Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.19/0112-4.19.13-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.19/0112-4.19.13-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3391 - (hide annotations) (download)
    Fri Aug 2 11:47:26 2019 UTC (4 years, 9 months ago) by niro
    File size: 74632 byte(s) 
    -linux-4.19.13
    1 niro 3391 diff --git a/Makefile b/Makefile
    2     index 9770f29a690a..892ff14cbc9d 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,7 +1,7 @@
    6     # SPDX-License-Identifier: GPL-2.0
    7     VERSION = 4
    8     PATCHLEVEL = 19
    9     -SUBLEVEL = 12
    10     +SUBLEVEL = 13
    11     EXTRAVERSION =
    12     NAME = "People's Front"
    13    
    14     diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
    15     index 92fd2c8a9af0..12659ce5c1f3 100644
    16     --- a/arch/arm/include/asm/pgtable-2level.h
    17     +++ b/arch/arm/include/asm/pgtable-2level.h
    18     @@ -10,7 +10,7 @@
    19     #ifndef _ASM_PGTABLE_2LEVEL_H
    20     #define _ASM_PGTABLE_2LEVEL_H
    21    
    22     -#define __PAGETABLE_PMD_FOLDED
    23     +#define __PAGETABLE_PMD_FOLDED 1
    24    
    25     /*
    26     * Hardware-wise, we have a two level page table structure, where the first
    27     diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
    28     index 6181e4134483..fe3ddd73a0cc 100644
    29     --- a/arch/m68k/include/asm/pgtable_mm.h
    30     +++ b/arch/m68k/include/asm/pgtable_mm.h
    31     @@ -55,12 +55,12 @@
    32     */
    33     #ifdef CONFIG_SUN3
    34     #define PTRS_PER_PTE 16
    35     -#define __PAGETABLE_PMD_FOLDED
    36     +#define __PAGETABLE_PMD_FOLDED 1
    37     #define PTRS_PER_PMD 1
    38     #define PTRS_PER_PGD 2048
    39     #elif defined(CONFIG_COLDFIRE)
    40     #define PTRS_PER_PTE 512
    41     -#define __PAGETABLE_PMD_FOLDED
    42     +#define __PAGETABLE_PMD_FOLDED 1
    43     #define PTRS_PER_PMD 1
    44     #define PTRS_PER_PGD 1024
    45     #else
    46     diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
    47     index 7b650ab14fa0..2ca598534cc7 100644
    48     --- a/arch/microblaze/include/asm/pgtable.h
    49     +++ b/arch/microblaze/include/asm/pgtable.h
    50     @@ -63,7 +63,7 @@ extern int mem_init_done;
    51    
    52     #include <asm-generic/4level-fixup.h>
    53    
    54     -#define __PAGETABLE_PMD_FOLDED
    55     +#define __PAGETABLE_PMD_FOLDED 1
    56    
    57     #ifdef __KERNEL__
    58     #ifndef __ASSEMBLY__
    59     diff --git a/arch/nds32/include/asm/pgtable.h b/arch/nds32/include/asm/pgtable.h
    60     index d3e19a55cf53..9f52db930c00 100644
    61     --- a/arch/nds32/include/asm/pgtable.h
    62     +++ b/arch/nds32/include/asm/pgtable.h
    63     @@ -4,7 +4,7 @@
    64     #ifndef _ASMNDS32_PGTABLE_H
    65     #define _ASMNDS32_PGTABLE_H
    66    
    67     -#define __PAGETABLE_PMD_FOLDED
    68     +#define __PAGETABLE_PMD_FOLDED 1
    69     #include <asm-generic/4level-fixup.h>
    70     #include <asm-generic/sizes.h>
    71    
    72     diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
    73     index fa6b7c78f18a..ff0860b2b21a 100644
    74     --- a/arch/parisc/include/asm/pgtable.h
    75     +++ b/arch/parisc/include/asm/pgtable.h
    76     @@ -117,7 +117,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
    77     #if CONFIG_PGTABLE_LEVELS == 3
    78     #define BITS_PER_PMD (PAGE_SHIFT + PMD_ORDER - BITS_PER_PMD_ENTRY)
    79     #else
    80     -#define __PAGETABLE_PMD_FOLDED
    81     +#define __PAGETABLE_PMD_FOLDED 1
    82     #define BITS_PER_PMD 0
    83     #endif
    84     #define PTRS_PER_PMD (1UL << BITS_PER_PMD)
    85     diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
    86     index 141d415a8c80..c3d7ccd25381 100644
    87     --- a/arch/x86/entry/vdso/Makefile
    88     +++ b/arch/x86/entry/vdso/Makefile
    89     @@ -171,7 +171,8 @@ quiet_cmd_vdso = VDSO $@
    90     sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
    91    
    92     VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
    93     - $(call ld-option, --build-id) -Bsymbolic
    94     + $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \
    95     + -Bsymbolic
    96     GCOV_PROFILE := n
    97    
    98     #
    99     diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
    100     index b3486c8b570a..1f9de7635bcb 100644
    101     --- a/arch/x86/include/asm/msr-index.h
    102     +++ b/arch/x86/include/asm/msr-index.h
    103     @@ -389,6 +389,7 @@
    104     #define MSR_F15H_NB_PERF_CTR 0xc0010241
    105     #define MSR_F15H_PTSC 0xc0010280
    106     #define MSR_F15H_IC_CFG 0xc0011021
    107     +#define MSR_F15H_EX_CFG 0xc001102c
    108    
    109     /* Fam 10h MSRs */
    110     #define MSR_FAM10H_MMIO_CONF_BASE 0xc0010058
    111     diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
    112     index 0f53049719cd..627e5c809b33 100644
    113     --- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
    114     +++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
    115     @@ -23,6 +23,7 @@
    116    
    117     #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
    118    
    119     +#include <linux/cpu.h>
    120     #include <linux/kernfs.h>
    121     #include <linux/seq_file.h>
    122     #include <linux/slab.h>
    123     @@ -310,9 +311,11 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
    124     return -EINVAL;
    125     buf[nbytes - 1] = '\0';
    126    
    127     + cpus_read_lock();
    128     rdtgrp = rdtgroup_kn_lock_live(of->kn);
    129     if (!rdtgrp) {
    130     rdtgroup_kn_unlock(of->kn);
    131     + cpus_read_unlock();
    132     return -ENOENT;
    133     }
    134     rdt_last_cmd_clear();
    135     @@ -367,6 +370,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
    136    
    137     out:
    138     rdtgroup_kn_unlock(of->kn);
    139     + cpus_read_unlock();
    140     return ret ?: nbytes;
    141     }
    142    
    143     diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
    144     index 40eee6cc4124..254683b503a9 100644
    145     --- a/arch/x86/kernel/cpu/mtrr/if.c
    146     +++ b/arch/x86/kernel/cpu/mtrr/if.c
    147     @@ -165,6 +165,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)
    148     struct mtrr_gentry gentry;
    149     void __user *arg = (void __user *) __arg;
    150    
    151     + memset(&gentry, 0, sizeof(gentry));
    152     +
    153     switch (cmd) {
    154     case MTRRIOC_ADD_ENTRY:
    155     case MTRRIOC_SET_ENTRY:
    156     diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    157     index c97a9d60d305..33ffb6d17e73 100644
    158     --- a/arch/x86/kvm/vmx.c
    159     +++ b/arch/x86/kvm/vmx.c
    160     @@ -11471,6 +11471,8 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
    161     kunmap(vmx->nested.pi_desc_page);
    162     kvm_release_page_dirty(vmx->nested.pi_desc_page);
    163     vmx->nested.pi_desc_page = NULL;
    164     + vmx->nested.pi_desc = NULL;
    165     + vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull);
    166     }
    167     page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr);
    168     if (is_error_page(page))
    169     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    170     index 68b53f05a420..956eecd227f8 100644
    171     --- a/arch/x86/kvm/x86.c
    172     +++ b/arch/x86/kvm/x86.c
    173     @@ -2343,6 +2343,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    174     case MSR_AMD64_PATCH_LOADER:
    175     case MSR_AMD64_BU_CFG2:
    176     case MSR_AMD64_DC_CFG:
    177     + case MSR_F15H_EX_CFG:
    178     break;
    179    
    180     case MSR_IA32_UCODE_REV:
    181     @@ -2638,6 +2639,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
    182     case MSR_AMD64_BU_CFG2:
    183     case MSR_IA32_PERF_CTL:
    184     case MSR_AMD64_DC_CFG:
    185     + case MSR_F15H_EX_CFG:
    186     msr_info->data = 0;
    187     break;
    188     case MSR_F15H_PERF_CTL0 ... MSR_F15H_PERF_CTR5:
    189     @@ -7304,7 +7306,7 @@ void kvm_make_scan_ioapic_request(struct kvm *kvm)
    190    
    191     static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
    192     {
    193     - if (!kvm_apic_hw_enabled(vcpu->arch.apic))
    194     + if (!kvm_apic_present(vcpu))
    195     return;
    196    
    197     bitmap_zero(vcpu->arch.ioapic_handled_vectors, 256);
    198     diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
    199     index 3d0c83ef6aab..a3c9ea29d7cc 100644
    200     --- a/arch/x86/mm/pat.c
    201     +++ b/arch/x86/mm/pat.c
    202     @@ -519,8 +519,13 @@ static u64 sanitize_phys(u64 address)
    203     * for a "decoy" virtual address (bit 63 clear) passed to
    204     * set_memory_X(). __pa() on a "decoy" address results in a
    205     * physical address with bit 63 set.
    206     + *
    207     + * Decoy addresses are not present for 32-bit builds, see
    208     + * set_mce_nospec().
    209     */
    210     - return address & __PHYSICAL_MASK;
    211     + if (IS_ENABLED(CONFIG_X86_64))
    212     + return address & __PHYSICAL_MASK;
    213     + return address;
    214     }
    215    
    216     /*
    217     @@ -546,7 +551,11 @@ int reserve_memtype(u64 start, u64 end, enum page_cache_mode req_type,
    218    
    219     start = sanitize_phys(start);
    220     end = sanitize_phys(end);
    221     - BUG_ON(start >= end); /* end is exclusive */
    222     + if (start >= end) {
    223     + WARN(1, "%s failed: [mem %#010Lx-%#010Lx], req %s\n", __func__,
    224     + start, end - 1, cattr_name(req_type));
    225     + return -EINVAL;
    226     + }
    227    
    228     if (!pat_enabled()) {
    229     /* This is identical to page table setting without PAT */
    230     diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c
    231     index 05813fbf3daf..647dfbbc4e1c 100644
    232     --- a/drivers/gpio/gpio-max7301.c
    233     +++ b/drivers/gpio/gpio-max7301.c
    234     @@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg,
    235     struct spi_device *spi = to_spi_device(dev);
    236     u16 word = ((reg & 0x7F) << 8) | (val & 0xFF);
    237    
    238     - return spi_write(spi, (const u8 *)&word, sizeof(word));
    239     + return spi_write_then_read(spi, &word, sizeof(word), NULL, 0);
    240     }
    241    
    242     /* A read from the MAX7301 means two transfers; here, one message each */
    243     @@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg)
    244     struct spi_device *spi = to_spi_device(dev);
    245    
    246     word = 0x8000 | (reg << 8);
    247     - ret = spi_write(spi, (const u8 *)&word, sizeof(word));
    248     - if (ret)
    249     - return ret;
    250     - /*
    251     - * This relies on the fact, that a transfer with NULL tx_buf shifts out
    252     - * zero bytes (=NOOP for MAX7301)
    253     - */
    254     - ret = spi_read(spi, (u8 *)&word, sizeof(word));
    255     + ret = spi_write_then_read(spi, &word, sizeof(word), &word,
    256     + sizeof(word));
    257     if (ret)
    258     return ret;
    259     return word & 0xff;
    260     diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
    261     index 8b9d7e42c600..c5e009f61021 100644
    262     --- a/drivers/gpio/gpiolib-acpi.c
    263     +++ b/drivers/gpio/gpiolib-acpi.c
    264     @@ -23,11 +23,28 @@
    265    
    266     #include "gpiolib.h"
    267    
    268     +/**
    269     + * struct acpi_gpio_event - ACPI GPIO event handler data
    270     + *
    271     + * @node: list-entry of the events list of the struct acpi_gpio_chip
    272     + * @handle: handle of ACPI method to execute when the IRQ triggers
    273     + * @handler: irq_handler to pass to request_irq when requesting the IRQ
    274     + * @pin: GPIO pin number on the gpio_chip
    275     + * @irq: Linux IRQ number for the event, for request_ / free_irq
    276     + * @irqflags: flags to pass to request_irq when requesting the IRQ
    277     + * @irq_is_wake: If the ACPI flags indicate the IRQ is a wakeup source
    278     + * @is_requested: True if request_irq has been done
    279     + * @desc: gpio_desc for the GPIO pin for this event
    280     + */
    281     struct acpi_gpio_event {
    282     struct list_head node;
    283     acpi_handle handle;
    284     + irq_handler_t handler;
    285     unsigned int pin;
    286     unsigned int irq;
    287     + unsigned long irqflags;
    288     + bool irq_is_wake;
    289     + bool irq_requested;
    290     struct gpio_desc *desc;
    291     };
    292    
    293     @@ -53,10 +70,10 @@ struct acpi_gpio_chip {
    294    
    295     /*
    296     * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
    297     - * (so builtin drivers) we register the ACPI GpioInt event handlers from a
    298     + * (so builtin drivers) we register the ACPI GpioInt IRQ handlers from a
    299     * late_initcall_sync handler, so that other builtin drivers can register their
    300     * OpRegions before the event handlers can run. This list contains gpiochips
    301     - * for which the acpi_gpiochip_request_interrupts() has been deferred.
    302     + * for which the acpi_gpiochip_request_irqs() call has been deferred.
    303     */
    304     static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
    305     static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
    306     @@ -137,8 +154,42 @@ bool acpi_gpio_get_irq_resource(struct acpi_resource *ares,
    307     }
    308     EXPORT_SYMBOL_GPL(acpi_gpio_get_irq_resource);
    309    
    310     -static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
    311     - void *context)
    312     +static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
    313     + struct acpi_gpio_event *event)
    314     +{
    315     + int ret, value;
    316     +
    317     + ret = request_threaded_irq(event->irq, NULL, event->handler,
    318     + event->irqflags, "ACPI:Event", event);
    319     + if (ret) {
    320     + dev_err(acpi_gpio->chip->parent,
    321     + "Failed to setup interrupt handler for %d\n",
    322     + event->irq);
    323     + return;
    324     + }
    325     +
    326     + if (event->irq_is_wake)
    327     + enable_irq_wake(event->irq);
    328     +
    329     + event->irq_requested = true;
    330     +
    331     + /* Make sure we trigger the initial state of edge-triggered IRQs */
    332     + value = gpiod_get_raw_value_cansleep(event->desc);
    333     + if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
    334     + ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
    335     + event->handler(event->irq, event);
    336     +}
    337     +
    338     +static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
    339     +{
    340     + struct acpi_gpio_event *event;
    341     +
    342     + list_for_each_entry(event, &acpi_gpio->events, node)
    343     + acpi_gpiochip_request_irq(acpi_gpio, event);
    344     +}
    345     +
    346     +static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
    347     + void *context)
    348     {
    349     struct acpi_gpio_chip *acpi_gpio = context;
    350     struct gpio_chip *chip = acpi_gpio->chip;
    351     @@ -147,8 +198,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
    352     struct acpi_gpio_event *event;
    353     irq_handler_t handler = NULL;
    354     struct gpio_desc *desc;
    355     - unsigned long irqflags;
    356     - int ret, pin, irq, value;
    357     + int ret, pin, irq;
    358    
    359     if (!acpi_gpio_get_irq_resource(ares, &agpio))
    360     return AE_OK;
    361     @@ -179,8 +229,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
    362    
    363     gpiod_direction_input(desc);
    364    
    365     - value = gpiod_get_value_cansleep(desc);
    366     -
    367     ret = gpiochip_lock_as_irq(chip, pin);
    368     if (ret) {
    369     dev_err(chip->parent, "Failed to lock GPIO as interrupt\n");
    370     @@ -193,64 +241,42 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
    371     goto fail_unlock_irq;
    372     }
    373    
    374     - irqflags = IRQF_ONESHOT;
    375     + event = kzalloc(sizeof(*event), GFP_KERNEL);
    376     + if (!event)
    377     + goto fail_unlock_irq;
    378     +
    379     + event->irqflags = IRQF_ONESHOT;
    380     if (agpio->triggering == ACPI_LEVEL_SENSITIVE) {
    381     if (agpio->polarity == ACPI_ACTIVE_HIGH)
    382     - irqflags |= IRQF_TRIGGER_HIGH;
    383     + event->irqflags |= IRQF_TRIGGER_HIGH;
    384     else
    385     - irqflags |= IRQF_TRIGGER_LOW;
    386     + event->irqflags |= IRQF_TRIGGER_LOW;
    387     } else {
    388     switch (agpio->polarity) {
    389     case ACPI_ACTIVE_HIGH:
    390     - irqflags |= IRQF_TRIGGER_RISING;
    391     + event->irqflags |= IRQF_TRIGGER_RISING;
    392     break;
    393     case ACPI_ACTIVE_LOW:
    394     - irqflags |= IRQF_TRIGGER_FALLING;
    395     + event->irqflags |= IRQF_TRIGGER_FALLING;
    396     break;
    397     default:
    398     - irqflags |= IRQF_TRIGGER_RISING |
    399     - IRQF_TRIGGER_FALLING;
    400     + event->irqflags |= IRQF_TRIGGER_RISING |
    401     + IRQF_TRIGGER_FALLING;
    402     break;
    403     }
    404     }
    405    
    406     - event = kzalloc(sizeof(*event), GFP_KERNEL);
    407     - if (!event)
    408     - goto fail_unlock_irq;
    409     -
    410     event->handle = evt_handle;
    411     + event->handler = handler;
    412     event->irq = irq;
    413     + event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
    414     event->pin = pin;
    415     event->desc = desc;
    416    
    417     - ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
    418     - "ACPI:Event", event);
    419     - if (ret) {
    420     - dev_err(chip->parent,
    421     - "Failed to setup interrupt handler for %d\n",
    422     - event->irq);
    423     - goto fail_free_event;
    424     - }
    425     -
    426     - if (agpio->wake_capable == ACPI_WAKE_CAPABLE)
    427     - enable_irq_wake(irq);
    428     -
    429     list_add_tail(&event->node, &acpi_gpio->events);
    430    
    431     - /*
    432     - * Make sure we trigger the initial state of the IRQ when using RISING
    433     - * or FALLING. Note we run the handlers on late_init, the AML code
    434     - * may refer to OperationRegions from other (builtin) drivers which
    435     - * may be probed after us.
    436     - */
    437     - if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
    438     - ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
    439     - handler(event->irq, event);
    440     -
    441     return AE_OK;
    442    
    443     -fail_free_event:
    444     - kfree(event);
    445     fail_unlock_irq:
    446     gpiochip_unlock_as_irq(chip, pin);
    447     fail_free_desc:
    448     @@ -287,6 +313,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
    449     if (ACPI_FAILURE(status))
    450     return;
    451    
    452     + acpi_walk_resources(handle, "_AEI",
    453     + acpi_gpiochip_alloc_event, acpi_gpio);
    454     +
    455     mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
    456     defer = !acpi_gpio_deferred_req_irqs_done;
    457     if (defer)
    458     @@ -297,8 +326,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
    459     if (defer)
    460     return;
    461    
    462     - acpi_walk_resources(handle, "_AEI",
    463     - acpi_gpiochip_request_interrupt, acpi_gpio);
    464     + acpi_gpiochip_request_irqs(acpi_gpio);
    465     }
    466     EXPORT_SYMBOL_GPL(acpi_gpiochip_request_interrupts);
    467    
    468     @@ -335,10 +363,13 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
    469     list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
    470     struct gpio_desc *desc;
    471    
    472     - if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
    473     - disable_irq_wake(event->irq);
    474     + if (event->irq_requested) {
    475     + if (event->irq_is_wake)
    476     + disable_irq_wake(event->irq);
    477     +
    478     + free_irq(event->irq, event);
    479     + }
    480    
    481     - free_irq(event->irq, event);
    482     desc = event->desc;
    483     if (WARN_ON(IS_ERR(desc)))
    484     continue;
    485     @@ -1204,23 +1235,16 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
    486     return con_id == NULL;
    487     }
    488    
    489     -/* Run deferred acpi_gpiochip_request_interrupts() */
    490     -static int acpi_gpio_handle_deferred_request_interrupts(void)
    491     +/* Run deferred acpi_gpiochip_request_irqs() */
    492     +static int acpi_gpio_handle_deferred_request_irqs(void)
    493     {
    494     struct acpi_gpio_chip *acpi_gpio, *tmp;
    495    
    496     mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
    497     list_for_each_entry_safe(acpi_gpio, tmp,
    498     &acpi_gpio_deferred_req_irqs_list,
    499     - deferred_req_irqs_list_entry) {
    500     - acpi_handle handle;
    501     -
    502     - handle = ACPI_HANDLE(acpi_gpio->chip->parent);
    503     - acpi_walk_resources(handle, "_AEI",
    504     - acpi_gpiochip_request_interrupt, acpi_gpio);
    505     -
    506     - list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
    507     - }
    508     + deferred_req_irqs_list_entry)
    509     + acpi_gpiochip_request_irqs(acpi_gpio);
    510    
    511     acpi_gpio_deferred_req_irqs_done = true;
    512     mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
    513     @@ -1228,4 +1252,4 @@ static int acpi_gpio_handle_deferred_request_interrupts(void)
    514     return 0;
    515     }
    516     /* We must use _sync so that this runs after the first deferred_probe run */
    517     -late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
    518     +late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
    519     diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
    520     index ea10e9a26aad..ba129b64b61f 100644
    521     --- a/drivers/gpu/drm/drm_ioctl.c
    522     +++ b/drivers/gpu/drm/drm_ioctl.c
    523     @@ -37,6 +37,7 @@
    524    
    525     #include <linux/pci.h>
    526     #include <linux/export.h>
    527     +#include <linux/nospec.h>
    528    
    529     /**
    530     * DOC: getunique and setversion story
    531     @@ -794,13 +795,17 @@ long drm_ioctl(struct file *filp,
    532    
    533     if (is_driver_ioctl) {
    534     /* driver ioctl */
    535     - if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
    536     + unsigned int index = nr - DRM_COMMAND_BASE;
    537     +
    538     + if (index >= dev->driver->num_ioctls)
    539     goto err_i1;
    540     - ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
    541     + index = array_index_nospec(index, dev->driver->num_ioctls);
    542     + ioctl = &dev->driver->ioctls[index];
    543     } else {
    544     /* core ioctl */
    545     if (nr >= DRM_CORE_IOCTL_COUNT)
    546     goto err_i1;
    547     + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
    548     ioctl = &drm_ioctls[nr];
    549     }
    550    
    551     @@ -882,6 +887,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
    552    
    553     if (nr >= DRM_CORE_IOCTL_COUNT)
    554     return false;
    555     + nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
    556    
    557     *flags = drm_ioctls[nr].flags;
    558     return true;
    559     diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
    560     index c71cc857b649..2c6d5c7a4445 100644
    561     --- a/drivers/hv/vmbus_drv.c
    562     +++ b/drivers/hv/vmbus_drv.c
    563     @@ -316,6 +316,8 @@ static ssize_t out_intr_mask_show(struct device *dev,
    564    
    565     if (!hv_dev->channel)
    566     return -ENODEV;
    567     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    568     + return -EINVAL;
    569     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    570     return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
    571     }
    572     @@ -329,6 +331,8 @@ static ssize_t out_read_index_show(struct device *dev,
    573    
    574     if (!hv_dev->channel)
    575     return -ENODEV;
    576     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    577     + return -EINVAL;
    578     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    579     return sprintf(buf, "%d\n", outbound.current_read_index);
    580     }
    581     @@ -343,6 +347,8 @@ static ssize_t out_write_index_show(struct device *dev,
    582    
    583     if (!hv_dev->channel)
    584     return -ENODEV;
    585     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    586     + return -EINVAL;
    587     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    588     return sprintf(buf, "%d\n", outbound.current_write_index);
    589     }
    590     @@ -357,6 +363,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
    591    
    592     if (!hv_dev->channel)
    593     return -ENODEV;
    594     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    595     + return -EINVAL;
    596     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    597     return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
    598     }
    599     @@ -371,6 +379,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
    600    
    601     if (!hv_dev->channel)
    602     return -ENODEV;
    603     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    604     + return -EINVAL;
    605     hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
    606     return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
    607     }
    608     @@ -384,6 +394,8 @@ static ssize_t in_intr_mask_show(struct device *dev,
    609    
    610     if (!hv_dev->channel)
    611     return -ENODEV;
    612     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    613     + return -EINVAL;
    614     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    615     return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
    616     }
    617     @@ -397,6 +409,8 @@ static ssize_t in_read_index_show(struct device *dev,
    618    
    619     if (!hv_dev->channel)
    620     return -ENODEV;
    621     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    622     + return -EINVAL;
    623     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    624     return sprintf(buf, "%d\n", inbound.current_read_index);
    625     }
    626     @@ -410,6 +424,8 @@ static ssize_t in_write_index_show(struct device *dev,
    627    
    628     if (!hv_dev->channel)
    629     return -ENODEV;
    630     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    631     + return -EINVAL;
    632     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    633     return sprintf(buf, "%d\n", inbound.current_write_index);
    634     }
    635     @@ -424,6 +440,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
    636    
    637     if (!hv_dev->channel)
    638     return -ENODEV;
    639     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    640     + return -EINVAL;
    641     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    642     return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
    643     }
    644     @@ -438,6 +456,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
    645    
    646     if (!hv_dev->channel)
    647     return -ENODEV;
    648     + if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
    649     + return -EINVAL;
    650     hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
    651     return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
    652     }
    653     diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    654     index 2d95e8d93cc7..9fe075c137dc 100644
    655     --- a/drivers/input/mouse/elantech.c
    656     +++ b/drivers/input/mouse/elantech.c
    657     @@ -1767,6 +1767,18 @@ static int elantech_smbus = IS_ENABLED(CONFIG_MOUSE_ELAN_I2C_SMBUS) ?
    658     module_param_named(elantech_smbus, elantech_smbus, int, 0644);
    659     MODULE_PARM_DESC(elantech_smbus, "Use a secondary bus for the Elantech device.");
    660    
    661     +static const char * const i2c_blacklist_pnp_ids[] = {
    662     + /*
    663     + * These are known to not be working properly as bits are missing
    664     + * in elan_i2c.
    665     + */
    666     + "LEN2131", /* ThinkPad P52 w/ NFC */
    667     + "LEN2132", /* ThinkPad P52 */
    668     + "LEN2133", /* ThinkPad P72 w/ NFC */
    669     + "LEN2134", /* ThinkPad P72 */
    670     + NULL
    671     +};
    672     +
    673     static int elantech_create_smbus(struct psmouse *psmouse,
    674     struct elantech_device_info *info,
    675     bool leave_breadcrumbs)
    676     @@ -1802,10 +1814,12 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
    677    
    678     if (elantech_smbus == ELANTECH_SMBUS_NOT_SET) {
    679     /*
    680     - * New ICs are enabled by default.
    681     + * New ICs are enabled by default, unless mentioned in
    682     + * i2c_blacklist_pnp_ids.
    683     * Old ICs are up to the user to decide.
    684     */
    685     - if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
    686     + if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
    687     + psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
    688     return -ENXIO;
    689     }
    690    
    691     diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
    692     index 30b15e91d8be..8e7a2a59cd32 100644
    693     --- a/drivers/media/i2c/ov5640.c
    694     +++ b/drivers/media/i2c/ov5640.c
    695     @@ -2020,6 +2020,7 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
    696     struct ov5640_dev *sensor = to_ov5640_dev(sd);
    697     const struct ov5640_mode_info *new_mode;
    698     struct v4l2_mbus_framefmt *mbus_fmt = &format->format;
    699     + struct v4l2_mbus_framefmt *fmt;
    700     int ret;
    701    
    702     if (format->pad != 0)
    703     @@ -2037,22 +2038,20 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
    704     if (ret)
    705     goto out;
    706    
    707     - if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
    708     - struct v4l2_mbus_framefmt *fmt =
    709     - v4l2_subdev_get_try_format(sd, cfg, 0);
    710     + if (format->which == V4L2_SUBDEV_FORMAT_TRY)
    711     + fmt = v4l2_subdev_get_try_format(sd, cfg, 0);
    712     + else
    713     + fmt = &sensor->fmt;
    714    
    715     - *fmt = *mbus_fmt;
    716     - goto out;
    717     - }
    718     + *fmt = *mbus_fmt;
    719    
    720     if (new_mode != sensor->current_mode) {
    721     sensor->current_mode = new_mode;
    722     sensor->pending_mode_change = true;
    723     }
    724     - if (mbus_fmt->code != sensor->fmt.code) {
    725     - sensor->fmt = *mbus_fmt;
    726     + if (mbus_fmt->code != sensor->fmt.code)
    727     sensor->pending_fmt_change = true;
    728     - }
    729     +
    730     out:
    731     mutex_unlock(&sensor->lock);
    732     return ret;
    733     diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
    734     index bc1bd2c25613..55997cf84b39 100644
    735     --- a/drivers/mmc/core/mmc.c
    736     +++ b/drivers/mmc/core/mmc.c
    737     @@ -30,6 +30,7 @@
    738     #include "pwrseq.h"
    739    
    740     #define DEFAULT_CMD6_TIMEOUT_MS 500
    741     +#define MIN_CACHE_EN_TIMEOUT_MS 1600
    742    
    743     static const unsigned int tran_exp[] = {
    744     10000, 100000, 1000000, 10000000,
    745     @@ -526,8 +527,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
    746     card->cid.year += 16;
    747    
    748     /* check whether the eMMC card supports BKOPS */
    749     - if (!mmc_card_broken_hpi(card) &&
    750     - ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
    751     + if (ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
    752     card->ext_csd.bkops = 1;
    753     card->ext_csd.man_bkops_en =
    754     (ext_csd[EXT_CSD_BKOPS_EN] &
    755     @@ -1782,20 +1782,26 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
    756     if (err) {
    757     pr_warn("%s: Enabling HPI failed\n",
    758     mmc_hostname(card->host));
    759     + card->ext_csd.hpi_en = 0;
    760     err = 0;
    761     - } else
    762     + } else {
    763     card->ext_csd.hpi_en = 1;
    764     + }
    765     }
    766    
    767     /*
    768     - * If cache size is higher than 0, this indicates
    769     - * the existence of cache and it can be turned on.
    770     + * If cache size is higher than 0, this indicates the existence of cache
    771     + * and it can be turned on. Note that some eMMCs from Micron has been
    772     + * reported to need ~800 ms timeout, while enabling the cache after
    773     + * sudden power failure tests. Let's extend the timeout to a minimum of
    774     + * DEFAULT_CACHE_EN_TIMEOUT_MS and do it for all cards.
    775     */
    776     - if (!mmc_card_broken_hpi(card) &&
    777     - card->ext_csd.cache_size > 0) {
    778     + if (card->ext_csd.cache_size > 0) {
    779     + unsigned int timeout_ms = MIN_CACHE_EN_TIMEOUT_MS;
    780     +
    781     + timeout_ms = max(card->ext_csd.generic_cmd6_time, timeout_ms);
    782     err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
    783     - EXT_CSD_CACHE_CTRL, 1,
    784     - card->ext_csd.generic_cmd6_time);
    785     + EXT_CSD_CACHE_CTRL, 1, timeout_ms);
    786     if (err && err != -EBADMSG)
    787     goto free_card;
    788    
    789     diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
    790     index 68760d4a5d3d..b23c57e07f36 100644
    791     --- a/drivers/mmc/host/omap_hsmmc.c
    792     +++ b/drivers/mmc/host/omap_hsmmc.c
    793     @@ -2066,7 +2066,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
    794     mmc->max_blk_size = 512; /* Block Length at max can be 1024 */
    795     mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */
    796     mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
    797     - mmc->max_seg_size = mmc->max_req_size;
    798    
    799     mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
    800     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
    801     @@ -2096,6 +2095,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
    802     goto err_irq;
    803     }
    804    
    805     + /*
    806     + * Limit the maximum segment size to the lower of the request size
    807     + * and the DMA engine device segment size limits. In reality, with
    808     + * 32-bit transfers, the DMA engine can do longer segments than this
    809     + * but there is no way to represent that in the DMA model - if we
    810     + * increase this figure here, we get warnings from the DMA API debug.
    811     + */
    812     + mmc->max_seg_size = min3(mmc->max_req_size,
    813     + dma_get_max_seg_size(host->rx_chan->device->dev),
    814     + dma_get_max_seg_size(host->tx_chan->device->dev));
    815     +
    816     /* Request IRQ for MMC operations */
    817     ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0,
    818     mmc_hostname(mmc), host);
    819     diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
    820     index 184c24baca15..d6916f787fce 100644
    821     --- a/drivers/net/usb/hso.c
    822     +++ b/drivers/net/usb/hso.c
    823     @@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
    824     return -EIO;
    825     }
    826    
    827     + /* check if we have a valid interface */
    828     + if (if_num > 16) {
    829     + kfree(config_data);
    830     + return -EINVAL;
    831     + }
    832     +
    833     switch (config_data[if_num]) {
    834     case 0x0:
    835     result = 0;
    836     @@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
    837    
    838     /* Get the interface/port specification from either driver_info or from
    839     * the device itself */
    840     - if (id->driver_info)
    841     + if (id->driver_info) {
    842     + /* if_num is controlled by the device, driver_info is a 0 terminated
    843     + * array. Make sure, the access is in bounds! */
    844     + for (i = 0; i <= if_num; ++i)
    845     + if (((u32 *)(id->driver_info))[i] == 0)
    846     + goto exit;
    847     port_spec = ((u32 *)(id->driver_info))[if_num];
    848     - else
    849     + } else {
    850     port_spec = hso_get_config_data(interface);
    851     + if (port_spec < 0)
    852     + goto exit;
    853     + }
    854    
    855     /* Check if we need to switch to alt interfaces prior to port
    856     * configuration */
    857     diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
    858     index 4d49a1a3f504..16c6c7f921a8 100644
    859     --- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
    860     +++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
    861     @@ -868,6 +868,15 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
    862     int ret, i, j;
    863     u16 cmd_wide_id = WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
    864    
    865     + /*
    866     + * This command is not supported on earlier firmware versions.
    867     + * Unfortunately, we don't have a TLV API flag to rely on, so
    868     + * rely on the major version which is in the first byte of
    869     + * ucode_ver.
    870     + */
    871     + if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
    872     + return 0;
    873     +
    874     ret = iwl_mvm_sar_get_wgds_table(mvm);
    875     if (ret < 0) {
    876     IWL_DEBUG_RADIO(mvm,
    877     diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    878     index b150da4c6721..5d65500a8aa7 100644
    879     --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    880     +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    881     @@ -518,6 +518,56 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
    882     {IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
    883    
    884     /* 9000 Series */
    885     + {IWL_PCI_DEVICE(0x02F0, 0x0030, iwl9560_2ac_cfg_soc)},
    886     + {IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_soc)},
    887     + {IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_cfg_soc)},
    888     + {IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_cfg_soc)},
    889     + {IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_soc)},
    890     + {IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_soc)},
    891     + {IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_soc)},
    892     + {IWL_PCI_DEVICE(0x02F0, 0x00A4, iwl9462_2ac_cfg_soc)},
    893     + {IWL_PCI_DEVICE(0x02F0, 0x0230, iwl9560_2ac_cfg_soc)},
    894     + {IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_soc)},
    895     + {IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_soc)},
    896     + {IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_soc)},
    897     + {IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_soc)},
    898     + {IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_soc)},
    899     + {IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_soc)},
    900     + {IWL_PCI_DEVICE(0x02F0, 0x02A4, iwl9462_2ac_cfg_soc)},
    901     + {IWL_PCI_DEVICE(0x02F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
    902     + {IWL_PCI_DEVICE(0x02F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
    903     + {IWL_PCI_DEVICE(0x02F0, 0x2030, iwl9560_2ac_cfg_soc)},
    904     + {IWL_PCI_DEVICE(0x02F0, 0x2034, iwl9560_2ac_cfg_soc)},
    905     + {IWL_PCI_DEVICE(0x02F0, 0x4030, iwl9560_2ac_cfg_soc)},
    906     + {IWL_PCI_DEVICE(0x02F0, 0x4034, iwl9560_2ac_cfg_soc)},
    907     + {IWL_PCI_DEVICE(0x02F0, 0x40A4, iwl9462_2ac_cfg_soc)},
    908     + {IWL_PCI_DEVICE(0x02F0, 0x4234, iwl9560_2ac_cfg_soc)},
    909     + {IWL_PCI_DEVICE(0x02F0, 0x42A4, iwl9462_2ac_cfg_soc)},
    910     + {IWL_PCI_DEVICE(0x06F0, 0x0030, iwl9560_2ac_cfg_soc)},
    911     + {IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_soc)},
    912     + {IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_cfg_soc)},
    913     + {IWL_PCI_DEVICE(0x06F0, 0x003C, iwl9560_2ac_cfg_soc)},
    914     + {IWL_PCI_DEVICE(0x06F0, 0x0060, iwl9461_2ac_cfg_soc)},
    915     + {IWL_PCI_DEVICE(0x06F0, 0x0064, iwl9461_2ac_cfg_soc)},
    916     + {IWL_PCI_DEVICE(0x06F0, 0x00A0, iwl9462_2ac_cfg_soc)},
    917     + {IWL_PCI_DEVICE(0x06F0, 0x00A4, iwl9462_2ac_cfg_soc)},
    918     + {IWL_PCI_DEVICE(0x06F0, 0x0230, iwl9560_2ac_cfg_soc)},
    919     + {IWL_PCI_DEVICE(0x06F0, 0x0234, iwl9560_2ac_cfg_soc)},
    920     + {IWL_PCI_DEVICE(0x06F0, 0x0238, iwl9560_2ac_cfg_soc)},
    921     + {IWL_PCI_DEVICE(0x06F0, 0x023C, iwl9560_2ac_cfg_soc)},
    922     + {IWL_PCI_DEVICE(0x06F0, 0x0260, iwl9461_2ac_cfg_soc)},
    923     + {IWL_PCI_DEVICE(0x06F0, 0x0264, iwl9461_2ac_cfg_soc)},
    924     + {IWL_PCI_DEVICE(0x06F0, 0x02A0, iwl9462_2ac_cfg_soc)},
    925     + {IWL_PCI_DEVICE(0x06F0, 0x02A4, iwl9462_2ac_cfg_soc)},
    926     + {IWL_PCI_DEVICE(0x06F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
    927     + {IWL_PCI_DEVICE(0x06F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
    928     + {IWL_PCI_DEVICE(0x06F0, 0x2030, iwl9560_2ac_cfg_soc)},
    929     + {IWL_PCI_DEVICE(0x06F0, 0x2034, iwl9560_2ac_cfg_soc)},
    930     + {IWL_PCI_DEVICE(0x06F0, 0x4030, iwl9560_2ac_cfg_soc)},
    931     + {IWL_PCI_DEVICE(0x06F0, 0x4034, iwl9560_2ac_cfg_soc)},
    932     + {IWL_PCI_DEVICE(0x06F0, 0x40A4, iwl9462_2ac_cfg_soc)},
    933     + {IWL_PCI_DEVICE(0x06F0, 0x4234, iwl9560_2ac_cfg_soc)},
    934     + {IWL_PCI_DEVICE(0x06F0, 0x42A4, iwl9462_2ac_cfg_soc)},
    935     {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
    936     {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
    937     {IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)},
    938     diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
    939     index e2addd8b878b..5d75c971004b 100644
    940     --- a/drivers/net/wireless/marvell/mwifiex/11n.c
    941     +++ b/drivers/net/wireless/marvell/mwifiex/11n.c
    942     @@ -696,11 +696,10 @@ void mwifiex_11n_delba(struct mwifiex_private *priv, int tid)
    943     "Send delba to tid=%d, %pM\n",
    944     tid, rx_reor_tbl_ptr->ta);
    945     mwifiex_send_delba(priv, tid, rx_reor_tbl_ptr->ta, 0);
    946     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    947     - flags);
    948     - return;
    949     + goto exit;
    950     }
    951     }
    952     +exit:
    953     spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    954     }
    955    
    956     diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
    957     index 8e63d14c1e1c..5380fba652cc 100644
    958     --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
    959     +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
    960     @@ -103,8 +103,6 @@ static int mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv, void *payload)
    961     * There could be holes in the buffer, which are skipped by the function.
    962     * Since the buffer is linear, the function uses rotation to simulate
    963     * circular buffer.
    964     - *
    965     - * The caller must hold rx_reorder_tbl_lock spinlock.
    966     */
    967     static void
    968     mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
    969     @@ -113,21 +111,25 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
    970     {
    971     int pkt_to_send, i;
    972     void *rx_tmp_ptr;
    973     + unsigned long flags;
    974    
    975     pkt_to_send = (start_win > tbl->start_win) ?
    976     min((start_win - tbl->start_win), tbl->win_size) :
    977     tbl->win_size;
    978    
    979     for (i = 0; i < pkt_to_send; ++i) {
    980     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    981     rx_tmp_ptr = NULL;
    982     if (tbl->rx_reorder_ptr[i]) {
    983     rx_tmp_ptr = tbl->rx_reorder_ptr[i];
    984     tbl->rx_reorder_ptr[i] = NULL;
    985     }
    986     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    987     if (rx_tmp_ptr)
    988     mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
    989     }
    990    
    991     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    992     /*
    993     * We don't have a circular buffer, hence use rotation to simulate
    994     * circular buffer
    995     @@ -138,6 +140,7 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
    996     }
    997    
    998     tbl->start_win = start_win;
    999     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1000     }
    1001    
    1002     /*
    1003     @@ -147,8 +150,6 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
    1004     * The start window is adjusted automatically when a hole is located.
    1005     * Since the buffer is linear, the function uses rotation to simulate
    1006     * circular buffer.
    1007     - *
    1008     - * The caller must hold rx_reorder_tbl_lock spinlock.
    1009     */
    1010     static void
    1011     mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
    1012     @@ -156,15 +157,22 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
    1013     {
    1014     int i, j, xchg;
    1015     void *rx_tmp_ptr;
    1016     + unsigned long flags;
    1017    
    1018     for (i = 0; i < tbl->win_size; ++i) {
    1019     - if (!tbl->rx_reorder_ptr[i])
    1020     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1021     + if (!tbl->rx_reorder_ptr[i]) {
    1022     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1023     + flags);
    1024     break;
    1025     + }
    1026     rx_tmp_ptr = tbl->rx_reorder_ptr[i];
    1027     tbl->rx_reorder_ptr[i] = NULL;
    1028     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1029     mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
    1030     }
    1031    
    1032     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1033     /*
    1034     * We don't have a circular buffer, hence use rotation to simulate
    1035     * circular buffer
    1036     @@ -177,6 +185,7 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
    1037     }
    1038     }
    1039     tbl->start_win = (tbl->start_win + i) & (MAX_TID_VALUE - 1);
    1040     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1041     }
    1042    
    1043     /*
    1044     @@ -184,8 +193,6 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
    1045     *
    1046     * The function stops the associated timer and dispatches all the
    1047     * pending packets in the Rx reorder table before deletion.
    1048     - *
    1049     - * The caller must hold rx_reorder_tbl_lock spinlock.
    1050     */
    1051     static void
    1052     mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
    1053     @@ -211,7 +218,11 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
    1054    
    1055     del_timer_sync(&tbl->timer_context.timer);
    1056     tbl->timer_context.timer_is_set = false;
    1057     +
    1058     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1059     list_del(&tbl->list);
    1060     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1061     +
    1062     kfree(tbl->rx_reorder_ptr);
    1063     kfree(tbl);
    1064    
    1065     @@ -224,17 +235,22 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
    1066     /*
    1067     * This function returns the pointer to an entry in Rx reordering
    1068     * table which matches the given TA/TID pair.
    1069     - *
    1070     - * The caller must hold rx_reorder_tbl_lock spinlock.
    1071     */
    1072     struct mwifiex_rx_reorder_tbl *
    1073     mwifiex_11n_get_rx_reorder_tbl(struct mwifiex_private *priv, int tid, u8 *ta)
    1074     {
    1075     struct mwifiex_rx_reorder_tbl *tbl;
    1076     + unsigned long flags;
    1077    
    1078     - list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list)
    1079     - if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid)
    1080     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1081     + list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list) {
    1082     + if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid) {
    1083     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1084     + flags);
    1085     return tbl;
    1086     + }
    1087     + }
    1088     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1089    
    1090     return NULL;
    1091     }
    1092     @@ -251,9 +267,14 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta)
    1093     return;
    1094    
    1095     spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1096     - list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list)
    1097     - if (!memcmp(tbl->ta, ta, ETH_ALEN))
    1098     + list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list) {
    1099     + if (!memcmp(tbl->ta, ta, ETH_ALEN)) {
    1100     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1101     + flags);
    1102     mwifiex_del_rx_reorder_entry(priv, tbl);
    1103     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1104     + }
    1105     + }
    1106     spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1107    
    1108     return;
    1109     @@ -262,18 +283,24 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta)
    1110     /*
    1111     * This function finds the last sequence number used in the packets
    1112     * buffered in Rx reordering table.
    1113     - *
    1114     - * The caller must hold rx_reorder_tbl_lock spinlock.
    1115     */
    1116     static int
    1117     mwifiex_11n_find_last_seq_num(struct reorder_tmr_cnxt *ctx)
    1118     {
    1119     struct mwifiex_rx_reorder_tbl *rx_reorder_tbl_ptr = ctx->ptr;
    1120     + struct mwifiex_private *priv = ctx->priv;
    1121     + unsigned long flags;
    1122     int i;
    1123    
    1124     - for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i)
    1125     - if (rx_reorder_tbl_ptr->rx_reorder_ptr[i])
    1126     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1127     + for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i) {
    1128     + if (rx_reorder_tbl_ptr->rx_reorder_ptr[i]) {
    1129     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1130     + flags);
    1131     return i;
    1132     + }
    1133     + }
    1134     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1135    
    1136     return -1;
    1137     }
    1138     @@ -291,22 +318,17 @@ mwifiex_flush_data(struct timer_list *t)
    1139     struct reorder_tmr_cnxt *ctx =
    1140     from_timer(ctx, t, timer);
    1141     int start_win, seq_num;
    1142     - unsigned long flags;
    1143    
    1144     ctx->timer_is_set = false;
    1145     - spin_lock_irqsave(&ctx->priv->rx_reorder_tbl_lock, flags);
    1146     seq_num = mwifiex_11n_find_last_seq_num(ctx);
    1147    
    1148     - if (seq_num < 0) {
    1149     - spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags);
    1150     + if (seq_num < 0)
    1151     return;
    1152     - }
    1153    
    1154     mwifiex_dbg(ctx->priv->adapter, INFO, "info: flush data %d\n", seq_num);
    1155     start_win = (ctx->ptr->start_win + seq_num + 1) & (MAX_TID_VALUE - 1);
    1156     mwifiex_11n_dispatch_pkt_until_start_win(ctx->priv, ctx->ptr,
    1157     start_win);
    1158     - spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags);
    1159     }
    1160    
    1161     /*
    1162     @@ -333,14 +355,11 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
    1163     * If we get a TID, ta pair which is already present dispatch all the
    1164     * the packets and move the window size until the ssn
    1165     */
    1166     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1167     tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
    1168     if (tbl) {
    1169     mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, seq_num);
    1170     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1171     return;
    1172     }
    1173     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1174     /* if !tbl then create one */
    1175     new_node = kzalloc(sizeof(struct mwifiex_rx_reorder_tbl), GFP_KERNEL);
    1176     if (!new_node)
    1177     @@ -551,20 +570,16 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
    1178     int prev_start_win, start_win, end_win, win_size;
    1179     u16 pkt_index;
    1180     bool init_window_shift = false;
    1181     - unsigned long flags;
    1182     int ret = 0;
    1183    
    1184     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1185     tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
    1186     if (!tbl) {
    1187     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1188     if (pkt_type != PKT_TYPE_BAR)
    1189     mwifiex_11n_dispatch_pkt(priv, payload);
    1190     return ret;
    1191     }
    1192    
    1193     if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
    1194     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1195     mwifiex_11n_dispatch_pkt(priv, payload);
    1196     return ret;
    1197     }
    1198     @@ -651,8 +666,6 @@ done:
    1199     if (!tbl->timer_context.timer_is_set ||
    1200     prev_start_win != tbl->start_win)
    1201     mwifiex_11n_rxreorder_timer_restart(tbl);
    1202     -
    1203     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1204     return ret;
    1205     }
    1206    
    1207     @@ -681,18 +694,14 @@ mwifiex_del_ba_tbl(struct mwifiex_private *priv, int tid, u8 *peer_mac,
    1208     peer_mac, tid, initiator);
    1209    
    1210     if (cleanup_rx_reorder_tbl) {
    1211     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1212     tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
    1213     peer_mac);
    1214     if (!tbl) {
    1215     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1216     - flags);
    1217     mwifiex_dbg(priv->adapter, EVENT,
    1218     "event: TID, TA not found in table\n");
    1219     return;
    1220     }
    1221     mwifiex_del_rx_reorder_entry(priv, tbl);
    1222     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1223     } else {
    1224     ptx_tbl = mwifiex_get_ba_tbl(priv, tid, peer_mac);
    1225     if (!ptx_tbl) {
    1226     @@ -726,7 +735,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
    1227     int tid, win_size;
    1228     struct mwifiex_rx_reorder_tbl *tbl;
    1229     uint16_t block_ack_param_set;
    1230     - unsigned long flags;
    1231    
    1232     block_ack_param_set = le16_to_cpu(add_ba_rsp->block_ack_param_set);
    1233    
    1234     @@ -740,20 +748,17 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
    1235     mwifiex_dbg(priv->adapter, ERROR, "ADDBA RSP: failed %pM tid=%d)\n",
    1236     add_ba_rsp->peer_mac_addr, tid);
    1237    
    1238     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1239     tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
    1240     add_ba_rsp->peer_mac_addr);
    1241     if (tbl)
    1242     mwifiex_del_rx_reorder_entry(priv, tbl);
    1243    
    1244     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1245     return 0;
    1246     }
    1247    
    1248     win_size = (block_ack_param_set & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK)
    1249     >> BLOCKACKPARAM_WINSIZE_POS;
    1250    
    1251     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1252     tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
    1253     add_ba_rsp->peer_mac_addr);
    1254     if (tbl) {
    1255     @@ -764,7 +769,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
    1256     else
    1257     tbl->amsdu = false;
    1258     }
    1259     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1260    
    1261     mwifiex_dbg(priv->adapter, CMD,
    1262     "cmd: ADDBA RSP: %pM tid=%d ssn=%d win_size=%d\n",
    1263     @@ -804,8 +808,11 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
    1264    
    1265     spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1266     list_for_each_entry_safe(del_tbl_ptr, tmp_node,
    1267     - &priv->rx_reorder_tbl_ptr, list)
    1268     + &priv->rx_reorder_tbl_ptr, list) {
    1269     + spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1270     mwifiex_del_rx_reorder_entry(priv, del_tbl_ptr);
    1271     + spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1272     + }
    1273     INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
    1274     spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1275    
    1276     @@ -929,7 +936,6 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
    1277     int tlv_buf_left = len;
    1278     int ret;
    1279     u8 *tmp;
    1280     - unsigned long flags;
    1281    
    1282     mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
    1283     event_buf, len);
    1284     @@ -949,18 +955,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
    1285     tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
    1286     tlv_bitmap_len);
    1287    
    1288     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1289     rx_reor_tbl_ptr =
    1290     mwifiex_11n_get_rx_reorder_tbl(priv, tlv_rxba->tid,
    1291     tlv_rxba->mac);
    1292     if (!rx_reor_tbl_ptr) {
    1293     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
    1294     - flags);
    1295     mwifiex_dbg(priv->adapter, ERROR,
    1296     "Can not find rx_reorder_tbl!");
    1297     return;
    1298     }
    1299     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1300    
    1301     for (i = 0; i < tlv_bitmap_len; i++) {
    1302     for (j = 0 ; j < 8; j++) {
    1303     diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
    1304     index a83c5afc256a..5ce85d5727e4 100644
    1305     --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
    1306     +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
    1307     @@ -421,15 +421,12 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
    1308     spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
    1309     }
    1310    
    1311     - spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
    1312     if (!priv->ap_11n_enabled ||
    1313     (!mwifiex_11n_get_rx_reorder_tbl(priv, uap_rx_pd->priority, ta) &&
    1314     (le16_to_cpu(uap_rx_pd->rx_pkt_type) != PKT_TYPE_AMSDU))) {
    1315     ret = mwifiex_handle_uap_rx_forward(priv, skb);
    1316     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1317     return ret;
    1318     }
    1319     - spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
    1320    
    1321     /* Reorder and send to kernel */
    1322     pkt_type = (u8)le16_to_cpu(uap_rx_pd->rx_pkt_type);
    1323     diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
    1324     index f4122c8fdd97..ef9b502ce576 100644
    1325     --- a/drivers/net/wireless/realtek/rtlwifi/base.c
    1326     +++ b/drivers/net/wireless/realtek/rtlwifi/base.c
    1327     @@ -2289,6 +2289,7 @@ void rtl_c2hcmd_enqueue(struct ieee80211_hw *hw, struct sk_buff *skb)
    1328    
    1329     if (rtl_c2h_fast_cmd(hw, skb)) {
    1330     rtl_c2h_content_parsing(hw, skb);
    1331     + kfree_skb(skb);
    1332     return;
    1333     }
    1334    
    1335     diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1336     index 4a57ffecc7e6..5c9acb634ff7 100644
    1337     --- a/drivers/scsi/sd.c
    1338     +++ b/drivers/scsi/sd.c
    1339     @@ -132,6 +132,7 @@ static DEFINE_MUTEX(sd_ref_mutex);
    1340    
    1341     static struct kmem_cache *sd_cdb_cache;
    1342     static mempool_t *sd_cdb_pool;
    1343     +static mempool_t *sd_page_pool;
    1344    
    1345     static const char *sd_cache_types[] = {
    1346     "write through", "none", "write back",
    1347     @@ -758,9 +759,10 @@ static int sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
    1348     unsigned int data_len = 24;
    1349     char *buf;
    1350    
    1351     - rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
    1352     + rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
    1353     if (!rq->special_vec.bv_page)
    1354     return BLKPREP_DEFER;
    1355     + clear_highpage(rq->special_vec.bv_page);
    1356     rq->special_vec.bv_offset = 0;
    1357     rq->special_vec.bv_len = data_len;
    1358     rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
    1359     @@ -791,9 +793,10 @@ static int sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd, bool unmap)
    1360     u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
    1361     u32 data_len = sdp->sector_size;
    1362    
    1363     - rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
    1364     + rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
    1365     if (!rq->special_vec.bv_page)
    1366     return BLKPREP_DEFER;
    1367     + clear_highpage(rq->special_vec.bv_page);
    1368     rq->special_vec.bv_offset = 0;
    1369     rq->special_vec.bv_len = data_len;
    1370     rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
    1371     @@ -821,9 +824,10 @@ static int sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd, bool unmap)
    1372     u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
    1373     u32 data_len = sdp->sector_size;
    1374    
    1375     - rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
    1376     + rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
    1377     if (!rq->special_vec.bv_page)
    1378     return BLKPREP_DEFER;
    1379     + clear_highpage(rq->special_vec.bv_page);
    1380     rq->special_vec.bv_offset = 0;
    1381     rq->special_vec.bv_len = data_len;
    1382     rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
    1383     @@ -1287,7 +1291,7 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
    1384     u8 *cmnd;
    1385    
    1386     if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
    1387     - __free_page(rq->special_vec.bv_page);
    1388     + mempool_free(rq->special_vec.bv_page, sd_page_pool);
    1389    
    1390     if (SCpnt->cmnd != scsi_req(rq)->cmd) {
    1391     cmnd = SCpnt->cmnd;
    1392     @@ -3635,6 +3639,13 @@ static int __init init_sd(void)
    1393     goto err_out_cache;
    1394     }
    1395    
    1396     + sd_page_pool = mempool_create_page_pool(SD_MEMPOOL_SIZE, 0);
    1397     + if (!sd_page_pool) {
    1398     + printk(KERN_ERR "sd: can't init discard page pool\n");
    1399     + err = -ENOMEM;
    1400     + goto err_out_ppool;
    1401     + }
    1402     +
    1403     err = scsi_register_driver(&sd_template.gendrv);
    1404     if (err)
    1405     goto err_out_driver;
    1406     @@ -3642,6 +3653,9 @@ static int __init init_sd(void)
    1407     return 0;
    1408    
    1409     err_out_driver:
    1410     + mempool_destroy(sd_page_pool);
    1411     +
    1412     +err_out_ppool:
    1413     mempool_destroy(sd_cdb_pool);
    1414    
    1415     err_out_cache:
    1416     @@ -3668,6 +3682,7 @@ static void __exit exit_sd(void)
    1417    
    1418     scsi_unregister_driver(&sd_template.gendrv);
    1419     mempool_destroy(sd_cdb_pool);
    1420     + mempool_destroy(sd_page_pool);
    1421     kmem_cache_destroy(sd_cdb_cache);
    1422    
    1423     class_unregister(&sd_disk_class);
    1424     diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    1425     index 94aca1b5ac8a..01b5818a4be5 100644
    1426     --- a/drivers/usb/host/xhci-hub.c
    1427     +++ b/drivers/usb/host/xhci-hub.c
    1428     @@ -1507,7 +1507,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
    1429     portsc_buf[port_index] = 0;
    1430    
    1431     /* Bail out if a USB3 port has a new device in link training */
    1432     - if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
    1433     + if ((hcd->speed >= HCD_USB3) &&
    1434     + (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
    1435     bus_state->bus_suspended = 0;
    1436     spin_unlock_irqrestore(&xhci->lock, flags);
    1437     xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
    1438     diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    1439     index c3ed7d1c9f65..e88060ea1e33 100644
    1440     --- a/drivers/usb/host/xhci.h
    1441     +++ b/drivers/usb/host/xhci.h
    1442     @@ -1860,6 +1860,8 @@ struct xhci_hcd {
    1443     unsigned sw_lpm_support:1;
    1444     /* support xHCI 1.0 spec USB2 hardware LPM */
    1445     unsigned hw_lpm_support:1;
    1446     + /* Broken Suspend flag for SNPS Suspend resume issue */
    1447     + unsigned broken_suspend:1;
    1448     /* cached usb2 extened protocol capabilites */
    1449     u32 *ext_caps;
    1450     unsigned int num_ext_caps;
    1451     @@ -1877,8 +1879,6 @@ struct xhci_hcd {
    1452     void *dbc;
    1453     /* platform-specific data -- must come last */
    1454     unsigned long priv[0] __aligned(sizeof(s64));
    1455     - /* Broken Suspend flag for SNPS Suspend resume issue */
    1456     - u8 broken_suspend;
    1457     };
    1458    
    1459     /* Platform specific overrides to generic XHCI hc_driver ops */
    1460     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1461     index e72ad9f81c73..17787dc349f8 100644
    1462     --- a/drivers/usb/serial/option.c
    1463     +++ b/drivers/usb/serial/option.c
    1464     @@ -1164,6 +1164,10 @@ static const struct usb_device_id option_ids[] = {
    1465     { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
    1466     { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
    1467     .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
    1468     + { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
    1469     + .driver_info = NCTRL(0) | RSVD(1) },
    1470     + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
    1471     + .driver_info = NCTRL(0) },
    1472     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
    1473     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
    1474     .driver_info = RSVD(1) },
    1475     @@ -1328,6 +1332,7 @@ static const struct usb_device_id option_ids[] = {
    1476     .driver_info = RSVD(4) },
    1477     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
    1478     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
    1479     + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
    1480     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
    1481     .driver_info = RSVD(4) },
    1482     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
    1483     @@ -1531,6 +1536,7 @@ static const struct usb_device_id option_ids[] = {
    1484     .driver_info = RSVD(2) },
    1485     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
    1486     .driver_info = RSVD(2) },
    1487     + { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
    1488     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
    1489     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
    1490     { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
    1491     @@ -1758,6 +1764,7 @@ static const struct usb_device_id option_ids[] = {
    1492     { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
    1493     { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
    1494     .driver_info = RSVD(5) | RSVD(6) },
    1495     + { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
    1496     { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
    1497     .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
    1498     { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
    1499     @@ -1940,7 +1947,14 @@ static const struct usb_device_id option_ids[] = {
    1500     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
    1501     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
    1502     { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
    1503     - { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
    1504     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
    1505     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */
    1506     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
    1507     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
    1508     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
    1509     + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
    1510     + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
    1511     + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
    1512     { } /* Terminating entry */
    1513     };
    1514     MODULE_DEVICE_TABLE(usb, option_ids);
    1515     diff --git a/fs/iomap.c b/fs/iomap.c
    1516     index 37da7a61a6c5..ec15cf2ec696 100644
    1517     --- a/fs/iomap.c
    1518     +++ b/fs/iomap.c
    1519     @@ -117,12 +117,6 @@ iomap_page_create(struct inode *inode, struct page *page)
    1520     atomic_set(&iop->read_count, 0);
    1521     atomic_set(&iop->write_count, 0);
    1522     bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
    1523     -
    1524     - /*
    1525     - * migrate_page_move_mapping() assumes that pages with private data have
    1526     - * their count elevated by 1.
    1527     - */
    1528     - get_page(page);
    1529     set_page_private(page, (unsigned long)iop);
    1530     SetPagePrivate(page);
    1531     return iop;
    1532     @@ -139,7 +133,6 @@ iomap_page_release(struct page *page)
    1533     WARN_ON_ONCE(atomic_read(&iop->write_count));
    1534     ClearPagePrivate(page);
    1535     set_page_private(page, 0);
    1536     - put_page(page);
    1537     kfree(iop);
    1538     }
    1539    
    1540     diff --git a/fs/namei.c b/fs/namei.c
    1541     index 0cab6494978c..914178cdbe94 100644
    1542     --- a/fs/namei.c
    1543     +++ b/fs/namei.c
    1544     @@ -3701,8 +3701,7 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
    1545     if (error)
    1546     return error;
    1547    
    1548     - if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
    1549     - !ns_capable(dentry->d_sb->s_user_ns, CAP_MKNOD))
    1550     + if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
    1551     return -EPERM;
    1552    
    1553     if (!dir->i_op->mknod)
    1554     diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
    1555     index 89921a0d2ebb..4d598a399bbf 100644
    1556     --- a/fs/proc/proc_sysctl.c
    1557     +++ b/fs/proc/proc_sysctl.c
    1558     @@ -464,7 +464,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    1559    
    1560     inode = new_inode(sb);
    1561     if (!inode)
    1562     - goto out;
    1563     + return ERR_PTR(-ENOMEM);
    1564    
    1565     inode->i_ino = get_next_ino();
    1566    
    1567     @@ -474,8 +474,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    1568     if (unlikely(head->unregistering)) {
    1569     spin_unlock(&sysctl_lock);
    1570     iput(inode);
    1571     - inode = NULL;
    1572     - goto out;
    1573     + return ERR_PTR(-ENOENT);
    1574     }
    1575     ei->sysctl = head;
    1576     ei->sysctl_entry = table;
    1577     @@ -500,7 +499,6 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
    1578     if (root->set_ownership)
    1579     root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
    1580    
    1581     -out:
    1582     return inode;
    1583     }
    1584    
    1585     @@ -549,10 +547,11 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
    1586     goto out;
    1587     }
    1588    
    1589     - err = ERR_PTR(-ENOMEM);
    1590     inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
    1591     - if (!inode)
    1592     + if (IS_ERR(inode)) {
    1593     + err = ERR_CAST(inode);
    1594     goto out;
    1595     + }
    1596    
    1597     d_set_d_op(dentry, &proc_sys_dentry_operations);
    1598     err = d_splice_alias(inode, dentry);
    1599     @@ -685,7 +684,7 @@ static bool proc_sys_fill_cache(struct file *file,
    1600     if (d_in_lookup(child)) {
    1601     struct dentry *res;
    1602     inode = proc_sys_make_inode(dir->d_sb, head, table);
    1603     - if (!inode) {
    1604     + if (IS_ERR(inode)) {
    1605     d_lookup_done(child);
    1606     dput(child);
    1607     return false;
    1608     diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
    1609     index 4844538eb926..c6f9b2225387 100644
    1610     --- a/fs/ubifs/replay.c
    1611     +++ b/fs/ubifs/replay.c
    1612     @@ -209,6 +209,38 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
    1613     return ubifs_tnc_remove_range(c, &min_key, &max_key);
    1614     }
    1615    
    1616     +/**
    1617     + * inode_still_linked - check whether inode in question will be re-linked.
    1618     + * @c: UBIFS file-system description object
    1619     + * @rino: replay entry to test
    1620     + *
    1621     + * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1.
    1622     + * This case needs special care, otherwise all references to the inode will
    1623     + * be removed upon the first replay entry of an inode with link count 0
    1624     + * is found.
    1625     + */
    1626     +static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino)
    1627     +{
    1628     + struct replay_entry *r;
    1629     +
    1630     + ubifs_assert(c, rino->deletion);
    1631     + ubifs_assert(c, key_type(c, &rino->key) == UBIFS_INO_KEY);
    1632     +
    1633     + /*
    1634     + * Find the most recent entry for the inode behind @rino and check
    1635     + * whether it is a deletion.
    1636     + */
    1637     + list_for_each_entry_reverse(r, &c->replay_list, list) {
    1638     + ubifs_assert(c, r->sqnum >= rino->sqnum);
    1639     + if (key_inum(c, &r->key) == key_inum(c, &rino->key))
    1640     + return r->deletion == 0;
    1641     +
    1642     + }
    1643     +
    1644     + ubifs_assert(c, 0);
    1645     + return false;
    1646     +}
    1647     +
    1648     /**
    1649     * apply_replay_entry - apply a replay entry to the TNC.
    1650     * @c: UBIFS file-system description object
    1651     @@ -236,6 +268,11 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
    1652     {
    1653     ino_t inum = key_inum(c, &r->key);
    1654    
    1655     + if (inode_still_linked(c, r)) {
    1656     + err = 0;
    1657     + break;
    1658     + }
    1659     +
    1660     err = ubifs_tnc_remove_ino(c, inum);
    1661     break;
    1662     }
    1663     diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
    1664     index 89f3b03b1445..e3667c9a33a5 100644
    1665     --- a/include/asm-generic/4level-fixup.h
    1666     +++ b/include/asm-generic/4level-fixup.h
    1667     @@ -3,7 +3,7 @@
    1668     #define _4LEVEL_FIXUP_H
    1669    
    1670     #define __ARCH_HAS_4LEVEL_HACK
    1671     -#define __PAGETABLE_PUD_FOLDED
    1672     +#define __PAGETABLE_PUD_FOLDED 1
    1673    
    1674     #define PUD_SHIFT PGDIR_SHIFT
    1675     #define PUD_SIZE PGDIR_SIZE
    1676     diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
    1677     index 9c2e0708eb82..73474bb52344 100644
    1678     --- a/include/asm-generic/5level-fixup.h
    1679     +++ b/include/asm-generic/5level-fixup.h
    1680     @@ -3,7 +3,7 @@
    1681     #define _5LEVEL_FIXUP_H
    1682    
    1683     #define __ARCH_HAS_5LEVEL_HACK
    1684     -#define __PAGETABLE_P4D_FOLDED
    1685     +#define __PAGETABLE_P4D_FOLDED 1
    1686    
    1687     #define P4D_SHIFT PGDIR_SHIFT
    1688     #define P4D_SIZE PGDIR_SIZE
    1689     diff --git a/include/asm-generic/pgtable-nop4d-hack.h b/include/asm-generic/pgtable-nop4d-hack.h
    1690     index 0c34215263b8..1d6dd38c0e5e 100644
    1691     --- a/include/asm-generic/pgtable-nop4d-hack.h
    1692     +++ b/include/asm-generic/pgtable-nop4d-hack.h
    1693     @@ -5,7 +5,7 @@
    1694     #ifndef __ASSEMBLY__
    1695     #include <asm-generic/5level-fixup.h>
    1696    
    1697     -#define __PAGETABLE_PUD_FOLDED
    1698     +#define __PAGETABLE_PUD_FOLDED 1
    1699    
    1700     /*
    1701     * Having the pud type consist of a pgd gets the size right, and allows
    1702     diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h
    1703     index 1a29b2a0282b..04cb913797bc 100644
    1704     --- a/include/asm-generic/pgtable-nop4d.h
    1705     +++ b/include/asm-generic/pgtable-nop4d.h
    1706     @@ -4,7 +4,7 @@
    1707    
    1708     #ifndef __ASSEMBLY__
    1709    
    1710     -#define __PAGETABLE_P4D_FOLDED
    1711     +#define __PAGETABLE_P4D_FOLDED 1
    1712    
    1713     typedef struct { pgd_t pgd; } p4d_t;
    1714    
    1715     diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
    1716     index f35f6e8149e4..b85b8271a73d 100644
    1717     --- a/include/asm-generic/pgtable-nopmd.h
    1718     +++ b/include/asm-generic/pgtable-nopmd.h
    1719     @@ -8,7 +8,7 @@
    1720    
    1721     struct mm_struct;
    1722    
    1723     -#define __PAGETABLE_PMD_FOLDED
    1724     +#define __PAGETABLE_PMD_FOLDED 1
    1725    
    1726     /*
    1727     * Having the pmd type consist of a pud gets the size right, and allows
    1728     diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
    1729     index e950b9c50f34..9bef475db6fe 100644
    1730     --- a/include/asm-generic/pgtable-nopud.h
    1731     +++ b/include/asm-generic/pgtable-nopud.h
    1732     @@ -9,7 +9,7 @@
    1733     #else
    1734     #include <asm-generic/pgtable-nop4d.h>
    1735    
    1736     -#define __PAGETABLE_PUD_FOLDED
    1737     +#define __PAGETABLE_PUD_FOLDED 1
    1738    
    1739     /*
    1740     * Having the pud type consist of a p4d gets the size right, and allows
    1741     diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
    1742     index 88ebc6102c7c..15fd0277ffa6 100644
    1743     --- a/include/asm-generic/pgtable.h
    1744     +++ b/include/asm-generic/pgtable.h
    1745     @@ -1127,4 +1127,20 @@ static inline bool arch_has_pfn_modify_check(void)
    1746     #endif
    1747     #endif
    1748    
    1749     +/*
    1750     + * On some architectures it depends on the mm if the p4d/pud or pmd
    1751     + * layer of the page table hierarchy is folded or not.
    1752     + */
    1753     +#ifndef mm_p4d_folded
    1754     +#define mm_p4d_folded(mm) __is_defined(__PAGETABLE_P4D_FOLDED)
    1755     +#endif
    1756     +
    1757     +#ifndef mm_pud_folded
    1758     +#define mm_pud_folded(mm) __is_defined(__PAGETABLE_PUD_FOLDED)
    1759     +#endif
    1760     +
    1761     +#ifndef mm_pmd_folded
    1762     +#define mm_pmd_folded(mm) __is_defined(__PAGETABLE_PMD_FOLDED)
    1763     +#endif
    1764     +
    1765     #endif /* _ASM_GENERIC_PGTABLE_H */
    1766     diff --git a/include/linux/math64.h b/include/linux/math64.h
    1767     index 837f2f2d1d34..bb2c84afb80c 100644
    1768     --- a/include/linux/math64.h
    1769     +++ b/include/linux/math64.h
    1770     @@ -281,4 +281,7 @@ static inline u64 mul_u64_u32_div(u64 a, u32 mul, u32 divisor)
    1771     }
    1772     #endif /* mul_u64_u32_div */
    1773    
    1774     +#define DIV64_U64_ROUND_UP(ll, d) \
    1775     + ({ u64 _tmp = (d); div64_u64((ll) + _tmp - 1, _tmp); })
    1776     +
    1777     #endif /* _LINUX_MATH64_H */
    1778     diff --git a/include/linux/mm.h b/include/linux/mm.h
    1779     index 0416a7204be3..e899460f1bc5 100644
    1780     --- a/include/linux/mm.h
    1781     +++ b/include/linux/mm.h
    1782     @@ -1724,11 +1724,15 @@ int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address);
    1783    
    1784     static inline void mm_inc_nr_puds(struct mm_struct *mm)
    1785     {
    1786     + if (mm_pud_folded(mm))
    1787     + return;
    1788     atomic_long_add(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
    1789     }
    1790    
    1791     static inline void mm_dec_nr_puds(struct mm_struct *mm)
    1792     {
    1793     + if (mm_pud_folded(mm))
    1794     + return;
    1795     atomic_long_sub(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
    1796     }
    1797     #endif
    1798     @@ -1748,11 +1752,15 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
    1799    
    1800     static inline void mm_inc_nr_pmds(struct mm_struct *mm)
    1801     {
    1802     + if (mm_pmd_folded(mm))
    1803     + return;
    1804     atomic_long_add(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
    1805     }
    1806    
    1807     static inline void mm_dec_nr_pmds(struct mm_struct *mm)
    1808     {
    1809     + if (mm_pmd_folded(mm))
    1810     + return;
    1811     atomic_long_sub(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
    1812     }
    1813     #endif
    1814     diff --git a/include/linux/t10-pi.h b/include/linux/t10-pi.h
    1815     index b9626aa7e90c..3e2a80cc7b56 100644
    1816     --- a/include/linux/t10-pi.h
    1817     +++ b/include/linux/t10-pi.h
    1818     @@ -39,12 +39,13 @@ struct t10_pi_tuple {
    1819    
    1820     static inline u32 t10_pi_ref_tag(struct request *rq)
    1821     {
    1822     + unsigned int shift = ilog2(queue_logical_block_size(rq->q));
    1823     +
    1824     #ifdef CONFIG_BLK_DEV_INTEGRITY
    1825     - return blk_rq_pos(rq) >>
    1826     - (rq->q->integrity.interval_exp - 9) & 0xffffffff;
    1827     -#else
    1828     - return -1U;
    1829     + if (rq->q->integrity.interval_exp)
    1830     + shift = rq->q->integrity.interval_exp;
    1831     #endif
    1832     + return blk_rq_pos(rq) >> (shift - SECTOR_SHIFT) & 0xffffffff;
    1833     }
    1834    
    1835     extern const struct blk_integrity_profile t10_pi_type1_crc;
    1836     diff --git a/include/net/xfrm.h b/include/net/xfrm.h
    1837     index 0eb390c205af..da588def3c61 100644
    1838     --- a/include/net/xfrm.h
    1839     +++ b/include/net/xfrm.h
    1840     @@ -1552,6 +1552,7 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
    1841     int (*func)(struct xfrm_state *, int, void*), void *);
    1842     void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
    1843     struct xfrm_state *xfrm_state_alloc(struct net *net);
    1844     +void xfrm_state_free(struct xfrm_state *x);
    1845     struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
    1846     const xfrm_address_t *saddr,
    1847     const struct flowi *fl,
    1848     diff --git a/kernel/futex.c b/kernel/futex.c
    1849     index 11fc3bb456d6..f89abca89513 100644
    1850     --- a/kernel/futex.c
    1851     +++ b/kernel/futex.c
    1852     @@ -1148,11 +1148,65 @@ out_error:
    1853     return ret;
    1854     }
    1855    
    1856     +static int handle_exit_race(u32 __user *uaddr, u32 uval,
    1857     + struct task_struct *tsk)
    1858     +{
    1859     + u32 uval2;
    1860     +
    1861     + /*
    1862     + * If PF_EXITPIDONE is not yet set, then try again.
    1863     + */
    1864     + if (tsk && !(tsk->flags & PF_EXITPIDONE))
    1865     + return -EAGAIN;
    1866     +
    1867     + /*
    1868     + * Reread the user space value to handle the following situation:
    1869     + *
    1870     + * CPU0 CPU1
    1871     + *
    1872     + * sys_exit() sys_futex()
    1873     + * do_exit() futex_lock_pi()
    1874     + * futex_lock_pi_atomic()
    1875     + * exit_signals(tsk) No waiters:
    1876     + * tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
    1877     + * mm_release(tsk) Set waiter bit
    1878     + * exit_robust_list(tsk) { *uaddr = 0x80000PID;
    1879     + * Set owner died attach_to_pi_owner() {
    1880     + * *uaddr = 0xC0000000; tsk = get_task(PID);
    1881     + * } if (!tsk->flags & PF_EXITING) {
    1882     + * ... attach();
    1883     + * tsk->flags |= PF_EXITPIDONE; } else {
    1884     + * if (!(tsk->flags & PF_EXITPIDONE))
    1885     + * return -EAGAIN;
    1886     + * return -ESRCH; <--- FAIL
    1887     + * }
    1888     + *
    1889     + * Returning ESRCH unconditionally is wrong here because the
    1890     + * user space value has been changed by the exiting task.
    1891     + *
    1892     + * The same logic applies to the case where the exiting task is
    1893     + * already gone.
    1894     + */
    1895     + if (get_futex_value_locked(&uval2, uaddr))
    1896     + return -EFAULT;
    1897     +
    1898     + /* If the user space value has changed, try again. */
    1899     + if (uval2 != uval)
    1900     + return -EAGAIN;
    1901     +
    1902     + /*
    1903     + * The exiting task did not have a robust list, the robust list was
    1904     + * corrupted or the user space value in *uaddr is simply bogus.
    1905     + * Give up and tell user space.
    1906     + */
    1907     + return -ESRCH;
    1908     +}
    1909     +
    1910     /*
    1911     * Lookup the task for the TID provided from user space and attach to
    1912     * it after doing proper sanity checks.
    1913     */
    1914     -static int attach_to_pi_owner(u32 uval, union futex_key *key,
    1915     +static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
    1916     struct futex_pi_state **ps)
    1917     {
    1918     pid_t pid = uval & FUTEX_TID_MASK;
    1919     @@ -1162,12 +1216,15 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
    1920     /*
    1921     * We are the first waiter - try to look up the real owner and attach
    1922     * the new pi_state to it, but bail out when TID = 0 [1]
    1923     + *
    1924     + * The !pid check is paranoid. None of the call sites should end up
    1925     + * with pid == 0, but better safe than sorry. Let the caller retry
    1926     */
    1927     if (!pid)
    1928     - return -ESRCH;
    1929     + return -EAGAIN;
    1930     p = find_get_task_by_vpid(pid);
    1931     if (!p)
    1932     - return -ESRCH;
    1933     + return handle_exit_race(uaddr, uval, NULL);
    1934    
    1935     if (unlikely(p->flags & PF_KTHREAD)) {
    1936     put_task_struct(p);
    1937     @@ -1187,7 +1244,7 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
    1938     * set, we know that the task has finished the
    1939     * cleanup:
    1940     */
    1941     - int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN;
    1942     + int ret = handle_exit_race(uaddr, uval, p);
    1943    
    1944     raw_spin_unlock_irq(&p->pi_lock);
    1945     put_task_struct(p);
    1946     @@ -1244,7 +1301,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
    1947     * We are the first waiter - try to look up the owner based on
    1948     * @uval and attach to it.
    1949     */
    1950     - return attach_to_pi_owner(uval, key, ps);
    1951     + return attach_to_pi_owner(uaddr, uval, key, ps);
    1952     }
    1953    
    1954     static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
    1955     @@ -1352,7 +1409,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
    1956     * attach to the owner. If that fails, no harm done, we only
    1957     * set the FUTEX_WAITERS bit in the user space variable.
    1958     */
    1959     - return attach_to_pi_owner(uval, key, ps);
    1960     + return attach_to_pi_owner(uaddr, newval, key, ps);
    1961     }
    1962    
    1963     /**
    1964     diff --git a/kernel/panic.c b/kernel/panic.c
    1965     index 8b2e002d52eb..6a6df23acd1a 100644
    1966     --- a/kernel/panic.c
    1967     +++ b/kernel/panic.c
    1968     @@ -14,6 +14,7 @@
    1969     #include <linux/kmsg_dump.h>
    1970     #include <linux/kallsyms.h>
    1971     #include <linux/notifier.h>
    1972     +#include <linux/vt_kern.h>
    1973     #include <linux/module.h>
    1974     #include <linux/random.h>
    1975     #include <linux/ftrace.h>
    1976     @@ -233,7 +234,10 @@ void panic(const char *fmt, ...)
    1977     if (_crash_kexec_post_notifiers)
    1978     __crash_kexec(NULL);
    1979    
    1980     - bust_spinlocks(0);
    1981     +#ifdef CONFIG_VT
    1982     + unblank_screen();
    1983     +#endif
    1984     + console_unblank();
    1985    
    1986     /*
    1987     * We may have ended up stopping the CPU holding the lock (in
    1988     diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
    1989     index 4b9127e95430..5a01c4fdbfef 100644
    1990     --- a/kernel/time/posix-timers.c
    1991     +++ b/kernel/time/posix-timers.c
    1992     @@ -289,9 +289,6 @@ static void common_hrtimer_rearm(struct k_itimer *timr)
    1993     {
    1994     struct hrtimer *timer = &timr->it.real.timer;
    1995    
    1996     - if (!timr->it_interval)
    1997     - return;
    1998     -
    1999     timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
    2000     timr->it_interval);
    2001     hrtimer_restart(timer);
    2002     @@ -317,7 +314,7 @@ void posixtimer_rearm(struct siginfo *info)
    2003     if (!timr)
    2004     return;
    2005    
    2006     - if (timr->it_requeue_pending == info->si_sys_private) {
    2007     + if (timr->it_interval && timr->it_requeue_pending == info->si_sys_private) {
    2008     timr->kclock->timer_rearm(timr);
    2009    
    2010     timr->it_active = 1;
    2011     diff --git a/mm/huge_memory.c b/mm/huge_memory.c
    2012     index 15310f14c25e..d2cd70cfaa90 100644
    2013     --- a/mm/huge_memory.c
    2014     +++ b/mm/huge_memory.c
    2015     @@ -2127,23 +2127,25 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
    2016     */
    2017     old_pmd = pmdp_invalidate(vma, haddr, pmd);
    2018    
    2019     -#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
    2020     pmd_migration = is_pmd_migration_entry(old_pmd);
    2021     - if (pmd_migration) {
    2022     + if (unlikely(pmd_migration)) {
    2023     swp_entry_t entry;
    2024    
    2025     entry = pmd_to_swp_entry(old_pmd);
    2026     page = pfn_to_page(swp_offset(entry));
    2027     - } else
    2028     -#endif
    2029     + write = is_write_migration_entry(entry);
    2030     + young = false;
    2031     + soft_dirty = pmd_swp_soft_dirty(old_pmd);
    2032     + } else {
    2033     page = pmd_page(old_pmd);
    2034     + if (pmd_dirty(old_pmd))
    2035     + SetPageDirty(page);
    2036     + write = pmd_write(old_pmd);
    2037     + young = pmd_young(old_pmd);
    2038     + soft_dirty = pmd_soft_dirty(old_pmd);
    2039     + }
    2040     VM_BUG_ON_PAGE(!page_count(page), page);
    2041     page_ref_add(page, HPAGE_PMD_NR - 1);
    2042     - if (pmd_dirty(old_pmd))
    2043     - SetPageDirty(page);
    2044     - write = pmd_write(old_pmd);
    2045     - young = pmd_young(old_pmd);
    2046     - soft_dirty = pmd_soft_dirty(old_pmd);
    2047    
    2048     /*
    2049     * Withdraw the table only after we mark the pmd entry invalid.
    2050     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    2051     index 6a62b2421cdf..93e73ccb4dec 100644
    2052     --- a/mm/page_alloc.c
    2053     +++ b/mm/page_alloc.c
    2054     @@ -5538,6 +5538,18 @@ not_early:
    2055     cond_resched();
    2056     }
    2057     }
    2058     +#ifdef CONFIG_SPARSEMEM
    2059     + /*
    2060     + * If the zone does not span the rest of the section then
    2061     + * we should at least initialize those pages. Otherwise we
    2062     + * could blow up on a poisoned page in some paths which depend
    2063     + * on full sections being initialized (e.g. memory hotplug).
    2064     + */
    2065     + while (end_pfn % PAGES_PER_SECTION) {
    2066     + __init_single_page(pfn_to_page(end_pfn), end_pfn, zone, nid);
    2067     + end_pfn++;
    2068     + }
    2069     +#endif
    2070     }
    2071    
    2072     static void __meminit zone_init_free_lists(struct zone *zone)
    2073     @@ -7704,11 +7716,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
    2074     * handle each tail page individually in migration.
    2075     */
    2076     if (PageHuge(page)) {
    2077     + struct page *head = compound_head(page);
    2078     + unsigned int skip_pages;
    2079    
    2080     - if (!hugepage_migration_supported(page_hstate(page)))
    2081     + if (!hugepage_migration_supported(page_hstate(head)))
    2082     goto unmovable;
    2083    
    2084     - iter = round_up(iter + 1, 1<<compound_order(page)) - 1;
    2085     + skip_pages = (1 << compound_order(head)) - (page - head);
    2086     + iter += skip_pages - 1;
    2087     continue;
    2088     }
    2089    
    2090     diff --git a/mm/vmscan.c b/mm/vmscan.c
    2091     index c5ef7240cbcb..961401c46334 100644
    2092     --- a/mm/vmscan.c
    2093     +++ b/mm/vmscan.c
    2094     @@ -2456,9 +2456,11 @@ out:
    2095     /*
    2096     * Scan types proportional to swappiness and
    2097     * their relative recent reclaim efficiency.
    2098     + * Make sure we don't miss the last page
    2099     + * because of a round-off error.
    2100     */
    2101     - scan = div64_u64(scan * fraction[file],
    2102     - denominator);
    2103     + scan = DIV64_U64_ROUND_UP(scan * fraction[file],
    2104     + denominator);
    2105     break;
    2106     case SCAN_FILE:
    2107     case SCAN_ANON:
    2108     diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    2109     index b669262682c9..7a34990a68b1 100644
    2110     --- a/net/xfrm/xfrm_state.c
    2111     +++ b/net/xfrm/xfrm_state.c
    2112     @@ -426,6 +426,12 @@ static void xfrm_put_mode(struct xfrm_mode *mode)
    2113     module_put(mode->owner);
    2114     }
    2115    
    2116     +void xfrm_state_free(struct xfrm_state *x)
    2117     +{
    2118     + kmem_cache_free(xfrm_state_cache, x);
    2119     +}
    2120     +EXPORT_SYMBOL(xfrm_state_free);
    2121     +
    2122     static void xfrm_state_gc_destroy(struct xfrm_state *x)
    2123     {
    2124     tasklet_hrtimer_cancel(&x->mtimer);
    2125     @@ -452,7 +458,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
    2126     }
    2127     xfrm_dev_state_free(x);
    2128     security_xfrm_state_free(x);
    2129     - kmem_cache_free(xfrm_state_cache, x);
    2130     + xfrm_state_free(x);
    2131     }
    2132    
    2133     static void xfrm_state_gc_task(struct work_struct *work)
    2134     diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    2135     index df7ca2dabc48..566919838d5e 100644
    2136     --- a/net/xfrm/xfrm_user.c
    2137     +++ b/net/xfrm/xfrm_user.c
    2138     @@ -2288,13 +2288,13 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
    2139    
    2140     }
    2141    
    2142     - kfree(x);
    2143     + xfrm_state_free(x);
    2144     kfree(xp);
    2145    
    2146     return 0;
    2147    
    2148     free_state:
    2149     - kfree(x);
    2150     + xfrm_state_free(x);
    2151     nomem:
    2152     return err;
    2153     }