Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0326-4.9.227-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0326-4.9.227-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3601 - (show annotations) (download)
    Thu Aug 13 10:21:41 2020 UTC (3 years, 9 months ago) by niro
    File size: 58848 byte(s) 
    linux-227
    1 diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
    2 index b41046b5713b..a5225df4a070 100644
    3 --- a/Documentation/ABI/testing/sysfs-devices-system-cpu
    4 +++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
    5 @@ -358,6 +358,7 @@ What: /sys/devices/system/cpu/vulnerabilities
    6 /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
    7 /sys/devices/system/cpu/vulnerabilities/l1tf
    8 /sys/devices/system/cpu/vulnerabilities/mds
    9 + /sys/devices/system/cpu/vulnerabilities/srbds
    10 /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
    11 /sys/devices/system/cpu/vulnerabilities/itlb_multihit
    12 Date: January 2018
    13 diff --git a/Documentation/hw-vuln/index.rst b/Documentation/hw-vuln/index.rst
    14 index 24f53c501366..b5fbc6ae9d5f 100644
    15 --- a/Documentation/hw-vuln/index.rst
    16 +++ b/Documentation/hw-vuln/index.rst
    17 @@ -12,4 +12,5 @@ are configurable at compile, boot or run time.
    18 l1tf
    19 mds
    20 tsx_async_abort
    21 - multihit.rst
    22 + multihit
    23 + special-register-buffer-data-sampling
    24 diff --git a/Documentation/hw-vuln/special-register-buffer-data-sampling.rst b/Documentation/hw-vuln/special-register-buffer-data-sampling.rst
    25 new file mode 100644
    26 index 000000000000..47b1b3afac99
    27 --- /dev/null
    28 +++ b/Documentation/hw-vuln/special-register-buffer-data-sampling.rst
    29 @@ -0,0 +1,149 @@
    30 +.. SPDX-License-Identifier: GPL-2.0
    31 +
    32 +SRBDS - Special Register Buffer Data Sampling
    33 +=============================================
    34 +
    35 +SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to
    36 +infer values returned from special register accesses. Special register
    37 +accesses are accesses to off core registers. According to Intel's evaluation,
    38 +the special register reads that have a security expectation of privacy are
    39 +RDRAND, RDSEED and SGX EGETKEY.
    40 +
    41 +When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved
    42 +to the core through the special register mechanism that is susceptible
    43 +to MDS attacks.
    44 +
    45 +Affected processors
    46 +--------------------
    47 +Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may
    48 +be affected.
    49 +
    50 +A processor is affected by SRBDS if its Family_Model and stepping is
    51 +in the following list, with the exception of the listed processors
    52 +exporting MDS_NO while Intel TSX is available yet not enabled. The
    53 +latter class of processors are only affected when Intel TSX is enabled
    54 +by software using TSX_CTRL_MSR otherwise they are not affected.
    55 +
    56 + ============= ============ ========
    57 + common name Family_Model Stepping
    58 + ============= ============ ========
    59 + IvyBridge 06_3AH All
    60 +
    61 + Haswell 06_3CH All
    62 + Haswell_L 06_45H All
    63 + Haswell_G 06_46H All
    64 +
    65 + Broadwell_G 06_47H All
    66 + Broadwell 06_3DH All
    67 +
    68 + Skylake_L 06_4EH All
    69 + Skylake 06_5EH All
    70 +
    71 + Kabylake_L 06_8EH <= 0xC
    72 + Kabylake 06_9EH <= 0xD
    73 + ============= ============ ========
    74 +
    75 +Related CVEs
    76 +------------
    77 +
    78 +The following CVE entry is related to this SRBDS issue:
    79 +
    80 + ============== ===== =====================================
    81 + CVE-2020-0543 SRBDS Special Register Buffer Data Sampling
    82 + ============== ===== =====================================
    83 +
    84 +Attack scenarios
    85 +----------------
    86 +An unprivileged user can extract values returned from RDRAND and RDSEED
    87 +executed on another core or sibling thread using MDS techniques.
    88 +
    89 +
    90 +Mitigation mechanism
    91 +-------------------
    92 +Intel will release microcode updates that modify the RDRAND, RDSEED, and
    93 +EGETKEY instructions to overwrite secret special register data in the shared
    94 +staging buffer before the secret data can be accessed by another logical
    95 +processor.
    96 +
    97 +During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core
    98 +accesses from other logical processors will be delayed until the special
    99 +register read is complete and the secret data in the shared staging buffer is
    100 +overwritten.
    101 +
    102 +This has three effects on performance:
    103 +
    104 +#. RDRAND, RDSEED, or EGETKEY instructions have higher latency.
    105 +
    106 +#. Executing RDRAND at the same time on multiple logical processors will be
    107 + serialized, resulting in an overall reduction in the maximum RDRAND
    108 + bandwidth.
    109 +
    110 +#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other
    111 + logical processors that miss their core caches, with an impact similar to
    112 + legacy locked cache-line-split accesses.
    113 +
    114 +The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable
    115 +the mitigation for RDRAND and RDSEED instructions executed outside of Intel
    116 +Software Guard Extensions (Intel SGX) enclaves. On logical processors that
    117 +disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not
    118 +take longer to execute and do not impact performance of sibling logical
    119 +processors memory accesses. The opt-out mechanism does not affect Intel SGX
    120 +enclaves (including execution of RDRAND or RDSEED inside an enclave, as well
    121 +as EGETKEY execution).
    122 +
    123 +IA32_MCU_OPT_CTRL MSR Definition
    124 +--------------------------------
    125 +Along with the mitigation for this issue, Intel added a new thread-scope
    126 +IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and
    127 +RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL =
    128 +9]==1. This MSR is introduced through the microcode update.
    129 +
    130 +Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor
    131 +disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX
    132 +enclave on that logical processor. Opting out of the mitigation for a
    133 +particular logical processor does not affect the RDRAND and RDSEED mitigations
    134 +for other logical processors.
    135 +
    136 +Note that inside of an Intel SGX enclave, the mitigation is applied regardless
    137 +of the value of RNGDS_MITG_DS.
    138 +
    139 +Mitigation control on the kernel command line
    140 +---------------------------------------------
    141 +The kernel command line allows control over the SRBDS mitigation at boot time
    142 +with the option "srbds=". The option for this is:
    143 +
    144 + ============= =============================================================
    145 + off This option disables SRBDS mitigation for RDRAND and RDSEED on
    146 + affected platforms.
    147 + ============= =============================================================
    148 +
    149 +SRBDS System Information
    150 +-----------------------
    151 +The Linux kernel provides vulnerability status information through sysfs. For
    152 +SRBDS this can be accessed by the following sysfs file:
    153 +/sys/devices/system/cpu/vulnerabilities/srbds
    154 +
    155 +The possible values contained in this file are:
    156 +
    157 + ============================== =============================================
    158 + Not affected Processor not vulnerable
    159 + Vulnerable Processor vulnerable and mitigation disabled
    160 + Vulnerable: No microcode Processor vulnerable and microcode is missing
    161 + mitigation
    162 + Mitigation: Microcode Processor is vulnerable and mitigation is in
    163 + effect.
    164 + Mitigation: TSX disabled Processor is only vulnerable when TSX is
    165 + enabled while this system was booted with TSX
    166 + disabled.
    167 + Unknown: Dependent on
    168 + hypervisor status Running on virtual guest processor that is
    169 + affected but with no way to know if host
    170 + processor is mitigated or vulnerable.
    171 + ============================== =============================================
    172 +
    173 +SRBDS Default mitigation
    174 +------------------------
    175 +This new microcode serializes processor access during execution of RDRAND,
    176 +RDSEED ensures that the shared buffer is overwritten before it is released for
    177 +reuse. Use the "srbds=off" kernel command line to disable the mitigation for
    178 +RDRAND and RDSEED.
    179 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
    180 index e05d65d6fcb6..40602517ca52 100644
    181 --- a/Documentation/kernel-parameters.txt
    182 +++ b/Documentation/kernel-parameters.txt
    183 @@ -4262,6 +4262,26 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
    184 spia_pedr=
    185 spia_peddr=
    186
    187 + srbds= [X86,INTEL]
    188 + Control the Special Register Buffer Data Sampling
    189 + (SRBDS) mitigation.
    190 +
    191 + Certain CPUs are vulnerable to an MDS-like
    192 + exploit which can leak bits from the random
    193 + number generator.
    194 +
    195 + By default, this issue is mitigated by
    196 + microcode. However, the microcode fix can cause
    197 + the RDRAND and RDSEED instructions to become
    198 + much slower. Among other effects, this will
    199 + result in reduced throughput from /dev/urandom.
    200 +
    201 + The microcode mitigation can be disabled with
    202 + the following option:
    203 +
    204 + off: Disable mitigation and remove
    205 + performance impact to RDRAND and RDSEED
    206 +
    207 ssbd= [ARM64,HW]
    208 Speculative Store Bypass Disable control
    209
    210 diff --git a/Makefile b/Makefile
    211 index b0e1162fddfa..6c3c6e193621 100644
    212 --- a/Makefile
    213 +++ b/Makefile
    214 @@ -1,6 +1,6 @@
    215 VERSION = 4
    216 PATCHLEVEL = 9
    217 -SUBLEVEL = 226
    218 +SUBLEVEL = 227
    219 EXTRAVERSION =
    220 NAME = Roaring Lionus
    221
    222 diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
    223 index 9f96120eee6e..82464fae7772 100644
    224 --- a/arch/arc/kernel/setup.c
    225 +++ b/arch/arc/kernel/setup.c
    226 @@ -12,6 +12,7 @@
    227 #include <linux/root_dev.h>
    228 #include <linux/console.h>
    229 #include <linux/module.h>
    230 +#include <linux/sizes.h>
    231 #include <linux/cpu.h>
    232 #include <linux/of_fdt.h>
    233 #include <linux/of.h>
    234 @@ -333,12 +334,12 @@ static void arc_chk_core_config(void)
    235 if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
    236 panic("Linux built with incorrect DCCM Base address\n");
    237
    238 - if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
    239 + if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
    240 panic("Linux built with incorrect DCCM Size\n");
    241 #endif
    242
    243 #ifdef CONFIG_ARC_HAS_ICCM
    244 - if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
    245 + if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
    246 panic("Linux built with incorrect ICCM Size\n");
    247 #endif
    248
    249 diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
    250 index 802a4ded9a62..e9df35249f9f 100644
    251 --- a/arch/s390/kernel/mcount.S
    252 +++ b/arch/s390/kernel/mcount.S
    253 @@ -39,6 +39,7 @@ EXPORT_SYMBOL(_mcount)
    254 ENTRY(ftrace_caller)
    255 .globl ftrace_regs_caller
    256 .set ftrace_regs_caller,ftrace_caller
    257 + stg %r14,(__SF_GPRS+8*8)(%r15) # save traced function caller
    258 lgr %r1,%r15
    259 #ifndef CC_USING_HOTPATCH
    260 aghi %r0,MCOUNT_RETURN_FIXUP
    261 diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
    262 index ff501e511d91..b9473858c6b6 100644
    263 --- a/arch/x86/include/asm/cpu_device_id.h
    264 +++ b/arch/x86/include/asm/cpu_device_id.h
    265 @@ -8,6 +8,33 @@
    266
    267 #include <linux/mod_devicetable.h>
    268
    269 +#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
    270 +
    271 +/**
    272 + * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
    273 + * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
    274 + * The name is expanded to X86_VENDOR_@_vendor
    275 + * @_family: The family number or X86_FAMILY_ANY
    276 + * @_model: The model number, model constant or X86_MODEL_ANY
    277 + * @_steppings: Bitmask for steppings, stepping constant or X86_STEPPING_ANY
    278 + * @_feature: A X86_FEATURE bit or X86_FEATURE_ANY
    279 + * @_data: Driver specific data or NULL. The internal storage
    280 + * format is unsigned long. The supplied value, pointer
    281 + * etc. is casted to unsigned long internally.
    282 + *
    283 + * Backport version to keep the SRBDS pile consistant. No shorter variants
    284 + * required for this.
    285 + */
    286 +#define X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
    287 + _steppings, _feature, _data) { \
    288 + .vendor = X86_VENDOR_##_vendor, \
    289 + .family = _family, \
    290 + .model = _model, \
    291 + .steppings = _steppings, \
    292 + .feature = _feature, \
    293 + .driver_data = (unsigned long) _data \
    294 +}
    295 +
    296 extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
    297
    298 #endif
    299 diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
    300 index fb457ba8ccc6..2cd5d12a842c 100644
    301 --- a/arch/x86/include/asm/cpufeatures.h
    302 +++ b/arch/x86/include/asm/cpufeatures.h
    303 @@ -316,6 +316,7 @@
    304 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
    305 #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
    306 #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
    307 +#define X86_FEATURE_SRBDS_CTRL (18*32+ 9) /* "" SRBDS mitigation MSR available */
    308 #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
    309 #define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */
    310 #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
    311 @@ -346,19 +347,20 @@
    312 */
    313 #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
    314 #endif
    315 -#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */
    316 -#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */
    317 -#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */
    318 -#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */
    319 -#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */
    320 -#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
    321 -#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
    322 -#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
    323 -#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
    324 -#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
    325 -#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
    326 -#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
    327 -#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
    328 -#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
    329 +#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */
    330 +#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */
    331 +#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */
    332 +#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */
    333 +#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */
    334 +#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
    335 +#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
    336 +#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
    337 +#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
    338 +#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
    339 +#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
    340 +#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
    341 +#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
    342 +#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
    343 +#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
    344
    345 #endif /* _ASM_X86_CPUFEATURES_H */
    346 diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
    347 index 8d162e0f2881..b12b0a50ad1f 100644
    348 --- a/arch/x86/include/asm/msr-index.h
    349 +++ b/arch/x86/include/asm/msr-index.h
    350 @@ -103,6 +103,10 @@
    351 #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */
    352 #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */
    353
    354 +/* SRBDS support */
    355 +#define MSR_IA32_MCU_OPT_CTRL 0x00000123
    356 +#define RNGDS_MITG_DIS BIT(0)
    357 +
    358 #define MSR_IA32_SYSENTER_CS 0x00000174
    359 #define MSR_IA32_SYSENTER_ESP 0x00000175
    360 #define MSR_IA32_SYSENTER_EIP 0x00000176
    361 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
    362 index 5736306bdaab..e638e3bc3cb8 100644
    363 --- a/arch/x86/include/asm/pgtable.h
    364 +++ b/arch/x86/include/asm/pgtable.h
    365 @@ -203,6 +203,7 @@ static inline int pmd_large(pmd_t pte)
    366 }
    367
    368 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
    369 +/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */
    370 static inline int pmd_trans_huge(pmd_t pmd)
    371 {
    372 return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE;
    373 diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
    374 index 24307d5bb4b8..5ef0a2b34261 100644
    375 --- a/arch/x86/kernel/cpu/bugs.c
    376 +++ b/arch/x86/kernel/cpu/bugs.c
    377 @@ -40,6 +40,7 @@ static void __init l1tf_select_mitigation(void);
    378 static void __init mds_select_mitigation(void);
    379 static void __init mds_print_mitigation(void);
    380 static void __init taa_select_mitigation(void);
    381 +static void __init srbds_select_mitigation(void);
    382
    383 /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
    384 u64 x86_spec_ctrl_base;
    385 @@ -107,6 +108,7 @@ void __init check_bugs(void)
    386 l1tf_select_mitigation();
    387 mds_select_mitigation();
    388 taa_select_mitigation();
    389 + srbds_select_mitigation();
    390
    391 /*
    392 * As MDS and TAA mitigations are inter-related, print MDS
    393 @@ -389,6 +391,97 @@ static int __init tsx_async_abort_parse_cmdline(char *str)
    394 }
    395 early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);
    396
    397 +#undef pr_fmt
    398 +#define pr_fmt(fmt) "SRBDS: " fmt
    399 +
    400 +enum srbds_mitigations {
    401 + SRBDS_MITIGATION_OFF,
    402 + SRBDS_MITIGATION_UCODE_NEEDED,
    403 + SRBDS_MITIGATION_FULL,
    404 + SRBDS_MITIGATION_TSX_OFF,
    405 + SRBDS_MITIGATION_HYPERVISOR,
    406 +};
    407 +
    408 +static enum srbds_mitigations srbds_mitigation __ro_after_init = SRBDS_MITIGATION_FULL;
    409 +
    410 +static const char * const srbds_strings[] = {
    411 + [SRBDS_MITIGATION_OFF] = "Vulnerable",
    412 + [SRBDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
    413 + [SRBDS_MITIGATION_FULL] = "Mitigation: Microcode",
    414 + [SRBDS_MITIGATION_TSX_OFF] = "Mitigation: TSX disabled",
    415 + [SRBDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status",
    416 +};
    417 +
    418 +static bool srbds_off;
    419 +
    420 +void update_srbds_msr(void)
    421 +{
    422 + u64 mcu_ctrl;
    423 +
    424 + if (!boot_cpu_has_bug(X86_BUG_SRBDS))
    425 + return;
    426 +
    427 + if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
    428 + return;
    429 +
    430 + if (srbds_mitigation == SRBDS_MITIGATION_UCODE_NEEDED)
    431 + return;
    432 +
    433 + rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
    434 +
    435 + switch (srbds_mitigation) {
    436 + case SRBDS_MITIGATION_OFF:
    437 + case SRBDS_MITIGATION_TSX_OFF:
    438 + mcu_ctrl |= RNGDS_MITG_DIS;
    439 + break;
    440 + case SRBDS_MITIGATION_FULL:
    441 + mcu_ctrl &= ~RNGDS_MITG_DIS;
    442 + break;
    443 + default:
    444 + break;
    445 + }
    446 +
    447 + wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
    448 +}
    449 +
    450 +static void __init srbds_select_mitigation(void)
    451 +{
    452 + u64 ia32_cap;
    453 +
    454 + if (!boot_cpu_has_bug(X86_BUG_SRBDS))
    455 + return;
    456 +
    457 + /*
    458 + * Check to see if this is one of the MDS_NO systems supporting
    459 + * TSX that are only exposed to SRBDS when TSX is enabled.
    460 + */
    461 + ia32_cap = x86_read_arch_cap_msr();
    462 + if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM))
    463 + srbds_mitigation = SRBDS_MITIGATION_TSX_OFF;
    464 + else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
    465 + srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR;
    466 + else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL))
    467 + srbds_mitigation = SRBDS_MITIGATION_UCODE_NEEDED;
    468 + else if (cpu_mitigations_off() || srbds_off)
    469 + srbds_mitigation = SRBDS_MITIGATION_OFF;
    470 +
    471 + update_srbds_msr();
    472 + pr_info("%s\n", srbds_strings[srbds_mitigation]);
    473 +}
    474 +
    475 +static int __init srbds_parse_cmdline(char *str)
    476 +{
    477 + if (!str)
    478 + return -EINVAL;
    479 +
    480 + if (!boot_cpu_has_bug(X86_BUG_SRBDS))
    481 + return 0;
    482 +
    483 + srbds_off = !strcmp(str, "off");
    484 + return 0;
    485 +}
    486 +early_param("srbds", srbds_parse_cmdline);
    487 +
    488 #undef pr_fmt
    489 #define pr_fmt(fmt) "Spectre V1 : " fmt
    490
    491 @@ -1501,6 +1594,11 @@ static char *ibpb_state(void)
    492 return "";
    493 }
    494
    495 +static ssize_t srbds_show_state(char *buf)
    496 +{
    497 + return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
    498 +}
    499 +
    500 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
    501 char *buf, unsigned int bug)
    502 {
    503 @@ -1542,6 +1640,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
    504 case X86_BUG_ITLB_MULTIHIT:
    505 return itlb_multihit_show_state(buf);
    506
    507 + case X86_BUG_SRBDS:
    508 + return srbds_show_state(buf);
    509 +
    510 default:
    511 break;
    512 }
    513 @@ -1588,4 +1689,9 @@ ssize_t cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr
    514 {
    515 return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT);
    516 }
    517 +
    518 +ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf)
    519 +{
    520 + return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS);
    521 +}
    522 #endif
    523 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
    524 index f490a4fab2f7..b16b6176738b 100644
    525 --- a/arch/x86/kernel/cpu/common.c
    526 +++ b/arch/x86/kernel/cpu/common.c
    527 @@ -956,9 +956,30 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
    528 {}
    529 };
    530
    531 -static bool __init cpu_matches(unsigned long which)
    532 +#define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \
    533 + X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \
    534 + INTEL_FAM6_##model, steppings, \
    535 + X86_FEATURE_ANY, issues)
    536 +
    537 +#define SRBDS BIT(0)
    538 +
    539 +static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
    540 + VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
    541 + VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS),
    542 + VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS),
    543 + VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS),
    544 + VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS),
    545 + VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
    546 + VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS),
    547 + VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS),
    548 + VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0xC), SRBDS),
    549 + VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0xD), SRBDS),
    550 + {}
    551 +};
    552 +
    553 +static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which)
    554 {
    555 - const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist);
    556 + const struct x86_cpu_id *m = x86_match_cpu(table);
    557
    558 return m && !!(m->driver_data & which);
    559 }
    560 @@ -978,29 +999,32 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
    561 u64 ia32_cap = x86_read_arch_cap_msr();
    562
    563 /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */
    564 - if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
    565 + if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) &&
    566 + !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
    567 setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT);
    568
    569 - if (cpu_matches(NO_SPECULATION))
    570 + if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION))
    571 return;
    572
    573 setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
    574 setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
    575
    576 - if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) &&
    577 + if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) &&
    578 + !(ia32_cap & ARCH_CAP_SSB_NO) &&
    579 !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
    580 setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
    581
    582 if (ia32_cap & ARCH_CAP_IBRS_ALL)
    583 setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
    584
    585 - if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) {
    586 + if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
    587 + !(ia32_cap & ARCH_CAP_MDS_NO)) {
    588 setup_force_cpu_bug(X86_BUG_MDS);
    589 - if (cpu_matches(MSBDS_ONLY))
    590 + if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY))
    591 setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
    592 }
    593
    594 - if (!cpu_matches(NO_SWAPGS))
    595 + if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS))
    596 setup_force_cpu_bug(X86_BUG_SWAPGS);
    597
    598 /*
    599 @@ -1018,7 +1042,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
    600 (ia32_cap & ARCH_CAP_TSX_CTRL_MSR)))
    601 setup_force_cpu_bug(X86_BUG_TAA);
    602
    603 - if (cpu_matches(NO_MELTDOWN))
    604 + /*
    605 + * SRBDS affects CPUs which support RDRAND or RDSEED and are listed
    606 + * in the vulnerability blacklist.
    607 + */
    608 + if ((cpu_has(c, X86_FEATURE_RDRAND) ||
    609 + cpu_has(c, X86_FEATURE_RDSEED)) &&
    610 + cpu_matches(cpu_vuln_blacklist, SRBDS))
    611 + setup_force_cpu_bug(X86_BUG_SRBDS);
    612 +
    613 + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
    614 return;
    615
    616 /* Rogue Data Cache Load? No! */
    617 @@ -1027,7 +1060,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
    618
    619 setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
    620
    621 - if (cpu_matches(NO_L1TF))
    622 + if (cpu_matches(cpu_vuln_whitelist, NO_L1TF))
    623 return;
    624
    625 setup_force_cpu_bug(X86_BUG_L1TF);
    626 @@ -1450,6 +1483,7 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c)
    627 mtrr_ap_init();
    628 validate_apic_and_package_id(c);
    629 x86_spec_ctrl_setup_ap();
    630 + update_srbds_msr();
    631 }
    632
    633 struct msr_range {
    634 diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
    635 index 4350f50b5deb..fdeeab6b158c 100644
    636 --- a/arch/x86/kernel/cpu/cpu.h
    637 +++ b/arch/x86/kernel/cpu/cpu.h
    638 @@ -66,6 +66,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
    639 extern int detect_ht_early(struct cpuinfo_x86 *c);
    640
    641 extern void x86_spec_ctrl_setup_ap(void);
    642 +extern void update_srbds_msr(void);
    643
    644 extern u64 x86_read_arch_cap_msr(void);
    645
    646 diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c
    647 index e42117d5f4d7..f46ffb3b295f 100644
    648 --- a/arch/x86/kernel/cpu/match.c
    649 +++ b/arch/x86/kernel/cpu/match.c
    650 @@ -33,13 +33,18 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
    651 const struct x86_cpu_id *m;
    652 struct cpuinfo_x86 *c = &boot_cpu_data;
    653
    654 - for (m = match; m->vendor | m->family | m->model | m->feature; m++) {
    655 + for (m = match;
    656 + m->vendor | m->family | m->model | m->steppings | m->feature;
    657 + m++) {
    658 if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor)
    659 continue;
    660 if (m->family != X86_FAMILY_ANY && c->x86 != m->family)
    661 continue;
    662 if (m->model != X86_MODEL_ANY && c->x86_model != m->model)
    663 continue;
    664 + if (m->steppings != X86_STEPPING_ANY &&
    665 + !(BIT(c->x86_stepping) & m->steppings))
    666 + continue;
    667 if (m->feature != X86_FEATURE_ANY && !cpu_has(c, m->feature))
    668 continue;
    669 return m;
    670 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
    671 index bef36622e408..abd4fa587ca4 100644
    672 --- a/arch/x86/mm/mmio-mod.c
    673 +++ b/arch/x86/mm/mmio-mod.c
    674 @@ -385,7 +385,7 @@ static void enter_uniprocessor(void)
    675 int cpu;
    676 int err;
    677
    678 - if (downed_cpus == NULL &&
    679 + if (!cpumask_available(downed_cpus) &&
    680 !alloc_cpumask_var(&downed_cpus, GFP_KERNEL)) {
    681 pr_notice("Failed to allocate mask\n");
    682 goto out;
    683 @@ -415,7 +415,7 @@ static void leave_uniprocessor(void)
    684 int cpu;
    685 int err;
    686
    687 - if (downed_cpus == NULL || cpumask_weight(downed_cpus) == 0)
    688 + if (!cpumask_available(downed_cpus) || cpumask_weight(downed_cpus) == 0)
    689 return;
    690 pr_notice("Re-enabling CPUs...\n");
    691 for_each_cpu(cpu, downed_cpus) {
    692 diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
    693 index 677c5f36674b..100850398dd3 100644
    694 --- a/drivers/base/cpu.c
    695 +++ b/drivers/base/cpu.c
    696 @@ -550,6 +550,12 @@ ssize_t __weak cpu_show_itlb_multihit(struct device *dev,
    697 return sprintf(buf, "Not affected\n");
    698 }
    699
    700 +ssize_t __weak cpu_show_srbds(struct device *dev,
    701 + struct device_attribute *attr, char *buf)
    702 +{
    703 + return sprintf(buf, "Not affected\n");
    704 +}
    705 +
    706 static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
    707 static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
    708 static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
    709 @@ -558,6 +564,7 @@ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
    710 static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
    711 static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
    712 static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
    713 +static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
    714
    715 static struct attribute *cpu_root_vulnerabilities_attrs[] = {
    716 &dev_attr_meltdown.attr,
    717 @@ -568,6 +575,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
    718 &dev_attr_mds.attr,
    719 &dev_attr_tsx_async_abort.attr,
    720 &dev_attr_itlb_multihit.attr,
    721 + &dev_attr_srbds.attr,
    722 NULL
    723 };
    724
    725 diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    726 index 95052373a828..681ac9bc68b3 100644
    727 --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    728 +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
    729 @@ -381,6 +381,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
    730 },
    731 .driver_data = (void *)&sipodev_desc
    732 },
    733 + {
    734 + .ident = "Schneider SCL142ALM",
    735 + .matches = {
    736 + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SCHNEIDER"),
    737 + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SCL142ALM"),
    738 + },
    739 + .driver_data = (void *)&sipodev_desc
    740 + },
    741 { } /* Terminate list */
    742 };
    743
    744 diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
    745 index 360b6e98137a..5a3a532937ba 100644
    746 --- a/drivers/iio/light/vcnl4000.c
    747 +++ b/drivers/iio/light/vcnl4000.c
    748 @@ -61,7 +61,6 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
    749 u8 rdy_mask, u8 data_reg, int *val)
    750 {
    751 int tries = 20;
    752 - __be16 buf;
    753 int ret;
    754
    755 mutex_lock(&data->lock);
    756 @@ -88,13 +87,12 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
    757 goto fail;
    758 }
    759
    760 - ret = i2c_smbus_read_i2c_block_data(data->client,
    761 - data_reg, sizeof(buf), (u8 *) &buf);
    762 + ret = i2c_smbus_read_word_swapped(data->client, data_reg);
    763 if (ret < 0)
    764 goto fail;
    765
    766 mutex_unlock(&data->lock);
    767 - *val = be16_to_cpu(buf);
    768 + *val = ret;
    769
    770 return 0;
    771
    772 diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
    773 index d0435c7631ff..9c938f9892b2 100644
    774 --- a/drivers/net/can/slcan.c
    775 +++ b/drivers/net/can/slcan.c
    776 @@ -618,10 +618,9 @@ err_free_chan:
    777 sl->tty = NULL;
    778 tty->disc_data = NULL;
    779 clear_bit(SLF_INUSE, &sl->flags);
    780 - slc_free_netdev(sl->dev);
    781 /* do not call free_netdev before rtnl_unlock */
    782 rtnl_unlock();
    783 - free_netdev(sl->dev);
    784 + slc_free_netdev(sl->dev);
    785 return err;
    786
    787 err_exit:
    788 diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
    789 index a65d7a60f116..ffa7e7e6d18d 100644
    790 --- a/drivers/net/ethernet/apple/bmac.c
    791 +++ b/drivers/net/ethernet/apple/bmac.c
    792 @@ -1187,7 +1187,7 @@ bmac_get_station_address(struct net_device *dev, unsigned char *ea)
    793 int i;
    794 unsigned short data;
    795
    796 - for (i = 0; i < 6; i++)
    797 + for (i = 0; i < 3; i++)
    798 {
    799 reset_and_select_srom(dev);
    800 data = read_srom(dev, i + EnetAddressOffset/2, SROMAddressBits);
    801 diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
    802 index 714593023bbc..af922bac19ae 100644
    803 --- a/drivers/net/ethernet/freescale/ucc_geth.c
    804 +++ b/drivers/net/ethernet/freescale/ucc_geth.c
    805 @@ -45,6 +45,7 @@
    806 #include <soc/fsl/qe/ucc.h>
    807 #include <soc/fsl/qe/ucc_fast.h>
    808 #include <asm/machdep.h>
    809 +#include <net/sch_generic.h>
    810
    811 #include "ucc_geth.h"
    812
    813 @@ -1551,11 +1552,8 @@ static int ugeth_disable(struct ucc_geth_private *ugeth, enum comm_dir mode)
    814
    815 static void ugeth_quiesce(struct ucc_geth_private *ugeth)
    816 {
    817 - /* Prevent any further xmits, plus detach the device. */
    818 - netif_device_detach(ugeth->ndev);
    819 -
    820 - /* Wait for any current xmits to finish. */
    821 - netif_tx_disable(ugeth->ndev);
    822 + /* Prevent any further xmits */
    823 + netif_tx_stop_all_queues(ugeth->ndev);
    824
    825 /* Disable the interrupt to avoid NAPI rescheduling. */
    826 disable_irq(ugeth->ug_info->uf_info.irq);
    827 @@ -1568,7 +1566,10 @@ static void ugeth_activate(struct ucc_geth_private *ugeth)
    828 {
    829 napi_enable(&ugeth->napi);
    830 enable_irq(ugeth->ug_info->uf_info.irq);
    831 - netif_device_attach(ugeth->ndev);
    832 +
    833 + /* allow to xmit again */
    834 + netif_tx_wake_all_queues(ugeth->ndev);
    835 + __netdev_watchdog_up(ugeth->ndev);
    836 }
    837
    838 /* Called every time the controller might need to be made
    839 diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
    840 index 4143659615e1..264136dba674 100644
    841 --- a/drivers/net/ethernet/smsc/smsc911x.c
    842 +++ b/drivers/net/ethernet/smsc/smsc911x.c
    843 @@ -2506,20 +2506,20 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
    844
    845 retval = smsc911x_init(dev);
    846 if (retval < 0)
    847 - goto out_disable_resources;
    848 + goto out_init_fail;
    849
    850 netif_carrier_off(dev);
    851
    852 retval = smsc911x_mii_init(pdev, dev);
    853 if (retval) {
    854 SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
    855 - goto out_disable_resources;
    856 + goto out_init_fail;
    857 }
    858
    859 retval = register_netdev(dev);
    860 if (retval) {
    861 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
    862 - goto out_disable_resources;
    863 + goto out_init_fail;
    864 } else {
    865 SMSC_TRACE(pdata, probe,
    866 "Network interface: \"%s\"", dev->name);
    867 @@ -2560,9 +2560,10 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
    868
    869 return 0;
    870
    871 -out_disable_resources:
    872 +out_init_fail:
    873 pm_runtime_put(&pdev->dev);
    874 pm_runtime_disable(&pdev->dev);
    875 +out_disable_resources:
    876 (void)smsc911x_disable_resources(pdev);
    877 out_enable_resources_fail:
    878 smsc911x_free_resources(pdev);
    879 diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
    880 index 11a4a81b0397..bcc5d1e16ce2 100644
    881 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
    882 +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
    883 @@ -330,6 +330,19 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
    884 /* Enable PTP clock */
    885 regmap_read(gmac->nss_common, NSS_COMMON_CLK_GATE, &val);
    886 val |= NSS_COMMON_CLK_GATE_PTP_EN(gmac->id);
    887 + switch (gmac->phy_mode) {
    888 + case PHY_INTERFACE_MODE_RGMII:
    889 + val |= NSS_COMMON_CLK_GATE_RGMII_RX_EN(gmac->id) |
    890 + NSS_COMMON_CLK_GATE_RGMII_TX_EN(gmac->id);
    891 + break;
    892 + case PHY_INTERFACE_MODE_SGMII:
    893 + val |= NSS_COMMON_CLK_GATE_GMII_RX_EN(gmac->id) |
    894 + NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id);
    895 + break;
    896 + default:
    897 + /* We don't get here; the switch above will have errored out */
    898 + unreachable();
    899 + }
    900 regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
    901
    902 if (gmac->phy_mode == PHY_INTERFACE_MODE_SGMII) {
    903 diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
    904 index fa8f7c40a384..804c52c35f07 100644
    905 --- a/drivers/net/ppp/pppoe.c
    906 +++ b/drivers/net/ppp/pppoe.c
    907 @@ -494,6 +494,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
    908 if (!skb)
    909 goto out;
    910
    911 + if (skb->pkt_type != PACKET_HOST)
    912 + goto abort;
    913 +
    914 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
    915 goto abort;
    916
    917 diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
    918 index cc841126147e..f870396e05e1 100644
    919 --- a/drivers/net/slip/slip.c
    920 +++ b/drivers/net/slip/slip.c
    921 @@ -867,7 +867,10 @@ err_free_chan:
    922 sl->tty = NULL;
    923 tty->disc_data = NULL;
    924 clear_bit(SLF_INUSE, &sl->flags);
    925 + /* do not call free_netdev before rtnl_unlock */
    926 + rtnl_unlock();
    927 sl_free_netdev(sl->dev);
    928 + return err;
    929
    930 err_exit:
    931 rtnl_unlock();
    932 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    933 index 5755eec00d7f..9a873616dd27 100644
    934 --- a/drivers/net/usb/qmi_wwan.c
    935 +++ b/drivers/net/usb/qmi_wwan.c
    936 @@ -921,6 +921,7 @@ static const struct usb_device_id products[] = {
    937 {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
    938 {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
    939 {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
    940 + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
    941 {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
    942 {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
    943 {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
    944 diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
    945 index a8d470010f5e..ea609dc7f081 100644
    946 --- a/drivers/net/wireless/cisco/airo.c
    947 +++ b/drivers/net/wireless/cisco/airo.c
    948 @@ -1928,6 +1928,10 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
    949 airo_print_err(dev->name, "%s: skb == NULL!",__func__);
    950 return NETDEV_TX_OK;
    951 }
    952 + if (skb_padto(skb, ETH_ZLEN)) {
    953 + dev->stats.tx_dropped++;
    954 + return NETDEV_TX_OK;
    955 + }
    956 npacks = skb_queue_len (&ai->txq);
    957
    958 if (npacks >= MAXTXQ - 1) {
    959 @@ -2130,6 +2134,10 @@ static netdev_tx_t airo_start_xmit(struct sk_buff *skb,
    960 airo_print_err(dev->name, "%s: skb == NULL!", __func__);
    961 return NETDEV_TX_OK;
    962 }
    963 + if (skb_padto(skb, ETH_ZLEN)) {
    964 + dev->stats.tx_dropped++;
    965 + return NETDEV_TX_OK;
    966 + }
    967
    968 /* Find a vacant FID */
    969 for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
    970 @@ -2204,6 +2212,10 @@ static netdev_tx_t airo_start_xmit11(struct sk_buff *skb,
    971 airo_print_err(dev->name, "%s: skb == NULL!", __func__);
    972 return NETDEV_TX_OK;
    973 }
    974 + if (skb_padto(skb, ETH_ZLEN)) {
    975 + dev->stats.tx_dropped++;
    976 + return NETDEV_TX_OK;
    977 + }
    978
    979 /* Find a vacant FID */
    980 for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
    981 diff --git a/drivers/net/wireless/intersil/p54/p54usb.c b/drivers/net/wireless/intersil/p54/p54usb.c
    982 index 4a197a32d78c..979fcef1d848 100644
    983 --- a/drivers/net/wireless/intersil/p54/p54usb.c
    984 +++ b/drivers/net/wireless/intersil/p54/p54usb.c
    985 @@ -64,6 +64,7 @@ static struct usb_device_id p54u_table[] = {
    986 {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
    987 {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
    988 {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
    989 + {USB_DEVICE(0x124a, 0x4026)}, /* AirVasT USB wireless device */
    990 {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
    991 {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */
    992 {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
    993 diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
    994 index 798a32bbac5d..e023a679bdea 100644
    995 --- a/drivers/nfc/st21nfca/dep.c
    996 +++ b/drivers/nfc/st21nfca/dep.c
    997 @@ -184,8 +184,10 @@ static int st21nfca_tm_send_atr_res(struct nfc_hci_dev *hdev,
    998 memcpy(atr_res->gbi, atr_req->gbi, gb_len);
    999 r = nfc_set_remote_general_bytes(hdev->ndev, atr_res->gbi,
    1000 gb_len);
    1001 - if (r < 0)
    1002 + if (r < 0) {
    1003 + kfree_skb(skb);
    1004 return r;
    1005 + }
    1006 }
    1007
    1008 info->dep_info.curr_nfc_dep_pni = 0;
    1009 diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
    1010 index b5305f08b184..05b1c4f36b7b 100644
    1011 --- a/drivers/nvmem/qfprom.c
    1012 +++ b/drivers/nvmem/qfprom.c
    1013 @@ -30,19 +30,6 @@ static int qfprom_reg_read(void *context,
    1014 return 0;
    1015 }
    1016
    1017 -static int qfprom_reg_write(void *context,
    1018 - unsigned int reg, void *_val, size_t bytes)
    1019 -{
    1020 - void __iomem *base = context;
    1021 - u32 *val = _val;
    1022 - int i = 0, words = bytes / 4;
    1023 -
    1024 - while (words--)
    1025 - writel(*val++, base + reg + (i++ * 4));
    1026 -
    1027 - return 0;
    1028 -}
    1029 -
    1030 static int qfprom_remove(struct platform_device *pdev)
    1031 {
    1032 struct nvmem_device *nvmem = platform_get_drvdata(pdev);
    1033 @@ -56,7 +43,6 @@ static struct nvmem_config econfig = {
    1034 .stride = 4,
    1035 .word_size = 1,
    1036 .reg_read = qfprom_reg_read,
    1037 - .reg_write = qfprom_reg_write,
    1038 };
    1039
    1040 static int qfprom_probe(struct platform_device *pdev)
    1041 diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
    1042 index 9d555b63d2e2..d596b76eea64 100644
    1043 --- a/drivers/scsi/scsi_devinfo.c
    1044 +++ b/drivers/scsi/scsi_devinfo.c
    1045 @@ -394,8 +394,8 @@ EXPORT_SYMBOL(scsi_dev_info_list_add_keyed);
    1046
    1047 /**
    1048 * scsi_dev_info_list_find - find a matching dev_info list entry.
    1049 - * @vendor: vendor string
    1050 - * @model: model (product) string
    1051 + * @vendor: full vendor string
    1052 + * @model: full model (product) string
    1053 * @key: specify list to use
    1054 *
    1055 * Description:
    1056 @@ -410,7 +410,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
    1057 struct scsi_dev_info_list *devinfo;
    1058 struct scsi_dev_info_list_table *devinfo_table =
    1059 scsi_devinfo_lookup_by_key(key);
    1060 - size_t vmax, mmax;
    1061 + size_t vmax, mmax, mlen;
    1062 const char *vskip, *mskip;
    1063
    1064 if (IS_ERR(devinfo_table))
    1065 @@ -449,15 +449,18 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
    1066 dev_info_list) {
    1067 if (devinfo->compatible) {
    1068 /*
    1069 - * Behave like the older version of get_device_flags.
    1070 + * vendor strings must be an exact match
    1071 */
    1072 - if (memcmp(devinfo->vendor, vskip, vmax) ||
    1073 - (vmax < sizeof(devinfo->vendor) &&
    1074 - devinfo->vendor[vmax]))
    1075 + if (vmax != strlen(devinfo->vendor) ||
    1076 + memcmp(devinfo->vendor, vskip, vmax))
    1077 continue;
    1078 - if (memcmp(devinfo->model, mskip, mmax) ||
    1079 - (mmax < sizeof(devinfo->model) &&
    1080 - devinfo->model[mmax]))
    1081 +
    1082 + /*
    1083 + * @model specifies the full string, and
    1084 + * must be larger or equal to devinfo->model
    1085 + */
    1086 + mlen = strlen(devinfo->model);
    1087 + if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
    1088 continue;
    1089 return devinfo;
    1090 } else {
    1091 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
    1092 index 50d15748084a..af4b0a2021d6 100644
    1093 --- a/drivers/scsi/ufs/ufshcd.c
    1094 +++ b/drivers/scsi/ufs/ufshcd.c
    1095 @@ -1512,6 +1512,7 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
    1096
    1097 err = ufshcd_map_sg(hba, lrbp);
    1098 if (err) {
    1099 + ufshcd_release(hba);
    1100 lrbp->cmd = NULL;
    1101 clear_bit_unlock(tag, &hba->lrb_in_use);
    1102 goto out;
    1103 diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
    1104 index 16f0def9df82..babf0a337e96 100644
    1105 --- a/drivers/spi/spi-dw.c
    1106 +++ b/drivers/spi/spi-dw.c
    1107 @@ -305,6 +305,9 @@ static int dw_spi_transfer_one(struct spi_master *master,
    1108 dws->len = transfer->len;
    1109 spin_unlock_irqrestore(&dws->buf_lock, flags);
    1110
    1111 + /* Ensure dw->rx and dw->rx_end are visible */
    1112 + smp_mb();
    1113 +
    1114 spi_enable_chip(dws, 0);
    1115
    1116 /* Handle per transfer options for bpw and speed */
    1117 diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h
    1118 index b8af9656e6da..f97275b90177 100644
    1119 --- a/drivers/staging/rtl8712/wifi.h
    1120 +++ b/drivers/staging/rtl8712/wifi.h
    1121 @@ -471,7 +471,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
    1122 /* block-ack parameters */
    1123 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
    1124 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
    1125 -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
    1126 +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
    1127 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
    1128 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
    1129
    1130 @@ -565,13 +565,6 @@ struct ieee80211_ht_addt_info {
    1131 #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004
    1132 #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010
    1133
    1134 -/* block-ack parameters */
    1135 -#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
    1136 -#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
    1137 -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
    1138 -#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
    1139 -#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
    1140 -
    1141 /*
    1142 * A-PMDU buffer sizes
    1143 * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
    1144 diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
    1145 index f8964247c4c3..985f49a65906 100644
    1146 --- a/drivers/tty/hvc/hvc_console.c
    1147 +++ b/drivers/tty/hvc/hvc_console.c
    1148 @@ -358,15 +358,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
    1149 * tty fields and return the kref reference.
    1150 */
    1151 if (rc) {
    1152 - tty_port_tty_set(&hp->port, NULL);
    1153 - tty->driver_data = NULL;
    1154 - tty_port_put(&hp->port);
    1155 printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc);
    1156 - } else
    1157 + } else {
    1158 /* We are ready... raise DTR/RTS */
    1159 if (C_BAUD(tty))
    1160 if (hp->ops->dtr_rts)
    1161 hp->ops->dtr_rts(hp, 1);
    1162 + tty_port_set_initialized(&hp->port, true);
    1163 + }
    1164
    1165 /* Force wakeup of the polling thread */
    1166 hvc_kick();
    1167 @@ -376,22 +375,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
    1168
    1169 static void hvc_close(struct tty_struct *tty, struct file * filp)
    1170 {
    1171 - struct hvc_struct *hp;
    1172 + struct hvc_struct *hp = tty->driver_data;
    1173 unsigned long flags;
    1174
    1175 if (tty_hung_up_p(filp))
    1176 return;
    1177
    1178 - /*
    1179 - * No driver_data means that this close was issued after a failed
    1180 - * hvc_open by the tty layer's release_dev() function and we can just
    1181 - * exit cleanly because the kref reference wasn't made.
    1182 - */
    1183 - if (!tty->driver_data)
    1184 - return;
    1185 -
    1186 - hp = tty->driver_data;
    1187 -
    1188 spin_lock_irqsave(&hp->port.lock, flags);
    1189
    1190 if (--hp->port.count == 0) {
    1191 @@ -399,6 +388,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
    1192 /* We are done with the tty pointer now. */
    1193 tty_port_tty_set(&hp->port, NULL);
    1194
    1195 + if (!tty_port_initialized(&hp->port))
    1196 + return;
    1197 +
    1198 if (C_HUPCL(tty))
    1199 if (hp->ops->dtr_rts)
    1200 hp->ops->dtr_rts(hp, 0);
    1201 @@ -415,6 +407,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
    1202 * waking periodically to check chars_in_buffer().
    1203 */
    1204 tty_wait_until_sent(tty, HVC_CLOSE_WAIT);
    1205 + tty_port_set_initialized(&hp->port, false);
    1206 } else {
    1207 if (hp->port.count < 0)
    1208 printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
    1209 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
    1210 index b4e7a7317713..d9eba7938917 100644
    1211 --- a/drivers/tty/vt/keyboard.c
    1212 +++ b/drivers/tty/vt/keyboard.c
    1213 @@ -125,7 +125,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */
    1214 static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */
    1215 static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */
    1216 static bool dead_key_next;
    1217 -static int npadch = -1; /* -1 or number assembled on pad */
    1218 +
    1219 +/* Handles a number being assembled on the number pad */
    1220 +static bool npadch_active;
    1221 +static unsigned int npadch_value;
    1222 +
    1223 static unsigned int diacr;
    1224 static char rep; /* flag telling character repeat */
    1225
    1226 @@ -815,12 +819,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag)
    1227 shift_state &= ~(1 << value);
    1228
    1229 /* kludge */
    1230 - if (up_flag && shift_state != old_state && npadch != -1) {
    1231 + if (up_flag && shift_state != old_state && npadch_active) {
    1232 if (kbd->kbdmode == VC_UNICODE)
    1233 - to_utf8(vc, npadch);
    1234 + to_utf8(vc, npadch_value);
    1235 else
    1236 - put_queue(vc, npadch & 0xff);
    1237 - npadch = -1;
    1238 + put_queue(vc, npadch_value & 0xff);
    1239 + npadch_active = false;
    1240 }
    1241 }
    1242
    1243 @@ -838,7 +842,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
    1244
    1245 static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
    1246 {
    1247 - int base;
    1248 + unsigned int base;
    1249
    1250 if (up_flag)
    1251 return;
    1252 @@ -852,10 +856,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
    1253 base = 16;
    1254 }
    1255
    1256 - if (npadch == -1)
    1257 - npadch = value;
    1258 - else
    1259 - npadch = npadch * base + value;
    1260 + if (!npadch_active) {
    1261 + npadch_value = 0;
    1262 + npadch_active = true;
    1263 + }
    1264 +
    1265 + npadch_value = npadch_value * base + value;
    1266 }
    1267
    1268 static void k_lock(struct vc_data *vc, unsigned char value, char up_flag)
    1269 diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
    1270 index f4bd08cfac11..a631975e050d 100644
    1271 --- a/drivers/usb/gadget/function/f_uac2.c
    1272 +++ b/drivers/usb/gadget/function/f_uac2.c
    1273 @@ -1069,13 +1069,13 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
    1274 agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
    1275 if (!agdev->out_ep) {
    1276 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
    1277 - return ret;
    1278 + return -ENODEV;
    1279 }
    1280
    1281 agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc);
    1282 if (!agdev->in_ep) {
    1283 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
    1284 - return ret;
    1285 + return -ENODEV;
    1286 }
    1287
    1288 uac2->p_prm.uac2 = uac2;
    1289 diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
    1290 index 534a3f6fa89c..474bb13b7dbb 100644
    1291 --- a/drivers/usb/musb/musb_debugfs.c
    1292 +++ b/drivers/usb/musb/musb_debugfs.c
    1293 @@ -200,6 +200,11 @@ static ssize_t musb_test_mode_write(struct file *file,
    1294 u8 test;
    1295 char buf[18];
    1296
    1297 + memset(buf, 0x00, sizeof(buf));
    1298 +
    1299 + if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
    1300 + return -EFAULT;
    1301 +
    1302 pm_runtime_get_sync(musb->controller);
    1303 test = musb_readb(musb->mregs, MUSB_TESTMODE);
    1304 if (test) {
    1305 @@ -208,11 +213,6 @@ static ssize_t musb_test_mode_write(struct file *file,
    1306 goto ret;
    1307 }
    1308
    1309 - memset(buf, 0x00, sizeof(buf));
    1310 -
    1311 - if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
    1312 - return -EFAULT;
    1313 -
    1314 if (strstarts(buf, "force host"))
    1315 test = MUSB_TEST_FORCE_HOST;
    1316
    1317 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1318 index 737b6652a0b5..326e7109b8f8 100644
    1319 --- a/drivers/usb/serial/option.c
    1320 +++ b/drivers/usb/serial/option.c
    1321 @@ -1146,6 +1146,10 @@ static const struct usb_device_id option_ids[] = {
    1322 { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
    1323 { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
    1324 { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
    1325 + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */
    1326 + .driver_info = NCTRL(0) | RSVD(3) },
    1327 + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
    1328 + .driver_info = NCTRL(0) },
    1329 { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
    1330 .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
    1331 { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),
    1332 diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    1333 index 06916ddc3159..c59e6d4a8a61 100644
    1334 --- a/drivers/usb/serial/qcserial.c
    1335 +++ b/drivers/usb/serial/qcserial.c
    1336 @@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = {
    1337 {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
    1338 {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
    1339 {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
    1340 + {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */
    1341 {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */
    1342 {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
    1343 {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */
    1344 diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
    1345 index 93c696e2131f..0fbb34fcbddf 100644
    1346 --- a/drivers/usb/serial/usb_wwan.c
    1347 +++ b/drivers/usb/serial/usb_wwan.c
    1348 @@ -305,6 +305,10 @@ static void usb_wwan_indat_callback(struct urb *urb)
    1349 if (status) {
    1350 dev_dbg(dev, "%s: nonzero status: %d on endpoint %02x.\n",
    1351 __func__, status, endpoint);
    1352 +
    1353 + /* don't resubmit on fatal errors */
    1354 + if (status == -ESHUTDOWN || status == -ENOENT)
    1355 + return;
    1356 } else {
    1357 if (urb->actual_length) {
    1358 tty_insert_flip_string(&port->port, data,
    1359 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
    1360 index 1abfe37314a0..df841a72b804 100644
    1361 --- a/include/linux/mod_devicetable.h
    1362 +++ b/include/linux/mod_devicetable.h
    1363 @@ -572,6 +572,10 @@ struct mips_cdmm_device_id {
    1364 /*
    1365 * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id.
    1366 * Although gcc seems to ignore this error, clang fails without this define.
    1367 + *
    1368 + * Note: The ordering of the struct is different from upstream because the
    1369 + * static initializers in kernels < 5.7 still use C89 style while upstream
    1370 + * has been converted to proper C99 initializers.
    1371 */
    1372 #define x86cpu_device_id x86_cpu_id
    1373 struct x86_cpu_id {
    1374 @@ -580,6 +584,7 @@ struct x86_cpu_id {
    1375 __u16 model;
    1376 __u16 feature; /* bit index */
    1377 kernel_ulong_t driver_data;
    1378 + __u16 steppings;
    1379 };
    1380
    1381 #define X86_FEATURE_MATCH(x) \
    1382 @@ -588,6 +593,7 @@ struct x86_cpu_id {
    1383 #define X86_VENDOR_ANY 0xffff
    1384 #define X86_FAMILY_ANY 0
    1385 #define X86_MODEL_ANY 0
    1386 +#define X86_STEPPING_ANY 0
    1387 #define X86_FEATURE_ANY 0 /* Same as FPU, you can't test for that */
    1388
    1389 /*
    1390 diff --git a/include/uapi/linux/mmc/ioctl.h b/include/uapi/linux/mmc/ioctl.h
    1391 index 7e385b83b9d8..fe4b6b69d79a 100644
    1392 --- a/include/uapi/linux/mmc/ioctl.h
    1393 +++ b/include/uapi/linux/mmc/ioctl.h
    1394 @@ -2,6 +2,7 @@
    1395 #define LINUX_MMC_IOCTL_H
    1396
    1397 #include <linux/types.h>
    1398 +#include <linux/major.h>
    1399
    1400 struct mmc_ioc_cmd {
    1401 /* Implies direction of data. true = write, false = read */
    1402 diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
    1403 index 8ddd29476c0d..1fcaa174ed32 100644
    1404 --- a/kernel/events/uprobes.c
    1405 +++ b/kernel/events/uprobes.c
    1406 @@ -604,10 +604,6 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
    1407 if (ret)
    1408 goto out;
    1409
    1410 - /* uprobe_write_opcode() assumes we don't cross page boundary */
    1411 - BUG_ON((uprobe->offset & ~PAGE_MASK) +
    1412 - UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
    1413 -
    1414 smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
    1415 set_bit(UPROBE_COPY_INSN, &uprobe->flags);
    1416
    1417 @@ -886,6 +882,13 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
    1418 if (offset > i_size_read(inode))
    1419 return -EINVAL;
    1420
    1421 + /*
    1422 + * This ensures that copy_from_page() and copy_to_page()
    1423 + * can't cross page boundary.
    1424 + */
    1425 + if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
    1426 + return -EINVAL;
    1427 +
    1428 retry:
    1429 uprobe = alloc_uprobe(inode, offset);
    1430 if (!uprobe)
    1431 @@ -1696,6 +1699,9 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr)
    1432 uprobe_opcode_t opcode;
    1433 int result;
    1434
    1435 + if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE)))
    1436 + return -EINVAL;
    1437 +
    1438 pagefault_disable();
    1439 result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr);
    1440 pagefault_enable();
    1441 diff --git a/kernel/relay.c b/kernel/relay.c
    1442 index 91e8fbf8aff3..5034cb3a339f 100644
    1443 --- a/kernel/relay.c
    1444 +++ b/kernel/relay.c
    1445 @@ -578,6 +578,11 @@ struct rchan *relay_open(const char *base_filename,
    1446 return NULL;
    1447
    1448 chan->buf = alloc_percpu(struct rchan_buf *);
    1449 + if (!chan->buf) {
    1450 + kfree(chan);
    1451 + return NULL;
    1452 + }
    1453 +
    1454 chan->version = RELAYFS_CHANNEL_VERSION;
    1455 chan->n_subbufs = n_subbufs;
    1456 chan->subbuf_size = subbuf_size;
    1457 diff --git a/mm/mremap.c b/mm/mremap.c
    1458 index 9e6035969d7b..b5d8d25173c6 100644
    1459 --- a/mm/mremap.c
    1460 +++ b/mm/mremap.c
    1461 @@ -212,7 +212,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
    1462 new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
    1463 if (!new_pmd)
    1464 break;
    1465 - if (pmd_trans_huge(*old_pmd)) {
    1466 + if (pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) {
    1467 if (extent == HPAGE_PMD_SIZE) {
    1468 bool moved;
    1469 /* See comment in move_ptes() */
    1470 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
    1471 index af3363f4543f..6f3c52943186 100644
    1472 --- a/net/ipv4/devinet.c
    1473 +++ b/net/ipv4/devinet.c
    1474 @@ -262,6 +262,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
    1475 err = devinet_sysctl_register(in_dev);
    1476 if (err) {
    1477 in_dev->dead = 1;
    1478 + neigh_parms_release(&arp_tbl, in_dev->arp_parms);
    1479 in_dev_put(in_dev);
    1480 in_dev = NULL;
    1481 goto out;
    1482 diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
    1483 index 6a924be66e37..da158a3acac4 100644
    1484 --- a/net/ipv6/esp6.c
    1485 +++ b/net/ipv6/esp6.c
    1486 @@ -426,8 +426,10 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
    1487
    1488 sg_init_table(sg, nfrags);
    1489 ret = skb_to_sgvec(skb, sg, 0, skb->len);
    1490 - if (unlikely(ret < 0))
    1491 + if (unlikely(ret < 0)) {
    1492 + kfree(tmp);
    1493 goto out;
    1494 + }
    1495
    1496 aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
    1497 aead_request_set_ad(req, assoclen);
    1498 diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
    1499 index 36c7f616294a..fdc1de1cb4fa 100644
    1500 --- a/net/l2tp/l2tp_core.c
    1501 +++ b/net/l2tp/l2tp_core.c
    1502 @@ -1568,6 +1568,8 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
    1503 tunnel_id, fd);
    1504 goto err;
    1505 }
    1506 + if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
    1507 + goto err;
    1508 switch (encap) {
    1509 case L2TP_ENCAPTYPE_UDP:
    1510 if (sk->sk_protocol != IPPROTO_UDP) {
    1511 diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
    1512 index 4a88c4eb2301..3817c3554641 100644
    1513 --- a/net/l2tp/l2tp_ip.c
    1514 +++ b/net/l2tp/l2tp_ip.c
    1515 @@ -24,7 +24,6 @@
    1516 #include <net/icmp.h>
    1517 #include <net/udp.h>
    1518 #include <net/inet_common.h>
    1519 -#include <net/inet_hashtables.h>
    1520 #include <net/tcp_states.h>
    1521 #include <net/protocol.h>
    1522 #include <net/xfrm.h>
    1523 @@ -208,15 +207,31 @@ discard:
    1524 return 0;
    1525 }
    1526
    1527 -static int l2tp_ip_open(struct sock *sk)
    1528 +static int l2tp_ip_hash(struct sock *sk)
    1529 {
    1530 - /* Prevent autobind. We don't have ports. */
    1531 - inet_sk(sk)->inet_num = IPPROTO_L2TP;
    1532 + if (sk_unhashed(sk)) {
    1533 + write_lock_bh(&l2tp_ip_lock);
    1534 + sk_add_node(sk, &l2tp_ip_table);
    1535 + write_unlock_bh(&l2tp_ip_lock);
    1536 + }
    1537 + return 0;
    1538 +}
    1539
    1540 +static void l2tp_ip_unhash(struct sock *sk)
    1541 +{
    1542 + if (sk_unhashed(sk))
    1543 + return;
    1544 write_lock_bh(&l2tp_ip_lock);
    1545 - sk_add_node(sk, &l2tp_ip_table);
    1546 + sk_del_node_init(sk);
    1547 write_unlock_bh(&l2tp_ip_lock);
    1548 +}
    1549 +
    1550 +static int l2tp_ip_open(struct sock *sk)
    1551 +{
    1552 + /* Prevent autobind. We don't have ports. */
    1553 + inet_sk(sk)->inet_num = IPPROTO_L2TP;
    1554
    1555 + l2tp_ip_hash(sk);
    1556 return 0;
    1557 }
    1558
    1559 @@ -598,8 +613,8 @@ static struct proto l2tp_ip_prot = {
    1560 .sendmsg = l2tp_ip_sendmsg,
    1561 .recvmsg = l2tp_ip_recvmsg,
    1562 .backlog_rcv = l2tp_ip_backlog_recv,
    1563 - .hash = inet_hash,
    1564 - .unhash = inet_unhash,
    1565 + .hash = l2tp_ip_hash,
    1566 + .unhash = l2tp_ip_unhash,
    1567 .obj_size = sizeof(struct l2tp_ip_sock),
    1568 #ifdef CONFIG_COMPAT
    1569 .compat_setsockopt = compat_ip_setsockopt,
    1570 diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
    1571 index 28274f397c55..76ef758db112 100644
    1572 --- a/net/l2tp/l2tp_ip6.c
    1573 +++ b/net/l2tp/l2tp_ip6.c
    1574 @@ -24,8 +24,6 @@
    1575 #include <net/icmp.h>
    1576 #include <net/udp.h>
    1577 #include <net/inet_common.h>
    1578 -#include <net/inet_hashtables.h>
    1579 -#include <net/inet6_hashtables.h>
    1580 #include <net/tcp_states.h>
    1581 #include <net/protocol.h>
    1582 #include <net/xfrm.h>
    1583 @@ -221,15 +219,31 @@ discard:
    1584 return 0;
    1585 }
    1586
    1587 -static int l2tp_ip6_open(struct sock *sk)
    1588 +static int l2tp_ip6_hash(struct sock *sk)
    1589 {
    1590 - /* Prevent autobind. We don't have ports. */
    1591 - inet_sk(sk)->inet_num = IPPROTO_L2TP;
    1592 + if (sk_unhashed(sk)) {
    1593 + write_lock_bh(&l2tp_ip6_lock);
    1594 + sk_add_node(sk, &l2tp_ip6_table);
    1595 + write_unlock_bh(&l2tp_ip6_lock);
    1596 + }
    1597 + return 0;
    1598 +}
    1599
    1600 +static void l2tp_ip6_unhash(struct sock *sk)
    1601 +{
    1602 + if (sk_unhashed(sk))
    1603 + return;
    1604 write_lock_bh(&l2tp_ip6_lock);
    1605 - sk_add_node(sk, &l2tp_ip6_table);
    1606 + sk_del_node_init(sk);
    1607 write_unlock_bh(&l2tp_ip6_lock);
    1608 +}
    1609 +
    1610 +static int l2tp_ip6_open(struct sock *sk)
    1611 +{
    1612 + /* Prevent autobind. We don't have ports. */
    1613 + inet_sk(sk)->inet_num = IPPROTO_L2TP;
    1614
    1615 + l2tp_ip6_hash(sk);
    1616 return 0;
    1617 }
    1618
    1619 @@ -732,8 +746,8 @@ static struct proto l2tp_ip6_prot = {
    1620 .sendmsg = l2tp_ip6_sendmsg,
    1621 .recvmsg = l2tp_ip6_recvmsg,
    1622 .backlog_rcv = l2tp_ip6_backlog_recv,
    1623 - .hash = inet6_hash,
    1624 - .unhash = inet_unhash,
    1625 + .hash = l2tp_ip6_hash,
    1626 + .unhash = l2tp_ip6_unhash,
    1627 .obj_size = sizeof(struct l2tp_ip6_sock),
    1628 #ifdef CONFIG_COMPAT
    1629 .compat_setsockopt = compat_ipv6_setsockopt,
    1630 diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
    1631 index 18f377306884..d6473b8d9a81 100644
    1632 --- a/net/vmw_vsock/af_vsock.c
    1633 +++ b/net/vmw_vsock/af_vsock.c
    1634 @@ -1296,7 +1296,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
    1635 /* Wait for children sockets to appear; these are the new sockets
    1636 * created upon connection establishment.
    1637 */
    1638 - timeout = sock_sndtimeo(listener, flags & O_NONBLOCK);
    1639 + timeout = sock_rcvtimeo(listener, flags & O_NONBLOCK);
    1640 prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
    1641
    1642 while ((connected = vsock_dequeue_accept(listener)) == NULL &&