Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0214-4.9.115-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0214-4.9.115-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3191 - (hide annotations) (download)
    Wed Aug 8 14:17:41 2018 UTC (5 years, 9 months ago) by niro
    File size: 30091 byte(s) 
    -linux-4.9.115
    1 niro 3191 diff --git a/Makefile b/Makefile
    2     index f4cd42c9b940..889c58e39928 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 114
    9     +SUBLEVEL = 115
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
    14     index 0a0eaf09aac7..5367fe36b69d 100644
    15     --- a/arch/arc/configs/axs101_defconfig
    16     +++ b/arch/arc/configs/axs101_defconfig
    17     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    18     # CONFIG_UTS_NS is not set
    19     # CONFIG_PID_NS is not set
    20     CONFIG_BLK_DEV_INITRD=y
    21     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    22     CONFIG_EMBEDDED=y
    23     CONFIG_PERF_EVENTS=y
    24     # CONFIG_VM_EVENT_COUNTERS is not set
    25     diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
    26     index 2233f5777a71..d40fad485982 100644
    27     --- a/arch/arc/configs/axs103_defconfig
    28     +++ b/arch/arc/configs/axs103_defconfig
    29     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    30     # CONFIG_UTS_NS is not set
    31     # CONFIG_PID_NS is not set
    32     CONFIG_BLK_DEV_INITRD=y
    33     -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    34     CONFIG_EMBEDDED=y
    35     CONFIG_PERF_EVENTS=y
    36     # CONFIG_VM_EVENT_COUNTERS is not set
    37     diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
    38     index 110874705085..06cbd27ef860 100644
    39     --- a/arch/arc/configs/axs103_smp_defconfig
    40     +++ b/arch/arc/configs/axs103_smp_defconfig
    41     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    42     # CONFIG_UTS_NS is not set
    43     # CONFIG_PID_NS is not set
    44     CONFIG_BLK_DEV_INITRD=y
    45     -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    46     CONFIG_EMBEDDED=y
    47     CONFIG_PERF_EVENTS=y
    48     # CONFIG_VM_EVENT_COUNTERS is not set
    49     diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
    50     index b0066a749d4c..df609fce999b 100644
    51     --- a/arch/arc/configs/nsim_700_defconfig
    52     +++ b/arch/arc/configs/nsim_700_defconfig
    53     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    54     # CONFIG_UTS_NS is not set
    55     # CONFIG_PID_NS is not set
    56     CONFIG_BLK_DEV_INITRD=y
    57     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    58     CONFIG_KALLSYMS_ALL=y
    59     CONFIG_EMBEDDED=y
    60     CONFIG_PERF_EVENTS=y
    61     diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
    62     index ebe9ebb92933..1dbb661b4c86 100644
    63     --- a/arch/arc/configs/nsim_hs_defconfig
    64     +++ b/arch/arc/configs/nsim_hs_defconfig
    65     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    66     # CONFIG_UTS_NS is not set
    67     # CONFIG_PID_NS is not set
    68     CONFIG_BLK_DEV_INITRD=y
    69     -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    70     CONFIG_KALLSYMS_ALL=y
    71     CONFIG_EMBEDDED=y
    72     CONFIG_PERF_EVENTS=y
    73     diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
    74     index 4bde43278be6..cb36a69e5ed1 100644
    75     --- a/arch/arc/configs/nsim_hs_smp_defconfig
    76     +++ b/arch/arc/configs/nsim_hs_smp_defconfig
    77     @@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y
    78     # CONFIG_UTS_NS is not set
    79     # CONFIG_PID_NS is not set
    80     CONFIG_BLK_DEV_INITRD=y
    81     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    82     CONFIG_KALLSYMS_ALL=y
    83     CONFIG_EMBEDDED=y
    84     CONFIG_PERF_EVENTS=y
    85     diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
    86     index f6fb3d26557e..5680daa65471 100644
    87     --- a/arch/arc/configs/nsimosci_defconfig
    88     +++ b/arch/arc/configs/nsimosci_defconfig
    89     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    90     # CONFIG_UTS_NS is not set
    91     # CONFIG_PID_NS is not set
    92     CONFIG_BLK_DEV_INITRD=y
    93     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs/"
    94     CONFIG_KALLSYMS_ALL=y
    95     CONFIG_EMBEDDED=y
    96     CONFIG_PERF_EVENTS=y
    97     diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
    98     index b9f0fe00044b..87decc491c58 100644
    99     --- a/arch/arc/configs/nsimosci_hs_defconfig
    100     +++ b/arch/arc/configs/nsimosci_hs_defconfig
    101     @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    102     # CONFIG_UTS_NS is not set
    103     # CONFIG_PID_NS is not set
    104     CONFIG_BLK_DEV_INITRD=y
    105     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    106     CONFIG_KALLSYMS_ALL=y
    107     CONFIG_EMBEDDED=y
    108     CONFIG_PERF_EVENTS=y
    109     diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
    110     index 6da71ba253a9..4d14684dc74a 100644
    111     --- a/arch/arc/configs/nsimosci_hs_smp_defconfig
    112     +++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
    113     @@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y
    114     # CONFIG_UTS_NS is not set
    115     # CONFIG_PID_NS is not set
    116     CONFIG_BLK_DEV_INITRD=y
    117     -CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/"
    118     CONFIG_PERF_EVENTS=y
    119     # CONFIG_COMPAT_BRK is not set
    120     CONFIG_KPROBES=y
    121     diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
    122     index 296c3426a6ad..ffb5f33475f1 100644
    123     --- a/arch/arc/include/asm/page.h
    124     +++ b/arch/arc/include/asm/page.h
    125     @@ -105,7 +105,7 @@ typedef pte_t * pgtable_t;
    126     #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr))
    127    
    128     /* Default Permissions for stack/heaps pages (Non Executable) */
    129     -#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE)
    130     +#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
    131    
    132     #define WANT_PAGE_VIRTUAL 1
    133    
    134     diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
    135     index e94ca72b974e..c10f5cb203e6 100644
    136     --- a/arch/arc/include/asm/pgtable.h
    137     +++ b/arch/arc/include/asm/pgtable.h
    138     @@ -378,7 +378,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address,
    139    
    140     /* Decode a PTE containing swap "identifier "into constituents */
    141     #define __swp_type(pte_lookalike) (((pte_lookalike).val) & 0x1f)
    142     -#define __swp_offset(pte_lookalike) ((pte_lookalike).val << 13)
    143     +#define __swp_offset(pte_lookalike) ((pte_lookalike).val >> 13)
    144    
    145     /* NOPs, to keep generic kernel happy */
    146     #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
    147     diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
    148     index 46e40aeae446..93eebc636c76 100644
    149     --- a/arch/x86/include/asm/apm.h
    150     +++ b/arch/x86/include/asm/apm.h
    151     @@ -6,8 +6,6 @@
    152     #ifndef _ASM_X86_MACH_DEFAULT_APM_H
    153     #define _ASM_X86_MACH_DEFAULT_APM_H
    154    
    155     -#include <asm/nospec-branch.h>
    156     -
    157     #ifdef APM_ZERO_SEGS
    158     # define APM_DO_ZERO_SEGS \
    159     "pushl %%ds\n\t" \
    160     @@ -33,7 +31,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
    161     * N.B. We do NOT need a cld after the BIOS call
    162     * because we always save and restore the flags.
    163     */
    164     - firmware_restrict_branch_speculation_start();
    165     __asm__ __volatile__(APM_DO_ZERO_SEGS
    166     "pushl %%edi\n\t"
    167     "pushl %%ebp\n\t"
    168     @@ -46,7 +43,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
    169     "=S" (*esi)
    170     : "a" (func), "b" (ebx_in), "c" (ecx_in)
    171     : "memory", "cc");
    172     - firmware_restrict_branch_speculation_end();
    173     }
    174    
    175     static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    176     @@ -59,7 +55,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    177     * N.B. We do NOT need a cld after the BIOS call
    178     * because we always save and restore the flags.
    179     */
    180     - firmware_restrict_branch_speculation_start();
    181     __asm__ __volatile__(APM_DO_ZERO_SEGS
    182     "pushl %%edi\n\t"
    183     "pushl %%ebp\n\t"
    184     @@ -72,7 +67,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in,
    185     "=S" (si)
    186     : "a" (func), "b" (ebx_in), "c" (ecx_in)
    187     : "memory", "cc");
    188     - firmware_restrict_branch_speculation_end();
    189     return error;
    190     }
    191    
    192     diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
    193     index 51287cd90bf6..313a85a7b222 100644
    194     --- a/arch/x86/kernel/apm_32.c
    195     +++ b/arch/x86/kernel/apm_32.c
    196     @@ -239,6 +239,7 @@
    197     #include <asm/olpc.h>
    198     #include <asm/paravirt.h>
    199     #include <asm/reboot.h>
    200     +#include <asm/nospec-branch.h>
    201    
    202     #if defined(CONFIG_APM_DISPLAY_BLANK) && defined(CONFIG_VT)
    203     extern int (*console_blank_hook)(int);
    204     @@ -613,11 +614,13 @@ static long __apm_bios_call(void *_call)
    205     gdt[0x40 / 8] = bad_bios_desc;
    206    
    207     apm_irq_save(flags);
    208     + firmware_restrict_branch_speculation_start();
    209     APM_DO_SAVE_SEGS;
    210     apm_bios_call_asm(call->func, call->ebx, call->ecx,
    211     &call->eax, &call->ebx, &call->ecx, &call->edx,
    212     &call->esi);
    213     APM_DO_RESTORE_SEGS;
    214     + firmware_restrict_branch_speculation_end();
    215     apm_irq_restore(flags);
    216     gdt[0x40 / 8] = save_desc_40;
    217     put_cpu();
    218     @@ -689,10 +692,12 @@ static long __apm_bios_call_simple(void *_call)
    219     gdt[0x40 / 8] = bad_bios_desc;
    220    
    221     apm_irq_save(flags);
    222     + firmware_restrict_branch_speculation_start();
    223     APM_DO_SAVE_SEGS;
    224     error = apm_bios_call_simple_asm(call->func, call->ebx, call->ecx,
    225     &call->eax);
    226     APM_DO_RESTORE_SEGS;
    227     + firmware_restrict_branch_speculation_end();
    228     apm_irq_restore(flags);
    229     gdt[0x40 / 8] = save_desc_40;
    230     put_cpu();
    231     diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
    232     index c49e146d4332..7e6163c9d434 100644
    233     --- a/arch/x86/kernel/cpu/mcheck/mce.c
    234     +++ b/arch/x86/kernel/cpu/mcheck/mce.c
    235     @@ -2397,9 +2397,6 @@ static ssize_t store_int_with_restart(struct device *s,
    236     if (check_interval == old_check_interval)
    237     return ret;
    238    
    239     - if (check_interval < 1)
    240     - check_interval = 1;
    241     -
    242     mutex_lock(&mce_sysfs_mutex);
    243     mce_restart();
    244     mutex_unlock(&mce_sysfs_mutex);
    245     diff --git a/block/blk-core.c b/block/blk-core.c
    246     index 23daf40be371..77b99bf16c83 100644
    247     --- a/block/blk-core.c
    248     +++ b/block/blk-core.c
    249     @@ -652,7 +652,6 @@ EXPORT_SYMBOL(blk_alloc_queue);
    250     int blk_queue_enter(struct request_queue *q, bool nowait)
    251     {
    252     while (true) {
    253     - int ret;
    254    
    255     if (percpu_ref_tryget_live(&q->q_usage_counter))
    256     return 0;
    257     @@ -660,13 +659,11 @@ int blk_queue_enter(struct request_queue *q, bool nowait)
    258     if (nowait)
    259     return -EBUSY;
    260    
    261     - ret = wait_event_interruptible(q->mq_freeze_wq,
    262     - !atomic_read(&q->mq_freeze_depth) ||
    263     - blk_queue_dying(q));
    264     + wait_event(q->mq_freeze_wq,
    265     + !atomic_read(&q->mq_freeze_depth) ||
    266     + blk_queue_dying(q));
    267     if (blk_queue_dying(q))
    268     return -ENODEV;
    269     - if (ret)
    270     - return ret;
    271     }
    272     }
    273    
    274     diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
    275     index 02908e37c228..279d1e021421 100644
    276     --- a/drivers/gpu/drm/i915/i915_irq.c
    277     +++ b/drivers/gpu/drm/i915/i915_irq.c
    278     @@ -1684,10 +1684,38 @@ static void valleyview_pipestat_irq_handler(struct drm_i915_private *dev_priv,
    279    
    280     static u32 i9xx_hpd_irq_ack(struct drm_i915_private *dev_priv)
    281     {
    282     - u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
    283     + u32 hotplug_status = 0, hotplug_status_mask;
    284     + int i;
    285     +
    286     + if (IS_G4X(dev_priv) ||
    287     + IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
    288     + hotplug_status_mask = HOTPLUG_INT_STATUS_G4X |
    289     + DP_AUX_CHANNEL_MASK_INT_STATUS_G4X;
    290     + else
    291     + hotplug_status_mask = HOTPLUG_INT_STATUS_I915;
    292    
    293     - if (hotplug_status)
    294     + /*
    295     + * We absolutely have to clear all the pending interrupt
    296     + * bits in PORT_HOTPLUG_STAT. Otherwise the ISR port
    297     + * interrupt bit won't have an edge, and the i965/g4x
    298     + * edge triggered IIR will not notice that an interrupt
    299     + * is still pending. We can't use PORT_HOTPLUG_EN to
    300     + * guarantee the edge as the act of toggling the enable
    301     + * bits can itself generate a new hotplug interrupt :(
    302     + */
    303     + for (i = 0; i < 10; i++) {
    304     + u32 tmp = I915_READ(PORT_HOTPLUG_STAT) & hotplug_status_mask;
    305     +
    306     + if (tmp == 0)
    307     + return hotplug_status;
    308     +
    309     + hotplug_status |= tmp;
    310     I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
    311     + }
    312     +
    313     + WARN_ONCE(1,
    314     + "PORT_HOTPLUG_STAT did not clear (0x%08x)\n",
    315     + I915_READ(PORT_HOTPLUG_STAT));
    316    
    317     return hotplug_status;
    318     }
    319     diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    320     index 4ffbe850d746..6250989c83d8 100644
    321     --- a/drivers/net/ethernet/broadcom/tg3.c
    322     +++ b/drivers/net/ethernet/broadcom/tg3.c
    323     @@ -9276,6 +9276,15 @@ static int tg3_chip_reset(struct tg3 *tp)
    324    
    325     tg3_restore_clk(tp);
    326    
    327     + /* Increase the core clock speed to fix tx timeout issue for 5762
    328     + * with 100Mbps link speed.
    329     + */
    330     + if (tg3_asic_rev(tp) == ASIC_REV_5762) {
    331     + val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
    332     + tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
    333     + TG3_CPMU_MAC_ORIDE_ENABLE);
    334     + }
    335     +
    336     /* Reprobe ASF enable state. */
    337     tg3_flag_clear(tp, ENABLE_ASF);
    338     tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
    339     diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
    340     index bf02f8e4648a..b131e555d3c2 100644
    341     --- a/drivers/net/phy/phy_device.c
    342     +++ b/drivers/net/phy/phy_device.c
    343     @@ -1579,11 +1579,8 @@ static int gen10g_resume(struct phy_device *phydev)
    344    
    345     static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
    346     {
    347     - /* The default values for phydev->supported are provided by the PHY
    348     - * driver "features" member, we want to reset to sane defaults first
    349     - * before supporting higher speeds.
    350     - */
    351     - phydev->supported &= PHY_DEFAULT_FEATURES;
    352     + phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
    353     + PHY_10BT_FEATURES);
    354    
    355     switch (max_speed) {
    356     default:
    357     diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
    358     index 32e9ec8f1521..5be6b67492d5 100644
    359     --- a/drivers/net/usb/asix_devices.c
    360     +++ b/drivers/net/usb/asix_devices.c
    361     @@ -640,10 +640,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
    362     priv->presvd_phy_advertise);
    363    
    364     /* Restore BMCR */
    365     + if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
    366     + priv->presvd_phy_bmcr |= BMCR_ANRESTART;
    367     +
    368     asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
    369     priv->presvd_phy_bmcr);
    370    
    371     - mii_nway_restart(&dev->mii);
    372     priv->presvd_phy_advertise = 0;
    373     priv->presvd_phy_bmcr = 0;
    374     }
    375     diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    376     index 6d654d65f8a0..31a6d87b61b2 100644
    377     --- a/drivers/net/usb/qmi_wwan.c
    378     +++ b/drivers/net/usb/qmi_wwan.c
    379     @@ -953,6 +953,7 @@ static const struct usb_device_id products[] = {
    380     {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */
    381     {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
    382     {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
    383     + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
    384     {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
    385     {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
    386    
    387     diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
    388     index 58a97d420572..51364621f77c 100644
    389     --- a/drivers/ptp/ptp_chardev.c
    390     +++ b/drivers/ptp/ptp_chardev.c
    391     @@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
    392     case PTP_PF_PHYSYNC:
    393     if (chan != 0)
    394     return -EINVAL;
    395     + break;
    396     default:
    397     return -EINVAL;
    398     }
    399     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    400     index a7d239f5fc5f..81f25213cb41 100644
    401     --- a/drivers/usb/host/xhci.c
    402     +++ b/drivers/usb/host/xhci.c
    403     @@ -891,6 +891,41 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
    404     spin_unlock_irqrestore(&xhci->lock, flags);
    405     }
    406    
    407     +static bool xhci_pending_portevent(struct xhci_hcd *xhci)
    408     +{
    409     + __le32 __iomem **port_array;
    410     + int port_index;
    411     + u32 status;
    412     + u32 portsc;
    413     +
    414     + status = readl(&xhci->op_regs->status);
    415     + if (status & STS_EINT)
    416     + return true;
    417     + /*
    418     + * Checking STS_EINT is not enough as there is a lag between a change
    419     + * bit being set and the Port Status Change Event that it generated
    420     + * being written to the Event Ring. See note in xhci 1.1 section 4.19.2.
    421     + */
    422     +
    423     + port_index = xhci->num_usb2_ports;
    424     + port_array = xhci->usb2_ports;
    425     + while (port_index--) {
    426     + portsc = readl(port_array[port_index]);
    427     + if (portsc & PORT_CHANGE_MASK ||
    428     + (portsc & PORT_PLS_MASK) == XDEV_RESUME)
    429     + return true;
    430     + }
    431     + port_index = xhci->num_usb3_ports;
    432     + port_array = xhci->usb3_ports;
    433     + while (port_index--) {
    434     + portsc = readl(port_array[port_index]);
    435     + if (portsc & PORT_CHANGE_MASK ||
    436     + (portsc & PORT_PLS_MASK) == XDEV_RESUME)
    437     + return true;
    438     + }
    439     + return false;
    440     +}
    441     +
    442     /*
    443     * Stop HC (not bus-specific)
    444     *
    445     @@ -987,7 +1022,7 @@ EXPORT_SYMBOL_GPL(xhci_suspend);
    446     */
    447     int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    448     {
    449     - u32 command, temp = 0, status;
    450     + u32 command, temp = 0;
    451     struct usb_hcd *hcd = xhci_to_hcd(xhci);
    452     struct usb_hcd *secondary_hcd;
    453     int retval = 0;
    454     @@ -1109,8 +1144,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    455     done:
    456     if (retval == 0) {
    457     /* Resume root hubs only when have pending events. */
    458     - status = readl(&xhci->op_regs->status);
    459     - if (status & STS_EINT) {
    460     + if (xhci_pending_portevent(xhci)) {
    461     usb_hcd_resume_root_hub(xhci->shared_hcd);
    462     usb_hcd_resume_root_hub(hcd);
    463     }
    464     diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    465     index 836398ade58d..b9181281aa9e 100644
    466     --- a/drivers/usb/host/xhci.h
    467     +++ b/drivers/usb/host/xhci.h
    468     @@ -385,6 +385,10 @@ struct xhci_op_regs {
    469     #define PORT_PLC (1 << 22)
    470     /* port configure error change - port failed to configure its link partner */
    471     #define PORT_CEC (1 << 23)
    472     +#define PORT_CHANGE_MASK (PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \
    473     + PORT_RC | PORT_PLC | PORT_CEC)
    474     +
    475     +
    476     /* Cold Attach Status - xHC can set this bit to report device attached during
    477     * Sx state. Warm port reset should be perfomed to clear this bit and move port
    478     * to connected state.
    479     diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
    480     index 43559bed7822..7338e43faa17 100644
    481     --- a/drivers/vfio/pci/vfio_pci.c
    482     +++ b/drivers/vfio/pci/vfio_pci.c
    483     @@ -28,6 +28,7 @@
    484     #include <linux/uaccess.h>
    485     #include <linux/vfio.h>
    486     #include <linux/vgaarb.h>
    487     +#include <linux/nospec.h>
    488    
    489     #include "vfio_pci_private.h"
    490    
    491     @@ -755,6 +756,9 @@ static long vfio_pci_ioctl(void *device_data,
    492     if (info.index >=
    493     VFIO_PCI_NUM_REGIONS + vdev->num_regions)
    494     return -EINVAL;
    495     + info.index = array_index_nospec(info.index,
    496     + VFIO_PCI_NUM_REGIONS +
    497     + vdev->num_regions);
    498    
    499     i = info.index - VFIO_PCI_NUM_REGIONS;
    500    
    501     diff --git a/fs/fat/inode.c b/fs/fat/inode.c
    502     index a2c05f2ada6d..88720011a6eb 100644
    503     --- a/fs/fat/inode.c
    504     +++ b/fs/fat/inode.c
    505     @@ -696,13 +696,21 @@ static void fat_set_state(struct super_block *sb,
    506     brelse(bh);
    507     }
    508    
    509     +static void fat_reset_iocharset(struct fat_mount_options *opts)
    510     +{
    511     + if (opts->iocharset != fat_default_iocharset) {
    512     + /* Note: opts->iocharset can be NULL here */
    513     + kfree(opts->iocharset);
    514     + opts->iocharset = fat_default_iocharset;
    515     + }
    516     +}
    517     +
    518     static void delayed_free(struct rcu_head *p)
    519     {
    520     struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
    521     unload_nls(sbi->nls_disk);
    522     unload_nls(sbi->nls_io);
    523     - if (sbi->options.iocharset != fat_default_iocharset)
    524     - kfree(sbi->options.iocharset);
    525     + fat_reset_iocharset(&sbi->options);
    526     kfree(sbi);
    527     }
    528    
    529     @@ -1117,7 +1125,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
    530     opts->fs_fmask = opts->fs_dmask = current_umask();
    531     opts->allow_utime = -1;
    532     opts->codepage = fat_default_codepage;
    533     - opts->iocharset = fat_default_iocharset;
    534     + fat_reset_iocharset(opts);
    535     if (is_vfat) {
    536     opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
    537     opts->rodir = 0;
    538     @@ -1274,8 +1282,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
    539    
    540     /* vfat specific */
    541     case Opt_charset:
    542     - if (opts->iocharset != fat_default_iocharset)
    543     - kfree(opts->iocharset);
    544     + fat_reset_iocharset(opts);
    545     iocharset = match_strdup(&args[0]);
    546     if (!iocharset)
    547     return -ENOMEM;
    548     @@ -1866,8 +1873,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
    549     iput(fat_inode);
    550     unload_nls(sbi->nls_io);
    551     unload_nls(sbi->nls_disk);
    552     - if (sbi->options.iocharset != fat_default_iocharset)
    553     - kfree(sbi->options.iocharset);
    554     + fat_reset_iocharset(&sbi->options);
    555     sb->s_fs_info = NULL;
    556     kfree(sbi);
    557     return error;
    558     diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    559     index 1b3a2f95503d..b048d3d3b327 100644
    560     --- a/include/linux/skbuff.h
    561     +++ b/include/linux/skbuff.h
    562     @@ -602,6 +602,7 @@ static inline bool skb_mstamp_after(const struct skb_mstamp *t1,
    563     * @hash: the packet hash
    564     * @queue_mapping: Queue mapping for multiqueue devices
    565     * @xmit_more: More SKBs are pending for this queue
    566     + * @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
    567     * @ndisc_nodetype: router type (from link layer)
    568     * @ooo_okay: allow the mapping of a socket to a queue to be changed
    569     * @l4_hash: indicate hash is a canonical 4-tuple hash over transport
    570     @@ -692,7 +693,7 @@ struct sk_buff {
    571     peeked:1,
    572     head_frag:1,
    573     xmit_more:1,
    574     - __unused:1; /* one bit hole */
    575     + pfmemalloc:1;
    576     kmemcheck_bitfield_end(flags1);
    577    
    578     /* fields enclosed in headers_start/headers_end are copied
    579     @@ -712,19 +713,18 @@ struct sk_buff {
    580    
    581     __u8 __pkt_type_offset[0];
    582     __u8 pkt_type:3;
    583     - __u8 pfmemalloc:1;
    584     __u8 ignore_df:1;
    585     __u8 nfctinfo:3;
    586     -
    587     __u8 nf_trace:1;
    588     +
    589     __u8 ip_summed:2;
    590     __u8 ooo_okay:1;
    591     __u8 l4_hash:1;
    592     __u8 sw_hash:1;
    593     __u8 wifi_acked_valid:1;
    594     __u8 wifi_acked:1;
    595     -
    596     __u8 no_fcs:1;
    597     +
    598     /* Indicates the inner headers are valid in the skbuff. */
    599     __u8 encapsulation:1;
    600     __u8 encap_hdr_csum:1;
    601     @@ -732,11 +732,11 @@ struct sk_buff {
    602     __u8 csum_complete_sw:1;
    603     __u8 csum_level:2;
    604     __u8 csum_bad:1;
    605     -
    606     #ifdef CONFIG_IPV6_NDISC_NODETYPE
    607     __u8 ndisc_nodetype:2;
    608     #endif
    609     __u8 ipvs_property:1;
    610     +
    611     __u8 inner_protocol_type:1;
    612     __u8 remcsum_offload:1;
    613     #ifdef CONFIG_NET_SWITCHDEV
    614     diff --git a/include/net/ipv6.h b/include/net/ipv6.h
    615     index e64210c98c2b..407087d686a7 100644
    616     --- a/include/net/ipv6.h
    617     +++ b/include/net/ipv6.h
    618     @@ -794,7 +794,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
    619     * to minimize possbility that any useful information to an
    620     * attacker is leaked. Only lower 20 bits are relevant.
    621     */
    622     - rol32(hash, 16);
    623     + hash = rol32(hash, 16);
    624    
    625     flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
    626    
    627     diff --git a/lib/rhashtable.c b/lib/rhashtable.c
    628     index 895961c53385..101dac085c62 100644
    629     --- a/lib/rhashtable.c
    630     +++ b/lib/rhashtable.c
    631     @@ -783,8 +783,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
    632    
    633     static size_t rounded_hashtable_size(const struct rhashtable_params *params)
    634     {
    635     - return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
    636     - (unsigned long)params->min_size);
    637     + size_t retsize;
    638     +
    639     + if (params->nelem_hint)
    640     + retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
    641     + (unsigned long)params->min_size);
    642     + else
    643     + retsize = max(HASH_DEFAULT_SIZE,
    644     + (unsigned long)params->min_size);
    645     +
    646     + return retsize;
    647     }
    648    
    649     static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
    650     @@ -841,8 +849,6 @@ int rhashtable_init(struct rhashtable *ht,
    651     struct bucket_table *tbl;
    652     size_t size;
    653    
    654     - size = HASH_DEFAULT_SIZE;
    655     -
    656     if ((!params->key_len && !params->obj_hashfn) ||
    657     (params->obj_hashfn && !params->obj_cmpfn))
    658     return -EINVAL;
    659     @@ -869,8 +875,7 @@ int rhashtable_init(struct rhashtable *ht,
    660    
    661     ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
    662    
    663     - if (params->nelem_hint)
    664     - size = rounded_hashtable_size(&ht->p);
    665     + size = rounded_hashtable_size(&ht->p);
    666    
    667     /* The maximum (not average) chain length grows with the
    668     * size of the hash table, at a rate of (log N)/(log log N).
    669     diff --git a/mm/huge_memory.c b/mm/huge_memory.c
    670     index 724372866e67..9efe88ef9702 100644
    671     --- a/mm/huge_memory.c
    672     +++ b/mm/huge_memory.c
    673     @@ -1642,6 +1642,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
    674     if (vma_is_dax(vma))
    675     return;
    676     page = pmd_page(_pmd);
    677     + if (!PageDirty(page) && pmd_dirty(_pmd))
    678     + set_page_dirty(page);
    679     if (!PageReferenced(page) && pmd_young(_pmd))
    680     SetPageReferenced(page);
    681     page_remove_rmap(page, true);
    682     diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    683     index 50088150fc17..349f4a8e3c4f 100644
    684     --- a/mm/memcontrol.c
    685     +++ b/mm/memcontrol.c
    686     @@ -895,7 +895,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
    687     int nid;
    688     int i;
    689    
    690     - while ((memcg = parent_mem_cgroup(memcg))) {
    691     + for (; memcg; memcg = parent_mem_cgroup(memcg)) {
    692     for_each_node(nid) {
    693     mz = mem_cgroup_nodeinfo(memcg, nid);
    694     for (i = 0; i <= DEF_PRIORITY; i++) {
    695     diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
    696     index 508e051304fb..18f17e1e5762 100644
    697     --- a/net/core/gen_stats.c
    698     +++ b/net/core/gen_stats.c
    699     @@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
    700     d->lock = lock;
    701     spin_lock_bh(lock);
    702     }
    703     - if (d->tail)
    704     - return gnet_stats_copy(d, type, NULL, 0, padattr);
    705     + if (d->tail) {
    706     + int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
    707     +
    708     + /* The initial attribute added in gnet_stats_copy() may be
    709     + * preceded by a padding attribute, in which case d->tail will
    710     + * end up pointing at the padding instead of the real attribute.
    711     + * Fix this so gnet_stats_finish_copy() adjusts the length of
    712     + * the right attribute.
    713     + */
    714     + if (ret == 0 && d->tail->nla_type == padattr)
    715     + d->tail = (struct nlattr *)((char *)d->tail +
    716     + NLA_ALIGN(d->tail->nla_len));
    717     + return ret;
    718     + }
    719    
    720     return 0;
    721     }
    722     diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    723     index 9f697b00158d..8cae7aa4a4ec 100644
    724     --- a/net/core/skbuff.c
    725     +++ b/net/core/skbuff.c
    726     @@ -904,6 +904,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
    727     n->cloned = 1;
    728     n->nohdr = 0;
    729     n->peeked = 0;
    730     + C(pfmemalloc);
    731     n->destructor = NULL;
    732     C(tail);
    733     C(end);
    734     diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
    735     index ffae472e250a..7bdd89354db5 100644
    736     --- a/net/ipv4/fib_frontend.c
    737     +++ b/net/ipv4/fib_frontend.c
    738     @@ -290,6 +290,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
    739     if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
    740     struct flowi4 fl4 = {
    741     .flowi4_iif = LOOPBACK_IFINDEX,
    742     + .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
    743     .daddr = ip_hdr(skb)->saddr,
    744     .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
    745     .flowi4_scope = scope,
    746     diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
    747     index 51a0039cb318..024ab833557d 100644
    748     --- a/net/ipv4/sysctl_net_ipv4.c
    749     +++ b/net/ipv4/sysctl_net_ipv4.c
    750     @@ -140,8 +140,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
    751     if (write && ret == 0) {
    752     low = make_kgid(user_ns, urange[0]);
    753     high = make_kgid(user_ns, urange[1]);
    754     - if (!gid_valid(low) || !gid_valid(high) ||
    755     - (urange[1] < urange[0]) || gid_lt(high, low)) {
    756     + if (!gid_valid(low) || !gid_valid(high))
    757     + return -EINVAL;
    758     + if (urange[1] < urange[0] || gid_lt(high, low)) {
    759     low = make_kgid(&init_user_ns, 1);
    760     high = make_kgid(&init_user_ns, 0);
    761     }
    762     diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    763     index 84ffebf0192d..8f15eae3325b 100644
    764     --- a/net/ipv4/tcp.c
    765     +++ b/net/ipv4/tcp.c
    766     @@ -3238,8 +3238,7 @@ int tcp_abort(struct sock *sk, int err)
    767     struct request_sock *req = inet_reqsk(sk);
    768    
    769     local_bh_disable();
    770     - inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
    771     - req);
    772     + inet_csk_reqsk_queue_drop(req->rsk_listener, req);
    773     local_bh_enable();
    774     return 0;
    775     }
    776     diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
    777     index f57c9f0ab8f9..0287734f126f 100644
    778     --- a/net/sunrpc/xprtrdma/rpc_rdma.c
    779     +++ b/net/sunrpc/xprtrdma/rpc_rdma.c
    780     @@ -229,7 +229,7 @@ rpcrdma_convert_iovs(struct rpcrdma_xprt *r_xprt, struct xdr_buf *xdrbuf,
    781     /* alloc the pagelist for receiving buffer */
    782     ppages[p] = alloc_page(GFP_ATOMIC);
    783     if (!ppages[p])
    784     - return -EAGAIN;
    785     + return -ENOBUFS;
    786     }
    787     seg[n].mr_page = ppages[p];
    788     seg[n].mr_offset = (void *)(unsigned long) page_base;
    789     diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
    790     index 16f8124b1150..59111cadaec2 100644
    791     --- a/sound/core/rawmidi.c
    792     +++ b/sound/core/rawmidi.c
    793     @@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card,
    794     int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
    795     struct snd_rawmidi_params * params)
    796     {
    797     - char *newbuf;
    798     + char *newbuf, *oldbuf;
    799     struct snd_rawmidi_runtime *runtime = substream->runtime;
    800    
    801     if (substream->append && substream->use_count > 1)
    802     @@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
    803     return -EINVAL;
    804     }
    805     if (params->buffer_size != runtime->buffer_size) {
    806     - newbuf = krealloc(runtime->buffer, params->buffer_size,
    807     - GFP_KERNEL);
    808     + newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
    809     if (!newbuf)
    810     return -ENOMEM;
    811     + spin_lock_irq(&runtime->lock);
    812     + oldbuf = runtime->buffer;
    813     runtime->buffer = newbuf;
    814     runtime->buffer_size = params->buffer_size;
    815     runtime->avail = runtime->buffer_size;
    816     + runtime->appl_ptr = runtime->hw_ptr = 0;
    817     + spin_unlock_irq(&runtime->lock);
    818     + kfree(oldbuf);
    819     }
    820     runtime->avail_min = params->avail_min;
    821     substream->active_sensing = !params->no_active_sensing;
    822     @@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params);
    823     int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
    824     struct snd_rawmidi_params * params)
    825     {
    826     - char *newbuf;
    827     + char *newbuf, *oldbuf;
    828     struct snd_rawmidi_runtime *runtime = substream->runtime;
    829    
    830     snd_rawmidi_drain_input(substream);
    831     @@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
    832     return -EINVAL;
    833     }
    834     if (params->buffer_size != runtime->buffer_size) {
    835     - newbuf = krealloc(runtime->buffer, params->buffer_size,
    836     - GFP_KERNEL);
    837     + newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
    838     if (!newbuf)
    839     return -ENOMEM;
    840     + spin_lock_irq(&runtime->lock);
    841     + oldbuf = runtime->buffer;
    842     runtime->buffer = newbuf;
    843     runtime->buffer_size = params->buffer_size;
    844     + runtime->appl_ptr = runtime->hw_ptr = 0;
    845     + spin_unlock_irq(&runtime->lock);
    846     + kfree(oldbuf);
    847     }
    848     runtime->avail_min = params->avail_min;
    849     return 0;
    850     diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
    851     index 4d28a9ddbee0..3f24eb1e8554 100644
    852     --- a/virt/kvm/eventfd.c
    853     +++ b/virt/kvm/eventfd.c
    854     @@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work)
    855     {
    856     struct kvm_kernel_irqfd *irqfd =
    857     container_of(work, struct kvm_kernel_irqfd, shutdown);
    858     + struct kvm *kvm = irqfd->kvm;
    859     u64 cnt;
    860    
    861     + /* Make sure irqfd has been initalized in assign path. */
    862     + synchronize_srcu(&kvm->irq_srcu);
    863     +
    864     /*
    865     * Synchronize with the wait-queue and unhook ourselves to prevent
    866     * further events.
    867     @@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
    868    
    869     idx = srcu_read_lock(&kvm->irq_srcu);
    870     irqfd_update(kvm, irqfd);
    871     - srcu_read_unlock(&kvm->irq_srcu, idx);
    872    
    873     list_add_tail(&irqfd->list, &kvm->irqfds.items);
    874    
    875     @@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
    876     }
    877     #endif
    878    
    879     + srcu_read_unlock(&kvm->irq_srcu, idx);
    880     return 0;
    881    
    882     fail: