Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.11/0100-4.11.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.11/0100-4.11.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2920 - (show annotations) (download)
    Fri May 19 09:22:52 2017 UTC (6 years, 11 months ago) by niro
    File size: 54861 byte(s) 
    -added 4.11.1 patch
    1 diff --git a/Makefile b/Makefile
    2 index 4b074a904106..9dc2aec1c2e5 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 11
    8 -SUBLEVEL = 0
    9 +SUBLEVEL = 1
    10 EXTRAVERSION =
    11 NAME = Fearless Coyote
    12
    13 diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
    14 index 220ba207be91..36ec9c8f6e16 100644
    15 --- a/arch/arm/include/asm/device.h
    16 +++ b/arch/arm/include/asm/device.h
    17 @@ -16,6 +16,9 @@ struct dev_archdata {
    18 #ifdef CONFIG_ARM_DMA_USE_IOMMU
    19 struct dma_iommu_mapping *mapping;
    20 #endif
    21 +#ifdef CONFIG_XEN
    22 + const struct dma_map_ops *dev_dma_ops;
    23 +#endif
    24 bool dma_coherent;
    25 };
    26
    27 diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
    28 index 716656925975..680d3f3889e7 100644
    29 --- a/arch/arm/include/asm/dma-mapping.h
    30 +++ b/arch/arm/include/asm/dma-mapping.h
    31 @@ -16,19 +16,9 @@
    32 extern const struct dma_map_ops arm_dma_ops;
    33 extern const struct dma_map_ops arm_coherent_dma_ops;
    34
    35 -static inline const struct dma_map_ops *__generic_dma_ops(struct device *dev)
    36 -{
    37 - if (dev && dev->dma_ops)
    38 - return dev->dma_ops;
    39 - return &arm_dma_ops;
    40 -}
    41 -
    42 static inline const struct dma_map_ops *get_arch_dma_ops(struct bus_type *bus)
    43 {
    44 - if (xen_initial_domain())
    45 - return xen_dma_ops;
    46 - else
    47 - return __generic_dma_ops(NULL);
    48 + return &arm_dma_ops;
    49 }
    50
    51 #define HAVE_ARCH_DMA_SUPPORTED 1
    52 diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
    53 index 475811f5383a..0268584f1fa0 100644
    54 --- a/arch/arm/mm/dma-mapping.c
    55 +++ b/arch/arm/mm/dma-mapping.c
    56 @@ -2414,6 +2414,13 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
    57 dma_ops = arm_get_dma_map_ops(coherent);
    58
    59 set_dma_ops(dev, dma_ops);
    60 +
    61 +#ifdef CONFIG_XEN
    62 + if (xen_initial_domain()) {
    63 + dev->archdata.dev_dma_ops = dev->dma_ops;
    64 + dev->dma_ops = xen_dma_ops;
    65 + }
    66 +#endif
    67 }
    68
    69 void arch_teardown_dma_ops(struct device *dev)
    70 diff --git a/arch/arm64/include/asm/device.h b/arch/arm64/include/asm/device.h
    71 index 73d5bab015eb..5a5fa47a6b18 100644
    72 --- a/arch/arm64/include/asm/device.h
    73 +++ b/arch/arm64/include/asm/device.h
    74 @@ -20,6 +20,9 @@ struct dev_archdata {
    75 #ifdef CONFIG_IOMMU_API
    76 void *iommu; /* private IOMMU data */
    77 #endif
    78 +#ifdef CONFIG_XEN
    79 + const struct dma_map_ops *dev_dma_ops;
    80 +#endif
    81 bool dma_coherent;
    82 };
    83
    84 diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
    85 index 505756cdc67a..5392dbeffa45 100644
    86 --- a/arch/arm64/include/asm/dma-mapping.h
    87 +++ b/arch/arm64/include/asm/dma-mapping.h
    88 @@ -27,11 +27,8 @@
    89 #define DMA_ERROR_CODE (~(dma_addr_t)0)
    90 extern const struct dma_map_ops dummy_dma_ops;
    91
    92 -static inline const struct dma_map_ops *__generic_dma_ops(struct device *dev)
    93 +static inline const struct dma_map_ops *get_arch_dma_ops(struct bus_type *bus)
    94 {
    95 - if (dev && dev->dma_ops)
    96 - return dev->dma_ops;
    97 -
    98 /*
    99 * We expect no ISA devices, and all other DMA masters are expected to
    100 * have someone call arch_setup_dma_ops at device creation time.
    101 @@ -39,14 +36,6 @@ static inline const struct dma_map_ops *__generic_dma_ops(struct device *dev)
    102 return &dummy_dma_ops;
    103 }
    104
    105 -static inline const struct dma_map_ops *get_arch_dma_ops(struct bus_type *bus)
    106 -{
    107 - if (xen_initial_domain())
    108 - return xen_dma_ops;
    109 - else
    110 - return __generic_dma_ops(NULL);
    111 -}
    112 -
    113 void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
    114 const struct iommu_ops *iommu, bool coherent);
    115 #define arch_setup_dma_ops arch_setup_dma_ops
    116 diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
    117 index 81cdb2e844ed..7f8b37e85a2b 100644
    118 --- a/arch/arm64/mm/dma-mapping.c
    119 +++ b/arch/arm64/mm/dma-mapping.c
    120 @@ -977,4 +977,11 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
    121
    122 dev->archdata.dma_coherent = coherent;
    123 __iommu_setup_dma_ops(dev, dma_base, size, iommu);
    124 +
    125 +#ifdef CONFIG_XEN
    126 + if (xen_initial_domain()) {
    127 + dev->archdata.dev_dma_ops = dev->dma_ops;
    128 + dev->dma_ops = xen_dma_ops;
    129 + }
    130 +#endif
    131 }
    132 diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
    133 index a785554916c0..ce8ab0409deb 100644
    134 --- a/arch/arm64/net/bpf_jit_comp.c
    135 +++ b/arch/arm64/net/bpf_jit_comp.c
    136 @@ -779,14 +779,14 @@ static int build_body(struct jit_ctx *ctx)
    137 int ret;
    138
    139 ret = build_insn(insn, ctx);
    140 -
    141 - if (ctx->image == NULL)
    142 - ctx->offset[i] = ctx->idx;
    143 -
    144 if (ret > 0) {
    145 i++;
    146 + if (ctx->image == NULL)
    147 + ctx->offset[i] = ctx->idx;
    148 continue;
    149 }
    150 + if (ctx->image == NULL)
    151 + ctx->offset[i] = ctx->idx;
    152 if (ret)
    153 return ret;
    154 }
    155 diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
    156 index 44101196d02b..41a407328667 100644
    157 --- a/arch/sparc/kernel/head_64.S
    158 +++ b/arch/sparc/kernel/head_64.S
    159 @@ -939,3 +939,9 @@ ENTRY(__retl_o1)
    160 retl
    161 mov %o1, %o0
    162 ENDPROC(__retl_o1)
    163 +
    164 +ENTRY(__retl_o1_asi)
    165 + wr %o5, 0x0, %asi
    166 + retl
    167 + mov %o1, %o0
    168 +ENDPROC(__retl_o1_asi)
    169 diff --git a/arch/sparc/lib/GENbzero.S b/arch/sparc/lib/GENbzero.S
    170 index 8e7a843ddd88..2fbf6297d57c 100644
    171 --- a/arch/sparc/lib/GENbzero.S
    172 +++ b/arch/sparc/lib/GENbzero.S
    173 @@ -8,7 +8,7 @@
    174 98: x,y; \
    175 .section __ex_table,"a";\
    176 .align 4; \
    177 - .word 98b, __retl_o1; \
    178 + .word 98b, __retl_o1_asi;\
    179 .text; \
    180 .align 4;
    181
    182 diff --git a/arch/sparc/lib/NGbzero.S b/arch/sparc/lib/NGbzero.S
    183 index beab29bf419b..33053bdf3766 100644
    184 --- a/arch/sparc/lib/NGbzero.S
    185 +++ b/arch/sparc/lib/NGbzero.S
    186 @@ -8,7 +8,7 @@
    187 98: x,y; \
    188 .section __ex_table,"a";\
    189 .align 4; \
    190 - .word 98b, __retl_o1; \
    191 + .word 98b, __retl_o1_asi;\
    192 .text; \
    193 .align 4;
    194
    195 diff --git a/arch/x86/include/asm/xen/events.h b/arch/x86/include/asm/xen/events.h
    196 index 608a79d5a466..e6911caf5bbf 100644
    197 --- a/arch/x86/include/asm/xen/events.h
    198 +++ b/arch/x86/include/asm/xen/events.h
    199 @@ -20,4 +20,15 @@ static inline int xen_irqs_disabled(struct pt_regs *regs)
    200 /* No need for a barrier -- XCHG is a barrier on x86. */
    201 #define xchg_xen_ulong(ptr, val) xchg((ptr), (val))
    202
    203 +extern int xen_have_vector_callback;
    204 +
    205 +/*
    206 + * Events delivered via platform PCI interrupts are always
    207 + * routed to vcpu 0 and hence cannot be rebound.
    208 + */
    209 +static inline bool xen_support_evtchn_rebind(void)
    210 +{
    211 + return (!xen_hvm_domain() || xen_have_vector_callback);
    212 +}
    213 +
    214 #endif /* _ASM_X86_XEN_EVENTS_H */
    215 diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
    216 index 292ab0364a89..c4b3646bd04c 100644
    217 --- a/arch/x86/pci/xen.c
    218 +++ b/arch/x86/pci/xen.c
    219 @@ -447,7 +447,7 @@ void __init xen_msi_init(void)
    220
    221 int __init pci_xen_hvm_init(void)
    222 {
    223 - if (!xen_feature(XENFEAT_hvm_pirqs))
    224 + if (!xen_have_vector_callback || !xen_feature(XENFEAT_hvm_pirqs))
    225 return 0;
    226
    227 #ifdef CONFIG_ACPI
    228 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
    229 index ec1d5c46e58f..29b239025b57 100644
    230 --- a/arch/x86/xen/enlighten.c
    231 +++ b/arch/x86/xen/enlighten.c
    232 @@ -138,6 +138,8 @@ struct shared_info xen_dummy_shared_info;
    233 void *xen_initial_gdt;
    234
    235 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
    236 +__read_mostly int xen_have_vector_callback;
    237 +EXPORT_SYMBOL_GPL(xen_have_vector_callback);
    238
    239 static int xen_cpu_up_prepare(unsigned int cpu);
    240 static int xen_cpu_up_online(unsigned int cpu);
    241 @@ -1861,7 +1863,9 @@ static int xen_cpu_up_prepare(unsigned int cpu)
    242 xen_vcpu_setup(cpu);
    243 }
    244
    245 - if (xen_pv_domain() || xen_feature(XENFEAT_hvm_safe_pvclock))
    246 + if (xen_pv_domain() ||
    247 + (xen_have_vector_callback &&
    248 + xen_feature(XENFEAT_hvm_safe_pvclock)))
    249 xen_setup_timer(cpu);
    250
    251 rc = xen_smp_intr_init(cpu);
    252 @@ -1877,7 +1881,9 @@ static int xen_cpu_dead(unsigned int cpu)
    253 {
    254 xen_smp_intr_free(cpu);
    255
    256 - if (xen_pv_domain() || xen_feature(XENFEAT_hvm_safe_pvclock))
    257 + if (xen_pv_domain() ||
    258 + (xen_have_vector_callback &&
    259 + xen_feature(XENFEAT_hvm_safe_pvclock)))
    260 xen_teardown_timer(cpu);
    261
    262 return 0;
    263 @@ -1916,8 +1922,8 @@ static void __init xen_hvm_guest_init(void)
    264
    265 xen_panic_handler_init();
    266
    267 - BUG_ON(!xen_feature(XENFEAT_hvm_callback_vector));
    268 -
    269 + if (xen_feature(XENFEAT_hvm_callback_vector))
    270 + xen_have_vector_callback = 1;
    271 xen_hvm_smp_init();
    272 WARN_ON(xen_cpuhp_setup());
    273 xen_unplug_emulated_devices();
    274 @@ -1958,7 +1964,7 @@ bool xen_hvm_need_lapic(void)
    275 return false;
    276 if (!xen_hvm_domain())
    277 return false;
    278 - if (xen_feature(XENFEAT_hvm_pirqs))
    279 + if (xen_feature(XENFEAT_hvm_pirqs) && xen_have_vector_callback)
    280 return false;
    281 return true;
    282 }
    283 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
    284 index 7ff2f1bfb7ec..4e6b65baf8e2 100644
    285 --- a/arch/x86/xen/smp.c
    286 +++ b/arch/x86/xen/smp.c
    287 @@ -742,6 +742,8 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
    288
    289 void __init xen_hvm_smp_init(void)
    290 {
    291 + if (!xen_have_vector_callback)
    292 + return;
    293 smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
    294 smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
    295 smp_ops.cpu_die = xen_cpu_die;
    296 diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
    297 index 1e69956d7852..4535627cf532 100644
    298 --- a/arch/x86/xen/time.c
    299 +++ b/arch/x86/xen/time.c
    300 @@ -432,6 +432,11 @@ static void xen_hvm_setup_cpu_clockevents(void)
    301
    302 void __init xen_hvm_init_time_ops(void)
    303 {
    304 + /* vector callback is needed otherwise we cannot receive interrupts
    305 + * on cpu > 0 and at this point we don't know how many cpus are
    306 + * available */
    307 + if (!xen_have_vector_callback)
    308 + return;
    309 if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
    310 printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
    311 "disable pv timer\n");
    312 diff --git a/block/blk-integrity.c b/block/blk-integrity.c
    313 index 9f0ff5ba4f84..35c5af1ea068 100644
    314 --- a/block/blk-integrity.c
    315 +++ b/block/blk-integrity.c
    316 @@ -417,7 +417,7 @@ void blk_integrity_register(struct gendisk *disk, struct blk_integrity *template
    317 bi->tuple_size = template->tuple_size;
    318 bi->tag_size = template->tag_size;
    319
    320 - blk_integrity_revalidate(disk);
    321 + disk->queue->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
    322 }
    323 EXPORT_SYMBOL(blk_integrity_register);
    324
    325 @@ -430,26 +430,11 @@ EXPORT_SYMBOL(blk_integrity_register);
    326 */
    327 void blk_integrity_unregister(struct gendisk *disk)
    328 {
    329 - blk_integrity_revalidate(disk);
    330 + disk->queue->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES;
    331 memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity));
    332 }
    333 EXPORT_SYMBOL(blk_integrity_unregister);
    334
    335 -void blk_integrity_revalidate(struct gendisk *disk)
    336 -{
    337 - struct blk_integrity *bi = &disk->queue->integrity;
    338 -
    339 - if (!(disk->flags & GENHD_FL_UP))
    340 - return;
    341 -
    342 - if (bi->profile)
    343 - disk->queue->backing_dev_info->capabilities |=
    344 - BDI_CAP_STABLE_WRITES;
    345 - else
    346 - disk->queue->backing_dev_info->capabilities &=
    347 - ~BDI_CAP_STABLE_WRITES;
    348 -}
    349 -
    350 void blk_integrity_add(struct gendisk *disk)
    351 {
    352 if (kobject_init_and_add(&disk->integrity_kobj, &integrity_ktype,
    353 diff --git a/block/partition-generic.c b/block/partition-generic.c
    354 index 7afb9907821f..0171a2faad68 100644
    355 --- a/block/partition-generic.c
    356 +++ b/block/partition-generic.c
    357 @@ -497,7 +497,6 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
    358
    359 if (disk->fops->revalidate_disk)
    360 disk->fops->revalidate_disk(disk);
    361 - blk_integrity_revalidate(disk);
    362 check_disk_size_change(disk, bdev);
    363 bdev->bd_invalidated = 0;
    364 if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
    365 diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c
    366 index 86279f5022c2..88f16cdf6a4b 100644
    367 --- a/drivers/gpu/drm/sti/sti_gdp.c
    368 +++ b/drivers/gpu/drm/sti/sti_gdp.c
    369 @@ -66,7 +66,9 @@ static struct gdp_format_to_str {
    370 #define GAM_GDP_ALPHARANGE_255 BIT(5)
    371 #define GAM_GDP_AGC_FULL_RANGE 0x00808080
    372 #define GAM_GDP_PPT_IGNORE (BIT(1) | BIT(0))
    373 -#define GAM_GDP_SIZE_MAX 0x7FF
    374 +
    375 +#define GAM_GDP_SIZE_MAX_WIDTH 3840
    376 +#define GAM_GDP_SIZE_MAX_HEIGHT 2160
    377
    378 #define GDP_NODE_NB_BANK 2
    379 #define GDP_NODE_PER_FIELD 2
    380 @@ -632,8 +634,8 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane,
    381 /* src_x are in 16.16 format */
    382 src_x = state->src_x >> 16;
    383 src_y = state->src_y >> 16;
    384 - src_w = clamp_val(state->src_w >> 16, 0, GAM_GDP_SIZE_MAX);
    385 - src_h = clamp_val(state->src_h >> 16, 0, GAM_GDP_SIZE_MAX);
    386 + src_w = clamp_val(state->src_w >> 16, 0, GAM_GDP_SIZE_MAX_WIDTH);
    387 + src_h = clamp_val(state->src_h >> 16, 0, GAM_GDP_SIZE_MAX_HEIGHT);
    388
    389 format = sti_gdp_fourcc2format(fb->format->format);
    390 if (format == -1) {
    391 @@ -741,8 +743,8 @@ static void sti_gdp_atomic_update(struct drm_plane *drm_plane,
    392 /* src_x are in 16.16 format */
    393 src_x = state->src_x >> 16;
    394 src_y = state->src_y >> 16;
    395 - src_w = clamp_val(state->src_w >> 16, 0, GAM_GDP_SIZE_MAX);
    396 - src_h = clamp_val(state->src_h >> 16, 0, GAM_GDP_SIZE_MAX);
    397 + src_w = clamp_val(state->src_w >> 16, 0, GAM_GDP_SIZE_MAX_WIDTH);
    398 + src_h = clamp_val(state->src_h >> 16, 0, GAM_GDP_SIZE_MAX_HEIGHT);
    399
    400 list = sti_gdp_get_free_nodes(gdp);
    401 top_field = list->top_field;
    402 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
    403 index 4da6fc6b1ffd..3d040f52539c 100644
    404 --- a/drivers/md/dm-ioctl.c
    405 +++ b/drivers/md/dm-ioctl.c
    406 @@ -1848,7 +1848,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user)
    407 if (r)
    408 goto out;
    409
    410 - param->data_size = sizeof(*param);
    411 + param->data_size = offsetof(struct dm_ioctl, data);
    412 r = fn(param, input_param_size);
    413
    414 if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&
    415 diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
    416 index 1f1e54ba0ecb..2c02a4cebc24 100644
    417 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
    418 +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
    419 @@ -3000,7 +3000,8 @@ static int bnxt_alloc_ntp_fltrs(struct bnxt *bp)
    420 INIT_HLIST_HEAD(&bp->ntp_fltr_hash_tbl[i]);
    421
    422 bp->ntp_fltr_count = 0;
    423 - bp->ntp_fltr_bmap = kzalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR),
    424 + bp->ntp_fltr_bmap = kcalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR),
    425 + sizeof(long),
    426 GFP_KERNEL);
    427
    428 if (!bp->ntp_fltr_bmap)
    429 diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
    430 index 30606b11b128..377fb0f22a5b 100644
    431 --- a/drivers/net/ethernet/cadence/macb.c
    432 +++ b/drivers/net/ethernet/cadence/macb.c
    433 @@ -432,15 +432,17 @@ static int macb_mii_probe(struct net_device *dev)
    434 }
    435
    436 pdata = dev_get_platdata(&bp->pdev->dev);
    437 - if (pdata && gpio_is_valid(pdata->phy_irq_pin)) {
    438 - ret = devm_gpio_request(&bp->pdev->dev, pdata->phy_irq_pin,
    439 - "phy int");
    440 - if (!ret) {
    441 - phy_irq = gpio_to_irq(pdata->phy_irq_pin);
    442 - phydev->irq = (phy_irq < 0) ? PHY_POLL : phy_irq;
    443 + if (pdata) {
    444 + if (gpio_is_valid(pdata->phy_irq_pin)) {
    445 + ret = devm_gpio_request(&bp->pdev->dev,
    446 + pdata->phy_irq_pin, "phy int");
    447 + if (!ret) {
    448 + phy_irq = gpio_to_irq(pdata->phy_irq_pin);
    449 + phydev->irq = (phy_irq < 0) ? PHY_POLL : phy_irq;
    450 + }
    451 + } else {
    452 + phydev->irq = PHY_POLL;
    453 }
    454 - } else {
    455 - phydev->irq = PHY_POLL;
    456 }
    457
    458 /* attach the mac to the phy */
    459 diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
    460 index 7074b40ebd7f..dec5d563ab19 100644
    461 --- a/drivers/net/geneve.c
    462 +++ b/drivers/net/geneve.c
    463 @@ -1244,7 +1244,7 @@ static int geneve_newlink(struct net *net, struct net_device *dev,
    464 metadata = true;
    465
    466 if (data[IFLA_GENEVE_UDP_CSUM] &&
    467 - !nla_get_u8(data[IFLA_GENEVE_UDP_CSUM]))
    468 + nla_get_u8(data[IFLA_GENEVE_UDP_CSUM]))
    469 info.key.tun_flags |= TUNNEL_CSUM;
    470
    471 if (data[IFLA_GENEVE_UDP_ZERO_CSUM6_TX] &&
    472 diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
    473 index 0a0412524cec..0a5f62e0efcc 100644
    474 --- a/drivers/net/phy/mdio-mux-bcm-iproc.c
    475 +++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
    476 @@ -203,11 +203,14 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev)
    477 &md->mux_handle, md, md->mii_bus);
    478 if (rc) {
    479 dev_info(md->dev, "mdiomux initialization failed\n");
    480 - goto out;
    481 + goto out_register;
    482 }
    483
    484 dev_info(md->dev, "iProc mdiomux registered\n");
    485 return 0;
    486 +
    487 +out_register:
    488 + mdiobus_unregister(bus);
    489 out:
    490 mdiobus_free(bus);
    491 return rc;
    492 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    493 index 2474618404f5..4e34568db64f 100644
    494 --- a/drivers/net/usb/qmi_wwan.c
    495 +++ b/drivers/net/usb/qmi_wwan.c
    496 @@ -907,6 +907,7 @@ static const struct usb_device_id products[] = {
    497 {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
    498 {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
    499 {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
    500 + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
    501 {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
    502 {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
    503 {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */
    504 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
    505 index 60da86a8d95b..f6b17fb58877 100644
    506 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
    507 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
    508 @@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
    509 int ret;
    510 struct brcmf_if *ifp = netdev_priv(ndev);
    511 struct brcmf_pub *drvr = ifp->drvr;
    512 - struct ethhdr *eh = (struct ethhdr *)(skb->data);
    513 + struct ethhdr *eh;
    514
    515 brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
    516
    517 @@ -211,22 +211,13 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
    518 goto done;
    519 }
    520
    521 - /* Make sure there's enough room for any header */
    522 - if (skb_headroom(skb) < drvr->hdrlen) {
    523 - struct sk_buff *skb2;
    524 -
    525 - brcmf_dbg(INFO, "%s: insufficient headroom\n",
    526 + /* Make sure there's enough writable headroom*/
    527 + ret = skb_cow_head(skb, drvr->hdrlen);
    528 + if (ret < 0) {
    529 + brcmf_err("%s: skb_cow_head failed\n",
    530 brcmf_ifname(ifp));
    531 - drvr->bus_if->tx_realloc++;
    532 - skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
    533 dev_kfree_skb(skb);
    534 - skb = skb2;
    535 - if (skb == NULL) {
    536 - brcmf_err("%s: skb_realloc_headroom failed\n",
    537 - brcmf_ifname(ifp));
    538 - ret = -ENOMEM;
    539 - goto done;
    540 - }
    541 + goto done;
    542 }
    543
    544 /* validate length for ether packet */
    545 @@ -236,6 +227,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
    546 goto done;
    547 }
    548
    549 + eh = (struct ethhdr *)(skb->data);
    550 +
    551 if (eh->h_proto == htons(ETH_P_PAE))
    552 atomic_inc(&ifp->pend_8021x_cnt);
    553
    554 diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c
    555 index 509e2b341bd6..677f7c40b25a 100644
    556 --- a/drivers/power/supply/lp8788-charger.c
    557 +++ b/drivers/power/supply/lp8788-charger.c
    558 @@ -651,7 +651,7 @@ static ssize_t lp8788_show_eoc_time(struct device *dev,
    559 {
    560 struct lp8788_charger *pchg = dev_get_drvdata(dev);
    561 char *stime[] = { "400ms", "5min", "10min", "15min",
    562 - "20min", "25min", "30min" "No timeout" };
    563 + "20min", "25min", "30min", "No timeout" };
    564 u8 val;
    565
    566 lp8788_read_byte(pchg->lp, LP8788_CHG_EOC, &val);
    567 diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
    568 index 6a53577772c9..42807ce11c42 100644
    569 --- a/drivers/xen/events/events_base.c
    570 +++ b/drivers/xen/events/events_base.c
    571 @@ -1312,6 +1312,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
    572 if (!VALID_EVTCHN(evtchn))
    573 return -1;
    574
    575 + if (!xen_support_evtchn_rebind())
    576 + return -1;
    577 +
    578 /* Send future instances of this interrupt to other vcpu. */
    579 bind_vcpu.port = evtchn;
    580 bind_vcpu.vcpu = xen_vcpu_nr(tcpu);
    581 @@ -1645,15 +1648,20 @@ void xen_callback_vector(void)
    582 {
    583 int rc;
    584 uint64_t callback_via;
    585 -
    586 - callback_via = HVM_CALLBACK_VECTOR(HYPERVISOR_CALLBACK_VECTOR);
    587 - rc = xen_set_callback_via(callback_via);
    588 - BUG_ON(rc);
    589 - pr_info("Xen HVM callback vector for event delivery is enabled\n");
    590 - /* in the restore case the vector has already been allocated */
    591 - if (!test_bit(HYPERVISOR_CALLBACK_VECTOR, used_vectors))
    592 - alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
    593 - xen_hvm_callback_vector);
    594 + if (xen_have_vector_callback) {
    595 + callback_via = HVM_CALLBACK_VECTOR(HYPERVISOR_CALLBACK_VECTOR);
    596 + rc = xen_set_callback_via(callback_via);
    597 + if (rc) {
    598 + pr_err("Request for Xen HVM callback vector failed\n");
    599 + xen_have_vector_callback = 0;
    600 + return;
    601 + }
    602 + pr_info("Xen HVM callback vector for event delivery is enabled\n");
    603 + /* in the restore case the vector has already been allocated */
    604 + if (!test_bit(HYPERVISOR_CALLBACK_VECTOR, used_vectors))
    605 + alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
    606 + xen_hvm_callback_vector);
    607 + }
    608 }
    609 #else
    610 void xen_callback_vector(void) {}
    611 diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
    612 index 2a165cc8a43c..1c4deac9b0f8 100644
    613 --- a/drivers/xen/platform-pci.c
    614 +++ b/drivers/xen/platform-pci.c
    615 @@ -67,7 +67,7 @@ static uint64_t get_callback_via(struct pci_dev *pdev)
    616 pin = pdev->pin;
    617
    618 /* We don't know the GSI. Specify the PCI INTx line instead. */
    619 - return ((uint64_t)0x01 << HVM_CALLBACK_VIA_TYPE_SHIFT) | /* PCI INTx identifier */
    620 + return ((uint64_t)0x01 << 56) | /* PCI INTx identifier */
    621 ((uint64_t)pci_domain_nr(pdev->bus) << 32) |
    622 ((uint64_t)pdev->bus->number << 16) |
    623 ((uint64_t)(pdev->devfn & 0xff) << 8) |
    624 @@ -90,7 +90,7 @@ static int xen_allocate_irq(struct pci_dev *pdev)
    625 static int platform_pci_resume(struct pci_dev *pdev)
    626 {
    627 int err;
    628 - if (!xen_pv_domain())
    629 + if (xen_have_vector_callback)
    630 return 0;
    631 err = xen_set_callback_via(callback_via);
    632 if (err) {
    633 @@ -138,14 +138,7 @@ static int platform_pci_probe(struct pci_dev *pdev,
    634 platform_mmio = mmio_addr;
    635 platform_mmiolen = mmio_len;
    636
    637 - /*
    638 - * Xen HVM guests always use the vector callback mechanism.
    639 - * L1 Dom0 in a nested Xen environment is a PV guest inside in an
    640 - * HVM environment. It needs the platform-pci driver to get
    641 - * notifications from L0 Xen, but it cannot use the vector callback
    642 - * as it is not exported by L1 Xen.
    643 - */
    644 - if (xen_pv_domain()) {
    645 + if (!xen_have_vector_callback) {
    646 ret = xen_allocate_irq(pdev);
    647 if (ret) {
    648 dev_warn(&pdev->dev, "request_irq failed err=%d\n", ret);
    649 diff --git a/fs/block_dev.c b/fs/block_dev.c
    650 index 2eca00ec4370..56039dfbc674 100644
    651 --- a/fs/block_dev.c
    652 +++ b/fs/block_dev.c
    653 @@ -1451,7 +1451,6 @@ int revalidate_disk(struct gendisk *disk)
    654
    655 if (disk->fops->revalidate_disk)
    656 ret = disk->fops->revalidate_disk(disk);
    657 - blk_integrity_revalidate(disk);
    658 bdev = bdget_disk(disk, 0);
    659 if (!bdev)
    660 return ret;
    661 diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
    662 index 96fe8ed73100..858aef564a58 100644
    663 --- a/fs/f2fs/super.c
    664 +++ b/fs/f2fs/super.c
    665 @@ -1483,6 +1483,13 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
    666 return 1;
    667 }
    668
    669 + if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) {
    670 + f2fs_msg(sb, KERN_INFO,
    671 + "Invalid segment count (%u)",
    672 + le32_to_cpu(raw_super->segment_count));
    673 + return 1;
    674 + }
    675 +
    676 /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
    677 if (sanity_check_area_boundary(sbi, bh))
    678 return 1;
    679 diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
    680 index e2d239ed4c60..661200e6d281 100644
    681 --- a/include/linux/f2fs_fs.h
    682 +++ b/include/linux/f2fs_fs.h
    683 @@ -302,6 +302,12 @@ struct f2fs_nat_block {
    684 #define SIT_ENTRY_PER_BLOCK (PAGE_SIZE / sizeof(struct f2fs_sit_entry))
    685
    686 /*
    687 + * F2FS uses 4 bytes to represent block address. As a result, supported size of
    688 + * disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.
    689 + */
    690 +#define F2FS_MAX_SEGMENT ((16 * 1024 * 1024) / 2)
    691 +
    692 +/*
    693 * Note that f2fs_sit_entry->vblocks has the following bit-field information.
    694 * [15:10] : allocation type such as CURSEG_XXXX_TYPE
    695 * [9:0] : valid block count
    696 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
    697 index 76f39754e7b0..76d6a1cd4153 100644
    698 --- a/include/linux/genhd.h
    699 +++ b/include/linux/genhd.h
    700 @@ -722,11 +722,9 @@ static inline void part_nr_sects_write(struct hd_struct *part, sector_t size)
    701 #if defined(CONFIG_BLK_DEV_INTEGRITY)
    702 extern void blk_integrity_add(struct gendisk *);
    703 extern void blk_integrity_del(struct gendisk *);
    704 -extern void blk_integrity_revalidate(struct gendisk *);
    705 #else /* CONFIG_BLK_DEV_INTEGRITY */
    706 static inline void blk_integrity_add(struct gendisk *disk) { }
    707 static inline void blk_integrity_del(struct gendisk *disk) { }
    708 -static inline void blk_integrity_revalidate(struct gendisk *disk) { }
    709 #endif /* CONFIG_BLK_DEV_INTEGRITY */
    710
    711 #else /* CONFIG_BLOCK */
    712 diff --git a/include/net/addrconf.h b/include/net/addrconf.h
    713 index 17c6fd84e287..4d93c5ec9b12 100644
    714 --- a/include/net/addrconf.h
    715 +++ b/include/net/addrconf.h
    716 @@ -20,6 +20,8 @@
    717 #define ADDRCONF_TIMER_FUZZ (HZ / 4)
    718 #define ADDRCONF_TIMER_FUZZ_MAX (HZ)
    719
    720 +#define ADDRCONF_NOTIFY_PRIORITY 0
    721 +
    722 #include <linux/in.h>
    723 #include <linux/in6.h>
    724
    725 diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
    726 index 9dc2c182a263..f5e625f53367 100644
    727 --- a/include/net/ip6_route.h
    728 +++ b/include/net/ip6_route.h
    729 @@ -84,6 +84,7 @@ struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
    730 struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
    731 int ifindex, struct flowi6 *fl6, int flags);
    732
    733 +void ip6_route_init_special_entries(void);
    734 int ip6_route_init(void);
    735 void ip6_route_cleanup(void);
    736
    737 diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
    738 index 0caee631a836..b94006f6fbdd 100644
    739 --- a/include/net/secure_seq.h
    740 +++ b/include/net/secure_seq.h
    741 @@ -6,10 +6,12 @@
    742 u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
    743 u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
    744 __be16 dport);
    745 -u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
    746 - __be16 sport, __be16 dport, u32 *tsoff);
    747 -u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
    748 - __be16 sport, __be16 dport, u32 *tsoff);
    749 +u32 secure_tcp_seq(__be32 saddr, __be32 daddr,
    750 + __be16 sport, __be16 dport);
    751 +u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr);
    752 +u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr,
    753 + __be16 sport, __be16 dport);
    754 +u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr);
    755 u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
    756 __be16 sport, __be16 dport);
    757 u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
    758 diff --git a/include/net/tcp.h b/include/net/tcp.h
    759 index 6ec4ea652f3f..6423b4698880 100644
    760 --- a/include/net/tcp.h
    761 +++ b/include/net/tcp.h
    762 @@ -471,7 +471,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb);
    763 /* From syncookies.c */
    764 struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
    765 struct request_sock *req,
    766 - struct dst_entry *dst);
    767 + struct dst_entry *dst, u32 tsoff);
    768 int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
    769 u32 cookie);
    770 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb);
    771 @@ -1816,7 +1816,8 @@ struct tcp_request_sock_ops {
    772 struct dst_entry *(*route_req)(const struct sock *sk, struct flowi *fl,
    773 const struct request_sock *req,
    774 bool *strict);
    775 - __u32 (*init_seq)(const struct sk_buff *skb, u32 *tsoff);
    776 + u32 (*init_seq)(const struct sk_buff *skb);
    777 + u32 (*init_ts_off)(const struct sk_buff *skb);
    778 int (*send_synack)(const struct sock *sk, struct dst_entry *dst,
    779 struct flowi *fl, struct request_sock *req,
    780 struct tcp_fastopen_cookie *foc,
    781 diff --git a/include/xen/arm/page-coherent.h b/include/xen/arm/page-coherent.h
    782 index 95ce6ac3a971..b0a2bfc8d647 100644
    783 --- a/include/xen/arm/page-coherent.h
    784 +++ b/include/xen/arm/page-coherent.h
    785 @@ -2,8 +2,16 @@
    786 #define _ASM_ARM_XEN_PAGE_COHERENT_H
    787
    788 #include <asm/page.h>
    789 +#include <asm/dma-mapping.h>
    790 #include <linux/dma-mapping.h>
    791
    792 +static inline const struct dma_map_ops *__generic_dma_ops(struct device *dev)
    793 +{
    794 + if (dev && dev->archdata.dev_dma_ops)
    795 + return dev->archdata.dev_dma_ops;
    796 + return get_arch_dma_ops(NULL);
    797 +}
    798 +
    799 void __xen_dma_map_page(struct device *hwdev, struct page *page,
    800 dma_addr_t dev_addr, unsigned long offset, size_t size,
    801 enum dma_data_direction dir, unsigned long attrs);
    802 diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    803 index a834068a400e..6fd78d4c4164 100644
    804 --- a/kernel/bpf/verifier.c
    805 +++ b/kernel/bpf/verifier.c
    806 @@ -296,7 +296,8 @@ static const char *const bpf_jmp_string[16] = {
    807 [BPF_EXIT >> 4] = "exit",
    808 };
    809
    810 -static void print_bpf_insn(struct bpf_insn *insn)
    811 +static void print_bpf_insn(const struct bpf_verifier_env *env,
    812 + const struct bpf_insn *insn)
    813 {
    814 u8 class = BPF_CLASS(insn->code);
    815
    816 @@ -360,9 +361,19 @@ static void print_bpf_insn(struct bpf_insn *insn)
    817 insn->code,
    818 bpf_ldst_string[BPF_SIZE(insn->code) >> 3],
    819 insn->src_reg, insn->imm);
    820 - } else if (BPF_MODE(insn->code) == BPF_IMM) {
    821 - verbose("(%02x) r%d = 0x%x\n",
    822 - insn->code, insn->dst_reg, insn->imm);
    823 + } else if (BPF_MODE(insn->code) == BPF_IMM &&
    824 + BPF_SIZE(insn->code) == BPF_DW) {
    825 + /* At this point, we already made sure that the second
    826 + * part of the ldimm64 insn is accessible.
    827 + */
    828 + u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
    829 + bool map_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD;
    830 +
    831 + if (map_ptr && !env->allow_ptr_leaks)
    832 + imm = 0;
    833 +
    834 + verbose("(%02x) r%d = 0x%llx\n", insn->code,
    835 + insn->dst_reg, (unsigned long long)imm);
    836 } else {
    837 verbose("BUG_ld_%02x\n", insn->code);
    838 return;
    839 @@ -1911,6 +1922,17 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
    840 return 0;
    841 } else if (opcode == BPF_ADD &&
    842 BPF_CLASS(insn->code) == BPF_ALU64 &&
    843 + dst_reg->type == PTR_TO_STACK &&
    844 + ((BPF_SRC(insn->code) == BPF_X &&
    845 + regs[insn->src_reg].type == CONST_IMM) ||
    846 + BPF_SRC(insn->code) == BPF_K)) {
    847 + if (BPF_SRC(insn->code) == BPF_X)
    848 + dst_reg->imm += regs[insn->src_reg].imm;
    849 + else
    850 + dst_reg->imm += insn->imm;
    851 + return 0;
    852 + } else if (opcode == BPF_ADD &&
    853 + BPF_CLASS(insn->code) == BPF_ALU64 &&
    854 (dst_reg->type == PTR_TO_PACKET ||
    855 (BPF_SRC(insn->code) == BPF_X &&
    856 regs[insn->src_reg].type == PTR_TO_PACKET))) {
    857 @@ -2824,7 +2846,7 @@ static int do_check(struct bpf_verifier_env *env)
    858
    859 if (log_level) {
    860 verbose("%d: ", insn_idx);
    861 - print_bpf_insn(insn);
    862 + print_bpf_insn(env, insn);
    863 }
    864
    865 err = ext_analyzer_insn_hook(env, insn_idx, prev_insn_idx);
    866 diff --git a/lib/refcount.c b/lib/refcount.c
    867 index aa09ad3c30b0..26dffb7e4c04 100644
    868 --- a/lib/refcount.c
    869 +++ b/lib/refcount.c
    870 @@ -62,13 +62,13 @@ bool refcount_add_not_zero(unsigned int i, refcount_t *r)
    871
    872 return true;
    873 }
    874 -EXPORT_SYMBOL_GPL(refcount_add_not_zero);
    875 +EXPORT_SYMBOL(refcount_add_not_zero);
    876
    877 void refcount_add(unsigned int i, refcount_t *r)
    878 {
    879 WARN_ONCE(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
    880 }
    881 -EXPORT_SYMBOL_GPL(refcount_add);
    882 +EXPORT_SYMBOL(refcount_add);
    883
    884 /*
    885 * Similar to atomic_inc_not_zero(), will saturate at UINT_MAX and WARN.
    886 @@ -101,7 +101,7 @@ bool refcount_inc_not_zero(refcount_t *r)
    887
    888 return true;
    889 }
    890 -EXPORT_SYMBOL_GPL(refcount_inc_not_zero);
    891 +EXPORT_SYMBOL(refcount_inc_not_zero);
    892
    893 /*
    894 * Similar to atomic_inc(), will saturate at UINT_MAX and WARN.
    895 @@ -113,7 +113,7 @@ void refcount_inc(refcount_t *r)
    896 {
    897 WARN_ONCE(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
    898 }
    899 -EXPORT_SYMBOL_GPL(refcount_inc);
    900 +EXPORT_SYMBOL(refcount_inc);
    901
    902 bool refcount_sub_and_test(unsigned int i, refcount_t *r)
    903 {
    904 @@ -138,7 +138,7 @@ bool refcount_sub_and_test(unsigned int i, refcount_t *r)
    905
    906 return !new;
    907 }
    908 -EXPORT_SYMBOL_GPL(refcount_sub_and_test);
    909 +EXPORT_SYMBOL(refcount_sub_and_test);
    910
    911 /*
    912 * Similar to atomic_dec_and_test(), it will WARN on underflow and fail to
    913 @@ -152,7 +152,7 @@ bool refcount_dec_and_test(refcount_t *r)
    914 {
    915 return refcount_sub_and_test(1, r);
    916 }
    917 -EXPORT_SYMBOL_GPL(refcount_dec_and_test);
    918 +EXPORT_SYMBOL(refcount_dec_and_test);
    919
    920 /*
    921 * Similar to atomic_dec(), it will WARN on underflow and fail to decrement
    922 @@ -166,7 +166,7 @@ void refcount_dec(refcount_t *r)
    923 {
    924 WARN_ONCE(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
    925 }
    926 -EXPORT_SYMBOL_GPL(refcount_dec);
    927 +EXPORT_SYMBOL(refcount_dec);
    928
    929 /*
    930 * No atomic_t counterpart, it attempts a 1 -> 0 transition and returns the
    931 @@ -183,7 +183,7 @@ bool refcount_dec_if_one(refcount_t *r)
    932 {
    933 return atomic_cmpxchg_release(&r->refs, 1, 0) == 1;
    934 }
    935 -EXPORT_SYMBOL_GPL(refcount_dec_if_one);
    936 +EXPORT_SYMBOL(refcount_dec_if_one);
    937
    938 /*
    939 * No atomic_t counterpart, it decrements unless the value is 1, in which case
    940 @@ -217,7 +217,7 @@ bool refcount_dec_not_one(refcount_t *r)
    941
    942 return true;
    943 }
    944 -EXPORT_SYMBOL_GPL(refcount_dec_not_one);
    945 +EXPORT_SYMBOL(refcount_dec_not_one);
    946
    947 /*
    948 * Similar to atomic_dec_and_mutex_lock(), it will WARN on underflow and fail
    949 @@ -240,7 +240,7 @@ bool refcount_dec_and_mutex_lock(refcount_t *r, struct mutex *lock)
    950
    951 return true;
    952 }
    953 -EXPORT_SYMBOL_GPL(refcount_dec_and_mutex_lock);
    954 +EXPORT_SYMBOL(refcount_dec_and_mutex_lock);
    955
    956 /*
    957 * Similar to atomic_dec_and_lock(), it will WARN on underflow and fail to
    958 @@ -263,5 +263,5 @@ bool refcount_dec_and_lock(refcount_t *r, spinlock_t *lock)
    959
    960 return true;
    961 }
    962 -EXPORT_SYMBOL_GPL(refcount_dec_and_lock);
    963 +EXPORT_SYMBOL(refcount_dec_and_lock);
    964
    965 diff --git a/lib/test_bpf.c b/lib/test_bpf.c
    966 index 0362da0b66c3..2e385026915c 100644
    967 --- a/lib/test_bpf.c
    968 +++ b/lib/test_bpf.c
    969 @@ -4656,6 +4656,51 @@ static struct bpf_test tests[] = {
    970 { },
    971 { { 0, 1 } },
    972 },
    973 + {
    974 + /* Mainly testing JIT + imm64 here. */
    975 + "JMP_JGE_X: ldimm64 test 1",
    976 + .u.insns_int = {
    977 + BPF_ALU32_IMM(BPF_MOV, R0, 0),
    978 + BPF_LD_IMM64(R1, 3),
    979 + BPF_LD_IMM64(R2, 2),
    980 + BPF_JMP_REG(BPF_JGE, R1, R2, 2),
    981 + BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
    982 + BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL),
    983 + BPF_EXIT_INSN(),
    984 + },
    985 + INTERNAL,
    986 + { },
    987 + { { 0, 0xeeeeeeeeU } },
    988 + },
    989 + {
    990 + "JMP_JGE_X: ldimm64 test 2",
    991 + .u.insns_int = {
    992 + BPF_ALU32_IMM(BPF_MOV, R0, 0),
    993 + BPF_LD_IMM64(R1, 3),
    994 + BPF_LD_IMM64(R2, 2),
    995 + BPF_JMP_REG(BPF_JGE, R1, R2, 0),
    996 + BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
    997 + BPF_EXIT_INSN(),
    998 + },
    999 + INTERNAL,
    1000 + { },
    1001 + { { 0, 0xffffffffU } },
    1002 + },
    1003 + {
    1004 + "JMP_JGE_X: ldimm64 test 3",
    1005 + .u.insns_int = {
    1006 + BPF_ALU32_IMM(BPF_MOV, R0, 1),
    1007 + BPF_LD_IMM64(R1, 3),
    1008 + BPF_LD_IMM64(R2, 2),
    1009 + BPF_JMP_REG(BPF_JGE, R1, R2, 4),
    1010 + BPF_LD_IMM64(R0, 0xffffffffffffffffUL),
    1011 + BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL),
    1012 + BPF_EXIT_INSN(),
    1013 + },
    1014 + INTERNAL,
    1015 + { },
    1016 + { { 0, 1 } },
    1017 + },
    1018 /* BPF_JMP | BPF_JNE | BPF_X */
    1019 {
    1020 "JMP_JNE_X: if (3 != 2) return 1",
    1021 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    1022 index c4e84c558240..69daf393cbe1 100644
    1023 --- a/net/core/rtnetlink.c
    1024 +++ b/net/core/rtnetlink.c
    1025 @@ -1056,7 +1056,7 @@ static int rtnl_phys_port_name_fill(struct sk_buff *skb, struct net_device *dev)
    1026 return err;
    1027 }
    1028
    1029 - if (nla_put(skb, IFLA_PHYS_PORT_NAME, strlen(name), name))
    1030 + if (nla_put_string(skb, IFLA_PHYS_PORT_NAME, name))
    1031 return -EMSGSIZE;
    1032
    1033 return 0;
    1034 diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
    1035 index d28da7d363f1..ae35cce3a40d 100644
    1036 --- a/net/core/secure_seq.c
    1037 +++ b/net/core/secure_seq.c
    1038 @@ -24,9 +24,13 @@ static siphash_key_t ts_secret __read_mostly;
    1039
    1040 static __always_inline void net_secret_init(void)
    1041 {
    1042 - net_get_random_once(&ts_secret, sizeof(ts_secret));
    1043 net_get_random_once(&net_secret, sizeof(net_secret));
    1044 }
    1045 +
    1046 +static __always_inline void ts_secret_init(void)
    1047 +{
    1048 + net_get_random_once(&ts_secret, sizeof(ts_secret));
    1049 +}
    1050 #endif
    1051
    1052 #ifdef CONFIG_INET
    1053 @@ -47,7 +51,7 @@ static u32 seq_scale(u32 seq)
    1054 #endif
    1055
    1056 #if IS_ENABLED(CONFIG_IPV6)
    1057 -static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
    1058 +u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
    1059 {
    1060 const struct {
    1061 struct in6_addr saddr;
    1062 @@ -60,12 +64,14 @@ static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
    1063 if (sysctl_tcp_timestamps != 1)
    1064 return 0;
    1065
    1066 + ts_secret_init();
    1067 return siphash(&combined, offsetofend(typeof(combined), daddr),
    1068 &ts_secret);
    1069 }
    1070 +EXPORT_SYMBOL(secure_tcpv6_ts_off);
    1071
    1072 -u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
    1073 - __be16 sport, __be16 dport, u32 *tsoff)
    1074 +u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr,
    1075 + __be16 sport, __be16 dport)
    1076 {
    1077 const struct {
    1078 struct in6_addr saddr;
    1079 @@ -78,14 +84,14 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
    1080 .sport = sport,
    1081 .dport = dport
    1082 };
    1083 - u64 hash;
    1084 + u32 hash;
    1085 +
    1086 net_secret_init();
    1087 hash = siphash(&combined, offsetofend(typeof(combined), dport),
    1088 &net_secret);
    1089 - *tsoff = secure_tcpv6_ts_off(saddr, daddr);
    1090 return seq_scale(hash);
    1091 }
    1092 -EXPORT_SYMBOL(secure_tcpv6_sequence_number);
    1093 +EXPORT_SYMBOL(secure_tcpv6_seq);
    1094
    1095 u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
    1096 __be16 dport)
    1097 @@ -107,30 +113,30 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
    1098 #endif
    1099
    1100 #ifdef CONFIG_INET
    1101 -static u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr)
    1102 +u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr)
    1103 {
    1104 if (sysctl_tcp_timestamps != 1)
    1105 return 0;
    1106
    1107 + ts_secret_init();
    1108 return siphash_2u32((__force u32)saddr, (__force u32)daddr,
    1109 &ts_secret);
    1110 }
    1111
    1112 -/* secure_tcp_sequence_number(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d),
    1113 +/* secure_tcp_seq_and_tsoff(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d),
    1114 * but fortunately, `sport' cannot be 0 in any circumstances. If this changes,
    1115 * it would be easy enough to have the former function use siphash_4u32, passing
    1116 * the arguments as separate u32.
    1117 */
    1118 -
    1119 -u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
    1120 - __be16 sport, __be16 dport, u32 *tsoff)
    1121 +u32 secure_tcp_seq(__be32 saddr, __be32 daddr,
    1122 + __be16 sport, __be16 dport)
    1123 {
    1124 - u64 hash;
    1125 + u32 hash;
    1126 +
    1127 net_secret_init();
    1128 hash = siphash_3u32((__force u32)saddr, (__force u32)daddr,
    1129 (__force u32)sport << 16 | (__force u32)dport,
    1130 &net_secret);
    1131 - *tsoff = secure_tcp_ts_off(saddr, daddr);
    1132 return seq_scale(hash);
    1133 }
    1134
    1135 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    1136 index 9d943974de2b..bdffad875691 100644
    1137 --- a/net/ipv4/raw.c
    1138 +++ b/net/ipv4/raw.c
    1139 @@ -358,6 +358,9 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
    1140 rt->dst.dev->mtu);
    1141 return -EMSGSIZE;
    1142 }
    1143 + if (length < sizeof(struct iphdr))
    1144 + return -EINVAL;
    1145 +
    1146 if (flags&MSG_PROBE)
    1147 goto out;
    1148
    1149 diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
    1150 index 496b97e17aaf..0257d965f111 100644
    1151 --- a/net/ipv4/syncookies.c
    1152 +++ b/net/ipv4/syncookies.c
    1153 @@ -16,6 +16,7 @@
    1154 #include <linux/siphash.h>
    1155 #include <linux/kernel.h>
    1156 #include <linux/export.h>
    1157 +#include <net/secure_seq.h>
    1158 #include <net/tcp.h>
    1159 #include <net/route.h>
    1160
    1161 @@ -203,7 +204,7 @@ EXPORT_SYMBOL_GPL(__cookie_v4_check);
    1162
    1163 struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
    1164 struct request_sock *req,
    1165 - struct dst_entry *dst)
    1166 + struct dst_entry *dst, u32 tsoff)
    1167 {
    1168 struct inet_connection_sock *icsk = inet_csk(sk);
    1169 struct sock *child;
    1170 @@ -213,6 +214,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
    1171 NULL, &own_req);
    1172 if (child) {
    1173 atomic_set(&req->rsk_refcnt, 1);
    1174 + tcp_sk(child)->tsoffset = tsoff;
    1175 sock_rps_save_rxhash(child, skb);
    1176 inet_csk_reqsk_queue_add(sk, req, child);
    1177 } else {
    1178 @@ -292,6 +294,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
    1179 struct rtable *rt;
    1180 __u8 rcv_wscale;
    1181 struct flowi4 fl4;
    1182 + u32 tsoff = 0;
    1183
    1184 if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
    1185 goto out;
    1186 @@ -311,6 +314,11 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
    1187 memset(&tcp_opt, 0, sizeof(tcp_opt));
    1188 tcp_parse_options(skb, &tcp_opt, 0, NULL);
    1189
    1190 + if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
    1191 + tsoff = secure_tcp_ts_off(ip_hdr(skb)->daddr, ip_hdr(skb)->saddr);
    1192 + tcp_opt.rcv_tsecr -= tsoff;
    1193 + }
    1194 +
    1195 if (!cookie_timestamp_decode(&tcp_opt))
    1196 goto out;
    1197
    1198 @@ -381,7 +389,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
    1199 ireq->rcv_wscale = rcv_wscale;
    1200 ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);
    1201
    1202 - ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst);
    1203 + ret = tcp_get_cookie_sock(sk, skb, req, &rt->dst, tsoff);
    1204 /* ip_queue_xmit() depends on our flow being setup
    1205 * Normal sockets get it right from inet_csk_route_child_sock()
    1206 */
    1207 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    1208 index 40ba4249a586..2dc7fcf60bf3 100644
    1209 --- a/net/ipv4/tcp.c
    1210 +++ b/net/ipv4/tcp.c
    1211 @@ -533,7 +533,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
    1212
    1213 if (tp->urg_data & TCP_URG_VALID)
    1214 mask |= POLLPRI;
    1215 - } else if (sk->sk_state == TCP_SYN_SENT && inet_sk(sk)->defer_connect) {
    1216 + } else if (state == TCP_SYN_SENT && inet_sk(sk)->defer_connect) {
    1217 /* Active TCP fastopen socket with defer_connect
    1218 * Return POLLOUT so application can call write()
    1219 * in order for kernel to generate SYN+data
    1220 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    1221 index 659d1baefb2b..3c6c8787b42e 100644
    1222 --- a/net/ipv4/tcp_input.c
    1223 +++ b/net/ipv4/tcp_input.c
    1224 @@ -85,7 +85,6 @@ int sysctl_tcp_dsack __read_mostly = 1;
    1225 int sysctl_tcp_app_win __read_mostly = 31;
    1226 int sysctl_tcp_adv_win_scale __read_mostly = 1;
    1227 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
    1228 -EXPORT_SYMBOL(sysctl_tcp_timestamps);
    1229
    1230 /* rfc5961 challenge ack rate limiting */
    1231 int sysctl_tcp_challenge_ack_limit = 1000;
    1232 @@ -6332,8 +6331,8 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
    1233 if (security_inet_conn_request(sk, skb, req))
    1234 goto drop_and_free;
    1235
    1236 - if (isn && tmp_opt.tstamp_ok)
    1237 - af_ops->init_seq(skb, &tcp_rsk(req)->ts_off);
    1238 + if (tmp_opt.tstamp_ok)
    1239 + tcp_rsk(req)->ts_off = af_ops->init_ts_off(skb);
    1240
    1241 if (!want_cookie && !isn) {
    1242 /* VJ's idea. We save last timestamp seen
    1243 @@ -6375,7 +6374,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
    1244 goto drop_and_release;
    1245 }
    1246
    1247 - isn = af_ops->init_seq(skb, &tcp_rsk(req)->ts_off);
    1248 + isn = af_ops->init_seq(skb);
    1249 }
    1250 if (!dst) {
    1251 dst = af_ops->route_req(sk, &fl, req, NULL);
    1252 @@ -6387,7 +6386,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
    1253
    1254 if (want_cookie) {
    1255 isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
    1256 - tcp_rsk(req)->ts_off = 0;
    1257 req->cookie_ts = tmp_opt.tstamp_ok;
    1258 if (!tmp_opt.tstamp_ok)
    1259 inet_rsk(req)->ecn_ok = 0;
    1260 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    1261 index 575e19dcc017..1a5fa95c981f 100644
    1262 --- a/net/ipv4/tcp_ipv4.c
    1263 +++ b/net/ipv4/tcp_ipv4.c
    1264 @@ -94,12 +94,18 @@ static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
    1265 struct inet_hashinfo tcp_hashinfo;
    1266 EXPORT_SYMBOL(tcp_hashinfo);
    1267
    1268 -static u32 tcp_v4_init_sequence(const struct sk_buff *skb, u32 *tsoff)
    1269 +static u32 tcp_v4_init_seq(const struct sk_buff *skb)
    1270 {
    1271 - return secure_tcp_sequence_number(ip_hdr(skb)->daddr,
    1272 - ip_hdr(skb)->saddr,
    1273 - tcp_hdr(skb)->dest,
    1274 - tcp_hdr(skb)->source, tsoff);
    1275 + return secure_tcp_seq(ip_hdr(skb)->daddr,
    1276 + ip_hdr(skb)->saddr,
    1277 + tcp_hdr(skb)->dest,
    1278 + tcp_hdr(skb)->source);
    1279 +}
    1280 +
    1281 +static u32 tcp_v4_init_ts_off(const struct sk_buff *skb)
    1282 +{
    1283 + return secure_tcp_ts_off(ip_hdr(skb)->daddr,
    1284 + ip_hdr(skb)->saddr);
    1285 }
    1286
    1287 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
    1288 @@ -145,7 +151,6 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
    1289 struct flowi4 *fl4;
    1290 struct rtable *rt;
    1291 int err;
    1292 - u32 seq;
    1293 struct ip_options_rcu *inet_opt;
    1294 struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
    1295
    1296 @@ -236,13 +241,13 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
    1297 rt = NULL;
    1298
    1299 if (likely(!tp->repair)) {
    1300 - seq = secure_tcp_sequence_number(inet->inet_saddr,
    1301 - inet->inet_daddr,
    1302 - inet->inet_sport,
    1303 - usin->sin_port,
    1304 - &tp->tsoffset);
    1305 if (!tp->write_seq)
    1306 - tp->write_seq = seq;
    1307 + tp->write_seq = secure_tcp_seq(inet->inet_saddr,
    1308 + inet->inet_daddr,
    1309 + inet->inet_sport,
    1310 + usin->sin_port);
    1311 + tp->tsoffset = secure_tcp_ts_off(inet->inet_saddr,
    1312 + inet->inet_daddr);
    1313 }
    1314
    1315 inet->inet_id = tp->write_seq ^ jiffies;
    1316 @@ -1253,7 +1258,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
    1317 .cookie_init_seq = cookie_v4_init_sequence,
    1318 #endif
    1319 .route_req = tcp_v4_route_req,
    1320 - .init_seq = tcp_v4_init_sequence,
    1321 + .init_seq = tcp_v4_init_seq,
    1322 + .init_ts_off = tcp_v4_init_ts_off,
    1323 .send_synack = tcp_v4_send_synack,
    1324 };
    1325
    1326 diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
    1327 index 046fd3910873..d6fb6c067af4 100644
    1328 --- a/net/ipv4/tcp_lp.c
    1329 +++ b/net/ipv4/tcp_lp.c
    1330 @@ -264,13 +264,15 @@ static void tcp_lp_pkts_acked(struct sock *sk, const struct ack_sample *sample)
    1331 {
    1332 struct tcp_sock *tp = tcp_sk(sk);
    1333 struct lp *lp = inet_csk_ca(sk);
    1334 + u32 delta;
    1335
    1336 if (sample->rtt_us > 0)
    1337 tcp_lp_rtt_sample(sk, sample->rtt_us);
    1338
    1339 /* calc inference */
    1340 - if (tcp_time_stamp > tp->rx_opt.rcv_tsecr)
    1341 - lp->inference = 3 * (tcp_time_stamp - tp->rx_opt.rcv_tsecr);
    1342 + delta = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
    1343 + if ((s32)delta > 0)
    1344 + lp->inference = 3 * delta;
    1345
    1346 /* test if within inference */
    1347 if (lp->last_drop && (tcp_time_stamp - lp->last_drop < lp->inference))
    1348 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
    1349 index 65c0f3d13eca..c1259ccc422f 100644
    1350 --- a/net/ipv4/tcp_minisocks.c
    1351 +++ b/net/ipv4/tcp_minisocks.c
    1352 @@ -536,6 +536,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
    1353 newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
    1354 newtp->rx_opt.mss_clamp = req->mss;
    1355 tcp_ecn_openreq_child(newtp, req);
    1356 + newtp->fastopen_req = NULL;
    1357 newtp->fastopen_rsk = NULL;
    1358 newtp->syn_data_acked = 0;
    1359 newtp->rack.mstamp.v64 = 0;
    1360 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1361 index 0ea96c4d334d..311f45641673 100644
    1362 --- a/net/ipv6/addrconf.c
    1363 +++ b/net/ipv6/addrconf.c
    1364 @@ -3296,7 +3296,8 @@ static int fixup_permanent_addr(struct inet6_dev *idev,
    1365 idev->dev, 0, 0);
    1366 }
    1367
    1368 - addrconf_dad_start(ifp);
    1369 + if (ifp->state == INET6_IFADDR_STATE_PREDAD)
    1370 + addrconf_dad_start(ifp);
    1371
    1372 return 0;
    1373 }
    1374 @@ -3515,6 +3516,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
    1375 */
    1376 static struct notifier_block ipv6_dev_notf = {
    1377 .notifier_call = addrconf_notify,
    1378 + .priority = ADDRCONF_NOTIFY_PRIORITY,
    1379 };
    1380
    1381 static void addrconf_type_change(struct net_device *dev, unsigned long event)
    1382 @@ -3651,7 +3653,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
    1383 if (keep) {
    1384 /* set state to skip the notifier below */
    1385 state = INET6_IFADDR_STATE_DEAD;
    1386 - ifa->state = 0;
    1387 + ifa->state = INET6_IFADDR_STATE_PREDAD;
    1388 if (!(ifa->flags & IFA_F_NODAD))
    1389 ifa->flags |= IFA_F_TENTATIVE;
    1390
    1391 @@ -6408,6 +6410,8 @@ int __init addrconf_init(void)
    1392 goto errlo;
    1393 }
    1394
    1395 + ip6_route_init_special_entries();
    1396 +
    1397 for (i = 0; i < IN6_ADDR_HSIZE; i++)
    1398 INIT_HLIST_HEAD(&inet6_addr_lst[i]);
    1399
    1400 diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
    1401 index 0da6a12b5472..1f992d9e261d 100644
    1402 --- a/net/ipv6/raw.c
    1403 +++ b/net/ipv6/raw.c
    1404 @@ -632,6 +632,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
    1405 ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
    1406 return -EMSGSIZE;
    1407 }
    1408 + if (length < sizeof(struct ipv6hdr))
    1409 + return -EINVAL;
    1410 if (flags&MSG_PROBE)
    1411 goto out;
    1412
    1413 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1414 index fb174b590fd3..d316d00e11ab 100644
    1415 --- a/net/ipv6/route.c
    1416 +++ b/net/ipv6/route.c
    1417 @@ -3704,7 +3704,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
    1418 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
    1419 struct net *net = dev_net(dev);
    1420
    1421 - if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
    1422 + if (!(dev->flags & IFF_LOOPBACK))
    1423 + return NOTIFY_OK;
    1424 +
    1425 + if (event == NETDEV_REGISTER) {
    1426 net->ipv6.ip6_null_entry->dst.dev = dev;
    1427 net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
    1428 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
    1429 @@ -3713,6 +3716,12 @@ static int ip6_route_dev_notify(struct notifier_block *this,
    1430 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
    1431 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
    1432 #endif
    1433 + } else if (event == NETDEV_UNREGISTER) {
    1434 + in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
    1435 +#ifdef CONFIG_IPV6_MULTIPLE_TABLES
    1436 + in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
    1437 + in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
    1438 +#endif
    1439 }
    1440
    1441 return NOTIFY_OK;
    1442 @@ -4019,9 +4028,24 @@ static struct pernet_operations ip6_route_net_late_ops = {
    1443
    1444 static struct notifier_block ip6_route_dev_notifier = {
    1445 .notifier_call = ip6_route_dev_notify,
    1446 - .priority = 0,
    1447 + .priority = ADDRCONF_NOTIFY_PRIORITY - 10,
    1448 };
    1449
    1450 +void __init ip6_route_init_special_entries(void)
    1451 +{
    1452 + /* Registering of the loopback is done before this portion of code,
    1453 + * the loopback reference in rt6_info will not be taken, do it
    1454 + * manually for init_net */
    1455 + init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
    1456 + init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1457 + #ifdef CONFIG_IPV6_MULTIPLE_TABLES
    1458 + init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
    1459 + init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1460 + init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
    1461 + init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1462 + #endif
    1463 +}
    1464 +
    1465 int __init ip6_route_init(void)
    1466 {
    1467 int ret;
    1468 @@ -4048,17 +4072,6 @@ int __init ip6_route_init(void)
    1469
    1470 ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
    1471
    1472 - /* Registering of the loopback is done before this portion of code,
    1473 - * the loopback reference in rt6_info will not be taken, do it
    1474 - * manually for init_net */
    1475 - init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
    1476 - init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1477 - #ifdef CONFIG_IPV6_MULTIPLE_TABLES
    1478 - init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
    1479 - init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1480 - init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
    1481 - init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
    1482 - #endif
    1483 ret = fib6_init();
    1484 if (ret)
    1485 goto out_register_subsys;
    1486 diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
    1487 index 895ff650db43..5abc3692b901 100644
    1488 --- a/net/ipv6/syncookies.c
    1489 +++ b/net/ipv6/syncookies.c
    1490 @@ -18,6 +18,7 @@
    1491 #include <linux/random.h>
    1492 #include <linux/siphash.h>
    1493 #include <linux/kernel.h>
    1494 +#include <net/secure_seq.h>
    1495 #include <net/ipv6.h>
    1496 #include <net/tcp.h>
    1497
    1498 @@ -143,6 +144,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
    1499 int mss;
    1500 struct dst_entry *dst;
    1501 __u8 rcv_wscale;
    1502 + u32 tsoff = 0;
    1503
    1504 if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
    1505 goto out;
    1506 @@ -162,6 +164,12 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
    1507 memset(&tcp_opt, 0, sizeof(tcp_opt));
    1508 tcp_parse_options(skb, &tcp_opt, 0, NULL);
    1509
    1510 + if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) {
    1511 + tsoff = secure_tcpv6_ts_off(ipv6_hdr(skb)->daddr.s6_addr32,
    1512 + ipv6_hdr(skb)->saddr.s6_addr32);
    1513 + tcp_opt.rcv_tsecr -= tsoff;
    1514 + }
    1515 +
    1516 if (!cookie_timestamp_decode(&tcp_opt))
    1517 goto out;
    1518
    1519 @@ -242,7 +250,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
    1520 ireq->rcv_wscale = rcv_wscale;
    1521 ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), dst);
    1522
    1523 - ret = tcp_get_cookie_sock(sk, skb, req, dst);
    1524 + ret = tcp_get_cookie_sock(sk, skb, req, dst, tsoff);
    1525 out:
    1526 return ret;
    1527 out_free:
    1528 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1529 index 49fa2e8c3fa9..4c4afdca41ff 100644
    1530 --- a/net/ipv6/tcp_ipv6.c
    1531 +++ b/net/ipv6/tcp_ipv6.c
    1532 @@ -101,12 +101,18 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
    1533 }
    1534 }
    1535
    1536 -static u32 tcp_v6_init_sequence(const struct sk_buff *skb, u32 *tsoff)
    1537 +static u32 tcp_v6_init_seq(const struct sk_buff *skb)
    1538 {
    1539 - return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
    1540 - ipv6_hdr(skb)->saddr.s6_addr32,
    1541 - tcp_hdr(skb)->dest,
    1542 - tcp_hdr(skb)->source, tsoff);
    1543 + return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
    1544 + ipv6_hdr(skb)->saddr.s6_addr32,
    1545 + tcp_hdr(skb)->dest,
    1546 + tcp_hdr(skb)->source);
    1547 +}
    1548 +
    1549 +static u32 tcp_v6_init_ts_off(const struct sk_buff *skb)
    1550 +{
    1551 + return secure_tcpv6_ts_off(ipv6_hdr(skb)->daddr.s6_addr32,
    1552 + ipv6_hdr(skb)->saddr.s6_addr32);
    1553 }
    1554
    1555 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
    1556 @@ -122,7 +128,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
    1557 struct flowi6 fl6;
    1558 struct dst_entry *dst;
    1559 int addr_type;
    1560 - u32 seq;
    1561 int err;
    1562 struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
    1563
    1564 @@ -287,13 +292,13 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
    1565 sk_set_txhash(sk);
    1566
    1567 if (likely(!tp->repair)) {
    1568 - seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
    1569 - sk->sk_v6_daddr.s6_addr32,
    1570 - inet->inet_sport,
    1571 - inet->inet_dport,
    1572 - &tp->tsoffset);
    1573 if (!tp->write_seq)
    1574 - tp->write_seq = seq;
    1575 + tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
    1576 + sk->sk_v6_daddr.s6_addr32,
    1577 + inet->inet_sport,
    1578 + inet->inet_dport);
    1579 + tp->tsoffset = secure_tcpv6_ts_off(np->saddr.s6_addr32,
    1580 + sk->sk_v6_daddr.s6_addr32);
    1581 }
    1582
    1583 if (tcp_fastopen_defer_connect(sk, &err))
    1584 @@ -757,7 +762,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
    1585 .cookie_init_seq = cookie_v6_init_sequence,
    1586 #endif
    1587 .route_req = tcp_v6_route_req,
    1588 - .init_seq = tcp_v6_init_sequence,
    1589 + .init_seq = tcp_v6_init_seq,
    1590 + .init_ts_off = tcp_v6_init_ts_off,
    1591 .send_synack = tcp_v6_send_synack,
    1592 };
    1593
    1594 diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
    1595 index c848e90b6421..8b433bf3fdd7 100644
    1596 --- a/tools/testing/selftests/bpf/test_verifier.c
    1597 +++ b/tools/testing/selftests/bpf/test_verifier.c
    1598 @@ -1809,16 +1809,22 @@ static struct bpf_test tests[] = {
    1599 .result = ACCEPT,
    1600 },
    1601 {
    1602 - "unpriv: obfuscate stack pointer",
    1603 + "stack pointer arithmetic",
    1604 .insns = {
    1605 - BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
    1606 - BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    1607 - BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
    1608 + BPF_MOV64_IMM(BPF_REG_1, 4),
    1609 + BPF_JMP_IMM(BPF_JA, 0, 0, 0),
    1610 + BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
    1611 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
    1612 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
    1613 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
    1614 + BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
    1615 + BPF_ST_MEM(0, BPF_REG_2, 4, 0),
    1616 + BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
    1617 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
    1618 + BPF_ST_MEM(0, BPF_REG_2, 4, 0),
    1619 BPF_MOV64_IMM(BPF_REG_0, 0),
    1620 BPF_EXIT_INSN(),
    1621 },
    1622 - .errstr_unpriv = "R2 pointer arithmetic",
    1623 - .result_unpriv = REJECT,
    1624 .result = ACCEPT,
    1625 },
    1626 {