From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1046022-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 68A73138334
for <garchives@archives.gentoo.org>; Sun, 9 Sep 2018 11:25:29 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 582D8E08F0;
Sun, 9 Sep 2018 11:25:27 +0000 (UTC)
Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 008D8E08F0
for <gentoo-commits@lists.gentoo.org>; Sun, 9 Sep 2018 11:25:26 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 5DADC340D3C
for <gentoo-commits@lists.gentoo.org>; Sun, 9 Sep 2018 11:25:24 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id 3459F3B1
for <gentoo-commits@lists.gentoo.org>; Sun, 9 Sep 2018 11:25:21 +0000 (UTC)
From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" <mpagano@gentoo.org>
Message-ID: <1536492312.9a044a4deae2ea2a876cb6bea5415a1efac72a9e.mpagano@gentoo>
Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: /
X-VCS-Repository: proj/linux-patches
X-VCS-Files: 0000_README 1006_linux-4.18.7.patch
X-VCS-Directories: /
X-VCS-Committer: mpagano
X-VCS-Committer-Name: Mike Pagano
X-VCS-Revision: 9a044a4deae2ea2a876cb6bea5415a1efac72a9e
X-VCS-Branch: 4.18
Date: Sun, 9 Sep 2018 11:25:21 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Archives-Salt: c47800c2-1f04-4bfa-9ffb-0816f551acff
X-Archives-Hash: 312535dde8da51d55f497f81f445770a
commit: 9a044a4deae2ea2a876cb6bea5415a1efac72a9e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 9 11:25:12 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Sep 9 11:25:12 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9a044a4d
Linux patch 4.18.7
0000_README | 4 +
1006_linux-4.18.7.patch | 5658 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5662 insertions(+)
diff --git a/0000_README b/0000_README
index 8bfc2e4..f3682ca 100644
--- a/0000_README
+++ b/0000_README
@@ -67,6 +67,10 @@ Patch: 1005_linux-4.18.6.patch
From: http://www.kernel.org
Desc: Linux 4.18.6
+Patch: 1006_linux-4.18.7.patch
+From: http://www.kernel.org
+Desc: Linux 4.18.7
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1006_linux-4.18.7.patch b/1006_linux-4.18.7.patch
new file mode 100644
index 0000000..7ab3155
--- /dev/null
+++ b/1006_linux-4.18.7.patch
@@ -0,0 +1,5658 @@
+diff --git a/Makefile b/Makefile
+index 62524f4d42ad..711b04d00e49 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 18
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Merciless Moray
+
+diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
+index c210a25dd6da..cff52d8ffdb1 100644
+--- a/arch/alpha/kernel/osf_sys.c
++++ b/arch/alpha/kernel/osf_sys.c
+@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path,
+ SYSCALL_DEFINE1(osf_utsname, char __user *, name)
+ {
+ int error;
++ char tmp[5 * 32];
+
+ down_read(&uts_sem);
+- error = -EFAULT;
+- if (copy_to_user(name + 0, utsname()->sysname, 32))
+- goto out;
+- if (copy_to_user(name + 32, utsname()->nodename, 32))
+- goto out;
+- if (copy_to_user(name + 64, utsname()->release, 32))
+- goto out;
+- if (copy_to_user(name + 96, utsname()->version, 32))
+- goto out;
+- if (copy_to_user(name + 128, utsname()->machine, 32))
+- goto out;
++ memcpy(tmp + 0 * 32, utsname()->sysname, 32);
++ memcpy(tmp + 1 * 32, utsname()->nodename, 32);
++ memcpy(tmp + 2 * 32, utsname()->release, 32);
++ memcpy(tmp + 3 * 32, utsname()->version, 32);
++ memcpy(tmp + 4 * 32, utsname()->machine, 32);
++ up_read(&uts_sem);
+
+- error = 0;
+- out:
+- up_read(&uts_sem);
+- return error;
++ if (copy_to_user(name, tmp, sizeof(tmp)))
++ return -EFAULT;
++ return 0;
+ }
+
+ SYSCALL_DEFINE0(getpagesize)
+@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
+ {
+ int len, err = 0;
+ char *kname;
++ char tmp[32];
+
+- if (namelen > 32)
++ if (namelen < 0 || namelen > 32)
+ namelen = 32;
+
+ down_read(&uts_sem);
+ kname = utsname()->domainname;
+ len = strnlen(kname, namelen);
+- if (copy_to_user(name, kname, min(len + 1, namelen)))
+- err = -EFAULT;
++ len = min(len + 1, namelen);
++ memcpy(tmp, kname, len);
+ up_read(&uts_sem);
+
+- return err;
++ if (copy_to_user(name, tmp, len))
++ return -EFAULT;
++ return 0;
+ }
+
+ /*
+@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
+ };
+ unsigned long offset;
+ const char *res;
+- long len, err = -EINVAL;
++ long len;
++ char tmp[__NEW_UTS_LEN + 1];
+
+ offset = command-1;
+ if (offset >= ARRAY_SIZE(sysinfo_table)) {
+ /* Digital UNIX has a few unpublished interfaces here */
+ printk("sysinfo(%d)", command);
+- goto out;
++ return -EINVAL;
+ }
+
+ down_read(&uts_sem);
+@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
+ len = strlen(res)+1;
+ if ((unsigned long)len > (unsigned long)count)
+ len = count;
+- if (copy_to_user(buf, res, len))
+- err = -EFAULT;
+- else
+- err = 0;
++ memcpy(tmp, res, len);
+ up_read(&uts_sem);
+- out:
+- return err;
++ if (copy_to_user(buf, tmp, len))
++ return -EFAULT;
++ return 0;
+ }
+
+ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index 5bb9d68d6e90..d9a2049a1ea8 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -66,10 +66,6 @@
+ };
+ };
+
+-&omap_dwc3_2 {
+- extcon = <&extcon_usb2>;
+-};
+-
+ &extcon_usb2 {
+ id-gpio = <&gpio5 7 GPIO_ACTIVE_HIGH>;
+ vbus-gpio = <&gpio7 22 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm/boot/dts/am572x-idk-common.dtsi b/arch/arm/boot/dts/am572x-idk-common.dtsi
+index c6d858b31011..784639ddf451 100644
+--- a/arch/arm/boot/dts/am572x-idk-common.dtsi
++++ b/arch/arm/boot/dts/am572x-idk-common.dtsi
+@@ -57,10 +57,6 @@
+ };
+ };
+
+-&omap_dwc3_2 {
+- extcon = <&extcon_usb2>;
+-};
+-
+ &extcon_usb2 {
+ id-gpio = <&gpio3 16 GPIO_ACTIVE_HIGH>;
+ vbus-gpio = <&gpio3 26 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+index ad87f1ae904d..c9063ffca524 100644
+--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+@@ -395,8 +395,13 @@
+ dr_mode = "host";
+ };
+
++&omap_dwc3_2 {
++ extcon = <&extcon_usb2>;
++};
++
+ &usb2 {
+- dr_mode = "peripheral";
++ extcon = <&extcon_usb2>;
++ dr_mode = "otg";
+ };
+
+ &mmc1 {
+diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+index 92a9740c533f..3b1db7b9ec50 100644
+--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
++++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+@@ -206,6 +206,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x70>;
++ reset-gpio = <&gpio TEGRA_GPIO(BB, 0) GPIO_ACTIVE_LOW>;
+ };
+ };
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 42c090cf0292..3eb034189cf8 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -754,7 +754,6 @@ config NEED_PER_CPU_EMBED_FIRST_CHUNK
+
+ config HOLES_IN_ZONE
+ def_bool y
+- depends on NUMA
+
+ source kernel/Kconfig.preempt
+ source kernel/Kconfig.hz
+diff --git a/arch/arm64/crypto/sm4-ce-glue.c b/arch/arm64/crypto/sm4-ce-glue.c
+index b7fb5274b250..0c4fc223f225 100644
+--- a/arch/arm64/crypto/sm4-ce-glue.c
++++ b/arch/arm64/crypto/sm4-ce-glue.c
+@@ -69,5 +69,5 @@ static void __exit sm4_ce_mod_fini(void)
+ crypto_unregister_alg(&sm4_ce_alg);
+ }
+
+-module_cpu_feature_match(SM3, sm4_ce_mod_init);
++module_cpu_feature_match(SM4, sm4_ce_mod_init);
+ module_exit(sm4_ce_mod_fini);
+diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
+index 5a23010af600..1e7a33592e29 100644
+--- a/arch/powerpc/include/asm/fadump.h
++++ b/arch/powerpc/include/asm/fadump.h
+@@ -195,9 +195,6 @@ struct fadump_crash_info_header {
+ struct cpumask online_mask;
+ };
+
+-/* Crash memory ranges */
+-#define INIT_CRASHMEM_RANGES (INIT_MEMBLOCK_REGIONS + 2)
+-
+ struct fad_crash_memory_ranges {
+ unsigned long long base;
+ unsigned long long size;
+diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
+index 2160be2e4339..b321c82b3624 100644
+--- a/arch/powerpc/include/asm/nohash/pgtable.h
++++ b/arch/powerpc/include/asm/nohash/pgtable.h
+@@ -51,17 +51,14 @@ static inline int pte_present(pte_t pte)
+ #define pte_access_permitted pte_access_permitted
+ static inline bool pte_access_permitted(pte_t pte, bool write)
+ {
+- unsigned long pteval = pte_val(pte);
+ /*
+ * A read-only access is controlled by _PAGE_USER bit.
+ * We have _PAGE_READ set for WRITE and EXECUTE
+ */
+- unsigned long need_pte_bits = _PAGE_PRESENT | _PAGE_USER;
+-
+- if (write)
+- need_pte_bits |= _PAGE_WRITE;
++ if (!pte_present(pte) || !pte_user(pte) || !pte_read(pte))
++ return false;
+
+- if ((pteval & need_pte_bits) != need_pte_bits)
++ if (write && !pte_write(pte))
+ return false;
+
+ return true;
+diff --git a/arch/powerpc/include/asm/pkeys.h b/arch/powerpc/include/asm/pkeys.h
+index 5ba80cffb505..3312606fda07 100644
+--- a/arch/powerpc/include/asm/pkeys.h
++++ b/arch/powerpc/include/asm/pkeys.h
+@@ -94,8 +94,6 @@ static inline bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey)
+ __mm_pkey_is_allocated(mm, pkey));
+ }
+
+-extern void __arch_activate_pkey(int pkey);
+-extern void __arch_deactivate_pkey(int pkey);
+ /*
+ * Returns a positive, 5-bit key on success, or -1 on failure.
+ * Relies on the mmap_sem to protect against concurrency in mm_pkey_alloc() and
+@@ -124,11 +122,6 @@ static inline int mm_pkey_alloc(struct mm_struct *mm)
+ ret = ffz((u32)mm_pkey_allocation_map(mm));
+ __mm_pkey_allocated(mm, ret);
+
+- /*
+- * Enable the key in the hardware
+- */
+- if (ret > 0)
+- __arch_activate_pkey(ret);
+ return ret;
+ }
+
+@@ -140,10 +133,6 @@ static inline int mm_pkey_free(struct mm_struct *mm, int pkey)
+ if (!mm_pkey_is_allocated(mm, pkey))
+ return -EINVAL;
+
+- /*
+- * Disable the key in the hardware
+- */
+- __arch_deactivate_pkey(pkey);
+ __mm_pkey_free(mm, pkey);
+
+ return 0;
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 07e8396d472b..958eb5cd2a9e 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -47,8 +47,10 @@ static struct fadump_mem_struct fdm;
+ static const struct fadump_mem_struct *fdm_active;
+
+ static DEFINE_MUTEX(fadump_mutex);
+-struct fad_crash_memory_ranges crash_memory_ranges[INIT_CRASHMEM_RANGES];
++struct fad_crash_memory_ranges *crash_memory_ranges;
++int crash_memory_ranges_size;
+ int crash_mem_ranges;
++int max_crash_mem_ranges;
+
+ /* Scan the Firmware Assisted dump configuration details. */
+ int __init early_init_dt_scan_fw_dump(unsigned long node,
+@@ -868,38 +870,88 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active)
+ return 0;
+ }
+
+-static inline void fadump_add_crash_memory(unsigned long long base,
+- unsigned long long end)
++static void free_crash_memory_ranges(void)
++{
++ kfree(crash_memory_ranges);
++ crash_memory_ranges = NULL;
++ crash_memory_ranges_size = 0;
++ max_crash_mem_ranges = 0;
++}
++
++/*
++ * Allocate or reallocate crash memory ranges array in incremental units
++ * of PAGE_SIZE.
++ */
++static int allocate_crash_memory_ranges(void)
++{
++ struct fad_crash_memory_ranges *new_array;
++ u64 new_size;
++
++ new_size = crash_memory_ranges_size + PAGE_SIZE;
++ pr_debug("Allocating %llu bytes of memory for crash memory ranges\n",
++ new_size);
++
++ new_array = krealloc(crash_memory_ranges, new_size, GFP_KERNEL);
++ if (new_array == NULL) {
++ pr_err("Insufficient memory for setting up crash memory ranges\n");
++ free_crash_memory_ranges();
++ return -ENOMEM;
++ }
++
++ crash_memory_ranges = new_array;
++ crash_memory_ranges_size = new_size;
++ max_crash_mem_ranges = (new_size /
++ sizeof(struct fad_crash_memory_ranges));
++ return 0;
++}
++
++static inline int fadump_add_crash_memory(unsigned long long base,
++ unsigned long long end)
+ {
+ if (base == end)
+- return;
++ return 0;
++
++ if (crash_mem_ranges == max_crash_mem_ranges) {
++ int ret;
++
++ ret = allocate_crash_memory_ranges();
++ if (ret)
++ return ret;
++ }
+
+ pr_debug("crash_memory_range[%d] [%#016llx-%#016llx], %#llx bytes\n",
+ crash_mem_ranges, base, end - 1, (end - base));
+ crash_memory_ranges[crash_mem_ranges].base = base;
+ crash_memory_ranges[crash_mem_ranges].size = end - base;
+ crash_mem_ranges++;
++ return 0;
+ }
+
+-static void fadump_exclude_reserved_area(unsigned long long start,
++static int fadump_exclude_reserved_area(unsigned long long start,
+ unsigned long long end)
+ {
+ unsigned long long ra_start, ra_end;
++ int ret = 0;
+
+ ra_start = fw_dump.reserve_dump_area_start;
+ ra_end = ra_start + fw_dump.reserve_dump_area_size;
+
+ if ((ra_start < end) && (ra_end > start)) {
+ if ((start < ra_start) && (end > ra_end)) {
+- fadump_add_crash_memory(start, ra_start);
+- fadump_add_crash_memory(ra_end, end);
++ ret = fadump_add_crash_memory(start, ra_start);
++ if (ret)
++ return ret;
++
++ ret = fadump_add_crash_memory(ra_end, end);
+ } else if (start < ra_start) {
+- fadump_add_crash_memory(start, ra_start);
++ ret = fadump_add_crash_memory(start, ra_start);
+ } else if (ra_end < end) {
+- fadump_add_crash_memory(ra_end, end);
++ ret = fadump_add_crash_memory(ra_end, end);
+ }
+ } else
+- fadump_add_crash_memory(start, end);
++ ret = fadump_add_crash_memory(start, end);
++
++ return ret;
+ }
+
+ static int fadump_init_elfcore_header(char *bufp)
+@@ -939,10 +991,11 @@ static int fadump_init_elfcore_header(char *bufp)
+ * Traverse through memblock structure and setup crash memory ranges. These
+ * ranges will be used create PT_LOAD program headers in elfcore header.
+ */
+-static void fadump_setup_crash_memory_ranges(void)
++static int fadump_setup_crash_memory_ranges(void)
+ {
+ struct memblock_region *reg;
+ unsigned long long start, end;
++ int ret;
+
+ pr_debug("Setup crash memory ranges.\n");
+ crash_mem_ranges = 0;
+@@ -953,7 +1006,9 @@ static void fadump_setup_crash_memory_ranges(void)
+ * specified during fadump registration. We need to create a separate
+ * program header for this chunk with the correct offset.
+ */
+- fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size);
++ ret = fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size);
++ if (ret)
++ return ret;
+
+ for_each_memblock(memory, reg) {
+ start = (unsigned long long)reg->base;
+@@ -973,8 +1028,12 @@ static void fadump_setup_crash_memory_ranges(void)
+ }
+
+ /* add this range excluding the reserved dump area. */
+- fadump_exclude_reserved_area(start, end);
++ ret = fadump_exclude_reserved_area(start, end);
++ if (ret)
++ return ret;
+ }
++
++ return 0;
+ }
+
+ /*
+@@ -1097,6 +1156,7 @@ static int register_fadump(void)
+ {
+ unsigned long addr;
+ void *vaddr;
++ int ret;
+
+ /*
+ * If no memory is reserved then we can not register for firmware-
+@@ -1105,7 +1165,9 @@ static int register_fadump(void)
+ if (!fw_dump.reserve_dump_area_size)
+ return -ENODEV;
+
+- fadump_setup_crash_memory_ranges();
++ ret = fadump_setup_crash_memory_ranges();
++ if (ret)
++ return ret;
+
+ addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len);
+ /* Initialize fadump crash info header. */
+@@ -1183,6 +1245,7 @@ void fadump_cleanup(void)
+ } else if (fw_dump.dump_registered) {
+ /* Un-register Firmware-assisted dump if it was registered. */
+ fadump_unregister_dump(&fdm);
++ free_crash_memory_ranges();
+ }
+ }
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 9ef4aea9fffe..991d09774108 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -583,6 +583,7 @@ static void save_all(struct task_struct *tsk)
+ __giveup_spe(tsk);
+
+ msr_check_and_clear(msr_all_available);
++ thread_pkey_regs_save(&tsk->thread);
+ }
+
+ void flush_all_to_thread(struct task_struct *tsk)
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index de686b340f4a..a995513573c2 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -46,6 +46,7 @@
+ #include <linux/compiler.h>
+ #include <linux/of.h>
+
++#include <asm/ftrace.h>
+ #include <asm/reg.h>
+ #include <asm/ppc-opcode.h>
+ #include <asm/asm-prototypes.h>
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index f3d4b4a0e561..3bb5cec03d1f 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -200,9 +200,9 @@ static void pte_frag_destroy(void *pte_frag)
+ /* drop all the pending references */
+ count = ((unsigned long)pte_frag & ~PAGE_MASK) >> PTE_FRAG_SIZE_SHIFT;
+ /* We allow PTE_FRAG_NR fragments from a PTE page */
+- if (page_ref_sub_and_test(page, PTE_FRAG_NR - count)) {
++ if (atomic_sub_and_test(PTE_FRAG_NR - count, &page->pt_frag_refcount)) {
+ pgtable_page_dtor(page);
+- free_unref_page(page);
++ __free_page(page);
+ }
+ }
+
+@@ -215,9 +215,9 @@ static void pmd_frag_destroy(void *pmd_frag)
+ /* drop all the pending references */
+ count = ((unsigned long)pmd_frag & ~PAGE_MASK) >> PMD_FRAG_SIZE_SHIFT;
+ /* We allow PTE_FRAG_NR fragments from a PTE page */
+- if (page_ref_sub_and_test(page, PMD_FRAG_NR - count)) {
++ if (atomic_sub_and_test(PMD_FRAG_NR - count, &page->pt_frag_refcount)) {
+ pgtable_pmd_page_dtor(page);
+- free_unref_page(page);
++ __free_page(page);
+ }
+ }
+
+diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
+index a4ca57612558..c9ee9e23845f 100644
+--- a/arch/powerpc/mm/mmu_context_iommu.c
++++ b/arch/powerpc/mm/mmu_context_iommu.c
+@@ -129,6 +129,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ long i, j, ret = 0, locked_entries = 0;
+ unsigned int pageshift;
+ unsigned long flags;
++ unsigned long cur_ua;
+ struct page *page = NULL;
+
+ mutex_lock(&mem_list_mutex);
+@@ -177,7 +178,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ }
+
+ for (i = 0; i < entries; ++i) {
+- if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT),
++ cur_ua = ua + (i << PAGE_SHIFT);
++ if (1 != get_user_pages_fast(cur_ua,
+ 1/* pages */, 1/* iswrite */, &page)) {
+ ret = -EFAULT;
+ for (j = 0; j < i; ++j)
+@@ -196,7 +198,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ if (is_migrate_cma_page(page)) {
+ if (mm_iommu_move_page_from_cma(page))
+ goto populate;
+- if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT),
++ if (1 != get_user_pages_fast(cur_ua,
+ 1/* pages */, 1/* iswrite */,
+ &page)) {
+ ret = -EFAULT;
+@@ -210,20 +212,21 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ }
+ populate:
+ pageshift = PAGE_SHIFT;
+- if (PageCompound(page)) {
++ if (mem->pageshift > PAGE_SHIFT && PageCompound(page)) {
+ pte_t *pte;
+ struct page *head = compound_head(page);
+ unsigned int compshift = compound_order(head);
++ unsigned int pteshift;
+
+ local_irq_save(flags); /* disables as well */
+- pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift);
+- local_irq_restore(flags);
++ pte = find_linux_pte(mm->pgd, cur_ua, NULL, &pteshift);
+
+ /* Double check it is still the same pinned page */
+ if (pte && pte_page(*pte) == head &&
+- pageshift == compshift)
+- pageshift = max_t(unsigned int, pageshift,
++ pteshift == compshift + PAGE_SHIFT)
++ pageshift = max_t(unsigned int, pteshift,
+ PAGE_SHIFT);
++ local_irq_restore(flags);
+ }
+ mem->pageshift = min(mem->pageshift, pageshift);
+ mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT;
+diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
+index 4afbfbb64bfd..78d0b3d5ebad 100644
+--- a/arch/powerpc/mm/pgtable-book3s64.c
++++ b/arch/powerpc/mm/pgtable-book3s64.c
+@@ -270,6 +270,8 @@ static pmd_t *__alloc_for_pmdcache(struct mm_struct *mm)
+ return NULL;
+ }
+
++ atomic_set(&page->pt_frag_refcount, 1);
++
+ ret = page_address(page);
+ /*
+ * if we support only one fragment just return the
+@@ -285,7 +287,7 @@ static pmd_t *__alloc_for_pmdcache(struct mm_struct *mm)
+ * count.
+ */
+ if (likely(!mm->context.pmd_frag)) {
+- set_page_count(page, PMD_FRAG_NR);
++ atomic_set(&page->pt_frag_refcount, PMD_FRAG_NR);
+ mm->context.pmd_frag = ret + PMD_FRAG_SIZE;
+ }
+ spin_unlock(&mm->page_table_lock);
+@@ -308,9 +310,10 @@ void pmd_fragment_free(unsigned long *pmd)
+ {
+ struct page *page = virt_to_page(pmd);
+
+- if (put_page_testzero(page)) {
++ BUG_ON(atomic_read(&page->pt_frag_refcount) <= 0);
++ if (atomic_dec_and_test(&page->pt_frag_refcount)) {
+ pgtable_pmd_page_dtor(page);
+- free_unref_page(page);
++ __free_page(page);
+ }
+ }
+
+@@ -352,6 +355,7 @@ static pte_t *__alloc_for_ptecache(struct mm_struct *mm, int kernel)
+ return NULL;
+ }
+
++ atomic_set(&page->pt_frag_refcount, 1);
+
+ ret = page_address(page);
+ /*
+@@ -367,7 +371,7 @@ static pte_t *__alloc_for_ptecache(struct mm_struct *mm, int kernel)
+ * count.
+ */
+ if (likely(!mm->context.pte_frag)) {
+- set_page_count(page, PTE_FRAG_NR);
++ atomic_set(&page->pt_frag_refcount, PTE_FRAG_NR);
+ mm->context.pte_frag = ret + PTE_FRAG_SIZE;
+ }
+ spin_unlock(&mm->page_table_lock);
+@@ -390,10 +394,11 @@ void pte_fragment_free(unsigned long *table, int kernel)
+ {
+ struct page *page = virt_to_page(table);
+
+- if (put_page_testzero(page)) {
++ BUG_ON(atomic_read(&page->pt_frag_refcount) <= 0);
++ if (atomic_dec_and_test(&page->pt_frag_refcount)) {
+ if (!kernel)
+ pgtable_page_dtor(page);
+- free_unref_page(page);
++ __free_page(page);
+ }
+ }
+
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index e6f500fabf5e..0e7810ccd1ae 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -15,8 +15,10 @@ bool pkey_execute_disable_supported;
+ int pkeys_total; /* Total pkeys as per device tree */
+ bool pkeys_devtree_defined; /* pkey property exported by device tree */
+ u32 initial_allocation_mask; /* Bits set for reserved keys */
+-u64 pkey_amr_uamor_mask; /* Bits in AMR/UMOR not to be touched */
++u64 pkey_amr_mask; /* Bits in AMR not to be touched */
+ u64 pkey_iamr_mask; /* Bits in AMR not to be touched */
++u64 pkey_uamor_mask; /* Bits in UMOR not to be touched */
++int execute_only_key = 2;
+
+ #define AMR_BITS_PER_PKEY 2
+ #define AMR_RD_BIT 0x1UL
+@@ -91,7 +93,7 @@ int pkey_initialize(void)
+ * arch-neutral code.
+ */
+ pkeys_total = min_t(int, pkeys_total,
+- (ARCH_VM_PKEY_FLAGS >> VM_PKEY_SHIFT));
++ ((ARCH_VM_PKEY_FLAGS >> VM_PKEY_SHIFT)+1));
+
+ if (!pkey_mmu_enabled() || radix_enabled() || !pkeys_total)
+ static_branch_enable(&pkey_disabled);
+@@ -119,20 +121,38 @@ int pkey_initialize(void)
+ #else
+ os_reserved = 0;
+ #endif
+- initial_allocation_mask = ~0x0;
+- pkey_amr_uamor_mask = ~0x0ul;
++ initial_allocation_mask = (0x1 << 0) | (0x1 << 1) |
++ (0x1 << execute_only_key);
++
++ /* register mask is in BE format */
++ pkey_amr_mask = ~0x0ul;
++ pkey_amr_mask &= ~(0x3ul << pkeyshift(0));
++
+ pkey_iamr_mask = ~0x0ul;
+- /*
+- * key 0, 1 are reserved.
+- * key 0 is the default key, which allows read/write/execute.
+- * key 1 is recommended not to be used. PowerISA(3.0) page 1015,
+- * programming note.
+- */
+- for (i = 2; i < (pkeys_total - os_reserved); i++) {
+- initial_allocation_mask &= ~(0x1 << i);
+- pkey_amr_uamor_mask &= ~(0x3ul << pkeyshift(i));
+- pkey_iamr_mask &= ~(0x1ul << pkeyshift(i));
++ pkey_iamr_mask &= ~(0x3ul << pkeyshift(0));
++ pkey_iamr_mask &= ~(0x3ul << pkeyshift(execute_only_key));
++
++ pkey_uamor_mask = ~0x0ul;
++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(0));
++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(execute_only_key));
++
++ /* mark the rest of the keys as reserved and hence unavailable */
++ for (i = (pkeys_total - os_reserved); i < pkeys_total; i++) {
++ initial_allocation_mask |= (0x1 << i);
++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(i));
++ }
++
++ if (unlikely((pkeys_total - os_reserved) <= execute_only_key)) {
++ /*
++ * Insufficient number of keys to support
++ * execute only key. Mark it unavailable.
++ * Any AMR, UAMOR, IAMR bit set for
++ * this key is irrelevant since this key
++ * can never be allocated.
++ */
++ execute_only_key = -1;
+ }
++
+ return 0;
+ }
+
+@@ -143,8 +163,7 @@ void pkey_mm_init(struct mm_struct *mm)
+ if (static_branch_likely(&pkey_disabled))
+ return;
+ mm_pkey_allocation_map(mm) = initial_allocation_mask;
+- /* -1 means unallocated or invalid */
+- mm->context.execute_only_pkey = -1;
++ mm->context.execute_only_pkey = execute_only_key;
+ }
+
+ static inline u64 read_amr(void)
+@@ -213,33 +232,6 @@ static inline void init_iamr(int pkey, u8 init_bits)
+ write_iamr(old_iamr | new_iamr_bits);
+ }
+
+-static void pkey_status_change(int pkey, bool enable)
+-{
+- u64 old_uamor;
+-
+- /* Reset the AMR and IAMR bits for this key */
+- init_amr(pkey, 0x0);
+- init_iamr(pkey, 0x0);
+-
+- /* Enable/disable key */
+- old_uamor = read_uamor();
+- if (enable)
+- old_uamor |= (0x3ul << pkeyshift(pkey));
+- else
+- old_uamor &= ~(0x3ul << pkeyshift(pkey));
+- write_uamor(old_uamor);
+-}
+-
+-void __arch_activate_pkey(int pkey)
+-{
+- pkey_status_change(pkey, true);
+-}
+-
+-void __arch_deactivate_pkey(int pkey)
+-{
+- pkey_status_change(pkey, false);
+-}
+-
+ /*
+ * Set the access rights in AMR IAMR and UAMOR registers for @pkey to that
+ * specified in @init_val.
+@@ -289,9 +281,6 @@ void thread_pkey_regs_restore(struct thread_struct *new_thread,
+ if (static_branch_likely(&pkey_disabled))
+ return;
+
+- /*
+- * TODO: Just set UAMOR to zero if @new_thread hasn't used any keys yet.
+- */
+ if (old_thread->amr != new_thread->amr)
+ write_amr(new_thread->amr);
+ if (old_thread->iamr != new_thread->iamr)
+@@ -305,9 +294,13 @@ void thread_pkey_regs_init(struct thread_struct *thread)
+ if (static_branch_likely(&pkey_disabled))
+ return;
+
+- thread->amr = read_amr() & pkey_amr_uamor_mask;
+- thread->iamr = read_iamr() & pkey_iamr_mask;
+- thread->uamor = read_uamor() & pkey_amr_uamor_mask;
++ thread->amr = pkey_amr_mask;
++ thread->iamr = pkey_iamr_mask;
++ thread->uamor = pkey_uamor_mask;
++
++ write_uamor(pkey_uamor_mask);
++ write_amr(pkey_amr_mask);
++ write_iamr(pkey_iamr_mask);
+ }
+
+ static inline bool pkey_allows_readwrite(int pkey)
+@@ -322,48 +315,7 @@ static inline bool pkey_allows_readwrite(int pkey)
+
+ int __execute_only_pkey(struct mm_struct *mm)
+ {
+- bool need_to_set_mm_pkey = false;
+- int execute_only_pkey = mm->context.execute_only_pkey;
+- int ret;
+-
+- /* Do we need to assign a pkey for mm's execute-only maps? */
+- if (execute_only_pkey == -1) {
+- /* Go allocate one to use, which might fail */
+- execute_only_pkey = mm_pkey_alloc(mm);
+- if (execute_only_pkey < 0)
+- return -1;
+- need_to_set_mm_pkey = true;
+- }
+-
+- /*
+- * We do not want to go through the relatively costly dance to set AMR
+- * if we do not need to. Check it first and assume that if the
+- * execute-only pkey is readwrite-disabled than we do not have to set it
+- * ourselves.
+- */
+- if (!need_to_set_mm_pkey && !pkey_allows_readwrite(execute_only_pkey))
+- return execute_only_pkey;
+-
+- /*
+- * Set up AMR so that it denies access for everything other than
+- * execution.
+- */
+- ret = __arch_set_user_pkey_access(current, execute_only_pkey,
+- PKEY_DISABLE_ACCESS |
+- PKEY_DISABLE_WRITE);
+- /*
+- * If the AMR-set operation failed somehow, just return 0 and
+- * effectively disable execute-only support.
+- */
+- if (ret) {
+- mm_pkey_free(mm, execute_only_pkey);
+- return -1;
+- }
+-
+- /* We got one, store it and use it from here on out */
+- if (need_to_set_mm_pkey)
+- mm->context.execute_only_pkey = execute_only_pkey;
+- return execute_only_pkey;
++ return mm->context.execute_only_pkey;
+ }
+
+ static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma)
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 70b2e1e0f23c..a2cdf358a3ac 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -3368,12 +3368,49 @@ static void pnv_pci_ioda_create_dbgfs(void)
+ #endif /* CONFIG_DEBUG_FS */
+ }
+
++static void pnv_pci_enable_bridge(struct pci_bus *bus)
++{
++ struct pci_dev *dev = bus->self;
++ struct pci_bus *child;
++
++ /* Empty bus ? bail */
++ if (list_empty(&bus->devices))
++ return;
++
++ /*
++ * If there's a bridge associated with that bus enable it. This works
++ * around races in the generic code if the enabling is done during
++ * parallel probing. This can be removed once those races have been
++ * fixed.
++ */
++ if (dev) {
++ int rc = pci_enable_device(dev);
++ if (rc)
++ pci_err(dev, "Error enabling bridge (%d)\n", rc);
++ pci_set_master(dev);
++ }
++
++ /* Perform the same to child busses */
++ list_for_each_entry(child, &bus->children, node)
++ pnv_pci_enable_bridge(child);
++}
++
++static void pnv_pci_enable_bridges(void)
++{
++ struct pci_controller *hose;
++
++ list_for_each_entry(hose, &hose_list, list_node)
++ pnv_pci_enable_bridge(hose->bus);
++}
++
+ static void pnv_pci_ioda_fixup(void)
+ {
+ pnv_pci_ioda_setup_PEs();
+ pnv_pci_ioda_setup_iommu_api();
+ pnv_pci_ioda_create_dbgfs();
+
++ pnv_pci_enable_bridges();
++
+ #ifdef CONFIG_EEH
+ pnv_eeh_post_init();
+ #endif
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 5e1ef9150182..2edc673be137 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -360,7 +360,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
+ }
+
+ savep = __va(regs->gpr[3]);
+- regs->gpr[3] = savep[0]; /* restore original r3 */
++ regs->gpr[3] = be64_to_cpu(savep[0]); /* restore original r3 */
+
+ /* If it isn't an extended log we can use the per cpu 64bit buffer */
+ h = (struct rtas_error_log *)&savep[1];
+diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
+index 7f3d9c59719a..452e4d080855 100644
+--- a/arch/sparc/kernel/sys_sparc_32.c
++++ b/arch/sparc/kernel/sys_sparc_32.c
+@@ -197,23 +197,27 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig,
+
+ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
+ {
+- int nlen, err;
+-
++ int nlen, err;
++ char tmp[__NEW_UTS_LEN + 1];
++
+ if (len < 0)
+ return -EINVAL;
+
+- down_read(&uts_sem);
+-
++ down_read(&uts_sem);
++
+ nlen = strlen(utsname()->domainname) + 1;
+ err = -EINVAL;
+ if (nlen > len)
+- goto out;
++ goto out_unlock;
++ memcpy(tmp, utsname()->domainname, nlen);
+
+- err = -EFAULT;
+- if (!copy_to_user(name, utsname()->domainname, nlen))
+- err = 0;
++ up_read(&uts_sem);
+
+-out:
++ if (copy_to_user(name, tmp, nlen))
++ return -EFAULT;
++ return 0;
++
++out_unlock:
+ up_read(&uts_sem);
+ return err;
+ }
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 63baa8aa9414..274ed0b9b3e0 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -519,23 +519,27 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs)
+
+ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
+ {
+- int nlen, err;
++ int nlen, err;
++ char tmp[__NEW_UTS_LEN + 1];
+
+ if (len < 0)
+ return -EINVAL;
+
+- down_read(&uts_sem);
+-
++ down_read(&uts_sem);
++
+ nlen = strlen(utsname()->domainname) + 1;
+ err = -EINVAL;
+ if (nlen > len)
+- goto out;
++ goto out_unlock;
++ memcpy(tmp, utsname()->domainname, nlen);
++
++ up_read(&uts_sem);
+
+- err = -EFAULT;
+- if (!copy_to_user(name, utsname()->domainname, nlen))
+- err = 0;
++ if (copy_to_user(name, tmp, nlen))
++ return -EFAULT;
++ return 0;
+
+-out:
++out_unlock:
+ up_read(&uts_sem);
+ return err;
+ }
+diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
+index e762ef417562..d27a50656aa1 100644
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -223,34 +223,34 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff
+ pcmpeqd TWOONE(%rip), \TMP2
+ pand POLY(%rip), \TMP2
+ pxor \TMP2, \TMP3
+- movdqa \TMP3, HashKey(%arg2)
++ movdqu \TMP3, HashKey(%arg2)
+
+ movdqa \TMP3, \TMP5
+ pshufd $78, \TMP3, \TMP1
+ pxor \TMP3, \TMP1
+- movdqa \TMP1, HashKey_k(%arg2)
++ movdqu \TMP1, HashKey_k(%arg2)
+
+ GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
+ # TMP5 = HashKey^2<<1 (mod poly)
+- movdqa \TMP5, HashKey_2(%arg2)
++ movdqu \TMP5, HashKey_2(%arg2)
+ # HashKey_2 = HashKey^2<<1 (mod poly)
+ pshufd $78, \TMP5, \TMP1
+ pxor \TMP5, \TMP1
+- movdqa \TMP1, HashKey_2_k(%arg2)
++ movdqu \TMP1, HashKey_2_k(%arg2)
+
+ GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
+ # TMP5 = HashKey^3<<1 (mod poly)
+- movdqa \TMP5, HashKey_3(%arg2)
++ movdqu \TMP5, HashKey_3(%arg2)
+ pshufd $78, \TMP5, \TMP1
+ pxor \TMP5, \TMP1
+- movdqa \TMP1, HashKey_3_k(%arg2)
++ movdqu \TMP1, HashKey_3_k(%arg2)
+
+ GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7
+ # TMP5 = HashKey^3<<1 (mod poly)
+- movdqa \TMP5, HashKey_4(%arg2)
++ movdqu \TMP5, HashKey_4(%arg2)
+ pshufd $78, \TMP5, \TMP1
+ pxor \TMP5, \TMP1
+- movdqa \TMP1, HashKey_4_k(%arg2)
++ movdqu \TMP1, HashKey_4_k(%arg2)
+ .endm
+
+ # GCM_INIT initializes a gcm_context struct to prepare for encoding/decoding.
+@@ -271,7 +271,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff
+ movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv
+
+ PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
+- movdqa HashKey(%arg2), %xmm13
++ movdqu HashKey(%arg2), %xmm13
+
+ CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \
+ %xmm4, %xmm5, %xmm6
+@@ -997,7 +997,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ pshufd $78, \XMM5, \TMP6
+ pxor \XMM5, \TMP6
+ paddd ONE(%rip), \XMM0 # INCR CNT
+- movdqa HashKey_4(%arg2), \TMP5
++ movdqu HashKey_4(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP4 # TMP4 = a1*b1
+ movdqa \XMM0, \XMM1
+ paddd ONE(%rip), \XMM0 # INCR CNT
+@@ -1016,7 +1016,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ pxor (%arg1), \XMM2
+ pxor (%arg1), \XMM3
+ pxor (%arg1), \XMM4
+- movdqa HashKey_4_k(%arg2), \TMP5
++ movdqu HashKey_4_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP6 # TMP6 = (a1+a0)*(b1+b0)
+ movaps 0x10(%arg1), \TMP1
+ AESENC \TMP1, \XMM1 # Round 1
+@@ -1031,7 +1031,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM6, \TMP1
+ pshufd $78, \XMM6, \TMP2
+ pxor \XMM6, \TMP2
+- movdqa HashKey_3(%arg2), \TMP5
++ movdqu HashKey_3(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1 * b1
+ movaps 0x30(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 3
+@@ -1044,7 +1044,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ AESENC \TMP3, \XMM2
+ AESENC \TMP3, \XMM3
+ AESENC \TMP3, \XMM4
+- movdqa HashKey_3_k(%arg2), \TMP5
++ movdqu HashKey_3_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movaps 0x50(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 5
+@@ -1058,7 +1058,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM7, \TMP1
+ pshufd $78, \XMM7, \TMP2
+ pxor \XMM7, \TMP2
+- movdqa HashKey_2(%arg2), \TMP5
++ movdqu HashKey_2(%arg2), \TMP5
+
+ # Multiply TMP5 * HashKey using karatsuba
+
+@@ -1074,7 +1074,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ AESENC \TMP3, \XMM2
+ AESENC \TMP3, \XMM3
+ AESENC \TMP3, \XMM4
+- movdqa HashKey_2_k(%arg2), \TMP5
++ movdqu HashKey_2_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movaps 0x80(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 8
+@@ -1092,7 +1092,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM8, \TMP1
+ pshufd $78, \XMM8, \TMP2
+ pxor \XMM8, \TMP2
+- movdqa HashKey(%arg2), \TMP5
++ movdqu HashKey(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1
+ movaps 0x90(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 9
+@@ -1121,7 +1121,7 @@ aes_loop_par_enc_done\@:
+ AESENCLAST \TMP3, \XMM2
+ AESENCLAST \TMP3, \XMM3
+ AESENCLAST \TMP3, \XMM4
+- movdqa HashKey_k(%arg2), \TMP5
++ movdqu HashKey_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movdqu (%arg4,%r11,1), \TMP3
+ pxor \TMP3, \XMM1 # Ciphertext/Plaintext XOR EK
+@@ -1205,7 +1205,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ pshufd $78, \XMM5, \TMP6
+ pxor \XMM5, \TMP6
+ paddd ONE(%rip), \XMM0 # INCR CNT
+- movdqa HashKey_4(%arg2), \TMP5
++ movdqu HashKey_4(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP4 # TMP4 = a1*b1
+ movdqa \XMM0, \XMM1
+ paddd ONE(%rip), \XMM0 # INCR CNT
+@@ -1224,7 +1224,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ pxor (%arg1), \XMM2
+ pxor (%arg1), \XMM3
+ pxor (%arg1), \XMM4
+- movdqa HashKey_4_k(%arg2), \TMP5
++ movdqu HashKey_4_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP6 # TMP6 = (a1+a0)*(b1+b0)
+ movaps 0x10(%arg1), \TMP1
+ AESENC \TMP1, \XMM1 # Round 1
+@@ -1239,7 +1239,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM6, \TMP1
+ pshufd $78, \XMM6, \TMP2
+ pxor \XMM6, \TMP2
+- movdqa HashKey_3(%arg2), \TMP5
++ movdqu HashKey_3(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1 * b1
+ movaps 0x30(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 3
+@@ -1252,7 +1252,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ AESENC \TMP3, \XMM2
+ AESENC \TMP3, \XMM3
+ AESENC \TMP3, \XMM4
+- movdqa HashKey_3_k(%arg2), \TMP5
++ movdqu HashKey_3_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movaps 0x50(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 5
+@@ -1266,7 +1266,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM7, \TMP1
+ pshufd $78, \XMM7, \TMP2
+ pxor \XMM7, \TMP2
+- movdqa HashKey_2(%arg2), \TMP5
++ movdqu HashKey_2(%arg2), \TMP5
+
+ # Multiply TMP5 * HashKey using karatsuba
+
+@@ -1282,7 +1282,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ AESENC \TMP3, \XMM2
+ AESENC \TMP3, \XMM3
+ AESENC \TMP3, \XMM4
+- movdqa HashKey_2_k(%arg2), \TMP5
++ movdqu HashKey_2_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movaps 0x80(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 8
+@@ -1300,7 +1300,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+ movdqa \XMM8, \TMP1
+ pshufd $78, \XMM8, \TMP2
+ pxor \XMM8, \TMP2
+- movdqa HashKey(%arg2), \TMP5
++ movdqu HashKey(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1
+ movaps 0x90(%arg1), \TMP3
+ AESENC \TMP3, \XMM1 # Round 9
+@@ -1329,7 +1329,7 @@ aes_loop_par_dec_done\@:
+ AESENCLAST \TMP3, \XMM2
+ AESENCLAST \TMP3, \XMM3
+ AESENCLAST \TMP3, \XMM4
+- movdqa HashKey_k(%arg2), \TMP5
++ movdqu HashKey_k(%arg2), \TMP5
+ PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movdqu (%arg4,%r11,1), \TMP3
+ pxor \TMP3, \XMM1 # Ciphertext/Plaintext XOR EK
+@@ -1405,10 +1405,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
+ movdqa \XMM1, \TMP6
+ pshufd $78, \XMM1, \TMP2
+ pxor \XMM1, \TMP2
+- movdqa HashKey_4(%arg2), \TMP5
++ movdqu HashKey_4(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP6 # TMP6 = a1*b1
+ PCLMULQDQ 0x00, \TMP5, \XMM1 # XMM1 = a0*b0
+- movdqa HashKey_4_k(%arg2), \TMP4
++ movdqu HashKey_4_k(%arg2), \TMP4
+ PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ movdqa \XMM1, \XMMDst
+ movdqa \TMP2, \XMM1 # result in TMP6, XMMDst, XMM1
+@@ -1418,10 +1418,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
+ movdqa \XMM2, \TMP1
+ pshufd $78, \XMM2, \TMP2
+ pxor \XMM2, \TMP2
+- movdqa HashKey_3(%arg2), \TMP5
++ movdqu HashKey_3(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1
+ PCLMULQDQ 0x00, \TMP5, \XMM2 # XMM2 = a0*b0
+- movdqa HashKey_3_k(%arg2), \TMP4
++ movdqu HashKey_3_k(%arg2), \TMP4
+ PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ pxor \TMP1, \TMP6
+ pxor \XMM2, \XMMDst
+@@ -1433,10 +1433,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
+ movdqa \XMM3, \TMP1
+ pshufd $78, \XMM3, \TMP2
+ pxor \XMM3, \TMP2
+- movdqa HashKey_2(%arg2), \TMP5
++ movdqu HashKey_2(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1
+ PCLMULQDQ 0x00, \TMP5, \XMM3 # XMM3 = a0*b0
+- movdqa HashKey_2_k(%arg2), \TMP4
++ movdqu HashKey_2_k(%arg2), \TMP4
+ PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ pxor \TMP1, \TMP6
+ pxor \XMM3, \XMMDst
+@@ -1446,10 +1446,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
+ movdqa \XMM4, \TMP1
+ pshufd $78, \XMM4, \TMP2
+ pxor \XMM4, \TMP2
+- movdqa HashKey(%arg2), \TMP5
++ movdqu HashKey(%arg2), \TMP5
+ PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1
+ PCLMULQDQ 0x00, \TMP5, \XMM4 # XMM4 = a0*b0
+- movdqa HashKey_k(%arg2), \TMP4
++ movdqu HashKey_k(%arg2), \TMP4
+ PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0)
+ pxor \TMP1, \TMP6
+ pxor \XMM4, \XMMDst
+diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
+index 7326078eaa7a..278cd07228dd 100644
+--- a/arch/x86/kernel/kexec-bzimage64.c
++++ b/arch/x86/kernel/kexec-bzimage64.c
+@@ -532,7 +532,7 @@ static int bzImage64_cleanup(void *loader_data)
+ static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
+ {
+ return verify_pefile_signature(kernel, kernel_len,
+- NULL,
++ VERIFY_USE_SECONDARY_KEYRING,
+ VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ #endif
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 46b428c0990e..bedabcf33a3e 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -197,12 +197,14 @@ static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_
+
+ static const struct {
+ const char *option;
+- enum vmx_l1d_flush_state cmd;
++ bool for_parse;
+ } vmentry_l1d_param[] = {
+- {"auto", VMENTER_L1D_FLUSH_AUTO},
+- {"never", VMENTER_L1D_FLUSH_NEVER},
+- {"cond", VMENTER_L1D_FLUSH_COND},
+- {"always", VMENTER_L1D_FLUSH_ALWAYS},
++ [VMENTER_L1D_FLUSH_AUTO] = {"auto", true},
++ [VMENTER_L1D_FLUSH_NEVER] = {"never", true},
++ [VMENTER_L1D_FLUSH_COND] = {"cond", true},
++ [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true},
++ [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
++ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
+ };
+
+ #define L1D_CACHE_ORDER 4
+@@ -286,8 +288,9 @@ static int vmentry_l1d_flush_parse(const char *s)
+
+ if (s) {
+ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+- if (sysfs_streq(s, vmentry_l1d_param[i].option))
+- return vmentry_l1d_param[i].cmd;
++ if (vmentry_l1d_param[i].for_parse &&
++ sysfs_streq(s, vmentry_l1d_param[i].option))
++ return i;
+ }
+ }
+ return -EINVAL;
+@@ -297,13 +300,13 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+ {
+ int l1tf, ret;
+
+- if (!boot_cpu_has(X86_BUG_L1TF))
+- return 0;
+-
+ l1tf = vmentry_l1d_flush_parse(s);
+ if (l1tf < 0)
+ return l1tf;
+
++ if (!boot_cpu_has(X86_BUG_L1TF))
++ return 0;
++
+ /*
+ * Has vmx_init() run already? If not then this is the pre init
+ * parameter parsing. In that case just store the value and let
+@@ -323,6 +326,9 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+
+ static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
+ {
++ if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
++ return sprintf(s, "???\n");
++
+ return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
+ }
+
+diff --git a/arch/xtensa/include/asm/cacheasm.h b/arch/xtensa/include/asm/cacheasm.h
+index 2041abb10a23..34545ecfdd6b 100644
+--- a/arch/xtensa/include/asm/cacheasm.h
++++ b/arch/xtensa/include/asm/cacheasm.h
+@@ -31,16 +31,32 @@
+ *
+ */
+
+- .macro __loop_cache_all ar at insn size line_width
+
+- movi \ar, 0
++ .macro __loop_cache_unroll ar at insn size line_width max_immed
++
++ .if (1 << (\line_width)) > (\max_immed)
++ .set _reps, 1
++ .elseif (2 << (\line_width)) > (\max_immed)
++ .set _reps, 2
++ .else
++ .set _reps, 4
++ .endif
++
++ __loopi \ar, \at, \size, (_reps << (\line_width))
++ .set _index, 0
++ .rep _reps
++ \insn \ar, _index << (\line_width)
++ .set _index, _index + 1
++ .endr
++ __endla \ar, \at, _reps << (\line_width)
++
++ .endm
++
+
+- __loopi \ar, \at, \size, (4 << (\line_width))
+- \insn \ar, 0 << (\line_width)
+- \insn \ar, 1 << (\line_width)
+- \insn \ar, 2 << (\line_width)
+- \insn \ar, 3 << (\line_width)
+- __endla \ar, \at, 4 << (\line_width)
++ .macro __loop_cache_all ar at insn size line_width max_immed
++
++ movi \ar, 0
++ __loop_cache_unroll \ar, \at, \insn, \size, \line_width, \max_immed
+
+ .endm
+
+@@ -57,14 +73,9 @@
+ .endm
+
+
+- .macro __loop_cache_page ar at insn line_width
++ .macro __loop_cache_page ar at insn line_width max_immed
+
+- __loopi \ar, \at, PAGE_SIZE, 4 << (\line_width)
+- \insn \ar, 0 << (\line_width)
+- \insn \ar, 1 << (\line_width)
+- \insn \ar, 2 << (\line_width)
+- \insn \ar, 3 << (\line_width)
+- __endla \ar, \at, 4 << (\line_width)
++ __loop_cache_unroll \ar, \at, \insn, PAGE_SIZE, \line_width, \max_immed
+
+ .endm
+
+@@ -72,7 +83,8 @@
+ .macro ___unlock_dcache_all ar at
+
+ #if XCHAL_DCACHE_LINE_LOCKABLE && XCHAL_DCACHE_SIZE
+- __loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE \
++ XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+
+ .endm
+@@ -81,7 +93,8 @@
+ .macro ___unlock_icache_all ar at
+
+ #if XCHAL_ICACHE_LINE_LOCKABLE && XCHAL_ICACHE_SIZE
+- __loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE XCHAL_ICACHE_LINEWIDTH
++ __loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE \
++ XCHAL_ICACHE_LINEWIDTH 240
+ #endif
+
+ .endm
+@@ -90,7 +103,8 @@
+ .macro ___flush_invalidate_dcache_all ar at
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE \
++ XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+
+ .endm
+@@ -99,7 +113,8 @@
+ .macro ___flush_dcache_all ar at
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE \
++ XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+
+ .endm
+@@ -108,8 +123,8 @@
+ .macro ___invalidate_dcache_all ar at
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_all \ar \at dii __stringify(DCACHE_WAY_SIZE) \
+- XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_all \ar \at dii XCHAL_DCACHE_SIZE \
++ XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+@@ -118,8 +133,8 @@
+ .macro ___invalidate_icache_all ar at
+
+ #if XCHAL_ICACHE_SIZE
+- __loop_cache_all \ar \at iii __stringify(ICACHE_WAY_SIZE) \
+- XCHAL_ICACHE_LINEWIDTH
++ __loop_cache_all \ar \at iii XCHAL_ICACHE_SIZE \
++ XCHAL_ICACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+@@ -166,7 +181,7 @@
+ .macro ___flush_invalidate_dcache_page ar as
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+@@ -175,7 +190,7 @@
+ .macro ___flush_dcache_page ar as
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+@@ -184,7 +199,7 @@
+ .macro ___invalidate_dcache_page ar as
+
+ #if XCHAL_DCACHE_SIZE
+- __loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH
++ __loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+@@ -193,7 +208,7 @@
+ .macro ___invalidate_icache_page ar as
+
+ #if XCHAL_ICACHE_SIZE
+- __loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH
++ __loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH 1020
+ #endif
+
+ .endm
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index a9e8633388f4..58c6efa9f9a9 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -913,7 +913,8 @@ static ssize_t bfq_io_set_weight(struct kernfs_open_file *of,
+ if (ret)
+ return ret;
+
+- return bfq_io_set_weight_legacy(of_css(of), NULL, weight);
++ ret = bfq_io_set_weight_legacy(of_css(of), NULL, weight);
++ return ret ?: nbytes;
+ }
+
+ #ifdef CONFIG_DEBUG_BLK_CGROUP
+diff --git a/block/blk-core.c b/block/blk-core.c
+index ee33590f54eb..1646ea85dade 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -715,6 +715,35 @@ void blk_set_queue_dying(struct request_queue *q)
+ }
+ EXPORT_SYMBOL_GPL(blk_set_queue_dying);
+
++/* Unconfigure the I/O scheduler and dissociate from the cgroup controller. */
++void blk_exit_queue(struct request_queue *q)
++{
++ /*
++ * Since the I/O scheduler exit code may access cgroup information,
++ * perform I/O scheduler exit before disassociating from the block
++ * cgroup controller.
++ */
++ if (q->elevator) {
++ ioc_clear_queue(q);
++ elevator_exit(q, q->elevator);
++ q->elevator = NULL;
++ }
++
++ /*
++ * Remove all references to @q from the block cgroup controller before
++ * restoring @q->queue_lock to avoid that restoring this pointer causes
++ * e.g. blkcg_print_blkgs() to crash.
++ */
++ blkcg_exit_queue(q);
++
++ /*
++ * Since the cgroup code may dereference the @q->backing_dev_info
++ * pointer, only decrease its reference count after having removed the
++ * association with the block cgroup controller.
++ */
++ bdi_put(q->backing_dev_info);
++}
++
+ /**
+ * blk_cleanup_queue - shutdown a request queue
+ * @q: request queue to shutdown
+@@ -780,30 +809,7 @@ void blk_cleanup_queue(struct request_queue *q)
+ */
+ WARN_ON_ONCE(q->kobj.state_in_sysfs);
+
+- /*
+- * Since the I/O scheduler exit code may access cgroup information,
+- * perform I/O scheduler exit before disassociating from the block
+- * cgroup controller.
+- */
+- if (q->elevator) {
+- ioc_clear_queue(q);
+- elevator_exit(q, q->elevator);
+- q->elevator = NULL;
+- }
+-
+- /*
+- * Remove all references to @q from the block cgroup controller before
+- * restoring @q->queue_lock to avoid that restoring this pointer causes
+- * e.g. blkcg_print_blkgs() to crash.
+- */
+- blkcg_exit_queue(q);
+-
+- /*
+- * Since the cgroup code may dereference the @q->backing_dev_info
+- * pointer, only decrease its reference count after having removed the
+- * association with the block cgroup controller.
+- */
+- bdi_put(q->backing_dev_info);
++ blk_exit_queue(q);
+
+ if (q->mq_ops)
+ blk_mq_free_queue(q);
+@@ -1180,6 +1186,7 @@ out_exit_flush_rq:
+ q->exit_rq_fn(q, q->fq->flush_rq);
+ out_free_flush_queue:
+ blk_free_flush_queue(q->fq);
++ q->fq = NULL;
+ return -ENOMEM;
+ }
+ EXPORT_SYMBOL(blk_init_allocated_queue);
+@@ -3763,9 +3770,11 @@ EXPORT_SYMBOL(blk_finish_plug);
+ */
+ void blk_pm_runtime_init(struct request_queue *q, struct device *dev)
+ {
+- /* not support for RQF_PM and ->rpm_status in blk-mq yet */
+- if (q->mq_ops)
++ /* Don't enable runtime PM for blk-mq until it is ready */
++ if (q->mq_ops) {
++ pm_runtime_disable(dev);
+ return;
++ }
+
+ q->dev = dev;
+ q->rpm_status = RPM_ACTIVE;
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index 8faa70f26fcd..d1b9dd03da25 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -68,6 +68,8 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ */
+ req_sects = min_t(sector_t, nr_sects,
+ q->limits.max_discard_sectors);
++ if (!req_sects)
++ goto fail;
+ if (req_sects > UINT_MAX >> 9)
+ req_sects = UINT_MAX >> 9;
+
+@@ -105,6 +107,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+
+ *biop = bio;
+ return 0;
++
++fail:
++ if (bio) {
++ submit_bio_wait(bio);
++ bio_put(bio);
++ }
++ *biop = NULL;
++ return -EOPNOTSUPP;
+ }
+ EXPORT_SYMBOL(__blkdev_issue_discard);
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 94987b1f69e1..96c7dfc04852 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -804,6 +804,21 @@ static void __blk_release_queue(struct work_struct *work)
+ blk_stat_remove_callback(q, q->poll_cb);
+ blk_stat_free_callback(q->poll_cb);
+
++ if (!blk_queue_dead(q)) {
++ /*
++ * Last reference was dropped without having called
++ * blk_cleanup_queue().
++ */
++ WARN_ONCE(blk_queue_init_done(q),
++ "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n",
++ q);
++ blk_exit_queue(q);
++ }
++
++ WARN(blkg_root_lookup(q),
++ "request queue %p is being released but it has not yet been removed from the blkcg controller\n",
++ q);
++
+ blk_free_queue_stats(q->stats);
+
+ blk_exit_rl(q, &q->root_rl);
+diff --git a/block/blk.h b/block/blk.h
+index 8d23aea96ce9..a8f0f7986cfd 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -130,6 +130,7 @@ void blk_free_flush_queue(struct blk_flush_queue *q);
+ int blk_init_rl(struct request_list *rl, struct request_queue *q,
+ gfp_t gfp_mask);
+ void blk_exit_rl(struct request_queue *q, struct request_list *rl);
++void blk_exit_queue(struct request_queue *q);
+ void blk_rq_bio_prep(struct request_queue *q, struct request *rq,
+ struct bio *bio);
+ void blk_queue_bypass_start(struct request_queue *q);
+diff --git a/certs/system_keyring.c b/certs/system_keyring.c
+index 6251d1b27f0c..81728717523d 100644
+--- a/certs/system_keyring.c
++++ b/certs/system_keyring.c
+@@ -15,6 +15,7 @@
+ #include <linux/cred.h>
+ #include <linux/err.h>
+ #include <linux/slab.h>
++#include <linux/verification.h>
+ #include <keys/asymmetric-type.h>
+ #include <keys/system_keyring.h>
+ #include <crypto/pkcs7.h>
+@@ -230,7 +231,7 @@ int verify_pkcs7_signature(const void *data, size_t len,
+
+ if (!trusted_keys) {
+ trusted_keys = builtin_trusted_keys;
+- } else if (trusted_keys == (void *)1UL) {
++ } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) {
+ #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+ trusted_keys = secondary_trusted_keys;
+ #else
+diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c
+index e284d9cb9237..5b2f6a2b5585 100644
+--- a/crypto/asymmetric_keys/pkcs7_key_type.c
++++ b/crypto/asymmetric_keys/pkcs7_key_type.c
+@@ -63,7 +63,7 @@ static int pkcs7_preparse(struct key_preparsed_payload *prep)
+
+ return verify_pkcs7_signature(NULL, 0,
+ prep->data, prep->datalen,
+- (void *)1UL, usage,
++ VERIFY_USE_SECONDARY_KEYRING, usage,
+ pkcs7_view_content, prep);
+ }
+
+diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
+index fe9d46d81750..d8b8fc2ff563 100644
+--- a/drivers/acpi/acpica/hwsleep.c
++++ b/drivers/acpi/acpica/hwsleep.c
+@@ -56,14 +56,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
+ if (ACPI_FAILURE(status)) {
+ return_ACPI_STATUS(status);
+ }
+- /*
+- * If the target sleep state is S5, clear all GPEs and fixed events too
+- */
+- if (sleep_state == ACPI_STATE_S5) {
+- status = acpi_hw_clear_acpi_status();
+- if (ACPI_FAILURE(status)) {
+- return_ACPI_STATUS(status);
+- }
++ status = acpi_hw_clear_acpi_status();
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
+ }
+ acpi_gbl_system_awake_and_running = FALSE;
+
+diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
+index 44f35ab3347d..0f0bdc9d24c6 100644
+--- a/drivers/acpi/acpica/psloop.c
++++ b/drivers/acpi/acpica/psloop.c
+@@ -22,6 +22,7 @@
+ #include "acdispat.h"
+ #include "amlcode.h"
+ #include "acconvert.h"
++#include "acnamesp.h"
+
+ #define _COMPONENT ACPI_PARSER
+ ACPI_MODULE_NAME("psloop")
+@@ -527,12 +528,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ if (ACPI_FAILURE(status)) {
+ return_ACPI_STATUS(status);
+ }
+- if (walk_state->opcode == AML_SCOPE_OP) {
++ if (acpi_ns_opens_scope
++ (acpi_ps_get_opcode_info
++ (walk_state->opcode)->object_type)) {
+ /*
+- * If the scope op fails to parse, skip the body of the
+- * scope op because the parse failure indicates that the
+- * device may not exist.
++ * If the scope/device op fails to parse, skip the body of
++ * the scope op because the parse failure indicates that
++ * the device may not exist.
+ */
++ ACPI_ERROR((AE_INFO,
++ "Skip parsing opcode %s",
++ acpi_ps_get_opcode_name
++ (walk_state->opcode)));
+ walk_state->parser_state.aml =
+ walk_state->aml + 1;
+ walk_state->parser_state.aml =
+@@ -540,8 +547,6 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ (&walk_state->parser_state);
+ walk_state->aml =
+ walk_state->parser_state.aml;
+- ACPI_ERROR((AE_INFO,
+- "Skipping Scope block"));
+ }
+
+ continue;
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index a390c6d4f72d..af7cb8e618fe 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -337,6 +337,7 @@ static ssize_t backing_dev_store(struct device *dev,
+ struct device_attribute *attr, const char *buf, size_t len)
+ {
+ char *file_name;
++ size_t sz;
+ struct file *backing_dev = NULL;
+ struct inode *inode;
+ struct address_space *mapping;
+@@ -357,7 +358,11 @@ static ssize_t backing_dev_store(struct device *dev,
+ goto out;
+ }
+
+- strlcpy(file_name, buf, len);
++ strlcpy(file_name, buf, PATH_MAX);
++ /* ignore trailing newline */
++ sz = strlen(file_name);
++ if (sz > 0 && file_name[sz - 1] == '\n')
++ file_name[sz - 1] = 0x00;
+
+ backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0);
+ if (IS_ERR(backing_dev)) {
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index 1d50e97d49f1..6d53f7d9fc7a 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -555,12 +555,20 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_stop);
+
+ void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy)
+ {
+- struct policy_dbs_info *policy_dbs = policy->governor_data;
++ struct policy_dbs_info *policy_dbs;
++
++ /* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
++ mutex_lock(&gov_dbs_data_mutex);
++ policy_dbs = policy->governor_data;
++ if (!policy_dbs)
++ goto out;
+
+ mutex_lock(&policy_dbs->update_mutex);
+ cpufreq_policy_apply_limits(policy);
+ gov_update_sample_delay(policy_dbs, 0);
+-
+ mutex_unlock(&policy_dbs->update_mutex);
++
++out:
++ mutex_unlock(&gov_dbs_data_mutex);
+ }
+ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_limits);
+diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
+index 1aef60d160eb..910f8a68f58b 100644
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -349,14 +349,12 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ * If the tick is already stopped, the cost of possible short
+ * idle duration misprediction is much higher, because the CPU
+ * may be stuck in a shallow idle state for a long time as a
+- * result of it. In that case say we might mispredict and try
+- * to force the CPU into a state for which we would have stopped
+- * the tick, unless a timer is going to expire really soon
+- * anyway.
++ * result of it. In that case say we might mispredict and use
++ * the known time till the closest timer event for the idle
++ * state selection.
+ */
+ if (data->predicted_us < TICK_USEC)
+- data->predicted_us = min_t(unsigned int, TICK_USEC,
+- ktime_to_us(delta_next));
++ data->predicted_us = ktime_to_us(delta_next);
+ } else {
+ /*
+ * Use the performance multiplier and the user-configurable
+@@ -381,8 +379,33 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ continue;
+ if (idx == -1)
+ idx = i; /* first enabled state */
+- if (s->target_residency > data->predicted_us)
+- break;
++ if (s->target_residency > data->predicted_us) {
++ if (data->predicted_us < TICK_USEC)
++ break;
++
++ if (!tick_nohz_tick_stopped()) {
++ /*
++ * If the state selected so far is shallow,
++ * waking up early won't hurt, so retain the
++ * tick in that case and let the governor run
++ * again in the next iteration of the loop.
++ */
++ expected_interval = drv->states[idx].target_residency;
++ break;
++ }
++
++ /*
++ * If the state selected so far is shallow and this
++ * state's target residency matches the time till the
++ * closest timer event, select this one to avoid getting
++ * stuck in the shallow one for too long.
++ */
++ if (drv->states[idx].target_residency < TICK_USEC &&
++ s->target_residency <= ktime_to_us(delta_next))
++ idx = i;
++
++ goto out;
++ }
+ if (s->exit_latency > latency_req) {
+ /*
+ * If we break out of the loop for latency reasons, use
+@@ -403,14 +426,13 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ * Don't stop the tick if the selected state is a polling one or if the
+ * expected idle duration is shorter than the tick period length.
+ */
+- if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) ||
+- expected_interval < TICK_USEC) {
++ if (((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) ||
++ expected_interval < TICK_USEC) && !tick_nohz_tick_stopped()) {
+ unsigned int delta_next_us = ktime_to_us(delta_next);
+
+ *stop_tick = false;
+
+- if (!tick_nohz_tick_stopped() && idx > 0 &&
+- drv->states[idx].target_residency > delta_next_us) {
++ if (idx > 0 && drv->states[idx].target_residency > delta_next_us) {
+ /*
+ * The tick is not going to be stopped and the target
+ * residency of the state to be returned is not within
+@@ -429,6 +451,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ }
+ }
+
++out:
+ data->last_state_idx = idx;
+
+ return data->last_state_idx;
+diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
+index 6e61cc93c2b0..d7aa7d7ff102 100644
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -679,10 +679,8 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
+ int ret = 0;
+
+ if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) {
+- crypto_ablkcipher_set_flags(ablkcipher,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
+ dev_err(jrdev, "key size mismatch\n");
+- return -EINVAL;
++ goto badkey;
+ }
+
+ ctx->cdata.keylen = keylen;
+@@ -715,7 +713,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
+ return ret;
+ badkey:
+ crypto_ablkcipher_set_flags(ablkcipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
+- return 0;
++ return -EINVAL;
+ }
+
+ /*
+diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
+index 578ea63a3109..f26d62e5533a 100644
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -71,8 +71,8 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc,
+ dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE);
+ dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE);
+ dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
+- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+- dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
++ dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
+ }
+
+ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
+@@ -90,8 +90,8 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
+ dma_unmap_single(dev, pdb->dp_dma, p_sz, DMA_TO_DEVICE);
+ dma_unmap_single(dev, pdb->dq_dma, q_sz, DMA_TO_DEVICE);
+ dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
+- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+- dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
++ dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
+ }
+
+ /* RSA Job Completion handler */
+@@ -417,13 +417,13 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
+ goto unmap_p;
+ }
+
+- pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
++ pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(dev, pdb->tmp1_dma)) {
+ dev_err(dev, "Unable to map RSA tmp1 memory\n");
+ goto unmap_q;
+ }
+
+- pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
++ pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(dev, pdb->tmp2_dma)) {
+ dev_err(dev, "Unable to map RSA tmp2 memory\n");
+ goto unmap_tmp1;
+@@ -451,7 +451,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
+ return 0;
+
+ unmap_tmp1:
+- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+ unmap_q:
+ dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
+ unmap_p:
+@@ -504,13 +504,13 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
+ goto unmap_dq;
+ }
+
+- pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
++ pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(dev, pdb->tmp1_dma)) {
+ dev_err(dev, "Unable to map RSA tmp1 memory\n");
+ goto unmap_qinv;
+ }
+
+- pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
++ pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(dev, pdb->tmp2_dma)) {
+ dev_err(dev, "Unable to map RSA tmp2 memory\n");
+ goto unmap_tmp1;
+@@ -538,7 +538,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
+ return 0;
+
+ unmap_tmp1:
+- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+ unmap_qinv:
+ dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
+ unmap_dq:
+diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
+index f4f258075b89..acdd72016ffe 100644
+--- a/drivers/crypto/caam/jr.c
++++ b/drivers/crypto/caam/jr.c
+@@ -190,7 +190,8 @@ static void caam_jr_dequeue(unsigned long devarg)
+ BUG_ON(CIRC_CNT(head, tail + i, JOBR_DEPTH) <= 0);
+
+ /* Unmap just-run descriptor so we can post-process */
+- dma_unmap_single(dev, jrp->outring[hw_idx].desc,
++ dma_unmap_single(dev,
++ caam_dma_to_cpu(jrp->outring[hw_idx].desc),
+ jrp->entinfo[sw_idx].desc_size,
+ DMA_TO_DEVICE);
+
+diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
+index 5285ece4f33a..b71895871be3 100644
+--- a/drivers/crypto/vmx/aes_cbc.c
++++ b/drivers/crypto/vmx/aes_cbc.c
+@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc,
+ ret = crypto_skcipher_encrypt(req);
+ skcipher_request_zero(req);
+ } else {
+- preempt_disable();
+- pagefault_disable();
+- enable_kernel_vsx();
+-
+ blkcipher_walk_init(&walk, dst, src, nbytes);
+ ret = blkcipher_walk_virt(desc, &walk);
+ while ((nbytes = walk.nbytes)) {
++ preempt_disable();
++ pagefault_disable();
++ enable_kernel_vsx();
+ aes_p8_cbc_encrypt(walk.src.virt.addr,
+ walk.dst.virt.addr,
+ nbytes & AES_BLOCK_MASK,
+ &ctx->enc_key, walk.iv, 1);
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
++
+ nbytes &= AES_BLOCK_SIZE - 1;
+ ret = blkcipher_walk_done(desc, &walk, nbytes);
+ }
+-
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+ }
+
+ return ret;
+@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc,
+ ret = crypto_skcipher_decrypt(req);
+ skcipher_request_zero(req);
+ } else {
+- preempt_disable();
+- pagefault_disable();
+- enable_kernel_vsx();
+-
+ blkcipher_walk_init(&walk, dst, src, nbytes);
+ ret = blkcipher_walk_virt(desc, &walk);
+ while ((nbytes = walk.nbytes)) {
++ preempt_disable();
++ pagefault_disable();
++ enable_kernel_vsx();
+ aes_p8_cbc_encrypt(walk.src.virt.addr,
+ walk.dst.virt.addr,
+ nbytes & AES_BLOCK_MASK,
+ &ctx->dec_key, walk.iv, 0);
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
++
+ nbytes &= AES_BLOCK_SIZE - 1;
+ ret = blkcipher_walk_done(desc, &walk, nbytes);
+ }
+-
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+ }
+
+ return ret;
+diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
+index 8bd9aff0f55f..e9954a7d4694 100644
+--- a/drivers/crypto/vmx/aes_xts.c
++++ b/drivers/crypto/vmx/aes_xts.c
+@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
+ ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
+ skcipher_request_zero(req);
+ } else {
++ blkcipher_walk_init(&walk, dst, src, nbytes);
++
++ ret = blkcipher_walk_virt(desc, &walk);
++
+ preempt_disable();
+ pagefault_disable();
+ enable_kernel_vsx();
+
+- blkcipher_walk_init(&walk, dst, src, nbytes);
+-
+- ret = blkcipher_walk_virt(desc, &walk);
+ iv = walk.iv;
+ memset(tweak, 0, AES_BLOCK_SIZE);
+ aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
+
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
++
+ while ((nbytes = walk.nbytes)) {
++ preempt_disable();
++ pagefault_disable();
++ enable_kernel_vsx();
+ if (enc)
+ aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak);
+ else
+ aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak);
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
+
+ nbytes &= AES_BLOCK_SIZE - 1;
+ ret = blkcipher_walk_done(desc, &walk, nbytes);
+ }
+-
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+ }
+ return ret;
+ }
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index 314eb1071cce..532545b9488e 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -141,6 +141,7 @@ reservation_object_add_shared_inplace(struct reservation_object *obj,
+ if (signaled) {
+ RCU_INIT_POINTER(fobj->shared[signaled_idx], fence);
+ } else {
++ BUG_ON(fobj->shared_count >= fobj->shared_max);
+ RCU_INIT_POINTER(fobj->shared[fobj->shared_count], fence);
+ fobj->shared_count++;
+ }
+@@ -230,10 +231,9 @@ void reservation_object_add_shared_fence(struct reservation_object *obj,
+ old = reservation_object_get_list(obj);
+ obj->staged = NULL;
+
+- if (!fobj) {
+- BUG_ON(old->shared_count >= old->shared_max);
++ if (!fobj)
+ reservation_object_add_shared_inplace(obj, old, fence);
+- } else
++ else
+ reservation_object_add_shared_replace(obj, old, fobj, fence);
+ }
+ EXPORT_SYMBOL(reservation_object_add_shared_fence);
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index af83ad58819c..b9d27c8fe57e 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -433,8 +433,8 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id)
+ return index;
+
+ spin_lock_irqsave(&edev->lock, flags);
+-
+ state = !!(edev->state & BIT(index));
++ spin_unlock_irqrestore(&edev->lock, flags);
+
+ /*
+ * Call functions in a raw notifier chain for the specific one
+@@ -448,6 +448,7 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id)
+ */
+ raw_notifier_call_chain(&edev->nh_all, state, edev);
+
++ spin_lock_irqsave(&edev->lock, flags);
+ /* This could be in interrupt handler */
+ prop_buf = (char *)get_zeroed_page(GFP_ATOMIC);
+ if (!prop_buf) {
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index ba0a092ae085..c3949220b770 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -558,11 +558,8 @@ static void reset_channel_cb(void *arg)
+ channel->onchannel_callback = NULL;
+ }
+
+-static int vmbus_close_internal(struct vmbus_channel *channel)
++void vmbus_reset_channel_cb(struct vmbus_channel *channel)
+ {
+- struct vmbus_channel_close_channel *msg;
+- int ret;
+-
+ /*
+ * vmbus_on_event(), running in the per-channel tasklet, can race
+ * with vmbus_close_internal() in the case of SMP guest, e.g., when
+@@ -572,6 +569,29 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ */
+ tasklet_disable(&channel->callback_event);
+
++ channel->sc_creation_callback = NULL;
++
++ /* Stop the callback asap */
++ if (channel->target_cpu != get_cpu()) {
++ put_cpu();
++ smp_call_function_single(channel->target_cpu, reset_channel_cb,
++ channel, true);
++ } else {
++ reset_channel_cb(channel);
++ put_cpu();
++ }
++
++ /* Re-enable tasklet for use on re-open */
++ tasklet_enable(&channel->callback_event);
++}
++
++static int vmbus_close_internal(struct vmbus_channel *channel)
++{
++ struct vmbus_channel_close_channel *msg;
++ int ret;
++
++ vmbus_reset_channel_cb(channel);
++
+ /*
+ * In case a device driver's probe() fails (e.g.,
+ * util_probe() -> vmbus_open() returns -ENOMEM) and the device is
+@@ -585,16 +605,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ }
+
+ channel->state = CHANNEL_OPEN_STATE;
+- channel->sc_creation_callback = NULL;
+- /* Stop callback and cancel the timer asap */
+- if (channel->target_cpu != get_cpu()) {
+- put_cpu();
+- smp_call_function_single(channel->target_cpu, reset_channel_cb,
+- channel, true);
+- } else {
+- reset_channel_cb(channel);
+- put_cpu();
+- }
+
+ /* Send a closing message */
+
+@@ -639,8 +649,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
+
+ out:
+- /* re-enable tasklet for use on re-open */
+- tasklet_enable(&channel->callback_event);
+ return ret;
+ }
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index ecc2bd275a73..0f0e091c117c 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -527,10 +527,8 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ struct hv_device *dev
+ = newchannel->primary_channel->device_obj;
+
+- if (vmbus_add_channel_kobj(dev, newchannel)) {
+- atomic_dec(&vmbus_connection.offer_in_progress);
++ if (vmbus_add_channel_kobj(dev, newchannel))
+ goto err_free_chan;
+- }
+
+ if (channel->sc_creation_callback != NULL)
+ channel->sc_creation_callback(newchannel);
+@@ -894,6 +892,12 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ return;
+ }
+
++ /*
++ * Before setting channel->rescind in vmbus_rescind_cleanup(), we
++ * should make sure the channel callback is not running any more.
++ */
++ vmbus_reset_channel_cb(channel);
++
+ /*
+ * Now wait for offer handling to complete.
+ */
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index 27436a937492..54b2a3a86677 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -693,7 +693,6 @@ int i2c_dw_probe(struct dw_i2c_dev *dev)
+ i2c_set_adapdata(adap, dev);
+
+ if (dev->pm_disabled) {
+- dev_pm_syscore_device(dev->dev, true);
+ irq_flags = IRQF_NO_SUSPEND;
+ } else {
+ irq_flags = IRQF_SHARED | IRQF_COND_SUSPEND;
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 5660daf6c92e..d281d21cdd8e 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -448,6 +448,9 @@ static int dw_i2c_plat_suspend(struct device *dev)
+ {
+ struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
+
++ if (i_dev->pm_disabled)
++ return 0;
++
+ i_dev->disable(i_dev);
+ i2c_dw_prepare_clk(i_dev, false);
+
+@@ -458,7 +461,9 @@ static int dw_i2c_plat_resume(struct device *dev)
+ {
+ struct dw_i2c_dev *i_dev = dev_get_drvdata(dev);
+
+- i2c_dw_prepare_clk(i_dev, true);
++ if (!i_dev->pm_disabled)
++ i2c_dw_prepare_clk(i_dev, true);
++
+ i_dev->init(i_dev);
+
+ return 0;
+diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c
+index 4dceb75e3586..4964561595f5 100644
+--- a/drivers/iio/accel/sca3000.c
++++ b/drivers/iio/accel/sca3000.c
+@@ -797,6 +797,7 @@ static int sca3000_write_raw(struct iio_dev *indio_dev,
+ mutex_lock(&st->lock);
+ ret = sca3000_write_3db_freq(st, val);
+ mutex_unlock(&st->lock);
++ return ret;
+ default:
+ return -EINVAL;
+ }
+diff --git a/drivers/iio/frequency/ad9523.c b/drivers/iio/frequency/ad9523.c
+index ddb6a334ae68..8e8263758439 100644
+--- a/drivers/iio/frequency/ad9523.c
++++ b/drivers/iio/frequency/ad9523.c
+@@ -508,7 +508,7 @@ static ssize_t ad9523_store(struct device *dev,
+ return ret;
+
+ if (!state)
+- return 0;
++ return len;
+
+ mutex_lock(&indio_dev->mlock);
+ switch ((u32)this_attr->address) {
+@@ -642,7 +642,7 @@ static int ad9523_read_raw(struct iio_dev *indio_dev,
+ code = (AD9523_CLK_DIST_DIV_PHASE_REV(ret) * 3141592) /
+ AD9523_CLK_DIST_DIV_REV(ret);
+ *val = code / 1000000;
+- *val2 = (code % 1000000) * 10;
++ *val2 = code % 1000000;
+ return IIO_VAL_INT_PLUS_MICRO;
+ default:
+ return -EINVAL;
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index b3ba9a222550..cbeae4509359 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -4694,7 +4694,7 @@ static void mlx5_ib_dealloc_counters(struct mlx5_ib_dev *dev)
+ int i;
+
+ for (i = 0; i < dev->num_ports; i++) {
+- if (dev->port[i].cnts.set_id)
++ if (dev->port[i].cnts.set_id_valid)
+ mlx5_core_dealloc_q_counter(dev->mdev,
+ dev->port[i].cnts.set_id);
+ kfree(dev->port[i].cnts.names);
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index a4f1f638509f..01eae67d5a6e 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -1626,7 +1626,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
+ struct mlx5_ib_resources *devr = &dev->devr;
+ int inlen = MLX5_ST_SZ_BYTES(create_qp_in);
+ struct mlx5_core_dev *mdev = dev->mdev;
+- struct mlx5_ib_create_qp_resp resp;
++ struct mlx5_ib_create_qp_resp resp = {};
+ struct mlx5_ib_cq *send_cq;
+ struct mlx5_ib_cq *recv_cq;
+ unsigned long flags;
+@@ -5365,7 +5365,9 @@ static int set_user_rq_size(struct mlx5_ib_dev *dev,
+
+ rwq->wqe_count = ucmd->rq_wqe_count;
+ rwq->wqe_shift = ucmd->rq_wqe_shift;
+- rwq->buf_size = (rwq->wqe_count << rwq->wqe_shift);
++ if (check_shl_overflow(rwq->wqe_count, rwq->wqe_shift, &rwq->buf_size))
++ return -EINVAL;
++
+ rwq->log_rq_stride = rwq->wqe_shift;
+ rwq->log_rq_size = ilog2(rwq->wqe_count);
+ return 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 98d470d1f3fc..83311dd07019 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -276,6 +276,7 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ if (wqe->wr.opcode != IB_WR_RDMA_READ &&
+ wqe->wr.opcode != IB_WR_RDMA_READ_WITH_INV) {
++ wqe->status = IB_WC_FATAL_ERR;
+ return COMPST_ERROR;
+ }
+ reset_retry_counters(qp);
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 3081c629a7f7..8a9633e97bec 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1833,8 +1833,7 @@ static bool srpt_close_ch(struct srpt_rdma_ch *ch)
+ int ret;
+
+ if (!srpt_set_ch_state(ch, CH_DRAINING)) {
+- pr_debug("%s-%d: already closed\n", ch->sess_name,
+- ch->qp->qp_num);
++ pr_debug("%s: already closed\n", ch->sess_name);
+ return false;
+ }
+
+@@ -1940,8 +1939,8 @@ static void __srpt_close_all_ch(struct srpt_port *sport)
+ list_for_each_entry(nexus, &sport->nexus_list, entry) {
+ list_for_each_entry(ch, &nexus->ch_list, list) {
+ if (srpt_disconnect_ch(ch) >= 0)
+- pr_info("Closing channel %s-%d because target %s_%d has been disabled\n",
+- ch->sess_name, ch->qp->qp_num,
++ pr_info("Closing channel %s because target %s_%d has been disabled\n",
++ ch->sess_name,
+ sport->sdev->device->name, sport->port);
+ srpt_close_ch(ch);
+ }
+@@ -2087,7 +2086,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ struct rdma_conn_param rdma_cm;
+ struct ib_cm_rep_param ib_cm;
+ } *rep_param = NULL;
+- struct srpt_rdma_ch *ch;
++ struct srpt_rdma_ch *ch = NULL;
+ char i_port_id[36];
+ u32 it_iu_len;
+ int i, ret;
+@@ -2234,13 +2233,15 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ TARGET_PROT_NORMAL,
+ i_port_id + 2, ch, NULL);
+ if (IS_ERR_OR_NULL(ch->sess)) {
++ WARN_ON_ONCE(ch->sess == NULL);
+ ret = PTR_ERR(ch->sess);
++ ch->sess = NULL;
+ pr_info("Rejected login for initiator %s: ret = %d.\n",
+ ch->sess_name, ret);
+ rej->reason = cpu_to_be32(ret == -ENOMEM ?
+ SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES :
+ SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
+- goto reject;
++ goto destroy_ib;
+ }
+
+ mutex_lock(&sport->mutex);
+@@ -2279,7 +2280,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+ pr_err("rejected SRP_LOGIN_REQ because enabling RTR failed (error code = %d)\n",
+ ret);
+- goto destroy_ib;
++ goto reject;
+ }
+
+ pr_debug("Establish connection sess=%p name=%s ch=%p\n", ch->sess,
+@@ -2358,8 +2359,11 @@ free_ring:
+ srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
+ ch->sport->sdev, ch->rq_size,
+ ch->max_rsp_size, DMA_TO_DEVICE);
++
+ free_ch:
+- if (ib_cm_id)
++ if (rdma_cm_id)
++ rdma_cm_id->context = NULL;
++ else
+ ib_cm_id->context = NULL;
+ kfree(ch);
+ ch = NULL;
+@@ -2379,6 +2383,15 @@ reject:
+ ib_send_cm_rej(ib_cm_id, IB_CM_REJ_CONSUMER_DEFINED, NULL, 0,
+ rej, sizeof(*rej));
+
++ if (ch && ch->sess) {
++ srpt_close_ch(ch);
++ /*
++ * Tell the caller not to free cm_id since
++ * srpt_release_channel_work() will do that.
++ */
++ ret = 0;
++ }
++
+ out:
+ kfree(rep_param);
+ kfree(rsp);
+@@ -2969,7 +2982,8 @@ static void srpt_add_one(struct ib_device *device)
+
+ pr_debug("device = %p\n", device);
+
+- sdev = kzalloc(sizeof(*sdev), GFP_KERNEL);
++ sdev = kzalloc(struct_size(sdev, port, device->phys_port_cnt),
++ GFP_KERNEL);
+ if (!sdev)
+ goto err;
+
+@@ -3023,8 +3037,6 @@ static void srpt_add_one(struct ib_device *device)
+ srpt_event_handler);
+ ib_register_event_handler(&sdev->event_handler);
+
+- WARN_ON(sdev->device->phys_port_cnt > ARRAY_SIZE(sdev->port));
+-
+ for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
+ sport = &sdev->port[i - 1];
+ INIT_LIST_HEAD(&sport->nexus_list);
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h
+index 2361483476a0..444dfd7281b5 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.h
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.h
+@@ -396,9 +396,9 @@ struct srpt_port {
+ * @sdev_mutex: Serializes use_srq changes.
+ * @use_srq: Whether or not to use SRQ.
+ * @ioctx_ring: Per-HCA SRQ.
+- * @port: Information about the ports owned by this HCA.
+ * @event_handler: Per-HCA asynchronous IB event handler.
+ * @list: Node in srpt_dev_list.
++ * @port: Information about the ports owned by this HCA.
+ */
+ struct srpt_device {
+ struct ib_device *device;
+@@ -410,9 +410,9 @@ struct srpt_device {
+ struct mutex sdev_mutex;
+ bool use_srq;
+ struct srpt_recv_ioctx **ioctx_ring;
+- struct srpt_port port[2];
+ struct ib_event_handler event_handler;
+ struct list_head list;
++ struct srpt_port port[];
+ };
+
+ #endif /* IB_SRPT_H */
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 75456b5aa825..d9c748b6f9e4 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1339,8 +1339,8 @@ void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
+ qi_submit_sync(&desc, iommu);
+ }
+
+-void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+- u64 addr, unsigned mask)
++void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
++ u16 qdep, u64 addr, unsigned mask)
+ {
+ struct qi_desc desc;
+
+@@ -1355,7 +1355,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+ qdep = 0;
+
+ desc.low = QI_DEV_IOTLB_SID(sid) | QI_DEV_IOTLB_QDEP(qdep) |
+- QI_DIOTLB_TYPE;
++ QI_DIOTLB_TYPE | QI_DEV_IOTLB_PFSID(pfsid);
+
+ qi_submit_sync(&desc, iommu);
+ }
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 115ff26e9ced..07dc938199f9 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -421,6 +421,7 @@ struct device_domain_info {
+ struct list_head global; /* link to global list */
+ u8 bus; /* PCI bus number */
+ u8 devfn; /* PCI devfn number */
++ u16 pfsid; /* SRIOV physical function source ID */
+ u8 pasid_supported:3;
+ u8 pasid_enabled:1;
+ u8 pri_supported:1;
+@@ -1501,6 +1502,20 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info)
+ return;
+
+ pdev = to_pci_dev(info->dev);
++ /* For IOMMU that supports device IOTLB throttling (DIT), we assign
++ * PFSID to the invalidation desc of a VF such that IOMMU HW can gauge
++ * queue depth at PF level. If DIT is not set, PFSID will be treated as
++ * reserved, which should be set to 0.
++ */
++ if (!ecap_dit(info->iommu->ecap))
++ info->pfsid = 0;
++ else {
++ struct pci_dev *pf_pdev;
++
++ /* pdev will be returned if device is not a vf */
++ pf_pdev = pci_physfn(pdev);
++ info->pfsid = PCI_DEVID(pf_pdev->bus->number, pf_pdev->devfn);
++ }
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ /* The PCIe spec, in its wisdom, declares that the behaviour of
+@@ -1566,7 +1581,8 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain,
+
+ sid = info->bus << 8 | info->devfn;
+ qdep = info->ats_qdep;
+- qi_flush_dev_iotlb(info->iommu, sid, qdep, addr, mask);
++ qi_flush_dev_iotlb(info->iommu, sid, info->pfsid,
++ qdep, addr, mask);
+ }
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+ }
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index 40ae6e87cb88..09b47260c74b 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -1081,12 +1081,19 @@ static struct platform_driver ipmmu_driver = {
+
+ static int __init ipmmu_init(void)
+ {
++ struct device_node *np;
+ static bool setup_done;
+ int ret;
+
+ if (setup_done)
+ return 0;
+
++ np = of_find_matching_node(NULL, ipmmu_of_ids);
++ if (!np)
++ return 0;
++
++ of_node_put(np);
++
+ ret = platform_driver_register(&ipmmu_driver);
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/mailbox/mailbox-xgene-slimpro.c b/drivers/mailbox/mailbox-xgene-slimpro.c
+index a7040163dd43..b8b2b3533f46 100644
+--- a/drivers/mailbox/mailbox-xgene-slimpro.c
++++ b/drivers/mailbox/mailbox-xgene-slimpro.c
+@@ -195,9 +195,9 @@ static int slimpro_mbox_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, ctx);
+
+ regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- mb_base = devm_ioremap(&pdev->dev, regs->start, resource_size(regs));
+- if (!mb_base)
+- return -ENOMEM;
++ mb_base = devm_ioremap_resource(&pdev->dev, regs);
++ if (IS_ERR(mb_base))
++ return PTR_ERR(mb_base);
+
+ /* Setup mailbox links */
+ for (i = 0; i < MBOX_CNT; i++) {
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index ad45ebe1a74b..6c33923c2c35 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -645,8 +645,10 @@ static int bch_writeback_thread(void *arg)
+ * data on cache. BCACHE_DEV_DETACHING flag is set in
+ * bch_cached_dev_detach().
+ */
+- if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) {
++ up_write(&dc->writeback_lock);
+ break;
++ }
+ }
+
+ up_write(&dc->writeback_lock);
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 0d7212410e21..69dddeab124c 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -363,7 +363,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
+ disk_super->version = cpu_to_le32(cmd->version);
+ memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
+ memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version));
+- disk_super->policy_hint_size = 0;
++ disk_super->policy_hint_size = cpu_to_le32(0);
+
+ __copy_sm_root(cmd, disk_super);
+
+@@ -701,6 +701,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
+ disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]);
+ disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]);
+ disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]);
++ disk_super->policy_hint_size = cpu_to_le32(cmd->policy_hint_size);
+
+ disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits);
+ disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses);
+@@ -1322,6 +1323,7 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd,
+
+ dm_oblock_t oblock;
+ unsigned flags;
++ bool dirty = true;
+
+ dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le);
+ memcpy(&mapping, mapping_value_le, sizeof(mapping));
+@@ -1332,8 +1334,10 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd,
+ dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le);
+ memcpy(&hint, hint_value_le, sizeof(hint));
+ }
++ if (cmd->clean_when_opened)
++ dirty = flags & M_DIRTY;
+
+- r = fn(context, oblock, to_cblock(cb), flags & M_DIRTY,
++ r = fn(context, oblock, to_cblock(cb), dirty,
+ le32_to_cpu(hint), hints_valid);
+ if (r) {
+ DMERR("policy couldn't load cache block %llu",
+@@ -1361,7 +1365,7 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd,
+
+ dm_oblock_t oblock;
+ unsigned flags;
+- bool dirty;
++ bool dirty = true;
+
+ dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le);
+ memcpy(&mapping, mapping_value_le, sizeof(mapping));
+@@ -1372,8 +1376,9 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd,
+ dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le);
+ memcpy(&hint, hint_value_le, sizeof(hint));
+ }
++ if (cmd->clean_when_opened)
++ dirty = dm_bitset_cursor_get_value(dirty_cursor);
+
+- dirty = dm_bitset_cursor_get_value(dirty_cursor);
+ r = fn(context, oblock, to_cblock(cb), dirty,
+ le32_to_cpu(hint), hints_valid);
+ if (r) {
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index b61b069c33af..3fdec1147221 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -3069,11 +3069,11 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ */
+ limits->max_segment_size = PAGE_SIZE;
+
+- if (cc->sector_size != (1 << SECTOR_SHIFT)) {
+- limits->logical_block_size = cc->sector_size;
+- limits->physical_block_size = cc->sector_size;
+- blk_limits_io_min(limits, cc->sector_size);
+- }
++ limits->logical_block_size =
++ max_t(unsigned short, limits->logical_block_size, cc->sector_size);
++ limits->physical_block_size =
++ max_t(unsigned, limits->physical_block_size, cc->sector_size);
++ limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
+ }
+
+ static struct target_type crypt_target = {
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 86438b2f10dd..0a8a4c2aa3ea 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -178,7 +178,7 @@ struct dm_integrity_c {
+ __u8 sectors_per_block;
+
+ unsigned char mode;
+- bool suspending;
++ int suspending;
+
+ int failed;
+
+@@ -2210,7 +2210,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+
+ del_timer_sync(&ic->autocommit_timer);
+
+- ic->suspending = true;
++ WRITE_ONCE(ic->suspending, 1);
+
+ queue_work(ic->commit_wq, &ic->commit_work);
+ drain_workqueue(ic->commit_wq);
+@@ -2220,7 +2220,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ dm_integrity_flush_buffers(ic);
+ }
+
+- ic->suspending = false;
++ WRITE_ONCE(ic->suspending, 0);
+
+ BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index b900723bbd0f..1087f6a1ac79 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2520,6 +2520,8 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ case PM_WRITE:
+ if (old_mode != new_mode)
+ notify_of_pool_mode_change(pool, "write");
++ if (old_mode == PM_OUT_OF_DATA_SPACE)
++ cancel_delayed_work_sync(&pool->no_space_timeout);
+ pool->out_of_data_space = false;
+ pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
+ dm_pool_metadata_read_write(pool->pmd);
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 87107c995cb5..7669069005e9 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc)
+ COMPLETION_INITIALIZER_ONSTACK(endio.c),
+ ATOMIC_INIT(1),
+ };
+- unsigned bitmap_bits = wc->dirty_bitmap_size * BITS_PER_LONG;
++ unsigned bitmap_bits = wc->dirty_bitmap_size * 8;
+ unsigned i = 0;
+
+ while (1) {
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index b162c2fe62c3..76e6bed5a1da 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -872,7 +872,7 @@ static int tvp5150_fill_fmt(struct v4l2_subdev *sd,
+ f = &format->format;
+
+ f->width = decoder->rect.width;
+- f->height = decoder->rect.height;
++ f->height = decoder->rect.height / 2;
+
+ f->code = MEDIA_BUS_FMT_UYVY8_2X8;
+ f->field = V4L2_FIELD_ALTERNATE;
+diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
+index c37ccbfd52f2..96c07fa1802a 100644
+--- a/drivers/mfd/hi655x-pmic.c
++++ b/drivers/mfd/hi655x-pmic.c
+@@ -49,7 +49,7 @@ static struct regmap_config hi655x_regmap_config = {
+ .reg_bits = 32,
+ .reg_stride = HI655X_STRIDE,
+ .val_bits = 8,
+- .max_register = HI655X_BUS_ADDR(0xFFF),
++ .max_register = HI655X_BUS_ADDR(0x400) - HI655X_STRIDE,
+ };
+
+ static struct resource pwrkey_resources[] = {
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index c1ba0d42cbc8..e0f29b8a872d 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -287,7 +287,7 @@ int cxl_adapter_context_get(struct cxl *adapter)
+ int rc;
+
+ rc = atomic_inc_unless_negative(&adapter->contexts_num);
+- return rc >= 0 ? 0 : -EBUSY;
++ return rc ? 0 : -EBUSY;
+ }
+
+ void cxl_adapter_context_put(struct cxl *adapter)
+diff --git a/drivers/misc/ocxl/link.c b/drivers/misc/ocxl/link.c
+index 88876ae8f330..a963b0a4a3c5 100644
+--- a/drivers/misc/ocxl/link.c
++++ b/drivers/misc/ocxl/link.c
+@@ -136,7 +136,7 @@ static void xsl_fault_handler_bh(struct work_struct *fault_work)
+ int rc;
+
+ /*
+- * We need to release a reference on the mm whenever exiting this
++ * We must release a reference on mm_users whenever exiting this
+ * function (taken in the memory fault interrupt handler)
+ */
+ rc = copro_handle_mm_fault(fault->pe_data.mm, fault->dar, fault->dsisr,
+@@ -172,7 +172,7 @@ static void xsl_fault_handler_bh(struct work_struct *fault_work)
+ }
+ r = RESTART;
+ ack:
+- mmdrop(fault->pe_data.mm);
++ mmput(fault->pe_data.mm);
+ ack_irq(spa, r);
+ }
+
+@@ -184,6 +184,7 @@ static irqreturn_t xsl_fault_handler(int irq, void *data)
+ struct pe_data *pe_data;
+ struct ocxl_process_element *pe;
+ int lpid, pid, tid;
++ bool schedule = false;
+
+ read_irq(spa, &dsisr, &dar, &pe_handle);
+ trace_ocxl_fault(spa->spa_mem, pe_handle, dsisr, dar, -1);
+@@ -226,14 +227,19 @@ static irqreturn_t xsl_fault_handler(int irq, void *data)
+ }
+ WARN_ON(pe_data->mm->context.id != pid);
+
+- spa->xsl_fault.pe = pe_handle;
+- spa->xsl_fault.dar = dar;
+- spa->xsl_fault.dsisr = dsisr;
+- spa->xsl_fault.pe_data = *pe_data;
+- mmgrab(pe_data->mm); /* mm count is released by bottom half */
+-
++ if (mmget_not_zero(pe_data->mm)) {
++ spa->xsl_fault.pe = pe_handle;
++ spa->xsl_fault.dar = dar;
++ spa->xsl_fault.dsisr = dsisr;
++ spa->xsl_fault.pe_data = *pe_data;
++ schedule = true;
++ /* mm_users count released by bottom half */
++ }
+ rcu_read_unlock();
+- schedule_work(&spa->xsl_fault.fault_work);
++ if (schedule)
++ schedule_work(&spa->xsl_fault.fault_work);
++ else
++ ack_irq(spa, ADDRESS_ERROR);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
+index 56c6f79a5c5a..5f8b583c6e41 100644
+--- a/drivers/misc/vmw_balloon.c
++++ b/drivers/misc/vmw_balloon.c
+@@ -341,7 +341,13 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps)
+ success = false;
+ }
+
+- if (b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS)
++ /*
++ * 2MB pages are only supported with batching. If batching is for some
++ * reason disabled, do not use 2MB pages, since otherwise the legacy
++ * mechanism is used with 2MB pages, causing a failure.
++ */
++ if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) &&
++ (b->capabilities & VMW_BALLOON_BATCHED_CMDS))
+ b->supported_page_sizes = 2;
+ else
+ b->supported_page_sizes = 1;
+@@ -450,7 +456,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
+
+ pfn32 = (u32)pfn;
+ if (pfn32 != pfn)
+- return -1;
++ return -EINVAL;
+
+ STATS_INC(b->stats.lock[false]);
+
+@@ -460,7 +466,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
+
+ pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+ STATS_INC(b->stats.lock_fail[false]);
+- return 1;
++ return -EIO;
+ }
+
+ static int vmballoon_send_batched_lock(struct vmballoon *b,
+@@ -597,11 +603,12 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages,
+
+ locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status,
+ target);
+- if (locked > 0) {
++ if (locked) {
+ STATS_INC(b->stats.refused_alloc[false]);
+
+- if (hv_status == VMW_BALLOON_ERROR_RESET ||
+- hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED) {
++ if (locked == -EIO &&
++ (hv_status == VMW_BALLOON_ERROR_RESET ||
++ hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) {
+ vmballoon_free_page(page, false);
+ return -EIO;
+ }
+@@ -617,7 +624,7 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages,
+ } else {
+ vmballoon_free_page(page, false);
+ }
+- return -EIO;
++ return locked;
+ }
+
+ /* track allocated page */
+@@ -1029,29 +1036,30 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b)
+ */
+ static int vmballoon_vmci_init(struct vmballoon *b)
+ {
+- int error = 0;
++ unsigned long error, dummy;
+
+- if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) != 0) {
+- error = vmci_doorbell_create(&b->vmci_doorbell,
+- VMCI_FLAG_DELAYED_CB,
+- VMCI_PRIVILEGE_FLAG_RESTRICTED,
+- vmballoon_doorbell, b);
+-
+- if (error == VMCI_SUCCESS) {
+- VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET,
+- b->vmci_doorbell.context,
+- b->vmci_doorbell.resource, error);
+- STATS_INC(b->stats.doorbell_set);
+- }
+- }
++ if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0)
++ return 0;
+
+- if (error != 0) {
+- vmballoon_vmci_cleanup(b);
++ error = vmci_doorbell_create(&b->vmci_doorbell, VMCI_FLAG_DELAYED_CB,
++ VMCI_PRIVILEGE_FLAG_RESTRICTED,
++ vmballoon_doorbell, b);
+
+- return -EIO;
+- }
++ if (error != VMCI_SUCCESS)
++ goto fail;
++
++ error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context,
++ b->vmci_doorbell.resource, dummy);
++
++ STATS_INC(b->stats.doorbell_set);
++
++ if (error != VMW_BALLOON_SUCCESS)
++ goto fail;
+
+ return 0;
++fail:
++ vmballoon_vmci_cleanup(b);
++ return -EIO;
+ }
+
+ /*
+@@ -1289,7 +1297,14 @@ static int __init vmballoon_init(void)
+
+ return 0;
+ }
+-module_init(vmballoon_init);
++
++/*
++ * Using late_initcall() instead of module_init() allows the balloon to use the
++ * VMCI doorbell even when the balloon is built into the kernel. Otherwise the
++ * VMCI is probed only after the balloon is initialized. If the balloon is used
++ * as a module, late_initcall() is equivalent to module_init().
++ */
++late_initcall(vmballoon_init);
+
+ static void __exit vmballoon_exit(void)
+ {
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 648eb6743ed5..6edffeed9953 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -238,10 +238,6 @@ static void mmc_mq_exit_request(struct blk_mq_tag_set *set, struct request *req,
+ mmc_exit_request(mq->queue, req);
+ }
+
+-/*
+- * We use BLK_MQ_F_BLOCKING and have only 1 hardware queue, which means requests
+- * will not be dispatched in parallel.
+- */
+ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
+ const struct blk_mq_queue_data *bd)
+ {
+@@ -264,7 +260,7 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
+
+ spin_lock_irq(q->queue_lock);
+
+- if (mq->recovery_needed) {
++ if (mq->recovery_needed || mq->busy) {
+ spin_unlock_irq(q->queue_lock);
+ return BLK_STS_RESOURCE;
+ }
+@@ -291,6 +287,9 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
+ break;
+ }
+
++ /* Parallel dispatch of requests is not supported at the moment */
++ mq->busy = true;
++
+ mq->in_flight[issue_type] += 1;
+ get_card = (mmc_tot_in_flight(mq) == 1);
+ cqe_retune_ok = (mmc_cqe_qcnt(mq) == 1);
+@@ -333,9 +332,12 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
+ mq->in_flight[issue_type] -= 1;
+ if (mmc_tot_in_flight(mq) == 0)
+ put_card = true;
++ mq->busy = false;
+ spin_unlock_irq(q->queue_lock);
+ if (put_card)
+ mmc_put_card(card, &mq->ctx);
++ } else {
++ WRITE_ONCE(mq->busy, false);
+ }
+
+ return ret;
+diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
+index 17e59d50b496..9bf3c9245075 100644
+--- a/drivers/mmc/core/queue.h
++++ b/drivers/mmc/core/queue.h
+@@ -81,6 +81,7 @@ struct mmc_queue {
+ unsigned int cqe_busy;
+ #define MMC_CQE_DCMD_BUSY BIT(0)
+ #define MMC_CQE_QUEUE_FULL BIT(1)
++ bool busy;
+ bool use_cqe;
+ bool recovery_needed;
+ bool in_recovery;
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index d032bd63444d..4a7991151918 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -45,14 +45,16 @@
+ /* DM_CM_RST */
+ #define RST_DTRANRST1 BIT(9)
+ #define RST_DTRANRST0 BIT(8)
+-#define RST_RESERVED_BITS GENMASK_ULL(32, 0)
++#define RST_RESERVED_BITS GENMASK_ULL(31, 0)
+
+ /* DM_CM_INFO1 and DM_CM_INFO1_MASK */
+ #define INFO1_CLEAR 0
++#define INFO1_MASK_CLEAR GENMASK_ULL(31, 0)
+ #define INFO1_DTRANEND1 BIT(17)
+ #define INFO1_DTRANEND0 BIT(16)
+
+ /* DM_CM_INFO2 and DM_CM_INFO2_MASK */
++#define INFO2_MASK_CLEAR GENMASK_ULL(31, 0)
+ #define INFO2_DTRANERR1 BIT(17)
+ #define INFO2_DTRANERR0 BIT(16)
+
+@@ -236,6 +238,12 @@ renesas_sdhi_internal_dmac_request_dma(struct tmio_mmc_host *host,
+ {
+ struct renesas_sdhi *priv = host_to_priv(host);
+
++ /* Disable DMAC interrupts, we don't use them */
++ renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO1_MASK,
++ INFO1_MASK_CLEAR);
++ renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO2_MASK,
++ INFO2_MASK_CLEAR);
++
+ /* Each value is set to non-zero to assume "enabling" each DMA */
+ host->chan_rx = host->chan_tx = (void *)0xdeadbeaf;
+
+diff --git a/drivers/net/wireless/marvell/libertas/dev.h b/drivers/net/wireless/marvell/libertas/dev.h
+index dd1ee1f0af48..469134930026 100644
+--- a/drivers/net/wireless/marvell/libertas/dev.h
++++ b/drivers/net/wireless/marvell/libertas/dev.h
+@@ -104,6 +104,7 @@ struct lbs_private {
+ u8 fw_ready;
+ u8 surpriseremoved;
+ u8 setup_fw_on_resume;
++ u8 power_up_on_resume;
+ int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb);
+ void (*reset_card) (struct lbs_private *priv);
+ int (*power_save) (struct lbs_private *priv);
+diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
+index 2300e796c6ab..43743c26c071 100644
+--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
+@@ -1290,15 +1290,23 @@ static void if_sdio_remove(struct sdio_func *func)
+ static int if_sdio_suspend(struct device *dev)
+ {
+ struct sdio_func *func = dev_to_sdio_func(dev);
+- int ret;
+ struct if_sdio_card *card = sdio_get_drvdata(func);
++ struct lbs_private *priv = card->priv;
++ int ret;
+
+ mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
++ priv->power_up_on_resume = false;
+
+ /* If we're powered off anyway, just let the mmc layer remove the
+ * card. */
+- if (!lbs_iface_active(card->priv))
+- return -ENOSYS;
++ if (!lbs_iface_active(priv)) {
++ if (priv->fw_ready) {
++ priv->power_up_on_resume = true;
++ if_sdio_power_off(card);
++ }
++
++ return 0;
++ }
+
+ dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
+ sdio_func_id(func), flags);
+@@ -1306,9 +1314,14 @@ static int if_sdio_suspend(struct device *dev)
+ /* If we aren't being asked to wake on anything, we should bail out
+ * and let the SD stack power down the card.
+ */
+- if (card->priv->wol_criteria == EHS_REMOVE_WAKEUP) {
++ if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
+ dev_info(dev, "Suspend without wake params -- powering down card\n");
+- return -ENOSYS;
++ if (priv->fw_ready) {
++ priv->power_up_on_resume = true;
++ if_sdio_power_off(card);
++ }
++
++ return 0;
+ }
+
+ if (!(flags & MMC_PM_KEEP_POWER)) {
+@@ -1321,7 +1334,7 @@ static int if_sdio_suspend(struct device *dev)
+ if (ret)
+ return ret;
+
+- ret = lbs_suspend(card->priv);
++ ret = lbs_suspend(priv);
+ if (ret)
+ return ret;
+
+@@ -1336,6 +1349,11 @@ static int if_sdio_resume(struct device *dev)
+
+ dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func));
+
++ if (card->priv->power_up_on_resume) {
++ if_sdio_power_on(card);
++ wait_event(card->pwron_waitq, card->priv->fw_ready);
++ }
++
+ ret = lbs_resume(card->priv);
+
+ return ret;
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 27902a8799b1..8aae6dcc839f 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
+ * overshoots the remainder by 4 bytes, assume it was
+ * including 'status'.
+ */
+- if (out_field[1] - 8 == remainder)
++ if (out_field[1] - 4 == remainder)
+ return remainder;
+- return out_field[1] - 4;
++ return out_field[1] - 8;
+ } else if (cmd == ND_CMD_CALL) {
+ struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
+
+diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
+index 8d348b22ba45..863cabc35215 100644
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -536,6 +536,37 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region)
+ return info.available;
+ }
+
++/**
++ * nd_pmem_max_contiguous_dpa - For the given dimm+region, return the max
++ * contiguous unallocated dpa range.
++ * @nd_region: constrain available space check to this reference region
++ * @nd_mapping: container of dpa-resource-root + labels
++ */
++resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region,
++ struct nd_mapping *nd_mapping)
++{
++ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
++ struct nvdimm_bus *nvdimm_bus;
++ resource_size_t max = 0;
++ struct resource *res;
++
++ /* if a dimm is disabled the available capacity is zero */
++ if (!ndd)
++ return 0;
++
++ nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
++ if (__reserve_free_pmem(&nd_region->dev, nd_mapping->nvdimm))
++ return 0;
++ for_each_dpa_resource(ndd, res) {
++ if (strcmp(res->name, "pmem-reserve") != 0)
++ continue;
++ if (resource_size(res) > max)
++ max = resource_size(res);
++ }
++ release_free_pmem(nvdimm_bus, nd_mapping);
++ return max;
++}
++
+ /**
+ * nd_pmem_available_dpa - for the given dimm+region account unallocated dpa
+ * @nd_mapping: container of dpa-resource-root + labels
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 28afdd668905..4525d8ef6022 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -799,7 +799,7 @@ static int merge_dpa(struct nd_region *nd_region,
+ return 0;
+ }
+
+-static int __reserve_free_pmem(struct device *dev, void *data)
++int __reserve_free_pmem(struct device *dev, void *data)
+ {
+ struct nvdimm *nvdimm = data;
+ struct nd_region *nd_region;
+@@ -836,7 +836,7 @@ static int __reserve_free_pmem(struct device *dev, void *data)
+ return 0;
+ }
+
+-static void release_free_pmem(struct nvdimm_bus *nvdimm_bus,
++void release_free_pmem(struct nvdimm_bus *nvdimm_bus,
+ struct nd_mapping *nd_mapping)
+ {
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+@@ -1032,7 +1032,7 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+
+ allocated += nvdimm_allocated_dpa(ndd, &label_id);
+ }
+- available = nd_region_available_dpa(nd_region);
++ available = nd_region_allocatable_dpa(nd_region);
+
+ if (val > available + allocated)
+ return -ENOSPC;
+diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
+index 79274ead54fb..ac68072fb8cd 100644
+--- a/drivers/nvdimm/nd-core.h
++++ b/drivers/nvdimm/nd-core.h
+@@ -100,6 +100,14 @@ struct nd_region;
+ struct nvdimm_drvdata;
+ struct nd_mapping;
+ void nd_mapping_free_labels(struct nd_mapping *nd_mapping);
++
++int __reserve_free_pmem(struct device *dev, void *data);
++void release_free_pmem(struct nvdimm_bus *nvdimm_bus,
++ struct nd_mapping *nd_mapping);
++
++resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region,
++ struct nd_mapping *nd_mapping);
++resource_size_t nd_region_allocatable_dpa(struct nd_region *nd_region);
+ resource_size_t nd_pmem_available_dpa(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, resource_size_t *overlap);
+ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region);
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index ec3543b83330..c30d5af02cc2 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -389,6 +389,30 @@ resource_size_t nd_region_available_dpa(struct nd_region *nd_region)
+ return available;
+ }
+
++resource_size_t nd_region_allocatable_dpa(struct nd_region *nd_region)
++{
++ resource_size_t available = 0;
++ int i;
++
++ if (is_memory(&nd_region->dev))
++ available = PHYS_ADDR_MAX;
++
++ WARN_ON(!is_nvdimm_bus_locked(&nd_region->dev));
++ for (i = 0; i < nd_region->ndr_mappings; i++) {
++ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
++
++ if (is_memory(&nd_region->dev))
++ available = min(available,
++ nd_pmem_max_contiguous_dpa(nd_region,
++ nd_mapping));
++ else if (is_nd_blk(&nd_region->dev))
++ available += nd_blk_available_dpa(nd_region);
++ }
++ if (is_memory(&nd_region->dev))
++ return available * nd_region->ndr_mappings;
++ return available;
++}
++
+ static ssize_t available_size_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 665da3c8fbce..f45798679e3c 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -264,8 +264,9 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+
+ timer_pdata = dev_get_platdata(&timer_pdev->dev);
+ if (!timer_pdata) {
+- dev_err(&pdev->dev, "dmtimer pdata structure NULL\n");
+- ret = -EINVAL;
++ dev_dbg(&pdev->dev,
++ "dmtimer pdata structure NULL, deferring probe\n");
++ ret = -EPROBE_DEFER;
+ goto put;
+ }
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 4c22cb395040..f7b8a86fa5c5 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -33,10 +33,6 @@
+ #define TBCTL 0x00
+ #define TBPRD 0x0A
+
+-#define TBCTL_RUN_MASK (BIT(15) | BIT(14))
+-#define TBCTL_STOP_NEXT 0
+-#define TBCTL_STOP_ON_CYCLE BIT(14)
+-#define TBCTL_FREE_RUN (BIT(15) | BIT(14))
+ #define TBCTL_PRDLD_MASK BIT(3)
+ #define TBCTL_PRDLD_SHDW 0
+ #define TBCTL_PRDLD_IMDT BIT(3)
+@@ -360,7 +356,7 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ /* Channels polarity can be configured from action qualifier module */
+ configure_polarity(pc, pwm->hwpwm);
+
+- /* Enable TBCLK before enabling PWM device */
++ /* Enable TBCLK */
+ ret = clk_enable(pc->tbclk);
+ if (ret) {
+ dev_err(chip->dev, "Failed to enable TBCLK for %s: %d\n",
+@@ -368,9 +364,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ return ret;
+ }
+
+- /* Enable time counter for free_run */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_FREE_RUN);
+-
+ return 0;
+ }
+
+@@ -388,6 +381,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ aqcsfrc_mask = AQCSFRC_CSFA_MASK;
+ }
+
++ /* Update shadow register first before modifying active register */
++ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ /*
+ * Changes to immediate action on Action Qualifier. This puts
+ * Action Qualifier control on PWM output from next TBCLK
+@@ -400,9 +395,6 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ /* Disabling TBCLK on PWM disable */
+ clk_disable(pc->tbclk);
+
+- /* Stop Time base counter */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_STOP_NEXT);
+-
+ /* Disable clock on PWM disable */
+ pm_runtime_put_sync(chip->dev);
+ }
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index 39086398833e..6a7b804c3074 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -861,13 +861,6 @@ static int omap_rtc_probe(struct platform_device *pdev)
+ goto err;
+ }
+
+- if (rtc->is_pmic_controller) {
+- if (!pm_power_off) {
+- omap_rtc_power_off_rtc = rtc;
+- pm_power_off = omap_rtc_power_off;
+- }
+- }
+-
+ /* Support ext_wakeup pinconf */
+ rtc_pinctrl_desc.name = dev_name(&pdev->dev);
+
+@@ -880,12 +873,21 @@ static int omap_rtc_probe(struct platform_device *pdev)
+
+ ret = rtc_register_device(rtc->rtc);
+ if (ret)
+- goto err;
++ goto err_deregister_pinctrl;
+
+ rtc_nvmem_register(rtc->rtc, &omap_rtc_nvmem_config);
+
++ if (rtc->is_pmic_controller) {
++ if (!pm_power_off) {
++ omap_rtc_power_off_rtc = rtc;
++ pm_power_off = omap_rtc_power_off;
++ }
++ }
++
+ return 0;
+
++err_deregister_pinctrl:
++ pinctrl_unregister(rtc->pctldev);
+ err:
+ clk_disable_unprepare(rtc->clk);
+ device_init_wakeup(&pdev->dev, false);
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index f3dad6fcdc35..a568f35522f9 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -319,7 +319,7 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi)
+ */
+ if (cdns_spi_read(xspi, CDNS_SPI_ISR) &
+ CDNS_SPI_IXR_TXFULL)
+- usleep_range(10, 20);
++ udelay(10);
+
+ if (xspi->txbuf)
+ cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++);
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index 577084bb911b..a02099c90c5c 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -217,7 +217,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
+ pdata = &dspi->pdata;
+
+ /* program delay transfers if tx_delay is non zero */
+- if (spicfg->wdelay)
++ if (spicfg && spicfg->wdelay)
+ spidat1 |= SPIDAT1_WDEL;
+
+ /*
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 0630962ce442..f225f7c99a32 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1029,30 +1029,30 @@ static int dspi_probe(struct platform_device *pdev)
+ goto out_master_put;
+ }
+
++ dspi->clk = devm_clk_get(&pdev->dev, "dspi");
++ if (IS_ERR(dspi->clk)) {
++ ret = PTR_ERR(dspi->clk);
++ dev_err(&pdev->dev, "unable to get clock\n");
++ goto out_master_put;
++ }
++ ret = clk_prepare_enable(dspi->clk);
++ if (ret)
++ goto out_master_put;
++
+ dspi_init(dspi);
+ dspi->irq = platform_get_irq(pdev, 0);
+ if (dspi->irq < 0) {
+ dev_err(&pdev->dev, "can't get platform irq\n");
+ ret = dspi->irq;
+- goto out_master_put;
++ goto out_clk_put;
+ }
+
+ ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt, 0,
+ pdev->name, dspi);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n");
+- goto out_master_put;
+- }
+-
+- dspi->clk = devm_clk_get(&pdev->dev, "dspi");
+- if (IS_ERR(dspi->clk)) {
+- ret = PTR_ERR(dspi->clk);
+- dev_err(&pdev->dev, "unable to get clock\n");
+- goto out_master_put;
++ goto out_clk_put;
+ }
+- ret = clk_prepare_enable(dspi->clk);
+- if (ret)
+- goto out_master_put;
+
+ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE) {
+ ret = dspi_request_dma(dspi, res->start);
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 0b2d60d30f69..14f4ea59caff 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1391,6 +1391,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+ { PCI_VDEVICE(INTEL, 0x31c2), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x31c4), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x31c6), LPSS_BXT_SSP },
++ /* ICL-LP */
++ { PCI_VDEVICE(INTEL, 0x34aa), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0x34ab), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0x34fb), LPSS_CNL_SSP },
+ /* APL */
+ { PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP },
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 9c14a453f73c..80bb56facfb6 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -182,6 +182,7 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ {
+ struct uart_port *uport = uart_port_check(state);
+ unsigned long page;
++ unsigned long flags = 0;
+ int retval = 0;
+
+ if (uport->type == PORT_UNKNOWN)
+@@ -196,15 +197,18 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ * Initialise and allocate the transmit and temporary
+ * buffer.
+ */
+- if (!state->xmit.buf) {
+- /* This is protected by the per port mutex */
+- page = get_zeroed_page(GFP_KERNEL);
+- if (!page)
+- return -ENOMEM;
++ page = get_zeroed_page(GFP_KERNEL);
++ if (!page)
++ return -ENOMEM;
+
++ uart_port_lock(state, flags);
++ if (!state->xmit.buf) {
+ state->xmit.buf = (unsigned char *) page;
+ uart_circ_clear(&state->xmit);
++ } else {
++ free_page(page);
+ }
++ uart_port_unlock(uport, flags);
+
+ retval = uport->ops->startup(uport);
+ if (retval == 0) {
+@@ -263,6 +267,7 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ {
+ struct uart_port *uport = uart_port_check(state);
+ struct tty_port *port = &state->port;
++ unsigned long flags = 0;
+
+ /*
+ * Set the TTY IO error marker
+@@ -295,10 +300,12 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ /*
+ * Free the transmit buffer page.
+ */
++ uart_port_lock(state, flags);
+ if (state->xmit.buf) {
+ free_page((unsigned long)state->xmit.buf);
+ state->xmit.buf = NULL;
+ }
++ uart_port_unlock(uport, flags);
+ }
+
+ /**
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index 609438d2465b..9ae2fb1344de 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1704,12 +1704,12 @@ static int do_register_framebuffer(struct fb_info *fb_info)
+ return 0;
+ }
+
+-static int do_unregister_framebuffer(struct fb_info *fb_info)
++static int unbind_console(struct fb_info *fb_info)
+ {
+ struct fb_event event;
+- int i, ret = 0;
++ int ret;
++ int i = fb_info->node;
+
+- i = fb_info->node;
+ if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info)
+ return -EINVAL;
+
+@@ -1724,17 +1724,29 @@ static int do_unregister_framebuffer(struct fb_info *fb_info)
+ unlock_fb_info(fb_info);
+ console_unlock();
+
++ return ret;
++}
++
++static int __unlink_framebuffer(struct fb_info *fb_info);
++
++static int do_unregister_framebuffer(struct fb_info *fb_info)
++{
++ struct fb_event event;
++ int ret;
++
++ ret = unbind_console(fb_info);
++
+ if (ret)
+ return -EINVAL;
+
+ pm_vt_switch_unregister(fb_info->dev);
+
+- unlink_framebuffer(fb_info);
++ __unlink_framebuffer(fb_info);
+ if (fb_info->pixmap.addr &&
+ (fb_info->pixmap.flags & FB_PIXMAP_DEFAULT))
+ kfree(fb_info->pixmap.addr);
+ fb_destroy_modelist(&fb_info->modelist);
+- registered_fb[i] = NULL;
++ registered_fb[fb_info->node] = NULL;
+ num_registered_fb--;
+ fb_cleanup_device(fb_info);
+ event.info = fb_info;
+@@ -1747,7 +1759,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info)
+ return 0;
+ }
+
+-int unlink_framebuffer(struct fb_info *fb_info)
++static int __unlink_framebuffer(struct fb_info *fb_info)
+ {
+ int i;
+
+@@ -1759,6 +1771,20 @@ int unlink_framebuffer(struct fb_info *fb_info)
+ device_destroy(fb_class, MKDEV(FB_MAJOR, i));
+ fb_info->dev = NULL;
+ }
++
++ return 0;
++}
++
++int unlink_framebuffer(struct fb_info *fb_info)
++{
++ int ret;
++
++ ret = __unlink_framebuffer(fb_info);
++ if (ret)
++ return ret;
++
++ unbind_console(fb_info);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(unlink_framebuffer);
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index f365d4862015..862e8027acf6 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -27,6 +27,7 @@
+ #include <linux/slab.h>
+ #include <linux/prefetch.h>
+ #include <linux/delay.h>
++#include <asm/unaligned.h>
+ #include <video/udlfb.h>
+ #include "edid.h"
+
+@@ -450,17 +451,17 @@ static void dlfb_compress_hline(
+ raw_pixels_count_byte = cmd++; /* we'll know this later */
+ raw_pixel_start = pixel;
+
+- cmd_pixel_end = pixel + min(MAX_CMD_PIXELS + 1,
+- min((int)(pixel_end - pixel),
+- (int)(cmd_buffer_end - cmd) / BPP));
++ cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL,
++ (unsigned long)(pixel_end - pixel),
++ (unsigned long)(cmd_buffer_end - 1 - cmd) / BPP);
+
+- prefetch_range((void *) pixel, (cmd_pixel_end - pixel) * BPP);
++ prefetch_range((void *) pixel, (u8 *)cmd_pixel_end - (u8 *)pixel);
+
+ while (pixel < cmd_pixel_end) {
+ const uint16_t * const repeating_pixel = pixel;
+
+- *cmd++ = *pixel >> 8;
+- *cmd++ = *pixel;
++ put_unaligned_be16(*pixel, cmd);
++ cmd += 2;
+ pixel++;
+
+ if (unlikely((pixel < cmd_pixel_end) &&
+@@ -486,13 +487,16 @@ static void dlfb_compress_hline(
+ if (pixel > raw_pixel_start) {
+ /* finalize last RAW span */
+ *raw_pixels_count_byte = (pixel-raw_pixel_start) & 0xFF;
++ } else {
++ /* undo unused byte */
++ cmd--;
+ }
+
+ *cmd_pixels_count_byte = (pixel - cmd_pixel_start) & 0xFF;
+- dev_addr += (pixel - cmd_pixel_start) * BPP;
++ dev_addr += (u8 *)pixel - (u8 *)cmd_pixel_start;
+ }
+
+- if (cmd_buffer_end <= MIN_RLX_CMD_BYTES + cmd) {
++ if (cmd_buffer_end - MIN_RLX_CMD_BYTES <= cmd) {
+ /* Fill leftover bytes with no-ops */
+ if (cmd_buffer_end > cmd)
+ memset(cmd, 0xAF, cmd_buffer_end - cmd);
+@@ -610,8 +614,11 @@ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+ }
+
+ if (cmd > (char *) urb->transfer_buffer) {
++ int len;
++ if (cmd < (char *) urb->transfer_buffer + urb->transfer_buffer_length)
++ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+- int len = cmd - (char *) urb->transfer_buffer;
++ len = cmd - (char *) urb->transfer_buffer;
+ ret = dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+@@ -735,8 +742,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
+ }
+
+ if (cmd > (char *) urb->transfer_buffer) {
++ int len;
++ if (cmd < (char *) urb->transfer_buffer + urb->transfer_buffer_length)
++ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+- int len = cmd - (char *) urb->transfer_buffer;
++ len = cmd - (char *) urb->transfer_buffer;
+ dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+@@ -922,14 +932,6 @@ static void dlfb_free(struct kref *kref)
+ kfree(dlfb);
+ }
+
+-static void dlfb_release_urb_work(struct work_struct *work)
+-{
+- struct urb_node *unode = container_of(work, struct urb_node,
+- release_urb_work.work);
+-
+- up(&unode->dlfb->urbs.limit_sem);
+-}
+-
+ static void dlfb_free_framebuffer(struct dlfb_data *dlfb)
+ {
+ struct fb_info *info = dlfb->info;
+@@ -1039,10 +1041,25 @@ static int dlfb_ops_set_par(struct fb_info *info)
+ int result;
+ u16 *pix_framebuffer;
+ int i;
++ struct fb_var_screeninfo fvs;
++
++ /* clear the activate field because it causes spurious miscompares */
++ fvs = info->var;
++ fvs.activate = 0;
++ fvs.vmode &= ~FB_VMODE_SMOOTH_XPAN;
++
++ if (!memcmp(&dlfb->current_mode, &fvs, sizeof(struct fb_var_screeninfo)))
++ return 0;
+
+ result = dlfb_set_video_mode(dlfb, &info->var);
+
+- if ((result == 0) && (dlfb->fb_count == 0)) {
++ if (result)
++ return result;
++
++ dlfb->current_mode = fvs;
++ info->fix.line_length = info->var.xres * (info->var.bits_per_pixel / 8);
++
++ if (dlfb->fb_count == 0) {
+
+ /* paint greenscreen */
+
+@@ -1054,7 +1071,7 @@ static int dlfb_ops_set_par(struct fb_info *info)
+ info->screen_base);
+ }
+
+- return result;
++ return 0;
+ }
+
+ /* To fonzi the jukebox (e.g. make blanking changes take effect) */
+@@ -1649,7 +1666,8 @@ static void dlfb_init_framebuffer_work(struct work_struct *work)
+ dlfb->info = info;
+ info->par = dlfb;
+ info->pseudo_palette = dlfb->pseudo_palette;
+- info->fbops = &dlfb_ops;
++ dlfb->ops = dlfb_ops;
++ info->fbops = &dlfb->ops;
+
+ retval = fb_alloc_cmap(&info->cmap, 256, 0);
+ if (retval < 0) {
+@@ -1789,14 +1807,7 @@ static void dlfb_urb_completion(struct urb *urb)
+ dlfb->urbs.available++;
+ spin_unlock_irqrestore(&dlfb->urbs.lock, flags);
+
+- /*
+- * When using fb_defio, we deadlock if up() is called
+- * while another is waiting. So queue to another process.
+- */
+- if (fb_defio)
+- schedule_delayed_work(&unode->release_urb_work, 0);
+- else
+- up(&dlfb->urbs.limit_sem);
++ up(&dlfb->urbs.limit_sem);
+ }
+
+ static void dlfb_free_urb_list(struct dlfb_data *dlfb)
+@@ -1805,16 +1816,11 @@ static void dlfb_free_urb_list(struct dlfb_data *dlfb)
+ struct list_head *node;
+ struct urb_node *unode;
+ struct urb *urb;
+- int ret;
+ unsigned long flags;
+
+ /* keep waiting and freeing, until we've got 'em all */
+ while (count--) {
+-
+- /* Getting interrupted means a leak, but ok at disconnect */
+- ret = down_interruptible(&dlfb->urbs.limit_sem);
+- if (ret)
+- break;
++ down(&dlfb->urbs.limit_sem);
+
+ spin_lock_irqsave(&dlfb->urbs.lock, flags);
+
+@@ -1838,25 +1844,27 @@ static void dlfb_free_urb_list(struct dlfb_data *dlfb)
+
+ static int dlfb_alloc_urb_list(struct dlfb_data *dlfb, int count, size_t size)
+ {
+- int i = 0;
+ struct urb *urb;
+ struct urb_node *unode;
+ char *buf;
++ size_t wanted_size = count * size;
+
+ spin_lock_init(&dlfb->urbs.lock);
+
++retry:
+ dlfb->urbs.size = size;
+ INIT_LIST_HEAD(&dlfb->urbs.list);
+
+- while (i < count) {
++ sema_init(&dlfb->urbs.limit_sem, 0);
++ dlfb->urbs.count = 0;
++ dlfb->urbs.available = 0;
++
++ while (dlfb->urbs.count * size < wanted_size) {
+ unode = kzalloc(sizeof(*unode), GFP_KERNEL);
+ if (!unode)
+ break;
+ unode->dlfb = dlfb;
+
+- INIT_DELAYED_WORK(&unode->release_urb_work,
+- dlfb_release_urb_work);
+-
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!urb) {
+ kfree(unode);
+@@ -1864,11 +1872,16 @@ static int dlfb_alloc_urb_list(struct dlfb_data *dlfb, int count, size_t size)
+ }
+ unode->urb = urb;
+
+- buf = usb_alloc_coherent(dlfb->udev, MAX_TRANSFER, GFP_KERNEL,
++ buf = usb_alloc_coherent(dlfb->udev, size, GFP_KERNEL,
+ &urb->transfer_dma);
+ if (!buf) {
+ kfree(unode);
+ usb_free_urb(urb);
++ if (size > PAGE_SIZE) {
++ size /= 2;
++ dlfb_free_urb_list(dlfb);
++ goto retry;
++ }
+ break;
+ }
+
+@@ -1879,14 +1892,12 @@ static int dlfb_alloc_urb_list(struct dlfb_data *dlfb, int count, size_t size)
+
+ list_add_tail(&unode->entry, &dlfb->urbs.list);
+
+- i++;
++ up(&dlfb->urbs.limit_sem);
++ dlfb->urbs.count++;
++ dlfb->urbs.available++;
+ }
+
+- sema_init(&dlfb->urbs.limit_sem, i);
+- dlfb->urbs.count = i;
+- dlfb->urbs.available = i;
+-
+- return i;
++ return dlfb->urbs.count;
+ }
+
+ static struct urb *dlfb_get_urb(struct dlfb_data *dlfb)
+diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c
+index f329eee6dc93..352abc39e891 100644
+--- a/fs/9p/xattr.c
++++ b/fs/9p/xattr.c
+@@ -105,7 +105,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,
+ {
+ struct kvec kvec = {.iov_base = (void *)value, .iov_len = value_len};
+ struct iov_iter from;
+- int retval;
++ int retval, err;
+
+ iov_iter_kvec(&from, WRITE | ITER_KVEC, &kvec, 1, value_len);
+
+@@ -126,7 +126,9 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,
+ retval);
+ else
+ p9_client_write(fid, 0, &from, &retval);
+- p9_client_clunk(fid);
++ err = p9_client_clunk(fid);
++ if (!retval && err)
++ retval = err;
+ return retval;
+ }
+
+diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
+index 96c1d14c18f1..c2a128678e6e 100644
+--- a/fs/lockd/clntlock.c
++++ b/fs/lockd/clntlock.c
+@@ -187,7 +187,7 @@ __be32 nlmclnt_grant(const struct sockaddr *addr, const struct nlm_lock *lock)
+ continue;
+ if (!rpc_cmp_addr(nlm_addr(block->b_host), addr))
+ continue;
+- if (nfs_compare_fh(NFS_FH(file_inode(fl_blocked->fl_file)) ,fh) != 0)
++ if (nfs_compare_fh(NFS_FH(locks_inode(fl_blocked->fl_file)), fh) != 0)
+ continue;
+ /* Alright, we found a lock. Set the return status
+ * and wake up the caller
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index a2c0dfc6fdc0..d20b92f271c2 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -128,7 +128,7 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl)
+ char *nodename = req->a_host->h_rpcclnt->cl_nodename;
+
+ nlmclnt_next_cookie(&argp->cookie);
+- memcpy(&lock->fh, NFS_FH(file_inode(fl->fl_file)), sizeof(struct nfs_fh));
++ memcpy(&lock->fh, NFS_FH(locks_inode(fl->fl_file)), sizeof(struct nfs_fh));
+ lock->caller = nodename;
+ lock->oh.data = req->a_owner;
+ lock->oh.len = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s",
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index 3701bccab478..74330daeab71 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -405,8 +405,8 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
+ __be32 ret;
+
+ dprintk("lockd: nlmsvc_lock(%s/%ld, ty=%d, pi=%d, %Ld-%Ld, bl=%d)\n",
+- file_inode(file->f_file)->i_sb->s_id,
+- file_inode(file->f_file)->i_ino,
++ locks_inode(file->f_file)->i_sb->s_id,
++ locks_inode(file->f_file)->i_ino,
+ lock->fl.fl_type, lock->fl.fl_pid,
+ (long long)lock->fl.fl_start,
+ (long long)lock->fl.fl_end,
+@@ -511,8 +511,8 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file,
+ __be32 ret;
+
+ dprintk("lockd: nlmsvc_testlock(%s/%ld, ty=%d, %Ld-%Ld)\n",
+- file_inode(file->f_file)->i_sb->s_id,
+- file_inode(file->f_file)->i_ino,
++ locks_inode(file->f_file)->i_sb->s_id,
++ locks_inode(file->f_file)->i_ino,
+ lock->fl.fl_type,
+ (long long)lock->fl.fl_start,
+ (long long)lock->fl.fl_end);
+@@ -566,8 +566,8 @@ nlmsvc_unlock(struct net *net, struct nlm_file *file, struct nlm_lock *lock)
+ int error;
+
+ dprintk("lockd: nlmsvc_unlock(%s/%ld, pi=%d, %Ld-%Ld)\n",
+- file_inode(file->f_file)->i_sb->s_id,
+- file_inode(file->f_file)->i_ino,
++ locks_inode(file->f_file)->i_sb->s_id,
++ locks_inode(file->f_file)->i_ino,
+ lock->fl.fl_pid,
+ (long long)lock->fl.fl_start,
+ (long long)lock->fl.fl_end);
+@@ -595,8 +595,8 @@ nlmsvc_cancel_blocked(struct net *net, struct nlm_file *file, struct nlm_lock *l
+ int status = 0;
+
+ dprintk("lockd: nlmsvc_cancel(%s/%ld, pi=%d, %Ld-%Ld)\n",
+- file_inode(file->f_file)->i_sb->s_id,
+- file_inode(file->f_file)->i_ino,
++ locks_inode(file->f_file)->i_sb->s_id,
++ locks_inode(file->f_file)->i_ino,
+ lock->fl.fl_pid,
+ (long long)lock->fl.fl_start,
+ (long long)lock->fl.fl_end);
+diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c
+index 4ec3d6e03e76..899360ba3b84 100644
+--- a/fs/lockd/svcsubs.c
++++ b/fs/lockd/svcsubs.c
+@@ -44,7 +44,7 @@ static inline void nlm_debug_print_fh(char *msg, struct nfs_fh *f)
+
+ static inline void nlm_debug_print_file(char *msg, struct nlm_file *file)
+ {
+- struct inode *inode = file_inode(file->f_file);
++ struct inode *inode = locks_inode(file->f_file);
+
+ dprintk("lockd: %s %s/%ld\n",
+ msg, inode->i_sb->s_id, inode->i_ino);
+@@ -414,7 +414,7 @@ nlmsvc_match_sb(void *datap, struct nlm_file *file)
+ {
+ struct super_block *sb = datap;
+
+- return sb == file_inode(file->f_file)->i_sb;
++ return sb == locks_inode(file->f_file)->i_sb;
+ }
+
+ /**
+diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
+index a7efd83779d2..dec5880ac6de 100644
+--- a/fs/nfs/blocklayout/dev.c
++++ b/fs/nfs/blocklayout/dev.c
+@@ -204,7 +204,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset,
+ chunk = div_u64(offset, dev->chunk_size);
+ div_u64_rem(chunk, dev->nr_children, &chunk_idx);
+
+- if (chunk_idx > dev->nr_children) {
++ if (chunk_idx >= dev->nr_children) {
+ dprintk("%s: invalid chunk idx %d (%lld/%lld)\n",
+ __func__, chunk_idx, offset, dev->chunk_size);
+ /* error, should not happen */
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 64c214fb9da6..5d57e818d0c3 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -441,11 +441,14 @@ validate_seqid(const struct nfs4_slot_table *tbl, const struct nfs4_slot *slot,
+ * a match. If the slot is in use and the sequence numbers match, the
+ * client is still waiting for a response to the original request.
+ */
+-static bool referring_call_exists(struct nfs_client *clp,
++static int referring_call_exists(struct nfs_client *clp,
+ uint32_t nrclists,
+- struct referring_call_list *rclists)
++ struct referring_call_list *rclists,
++ spinlock_t *lock)
++ __releases(lock)
++ __acquires(lock)
+ {
+- bool status = false;
++ int status = 0;
+ int i, j;
+ struct nfs4_session *session;
+ struct nfs4_slot_table *tbl;
+@@ -468,8 +471,10 @@ static bool referring_call_exists(struct nfs_client *clp,
+
+ for (j = 0; j < rclist->rcl_nrefcalls; j++) {
+ ref = &rclist->rcl_refcalls[j];
++ spin_unlock(lock);
+ status = nfs4_slot_wait_on_seqid(tbl, ref->rc_slotid,
+ ref->rc_sequenceid, HZ >> 1) < 0;
++ spin_lock(lock);
+ if (status)
+ goto out;
+ }
+@@ -546,7 +551,8 @@ __be32 nfs4_callback_sequence(void *argp, void *resp,
+ * related callback was received before the response to the original
+ * call.
+ */
+- if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists)) {
++ if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists,
++ &tbl->slot_tbl_lock) < 0) {
+ status = htonl(NFS4ERR_DELAY);
+ goto out_unlock;
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f6c4ccd693f4..464db0c0f5c8 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -581,8 +581,15 @@ nfs4_async_handle_exception(struct rpc_task *task, struct nfs_server *server,
+ ret = -EIO;
+ return ret;
+ out_retry:
+- if (ret == 0)
++ if (ret == 0) {
+ exception->retry = 1;
++ /*
++ * For NFS4ERR_MOVED, the client transport will need to
++ * be recomputed after migration recovery has completed.
++ */
++ if (errorcode == -NFS4ERR_MOVED)
++ rpc_task_release_transport(task);
++ }
+ return ret;
+ }
+
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index 32ba2d471853..d5e4d3cd8c7f 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -61,7 +61,7 @@ EXPORT_SYMBOL_GPL(pnfs_generic_commit_release);
+
+ /* The generic layer is about to remove the req from the commit list.
+ * If this will make the bucket empty, it will need to put the lseg reference.
+- * Note this must be called holding i_lock
++ * Note this must be called holding nfsi->commit_mutex
+ */
+ void
+ pnfs_generic_clear_request_commit(struct nfs_page *req,
+@@ -149,9 +149,7 @@ restart:
+ if (list_empty(&b->written)) {
+ freeme = b->wlseg;
+ b->wlseg = NULL;
+- spin_unlock(&cinfo->inode->i_lock);
+ pnfs_put_lseg(freeme);
+- spin_lock(&cinfo->inode->i_lock);
+ goto restart;
+ }
+ }
+@@ -167,7 +165,7 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
+ LIST_HEAD(pages);
+ int i;
+
+- spin_lock(&cinfo->inode->i_lock);
++ mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ for (i = idx; i < fl_cinfo->nbuckets; i++) {
+ bucket = &fl_cinfo->buckets[i];
+ if (list_empty(&bucket->committing))
+@@ -177,12 +175,12 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
+ list_for_each(pos, &bucket->committing)
+ cinfo->ds->ncommitting--;
+ list_splice_init(&bucket->committing, &pages);
+- spin_unlock(&cinfo->inode->i_lock);
++ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+ nfs_retry_commit(&pages, freeme, cinfo, i);
+ pnfs_put_lseg(freeme);
+- spin_lock(&cinfo->inode->i_lock);
++ mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ }
+- spin_unlock(&cinfo->inode->i_lock);
++ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+ }
+
+ static unsigned int
+@@ -222,13 +220,13 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
+ struct list_head *pos;
+
+ bucket = &cinfo->ds->buckets[data->ds_commit_index];
+- spin_lock(&cinfo->inode->i_lock);
++ mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ list_for_each(pos, &bucket->committing)
+ cinfo->ds->ncommitting--;
+ list_splice_init(&bucket->committing, pages);
+ data->lseg = bucket->clseg;
+ bucket->clseg = NULL;
+- spin_unlock(&cinfo->inode->i_lock);
++ mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+
+ }
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 857141446d6b..4a17fad93411 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -6293,7 +6293,7 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
+ return status;
+ }
+
+- inode = file_inode(filp);
++ inode = locks_inode(filp);
+ flctx = inode->i_flctx;
+
+ if (flctx && !list_empty_careful(&flctx->flc_posix)) {
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index ef1fe42ff7bb..cc8303a806b4 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -668,6 +668,21 @@ static int ovl_fill_real(struct dir_context *ctx, const char *name,
+ return orig_ctx->actor(orig_ctx, name, namelen, offset, ino, d_type);
+ }
+
++static bool ovl_is_impure_dir(struct file *file)
++{
++ struct ovl_dir_file *od = file->private_data;
++ struct inode *dir = d_inode(file->f_path.dentry);
++
++ /*
++ * Only upper dir can be impure, but if we are in the middle of
++ * iterating a lower real dir, dir could be copied up and marked
++ * impure. We only want the impure cache if we started iterating
++ * a real upper dir to begin with.
++ */
++ return od->is_upper && ovl_test_flag(OVL_IMPURE, dir);
++
++}
++
+ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
+ {
+ int err;
+@@ -696,7 +711,7 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
+ rdt.parent_ino = stat.ino;
+ }
+
+- if (ovl_test_flag(OVL_IMPURE, d_inode(dir))) {
++ if (ovl_is_impure_dir(file)) {
+ rdt.cache = ovl_cache_get_impure(&file->f_path);
+ if (IS_ERR(rdt.cache))
+ return PTR_ERR(rdt.cache);
+@@ -727,7 +742,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
+ */
+ if (ovl_xino_bits(dentry->d_sb) ||
+ (ovl_same_sb(dentry->d_sb) &&
+- (ovl_test_flag(OVL_IMPURE, d_inode(dentry)) ||
++ (ovl_is_impure_dir(file) ||
+ OVL_TYPE_MERGE(ovl_path_type(dentry->d_parent))))) {
+ return ovl_iterate_real(file, ctx);
+ }
+diff --git a/fs/quota/quota.c b/fs/quota/quota.c
+index 860bfbe7a07a..dac1735312df 100644
+--- a/fs/quota/quota.c
++++ b/fs/quota/quota.c
+@@ -18,6 +18,7 @@
+ #include <linux/quotaops.h>
+ #include <linux/types.h>
+ #include <linux/writeback.h>
++#include <linux/nospec.h>
+
+ static int check_quotactl_permission(struct super_block *sb, int type, int cmd,
+ qid_t id)
+@@ -703,6 +704,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
+
+ if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS))
+ return -EINVAL;
++ type = array_index_nospec(type, MAXQUOTAS);
+ /*
+ * Quota not supported on this fs? Check this before s_quota_types
+ * since they needn't be set if quota is not supported at all.
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 9da224d4f2da..e8616040bffc 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1123,8 +1123,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ struct ubifs_inode *ui;
+ struct ubifs_inode *dir_ui = ubifs_inode(dir);
+ struct ubifs_info *c = dir->i_sb->s_fs_info;
+- int err, len = strlen(symname);
+- int sz_change = CALC_DENT_SIZE(len);
++ int err, sz_change, len = strlen(symname);
+ struct fscrypt_str disk_link;
+ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
+ .new_ino_d = ALIGN(len, 8),
+@@ -1151,6 +1150,8 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ if (err)
+ goto out_budg;
+
++ sz_change = CALC_DENT_SIZE(fname_len(&nm));
++
+ inode = ubifs_new_inode(c, dir, S_IFLNK | S_IRWXUGO);
+ if (IS_ERR(inode)) {
+ err = PTR_ERR(inode);
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 07b4956e0425..48060dc48683 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -664,6 +664,11 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ spin_lock(&ui->ui_lock);
+ ui->synced_i_size = ui->ui_size;
+ spin_unlock(&ui->ui_lock);
++ if (xent) {
++ spin_lock(&host_ui->ui_lock);
++ host_ui->synced_i_size = host_ui->ui_size;
++ spin_unlock(&host_ui->ui_lock);
++ }
+ mark_inode_clean(c, ui);
+ mark_inode_clean(c, host_ui);
+ return 0;
+@@ -1282,11 +1287,10 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
+ int *new_len)
+ {
+ void *buf;
+- int err, compr_type;
+- u32 dlen, out_len, old_dlen;
++ int err, dlen, compr_type, out_len, old_dlen;
+
+ out_len = le32_to_cpu(dn->size);
+- buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
++ buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+ if (!buf)
+ return -ENOMEM;
+
+@@ -1388,7 +1392,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
+ else if (err)
+ goto out_free;
+ else {
+- if (le32_to_cpu(dn->size) <= dlen)
++ int dn_len = le32_to_cpu(dn->size);
++
++ if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) {
++ ubifs_err(c, "bad data node (block %u, inode %lu)",
++ blk, inode->i_ino);
++ ubifs_dump_node(c, dn);
++ goto out_free;
++ }
++
++ if (dn_len <= dlen)
+ dlen = 0; /* Nothing to do */
+ else {
+ err = truncate_data_node(c, inode, blk, dn, &dlen);
+diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
+index f5a46844340c..8ade493a423a 100644
+--- a/fs/ubifs/lprops.c
++++ b/fs/ubifs/lprops.c
+@@ -1089,10 +1089,6 @@ static int scan_check_cb(struct ubifs_info *c,
+ }
+ }
+
+- buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
+- if (!buf)
+- return -ENOMEM;
+-
+ /*
+ * After an unclean unmount, empty and freeable LEBs
+ * may contain garbage - do not scan them.
+@@ -1111,6 +1107,10 @@ static int scan_check_cb(struct ubifs_info *c,
+ return LPT_SCAN_CONTINUE;
+ }
+
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
+ sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ if (IS_ERR(sleb)) {
+ ret = PTR_ERR(sleb);
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index 6f720fdf5020..09e37e63bddd 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -152,6 +152,12 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ ui->data_len = size;
+
+ mutex_lock(&host_ui->ui_mutex);
++
++ if (!host->i_nlink) {
++ err = -ENOENT;
++ goto out_noent;
++ }
++
+ host->i_ctime = current_time(host);
+ host_ui->xattr_cnt += 1;
+ host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+@@ -184,6 +190,7 @@ out_cancel:
+ host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ host_ui->xattr_names -= fname_len(nm);
+ host_ui->flags &= ~UBIFS_CRYPT_FL;
++out_noent:
+ mutex_unlock(&host_ui->ui_mutex);
+ out_free:
+ make_bad_inode(inode);
+@@ -235,6 +242,12 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ mutex_unlock(&ui->ui_mutex);
+
+ mutex_lock(&host_ui->ui_mutex);
++
++ if (!host->i_nlink) {
++ err = -ENOENT;
++ goto out_noent;
++ }
++
+ host->i_ctime = current_time(host);
+ host_ui->xattr_size -= CALC_XATTR_BYTES(old_size);
+ host_ui->xattr_size += CALC_XATTR_BYTES(size);
+@@ -256,6 +269,7 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ out_cancel:
+ host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ host_ui->xattr_size += CALC_XATTR_BYTES(old_size);
++out_noent:
+ mutex_unlock(&host_ui->ui_mutex);
+ make_bad_inode(inode);
+ out_free:
+@@ -482,6 +496,12 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
+ return err;
+
+ mutex_lock(&host_ui->ui_mutex);
++
++ if (!host->i_nlink) {
++ err = -ENOENT;
++ goto out_noent;
++ }
++
+ host->i_ctime = current_time(host);
+ host_ui->xattr_cnt -= 1;
+ host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm));
+@@ -501,6 +521,7 @@ out_cancel:
+ host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+ host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
+ host_ui->xattr_names += fname_len(nm);
++out_noent:
+ mutex_unlock(&host_ui->ui_mutex);
+ ubifs_release_budget(c, &req);
+ make_bad_inode(inode);
+@@ -540,6 +561,9 @@ static int ubifs_xattr_remove(struct inode *host, const char *name)
+
+ ubifs_assert(inode_is_locked(host));
+
++ if (!host->i_nlink)
++ return -ENOENT;
++
+ if (fname_len(&nm) > UBIFS_MAX_NLEN)
+ return -ENAMETOOLONG;
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 0c504c8031d3..74b13347cd94 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1570,10 +1570,16 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
+ */
+ #define PART_DESC_ALLOC_STEP 32
+
++struct part_desc_seq_scan_data {
++ struct udf_vds_record rec;
++ u32 partnum;
++};
++
+ struct desc_seq_scan_data {
+ struct udf_vds_record vds[VDS_POS_LENGTH];
+ unsigned int size_part_descs;
+- struct udf_vds_record *part_descs_loc;
++ unsigned int num_part_descs;
++ struct part_desc_seq_scan_data *part_descs_loc;
+ };
+
+ static struct udf_vds_record *handle_partition_descriptor(
+@@ -1582,10 +1588,14 @@ static struct udf_vds_record *handle_partition_descriptor(
+ {
+ struct partitionDesc *desc = (struct partitionDesc *)bh->b_data;
+ int partnum;
++ int i;
+
+ partnum = le16_to_cpu(desc->partitionNumber);
+- if (partnum >= data->size_part_descs) {
+- struct udf_vds_record *new_loc;
++ for (i = 0; i < data->num_part_descs; i++)
++ if (partnum == data->part_descs_loc[i].partnum)
++ return &(data->part_descs_loc[i].rec);
++ if (data->num_part_descs >= data->size_part_descs) {
++ struct part_desc_seq_scan_data *new_loc;
+ unsigned int new_size = ALIGN(partnum, PART_DESC_ALLOC_STEP);
+
+ new_loc = kcalloc(new_size, sizeof(*new_loc), GFP_KERNEL);
+@@ -1597,7 +1607,7 @@ static struct udf_vds_record *handle_partition_descriptor(
+ data->part_descs_loc = new_loc;
+ data->size_part_descs = new_size;
+ }
+- return &(data->part_descs_loc[partnum]);
++ return &(data->part_descs_loc[data->num_part_descs++].rec);
+ }
+
+
+@@ -1647,6 +1657,7 @@ static noinline int udf_process_sequence(
+
+ memset(data.vds, 0, sizeof(struct udf_vds_record) * VDS_POS_LENGTH);
+ data.size_part_descs = PART_DESC_ALLOC_STEP;
++ data.num_part_descs = 0;
+ data.part_descs_loc = kcalloc(data.size_part_descs,
+ sizeof(*data.part_descs_loc),
+ GFP_KERNEL);
+@@ -1658,7 +1669,6 @@ static noinline int udf_process_sequence(
+ * are in it.
+ */
+ for (; (!done && block <= lastblock); block++) {
+-
+ bh = udf_read_tagged(sb, block, block, &ident);
+ if (!bh)
+ break;
+@@ -1730,13 +1740,10 @@ static noinline int udf_process_sequence(
+ }
+
+ /* Now handle prevailing Partition Descriptors */
+- for (i = 0; i < data.size_part_descs; i++) {
+- if (data.part_descs_loc[i].block) {
+- ret = udf_load_partdesc(sb,
+- data.part_descs_loc[i].block);
+- if (ret < 0)
+- return ret;
+- }
++ for (i = 0; i < data.num_part_descs; i++) {
++ ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
++ if (ret < 0)
++ return ret;
+ }
+
+ return 0;
+diff --git a/fs/xattr.c b/fs/xattr.c
+index f9cb1db187b7..1bee74682513 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -539,7 +539,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
+ if (error > 0) {
+ if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
+ (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
+- posix_acl_fix_xattr_to_user(kvalue, size);
++ posix_acl_fix_xattr_to_user(kvalue, error);
+ if (size && copy_to_user(value, kvalue, error))
+ error = -EFAULT;
+ } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
+diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
+index 6c666fd7de3c..0fce47d5acb1 100644
+--- a/include/linux/blk-cgroup.h
++++ b/include/linux/blk-cgroup.h
+@@ -295,6 +295,23 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg,
+ return __blkg_lookup(blkcg, q, false);
+ }
+
++/**
++ * blkg_lookup - look up blkg for the specified request queue
++ * @q: request_queue of interest
++ *
++ * Lookup blkg for @q at the root level. See also blkg_lookup().
++ */
++static inline struct blkcg_gq *blkg_root_lookup(struct request_queue *q)
++{
++ struct blkcg_gq *blkg;
++
++ rcu_read_lock();
++ blkg = blkg_lookup(&blkcg_root, q);
++ rcu_read_unlock();
++
++ return blkg;
++}
++
+ /**
+ * blkg_to_pdata - get policy private data
+ * @blkg: blkg of interest
+@@ -737,6 +754,7 @@ struct blkcg_policy {
+ #ifdef CONFIG_BLOCK
+
+ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { return NULL; }
++static inline struct blkcg_gq *blkg_root_lookup(struct request_queue *q) { return NULL; }
+ static inline int blkcg_init_queue(struct request_queue *q) { return 0; }
+ static inline void blkcg_drain_queue(struct request_queue *q) { }
+ static inline void blkcg_exit_queue(struct request_queue *q) { }
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index 3a3012f57be4..5389012f1d25 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -1046,6 +1046,8 @@ extern int vmbus_establish_gpadl(struct vmbus_channel *channel,
+ extern int vmbus_teardown_gpadl(struct vmbus_channel *channel,
+ u32 gpadl_handle);
+
++void vmbus_reset_channel_cb(struct vmbus_channel *channel);
++
+ extern int vmbus_recvpacket(struct vmbus_channel *channel,
+ void *buffer,
+ u32 bufferlen,
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index ef169d67df92..7fd9fbaea5aa 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -114,6 +114,7 @@
+ * Extended Capability Register
+ */
+
++#define ecap_dit(e) ((e >> 41) & 0x1)
+ #define ecap_pasid(e) ((e >> 40) & 0x1)
+ #define ecap_pss(e) ((e >> 35) & 0x1f)
+ #define ecap_eafs(e) ((e >> 34) & 0x1)
+@@ -284,6 +285,7 @@ enum {
+ #define QI_DEV_IOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32)
+ #define QI_DEV_IOTLB_QDEP(qdep) (((qdep) & 0x1f) << 16)
+ #define QI_DEV_IOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK)
++#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
+ #define QI_DEV_IOTLB_SIZE 1
+ #define QI_DEV_IOTLB_MAX_INVS 32
+
+@@ -308,6 +310,7 @@ enum {
+ #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
+ #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
++#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
+ #define QI_DEV_EIOTLB_MAX_INVS 32
+
+ #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55)
+@@ -453,9 +456,8 @@ extern void qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid,
+ u8 fm, u64 type);
+ extern void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
+ unsigned int size_order, u64 type);
+-extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+- u64 addr, unsigned mask);
+-
++extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
++ u16 qdep, u64 addr, unsigned mask);
+ extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
+
+ extern int dmar_ir_support(void);
+diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
+index 4fd95dbeb52f..b065ef406770 100644
+--- a/include/linux/lockd/lockd.h
++++ b/include/linux/lockd/lockd.h
+@@ -299,7 +299,7 @@ int nlmsvc_unlock_all_by_ip(struct sockaddr *server_addr);
+
+ static inline struct inode *nlmsvc_file_inode(struct nlm_file *file)
+ {
+- return file_inode(file->f_file);
++ return locks_inode(file->f_file);
+ }
+
+ static inline int __nlm_privileged_request4(const struct sockaddr *sap)
+@@ -359,7 +359,7 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp)
+ static inline int nlm_compare_locks(const struct file_lock *fl1,
+ const struct file_lock *fl2)
+ {
+- return file_inode(fl1->fl_file) == file_inode(fl2->fl_file)
++ return locks_inode(fl1->fl_file) == locks_inode(fl2->fl_file)
+ && fl1->fl_pid == fl2->fl_pid
+ && fl1->fl_owner == fl2->fl_owner
+ && fl1->fl_start == fl2->fl_start
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 99ce070e7dcb..22651e124071 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -139,7 +139,10 @@ struct page {
+ unsigned long _pt_pad_1; /* compound_head */
+ pgtable_t pmd_huge_pte; /* protected by page->ptl */
+ unsigned long _pt_pad_2; /* mapping */
+- struct mm_struct *pt_mm; /* x86 pgds only */
++ union {
++ struct mm_struct *pt_mm; /* x86 pgds only */
++ atomic_t pt_frag_refcount; /* powerpc */
++ };
+ #if ALLOC_SPLIT_PTLOCKS
+ spinlock_t *ptl;
+ #else
+diff --git a/include/linux/overflow.h b/include/linux/overflow.h
+index 8712ff70995f..40b48e2133cb 100644
+--- a/include/linux/overflow.h
++++ b/include/linux/overflow.h
+@@ -202,6 +202,37 @@
+
+ #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
+
++/** check_shl_overflow() - Calculate a left-shifted value and check overflow
++ *
++ * @a: Value to be shifted
++ * @s: How many bits left to shift
++ * @d: Pointer to where to store the result
++ *
++ * Computes *@d = (@a << @s)
++ *
++ * Returns true if '*d' cannot hold the result or when 'a << s' doesn't
++ * make sense. Example conditions:
++ * - 'a << s' causes bits to be lost when stored in *d.
++ * - 's' is garbage (e.g. negative) or so large that the result of
++ * 'a << s' is guaranteed to be 0.
++ * - 'a' is negative.
++ * - 'a << s' sets the sign bit, if any, in '*d'.
++ *
++ * '*d' will hold the results of the attempted shift, but is not
++ * considered "safe for use" if false is returned.
++ */
++#define check_shl_overflow(a, s, d) ({ \
++ typeof(a) _a = a; \
++ typeof(s) _s = s; \
++ typeof(d) _d = d; \
++ u64 _a_full = _a; \
++ unsigned int _to_shift = \
++ _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
++ *_d = (_a_full << _to_shift); \
++ (_to_shift != _s || *_d < 0 || _a < 0 || \
++ (*_d >> _to_shift) != _a); \
++})
++
+ /**
+ * array_size() - Calculate size of 2-dimensional array.
+ *
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index 9b11b6a0978c..73d5c4a870fa 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -156,6 +156,7 @@ int rpc_switch_client_transport(struct rpc_clnt *,
+
+ void rpc_shutdown_client(struct rpc_clnt *);
+ void rpc_release_client(struct rpc_clnt *);
++void rpc_task_release_transport(struct rpc_task *);
+ void rpc_task_release_client(struct rpc_task *);
+
+ int rpcb_create_local(struct net *);
+diff --git a/include/linux/verification.h b/include/linux/verification.h
+index a10549a6c7cd..cfa4730d607a 100644
+--- a/include/linux/verification.h
++++ b/include/linux/verification.h
+@@ -12,6 +12,12 @@
+ #ifndef _LINUX_VERIFICATION_H
+ #define _LINUX_VERIFICATION_H
+
++/*
++ * Indicate that both builtin trusted keys and secondary trusted keys
++ * should be used.
++ */
++#define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
++
+ /*
+ * The use to which an asymmetric key is being put.
+ */
+diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h
+index bf48e71f2634..8a3432d0f0dc 100644
+--- a/include/uapi/linux/eventpoll.h
++++ b/include/uapi/linux/eventpoll.h
+@@ -42,7 +42,7 @@
+ #define EPOLLRDHUP (__force __poll_t)0x00002000
+
+ /* Set exclusive wakeup mode for the target file descriptor */
+-#define EPOLLEXCLUSIVE (__force __poll_t)(1U << 28)
++#define EPOLLEXCLUSIVE ((__force __poll_t)(1U << 28))
+
+ /*
+ * Request the handling of system wakeup events so as to prevent system suspends
+@@ -54,13 +54,13 @@
+ *
+ * Requires CAP_BLOCK_SUSPEND
+ */
+-#define EPOLLWAKEUP (__force __poll_t)(1U << 29)
++#define EPOLLWAKEUP ((__force __poll_t)(1U << 29))
+
+ /* Set the One Shot behaviour for the target file descriptor */
+-#define EPOLLONESHOT (__force __poll_t)(1U << 30)
++#define EPOLLONESHOT ((__force __poll_t)(1U << 30))
+
+ /* Set the Edge Triggered behaviour for the target file descriptor */
+-#define EPOLLET (__force __poll_t)(1U << 31)
++#define EPOLLET ((__force __poll_t)(1U << 31))
+
+ /*
+ * On x86-64 make the 64bit structure have the same alignment as the
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index 0cabe6b09095..6e1a2e790b1b 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -20,7 +20,6 @@ struct dloarea {
+ struct urb_node {
+ struct list_head entry;
+ struct dlfb_data *dlfb;
+- struct delayed_work release_urb_work;
+ struct urb *urb;
+ };
+
+@@ -52,11 +51,13 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ struct fb_ops ops;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
+ atomic_t bytes_identical; /* saved effort with backbuffer comparison */
+ atomic_t bytes_sent; /* to usb, after compression including overhead */
+ atomic_t cpu_kcycles_used; /* transpired during pixel processing */
++ struct fb_var_screeninfo current_mode;
+ };
+
+ #define NR_USB_REQUEST_I2C_SUB_IO 0x02
+@@ -87,7 +88,7 @@ struct dlfb_data {
+ #define MIN_RAW_PIX_BYTES 2
+ #define MIN_RAW_CMD_BYTES (RAW_HEADER_BYTES + MIN_RAW_PIX_BYTES)
+
+-#define DL_DEFIO_WRITE_DELAY 5 /* fb_deferred_io.delay in jiffies */
++#define DL_DEFIO_WRITE_DELAY msecs_to_jiffies(HZ <= 300 ? 4 : 10) /* optimal value for 720p video */
+ #define DL_DEFIO_WRITE_DISABLE (HZ*60) /* "disable" with long delay */
+
+ /* remove these once align.h patch is taken into kernel */
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index 3a4656fb7047..5b77a7314e01 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -678,6 +678,9 @@ static int klp_init_func(struct klp_object *obj, struct klp_func *func)
+ if (!func->old_name || !func->new_func)
+ return -EINVAL;
+
++ if (strlen(func->old_name) >= KSYM_NAME_LEN)
++ return -EINVAL;
++
+ INIT_LIST_HEAD(&func->stack_node);
+ func->patched = false;
+ func->transition = false;
+@@ -751,6 +754,9 @@ static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
+ if (!obj->funcs)
+ return -EINVAL;
+
++ if (klp_is_module(obj) && strlen(obj->name) >= MODULE_NAME_LEN)
++ return -EINVAL;
++
+ obj->patched = false;
+ obj->mod = NULL;
+
+diff --git a/kernel/memremap.c b/kernel/memremap.c
+index 38283363da06..cfb750105e1e 100644
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -355,7 +355,6 @@ void __put_devmap_managed_page(struct page *page)
+ __ClearPageActive(page);
+ __ClearPageWaiters(page);
+
+- page->mapping = NULL;
+ mem_cgroup_uncharge(page);
+
+ page->pgmap->page_free(page, page->pgmap->data);
+diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
+index e880ca22c5a5..3a6c2f87699e 100644
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -105,6 +105,7 @@ config PM_SLEEP
+ def_bool y
+ depends on SUSPEND || HIBERNATE_CALLBACKS
+ select PM
++ select SRCU
+
+ config PM_SLEEP_SMP
+ def_bool y
+diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
+index a0a74c533e4b..0913b4d385de 100644
+--- a/kernel/printk/printk_safe.c
++++ b/kernel/printk/printk_safe.c
+@@ -306,12 +306,12 @@ static __printf(1, 0) int vprintk_nmi(const char *fmt, va_list args)
+ return printk_safe_log_store(s, fmt, args);
+ }
+
+-void printk_nmi_enter(void)
++void notrace printk_nmi_enter(void)
+ {
+ this_cpu_or(printk_context, PRINTK_NMI_CONTEXT_MASK);
+ }
+
+-void printk_nmi_exit(void)
++void notrace printk_nmi_exit(void)
+ {
+ this_cpu_and(printk_context, ~PRINTK_NMI_CONTEXT_MASK);
+ }
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index d40708e8c5d6..01b6ddeb4f05 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -472,6 +472,7 @@ retry_ipi:
+ static void sync_rcu_exp_select_cpus(struct rcu_state *rsp,
+ smp_call_func_t func)
+ {
++ int cpu;
+ struct rcu_node *rnp;
+
+ trace_rcu_exp_grace_period(rsp->name, rcu_exp_gp_seq_endval(rsp), TPS("reset"));
+@@ -492,7 +493,13 @@ static void sync_rcu_exp_select_cpus(struct rcu_state *rsp,
+ continue;
+ }
+ INIT_WORK(&rnp->rew.rew_work, sync_rcu_exp_select_node_cpus);
+- queue_work_on(rnp->grplo, rcu_par_gp_wq, &rnp->rew.rew_work);
++ preempt_disable();
++ cpu = cpumask_next(rnp->grplo - 1, cpu_online_mask);
++ /* If all offline, queue the work on an unbound CPU. */
++ if (unlikely(cpu > rnp->grphi))
++ cpu = WORK_CPU_UNBOUND;
++ queue_work_on(cpu, rcu_par_gp_wq, &rnp->rew.rew_work);
++ preempt_enable();
+ rnp->exp_need_flush = true;
+ }
+
+diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
+index 1a3e9bddd17b..16f84142f2f4 100644
+--- a/kernel/sched/idle.c
++++ b/kernel/sched/idle.c
+@@ -190,7 +190,7 @@ static void cpuidle_idle_call(void)
+ */
+ next_state = cpuidle_select(drv, dev, &stop_tick);
+
+- if (stop_tick)
++ if (stop_tick || tick_nohz_tick_stopped())
+ tick_nohz_idle_stop_tick();
+ else
+ tick_nohz_idle_retain_tick();
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 38509dc1f77b..69b9a37ecf0d 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1237,18 +1237,19 @@ static int override_release(char __user *release, size_t len)
+
+ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
+ {
+- int errno = 0;
++ struct new_utsname tmp;
+
+ down_read(&uts_sem);
+- if (copy_to_user(name, utsname(), sizeof *name))
+- errno = -EFAULT;
++ memcpy(&tmp, utsname(), sizeof(tmp));
+ up_read(&uts_sem);
++ if (copy_to_user(name, &tmp, sizeof(tmp)))
++ return -EFAULT;
+
+- if (!errno && override_release(name->release, sizeof(name->release)))
+- errno = -EFAULT;
+- if (!errno && override_architecture(name))
+- errno = -EFAULT;
+- return errno;
++ if (override_release(name->release, sizeof(name->release)))
++ return -EFAULT;
++ if (override_architecture(name))
++ return -EFAULT;
++ return 0;
+ }
+
+ #ifdef __ARCH_WANT_SYS_OLD_UNAME
+@@ -1257,55 +1258,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
+ */
+ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+ {
+- int error = 0;
++ struct old_utsname tmp;
+
+ if (!name)
+ return -EFAULT;
+
+ down_read(&uts_sem);
+- if (copy_to_user(name, utsname(), sizeof(*name)))
+- error = -EFAULT;
++ memcpy(&tmp, utsname(), sizeof(tmp));
+ up_read(&uts_sem);
++ if (copy_to_user(name, &tmp, sizeof(tmp)))
++ return -EFAULT;
+
+- if (!error && override_release(name->release, sizeof(name->release)))
+- error = -EFAULT;
+- if (!error && override_architecture(name))
+- error = -EFAULT;
+- return error;
++ if (override_release(name->release, sizeof(name->release)))
++ return -EFAULT;
++ if (override_architecture(name))
++ return -EFAULT;
++ return 0;
+ }
+
+ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+ {
+- int error;
++ struct oldold_utsname tmp = {};
+
+ if (!name)
+ return -EFAULT;
+- if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname)))
+- return -EFAULT;
+
+ down_read(&uts_sem);
+- error = __copy_to_user(&name->sysname, &utsname()->sysname,
+- __OLD_UTS_LEN);
+- error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
+- error |= __copy_to_user(&name->nodename, &utsname()->nodename,
+- __OLD_UTS_LEN);
+- error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
+- error |= __copy_to_user(&name->release, &utsname()->release,
+- __OLD_UTS_LEN);
+- error |= __put_user(0, name->release + __OLD_UTS_LEN);
+- error |= __copy_to_user(&name->version, &utsname()->version,
+- __OLD_UTS_LEN);
+- error |= __put_user(0, name->version + __OLD_UTS_LEN);
+- error |= __copy_to_user(&name->machine, &utsname()->machine,
+- __OLD_UTS_LEN);
+- error |= __put_user(0, name->machine + __OLD_UTS_LEN);
++ memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
++ memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
++ memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN);
++ memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN);
++ memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN);
+ up_read(&uts_sem);
++ if (copy_to_user(name, &tmp, sizeof(tmp)))
++ return -EFAULT;
+
+- if (!error && override_architecture(name))
+- error = -EFAULT;
+- if (!error && override_release(name->release, sizeof(name->release)))
+- error = -EFAULT;
+- return error ? -EFAULT : 0;
++ if (override_architecture(name))
++ return -EFAULT;
++ if (override_release(name->release, sizeof(name->release)))
++ return -EFAULT;
++ return 0;
+ }
+ #endif
+
+@@ -1319,17 +1311,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
+
+ if (len < 0 || len > __NEW_UTS_LEN)
+ return -EINVAL;
+- down_write(&uts_sem);
+ errno = -EFAULT;
+ if (!copy_from_user(tmp, name, len)) {
+- struct new_utsname *u = utsname();
++ struct new_utsname *u;
+
++ down_write(&uts_sem);
++ u = utsname();
+ memcpy(u->nodename, tmp, len);
+ memset(u->nodename + len, 0, sizeof(u->nodename) - len);
+ errno = 0;
+ uts_proc_notify(UTS_PROC_HOSTNAME);
++ up_write(&uts_sem);
+ }
+- up_write(&uts_sem);
+ return errno;
+ }
+
+@@ -1337,8 +1330,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
+
+ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
+ {
+- int i, errno;
++ int i;
+ struct new_utsname *u;
++ char tmp[__NEW_UTS_LEN + 1];
+
+ if (len < 0)
+ return -EINVAL;
+@@ -1347,11 +1341,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
+ i = 1 + strlen(u->nodename);
+ if (i > len)
+ i = len;
+- errno = 0;
+- if (copy_to_user(name, u->nodename, i))
+- errno = -EFAULT;
++ memcpy(tmp, u->nodename, i);
+ up_read(&uts_sem);
+- return errno;
++ if (copy_to_user(name, tmp, i))
++ return -EFAULT;
++ return 0;
+ }
+
+ #endif
+@@ -1370,17 +1364,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
+ if (len < 0 || len > __NEW_UTS_LEN)
+ return -EINVAL;
+
+- down_write(&uts_sem);
+ errno = -EFAULT;
+ if (!copy_from_user(tmp, name, len)) {
+- struct new_utsname *u = utsname();
++ struct new_utsname *u;
+
++ down_write(&uts_sem);
++ u = utsname();
+ memcpy(u->domainname, tmp, len);
+ memset(u->domainname + len, 0, sizeof(u->domainname) - len);
+ errno = 0;
+ uts_proc_notify(UTS_PROC_DOMAINNAME);
++ up_write(&uts_sem);
+ }
+- up_write(&uts_sem);
+ return errno;
+ }
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 987d9a9ae283..8defc6fd8c0f 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -1841,6 +1841,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
+ mutex_lock(&q->blk_trace_mutex);
+
+ if (attr == &dev_attr_enable) {
++ if (!!value == !!q->blk_trace) {
++ ret = 0;
++ goto out_unlock_bdev;
++ }
+ if (value)
+ ret = blk_trace_setup_queue(q, bdev);
+ else
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 176debd3481b..ddae35127571 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7628,7 +7628,9 @@ rb_simple_write(struct file *filp, const char __user *ubuf,
+
+ if (buffer) {
+ mutex_lock(&trace_types_lock);
+- if (val) {
++ if (!!val == tracer_tracing_is_on(tr)) {
++ val = 0; /* do nothing */
++ } else if (val) {
+ tracer_tracing_on(tr);
+ if (tr->current_trace->start)
+ tr->current_trace->start(tr);
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index bf89a51e740d..ac02fafc9f1b 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -952,7 +952,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file)
+
+ list_del_rcu(&link->list);
+ /* synchronize with u{,ret}probe_trace_func */
+- synchronize_sched();
++ synchronize_rcu();
+ kfree(link);
+
+ if (!list_empty(&tu->tp.files))
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index c3d7583fcd21..e5222b5fb4fe 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -859,7 +859,16 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ unsigned idx;
+ struct uid_gid_extent extent;
+ char *kbuf = NULL, *pos, *next_line;
+- ssize_t ret = -EINVAL;
++ ssize_t ret;
++
++ /* Only allow < page size writes at the beginning of the file */
++ if ((*ppos != 0) || (count >= PAGE_SIZE))
++ return -EINVAL;
++
++ /* Slurp in the user data */
++ kbuf = memdup_user_nul(buf, count);
++ if (IS_ERR(kbuf))
++ return PTR_ERR(kbuf);
+
+ /*
+ * The userns_state_mutex serializes all writes to any given map.
+@@ -895,19 +904,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
+ goto out;
+
+- /* Only allow < page size writes at the beginning of the file */
+- ret = -EINVAL;
+- if ((*ppos != 0) || (count >= PAGE_SIZE))
+- goto out;
+-
+- /* Slurp in the user data */
+- kbuf = memdup_user_nul(buf, count);
+- if (IS_ERR(kbuf)) {
+- ret = PTR_ERR(kbuf);
+- kbuf = NULL;
+- goto out;
+- }
+-
+ /* Parse the user data */
+ ret = -EINVAL;
+ pos = kbuf;
+diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
+index 233cd8fc6910..258033d62cb3 100644
+--- a/kernel/utsname_sysctl.c
++++ b/kernel/utsname_sysctl.c
+@@ -18,7 +18,7 @@
+
+ #ifdef CONFIG_PROC_SYSCTL
+
+-static void *get_uts(struct ctl_table *table, int write)
++static void *get_uts(struct ctl_table *table)
+ {
+ char *which = table->data;
+ struct uts_namespace *uts_ns;
+@@ -26,21 +26,9 @@ static void *get_uts(struct ctl_table *table, int write)
+ uts_ns = current->nsproxy->uts_ns;
+ which = (which - (char *)&init_uts_ns) + (char *)uts_ns;
+
+- if (!write)
+- down_read(&uts_sem);
+- else
+- down_write(&uts_sem);
+ return which;
+ }
+
+-static void put_uts(struct ctl_table *table, int write, void *which)
+-{
+- if (!write)
+- up_read(&uts_sem);
+- else
+- up_write(&uts_sem);
+-}
+-
+ /*
+ * Special case of dostring for the UTS structure. This has locks
+ * to observe. Should this be in kernel/sys.c ????
+@@ -50,13 +38,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write,
+ {
+ struct ctl_table uts_table;
+ int r;
++ char tmp_data[__NEW_UTS_LEN + 1];
++
+ memcpy(&uts_table, table, sizeof(uts_table));
+- uts_table.data = get_uts(table, write);
++ uts_table.data = tmp_data;
++
++ /*
++ * Buffer the value in tmp_data so that proc_dostring() can be called
++ * without holding any locks.
++ * We also need to read the original value in the write==1 case to
++ * support partial writes.
++ */
++ down_read(&uts_sem);
++ memcpy(tmp_data, get_uts(table), sizeof(tmp_data));
++ up_read(&uts_sem);
+ r = proc_dostring(&uts_table, write, buffer, lenp, ppos);
+- put_uts(table, write, uts_table.data);
+
+- if (write)
++ if (write) {
++ /*
++ * Write back the new value.
++ * Note that, since we dropped uts_sem, the result can
++ * theoretically be incorrect if there are two parallel writes
++ * at non-zero offsets to the same sysctl.
++ */
++ down_write(&uts_sem);
++ memcpy(get_uts(table), tmp_data, sizeof(tmp_data));
++ up_write(&uts_sem);
+ proc_sys_poll_notify(table->poll);
++ }
+
+ return r;
+ }
+diff --git a/mm/hmm.c b/mm/hmm.c
+index de7b6bf77201..f9d1d89dec4d 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -963,6 +963,8 @@ static void hmm_devmem_free(struct page *page, void *data)
+ {
+ struct hmm_devmem *devmem = data;
+
++ page->mapping = NULL;
++
+ devmem->ops->free(devmem, page);
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 86d4329acb05..f94feec6518d 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -391,15 +391,6 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
+ {
+ struct mmu_table_batch **batch = &tlb->batch;
+
+- /*
+- * When there's less then two users of this mm there cannot be a
+- * concurrent page-table walk.
+- */
+- if (atomic_read(&tlb->mm->mm_users) < 2) {
+- __tlb_remove_table(table);
+- return;
+- }
+-
+ if (*batch == NULL) {
+ *batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
+ if (*batch == NULL) {
+diff --git a/mm/readahead.c b/mm/readahead.c
+index e273f0de3376..792dea696d54 100644
+--- a/mm/readahead.c
++++ b/mm/readahead.c
+@@ -385,6 +385,7 @@ ondemand_readahead(struct address_space *mapping,
+ {
+ struct backing_dev_info *bdi = inode_to_bdi(mapping->host);
+ unsigned long max_pages = ra->ra_pages;
++ unsigned long add_pages;
+ pgoff_t prev_offset;
+
+ /*
+@@ -474,10 +475,17 @@ readit:
+ * Will this read hit the readahead marker made by itself?
+ * If so, trigger the readahead marker hit now, and merge
+ * the resulted next readahead window into the current one.
++ * Take care of maximum IO pages as above.
+ */
+ if (offset == ra->start && ra->size == ra->async_size) {
+- ra->async_size = get_next_ra_size(ra, max_pages);
+- ra->size += ra->async_size;
++ add_pages = get_next_ra_size(ra, max_pages);
++ if (ra->size + add_pages <= max_pages) {
++ ra->async_size = add_pages;
++ ra->size += add_pages;
++ } else {
++ ra->size = max_pages;
++ ra->async_size = max_pages >> 1;
++ }
+ }
+
+ return ra_submit(ra, mapping, filp);
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 5c1343195292..2872f3dbfd86 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -958,7 +958,7 @@ static int p9_client_version(struct p9_client *c)
+ {
+ int err = 0;
+ struct p9_req_t *req;
+- char *version;
++ char *version = NULL;
+ int msize;
+
+ p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 588bf88c3305..ef456395645a 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m)
+ spin_lock_irqsave(&p9_poll_lock, flags);
+ list_del_init(&m->poll_pending_link);
+ spin_unlock_irqrestore(&p9_poll_lock, flags);
++
++ flush_work(&p9_poll_work);
+ }
+
+ /**
+@@ -940,7 +942,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
+ if (err < 0)
+ return err;
+
+- if (valid_ipaddr4(addr) < 0)
++ if (addr == NULL || valid_ipaddr4(addr) < 0)
+ return -EINVAL;
+
+ csocket = NULL;
+@@ -990,6 +992,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
+
+ csocket = NULL;
+
++ if (addr == NULL)
++ return -EINVAL;
++
+ if (strlen(addr) >= UNIX_PATH_MAX) {
+ pr_err("%s (%d): address too long: %s\n",
+ __func__, task_pid_nr(current), addr);
+diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
+index 3d414acb7015..afaf0d65f3dd 100644
+--- a/net/9p/trans_rdma.c
++++ b/net/9p/trans_rdma.c
+@@ -644,6 +644,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
+ struct rdma_conn_param conn_param;
+ struct ib_qp_init_attr qp_attr;
+
++ if (addr == NULL)
++ return -EINVAL;
++
+ /* Parse the transport specific mount options */
+ err = parse_opts(args, &opts);
+ if (err < 0)
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 05006cbb3361..4c2da2513c8b 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -188,7 +188,7 @@ static int pack_sg_list(struct scatterlist *sg, int start,
+ s = rest_of_page(data);
+ if (s > count)
+ s = count;
+- BUG_ON(index > limit);
++ BUG_ON(index >= limit);
+ /* Make sure we don't terminate early. */
+ sg_unmark_end(&sg[index]);
+ sg_set_buf(&sg[index++], data, s);
+@@ -233,6 +233,7 @@ pack_sg_list_p(struct scatterlist *sg, int start, int limit,
+ s = PAGE_SIZE - data_off;
+ if (s > count)
+ s = count;
++ BUG_ON(index >= limit);
+ /* Make sure we don't terminate early. */
+ sg_unmark_end(&sg[index]);
+ sg_set_page(&sg[index++], pdata[i++], s, data_off);
+@@ -406,6 +407,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ p9_debug(P9_DEBUG_TRANS, "virtio request\n");
+
+ if (uodata) {
++ __le32 sz;
+ int n = p9_get_mapped_pages(chan, &out_pages, uodata,
+ outlen, &offs, &need_drop);
+ if (n < 0)
+@@ -416,6 +418,12 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4);
+ outlen = n;
+ }
++ /* The size field of the message must include the length of the
++ * header and the length of the data. We didn't actually know
++ * the length of the data until this point so add it in now.
++ */
++ sz = cpu_to_le32(req->tc->size + outlen);
++ memcpy(&req->tc->sdata[0], &sz, sizeof(sz));
+ } else if (uidata) {
+ int n = p9_get_mapped_pages(chan, &in_pages, uidata,
+ inlen, &offs, &need_drop);
+@@ -643,6 +651,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
+ int ret = -ENOENT;
+ int found = 0;
+
++ if (devname == NULL)
++ return -EINVAL;
++
+ mutex_lock(&virtio_9p_lock);
+ list_for_each_entry(chan, &virtio_chan_list, chan_list) {
+ if (!strncmp(devname, chan->tag, chan->tag_len) &&
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 2e2b8bca54f3..c2d54ac76bfd 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -94,6 +94,9 @@ static int p9_xen_create(struct p9_client *client, const char *addr, char *args)
+ {
+ struct xen_9pfs_front_priv *priv;
+
++ if (addr == NULL)
++ return -EINVAL;
++
+ read_lock(&xen_9pfs_lock);
+ list_for_each_entry(priv, &xen_9pfs_devs, list) {
+ if (!strcmp(priv->tag, addr)) {
+diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
+index e6ff5128e61a..ca53efa17be1 100644
+--- a/net/ieee802154/6lowpan/tx.c
++++ b/net/ieee802154/6lowpan/tx.c
+@@ -265,9 +265,24 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev)
+ /* We must take a copy of the skb before we modify/replace the ipv6
+ * header as the header could be used elsewhere
+ */
+- skb = skb_unshare(skb, GFP_ATOMIC);
+- if (!skb)
+- return NET_XMIT_DROP;
++ if (unlikely(skb_headroom(skb) < ldev->needed_headroom ||
++ skb_tailroom(skb) < ldev->needed_tailroom)) {
++ struct sk_buff *nskb;
++
++ nskb = skb_copy_expand(skb, ldev->needed_headroom,
++ ldev->needed_tailroom, GFP_ATOMIC);
++ if (likely(nskb)) {
++ consume_skb(skb);
++ skb = nskb;
++ } else {
++ kfree_skb(skb);
++ return NET_XMIT_DROP;
++ }
++ } else {
++ skb = skb_unshare(skb, GFP_ATOMIC);
++ if (!skb)
++ return NET_XMIT_DROP;
++ }
+
+ ret = lowpan_header(skb, ldev, &dgram_size, &dgram_offset);
+ if (ret < 0) {
+diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
+index 7e253455f9dd..bcd1a5e6ebf4 100644
+--- a/net/mac802154/tx.c
++++ b/net/mac802154/tx.c
+@@ -63,8 +63,21 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+ int ret;
+
+ if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) {
+- u16 crc = crc_ccitt(0, skb->data, skb->len);
++ struct sk_buff *nskb;
++ u16 crc;
++
++ if (unlikely(skb_tailroom(skb) < IEEE802154_FCS_LEN)) {
++ nskb = skb_copy_expand(skb, 0, IEEE802154_FCS_LEN,
++ GFP_ATOMIC);
++ if (likely(nskb)) {
++ consume_skb(skb);
++ skb = nskb;
++ } else {
++ goto err_tx;
++ }
++ }
+
++ crc = crc_ccitt(0, skb->data, skb->len);
+ put_unaligned_le16(crc, skb_put(skb, 2));
+ }
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index d839c33ae7d9..0d85425b1e07 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -965,10 +965,20 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(rpc_bind_new_program);
+
++void rpc_task_release_transport(struct rpc_task *task)
++{
++ struct rpc_xprt *xprt = task->tk_xprt;
++
++ if (xprt) {
++ task->tk_xprt = NULL;
++ xprt_put(xprt);
++ }
++}
++EXPORT_SYMBOL_GPL(rpc_task_release_transport);
++
+ void rpc_task_release_client(struct rpc_task *task)
+ {
+ struct rpc_clnt *clnt = task->tk_client;
+- struct rpc_xprt *xprt = task->tk_xprt;
+
+ if (clnt != NULL) {
+ /* Remove from client task list */
+@@ -979,12 +989,14 @@ void rpc_task_release_client(struct rpc_task *task)
+
+ rpc_release_client(clnt);
+ }
++ rpc_task_release_transport(task);
++}
+
+- if (xprt != NULL) {
+- task->tk_xprt = NULL;
+-
+- xprt_put(xprt);
+- }
++static
++void rpc_task_set_transport(struct rpc_task *task, struct rpc_clnt *clnt)
++{
++ if (!task->tk_xprt)
++ task->tk_xprt = xprt_iter_get_next(&clnt->cl_xpi);
+ }
+
+ static
+@@ -992,8 +1004,7 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
+ {
+
+ if (clnt != NULL) {
+- if (task->tk_xprt == NULL)
+- task->tk_xprt = xprt_iter_get_next(&clnt->cl_xpi);
++ rpc_task_set_transport(task, clnt);
+ task->tk_client = clnt;
+ atomic_inc(&clnt->cl_count);
+ if (clnt->cl_softrtry)
+@@ -1512,6 +1523,7 @@ call_start(struct rpc_task *task)
+ clnt->cl_program->version[clnt->cl_vers]->counts[idx]++;
+ clnt->cl_stats->rpccnt++;
+ task->tk_action = call_reserve;
++ rpc_task_set_transport(task, clnt);
+ }
+
+ /*
+diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
+index a3ac2c91331c..5e1dd493ce59 100644
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -173,7 +173,7 @@ HOSTLOADLIBES_nconf = $(shell . $(obj)/.nconf-cfg && echo $$libs)
+ HOSTCFLAGS_nconf.o = $(shell . $(obj)/.nconf-cfg && echo $$cflags)
+ HOSTCFLAGS_nconf.gui.o = $(shell . $(obj)/.nconf-cfg && echo $$cflags)
+
+-$(obj)/nconf.o: $(obj)/.nconf-cfg
++$(obj)/nconf.o $(obj)/nconf.gui.o: $(obj)/.nconf-cfg
+
+ # mconf: Used for the menuconfig target based on lxdialog
+ hostprogs-y += mconf
+@@ -184,7 +184,8 @@ HOSTLOADLIBES_mconf = $(shell . $(obj)/.mconf-cfg && echo $$libs)
+ $(foreach f, mconf.o $(lxdialog), \
+ $(eval HOSTCFLAGS_$f = $$(shell . $(obj)/.mconf-cfg && echo $$$$cflags)))
+
+-$(addprefix $(obj)/, mconf.o $(lxdialog)): $(obj)/.mconf-cfg
++$(obj)/mconf.o: $(obj)/.mconf-cfg
++$(addprefix $(obj)/lxdialog/, $(lxdialog)): $(obj)/.mconf-cfg
+
+ # qconf: Used for the xconfig target based on Qt
+ hostprogs-y += qconf
+diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
+index f2f22d00db18..4ccec1bcf6f5 100644
+--- a/security/apparmor/secid.c
++++ b/security/apparmor/secid.c
+@@ -79,7 +79,6 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ struct aa_label *label = aa_secid_to_label(secid);
+ int len;
+
+- AA_BUG(!secdata);
+ AA_BUG(!seclen);
+
+ if (!label)
+diff --git a/security/commoncap.c b/security/commoncap.c
+index f4c33abd9959..2e489d6a3ac8 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -388,7 +388,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ if (strcmp(name, "capability") != 0)
+ return -EOPNOTSUPP;
+
+- dentry = d_find_alias(inode);
++ dentry = d_find_any_alias(inode);
+ if (!dentry)
+ return -EINVAL;
+
+diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
+index 31f858eceffc..83eed9d7f679 100644
+--- a/sound/ac97/bus.c
++++ b/sound/ac97/bus.c
+@@ -503,7 +503,7 @@ static int ac97_bus_remove(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret)
++ if (ret < 0)
+ return ret;
+
+ ret = adrv->remove(adev);
+@@ -511,6 +511,8 @@ static int ac97_bus_remove(struct device *dev)
+ if (ret == 0)
+ ac97_put_disable_clk(adev);
+
++ pm_runtime_disable(dev);
++
+ return ret;
+ }
+
+diff --git a/sound/ac97/snd_ac97_compat.c b/sound/ac97/snd_ac97_compat.c
+index 61544e0d8de4..8bab44f74bb8 100644
+--- a/sound/ac97/snd_ac97_compat.c
++++ b/sound/ac97/snd_ac97_compat.c
+@@ -15,6 +15,11 @@
+
+ #include "ac97_core.h"
+
++static void compat_ac97_release(struct device *dev)
++{
++ kfree(to_ac97_t(dev));
++}
++
+ static void compat_ac97_reset(struct snd_ac97 *ac97)
+ {
+ struct ac97_codec_device *adev = to_ac97_device(ac97->private_data);
+@@ -65,21 +70,31 @@ static struct snd_ac97_bus compat_soc_ac97_bus = {
+ struct snd_ac97 *snd_ac97_compat_alloc(struct ac97_codec_device *adev)
+ {
+ struct snd_ac97 *ac97;
++ int ret;
+
+ ac97 = kzalloc(sizeof(struct snd_ac97), GFP_KERNEL);
+ if (ac97 == NULL)
+ return ERR_PTR(-ENOMEM);
+
+- ac97->dev = adev->dev;
+ ac97->private_data = adev;
+ ac97->bus = &compat_soc_ac97_bus;
++
++ ac97->dev.parent = &adev->dev;
++ ac97->dev.release = compat_ac97_release;
++ dev_set_name(&ac97->dev, "%s-compat", dev_name(&adev->dev));
++ ret = device_register(&ac97->dev);
++ if (ret) {
++ put_device(&ac97->dev);
++ return ERR_PTR(ret);
++ }
++
+ return ac97;
+ }
+ EXPORT_SYMBOL_GPL(snd_ac97_compat_alloc);
+
+ void snd_ac97_compat_release(struct snd_ac97 *ac97)
+ {
+- kfree(ac97);
++ device_unregister(&ac97->dev);
+ }
+ EXPORT_SYMBOL_GPL(snd_ac97_compat_release);
+
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index d056447520a2..eeb6d1f7cfb3 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -202,6 +202,9 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues,
+ for (i = 0; i < queues->nr_queues; i++) {
+ list_splice_tail(&queues->queue_array[i].head,
+ &queue_array[i].head);
++ queue_array[i].tid = queues->queue_array[i].tid;
++ queue_array[i].cpu = queues->queue_array[i].cpu;
++ queue_array[i].set = queues->queue_array[i].set;
+ queue_array[i].priv = queues->queue_array[i].priv;
+ }
+