{
++}
++
++static void native_alloc_pud(struct mm_struct *mm, unsigned long pfn)
++{
++}
++
++static void native_release_pte(unsigned long pfn)
++{
++}
++
++static void native_release_pmd(unsigned long pfn)
++{
++}
++
++static void native_release_pud(unsigned long pfn)
++{
++}
++
++static void native_pte_update(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
++{
++}
++
++static void native_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
++{
++}
++
++static void native_exit_mmap(struct mm_struct *mm)
++{
++}
++
++static void native_activate_mm(struct mm_struct *prev, struct mm_struct *next)
++{
++}
++
+struct pv_mmu_ops pv_mmu_ops __read_only = {
.read_cr2 = native_read_cr2,
.write_cr2 = native_write_cr2,
-@@ -434,6 +446,7 @@ struct pv_mmu_ops pv_mmu_ops = {
+@@ -400,20 +472,20 @@ struct pv_mmu_ops pv_mmu_ops = {
+ .flush_tlb_others = native_flush_tlb_others,
+
+ .pgd_alloc = __paravirt_pgd_alloc,
+- .pgd_free = paravirt_nop,
++ .pgd_free = native_pgd_free,
+
+- .alloc_pte = paravirt_nop,
+- .alloc_pmd = paravirt_nop,
+- .alloc_pud = paravirt_nop,
+- .release_pte = paravirt_nop,
+- .release_pmd = paravirt_nop,
+- .release_pud = paravirt_nop,
++ .alloc_pte = native_alloc_pte,
++ .alloc_pmd = native_alloc_pmd,
++ .alloc_pud = native_alloc_pud,
++ .release_pte = native_release_pte,
++ .release_pmd = native_release_pmd,
++ .release_pud = native_release_pud,
+
+ .set_pte = native_set_pte,
+ .set_pte_at = native_set_pte_at,
+ .set_pmd = native_set_pmd,
+ .set_pmd_at = native_set_pmd_at,
+- .pte_update = paravirt_nop,
++ .pte_update = native_pte_update,
+
+ .ptep_modify_prot_start = __ptep_modify_prot_start,
+ .ptep_modify_prot_commit = __ptep_modify_prot_commit,
+@@ -434,6 +506,7 @@ struct pv_mmu_ops pv_mmu_ops = {
.make_pud = PTE_IDENT,
.set_pgd = native_set_pgd,
@@ -28987,7 +29239,20 @@ index f08ac28..0151389 100644
#endif
#endif /* CONFIG_PGTABLE_LEVELS >= 3 */
-@@ -454,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+@@ -443,9 +516,9 @@ struct pv_mmu_ops pv_mmu_ops = {
+ .make_pte = PTE_IDENT,
+ .make_pgd = PTE_IDENT,
+
+- .dup_mmap = paravirt_nop,
+- .exit_mmap = paravirt_nop,
+- .activate_mm = paravirt_nop,
++ .dup_mmap = native_dup_mmap,
++ .exit_mmap = native_exit_mmap,
++ .activate_mm = native_activate_mm,
+
+ .lazy_mode = {
+ .enter = paravirt_nop,
+@@ -454,6 +527,12 @@ struct pv_mmu_ops pv_mmu_ops = {
},
.set_fixmap = native_set_fixmap,
@@ -31513,10 +31778,10 @@ index 539062e..0aa69ab 100644
.disabled_by_bios = vmx_disabled_by_bios,
.hardware_setup = hardware_setup,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index eca5bd9..5cf1b68 100644
+index ac4963c..902039d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -1945,8 +1945,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1944,8 +1944,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
{
struct kvm *kvm = vcpu->kvm;
int lm = is_long_mode(vcpu);
@@ -31527,7 +31792,7 @@ index eca5bd9..5cf1b68 100644
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u32 page_num = data & ~PAGE_MASK;
-@@ -2647,6 +2647,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2646,6 +2646,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
@@ -31536,7 +31801,7 @@ index eca5bd9..5cf1b68 100644
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
-@@ -3047,7 +3049,7 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
+@@ -3046,7 +3048,7 @@ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
{
@@ -31545,7 +31810,7 @@ index eca5bd9..5cf1b68 100644
u64 xstate_bv = xsave->header.xfeatures;
u64 valid;
-@@ -3083,7 +3085,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
+@@ -3082,7 +3084,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
{
@@ -31554,7 +31819,7 @@ index eca5bd9..5cf1b68 100644
u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET);
u64 valid;
-@@ -3127,7 +3129,7 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
+@@ -3126,7 +3128,7 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
fill_xsave((u8 *) guest_xsave->region, vcpu);
} else {
memcpy(guest_xsave->region,
@@ -31563,7 +31828,7 @@ index eca5bd9..5cf1b68 100644
sizeof(struct fxregs_state));
*(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)] =
XFEATURE_MASK_FPSSE;
-@@ -3152,7 +3154,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
+@@ -3151,7 +3153,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
} else {
if (xstate_bv & ~XFEATURE_MASK_FPSSE)
return -EINVAL;
@@ -31572,7 +31837,7 @@ index eca5bd9..5cf1b68 100644
guest_xsave->region, sizeof(struct fxregs_state));
}
return 0;
-@@ -6422,6 +6424,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
+@@ -6421,6 +6423,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
* exiting to the userspace. Otherwise, the value will be returned to the
* userspace.
*/
@@ -31580,7 +31845,7 @@ index eca5bd9..5cf1b68 100644
static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
{
int r;
-@@ -6686,6 +6689,7 @@ out:
+@@ -6687,6 +6690,7 @@ out:
return r;
}
@@ -31588,7 +31853,7 @@ index eca5bd9..5cf1b68 100644
static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
{
if (!kvm_arch_vcpu_runnable(vcpu) &&
-@@ -7233,7 +7237,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
+@@ -7234,7 +7238,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
{
struct fxregs_state *fxsave =
@@ -31597,7 +31862,7 @@ index eca5bd9..5cf1b68 100644
memcpy(fpu->fpr, fxsave->st_space, 128);
fpu->fcw = fxsave->cwd;
-@@ -7250,7 +7254,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+@@ -7251,7 +7255,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
{
struct fxregs_state *fxsave =
@@ -31606,7 +31871,7 @@ index eca5bd9..5cf1b68 100644
memcpy(fxsave->st_space, fpu->fpr, 128);
fxsave->cwd = fpu->fcw;
-@@ -7266,9 +7270,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+@@ -7267,9 +7271,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
static void fx_init(struct kvm_vcpu *vcpu)
{
@@ -31619,7 +31884,7 @@ index eca5bd9..5cf1b68 100644
/*
@@ -7292,7 +7296,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
- kvm_put_guest_xcr0(vcpu);
+ */
vcpu->guest_fpu_loaded = 1;
__kernel_fpu_begin();
- __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state);
@@ -31627,7 +31892,7 @@ index eca5bd9..5cf1b68 100644
trace_kvm_fpu(1);
}
-@@ -7595,6 +7599,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+@@ -7593,6 +7597,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
struct static_key kvm_no_apic_vcpu __read_mostly;
@@ -31636,7 +31901,7 @@ index eca5bd9..5cf1b68 100644
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
{
struct page *page;
-@@ -7612,11 +7618,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+@@ -7610,11 +7616,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
else
vcpu->arch.mp_state = KVM_MP_STATE_UNINITIALIZED;
@@ -31655,7 +31920,7 @@ index eca5bd9..5cf1b68 100644
vcpu->arch.pio_data = page_address(page);
kvm_set_tsc_khz(vcpu, max_tsc_khz);
-@@ -7674,6 +7683,9 @@ fail_mmu_destroy:
+@@ -7672,6 +7681,9 @@ fail_mmu_destroy:
kvm_mmu_destroy(vcpu);
fail_free_pio_data:
free_page((unsigned long)vcpu->arch.pio_data);
@@ -31665,7 +31930,7 @@ index eca5bd9..5cf1b68 100644
fail:
return r;
}
-@@ -7692,6 +7704,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu)
+@@ -7690,6 +7702,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu)
free_page((unsigned long)vcpu->arch.pio_data);
if (!lapic_in_kernel(vcpu))
static_key_slow_dec(&kvm_no_apic_vcpu);
@@ -34338,7 +34603,7 @@ index 903ec1e..41b4708 100644
}
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index e830c71..f7e9e6c 100644
+index e830c71..2c3c46a 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -14,6 +14,8 @@
@@ -34595,7 +34860,7 @@ index e830c71..f7e9e6c 100644
code = BUS_MCEERR_AR;
}
#endif
-@@ -927,6 +1039,107 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
+@@ -927,6 +1039,109 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
return 1;
}
@@ -34689,7 +34954,9 @@ index e830c71..f7e9e6c 100644
+ */
+ "invlpg (%0)\n"
+#endif
++ ASM_STAC "\n"
+ __copyuser_seg"testb $0,(%0)\n"
++ ASM_CLAC "\n"
+ "xorb %3,(%1)\n"
+ :
+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
@@ -34703,7 +34970,7 @@ index e830c71..f7e9e6c 100644
/*
* Handle a spurious fault caused by a stale TLB entry.
*
-@@ -1012,6 +1225,9 @@ int show_unhandled_signals = 1;
+@@ -1012,6 +1227,9 @@ int show_unhandled_signals = 1;
static inline int
access_error(unsigned long error_code, struct vm_area_struct *vma)
{
@@ -34713,7 +34980,7 @@ index e830c71..f7e9e6c 100644
if (error_code & PF_WRITE) {
/* write, present and write, not present: */
if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -1074,6 +1290,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
+@@ -1074,6 +1292,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
tsk = current;
mm = tsk->mm;
@@ -34736,7 +35003,7 @@ index e830c71..f7e9e6c 100644
/*
* Detect and handle instructions that would cause a page fault for
* both a tracked kernel page and a userspace page.
-@@ -1198,6 +1430,11 @@ retry:
+@@ -1198,6 +1432,11 @@ retry:
might_sleep();
}
@@ -34748,7 +35015,7 @@ index e830c71..f7e9e6c 100644
vma = find_vma(mm, address);
if (unlikely(!vma)) {
bad_area(regs, error_code, address);
-@@ -1209,18 +1446,24 @@ retry:
+@@ -1209,18 +1448,24 @@ retry:
bad_area(regs, error_code, address);
return;
}
@@ -34784,7 +35051,7 @@ index e830c71..f7e9e6c 100644
if (unlikely(expand_stack(vma, address))) {
bad_area(regs, error_code, address);
return;
-@@ -1340,3 +1583,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1340,3 +1585,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
}
NOKPROBE_SYMBOL(trace_do_page_fault);
#endif /* CONFIG_TRACING */
@@ -36364,7 +36631,7 @@ index 9f0614d..92ae64a 100644
p += get_opcode(p, &opcode);
for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index 4eb287e..e91945b 100644
+index 4eb287e..a021315 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -98,10 +98,75 @@ static inline void pgd_list_del(pgd_t *pgd)
@@ -36703,14 +36970,18 @@ index 4eb287e..e91945b 100644
void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
{
unsigned long address = __fix_to_virt(idx);
-@@ -536,6 +652,7 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
+@@ -536,9 +652,10 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
}
set_pte_vaddr(address, pte);
fixmaps_set++;
+ fix_user_fixmap(idx, address);
}
- void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys,
+-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys,
++void native_set_fixmap(unsigned int idx, phys_addr_t phys,
+ pgprot_t flags)
+ {
+ __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags));
@@ -602,9 +719,11 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
prot = pgprot_4k_2_large(prot);
@@ -38359,7 +38630,7 @@ index e3679db..16b93d1 100644
#ifdef CONFIG_ACPI_NUMA
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index c913ca4..b6d8c05 100644
+index c913ca4..a314c65 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1950,7 +1950,11 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
@@ -38406,7 +38677,27 @@ index c913ca4..b6d8c05 100644
#endif
/* This will work as long as patching hasn't happened yet
-@@ -2472,6 +2488,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+@@ -2423,6 +2439,10 @@ static void xen_leave_lazy_mmu(void)
+ preempt_enable();
+ }
+
++static void xen_pte_update(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
++{
++}
++
+ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ .read_cr2 = xen_read_cr2,
+ .write_cr2 = xen_write_cr2,
+@@ -2435,7 +2455,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ .flush_tlb_single = xen_flush_tlb_single,
+ .flush_tlb_others = xen_flush_tlb_others,
+
+- .pte_update = paravirt_nop,
++ .pte_update = xen_pte_update,
+
+ .pgd_alloc = xen_pgd_alloc,
+ .pgd_free = xen_pgd_free,
+@@ -2472,6 +2492,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
.pud_val = PV_CALLEE_SAVE(xen_pud_val),
.make_pud = PV_CALLEE_SAVE(xen_make_pud),
.set_pgd = xen_set_pgd_hyper,
@@ -40740,7 +41031,7 @@ index 279e539..b87ed03 100644
static void platform_msi_free_descs(struct device *dev, int base, int nvec)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
-index 301b785..82070c6 100644
+index 0caf92a..cff4879 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1804,8 +1804,10 @@ int genpd_dev_pm_attach(struct device *dev)
@@ -42580,6 +42871,31 @@ index e496dae..3db53b6 100644
{
.ident = "Sony Vaio",
.matches = {
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 2521425..10e45de 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -74,6 +74,11 @@ static void tpm_dev_release(struct device *dev)
+ kfree(chip);
+ }
+
++static void tpm_put_device(void *dev)
++{
++ put_device(dev);
++}
++
+ /**
+ * tpmm_chip_alloc() - allocate a new struct tpm_chip instance
+ * @dev: device to which the chip is associated
+@@ -136,7 +141,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
+ chip->cdev.owner = chip->pdev->driver->owner;
+ chip->cdev.kobj.parent = &chip->dev.kobj;
+
+- devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev);
++ devm_add_action(dev, tpm_put_device, &chip->dev);
+
+ return chip;
+ }
diff --git a/drivers/char/tpm/tpm_acpi.c b/drivers/char/tpm/tpm_acpi.c
index 565a947..dcdc06e 100644
--- a/drivers/char/tpm/tpm_acpi.c
@@ -43004,7 +43320,7 @@ index eae5107..26e7a39 100644
}
EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index cd83d47..3d6afab 100644
+index e895123..05de99b 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -141,13 +141,13 @@ struct pstate_funcs {
@@ -43084,7 +43400,7 @@ index cd83d47..3d6afab 100644
const char *buf, size_t count)
{
unsigned int input;
-@@ -850,19 +850,19 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
+@@ -855,19 +855,19 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
cpu->pstate.current_pstate = pstate;
@@ -43112,7 +43428,7 @@ index cd83d47..3d6afab 100644
intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false);
}
-@@ -1016,7 +1016,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
+@@ -1021,7 +1021,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
from = cpu->pstate.current_pstate;
@@ -43121,7 +43437,7 @@ index cd83d47..3d6afab 100644
intel_pstate_set_pstate(cpu, target_pstate, true);
-@@ -1249,15 +1249,15 @@ static unsigned int force_load;
+@@ -1254,15 +1254,15 @@ static unsigned int force_load;
static int intel_pstate_msrs_not_valid(void)
{
@@ -43141,7 +43457,7 @@ index cd83d47..3d6afab 100644
{
pid_params.sample_rate_ms = policy->sample_rate_ms;
pid_params.p_gain_pct = policy->p_gain_pct;
-@@ -1269,15 +1269,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -1274,15 +1274,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
static void copy_cpu_funcs(struct pstate_funcs *funcs)
{
@@ -43402,34 +43718,6 @@ index 832a2c3..1794080 100644
.attrs = cpuidle_default_attrs,
.name = "cpuidle",
};
-diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
-index 3d9acc5..60fc0fa 100644
---- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
-+++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
-@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
- struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
- struct ccp_aes_cmac_exp_ctx state;
-
-+ /* Don't let anything leak to 'out' */
-+ memset(&state, 0, sizeof(state));
-+
- state.null_msg = rctx->null_msg;
- memcpy(state.iv, rctx->iv, sizeof(state.iv));
- state.buf_count = rctx->buf_count;
-diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
-index 8ef06fa..ab9945f 100644
---- a/drivers/crypto/ccp/ccp-crypto-sha.c
-+++ b/drivers/crypto/ccp/ccp-crypto-sha.c
-@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out)
- struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
- struct ccp_sha_exp_ctx state;
-
-+ /* Don't let anything leak to 'out' */
-+ memset(&state, 0, sizeof(state));
-+
- state.type = rctx->type;
- state.msg_bits = rctx->msg_bits;
- state.first = rctx->first;
diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
index eee2c7e..268aa3e 100644
--- a/drivers/crypto/hifn_795x.c
@@ -44176,10 +44464,10 @@ index d425374..1da1716 100644
EXPORT_SYMBOL_GPL(cper_next_record_id);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
-index 2cd37da..8bcbe8b 100644
+index c51f3b2..d1cc54e 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
-@@ -176,14 +176,16 @@ static struct attribute_group efi_subsys_attr_group = {
+@@ -176,15 +176,17 @@ static struct attribute_group efi_subsys_attr_group = {
};
static struct efivars generic_efivars;
@@ -44190,11 +44478,13 @@ index 2cd37da..8bcbe8b 100644
{
- generic_ops.get_variable = efi.get_variable;
- generic_ops.set_variable = efi.set_variable;
+- generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking;
- generic_ops.get_next_variable = efi.get_next_variable;
- generic_ops.query_variable_store = efi_query_variable_store;
+ pax_open_kernel();
+ *(void **)&generic_ops.get_variable = efi.get_variable;
+ *(void **)&generic_ops.set_variable = efi.set_variable;
++ *(void **)&generic_ops.set_variable_nonblocking = efi.set_variable_nonblocking;
+ *(void **)&generic_ops.get_next_variable = efi.get_next_variable;
+ *(void **)&generic_ops.query_variable_store = efi_query_variable_store;
+ pax_close_kernel();
@@ -44421,10 +44711,10 @@ index 5c1ba87..ab4a059 100644
/*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-index 5e7770f..a84a2c6 100644
+index ff29975..a7fe398 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-@@ -1733,7 +1733,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor);
+@@ -1734,7 +1734,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor);
* amdgpu smumgr functions
*/
struct amdgpu_smumgr_funcs {
@@ -44433,7 +44723,7 @@ index 5e7770f..a84a2c6 100644
int (*request_smu_load_fw)(struct amdgpu_device *adev);
int (*request_smu_specific_fw)(struct amdgpu_device *adev, uint32_t fwtype);
};
-@@ -2345,7 +2345,7 @@ static inline void amdgpu_unregister_atpx_handler(void) {}
+@@ -2346,7 +2346,7 @@ static inline void amdgpu_unregister_atpx_handler(void) {}
* KMS
*/
extern const struct drm_ioctl_desc amdgpu_ioctls_kms[];
@@ -44443,7 +44733,7 @@ index 5e7770f..a84a2c6 100644
int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags);
int amdgpu_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-index 81dc6b6..2762d6b 100644
+index 3c89586..14cfa09 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -493,7 +493,7 @@ static int amdgpu_atpx_init(void)
@@ -44588,10 +44878,10 @@ index 119cdc2..fd6698c 100644
{
struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-index d6c68d0..ea00f37 100644
+index 51bfc11..4d4112a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-@@ -1091,7 +1091,7 @@ static bool amdgpu_switcheroo_can_switch(struct pci_dev *pdev)
+@@ -1085,7 +1085,7 @@ static bool amdgpu_switcheroo_can_switch(struct pci_dev *pdev)
* locking inversion with the driver load path. And the access here is
* completely racy anyway. So don't bother with locking for now.
*/
@@ -44654,7 +44944,7 @@ index 9ef1db8..bfd5d78 100644
}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
-index e23843f..9ecc6f3 100644
+index 4488e82..9b87225 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -749,4 +749,4 @@ const struct drm_ioctl_desc amdgpu_ioctls_kms[] = {
@@ -45704,25 +45994,19 @@ index 813ef23..17928d6 100644
{
struct drm_device *dev = connector->dev;
diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
-index 7cd87a0..be562ce 100644
+index 7cd87a0..1ccc140 100644
--- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
+++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
-@@ -120,9 +120,14 @@ static void dsi_set_pipe_plane_enable_state(struct drm_device *dev,
- u32 pipeconf_reg = PIPEACONF;
- u32 dspcntr_reg = DSPACNTR;
-
-- u32 dspcntr = dev_priv->dspcntr[pipe];
-+ u32 dspcntr;
- u32 mipi = MIPI_PORT_EN | PASS_FROM_SPHY_TO_AFE | SEL_FLOPPED_HSTX;
+@@ -645,6 +645,9 @@ static void mdfld_dsi_dpi_set_power(struct drm_encoder *encoder, bool on)
+ if (!gma_power_begin(dev, true))
+ return;
+ if (pipe == -1)
+ return;
+
-+ dspcntr = dev_priv->dspcntr[pipe];
-+
- if (pipe) {
- pipeconf_reg = PIPECCONF;
- dspcntr_reg = DSPCCNTR;
+ if (on) {
+ if (mdfld_get_panel_type(dev, pipe) == TMD_VID)
+ mdfld_dsi_dpi_turn_on(dpi_output, pipe);
diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_output.c b/drivers/gpu/drm/gma500/mdfld_dsi_output.c
index d758f4c..7828190 100644
--- a/drivers/gpu/drm/gma500/mdfld_dsi_output.c
@@ -46237,7 +46521,7 @@ index fa8afa7..0bac957 100644
/**
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 46947ff..c3efaa4 100644
+index a9c3513..9c2b9c9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15106,13 +15106,13 @@ struct intel_quirk {
@@ -46776,10 +47060,10 @@ index 6911b8c..89d6867 100644
return 0;
}
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
-index 8627651..87df69f 100644
+index 47e5264..3393741 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
-@@ -831,7 +831,7 @@ static int qxl_conn_get_modes(struct drm_connector *connector)
+@@ -836,7 +836,7 @@ static int qxl_conn_get_modes(struct drm_connector *connector)
return ret;
}
@@ -46815,10 +47099,10 @@ index 7307b07..8eecdd0 100644
}
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
-index 6e6b9b1..4462096 100644
+index 3f3897e..0bc8075 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
-@@ -290,10 +290,10 @@ struct qxl_device {
+@@ -292,10 +292,10 @@ struct qxl_device {
unsigned int last_sent_io_cmd;
/* interrupt handling */
@@ -47141,7 +47425,7 @@ index b928c17..e5d9400 100644
if (regcomp
(&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-index 9bc408c..3bb75f5 100644
+index c4b4f29..90464ff 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -491,7 +491,7 @@ static int radeon_atpx_init(void)
@@ -47154,7 +47438,7 @@ index 9bc408c..3bb75f5 100644
if (radeon_atpx_priv.dhandle == ACPI_HANDLE(&pdev->dev))
return VGA_SWITCHEROO_IGD;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 340f3f5..3a0afbe 100644
+index 9cfc1c3..524ccaa 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -851,7 +851,7 @@ static int radeon_lvds_get_modes(struct drm_connector *connector)
@@ -47203,10 +47487,10 @@ index 340f3f5..3a0afbe 100644
{
struct drm_device *dev = connector->dev;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index e239633..4ae1159 100644
+index 4197ca1..f07709e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -1259,7 +1259,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
+@@ -1253,7 +1253,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
* locking inversion with the driver load path. And the access here is
* completely racy anyway. So don't bother with locking for now.
*/
@@ -47331,10 +47615,10 @@ index 414953c..1b26674 100644
-int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
+const int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index e06ac54..46eabfd 100644
+index f342aad..f7b725f 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -961,7 +961,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
+@@ -963,7 +963,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
man->size = size >> PAGE_SHIFT;
}
@@ -47343,7 +47627,7 @@ index e06ac54..46eabfd 100644
static const struct vm_operations_struct *ttm_vm_ops = NULL;
static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -1002,8 +1002,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+@@ -1004,8 +1004,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
}
if (unlikely(ttm_vm_ops == NULL)) {
ttm_vm_ops = vma->vm_ops;
@@ -48976,10 +49260,10 @@ index d47df93..93e4cfd 100644
}
}
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
-index 6b4e8a0..271bdc3 100644
+index 564adf3..49ca28c 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
-@@ -919,14 +919,14 @@ static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file,
+@@ -920,14 +920,14 @@ static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file,
const char __user *inbuf,
int in_len, int out_len)
{
@@ -50008,10 +50292,10 @@ index a1e75cb..88d1c47 100644
This option enables code in the AMD IOMMU driver to collect various
statistics about whats happening in the driver and exports that
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 374c129..928e753 100644
+index 5efadad..d1b358e 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
-@@ -739,11 +739,21 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu,
+@@ -804,11 +804,21 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu,
static void build_completion_wait(struct iommu_cmd *cmd, u64 address)
{
@@ -57064,6 +57348,19 @@ index 6d04183..d69aee9 100644
---help---
Say Y here if you want to support for Freescale FlexCAN.
+diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
+index 1deb8ff..4e2b0c1 100644
+--- a/drivers/net/can/bfin_can.c
++++ b/drivers/net/can/bfin_can.c
+@@ -338,7 +338,7 @@ static int bfin_can_get_berr_counter(const struct net_device *dev,
+ return 0;
+ }
+
+-static int bfin_can_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t bfin_can_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bfin_can_priv *priv = netdev_priv(dev);
+ struct bfin_can_regs __iomem *reg = priv->membase;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 141c2a4..ca734ed 100644
--- a/drivers/net/can/dev.c
@@ -57077,6 +57374,19 @@ index 141c2a4..ca734ed 100644
.kind = "can",
.maxtype = IFLA_CAN_MAX,
.policy = can_policy,
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 41c0fc9..517f7e3 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -465,7 +465,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
+ return err;
+ }
+
+-static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct flexcan_priv *priv = netdev_priv(dev);
+ struct flexcan_regs __iomem *regs = priv->regs;
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index 5d04f54..9586a90 100644
--- a/drivers/net/can/janz-ican3.c
@@ -57156,15 +57466,24 @@ index 69fc840..77a32fc 100644
.setup = dummy_setup,
.validate = dummy_validate,
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
-index c89b9ae..7dcddfd 100644
+index c89b9ae..66151c0 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
+@@ -834,7 +834,7 @@ static int ax_probe(struct platform_device *pdev)
+ struct ei_device *ei_local;
+ struct ax_device *ax;
+ struct resource *irq, *mem, *mem2;
+- unsigned long mem_size, mem2_size = 0;
++ resource_size_t mem_size, mem2_size = 0;
+ int ret = 0;
+
+ dev = ax__alloc_ei_netdev(sizeof(struct ax_device));
@@ -878,9 +878,11 @@ static int ax_probe(struct platform_device *pdev)
if (ax->plat->reg_offsets)
ei_local->reg_offset = ax->plat->reg_offsets;
else {
+ resource_size_t _mem_size = mem_size;
-+ do_div(_mem_size, 0x18);
++ _mem_size /= 0x18;
ei_local->reg_offset = ax->reg_offsets;
for (ret = 0; ret < 0x18; ret++)
- ax->reg_offsets[ret] = (mem_size / 0x18) * ret;
@@ -57240,6 +57559,32 @@ index 2f79d29..ed5a64e 100644
{
void __iomem *shmem = ei_status.mem + (start_page << 8);
shmem -= ei_status.tx_start_page << 8;
+diff --git a/drivers/net/ethernet/adi/bfin_mac.c b/drivers/net/ethernet/adi/bfin_mac.c
+index 74139cb..6c2a056 100644
+--- a/drivers/net/ethernet/adi/bfin_mac.c
++++ b/drivers/net/ethernet/adi/bfin_mac.c
+@@ -1123,7 +1123,7 @@ static void tx_reclaim_skb_timeout(unsigned long lp)
+ tx_reclaim_skb((struct bfin_mac_local *)lp);
+ }
+
+-static int bfin_mac_hard_start_xmit(struct sk_buff *skb,
++static netdev_tx_t bfin_mac_hard_start_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
+ struct bfin_mac_local *lp = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
+index 8d50314..df65782 100644
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -438,7 +438,7 @@ static void emac_timeout(struct net_device *dev)
+ /* Hardware start transmission.
+ * Send a packet to media from the upper layer.
+ */
+-static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct emac_board_info *db = netdev_priv(dev);
+ unsigned long channel;
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index f749e4d..23a27f1 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
@@ -57276,6 +57621,32 @@ index f749e4d..23a27f1 100644
/* Scatter/gather IO is not supported,
* so it is turned off
+diff --git a/drivers/net/ethernet/amd/7990.c b/drivers/net/ethernet/amd/7990.c
+index 66d0b73c..5e0763f 100644
+--- a/drivers/net/ethernet/amd/7990.c
++++ b/drivers/net/ethernet/amd/7990.c
+@@ -535,7 +535,7 @@ void lance_tx_timeout(struct net_device *dev)
+ }
+ EXPORT_SYMBOL_GPL(lance_tx_timeout);
+
+-int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_init_block *ib = lp->init_block;
+diff --git a/drivers/net/ethernet/amd/7990.h b/drivers/net/ethernet/amd/7990.h
+index e9e0be3..1b8e3af 100644
+--- a/drivers/net/ethernet/amd/7990.h
++++ b/drivers/net/ethernet/amd/7990.h
+@@ -240,7 +240,7 @@ struct lance_private {
+ /* Now the prototypes we export */
+ int lance_open(struct net_device *dev);
+ int lance_close(struct net_device *dev);
+-int lance_start_xmit(struct sk_buff *skb, struct net_device *dev);
++netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ void lance_set_multicast(struct net_device *dev);
+ void lance_tx_timeout(struct net_device *dev);
+ #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index 9496005..1fb7ac2 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
@@ -57300,6 +57671,41 @@ index 9496005..1fb7ac2 100644
lp->ipg_data.ipg_timer.expires = jiffies +
IPG_CONVERGE_JIFFIES;
lp->ipg_data.ipg = DEFAULT_IPG;
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index b10964e..93b7cb8 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,7 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -770,7 +770,7 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index b584b78..5e994f9 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 7ccebae..237f6bb 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
@@ -57333,6 +57739,41 @@ index 7ccebae..237f6bb 100644
struct pcnet32_private *lp = netdev_priv(dev);
unsigned long flags;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 3d8c6b2..35160ad 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -235,7 +235,7 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +511,7 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 7847638..6126840 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index b6fa891..31ef157 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -58178,6 +58619,19 @@ index 08a23e6..2ffb80f 100644
{
struct nb8800_priv *priv = netdev_priv(dev);
struct nb8800_tx_desc *txd;
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index 87c6b5b..ebb3a41 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -571,7 +571,7 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 8fc3f3c..d97e01e 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
@@ -59357,6 +59811,19 @@ index 6528231..8503500 100644
{
u32 wr_mid;
u64 cntrl, *end;
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index 48d9194..68ced25 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1021,7 +1021,7 @@ static void dm9000_send_packet(struct net_device *dev,
+ * Hardware start transmission.
+ * Send a packet to media from the upper layer.
+ */
+-static int
++static netdev_tx_t
+ dm9000_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ unsigned long flags;
diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 3acde3b..284086c 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -59440,7 +59907,7 @@ index d1cf127..9d52393 100644
struct be_adapter *adapter = pci_get_drvdata(pdev);
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
-index 84384e1..baac17d 100644
+index 84384e1..9643fe6 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -30,6 +30,8 @@
@@ -59452,8 +59919,17 @@ index 84384e1..baac17d 100644
#include <net/ip.h>
#include "ftgmac100.h"
+@@ -1120,7 +1122,7 @@ static int ftgmac100_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
++static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
+ struct net_device *netdev)
+ {
+ struct ftgmac100 *priv = netdev_priv(netdev);
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
-index dce5f7b..2433466 100644
+index dce5f7b..222e709 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -31,6 +31,8 @@
@@ -59465,6 +59941,76 @@ index dce5f7b..2433466 100644
#include "ftmac100.h"
+@@ -1009,7 +1011,7 @@ static int ftmac100_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ftmac100 *priv = netdev_priv(netdev);
+ dma_addr_t map;
+diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+index 25553ee..0b3cdea 100644
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+@@ -306,7 +306,7 @@ static int mpc52xx_fec_close(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+ struct bcom_fec_bd *bd;
+diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+index 48a9c17..0745505 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+@@ -509,7 +509,7 @@ static struct sk_buff *tx_skb_align_workaround(struct net_device *dev,
+ }
+ #endif
+
+-static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct fs_enet_private *fep = netdev_priv(dev);
+ cbd_t __iomem *bdp;
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index b9ecf19..26b1b45 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -112,7 +112,7 @@
+ const char gfar_driver_version[] = "2.0";
+
+ static int gfar_enet_open(struct net_device *dev);
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static void gfar_reset_task(struct work_struct *work);
+ static void gfar_timeout(struct net_device *dev);
+ static int gfar_close(struct net_device *dev);
+@@ -2315,7 +2315,7 @@ static inline bool gfar_csum_errata_76(struct gfar_private *priv,
+ /* This is called by the kernel when a frame is ready for transmission.
+ * It is pointed to by the dev->hard_start_xmit function pointer
+ */
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct gfar_private *priv = netdev_priv(dev);
+ struct gfar_priv_tx_q *tx_queue = NULL;
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 5bf1ade..4e74666 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3085,7 +3085,7 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
+
+ /* This is called by the kernel when a frame is ready for transmission. */
+ /* It is pointed to by the dev->hard_start_xmit function pointer */
+-static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ucc_geth_private *ugeth = netdev_priv(dev);
+ #ifdef CONFIG_UGETH_TX_ON_DEMAND
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index 0c4afe9..d888314 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -59516,6 +60062,63 @@ index d4f92ed..38fdf5b 100644
snprintf(ae_dev->name, AE_NAME_SIZE, "%s%d", DSAF_DEVICE_NAME,
(int)atomic_inc_return(&id));
+diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
+index c984998..187fa04 100644
+--- a/drivers/net/ethernet/i825xx/lib82596.c
++++ b/drivers/net/ethernet/i825xx/lib82596.c
+@@ -347,7 +347,7 @@ static const char init_setup[] =
+ 0x7f /* *multi IA */ };
+
+ static int i596_open(struct net_device *dev);
+-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static irqreturn_t i596_interrupt(int irq, void *dev_id);
+ static int i596_close(struct net_device *dev);
+ static void i596_add_cmd(struct net_device *dev, struct i596_cmd *cmd);
+@@ -965,7 +965,7 @@ static void i596_tx_timeout (struct net_device *dev)
+ }
+
+
+-static int i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t i596_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct i596_private *lp = netdev_priv(dev);
+ struct tx_cmd *tx_cmd;
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 2a0dc12..d590cfd 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2048,7 +2048,7 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
+ dev_consume_skb_any(skb);
+ }
+
+-static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ehea_port *port = netdev_priv(dev);
+ struct ehea_swqe *swqe;
+diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
+index 5d7db6c..1592aba 100644
+--- a/drivers/net/ethernet/ibm/emac/core.c
++++ b/drivers/net/ethernet/ibm/emac/core.c
+@@ -1385,7 +1385,7 @@ static inline int emac_xmit_finish(struct emac_instance *dev, int len)
+ }
+
+ /* Tx lock BH */
+-static int emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ unsigned int len = skb->len;
+@@ -1443,7 +1443,7 @@ static inline int emac_xmit_split(struct emac_instance *dev, int slot,
+ }
+
+ /* Tx lock BH disabled (SG version for TAH equipped EMACs) */
+-static int emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ int nr_frags = skb_shinfo(skb)->nr_frags;
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 068789e..f4928f0 100644
--- a/drivers/net/ethernet/intel/e100.c
@@ -59735,6 +60338,19 @@ index a94daa8..d1d3bd0 100644
.notifier_call = mlxsw_sp_netdevice_event,
};
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index a8522d8..2126286 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 2fc5cd5..6c6108a 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -59748,6 +60364,19 @@ index 2fc5cd5..6c6108a 100644
{
int retv = NETDEV_TX_OK;
struct ks_net *ks = netdev_priv(netdev);
+diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
+index 3e67f45..f1e1504 100644
+--- a/drivers/net/ethernet/moxa/moxart_ether.c
++++ b/drivers/net/ethernet/moxa/moxart_ether.c
+@@ -319,7 +319,7 @@ static irqreturn_t moxart_mac_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct moxart_mac_priv_t *priv = netdev_priv(ndev);
+ void *desc;
diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
index 9ba9758..9c7c77f 100644
--- a/drivers/net/ethernet/neterion/s2io.c
@@ -59812,6 +60441,32 @@ index 43c618b..bb6e368 100644
{
struct nfp_net *nn = netdev_priv(netdev);
const struct skb_frag_struct *frag;
+diff --git a/drivers/net/ethernet/netx-eth.c b/drivers/net/ethernet/netx-eth.c
+index 9fbc302..f87f84a 100644
+--- a/drivers/net/ethernet/netx-eth.c
++++ b/drivers/net/ethernet/netx-eth.c
+@@ -107,7 +107,7 @@ static void netx_eth_set_multicast_list(struct net_device *ndev)
+ /* implement me */
+ }
+
+-static int
++static netdev_tx_t
+ netx_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct netx_eth_priv *priv = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/nuvoton/w90p910_ether.c b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+index afa4458..95ab01b 100644
+--- a/drivers/net/ethernet/nuvoton/w90p910_ether.c
++++ b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+@@ -633,7 +633,7 @@ static int w90p910_send_frame(struct net_device *dev,
+ return 0;
+ }
+
+-static int w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t w90p910_ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct w90p910_ether *ether = netdev_priv(dev);
+
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 75e88f4..1db3bf6 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
@@ -59827,6 +60482,19 @@ index 75e88f4..1db3bf6 100644
__le32 txvlan;
__le32 flaglen;
};
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index b1ce7aa..c082651 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1063,7 +1063,7 @@ static int lpc_eth_close(struct net_device *ndev)
+ return 0;
+ }
+
+-static int lpc_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t lpc_eth_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct netdata_local *pldat = netdev_priv(ndev);
+ u32 len, txidx;
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 3b98b263b..13d2129 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -60000,6 +60668,19 @@ index f39e719..d05dce9 100644
.notifier_call = rocker_netevent_event,
};
+diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
+index ca73366..8debe39 100644
+--- a/drivers/net/ethernet/seeq/sgiseeq.c
++++ b/drivers/net/ethernet/seeq/sgiseeq.c
+@@ -578,7 +578,7 @@ static inline int sgiseeq_reset(struct net_device *dev)
+ return 0;
+ }
+
+-static int sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sgiseeq_private *sp = netdev_priv(dev);
+ struct hpc3_ethregs *hregs = sp->hregs;
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index c771e0a..bbb368d 100644
--- a/drivers/net/ethernet/sfc/ptp.c
@@ -60083,6 +60764,54 @@ index 9d78830..74fc649 100644
if (tx_done != state->packet_count) {
/* Don't free the skbs; they will be picked up on TX
* overflow or channel teardown.
+diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
+index 7a254da..0693a2b4 100644
+--- a/drivers/net/ethernet/sgi/ioc3-eth.c
++++ b/drivers/net/ethernet/sgi/ioc3-eth.c
+@@ -103,7 +103,7 @@ static inline struct net_device *priv_netdev(struct ioc3_private *dev)
+
+ static int ioc3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+ static void ioc3_set_multicast_list(struct net_device *dev);
+-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static void ioc3_timeout(struct net_device *dev);
+ static inline unsigned int ioc3_hash(const unsigned char *addr);
+ static inline void ioc3_stop(struct ioc3_private *ip);
+@@ -1397,7 +1397,7 @@ static struct pci_driver ioc3_driver = {
+ .remove = ioc3_remove_one,
+ };
+
+-static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ unsigned long data;
+ struct ioc3_private *ip = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index bd64eb9..73ba84d 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -511,7 +511,7 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index db7db8a..6a1696c 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -637,7 +637,7 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 8af2556..6da27b9 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
@@ -60111,6 +60840,73 @@ index 3f20bb1..59add41 100644
}
/* To mask all all interrupts.*/
+diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
+index aa4f9d2..d9ffff3 100644
+--- a/drivers/net/ethernet/sun/sunbmac.c
++++ b/drivers/net/ethernet/sun/sunbmac.c
+@@ -950,7 +950,7 @@ static void bigmac_tx_timeout(struct net_device *dev)
+ }
+
+ /* Put a packet on the wire. */
+-static int bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bigmac *bp = netdev_priv(dev);
+ int len, entry;
+diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
+index 9b825780..71a2b34 100644
+--- a/drivers/net/ethernet/sun/sunqe.c
++++ b/drivers/net/ethernet/sun/sunqe.c
+@@ -568,7 +568,7 @@ out:
+ }
+
+ /* Get a packet queued to go onto the wire. */
+-static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sunqe *qep = netdev_priv(dev);
+ struct sunqe_buffers *qbufs = qep->buffers;
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 23fa298..c650e26 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -1152,15 +1152,15 @@ vnet_select_queue(struct net_device *dev, struct sk_buff *skb,
+ return port->q_index;
+ }
+
+-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev);
+
+-static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb)
++static netdev_tx_t vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb)
+ {
+ struct net_device *dev = port->vp->dev;
+ struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+ struct sk_buff *segs;
+ int maclen, datalen;
+- int status;
++ netdev_tx_t status;
+ int gso_size, gso_type, gso_segs;
+ int hlen = skb_transport_header(skb) - skb_mac_header(skb);
+ int proto = IPPROTO_IP;
+@@ -1216,7 +1216,7 @@ static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb)
+ skb_push(skb, maclen);
+ skb_reset_mac_header(skb);
+
+- status = 0;
++ status = NETDEV_TX_OK;
+ while (segs) {
+ struct sk_buff *curr = segs;
+
+@@ -1255,7 +1255,7 @@ out_dropped:
+ return NETDEV_TX_OK;
+ }
+
+-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct vnet *vp = netdev_priv(dev);
+ struct vnet_port *port = NULL;
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index af11ed1..21bca5f 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -60124,6 +60920,32 @@ index af11ed1..21bca5f 100644
{
struct net_local *lp = netdev_priv(ndev);
struct dwceqos_tx trans;
+diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
+index 7eef45e..c813085 100644
+--- a/drivers/net/ethernet/ti/cpmac.c
++++ b/drivers/net/ethernet/ti/cpmac.c
+@@ -545,7 +545,7 @@ fatal_error:
+
+ }
+
+-static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ int queue, len;
+ struct cpmac_desc *desc;
+diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
+index 029841f..e899a548 100644
+--- a/drivers/net/ethernet/ti/netcp_core.c
++++ b/drivers/net/ethernet/ti/netcp_core.c
+@@ -1237,7 +1237,7 @@ out:
+ }
+
+ /* Submit the packet */
+-static int netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct netcp_intf *netcp = netdev_priv(ndev);
+ int subqueue = skb_get_queue_mapping(skb);
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 2b7550c..f75bc6c 100644
--- a/drivers/net/ethernet/via/via-rhine.c
@@ -60163,6 +60985,32 @@ index 8da7b93..719204a 100644
{
struct w5300_priv *priv = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 5a1068d..6de663b 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -673,7 +673,7 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 4684644..6687c7f 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -652,7 +652,7 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 0bf7edd..7fc5d06 100644
--- a/drivers/net/geneve.c
@@ -62962,7 +63810,7 @@ index a040edc..4ea3fa7 100644
crypto_hdr[2] = 0;
crypto_hdr[3] = 0x20 | (keyconf->keyidx << 6);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-index 5a854c6..8871801 100644
+index 1198caa..90099d6 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2123,7 +2123,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
@@ -65430,6 +66278,32 @@ index a912dc0..a8225ba 100644
u16 int_num;
ZD_ASSERT(in_interrupt());
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index f5231a2..966574d 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -142,7 +142,7 @@ void xenvif_wake_queue(struct xenvif_queue *queue)
+ netif_tx_wake_queue(netdev_get_tx_queue(dev, id));
+ }
+
+-static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct xenvif *vif = netdev_priv(dev);
+ struct xenvif_queue *queue = NULL;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 96ccd4e..8e1c6b7 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -550,7 +550,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
+
+ #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)
+
+-static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct netfront_info *np = netdev_priv(dev);
+ struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 680f578..cf80097 100644
--- a/drivers/nvme/host/pci.c
@@ -75262,7 +76136,7 @@ index cffa0a0..1758349 100644
file->f_version = event_count;
return POLLIN | POLLRDNORM;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 59e7a33..86f0d9a 100644
+index 59e7a33..0296a3e 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -168,7 +168,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
@@ -75301,7 +76175,23 @@ index 59e7a33..86f0d9a 100644
if (copy_to_user(buf,
dev->rawdescriptors[i] + (*ppos - pos),
min(len, alloclen))) {
-@@ -1485,7 +1485,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+@@ -1186,10 +1186,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg)
+
+ static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg)
+ {
+- struct usbdevfs_connectinfo ci = {
+- .devnum = ps->dev->devnum,
+- .slow = ps->dev->speed == USB_SPEED_LOW
+- };
++ struct usbdevfs_connectinfo ci;
++
++ memset(&ci, 0, sizeof(ci));
++ ci.devnum = ps->dev->devnum;
++ ci.slow = ps->dev->speed == USB_SPEED_LOW;
+
+ if (copy_to_user(arg, &ci, sizeof(ci)))
+ return -EFAULT;
+@@ -1485,7 +1486,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
}
}
as->urb->dev = ps->dev;
@@ -75722,7 +76612,7 @@ index a7de8e8..e1ef134 100644
spin_lock_init(&uhci->lock);
setup_timer(&uhci->fsbr_timer, uhci_fsbr_timeout,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
-index f0640b7..f87a6f9 100644
+index 48672fa..9245081 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -32,7 +32,7 @@
@@ -75735,10 +76625,10 @@ index f0640b7..f87a6f9 100644
/* Device for a quirk */
#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index 0c8087d..0f5a685 100644
+index 8e713cc..8c92a15 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
-@@ -4870,7 +4870,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+@@ -4872,7 +4872,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
int retval;
/* Accept arbitrarily long scatter-gather lists */
@@ -75965,28 +76855,6 @@ index da0ad32..50b5bbe 100644
/* Dynamic bitflag definitions (us->dflags): used in set_bit() etc. */
-diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
-index facaaf0..e40da77 100644
---- a/drivers/usb/usbip/usbip_common.c
-+++ b/drivers/usb/usbip/usbip_common.c
-@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
- if (!(size > 0))
- return 0;
-
-+ if (size > urb->transfer_buffer_length) {
-+ /* should not happen, probably malicious packet */
-+ if (ud->side == USBIP_STUB) {
-+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
-+ return 0;
-+ } else {
-+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
-+ return -EPIPE;
-+ }
-+ }
-+
- ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
- if (ret != size) {
- dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
diff --git a/drivers/usb/usbip/vhci.h b/drivers/usb/usbip/vhci.h
index a863a98..d272795 100644
--- a/drivers/usb/usbip/vhci.h
@@ -93710,7 +94578,7 @@ index 914ac13..6a872f7 100644
/* first set the basic ref node struct up */
atomic_set(&ref->refs, 1);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index 4545e2e..4a2c0a9 100644
+index d8d68af..2524afc0 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1271,7 +1271,7 @@ static void __setup_root(u32 nodesize, u32 sectorsize, u32 stripesize,
@@ -93953,7 +94821,7 @@ index 539e7b5..9de4167 100644
.attrs = attrs,
};
diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
-index 0e1e61a..227b156 100644
+index d39f714..1adad12 100644
--- a/fs/btrfs/tests/btrfs-tests.c
+++ b/fs/btrfs/tests/btrfs-tests.c
@@ -119,7 +119,7 @@ struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(void)
@@ -95511,7 +96379,7 @@ index 7566b26..660a3cc 100644
dcache_init();
inode_init();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index bece948..e657aeb 100644
+index 8580831..36166e5 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -247,6 +247,10 @@ static struct dentry *start_creating(const char *name, struct dentry *parent)
@@ -111613,7 +112481,7 @@ index 510413eb..34d9a8c 100644
seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index fa95ab2..7ab502b 100644
+index 9d2f3e0..52c3ee0 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -15,12 +15,19 @@
@@ -111784,7 +112652,7 @@ index fa95ab2..7ab502b 100644
mss.resident >> 10,
(unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
mss.shared_clean >> 10,
-@@ -1588,6 +1638,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1615,6 +1665,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
char buffer[64];
int nid;
@@ -111798,7 +112666,7 @@ index fa95ab2..7ab502b 100644
if (!mm)
return 0;
-@@ -1602,11 +1659,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1629,11 +1686,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy);
}
@@ -112960,7 +113828,7 @@ index 85c40f4..52fcd23 100644
error = notify_change(path->dentry, &newattrs, &delegated_inode);
inode_unlock(inode);
diff --git a/fs/xattr.c b/fs/xattr.c
-index 4861322..205ea1d 100644
+index 4861322..7266aed 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -208,6 +208,27 @@ vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value,
@@ -112979,7 +113847,7 @@ index 4861322..205ea1d 100644
+ return error;
+
+ if (inode->i_op->getxattr)
-+ error = inode->i_op->getxattr(dentry, XATTR_NAME_PAX_FLAGS, value, size);
++ error = inode->i_op->getxattr(dentry, XATTR_NAME_USER_PAX_FLAGS, value, size);
+ else
+ error = -EOPNOTSUPP;
+
@@ -124499,7 +125367,7 @@ index 5bdab6b..9ae82fe 100644
#define pud_none(pud) 0
#define pud_bad(pud) 0
diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
-index eb1973b..b24b581 100644
+index eb1973b..76f4987 100644
--- a/include/asm-generic/atomic-long.h
+++ b/include/asm-generic/atomic-long.h
@@ -22,6 +22,12 @@
@@ -124696,7 +125564,7 @@ index eb1973b..b24b581 100644
#undef ATOMIC_LONG_INC_DEC_OP
-@@ -187,4 +224,51 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
+@@ -187,4 +224,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
#define atomic_long_inc_not_zero(l) \
ATOMIC_LONG_PFX(_inc_not_zero)((ATOMIC_LONG_PFX(_t) *)(l))
@@ -124731,8 +125599,12 @@ index eb1973b..b24b581 100644
+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
+#define atomic_inc_unchecked(v) atomic_inc(v)
+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
++#ifndef atomic_inc_return_unchecked
+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
++#endif
++#ifndef atomic_add_return_unchecked
+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
++#endif
+#define atomic_dec_unchecked(v) atomic_dec(v)
+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
@@ -125745,7 +126617,7 @@ index 8609d57..86e4d79 100644
int (*generic_packet) (struct cdrom_device_info *,
struct packet_command *);
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
-index 89d944b..1d98ada 100644
+index 7fc7cb7..5de1aa8 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -424,7 +424,7 @@ struct cftype {
@@ -129119,7 +129991,7 @@ index 2696c1f..9320d41 100644
static inline int
vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 516e149..93b0b57 100644
+index a6c240e..c25ac8d 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -155,6 +155,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -129153,7 +130025,7 @@ index 516e149..93b0b57 100644
struct mmu_gather;
struct inode;
-@@ -1175,8 +1181,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+@@ -1179,8 +1185,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
unsigned long *pfn);
int follow_phys(struct vm_area_struct *vma, unsigned long address,
unsigned int flags, unsigned long *prot, resource_size_t *phys);
@@ -129164,7 +130036,7 @@ index 516e149..93b0b57 100644
static inline void unmap_shared_mapping_range(struct address_space *mapping,
loff_t const holebegin, loff_t const holelen)
-@@ -1217,9 +1223,9 @@ static inline int fixup_user_fault(struct task_struct *tsk,
+@@ -1221,9 +1227,9 @@ static inline int fixup_user_fault(struct task_struct *tsk,
}
#endif
@@ -129177,7 +130049,7 @@ index 516e149..93b0b57 100644
long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
unsigned long start, unsigned long nr_pages,
-@@ -1310,39 +1316,11 @@ int clear_page_dirty_for_io(struct page *page);
+@@ -1314,39 +1320,11 @@ int clear_page_dirty_for_io(struct page *page);
int get_cmdline(struct task_struct *task, char *buffer, int buflen);
@@ -129217,7 +130089,7 @@ index 516e149..93b0b57 100644
int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t);
extern unsigned long move_page_tables(struct vm_area_struct *vma,
-@@ -1487,8 +1465,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+@@ -1491,8 +1469,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
{
return 0;
}
@@ -129233,7 +130105,7 @@ index 516e149..93b0b57 100644
#endif
#if defined(__PAGETABLE_PMD_FOLDED) || !defined(CONFIG_MMU)
-@@ -1498,6 +1483,12 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
+@@ -1502,6 +1487,12 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
return 0;
}
@@ -129246,7 +130118,7 @@ index 516e149..93b0b57 100644
static inline void mm_nr_pmds_init(struct mm_struct *mm) {}
static inline unsigned long mm_nr_pmds(struct mm_struct *mm)
-@@ -1510,6 +1501,7 @@ static inline void mm_dec_nr_pmds(struct mm_struct *mm) {}
+@@ -1514,6 +1505,7 @@ static inline void mm_dec_nr_pmds(struct mm_struct *mm) {}
#else
int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
@@ -129254,7 +130126,7 @@ index 516e149..93b0b57 100644
static inline void mm_nr_pmds_init(struct mm_struct *mm)
{
-@@ -1547,11 +1539,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
+@@ -1551,11 +1543,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
NULL: pud_offset(pgd, address);
}
@@ -129278,7 +130150,7 @@ index 516e149..93b0b57 100644
#endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
#if USE_SPLIT_PTE_PTLOCKS
-@@ -1934,12 +1938,23 @@ extern struct vm_area_struct *copy_vma(struct vm_area_struct **,
+@@ -1938,12 +1942,23 @@ extern struct vm_area_struct *copy_vma(struct vm_area_struct **,
bool *need_rmap_locks);
extern void exit_mmap(struct mm_struct *);
@@ -129302,7 +130174,7 @@ index 516e149..93b0b57 100644
if (rlim < RLIM_INFINITY) {
if (((new - start) + (end_data - start_data)) > rlim)
return -ENOSPC;
-@@ -1974,6 +1989,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1978,6 +1993,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
unsigned long len, unsigned long prot, unsigned long flags,
vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate);
extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -129310,7 +130182,7 @@ index 516e149..93b0b57 100644
static inline unsigned long
do_mmap_pgoff(struct file *file, unsigned long addr,
-@@ -2010,10 +2026,11 @@ struct vm_unmapped_area_info {
+@@ -2014,10 +2030,11 @@ struct vm_unmapped_area_info {
unsigned long high_limit;
unsigned long align_mask;
unsigned long align_offset;
@@ -129324,7 +130196,7 @@ index 516e149..93b0b57 100644
/*
* Search for an unmapped address range.
-@@ -2025,7 +2042,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
+@@ -2029,7 +2046,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
* - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
*/
static inline unsigned long
@@ -129333,7 +130205,7 @@ index 516e149..93b0b57 100644
{
if (info->flags & VM_UNMAPPED_AREA_TOPDOWN)
return unmapped_area_topdown(info);
-@@ -2085,6 +2102,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -2089,6 +2106,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
struct vm_area_struct **pprev);
@@ -129344,7 +130216,7 @@ index 516e149..93b0b57 100644
/* Look up the first VMA which intersects the interval start_addr..end_addr-1,
NULL if none. Assume start_addr < end_addr. */
static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -2114,10 +2135,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -2118,10 +2139,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
}
#ifdef CONFIG_MMU
@@ -129357,7 +130229,7 @@ index 516e149..93b0b57 100644
{
return __pgprot(0);
}
-@@ -2282,7 +2303,7 @@ extern int get_hwpoison_page(struct page *page);
+@@ -2286,7 +2307,7 @@ extern int get_hwpoison_page(struct page *page);
extern int sysctl_memory_failure_early_kill;
extern int sysctl_memory_failure_recovery;
extern void shake_page(struct page *p, int access);
@@ -129366,7 +130238,7 @@ index 516e149..93b0b57 100644
extern int soft_offline_page(struct page *page, int flags);
-@@ -2367,5 +2388,11 @@ void __init setup_nr_node_ids(void);
+@@ -2371,5 +2392,11 @@ void __init setup_nr_node_ids(void);
static inline void setup_nr_node_ids(void) {}
#endif
@@ -131654,6 +132526,164 @@ index f5f80c5..d4e916a 100644
{
rcu_lock_release(&(sp)->dep_map);
__srcu_read_unlock(sp, idx);
+diff --git a/include/linux/string.h b/include/linux/string.h
+index 9eebc66..733834c 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -18,51 +18,51 @@ extern void *memdup_user_nul(const void __user *, size_t);
+ #include <asm/string.h>
+
+ #ifndef __HAVE_ARCH_STRCPY
+-extern char * strcpy(char *,const char *);
++extern char * strcpy(char *,const char *) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRNCPY
+-extern char * strncpy(char *,const char *, __kernel_size_t);
++extern char * strncpy(char *,const char *, __kernel_size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRLCPY
+-size_t strlcpy(char *, const char *, size_t);
++size_t strlcpy(char *, const char *, size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRSCPY
+-ssize_t __must_check strscpy(char *, const char *, size_t);
++ssize_t __must_check strscpy(char *, const char *, size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRCAT
+-extern char * strcat(char *, const char *);
++extern char * strcat(char *, const char *) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRNCAT
+-extern char * strncat(char *, const char *, __kernel_size_t);
++extern char * strncat(char *, const char *, __kernel_size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRLCAT
+-extern size_t strlcat(char *, const char *, __kernel_size_t);
++extern size_t strlcat(char *, const char *, __kernel_size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRCMP
+-extern int strcmp(const char *,const char *);
++extern int strcmp(const char *,const char *) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRNCMP
+-extern int strncmp(const char *,const char *,__kernel_size_t);
++extern int strncmp(const char *,const char *,__kernel_size_t) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRCASECMP
+-extern int strcasecmp(const char *s1, const char *s2);
++extern int strcasecmp(const char *s1, const char *s2) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRNCASECMP
+-extern int strncasecmp(const char *s1, const char *s2, size_t n);
++extern int strncasecmp(const char *s1, const char *s2, size_t n) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRCHR
+-extern char * strchr(const char *,int);
++extern char * strchr(const char *,int) __nocapture(1);
+ #endif
+ #ifndef __HAVE_ARCH_STRCHRNUL
+-extern char * strchrnul(const char *,int);
++extern char * strchrnul(const char *,int) __nocapture(1);
+ #endif
+ #ifndef __HAVE_ARCH_STRNCHR
+-extern char * strnchr(const char *, size_t, int);
++extern char * strnchr(const char *, size_t, int) __nocapture(1);
+ #endif
+ #ifndef __HAVE_ARCH_STRRCHR
+-extern char * strrchr(const char *,int);
++extern char * strrchr(const char *,int) __nocapture(1);
+ #endif
+-extern char * __must_check skip_spaces(const char *);
++extern char * __must_check skip_spaces(const char *) __nocapture(1);
+
+ extern char *strim(char *);
+
+@@ -72,10 +72,10 @@ static inline __must_check char *strstrip(char *str)
+ }
+
+ #ifndef __HAVE_ARCH_STRSTR
+-extern char * strstr(const char *, const char *);
++extern char * strstr(const char *, const char *) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRNSTR
+-extern char * strnstr(const char *, const char *, size_t);
++extern char * strnstr(const char *, const char *, size_t) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRLEN
+ extern __kernel_size_t strlen(const char *);
+@@ -84,55 +84,55 @@ extern __kernel_size_t strlen(const char *);
+ extern __kernel_size_t strnlen(const char *,__kernel_size_t);
+ #endif
+ #ifndef __HAVE_ARCH_STRPBRK
+-extern char * strpbrk(const char *,const char *);
++extern char * strpbrk(const char *,const char *) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRSEP
+-extern char * strsep(char **,const char *);
++extern char * strsep(char **,const char *) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_STRSPN
+-extern __kernel_size_t strspn(const char *,const char *);
++extern __kernel_size_t strspn(const char *,const char *) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_STRCSPN
+-extern __kernel_size_t strcspn(const char *,const char *);
++extern __kernel_size_t strcspn(const char *,const char *) __nocapture(1, 2);
+ #endif
+
+ #ifndef __HAVE_ARCH_MEMSET
+ extern void * memset(void *,int,__kernel_size_t);
+ #endif
+ #ifndef __HAVE_ARCH_MEMCPY
+-extern void * memcpy(void *,const void *,__kernel_size_t);
++extern void * memcpy(void *,const void *,__kernel_size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_MEMMOVE
+-extern void * memmove(void *,const void *,__kernel_size_t);
++extern void * memmove(void *,const void *,__kernel_size_t) __nocapture(2);
+ #endif
+ #ifndef __HAVE_ARCH_MEMSCAN
+ extern void * memscan(void *,int,__kernel_size_t);
+ #endif
+ #ifndef __HAVE_ARCH_MEMCMP
+-extern int memcmp(const void *,const void *,__kernel_size_t);
++extern int memcmp(const void *,const void *,__kernel_size_t) __nocapture(1, 2);
+ #endif
+ #ifndef __HAVE_ARCH_MEMCHR
+-extern void * memchr(const void *,int,__kernel_size_t);
++extern void * memchr(const void *,int,__kernel_size_t) __nocapture(1);
+ #endif
+-void *memchr_inv(const void *s, int c, size_t n);
++void *memchr_inv(const void *s, int c, size_t n) __nocapture(1);
+ char *strreplace(char *s, char old, char new);
+
+ extern void kfree_const(const void *x);
+
+-extern char *kstrdup(const char *s, gfp_t gfp);
+-extern const char *kstrdup_const(const char *s, gfp_t gfp);
+-extern char *kstrndup(const char *s, size_t len, gfp_t gfp);
+-extern void *kmemdup(const void *src, size_t len, gfp_t gfp);
++extern char *kstrdup(const char *s, gfp_t gfp) __nocapture(1);
++extern const char *kstrdup_const(const char *s, gfp_t gfp) __nocapture(1);
++extern char *kstrndup(const char *s, size_t len, gfp_t gfp) __nocapture(1);
++extern void *kmemdup(const void *src, size_t len, gfp_t gfp) __nocapture(1);
+
+ extern char **argv_split(gfp_t gfp, const char *str, int *argcp);
+ extern void argv_free(char **argv);
+
+-extern bool sysfs_streq(const char *s1, const char *s2);
+-extern int strtobool(const char *s, bool *res);
++extern bool sysfs_streq(const char *s1, const char *s2) __nocapture(1, 2);
++extern int strtobool(const char *s, bool *res) __nocapture(1);
+
+ #ifdef CONFIG_BINARY_PRINTF
+-int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args);
+-int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf);
++int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args) __nocapture(3);
++int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) __nocapture(3);
+ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4);
+ #endif
+
diff --git a/include/linux/sunrpc/addr.h b/include/linux/sunrpc/addr.h
index 5c9c6cd..f16c5c9 100644
--- a/include/linux/sunrpc/addr.h
@@ -131811,7 +132841,7 @@ index 017fced..d4a9fc9 100644
extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
unsigned long offset, size_t size,
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
-index 185815c..9901529 100644
+index 185815c..5ade9cd 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -102,7 +102,12 @@ union bpf_attr;
@@ -131867,6 +132897,15 @@ index 185815c..9901529 100644
asmlinkage long sys_truncate(const char __user *path, long length);
asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length);
asmlinkage long sys_stat(const char __user *filename,
+@@ -457,7 +463,7 @@ asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size,
+ unsigned long prot, unsigned long pgoff,
+ unsigned long flags);
+ asmlinkage long sys_msync(unsigned long start, size_t len, int flags);
+-asmlinkage long sys_fadvise64(int fd, loff_t offset, size_t len, int advice);
++asmlinkage long sys_fadvise64(int fd, loff_t offset, loff_t len, int advice);
+ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice);
+ asmlinkage long sys_munmap(unsigned long addr, size_t len);
+ asmlinkage long sys_mlock(unsigned long start, size_t len);
@@ -604,7 +610,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
asmlinkage long sys_send(int, void __user *, size_t, unsigned);
@@ -134185,16 +135224,17 @@ index 0e011eb..0020b3c 100644
#ifdef __HAVE_BUILTIN_BSWAP64__
return __builtin_bswap64(val);
diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
-index 1590c49..5eab462 100644
+index 1590c49..6977e11 100644
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
-@@ -73,5 +73,9 @@
+@@ -73,5 +73,10 @@
#define XATTR_POSIX_ACL_DEFAULT "posix_acl_default"
#define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+/* User namespace */
-+#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
++#define XATTR_PAX_PREFIX "pax."
+#define XATTR_PAX_FLAGS_SUFFIX "flags"
++#define XATTR_NAME_USER_PAX_FLAGS XATTR_USER_PREFIX XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
+#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
#endif /* _UAPI_LINUX_XATTR_H */
@@ -135356,10 +136396,10 @@ index 45432b5..988f1e4 100644
+}
+EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 6a498da..19ed7eb 100644
+index 355cd5f..6273802 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
-@@ -3330,7 +3330,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
+@@ -3333,7 +3333,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
key = &cft->lockdep_key;
#endif
kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name),
@@ -135368,7 +136408,7 @@ index 6a498da..19ed7eb 100644
NULL, key);
if (IS_ERR(kn))
return PTR_ERR(kn);
-@@ -3434,11 +3434,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts)
+@@ -3437,11 +3437,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts)
/* free copy for custom atomic_write_len, see init_cftypes() */
if (cft->max_write_len && cft->max_write_len != PAGE_SIZE)
kfree(cft->kf_ops);
@@ -135386,7 +136426,7 @@ index 6a498da..19ed7eb 100644
}
}
-@@ -3469,8 +3472,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3472,8 +3475,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
kf_ops->atomic_write_len = cft->max_write_len;
}
@@ -135399,7 +136439,7 @@ index 6a498da..19ed7eb 100644
}
return 0;
-@@ -3483,7 +3488,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts)
+@@ -3486,7 +3491,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts)
if (!cfts || !cfts[0].ss)
return -ENOENT;
@@ -135408,7 +136448,7 @@ index 6a498da..19ed7eb 100644
cgroup_apply_cftypes(cfts, false);
cgroup_exit_cftypes(cfts);
return 0;
-@@ -3540,7 +3545,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3543,7 +3548,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
mutex_lock(&cgroup_mutex);
@@ -135417,7 +136457,7 @@ index 6a498da..19ed7eb 100644
ret = cgroup_apply_cftypes(cfts, true);
if (ret)
cgroup_rm_cftypes_locked(cfts);
-@@ -3561,8 +3566,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3564,8 +3569,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
{
struct cftype *cft;
@@ -135429,7 +136469,7 @@ index 6a498da..19ed7eb 100644
return cgroup_add_cftypes(ss, cfts);
}
-@@ -3578,8 +3585,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3581,8 +3588,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
{
struct cftype *cft;
@@ -135441,7 +136481,7 @@ index 6a498da..19ed7eb 100644
return cgroup_add_cftypes(ss, cfts);
}
-@@ -5722,6 +5731,9 @@ static void cgroup_release_agent(struct work_struct *work)
+@@ -5725,6 +5734,9 @@ static void cgroup_release_agent(struct work_struct *work)
if (!pathbuf || !agentbuf)
goto out;
@@ -135451,7 +136491,7 @@ index 6a498da..19ed7eb 100644
path = cgroup_path(cgrp, pathbuf, PATH_MAX);
if (!path)
goto out;
-@@ -5984,7 +5996,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
+@@ -5987,7 +5999,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
struct task_struct *task;
int count = 0;
@@ -135870,7 +136910,7 @@ index 2a20c0d..3eb7d03 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index f0b4b32..390e9b9 100644
+index a0ef98b..c60fa0a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -350,8 +350,15 @@ static struct srcu_struct pmus_srcu;
@@ -135919,7 +136959,7 @@ index f0b4b32..390e9b9 100644
struct hrtimer *timer = &cpuctx->hrtimer;
struct pmu *pmu = cpuctx->ctx.pmu;
unsigned long flags;
-@@ -2883,7 +2891,7 @@ void __perf_event_task_sched_in(struct task_struct *prev,
+@@ -2893,7 +2901,7 @@ void __perf_event_task_sched_in(struct task_struct *prev,
perf_pmu_sched_task(prev, task, true);
}
@@ -135928,7 +136968,7 @@ index f0b4b32..390e9b9 100644
{
u64 frequency = event->attr.sample_freq;
u64 sec = NSEC_PER_SEC;
-@@ -3934,9 +3942,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3944,9 +3952,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
total += perf_event_count(event);
*enabled += event->total_time_enabled +
@@ -135940,7 +136980,7 @@ index f0b4b32..390e9b9 100644
list_for_each_entry(child, &event->child_list, child_list) {
(void)perf_event_read(child, false);
-@@ -3968,12 +3976,12 @@ static int __perf_read_group_add(struct perf_event *leader,
+@@ -3978,12 +3986,12 @@ static int __perf_read_group_add(struct perf_event *leader,
*/
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] += leader->total_time_enabled +
@@ -135955,7 +136995,7 @@ index f0b4b32..390e9b9 100644
}
/*
-@@ -4475,10 +4483,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -4485,10 +4493,10 @@ void perf_event_update_userpage(struct perf_event *event)
userpg->offset -= local64_read(&event->hw.prev_count);
userpg->time_enabled = enabled +
@@ -135968,7 +137008,7 @@ index f0b4b32..390e9b9 100644
arch_perf_update_userpage(event, userpg, now);
-@@ -5153,7 +5161,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -5163,7 +5171,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
@@ -135977,7 +137017,7 @@ index f0b4b32..390e9b9 100644
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
-@@ -5244,11 +5252,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -5254,11 +5262,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -135991,7 +137031,7 @@ index f0b4b32..390e9b9 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -7558,8 +7566,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
+@@ -7568,8 +7576,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer);
@@ -136001,7 +137041,7 @@ index f0b4b32..390e9b9 100644
}
put_online_cpus();
mutex_unlock(&mux_interval_mutex);
-@@ -7928,7 +7935,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -7938,7 +7945,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -136010,7 +137050,7 @@ index f0b4b32..390e9b9 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -8290,6 +8297,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -8300,6 +8307,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -136022,7 +137062,7 @@ index f0b4b32..390e9b9 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -8777,10 +8789,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -8788,10 +8800,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -136730,7 +137770,7 @@ index 2e391c7..555531a 100644
int threads = max_threads;
int min = MIN_THREADS;
diff --git a/kernel/futex.c b/kernel/futex.c
-index 5d6ce64..3124491 100644
+index 11b5021..fb30ef5 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -202,7 +202,7 @@ struct futex_pi_state {
@@ -136772,7 +137812,7 @@ index 5d6ce64..3124491 100644
pagefault_disable();
ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -3135,6 +3140,7 @@ static void __init futex_detect_cmpxchg(void)
+@@ -3154,6 +3159,7 @@ static void __init futex_detect_cmpxchg(void)
{
#ifndef CONFIG_HAVE_FUTEX_CMPXCHG
u32 curval;
@@ -136780,7 +137820,7 @@ index 5d6ce64..3124491 100644
/*
* This will fail and we want it. Some arch implementations do
-@@ -3146,8 +3152,11 @@ static void __init futex_detect_cmpxchg(void)
+@@ -3165,8 +3171,11 @@ static void __init futex_detect_cmpxchg(void)
* implementation, the non-functional ones will return
* -ENOSYS.
*/
@@ -137506,7 +138546,7 @@ index 0551c21..f753f95 100644
debug_mutex_free_waiter(&waiter);
mutex_release(&lock->dep_map, 1, ip);
diff --git a/kernel/module.c b/kernel/module.c
-index 794ebe8..74c285e 100644
+index 794ebe8..f81f123 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -59,6 +59,7 @@
@@ -138076,7 +139116,7 @@ index 794ebe8..74c285e 100644
return ERR_PTR(-ENOEXEC);
}
-@@ -2851,8 +2947,14 @@ static struct module *setup_load_info(struct load_info *info, int flags)
+@@ -2851,8 +2947,16 @@ static struct module *setup_load_info(struct load_info *info, int flags)
static int check_modinfo(struct module *mod, struct load_info *info, int flags)
{
const char *modmagic = get_modinfo(info, "vermagic");
@@ -138084,14 +139124,16 @@ index 794ebe8..74c285e 100644
int err;
+#if defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR) || defined(CONFIG_PAX_RAP)
-+ if (!license || !license_is_gpl_compatible(license))
++ if (!license || !license_is_gpl_compatible(license)) {
++ pr_err("%s: module is not compatible with the KERNEXEC 'or' method and RAP\n", mod->name);
+ return -ENOEXEC;
++ }
+#endif
+
if (flags & MODULE_INIT_IGNORE_VERMAGIC)
modmagic = NULL;
-@@ -2877,7 +2979,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
+@@ -2877,7 +2981,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
}
/* Set up license info based on the info section */
@@ -138100,7 +139142,7 @@ index 794ebe8..74c285e 100644
return 0;
}
-@@ -2974,7 +3076,7 @@ static int move_module(struct module *mod, struct load_info *info)
+@@ -2974,7 +3078,7 @@ static int move_module(struct module *mod, struct load_info *info)
void *ptr;
/* Do the allocs. */
@@ -138109,7 +139151,7 @@ index 794ebe8..74c285e 100644
/*
* The pointer to this block is stored in the module structure
* which is inside the block. Just mark it as not being a
-@@ -2984,11 +3086,11 @@ static int move_module(struct module *mod, struct load_info *info)
+@@ -2984,11 +3088,11 @@ static int move_module(struct module *mod, struct load_info *info)
if (!ptr)
return -ENOMEM;
@@ -138125,7 +139167,7 @@ index 794ebe8..74c285e 100644
/*
* The pointer to this block is stored in the module structure
* which is inside the block. This block doesn't need to be
-@@ -2997,13 +3099,45 @@ static int move_module(struct module *mod, struct load_info *info)
+@@ -2997,13 +3101,45 @@ static int move_module(struct module *mod, struct load_info *info)
*/
kmemleak_ignore(ptr);
if (!ptr) {
@@ -138175,7 +139217,7 @@ index 794ebe8..74c285e 100644
/* Transfer each section which specifies SHF_ALLOC */
pr_debug("final section addresses:\n");
-@@ -3014,16 +3148,45 @@ static int move_module(struct module *mod, struct load_info *info)
+@@ -3014,16 +3150,45 @@ static int move_module(struct module *mod, struct load_info *info)
if (!(shdr->sh_flags & SHF_ALLOC))
continue;
@@ -138228,7 +139270,7 @@ index 794ebe8..74c285e 100644
pr_debug("\t0x%lx %s\n",
(long)shdr->sh_addr, info->secstrings + shdr->sh_name);
}
-@@ -3080,12 +3243,12 @@ static void flush_module_icache(const struct module *mod)
+@@ -3080,12 +3245,12 @@ static void flush_module_icache(const struct module *mod)
* Do it before processing of module parameters, so the module
* can provide parameter accessor functions of its own.
*/
@@ -138247,7 +139289,7 @@ index 794ebe8..74c285e 100644
set_fs(old_fs);
}
-@@ -3143,8 +3306,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
+@@ -3143,8 +3308,10 @@ static void module_deallocate(struct module *mod, struct load_info *info)
{
percpu_modfree(mod);
module_arch_freeing_init(mod);
@@ -138260,7 +139302,7 @@ index 794ebe8..74c285e 100644
}
int __weak module_finalize(const Elf_Ehdr *hdr,
-@@ -3157,7 +3322,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr,
+@@ -3157,7 +3324,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr,
static int post_relocation(struct module *mod, const struct load_info *info)
{
/* Sort exception table now relocations are done. */
@@ -138270,7 +139312,7 @@ index 794ebe8..74c285e 100644
/* Copy relocated percpu area over. */
percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr,
-@@ -3205,13 +3372,15 @@ static void do_mod_ctors(struct module *mod)
+@@ -3205,13 +3374,15 @@ static void do_mod_ctors(struct module *mod)
/* For freeing module_init on success, in case kallsyms traversing */
struct mod_initfree {
struct rcu_head rcu;
@@ -138288,7 +139330,7 @@ index 794ebe8..74c285e 100644
kfree(m);
}
-@@ -3231,7 +3400,8 @@ static noinline int do_init_module(struct module *mod)
+@@ -3231,7 +3402,8 @@ static noinline int do_init_module(struct module *mod)
ret = -ENOMEM;
goto fail;
}
@@ -138298,7 +139340,7 @@ index 794ebe8..74c285e 100644
/*
* We want to find out whether @mod uses async during init. Clear
-@@ -3290,10 +3460,10 @@ static noinline int do_init_module(struct module *mod)
+@@ -3290,10 +3462,10 @@ static noinline int do_init_module(struct module *mod)
mod_tree_remove_init(mod);
disable_ro_nx(&mod->init_layout);
module_arch_freeing_init(mod);
@@ -138313,7 +139355,7 @@ index 794ebe8..74c285e 100644
/*
* We want to free module_init, but be aware that kallsyms may be
* walking this with preempt disabled. In all the failure paths, we
-@@ -3481,9 +3651,38 @@ static int load_module(struct load_info *info, const char __user *uargs,
+@@ -3481,9 +3653,38 @@ static int load_module(struct load_info *info, const char __user *uargs,
if (err)
goto free_unload;
@@ -138352,7 +139394,7 @@ index 794ebe8..74c285e 100644
/* Fix up syms, so that st_value is a pointer to location. */
err = simplify_symbols(mod, info);
if (err < 0)
-@@ -3499,13 +3698,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
+@@ -3499,13 +3700,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
flush_module_icache(mod);
@@ -138366,7 +139408,7 @@ index 794ebe8..74c285e 100644
dynamic_debug_setup(info->debug, info->num_debug);
/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
-@@ -3557,11 +3749,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
+@@ -3557,11 +3751,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
ddebug_cleanup:
dynamic_debug_remove(info->debug);
synchronize_sched();
@@ -138379,7 +139421,7 @@ index 794ebe8..74c285e 100644
free_unload:
module_unload_free(mod);
unlink_mod:
-@@ -3581,7 +3772,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
+@@ -3581,7 +3774,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
*/
ftrace_release_mod(mod);
/* Free lock-classes; relies on the preceding sync_rcu() */
@@ -138389,7 +139431,7 @@ index 794ebe8..74c285e 100644
module_deallocate(mod, info);
free_copy:
-@@ -3664,10 +3856,16 @@ static const char *get_ksymbol(struct module *mod,
+@@ -3664,10 +3858,16 @@ static const char *get_ksymbol(struct module *mod,
struct mod_kallsyms *kallsyms = rcu_dereference_sched(mod->kallsyms);
/* At worse, next value is at end of module */
@@ -138409,7 +139451,7 @@ index 794ebe8..74c285e 100644
/* Scan for closest preceding symbol, and next symbol. (ELF
starts real symbols at 1). */
-@@ -3920,7 +4118,7 @@ static int m_show(struct seq_file *m, void *p)
+@@ -3920,7 +4120,7 @@ static int m_show(struct seq_file *m, void *p)
return 0;
seq_printf(m, "%s %u",
@@ -138418,7 +139460,7 @@ index 794ebe8..74c285e 100644
print_unload_info(m, mod);
/* Informative for users. */
-@@ -3929,7 +4127,7 @@ static int m_show(struct seq_file *m, void *p)
+@@ -3929,7 +4129,7 @@ static int m_show(struct seq_file *m, void *p)
mod->state == MODULE_STATE_COMING ? "Loading" :
"Live");
/* Used by oprofile and other similar tools. */
@@ -138427,7 +139469,7 @@ index 794ebe8..74c285e 100644
/* Taints info */
if (mod->taints)
-@@ -3965,7 +4163,17 @@ static const struct file_operations proc_modules_operations = {
+@@ -3965,7 +4165,17 @@ static const struct file_operations proc_modules_operations = {
static int __init proc_modules_init(void)
{
@@ -138445,7 +139487,7 @@ index 794ebe8..74c285e 100644
return 0;
}
module_init(proc_modules_init);
-@@ -4026,7 +4234,8 @@ struct module *__module_address(unsigned long addr)
+@@ -4026,7 +4236,8 @@ struct module *__module_address(unsigned long addr)
{
struct module *mod;
@@ -138455,7 +139497,7 @@ index 794ebe8..74c285e 100644
return NULL;
module_assert_mutex_or_preempt();
-@@ -4069,11 +4278,21 @@ bool is_module_text_address(unsigned long addr)
+@@ -4069,11 +4280,21 @@ bool is_module_text_address(unsigned long addr)
*/
struct module *__module_text_address(unsigned long addr)
{
@@ -139566,7 +140608,7 @@ index a5d966c..9c2d28b 100644
#ifdef CONFIG_RT_GROUP_SCHED
/*
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index a74073f8..757e116 100644
+index 1c1d2a0..a8b297a 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2263,7 +2263,7 @@ void set_numabalancing_state(bool enabled)
@@ -142007,46 +143049,10 @@ index 9acb29f..6fe517c 100644
.thread_should_run = watchdog_should_run,
.thread_fn = watchdog,
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index 7ff5dc7..72c5756 100644
+index 9e82d04..72c5756 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
-@@ -667,6 +667,35 @@ static void set_work_pool_and_clear_pending(struct work_struct *work,
- */
- smp_wmb();
- set_work_data(work, (unsigned long)pool_id << WORK_OFFQ_POOL_SHIFT, 0);
-+ /*
-+ * The following mb guarantees that previous clear of a PENDING bit
-+ * will not be reordered with any speculative LOADS or STORES from
-+ * work->current_func, which is executed afterwards. This possible
-+ * reordering can lead to a missed execution on attempt to qeueue
-+ * the same @work. E.g. consider this case:
-+ *
-+ * CPU#0 CPU#1
-+ * ---------------------------- --------------------------------
-+ *
-+ * 1 STORE event_indicated
-+ * 2 queue_work_on() {
-+ * 3 test_and_set_bit(PENDING)
-+ * 4 } set_..._and_clear_pending() {
-+ * 5 set_work_data() # clear bit
-+ * 6 smp_mb()
-+ * 7 work->current_func() {
-+ * 8 LOAD event_indicated
-+ * }
-+ *
-+ * Without an explicit full barrier speculative LOAD on line 8 can
-+ * be executed before CPU#0 does STORE on line 1. If that happens,
-+ * CPU#0 observes the PENDING bit is still set and new execution of
-+ * a @work is not queued in a hope, that CPU#1 will eventually
-+ * finish the queued @work. Meanwhile CPU#1 does not see
-+ * event_indicated is set, because speculative LOAD was executed
-+ * before actual STORE.
-+ */
-+ smp_mb();
- }
-
- static void clear_work_data(struct work_struct *work)
-@@ -1921,9 +1950,8 @@ static void pool_mayday_timeout(unsigned long __pool)
+@@ -1950,9 +1950,8 @@ static void pool_mayday_timeout(unsigned long __pool)
* multiple times. Does GFP_KERNEL allocations. Called only from
* manager.
*/
@@ -142057,7 +143063,7 @@ index 7ff5dc7..72c5756 100644
{
restart:
spin_unlock_irq(&pool->lock);
-@@ -2013,9 +2041,8 @@ static bool manage_workers(struct worker *worker)
+@@ -2042,9 +2041,8 @@ static bool manage_workers(struct worker *worker)
* CONTEXT:
* spin_lock_irq(pool->lock) which is released and regrabbed.
*/
@@ -142068,7 +143074,7 @@ index 7ff5dc7..72c5756 100644
{
struct pool_workqueue *pwq = get_work_pwq(work);
struct worker_pool *pool = worker->pool;
-@@ -4561,7 +4588,7 @@ static void rebind_workers(struct worker_pool *pool)
+@@ -4590,7 +4588,7 @@ static void rebind_workers(struct worker_pool *pool)
WARN_ON_ONCE(!(worker_flags & WORKER_UNBOUND));
worker_flags |= WORKER_REBOUND;
worker_flags &= ~WORKER_UNBOUND;
@@ -143171,6 +144177,19 @@ index f05b2d5..0d6e01f 100644
{VM_ACCOUNT, "account" },
{VM_NORESERVE, "noreserve" },
{VM_HUGETLB, "hugetlb" },
+diff --git a/mm/fadvise.c b/mm/fadvise.c
+index b8a5bc6..bf65b8c 100644
+--- a/mm/fadvise.c
++++ b/mm/fadvise.c
+@@ -154,7 +154,7 @@ out:
+
+ #ifdef __ARCH_WANT_SYS_FADVISE64
+
+-SYSCALL_DEFINE4(fadvise64, int, fd, loff_t, offset, size_t, len, int, advice)
++SYSCALL_DEFINE4(fadvise64, int, fd, loff_t, offset, loff_t, len, int, advice)
+ {
+ return sys_fadvise64_64(fd, offset, len, advice);
+ }
diff --git a/mm/filemap.c b/mm/filemap.c
index da7a35d..d10518d 100644
--- a/mm/filemap.c
@@ -143784,10 +144803,10 @@ index f56825b..f86f118 100644
if (end == start)
return error;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index caf3bf7..162b323 100644
+index a65ad1d..0a39040 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
-@@ -748,7 +748,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
+@@ -749,7 +749,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
mem_cgroup_update_tree(memcg, page);
#if MAX_NUMNODES > 1
if (unlikely(do_numainfo))
@@ -143796,7 +144815,7 @@ index caf3bf7..162b323 100644
#endif
}
}
-@@ -1381,7 +1381,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg)
+@@ -1382,7 +1382,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg)
* numainfo_events > 0 means there was at least NUMAINFO_EVENTS_TARGET
* pagein/pageout changes since the last update.
*/
@@ -143805,7 +144824,7 @@ index caf3bf7..162b323 100644
return;
if (atomic_inc_return(&memcg->numainfo_updating) > 1)
return;
-@@ -1395,7 +1395,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg)
+@@ -1396,7 +1396,7 @@ static void mem_cgroup_may_update_nodemask(struct mem_cgroup *memcg)
node_clear(nid, memcg->scan_nodes);
}
@@ -143846,7 +144865,7 @@ index ac595e7..78fa945 100644
/*
* free pages are specially detected outside this table:
diff --git a/mm/memory.c b/mm/memory.c
-index 8132787..64b99d0 100644
+index 3345dcf..291e077 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -416,6 +416,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -143891,7 +144910,7 @@ index 8132787..64b99d0 100644
vma->vm_file,
vma->vm_ops ? vma->vm_ops->fault : NULL,
vma->vm_file ? vma->vm_file->f_op->mmap : NULL,
-@@ -1448,6 +1453,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -1488,6 +1493,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
page_add_file_rmap(page);
set_pte_at(mm, addr, pte, mk_pte(page, prot));
@@ -143902,7 +144921,7 @@ index 8132787..64b99d0 100644
retval = 0;
pte_unmap_unlock(pte, ptl);
return retval;
-@@ -1492,9 +1501,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -1532,9 +1541,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
if (!page_count(page))
return -EINVAL;
if (!(vma->vm_flags & VM_MIXEDMAP)) {
@@ -143924,7 +144943,7 @@ index 8132787..64b99d0 100644
}
return insert_page(vma, addr, page, vma->vm_page_prot);
}
-@@ -1580,6 +1601,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+@@ -1620,6 +1641,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
pfn_t pfn)
{
BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -143932,7 +144951,7 @@ index 8132787..64b99d0 100644
if (addr < vma->vm_start || addr >= vma->vm_end)
return -EFAULT;
-@@ -1832,7 +1854,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -1872,7 +1894,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
BUG_ON(pud_huge(*pud));
@@ -143943,7 +144962,7 @@ index 8132787..64b99d0 100644
if (!pmd)
return -ENOMEM;
do {
-@@ -1852,7 +1876,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -1892,7 +1916,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
unsigned long next;
int err;
@@ -143954,7 +144973,7 @@ index 8132787..64b99d0 100644
if (!pud)
return -ENOMEM;
do {
-@@ -2048,6 +2074,196 @@ static inline int wp_page_reuse(struct mm_struct *mm,
+@@ -2088,6 +2114,196 @@ static inline int wp_page_reuse(struct mm_struct *mm,
return VM_FAULT_WRITE;
}
@@ -144151,7 +145170,7 @@ index 8132787..64b99d0 100644
/*
* Handle the case of a page which we actually need to copy to a new page.
*
-@@ -2102,6 +2318,12 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2142,6 +2358,12 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma,
*/
page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
if (likely(pte_same(*page_table, orig_pte))) {
@@ -144164,7 +145183,7 @@ index 8132787..64b99d0 100644
if (old_page) {
if (!PageAnon(old_page)) {
dec_mm_counter_fast(mm,
-@@ -2157,6 +2379,10 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2197,6 +2419,10 @@ static int wp_page_copy(struct mm_struct *mm, struct vm_area_struct *vma,
page_remove_rmap(old_page, false);
}
@@ -144175,7 +145194,7 @@ index 8132787..64b99d0 100644
/* Free the old page.. */
new_page = old_page;
page_copied = 1;
-@@ -2585,6 +2811,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2625,6 +2851,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (mem_cgroup_swap_full(page) ||
(vma->vm_flags & VM_LOCKED) || PageMlocked(page))
try_to_free_swap(page);
@@ -144187,7 +145206,7 @@ index 8132787..64b99d0 100644
unlock_page(page);
if (page != swapcache) {
/*
-@@ -2608,6 +2839,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2648,6 +2879,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -144199,7 +145218,7 @@ index 8132787..64b99d0 100644
unlock:
pte_unmap_unlock(page_table, ptl);
out:
-@@ -2627,40 +2863,6 @@ out_release:
+@@ -2667,40 +2903,6 @@ out_release:
}
/*
@@ -144240,7 +145259,7 @@ index 8132787..64b99d0 100644
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
* We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2670,25 +2872,22 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2710,25 +2912,22 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned int flags)
{
struct mem_cgroup *memcg;
@@ -144272,7 +145291,7 @@ index 8132787..64b99d0 100644
if (!pte_none(*page_table))
goto unlock;
/* Deliver the page fault to userland, check inside PT lock */
-@@ -2701,6 +2900,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2741,6 +2940,8 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
}
/* Allocate our own private page. */
@@ -144281,7 +145300,7 @@ index 8132787..64b99d0 100644
if (unlikely(anon_vma_prepare(vma)))
goto oom;
page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2734,6 +2935,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2774,6 +2975,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
VM_UFFD_MISSING);
}
@@ -144293,7 +145312,7 @@ index 8132787..64b99d0 100644
inc_mm_counter_fast(mm, MM_ANONPAGES);
page_add_new_anon_rmap(page, vma, address, false);
mem_cgroup_commit_charge(page, memcg, false, false);
-@@ -2743,6 +2949,12 @@ setpte:
+@@ -2783,6 +2989,12 @@ setpte:
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -144306,7 +145325,7 @@ index 8132787..64b99d0 100644
unlock:
pte_unmap_unlock(page_table, ptl);
return 0;
-@@ -2977,6 +3189,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3017,6 +3229,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
return ret;
}
do_set_pte(vma, address, fault_page, pte, false, false);
@@ -144318,7 +145337,7 @@ index 8132787..64b99d0 100644
unlock_page(fault_page);
unlock_out:
pte_unmap_unlock(pte, ptl);
-@@ -3028,7 +3245,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3068,7 +3285,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
}
goto uncharge_out;
}
@@ -144337,7 +145356,7 @@ index 8132787..64b99d0 100644
mem_cgroup_commit_charge(new_page, memcg, false, false);
lru_cache_add_active_or_unevictable(new_page, vma);
pte_unmap_unlock(pte, ptl);
-@@ -3086,6 +3314,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3126,6 +3354,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
return ret;
}
do_set_pte(vma, address, fault_page, pte, true, false);
@@ -144349,7 +145368,7 @@ index 8132787..64b99d0 100644
pte_unmap_unlock(pte, ptl);
if (set_page_dirty(fault_page))
-@@ -3338,6 +3571,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3378,6 +3611,12 @@ static int handle_pte_fault(struct mm_struct *mm,
if (flags & FAULT_FLAG_WRITE)
flush_tlb_fix_spurious_fault(vma, address);
}
@@ -144362,7 +145381,7 @@ index 8132787..64b99d0 100644
unlock:
pte_unmap_unlock(pte, ptl);
return 0;
-@@ -3357,9 +3596,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3397,9 +3636,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
pmd_t *pmd;
pte_t *pte;
@@ -144404,7 +145423,7 @@ index 8132787..64b99d0 100644
pgd = pgd_offset(mm, address);
pud = pud_alloc(mm, pgd, address);
if (!pud)
-@@ -3493,6 +3764,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3533,6 +3804,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -144428,7 +145447,7 @@ index 8132787..64b99d0 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3525,6 +3813,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3565,6 +3853,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -144461,7 +145480,7 @@ index 8132787..64b99d0 100644
#endif /* __PAGETABLE_PMD_FOLDED */
static int __follow_pte(struct mm_struct *mm, unsigned long address,
-@@ -3634,8 +3948,8 @@ out:
+@@ -3674,8 +3988,8 @@ out:
return ret;
}
@@ -144472,7 +145491,7 @@ index 8132787..64b99d0 100644
{
resource_size_t phys_addr;
unsigned long prot = 0;
-@@ -3661,8 +3975,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -3701,8 +4015,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
* Access another process' address space as given in mm. If non-NULL, use the
* given task for page fault accounting.
*/
@@ -144483,7 +145502,7 @@ index 8132787..64b99d0 100644
{
struct vm_area_struct *vma;
void *old_buf = buf;
-@@ -3670,7 +3984,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3710,7 +4024,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
down_read(&mm->mmap_sem);
/* ignore errors, just check how much was successfully transferred */
while (len) {
@@ -144492,7 +145511,7 @@ index 8132787..64b99d0 100644
void *maddr;
struct page *page = NULL;
-@@ -3731,8 +4045,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3771,8 +4085,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -144503,7 +145522,7 @@ index 8132787..64b99d0 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -3742,11 +4056,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -3782,11 +4096,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Source/target buffer must be kernel space,
* Do not walk the page table directly, use get_user_pages
*/
@@ -144595,10 +145614,10 @@ index 9a3f6b9..b9af66c 100644
capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
diff --git a/mm/migrate.c b/mm/migrate.c
-index 3ad0fea..2b361a1 100644
+index 625741f..ed2d240 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
-@@ -1509,8 +1509,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1515,8 +1515,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
*/
tcred = __task_cred(task);
if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
@@ -146749,7 +147768,7 @@ index 79f3bf0..92c8a7e 100644
/*
diff --git a/mm/shmem.c b/mm/shmem.c
-index 440e2a7..8aeebaa 100644
+index 440e2a7..9091191 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -33,7 +33,7 @@
@@ -146770,7 +147789,7 @@ index 440e2a7..8aeebaa 100644
/*
* shmem_fallocate communicates with shmem_fault or shmem_writepage via
-@@ -2670,6 +2670,25 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler,
+@@ -2670,6 +2670,23 @@ static int shmem_xattr_handler_set(const struct xattr_handler *handler,
return simple_xattr_set(&info->xattrs, name, value, size, flags);
}
@@ -146781,12 +147800,10 @@ index 440e2a7..8aeebaa 100644
+{
+ struct shmem_inode_info *info = SHMEM_I(d_inode(dentry));
+
-+#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
+ if (strcmp(name, XATTR_NAME_PAX_FLAGS))
+ return -EOPNOTSUPP;
+ if (size > 8)
+ return -EINVAL;
-+#endif
+
+ name = xattr_full_name(handler, name);
+ return simple_xattr_set(&info->xattrs, name, value, size, flags);
@@ -146796,7 +147813,7 @@ index 440e2a7..8aeebaa 100644
static const struct xattr_handler shmem_security_xattr_handler = {
.prefix = XATTR_SECURITY_PREFIX,
.get = shmem_xattr_handler_get,
-@@ -2682,6 +2701,14 @@ static const struct xattr_handler shmem_trusted_xattr_handler = {
+@@ -2682,6 +2699,14 @@ static const struct xattr_handler shmem_trusted_xattr_handler = {
.set = shmem_xattr_handler_set,
};
@@ -146811,7 +147828,7 @@ index 440e2a7..8aeebaa 100644
static const struct xattr_handler *shmem_xattr_handlers[] = {
#ifdef CONFIG_TMPFS_POSIX_ACL
&posix_acl_access_xattr_handler,
-@@ -2689,6 +2716,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+@@ -2689,6 +2714,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
#endif
&shmem_security_xattr_handler,
&shmem_trusted_xattr_handler,
@@ -146823,7 +147840,7 @@ index 440e2a7..8aeebaa 100644
NULL
};
-@@ -3051,8 +3083,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -3051,8 +3081,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
int err = -ENOMEM;
/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -147750,7 +148767,7 @@ index 5ec1580..017a002 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index d8fbd4a..f864712 100644
+index 2a722e1..1e5e2f8 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -34,6 +34,7 @@
@@ -154874,7 +155891,7 @@ index 85ca189..871f064 100644
if (!todrop_rate[i]) return 0;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index f57b4dc..8cba121 100644
+index f57b4dc..8cba1213 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -611,7 +611,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
@@ -155652,7 +156669,7 @@ index 11de55e..f25e448 100644
return 0;
}
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index f1ffb34..4e5a217 100644
+index d2bc03f..a95bb86 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -287,7 +287,7 @@ static void netlink_overrun(struct sock *sk)
@@ -157246,7 +158263,7 @@ index 1095be9..815d777 100644
/* make a copy for the caller */
*handle = ctxh;
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
-index 273bc3a..1a4b204 100644
+index 008c25d..b2bb1df7 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1623,7 +1623,7 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net)
@@ -157694,7 +158711,7 @@ index c8b8a8b..75b302c 100644
/* Build up the XDR from the receive buffers. */
rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
-index df57f3c..5febb1e 100644
+index df57f3ce..5febb1e 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -291,7 +291,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
@@ -159738,10 +160755,10 @@ index 23ba1c6..cad2484 100755
# Find all available archs
find_all_archs()
diff --git a/security/Kconfig b/security/Kconfig
-index e452378..51e3107 100644
+index e452378..4388a35 100644
--- a/security/Kconfig
+++ b/security/Kconfig
-@@ -4,6 +4,987 @@
+@@ -4,6 +4,989 @@
menu "Security options"
@@ -160705,13 +161722,15 @@ index e452378..51e3107 100644
+
+config PAX_RAP
+ bool "Prevent code reuse attacks"
-+ depends on X86_64 && !PARAVIRT
++ depends on X86_64
+ default y if GRKERNSEC_CONFIG_AUTO
+ help
+ By saying Y here the kernel will check indirect control transfers
+ in order to detect and prevent attacks that try to hijack control
+ flow by overwriting code pointers.
+
++ Note that binary modules cannot be instrumented by this approach.
++
+ Note that the implementation requires a gcc with plugin support,
+ i.e., gcc 4.5 or newer. You may need to install the supporting
+ headers explicitly in addition to the normal gcc package.
@@ -160729,7 +161748,7 @@ index e452378..51e3107 100644
source security/keys/Kconfig
config SECURITY_DMESG_RESTRICT
-@@ -104,7 +1085,7 @@ config INTEL_TXT
+@@ -104,7 +1087,7 @@ config INTEL_TXT
config LSM_MMAP_MIN_ADDR
int "Low address space for LSM to protect from user allocation"
depends on SECURITY && SECURITY_SELINUX
@@ -167209,15 +168228,20 @@ index 0000000..50d373c
+}
diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c
new file mode 100644
-index 0000000..c77d26d
+index 0000000..a716d7a
--- /dev/null
+++ b/tools/gcc/randomize_layout_plugin.c
-@@ -0,0 +1,935 @@
+@@ -0,0 +1,940 @@
+/*
-+ * Copyright 2014,2015 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net>
++ * Copyright 2014-2016 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net>
+ * and PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
+ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
+ * Usage:
+ * $ # for 4.5/4.6/C based 4.7
+ * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o randomize_layout_plugin.so randomize_layout_plugin.c
@@ -168815,10 +169839,10 @@ index 0000000..ebdcf7c
+}
diff --git a/tools/gcc/rap_plugin/rap_plugin.c b/tools/gcc/rap_plugin/rap_plugin.c
new file mode 100644
-index 0000000..c5827cb
+index 0000000..a6d423f
--- /dev/null
+++ b/tools/gcc/rap_plugin/rap_plugin.c
-@@ -0,0 +1,479 @@
+@@ -0,0 +1,480 @@
+/*
+ * Copyright 2012-2016 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -169060,6 +170084,7 @@ index 0000000..c5827cb
+ ASM_OUTPUT_LABEL(asm_out_file, name);
+ free(name);
+ }
++
+ if (hash.hash)
+ fprintf(asm_out_file, "\t.previous\n");
+}
@@ -182000,12 +183025,12 @@ index 0000000..be9724d
+exit 0
diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
new file mode 100644
-index 0000000..5aabc22
+index 0000000..ee987da
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
@@ -0,0 +1,369 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -182375,12 +183400,12 @@ index 0000000..5aabc22
+#include "gcc-generate-gimple-pass.h"
diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
new file mode 100644
-index 0000000..9f9bcd6
+index 0000000..b12cef3
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
-@@ -0,0 +1,1118 @@
+@@ -0,0 +1,1166 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -182973,7 +183998,7 @@ index 0000000..9f9bcd6
+ return get_lhs(assign);
+}
+
-+tree handle_intentional_overflow(struct visited *visited, interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2)
++tree handle_intentional_overflow(interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2)
+{
+ tree new_rhs, orig_rhs;
+ void (*gimple_assign_set_rhs)(gimple, tree);
@@ -182982,10 +184007,10 @@ index 0000000..9f9bcd6
+ tree lhs = gimple_assign_lhs(stmt);
+
+ if (!check_overflow)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
+ if (change_rhs == NULL_TREE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
+ if (new_rhs2 == NULL_TREE) {
+ orig_rhs = rhs1;
@@ -182997,11 +184022,11 @@ index 0000000..9f9bcd6
+
+ check_size_overflow(expand_from, stmt, TREE_TYPE(change_rhs), change_rhs, orig_rhs, BEFORE_STMT);
+
-+ new_rhs = change_assign_rhs(visited, stmt, orig_rhs, change_rhs);
++ new_rhs = change_assign_rhs(expand_from->visited, stmt, orig_rhs, change_rhs);
+ gimple_assign_set_rhs(stmt, new_rhs);
+ update_stmt(stmt);
+
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+}
+
+static bool is_subtraction_special(struct visited *visited, const gassign *stmt)
@@ -183107,7 +184132,7 @@ index 0000000..9f9bcd6
+ }
+}
+
-+tree handle_integer_truncation(struct visited *visited, interesting_stmts_t expand_from, const_tree lhs)
++tree handle_integer_truncation(interesting_stmts_t expand_from, const_tree lhs)
+{
+ tree new_rhs1, new_rhs2;
+ tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
@@ -183115,28 +184140,28 @@ index 0000000..9f9bcd6
+ tree rhs1 = gimple_assign_rhs1(stmt);
+ tree rhs2 = gimple_assign_rhs2(stmt);
+
-+ if (!is_subtraction_special(visited, stmt))
++ if (!is_subtraction_special(expand_from->visited, stmt))
+ return NULL_TREE;
+
-+ new_rhs1 = expand(visited, expand_from, rhs1);
-+ new_rhs2 = expand(visited, expand_from, rhs2);
++ new_rhs1 = expand(expand_from, rhs1);
++ new_rhs2 = expand(expand_from, rhs2);
+
-+ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs1);
-+ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs2);
++ new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(expand_from->visited, new_rhs1);
++ new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(expand_from->visited, new_rhs2);
+
+ if (new_rhs1_def_stmt_rhs1 == NULL_TREE || new_rhs2_def_stmt_rhs1 == NULL_TREE)
+ return NULL_TREE;
+
+ if (!types_compatible_p(TREE_TYPE(new_rhs1_def_stmt_rhs1), TREE_TYPE(new_rhs2_def_stmt_rhs1))) {
-+ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs1_def_stmt_rhs1);
-+ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs2_def_stmt_rhs1);
++ new_rhs1_def_stmt_rhs1 = cast_to_TI_type(expand_from->visited, stmt, new_rhs1_def_stmt_rhs1);
++ new_rhs2_def_stmt_rhs1 = cast_to_TI_type(expand_from->visited, stmt, new_rhs2_def_stmt_rhs1);
+ }
+
-+ assign = create_binary_assign(visited, MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
++ assign = create_binary_assign(expand_from->visited, MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
+ new_lhs = gimple_assign_lhs(assign);
+ check_size_overflow(expand_from, assign, TREE_TYPE(new_lhs), new_lhs, rhs1, AFTER_STMT);
+
-+ return dup_assign(visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
+}
+
+bool is_a_neg_overflow(const gassign *stmt, const_tree rhs)
@@ -183497,14 +184522,62 @@ index 0000000..9f9bcd6
+ // _51 = _50 * gt signed type max;
+ return is_mult_const(rhs1) || is_mult_const(rhs2);
+}
++
++/* True:
++ * drivers/net/ethernet/via/via-velocity.c velocity_rx_refill()
++ * u16 = cpu_to_le16(s32) | const
++ * rd->size = cpu_to_le16(vptr->rx.buf_sz) | RX_INTEN;
++ *
++ * _36 = (signed short) _35;
++ * _37 = _36 | -32768;
++ * _38 = (short unsigned int) _37;
++ */
++
++bool short_or_neg_const_ushort(gassign *stmt)
++{
++ const_tree rhs, lhs_type, rhs_type;
++ const_tree def_rhs1, def_rhs2;
++ const_gimple def_stmt;
++ gimple def_def_stmt = NULL;
++
++ if (!gimple_assign_cast_p(stmt))
++ return false;
++
++ // _38 = (short unsigned int) _37;
++ lhs_type = TREE_TYPE(gimple_assign_lhs(stmt));
++ if (!TYPE_UNSIGNED(lhs_type))
++ return false;
++ if (TYPE_MODE(lhs_type) != HImode)
++ return false;
++ rhs = gimple_assign_rhs1(stmt);
++ rhs_type = TREE_TYPE(rhs);
++ if (TYPE_UNSIGNED(rhs_type))
++ return false;
++ if (TYPE_MODE(rhs_type) != HImode)
++ return false;
++
++ // _37 = _36 | -32768;
++ def_stmt = get_def_stmt(rhs);
++ if (!def_stmt || gimple_assign_rhs_code(def_stmt) != BIT_IOR_EXPR)
++ return false;
++ def_rhs1 = gimple_assign_rhs1(def_stmt);
++ def_rhs2 = gimple_assign_rhs2(def_stmt);
++ if (is_gimple_constant(def_rhs1) && !is_gt_zero(def_rhs1))
++ def_def_stmt = get_def_stmt(def_rhs2);
++ else if (is_gimple_constant(def_rhs2) && !is_gt_zero(def_rhs2))
++ def_def_stmt = get_def_stmt(def_rhs1);
++
++ // _36 = (signed short) _35;
++ return def_def_stmt && gimple_assign_cast_p(def_def_stmt);
++}
diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
new file mode 100644
-index 0000000..5622b51
+index 0000000..c910983
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
@@ -0,0 +1,137 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -183642,10 +184715,10 @@ index 0000000..5622b51
+
diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
new file mode 100644
-index 0000000..b7f66f7
+index 0000000..4bd2e7f
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow.h
-@@ -0,0 +1,329 @@
+@@ -0,0 +1,331 @@
+#ifndef SIZE_OVERFLOW_H
+#define SIZE_OVERFLOW_H
+
@@ -183844,14 +184917,15 @@ index 0000000..b7f66f7
+extern bool is_a_cast_and_const_overflow(const_tree no_const_rhs);
+extern bool is_const_plus_unsigned_signed_truncation(const_tree lhs);
+extern bool is_a_constant_overflow(const gassign *stmt, const_tree rhs);
-+extern tree handle_intentional_overflow(struct visited *visited, interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2);
-+extern tree handle_integer_truncation(struct visited *visited, interesting_stmts_t expand_from, const_tree lhs);
++extern tree handle_intentional_overflow(interesting_stmts_t expand_from, bool check_overflow, gassign *stmt, tree change_rhs, tree new_rhs2);
++extern tree handle_integer_truncation(interesting_stmts_t expand_from, const_tree lhs);
+extern bool is_a_neg_overflow(const gassign *stmt, const_tree rhs);
+extern enum intentional_overflow_type add_mul_intentional_overflow(const gassign *stmt);
+extern void unsigned_signed_cast_intentional_overflow(struct visited *visited, gassign *stmt);
+extern bool neg_short_add_intentional_overflow(gassign *stmt);
+extern bool is_bitfield_unnamed_cast(const_tree decl, gassign *assign);
+extern bool uconst_neg_intentional_overflow(const gassign *stmt);
++extern bool short_or_neg_const_ushort(gassign *stmt);
+
+
+// insert_size_overflow_asm.c
@@ -183894,6 +184968,7 @@ index 0000000..b7f66f7
+ gimple first_stmt;
+ tree orig_node;
+ unsigned int num;
++ struct visited *visited;
+};
+
+extern unsigned int size_overflow_function_transform(struct cgraph_node *node);
@@ -183903,7 +184978,7 @@ index 0000000..b7f66f7
+// size_overflow_transform_core.c
+extern tree cast_to_new_size_overflow_type(struct visited *visited, gimple stmt, tree rhs, tree size_overflow_type, bool before);
+extern tree get_size_overflow_type(struct visited *visited, const_gimple stmt, const_tree node);
-+extern tree expand(struct visited *visited, interesting_stmts_t expand_from, tree lhs);
++extern tree expand(interesting_stmts_t expand_from, tree lhs);
+extern void check_size_overflow(interesting_stmts_t expand_from, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before);
+extern tree dup_assign(struct visited *visited, gassign *oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
+extern tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before);
@@ -183977,12 +185052,12 @@ index 0000000..b7f66f7
+#endif
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_debug.c b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
new file mode 100644
-index 0000000..fc58e16
+index 0000000..4098952
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
@@ -0,0 +1,194 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -205929,12 +207004,12 @@ index 0000000..17bc0d8
+enable_so_zpios_read_fndecl_64734 zpios_read fndecl 3 64734 NULL
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_ipa.c b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c
new file mode 100644
-index 0000000..758edea
+index 0000000..0a679f8
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_ipa.c
@@ -0,0 +1,1163 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -207098,12 +208173,12 @@ index 0000000..758edea
+#include "gcc-generate-ipa-pass.h"
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_misc.c b/tools/gcc/size_overflow_plugin/size_overflow_misc.c
new file mode 100644
-index 0000000..a44ea14
+index 0000000..7f459ed
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_misc.c
@@ -0,0 +1,505 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -207609,7 +208684,7 @@ index 0000000..a44ea14
+
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
new file mode 100644
-index 0000000..21e7d5c
+index 0000000..9fc86df
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
@@ -0,0 +1,290 @@
@@ -207644,7 +208719,7 @@ index 0000000..21e7d5c
+tree size_overflow_type_TI;
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20160306",
++ .version = "20160502",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
@@ -207905,12 +208980,12 @@ index 0000000..21e7d5c
+}
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
new file mode 100644
-index 0000000..4ac5098
+index 0000000..87af656
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
@@ -0,0 +1,352 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -208263,12 +209338,12 @@ index 0000000..4ac5098
+
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform.c b/tools/gcc/size_overflow_plugin/size_overflow_transform.c
new file mode 100644
-index 0000000..c958d66
+index 0000000..eebcf4c
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_transform.c
-@@ -0,0 +1,745 @@
+@@ -0,0 +1,743 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -208524,24 +209599,23 @@ index 0000000..c958d66
+ return search_interesting_stmt(head, next_node_ret, ret, first_node, 0);
+}
+
-+static void handle_binary_assign(struct visited *visited, interesting_stmts_t expand_from, gassign *assign, tree rhs)
++static void handle_binary_assign(interesting_stmts_t expand_from, gassign *assign, tree rhs)
+{
+ tree new_node;
+ gimple def_orig_node;
+
-+ new_node = expand(visited, expand_from, rhs);
++ new_node = expand(expand_from, rhs);
+ if (new_node == NULL_TREE)
+ return;
+
+ def_orig_node = get_def_stmt(rhs);
-+ change_orig_node(visited, assign, rhs, new_node, 0);
-+
-+ if (pointer_set_contains(visited->no_cast_check, def_orig_node))
++ if (pointer_set_contains(expand_from->visited->no_cast_check, def_orig_node))
+ return;
++ change_orig_node(expand_from->visited, assign, rhs, new_node, 0);
+ check_size_overflow(expand_from, assign, TREE_TYPE(new_node), new_node, rhs, BEFORE_STMT);
+}
+
-+static bool search_error_codes(struct visited *visited, gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code)
++static bool search_error_codes(gimple_set *visited_error_codes, interesting_stmts_t expand_from, tree lhs, bool error_code)
+{
+ gimple def_stmt;
+
@@ -208567,7 +209641,7 @@ index 0000000..c958d66
+
+ switch (gimple_num_ops(assign)) {
+ case 2:
-+ return search_error_codes(visited, visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code);
++ return search_error_codes(visited_error_codes, expand_from, gimple_assign_rhs1(def_stmt), error_code);
+ case 3:
+ if (!error_code)
+ return error_code;
@@ -208577,9 +209651,9 @@ index 0000000..c958d66
+ * before the error code PHI.
+ */
+ rhs1 = gimple_assign_rhs1(assign);
-+ handle_binary_assign(visited, expand_from, assign, rhs1);
++ handle_binary_assign(expand_from, assign, rhs1);
+ rhs2 = gimple_assign_rhs2(assign);
-+ handle_binary_assign(visited, expand_from, assign, rhs2);
++ handle_binary_assign(expand_from, assign, rhs2);
+ return error_code;
+ }
+ gcc_unreachable();
@@ -208589,7 +209663,7 @@ index 0000000..c958d66
+
+ error_code = has_error_code(as_a_gphi(def_stmt));
+ for (i = 0; i < gimple_phi_num_args(def_stmt); i++) {
-+ error_code = search_error_codes(visited, visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code);
++ error_code = search_error_codes(visited_error_codes, expand_from, gimple_phi_arg_def(def_stmt, i), error_code);
+ }
+ return error_code;
+ }
@@ -208600,7 +209674,7 @@ index 0000000..c958d66
+ }
+}
+
-+static bool handle_error_codes(struct visited *visited, interesting_stmts_t expand_from)
++static bool handle_error_codes(interesting_stmts_t expand_from)
+{
+ bool error_code;
+ gimple_set *visited_error_codes;
@@ -208610,7 +209684,7 @@ index 0000000..c958d66
+ return false;
+
+ visited_error_codes = pointer_set_create();
-+ error_code = search_error_codes(visited, visited_error_codes, expand_from, expand_from->orig_node, false);
++ error_code = search_error_codes(visited_error_codes, expand_from, expand_from->orig_node, false);
+ pointer_set_destroy(visited_error_codes);
+
+ return error_code;
@@ -208624,19 +209698,18 @@ index 0000000..c958d66
+ tree new_node;
+ gimple orig_def_stmt;
+
-+ if (handle_error_codes(visited, cur))
++ cur->visited = visited;
++ if (handle_error_codes(cur))
+ continue;
+
-+ new_node = expand(visited, cur, cur->orig_node);
++ new_node = expand(cur, cur->orig_node);
+ if (new_node == NULL_TREE)
+ continue;
+
+ orig_def_stmt = get_def_stmt(cur->orig_node);
-+
-+ change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num);
-+
+ if (pointer_set_contains(visited->no_cast_check, orig_def_stmt))
+ continue;
++ change_orig_node(visited, cur->first_stmt, cur->orig_node, new_node, cur->num);
+ check_size_overflow(cur, cur->first_stmt, TREE_TYPE(new_node), new_node, cur->orig_node, BEFORE_STMT);
+ }
+}
@@ -209014,12 +210087,12 @@ index 0000000..c958d66
+}
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c
new file mode 100644
-index 0000000..9162fe5
+index 0000000..062204a
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_transform_core.c
-@@ -0,0 +1,1015 @@
+@@ -0,0 +1,1025 @@
+/*
-+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
@@ -209374,7 +210447,7 @@ index 0000000..9162fe5
+ return result;
+}
+
-+static tree handle_phi(struct visited *visited, interesting_stmts_t expand_from, tree orig_result)
++static tree handle_phi(interesting_stmts_t expand_from, tree orig_result)
+{
+#if BUILDING_GCC_VERSION <= 4007
+ VEC(tree, heap) *args = NULL;
@@ -209386,18 +210459,18 @@ index 0000000..9162fe5
+ gphi *oldstmt = as_a_gphi(get_def_stmt(orig_result));
+
+ len = gimple_phi_num_args(oldstmt);
-+ pointer_set_insert(visited->stmts, oldstmt);
++ pointer_set_insert(expand_from->visited->stmts, oldstmt);
+ for (i = 0; i < len; i++) {
+ tree arg, new_arg;
+
+ arg = gimple_phi_arg_def(oldstmt, i);
-+ new_arg = expand(visited, expand_from, arg);
++ new_arg = expand(expand_from, arg);
+
+ if (ssa_name_var == NULL_TREE && new_arg != NULL_TREE)
+ ssa_name_var = SSA_NAME_VAR(new_arg);
+
+ if (is_gimple_constant(arg)) {
-+ tree size_overflow_type = get_size_overflow_type(visited, oldstmt, arg);
++ tree size_overflow_type = get_size_overflow_type(expand_from->visited, oldstmt, arg);
+
+ new_arg = cast_a_tree(size_overflow_type, arg);
+ }
@@ -209410,9 +210483,9 @@ index 0000000..9162fe5
+ }
+
+#if BUILDING_GCC_VERSION <= 4007
-+ return create_new_phi_node(visited, &args, ssa_name_var, oldstmt);
++ return create_new_phi_node(expand_from->visited, &args, ssa_name_var, oldstmt);
+#else
-+ return create_new_phi_node(visited, args, ssa_name_var, oldstmt);
++ return create_new_phi_node(expand_from->visited, args, ssa_name_var, oldstmt);
+#endif
+}
+
@@ -209429,7 +210502,7 @@ index 0000000..9162fe5
+ return create_assign(visited, stmt, rhs1, AFTER_STMT);
+}
+
-+static bool skip_lhs_cast_check(const gassign *stmt)
++static bool skip_lhs_cast_check(struct visited *visited, const gassign *stmt)
+{
+ const_tree rhs = gimple_assign_rhs1(stmt);
+ const_gimple def_stmt = get_def_stmt(rhs);
@@ -209438,8 +210511,10 @@ index 0000000..9162fe5
+ if (gimple_code(def_stmt) == GIMPLE_ASM)
+ return true;
+
-+ if (is_const_plus_unsigned_signed_truncation(rhs))
++ if (is_const_plus_unsigned_signed_truncation(rhs)) {
++ pointer_set_insert(visited->no_cast_check, stmt);
+ return true;
++ }
+
+ return false;
+}
@@ -209564,14 +210639,15 @@ index 0000000..9162fe5
+ const_tree rhs_type = TREE_TYPE(rhs);
+ tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
+
++ if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
++ return;
++
+ gcc_assert(rhs_type != NULL_TREE);
+ if (TREE_CODE(rhs_type) == POINTER_TYPE)
+ return;
+
+ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
+
-+ if (is_const_plus_unsigned_signed_truncation(rhs))
-+ return;
+ if (is_gimple_assign(stmt) && neg_short_add_intentional_overflow(as_a_gassign(stmt)))
+ return;
+
@@ -209629,7 +210705,7 @@ index 0000000..9162fe5
+ * _589 = -_588;
+ * _590 = (long int) _589;
+ */
-+static bool handle_unsigned_neg_or_bit_not(struct visited *visited, interesting_stmts_t expand_from, const gassign *stmt)
++static bool handle_unsigned_neg_or_bit_not(interesting_stmts_t expand_from, const gassign *stmt)
+{
+ gimple def_neg_stmt, neg_stmt;
+ tree lhs, new_neg_rhs;
@@ -209654,13 +210730,13 @@ index 0000000..9162fe5
+ if (!def_neg_stmt)
+ return false;
+
-+ new_neg_rhs = get_my_stmt_lhs(visited, def_neg_stmt);
++ new_neg_rhs = get_my_stmt_lhs(expand_from->visited, def_neg_stmt);
+ check_size_overflow(expand_from, neg_stmt, TREE_TYPE(new_neg_rhs), new_neg_rhs, lhs, BEFORE_STMT);
-+ pointer_set_insert(visited->no_cast_check, stmt);
++ pointer_set_insert(expand_from->visited->no_cast_check, stmt);
+ return true;
+}
+
-+static tree create_cast_overflow_check(struct visited *visited, interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt)
++static tree create_cast_overflow_check(interesting_stmts_t expand_from, tree new_rhs1, gassign *stmt)
+{
+ bool cast_lhs, cast_rhs;
+ tree lhs = gimple_assign_lhs(stmt);
@@ -209686,18 +210762,18 @@ index 0000000..9162fe5
+ { true, false, true, true }, // lhs < rhs
+ };
+
-+ if (handle_unsigned_neg_or_bit_not(visited, expand_from, stmt))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ if (handle_unsigned_neg_or_bit_not(expand_from, stmt))
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+
+ // skip lhs check on HI -> QI cast
+ if (rhs_mode == HImode && lhs_mode == QImode) {
-+ pointer_set_insert(visited->no_cast_check, stmt);
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ pointer_set_insert(expand_from->visited->no_cast_check, stmt);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+ }
+
+ // skip lhs check on signed SI -> HI cast or signed SI -> QI cast
+ if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
+ if (lhs_size > rhs_size) {
+ cast_lhs = check_lhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
@@ -209711,53 +210787,60 @@ index 0000000..9162fe5
+ }
+
+ if (!cast_lhs && !cast_rhs)
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+
-+ if (cast_lhs && !skip_lhs_cast_check(stmt))
++ if (cast_lhs && !skip_lhs_cast_check(expand_from->visited, stmt))
+ check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, lhs, BEFORE_STMT);
+
+ if (cast_rhs)
+ check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs, BEFORE_STMT);
+
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+}
+
-+static tree handle_unary_rhs(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt)
++static tree handle_unary_rhs(interesting_stmts_t expand_from, gassign *stmt)
+{
+ enum tree_code rhs_code;
+ tree rhs1, new_rhs1, lhs = gimple_assign_lhs(stmt);
+
-+ if (pointer_set_contains(visited->my_stmts, stmt))
++ if (pointer_set_contains(expand_from->visited->my_stmts, stmt))
+ return lhs;
+
+ rhs1 = gimple_assign_rhs1(stmt);
+ if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
-+ new_rhs1 = expand(visited, expand_from, rhs1);
++ new_rhs1 = expand(expand_from, rhs1);
+
+ if (new_rhs1 == NULL_TREE)
-+ return create_cast_assign(visited, stmt);
++ return create_cast_assign(expand_from->visited, stmt);
++
++ if (pointer_set_contains(expand_from->visited->no_cast_check, stmt))
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+
-+ if (pointer_set_contains(visited->no_cast_check, stmt))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++#if BUILDING_GCC_VERSION >= 5000
++ if (short_or_neg_const_ushort(stmt)) {
++ pointer_set_insert(expand_from->visited->no_cast_check, stmt);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ }
++#endif
+
+ rhs_code = gimple_assign_rhs_code(stmt);
+ if (rhs_code == BIT_NOT_EXPR || rhs_code == NEGATE_EXPR) {
-+ tree size_overflow_type = get_size_overflow_type(visited, stmt, rhs1);
++ tree size_overflow_type = get_size_overflow_type(expand_from->visited, stmt, rhs1);
+
-+ new_rhs1 = cast_to_new_size_overflow_type(visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ new_rhs1 = cast_to_new_size_overflow_type(expand_from->visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
+ check_size_overflow(expand_from, stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+ }
+
+ if (!gimple_assign_cast_p(stmt))
-+ return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
++ return dup_assign(expand_from->visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
+
-+ return create_cast_overflow_check(visited, expand_from, new_rhs1, stmt);
++ return create_cast_overflow_check(expand_from, new_rhs1, stmt);
+}
+
-+static tree handle_unary_ops(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt)
++static tree handle_unary_ops(interesting_stmts_t expand_from, gassign *stmt)
+{
+ tree rhs1, lhs = gimple_assign_lhs(stmt);
+ gimple def_stmt = get_def_stmt(lhs);
@@ -209766,14 +210849,14 @@ index 0000000..9162fe5
+ rhs1 = gimple_assign_rhs1(def_stmt);
+
+ if (is_gimple_constant(rhs1))
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
+
+ switch (TREE_CODE(rhs1)) {
+ case SSA_NAME: {
-+ tree ret = handle_unary_rhs(visited, expand_from, as_a_gassign(def_stmt));
++ tree ret = handle_unary_rhs(expand_from, as_a_gassign(def_stmt));
+
+ if (gimple_assign_cast_p(stmt))
-+ unsigned_signed_cast_intentional_overflow(visited, stmt);
++ unsigned_signed_cast_intentional_overflow(expand_from->visited, stmt);
+ return ret;
+ }
+ case ARRAY_REF:
@@ -209786,10 +210869,10 @@ index 0000000..9162fe5
+#endif
+ case TARGET_MEM_REF:
+ case VIEW_CONVERT_EXPR:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
+ case PARM_DECL:
+ case VAR_DECL:
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
+ default:
+ debug_gimple_stmt(def_stmt);
@@ -209843,7 +210926,7 @@ index 0000000..9162fe5
+ return true;
+}
+
-+static tree handle_comparison_code_class(struct visited *visited, interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2)
++static tree handle_comparison_code_class(interesting_stmts_t expand_from, gassign *stmt, tree new_rhs1, tree new_rhs2)
+{
+ tree rhs1, rhs2, lhs;
+
@@ -209853,15 +210936,15 @@ index 0000000..9162fe5
+
+ lhs = gimple_assign_lhs(stmt);
+ if (new_rhs2 == NULL_TREE)
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+
+ rhs2 = gimple_assign_rhs2(stmt);
+ if (!is_gimple_constant(rhs2))
+ check_size_overflow(expand_from, stmt, TREE_TYPE(new_rhs2), new_rhs2, rhs2, BEFORE_STMT);
-+ return create_assign(visited, stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, stmt, lhs, AFTER_STMT);
+}
+
-+static tree handle_binary_ops(struct visited *visited, interesting_stmts_t expand_from, tree lhs)
++static tree handle_binary_ops(interesting_stmts_t expand_from, tree lhs)
+{
+ enum intentional_overflow_type res;
+ tree rhs1, rhs2, new_lhs;
@@ -209870,7 +210953,7 @@ index 0000000..9162fe5
+ tree new_rhs2 = NULL_TREE;
+
+ if (is_ptr_diff(def_stmt))
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
+
+ rhs1 = gimple_assign_rhs1(def_stmt);
+ rhs2 = gimple_assign_rhs2(def_stmt);
@@ -209889,86 +210972,86 @@ index 0000000..9162fe5
+ case EXACT_DIV_EXPR:
+ case POINTER_PLUS_EXPR:
+ case BIT_AND_EXPR:
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
+ default:
+ break;
+ }
+
-+ new_lhs = handle_integer_truncation(visited, expand_from, lhs);
++ new_lhs = handle_integer_truncation(expand_from, lhs);
+ if (new_lhs != NULL_TREE)
+ return new_lhs;
+
+ if (TREE_CODE(rhs1) == SSA_NAME)
-+ new_rhs1 = expand(visited, expand_from, rhs1);
++ new_rhs1 = expand(expand_from, rhs1);
+ if (TREE_CODE(rhs2) == SSA_NAME)
-+ new_rhs2 = expand(visited, expand_from, rhs2);
++ new_rhs2 = expand(expand_from, rhs2);
+
+ res = add_mul_intentional_overflow(def_stmt);
+ if (res != NO_INTENTIONAL_OVERFLOW) {
-+ new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+ insert_cast_expr(visited, as_a_gassign(get_def_stmt(new_lhs)), res);
++ new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++ insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), res);
+ return new_lhs;
+ }
+
+ if (skip_expr_on_double_type(def_stmt)) {
-+ new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
-+ insert_cast_expr(visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW);
++ new_lhs = dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++ insert_cast_expr(expand_from->visited, as_a_gassign(get_def_stmt(new_lhs)), NO_INTENTIONAL_OVERFLOW);
+ return new_lhs;
+ }
+
+ if (is_a_neg_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, expand_from, true, def_stmt, new_rhs1, NULL_TREE);
++ return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs1, NULL_TREE);
+ if (is_a_neg_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, expand_from, true, def_stmt, new_rhs2, new_rhs2);
++ return handle_intentional_overflow(expand_from, true, def_stmt, new_rhs2, new_rhs2);
+
+
+ if (is_a_constant_overflow(def_stmt, rhs2))
-+ return handle_intentional_overflow(visited, expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE);
++ return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE);
+ if (is_a_constant_overflow(def_stmt, rhs1))
-+ return handle_intentional_overflow(visited, expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2);
++ return handle_intentional_overflow(expand_from, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2);
+
+ // the const is between 0 and (signed) MAX
+ if (is_gimple_constant(rhs1))
-+ new_rhs1 = create_assign(visited, def_stmt, rhs1, BEFORE_STMT);
++ new_rhs1 = create_assign(expand_from->visited, def_stmt, rhs1, BEFORE_STMT);
+ if (is_gimple_constant(rhs2))
-+ new_rhs2 = create_assign(visited, def_stmt, rhs2, BEFORE_STMT);
++ new_rhs2 = create_assign(expand_from->visited, def_stmt, rhs2, BEFORE_STMT);
+
+ if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
-+ return handle_comparison_code_class(visited, expand_from, def_stmt, new_rhs1, new_rhs2);
++ return handle_comparison_code_class(expand_from, def_stmt, new_rhs1, new_rhs2);
+
+ if (uconst_neg_intentional_overflow(def_stmt)) {
+ inform(gimple_location(def_stmt), "%s: gcc intentional overflow", __func__);
+ gcc_unreachable();
+ }
+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
++ return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
+}
+
+#if BUILDING_GCC_VERSION >= 4006
-+static tree get_new_rhs(struct visited *visited, interesting_stmts_t expand_from, tree size_overflow_type, tree rhs)
++static tree get_new_rhs(interesting_stmts_t expand_from, tree size_overflow_type, tree rhs)
+{
+ if (is_gimple_constant(rhs))
+ return cast_a_tree(size_overflow_type, rhs);
+ if (TREE_CODE(rhs) != SSA_NAME)
+ return NULL_TREE;
-+ return expand(visited, expand_from, rhs);
++ return expand(expand_from, rhs);
+}
+
-+static tree handle_ternary_ops(struct visited *visited, interesting_stmts_t expand_from, tree lhs)
++static tree handle_ternary_ops(interesting_stmts_t expand_from, tree lhs)
+{
+ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
+ gassign *def_stmt = as_a_gassign(get_def_stmt(lhs));
+
-+ size_overflow_type = get_size_overflow_type(visited, def_stmt, lhs);
++ size_overflow_type = get_size_overflow_type(expand_from->visited, def_stmt, lhs);
+
+ rhs1 = gimple_assign_rhs1(def_stmt);
+ rhs2 = gimple_assign_rhs2(def_stmt);
+ rhs3 = gimple_assign_rhs3(def_stmt);
-+ new_rhs1 = get_new_rhs(visited, expand_from, size_overflow_type, rhs1);
-+ new_rhs2 = get_new_rhs(visited, expand_from, size_overflow_type, rhs2);
-+ new_rhs3 = get_new_rhs(visited, expand_from, size_overflow_type, rhs3);
++ new_rhs1 = get_new_rhs(expand_from, size_overflow_type, rhs1);
++ new_rhs2 = get_new_rhs(expand_from, size_overflow_type, rhs2);
++ new_rhs3 = get_new_rhs(expand_from, size_overflow_type, rhs3);
+
-+ return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
++ return dup_assign(expand_from->visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
+}
+#endif
+
@@ -209988,7 +211071,7 @@ index 0000000..9162fe5
+ return get_my_stmt_lhs(visited, def_stmt);
+}
+
-+tree expand(struct visited *visited, interesting_stmts_t expand_from, tree lhs)
++tree expand(interesting_stmts_t expand_from, tree lhs)
+{
+ gimple def_stmt;
+
@@ -209997,11 +211080,11 @@ index 0000000..9162fe5
+ if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
+ return NULL_TREE;
+
-+ if (pointer_set_contains(visited->my_stmts, def_stmt))
++ if (pointer_set_contains(expand_from->visited->my_stmts, def_stmt))
+ return lhs;
+
-+ if (pointer_set_contains(visited->stmts, def_stmt))
-+ return expand_visited(visited, def_stmt);
++ if (pointer_set_contains(expand_from->visited->stmts, def_stmt))
++ return expand_visited(expand_from->visited, def_stmt);
+
+ if (is_gimple_constant(lhs))
+ return NULL_TREE;
@@ -210010,21 +211093,21 @@ index 0000000..9162fe5
+
+ switch (gimple_code(def_stmt)) {
+ case GIMPLE_PHI:
-+ return handle_phi(visited, expand_from, lhs);
++ return handle_phi(expand_from, lhs);
+ case GIMPLE_CALL:
+ case GIMPLE_ASM:
+ if (is_size_overflow_asm(def_stmt))
-+ return expand(visited, expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt)));
-+ return create_assign(visited, def_stmt, lhs, AFTER_STMT);
++ return expand(expand_from, get_size_overflow_asm_input(as_a_gasm(def_stmt)));
++ return create_assign(expand_from->visited, def_stmt, lhs, AFTER_STMT);
+ case GIMPLE_ASSIGN:
+ switch (gimple_num_ops(def_stmt)) {
+ case 2:
-+ return handle_unary_ops(visited, expand_from, as_a_gassign(def_stmt));
++ return handle_unary_ops(expand_from, as_a_gassign(def_stmt));
+ case 3:
-+ return handle_binary_ops(visited, expand_from, lhs);
++ return handle_binary_ops(expand_from, lhs);
+#if BUILDING_GCC_VERSION >= 4006
+ case 4:
-+ return handle_ternary_ops(visited, expand_from, lhs);
++ return handle_ternary_ops(expand_from, lhs);
+#endif
+ }
+ default:
diff --git a/4.5.2/4425_grsec_remove_EI_PAX.patch b/4.5.3/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.5.2/4425_grsec_remove_EI_PAX.patch
rename to 4.5.3/4425_grsec_remove_EI_PAX.patch
diff --git a/4.5.2/4427_force_XATTR_PAX_tmpfs.patch b/4.5.3/4427_force_XATTR_PAX_tmpfs.patch
similarity index 82%
rename from 4.5.2/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.5.3/4427_force_XATTR_PAX_tmpfs.patch
index 6db8e37..aa2a091 100644
--- a/4.5.2/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.5.3/4427_force_XATTR_PAX_tmpfs.patch
@@ -6,7 +6,7 @@ namespace supported on tmpfs so that the PaX markings survive emerge.
diff -Naur a/mm/shmem.c b/mm/shmem.c
--- a/mm/shmem.c 2016-04-29 19:56:25.306101147 -0400
+++ b/mm/shmem.c 2016-04-29 19:59:44.126104490 -0400
-@@ -2670,24 +2670,20 @@
+@@ -2670,7 +2670,6 @@
return simple_xattr_set(&info->xattrs, name, value, size, flags);
}
@@ -14,16 +14,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c
static int shmem_user_xattr_handler_set(const struct xattr_handler *handler,
struct dentry *dentry, const char *name,
const void *value, size_t size, int flags)
- {
- struct shmem_inode_info *info = SHMEM_I(d_inode(dentry));
-
--#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
- if (strcmp(name, XATTR_NAME_PAX_FLAGS))
- return -EOPNOTSUPP;
- if (size > 8)
- return -EINVAL;
--#endif
-
+@@ -2685,7 +2684,6 @@
name = xattr_full_name(handler, name);
return simple_xattr_set(&info->xattrs, name, value, size, flags);
}
@@ -31,7 +22,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c
static const struct xattr_handler shmem_security_xattr_handler = {
.prefix = XATTR_SECURITY_PREFIX,
-@@ -2701,13 +2697,11 @@
+@@ -2699,13 +2697,11 @@
.set = shmem_xattr_handler_set,
};
@@ -45,7 +36,7 @@ diff -Naur a/mm/shmem.c b/mm/shmem.c
static const struct xattr_handler *shmem_xattr_handlers[] = {
#ifdef CONFIG_TMPFS_POSIX_ACL
-@@ -2717,9 +2711,7 @@
+@@ -2715,9 +2711,7 @@
&shmem_security_xattr_handler,
&shmem_trusted_xattr_handler,
diff --git a/4.5.2/4430_grsec-remove-localversion-grsec.patch b/4.5.3/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.5.2/4430_grsec-remove-localversion-grsec.patch
rename to 4.5.3/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.5.2/4435_grsec-mute-warnings.patch b/4.5.3/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.5.2/4435_grsec-mute-warnings.patch
rename to 4.5.3/4435_grsec-mute-warnings.patch
diff --git a/4.5.2/4440_grsec-remove-protected-paths.patch b/4.5.3/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.5.2/4440_grsec-remove-protected-paths.patch
rename to 4.5.3/4440_grsec-remove-protected-paths.patch
diff --git a/4.5.2/4450_grsec-kconfig-default-gids.patch b/4.5.3/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.5.2/4450_grsec-kconfig-default-gids.patch
rename to 4.5.3/4450_grsec-kconfig-default-gids.patch
diff --git a/4.5.2/4465_selinux-avc_audit-log-curr_ip.patch b/4.5.3/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.5.2/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.5.3/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.5.2/4470_disable-compat_vdso.patch b/4.5.3/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.5.2/4470_disable-compat_vdso.patch
rename to 4.5.3/4470_disable-compat_vdso.patch
diff --git a/4.5.2/4475_emutramp_default_on.patch b/4.5.3/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.5.2/4475_emutramp_default_on.patch
rename to 4.5.3/4475_emutramp_default_on.patch
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2016-05-08 18:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-08 18:54 [gentoo-commits] proj/hardened-patchset:master commit in: 4.5.2/, 4.5.3/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox