linux kernel 4.14.34.14-4

2 files changed, 8038 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 1324e53f..9aaf65aa 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch:  1001_linux-4.14.2.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.2
 
+Patch:  1002_linux-4.14.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.3
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1002_linux-4.14.3.patch b/1002_linux-4.14.3.patch
new file mode 100644
index 00000000..269ad50d
--- /dev/null
+++ b/1002_linux-4.14.3.patch
@@ -0,0 +1,8034 @@
+diff --git a/Makefile b/Makefile
+index 75d89dc2b94a..ede4de0d8634 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
+index 35ff45470dbf..fc3b44028cfb 100644
+--- a/arch/arm/mm/dump.c
++++ b/arch/arm/mm/dump.c
+@@ -129,8 +129,8 @@ static const struct prot_bits section_bits[] = {
+ 		.val	= PMD_SECT_USER,
+ 		.set	= "USR",
+ 	}, {
+-		.mask	= L_PMD_SECT_RDONLY,
+-		.val	= L_PMD_SECT_RDONLY,
++		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
++		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ 		.set	= "ro",
+ 		.clear	= "RW",
+ #elif __LINUX_ARM_ARCH__ >= 6
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index ad80548325fe..0f6d1537f330 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -639,8 +639,8 @@ static struct section_perm ro_perms[] = {
+ 		.start  = (unsigned long)_stext,
+ 		.end    = (unsigned long)__init_begin,
+ #ifdef CONFIG_ARM_LPAE
+-		.mask   = ~L_PMD_SECT_RDONLY,
+-		.prot   = L_PMD_SECT_RDONLY,
++		.mask   = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
++		.prot   = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ #else
+ 		.mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
+ 		.prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index d8dd3298b15c..fb8d76a17bc5 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -49,6 +49,14 @@
+ 
+ / {
+ 	compatible = "amlogic,meson-gxl";
++
++	reserved-memory {
++		/* Alternate 3 MiB reserved for ARM Trusted Firmware (BL31) */
++		secmon_reserved_alt: secmon@05000000 {
++			reg = <0x0 0x05000000 0x0 0x300000>;
++			no-map;
++		};
++	};
+ };
+ 
+ &ethmac {
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index b46e54c2399b..c9530b5b5ca8 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -98,6 +98,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+ #define pte_valid_young(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
++#define pte_valid_user(pte) \
++	((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+ 
+ /*
+  * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+@@ -107,6 +109,18 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_accessible(mm, pte)	\
+ 	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
+ 
++/*
++ * p??_access_permitted() is true for valid user mappings (subject to the
++ * write permission check) other than user execute-only which do not have the
++ * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
++ */
++#define pte_access_permitted(pte, write) \
++	(pte_valid_user(pte) && (!(write) || pte_write(pte)))
++#define pmd_access_permitted(pmd, write) \
++	(pte_access_permitted(pmd_pte(pmd), (write)))
++#define pud_access_permitted(pud, write) \
++	(pte_access_permitted(pud_pte(pud), (write)))
++
+ static inline pte_t clear_pte_bit(pte_t pte, pgprot_t prot)
+ {
+ 	pte_val(pte) &= ~pgprot_val(prot);
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 5d3284d20678..c3d798b44030 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -65,7 +65,7 @@ config MIPS
+ 	select HAVE_PERF_EVENTS
+ 	select HAVE_REGS_AND_STACK_ACCESS_API
+ 	select HAVE_SYSCALL_TRACEPOINTS
+-	select HAVE_VIRT_CPU_ACCOUNTING_GEN
++	select HAVE_VIRT_CPU_ACCOUNTING_GEN if 64BIT || !SMP
+ 	select IRQ_FORCED_THREADING
+ 	select MODULES_USE_ELF_RELA if MODULES && 64BIT
+ 	select MODULES_USE_ELF_REL if MODULES
+diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c
+index d4f2407a42c6..8307a8a02667 100644
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -331,7 +331,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __initconst = {
+ /* Verified on: WRT54GS V1.0 */
+ static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_type_0101[] __initconst = {
+-	BCM47XX_GPIO_LED(0, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(0, "green", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "green", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+diff --git a/arch/mips/boot/dts/brcm/Makefile b/arch/mips/boot/dts/brcm/Makefile
+index 9e09cc4556b3..398994312361 100644
+--- a/arch/mips/boot/dts/brcm/Makefile
++++ b/arch/mips/boot/dts/brcm/Makefile
+@@ -23,7 +23,6 @@ dtb-$(CONFIG_DT_NONE) += \
+ 	bcm63268-comtrend-vr-3032u.dtb \
+ 	bcm93384wvg.dtb \
+ 	bcm93384wvg_viper.dtb \
+-	bcm96358nb4ser.dtb \
+ 	bcm96368mvwg.dtb \
+ 	bcm9ejtagprb.dtb \
+ 	bcm97125cbmb.dtb \
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 83054f79f72a..feb069cbf44e 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -19,6 +19,9 @@
+ #include <asm/asmmacro-64.h>
+ #endif
+ 
++/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
++#undef fp
++
+ /*
+  * Helper macros for generating raw instruction encodings.
+  */
+@@ -105,6 +108,7 @@
+ 	.macro	fpu_save_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	sdc1	$f1,  THREAD_FPR1(\thread)
+ 	sdc1	$f3,  THREAD_FPR3(\thread)
+@@ -126,8 +130,8 @@
+ 	.endm
+ 
+ 	.macro	fpu_save_double thread status tmp
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	sll	\tmp, \status, 5
+ 	bgez	\tmp, 10f
+ 	fpu_save_16odd \thread
+@@ -163,6 +167,7 @@
+ 	.macro	fpu_restore_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	ldc1	$f1,  THREAD_FPR1(\thread)
+ 	ldc1	$f3,  THREAD_FPR3(\thread)
+@@ -184,8 +189,8 @@
+ 	.endm
+ 
+ 	.macro	fpu_restore_double thread status tmp
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	sll	\tmp, \status, 5
+ 	bgez	\tmp, 10f				# 16 register mode?
+ 
+@@ -234,9 +239,6 @@
+ 	.endm
+ 
+ #ifdef TOOLCHAIN_SUPPORTS_MSA
+-/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+-#undef fp
+-
+ 	.macro	_cfcmsa	rd, cs
+ 	.set	push
+ 	.set	mips32r2
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index 7e25c5cc353a..89e9fb7976fe 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -204,8 +204,10 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+ #else
+ #include <asm-generic/cmpxchg-local.h>
+ #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
++#ifndef CONFIG_SMP
+ #define cmpxchg64(ptr, o, n) cmpxchg64_local((ptr), (o), (n))
+ #endif
++#endif
+ 
+ #undef __scbeqz
+ 
+diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
+index 1395654cfc8d..5a09c2901a76 100644
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -618,6 +618,19 @@ static const struct user_regset_view user_mips64_view = {
+ 	.n		= ARRAY_SIZE(mips64_regsets),
+ };
+ 
++#ifdef CONFIG_MIPS32_N32
++
++static const struct user_regset_view user_mipsn32_view = {
++	.name		= "mipsn32",
++	.e_flags	= EF_MIPS_ABI2,
++	.e_machine	= ELF_ARCH,
++	.ei_osabi	= ELF_OSABI,
++	.regsets	= mips64_regsets,
++	.n		= ARRAY_SIZE(mips64_regsets),
++};
++
++#endif /* CONFIG_MIPS32_N32 */
++
+ #endif /* CONFIG_64BIT */
+ 
+ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+@@ -628,6 +641,10 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+ #ifdef CONFIG_MIPS32_O32
+ 	if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ 		return &user_mips_view;
++#endif
++#ifdef CONFIG_MIPS32_N32
++	if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
++		return &user_mipsn32_view;
+ #endif
+ 	return &user_mips64_view;
+ #endif
+diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
+index 0a83b1708b3c..8e3a6020c613 100644
+--- a/arch/mips/kernel/r4k_fpu.S
++++ b/arch/mips/kernel/r4k_fpu.S
+@@ -40,8 +40,8 @@
+  */
+ LEAF(_save_fp)
+ EXPORT_SYMBOL(_save_fp)
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	mfc0	t0, CP0_STATUS
+ #endif
+ 	fpu_save_double a0 t0 t1		# clobbers t1
+@@ -52,8 +52,8 @@ EXPORT_SYMBOL(_save_fp)
+  * Restore a thread's fp context.
+  */
+ LEAF(_restore_fp)
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	mfc0	t0, CP0_STATUS
+ #endif
+ 	fpu_restore_double a0 t0 t1		# clobbers t1
+@@ -246,11 +246,11 @@ LEAF(_save_fp_context)
+ 	cfc1	t1, fcr31
+ 	.set	pop
+ 
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	.set	push
+ 	SET_HARDFLOAT
+-#ifdef CONFIG_CPU_MIPS32_R2
++#ifdef CONFIG_CPU_MIPSR2
+ 	.set	mips32r2
+ 	.set	fp=64
+ 	mfc0	t0, CP0_STATUS
+@@ -314,11 +314,11 @@ LEAF(_save_fp_context)
+ LEAF(_restore_fp_context)
+ 	EX	lw t1, 0(a1)
+ 
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)  || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2)  || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	.set	push
+ 	SET_HARDFLOAT
+-#ifdef CONFIG_CPU_MIPS32_R2
++#ifdef CONFIG_CPU_MIPSR2
+ 	.set	mips32r2
+ 	.set	fp=64
+ 	mfc0	t0, CP0_STATUS
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 16d9ef5a78c5..6f57212f5659 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -1795,7 +1795,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			SPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.s = ieee754sp_maddf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmsubf_op: {
+@@ -1809,7 +1809,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			SPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.s = ieee754sp_msubf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case frint_op: {
+@@ -1834,7 +1834,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.w = ieee754sp_2008class(fs);
+ 			rfmt = w_fmt;
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmin_op: {
+@@ -1847,7 +1847,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmin(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmina_op: {
+@@ -1860,7 +1860,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmina(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmax_op: {
+@@ -1873,7 +1873,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmax(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmaxa_op: {
+@@ -1886,7 +1886,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmaxa(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fabs_op:
+@@ -2165,7 +2165,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			DPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.d = ieee754dp_maddf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmsubf_op: {
+@@ -2179,7 +2179,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			DPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.d = ieee754dp_msubf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case frint_op: {
+@@ -2204,7 +2204,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.l = ieee754dp_2008class(fs);
+ 			rfmt = l_fmt;
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmin_op: {
+@@ -2217,7 +2217,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmin(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmina_op: {
+@@ -2230,7 +2230,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmina(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmax_op: {
+@@ -2243,7 +2243,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmax(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmaxa_op: {
+@@ -2256,7 +2256,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmaxa(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fabs_op:
+diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
+index 90fba9bf98da..27ac00c36bc0 100644
+--- a/arch/mips/pci/pci-mt7620.c
++++ b/arch/mips/pci/pci-mt7620.c
+@@ -121,7 +121,7 @@ static int wait_pciephy_busy(void)
+ 		else
+ 			break;
+ 		if (retry++ > WAITRETRY_MAX) {
+-			printk(KERN_WARN "PCIE-PHY retry failed.\n");
++			pr_warn("PCIE-PHY retry failed.\n");
+ 			return -1;
+ 		}
+ 	}
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index 9be8b08ae46b..41b71c4352c2 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -145,8 +145,8 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = {
+ 	FUNC("i2c", 0, 4, 2),
+ };
+ 
+-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
+-static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
++static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) };
++static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) };
+ static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
+ static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
+ 
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 41e60a9c7db2..e775f80ae28c 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -690,15 +690,15 @@ cas_action:
+ 	/* ELF32 Process entry path */
+ lws_compare_and_swap_2:
+ #ifdef CONFIG_64BIT
+-	/* Clip the input registers */
++	/* Clip the input registers. We don't need to clip %r23 as we
++	   only use it for word operations */
+ 	depdi	0, 31, 32, %r26
+ 	depdi	0, 31, 32, %r25
+ 	depdi	0, 31, 32, %r24
+-	depdi	0, 31, 32, %r23
+ #endif
+ 
+ 	/* Check the validity of the size pointer */
+-	subi,>>= 4, %r23, %r0
++	subi,>>= 3, %r23, %r0
+ 	b,n	lws_exit_nosys
+ 
+ 	/* Jump to the functions which will load the old and new values into
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 1c80bd292e48..06598142d755 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -542,7 +542,7 @@ EXC_COMMON_BEGIN(instruction_access_common)
+ 	RECONCILE_IRQ_STATE(r10, r11)
+ 	ld	r12,_MSR(r1)
+ 	ld	r3,_NIP(r1)
+-	andis.	r4,r12,DSISR_BAD_FAULT_64S@h
++	andis.	r4,r12,DSISR_SRR1_MATCH_64S@h
+ 	li	r5,0x400
+ 	std	r3,_DAR(r1)
+ 	std	r4,_DSISR(r1)
+diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
+index e9436c5e1e09..3d7539b90010 100644
+--- a/arch/powerpc/kernel/signal.c
++++ b/arch/powerpc/kernel/signal.c
+@@ -103,7 +103,7 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka,
+ static void do_signal(struct task_struct *tsk)
+ {
+ 	sigset_t *oldset = sigmask_to_save();
+-	struct ksignal ksig;
++	struct ksignal ksig = { .sig = 0 };
+ 	int ret;
+ 	int is32 = is_32bit_task();
+ 
+diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
+index 90644db9d38e..8e0cf8f186df 100644
+--- a/arch/powerpc/kvm/book3s_hv_builtin.c
++++ b/arch/powerpc/kvm/book3s_hv_builtin.c
+@@ -529,6 +529,8 @@ static inline bool is_rm(void)
+ 
+ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_xirr(vcpu);
+@@ -541,6 +543,8 @@ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)
+ 
+ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	vcpu->arch.gpr[5] = get_tb();
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+@@ -554,6 +558,8 @@ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)
+ 
+ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_ipoll(vcpu, server);
+@@ -567,6 +573,8 @@ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
+ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
+ 		    unsigned long mfrr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_ipi(vcpu, server, mfrr);
+@@ -579,6 +587,8 @@ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
+ 
+ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_cppr(vcpu, cppr);
+@@ -591,6 +601,8 @@ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
+ 
+ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_eoi(vcpu, xirr);
+diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
+index c9de03e0c1f1..d469224c4ada 100644
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -21,6 +21,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/page.h>
+ #include <asm/code-patching.h>
++#include <asm/setup.h>
+ 
+ static int __patch_instruction(unsigned int *addr, unsigned int instr)
+ {
+@@ -146,11 +147,8 @@ int patch_instruction(unsigned int *addr, unsigned int instr)
+ 	 * During early early boot patch_instruction is called
+ 	 * when text_poke_area is not ready, but we still need
+ 	 * to allow patching. We just do the plain old patching
+-	 * We use slab_is_available and per cpu read * via this_cpu_read
+-	 * of text_poke_area. Per-CPU areas might not be up early
+-	 * this can create problems with just using this_cpu_read()
+ 	 */
+-	if (!slab_is_available() || !this_cpu_read(text_poke_area))
++	if (!this_cpu_read(*PTRRELOC(&text_poke_area)))
+ 		return __patch_instruction(addr, instr);
+ 
+ 	local_irq_save(flags);
+diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
+index 558e9d3891bf..bd022d16745c 100644
+--- a/arch/powerpc/mm/hugetlbpage-radix.c
++++ b/arch/powerpc/mm/hugetlbpage-radix.c
+@@ -49,17 +49,28 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+ 	struct hstate *h = hstate_file(file);
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
+-	if (unlikely(addr > mm->context.addr_limit && addr < TASK_SIZE))
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > mm->task_size)
++	if (len > high_limit)
+ 		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
+ 
+-	if (flags & MAP_FIXED) {
++	if (unlikely(addr > mm->context.addr_limit &&
++		     mm->context.addr_limit != TASK_SIZE))
++		mm->context.addr_limit = TASK_SIZE;
++
++	if (fixed) {
+ 		if (prepare_hugepage_range(file, addr, len))
+ 			return -EINVAL;
+ 		return addr;
+@@ -68,7 +79,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr &&
++		if (high_limit - len >= addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -79,12 +90,9 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = PAGE_SIZE;
+-	info.high_limit = current->mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
+ 	info.align_offset = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
+index 5d78b193fec4..6d476a7b5611 100644
+--- a/arch/powerpc/mm/mmap.c
++++ b/arch/powerpc/mm/mmap.c
+@@ -106,22 +106,32 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ {
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -129,13 +139,9 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.flags = 0;
+ 	info.length = len;
+ 	info.low_limit = mm->mmap_base;
++	info.high_limit = high_limit;
+ 	info.align_mask = 0;
+ 
+-	if (unlikely(addr > DEFAULT_MAP_WINDOW))
+-		info.high_limit = mm->context.addr_limit;
+-	else
+-		info.high_limit = DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+ 
+@@ -149,37 +155,42 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long addr = addr0;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	/* requested length too big for entire address space */
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+-	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
+-				(!vma || addr + len <= vm_start_gap(vma)))
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
++		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+-	info.high_limit = mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	addr = vm_unmapped_area(&info);
+ 	if (!(addr & ~PAGE_MASK))
+ 		return addr;
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index 05e15386d4cb..b94fb62e60fd 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -93,11 +93,11 @@ static int hash__init_new_context(struct mm_struct *mm)
+ 		return index;
+ 
+ 	/*
+-	 * We do switch_slb() early in fork, even before we setup the
+-	 * mm->context.addr_limit. Default to max task size so that we copy the
+-	 * default values to paca which will help us to handle slb miss early.
++	 * In the case of exec, use the default limit,
++	 * otherwise inherit it from the mm we are duplicating.
+ 	 */
+-	mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
++	if (!mm->context.addr_limit)
++		mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
+ 
+ 	/*
+ 	 * The old code would re-promote on fork, we don't do that when using
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 39c252b54d16..cfbbee941a76 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -169,6 +169,16 @@ void radix__mark_rodata_ro(void)
+ {
+ 	unsigned long start, end;
+ 
++	/*
++	 * mark_rodata_ro() will mark itself as !writable at some point.
++	 * Due to DD1 workaround in radix__pte_update(), we'll end up with
++	 * an invalid pte and the system will crash quite severly.
++	 */
++	if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
++		pr_warn("Warning: Unable to mark rodata read only on P9 DD1\n");
++		return;
++	}
++
+ 	start = (unsigned long)_stext;
+ 	end = (unsigned long)__init_begin;
+ 
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 45f6740dd407..a4f93699194b 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -96,7 +96,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
+ {
+ 	struct vm_area_struct *vma;
+ 
+-	if ((mm->task_size - len) < addr)
++	if ((mm->context.addr_limit - len) < addr)
+ 		return 0;
+ 	vma = find_vma(mm, addr);
+ 	return (!vma || (addr + len) <= vm_start_gap(vma));
+@@ -133,7 +133,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret)
+ 		if (!slice_low_has_vma(mm, i))
+ 			ret->low_slices |= 1u << i;
+ 
+-	if (mm->task_size <= SLICE_LOW_TOP)
++	if (mm->context.addr_limit <= SLICE_LOW_TOP)
+ 		return;
+ 
+ 	for (i = 0; i < GET_HIGH_SLICE_INDEX(mm->context.addr_limit); i++)
+@@ -412,25 +412,31 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	struct slice_mask compat_mask;
+ 	int fixed = (flags & MAP_FIXED);
+ 	int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
++	unsigned long page_size = 1UL << pshift;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long newaddr;
+ 	unsigned long high_limit;
+ 
+-	/*
+-	 * Check if we need to expland slice area.
+-	 */
+-	if (unlikely(addr > mm->context.addr_limit &&
+-		     mm->context.addr_limit != TASK_SIZE)) {
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (len & (page_size - 1))
++		return -EINVAL;
++	if (fixed) {
++		if (addr & (page_size - 1))
++			return -EINVAL;
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
++	if (high_limit > mm->context.addr_limit) {
++		mm->context.addr_limit = high_limit;
+ 		on_each_cpu(slice_flush_segments, mm, 1);
+ 	}
+-	/*
+-	 * This mmap request can allocate upt to 512TB
+-	 */
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		high_limit = mm->context.addr_limit;
+-	else
+-		high_limit = DEFAULT_MAP_WINDOW;
++
+ 	/*
+ 	 * init different masks
+ 	 */
+@@ -446,27 +452,19 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 
+ 	/* Sanity checks */
+ 	BUG_ON(mm->task_size == 0);
++	BUG_ON(mm->context.addr_limit == 0);
+ 	VM_BUG_ON(radix_enabled());
+ 
+ 	slice_dbg("slice_get_unmapped_area(mm=%p, psize=%d...\n", mm, psize);
+ 	slice_dbg(" addr=%lx, len=%lx, flags=%lx, topdown=%d\n",
+ 		  addr, len, flags, topdown);
+ 
+-	if (len > mm->task_size)
+-		return -ENOMEM;
+-	if (len & ((1ul << pshift) - 1))
+-		return -EINVAL;
+-	if (fixed && (addr & ((1ul << pshift) - 1)))
+-		return -EINVAL;
+-	if (fixed && addr > (mm->task_size - len))
+-		return -ENOMEM;
+-
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+-		addr = _ALIGN_UP(addr, 1ul << pshift);
++		addr = _ALIGN_UP(addr, page_size);
+ 		slice_dbg(" aligned addr=%lx\n", addr);
+ 		/* Ignore hint if it's too large or overlaps a VMA */
+-		if (addr > mm->task_size - len ||
++		if (addr > high_limit - len ||
+ 		    !slice_area_is_free(mm, addr, len))
+ 			addr = 0;
+ 	}
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 36344117c680..cf64e16f92c2 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -467,7 +467,7 @@ static int nest_imc_event_init(struct perf_event *event)
+ 	 * Nest HW counter memory resides in a per-chip reserve-memory (HOMER).
+ 	 * Get the base memory addresss for this cpu.
+ 	 */
+-	chip_id = topology_physical_package_id(event->cpu);
++	chip_id = cpu_to_chip_id(event->cpu);
+ 	pcni = pmu->mem_info;
+ 	do {
+ 		if (pcni->id == chip_id) {
+@@ -524,19 +524,19 @@ static int nest_imc_event_init(struct perf_event *event)
+  */
+ static int core_imc_mem_init(int cpu, int size)
+ {
+-	int phys_id, rc = 0, core_id = (cpu / threads_per_core);
++	int nid, rc = 0, core_id = (cpu / threads_per_core);
+ 	struct imc_mem_info *mem_info;
+ 
+ 	/*
+ 	 * alloc_pages_node() will allocate memory for core in the
+ 	 * local node only.
+ 	 */
+-	phys_id = topology_physical_package_id(cpu);
++	nid = cpu_to_node(cpu);
+ 	mem_info = &core_imc_pmu->mem_info[core_id];
+ 	mem_info->id = core_id;
+ 
+ 	/* We need only vbase for core counters */
+-	mem_info->vbase = page_address(alloc_pages_node(phys_id,
++	mem_info->vbase = page_address(alloc_pages_node(nid,
+ 					  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+ 					  __GFP_NOWARN, get_order(size)));
+ 	if (!mem_info->vbase)
+@@ -797,14 +797,14 @@ static int core_imc_event_init(struct perf_event *event)
+ static int thread_imc_mem_alloc(int cpu_id, int size)
+ {
+ 	u64 ldbar_value, *local_mem = per_cpu(thread_imc_mem, cpu_id);
+-	int phys_id = topology_physical_package_id(cpu_id);
++	int nid = cpu_to_node(cpu_id);
+ 
+ 	if (!local_mem) {
+ 		/*
+ 		 * This case could happen only once at start, since we dont
+ 		 * free the memory in cpu offline path.
+ 		 */
+-		local_mem = page_address(alloc_pages_node(phys_id,
++		local_mem = page_address(alloc_pages_node(nid,
+ 				  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+ 				  __GFP_NOWARN, get_order(size)));
+ 		if (!local_mem)
+diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
+index c21fe1d57c00..ec7b476c1ac5 100644
+--- a/arch/s390/include/asm/switch_to.h
++++ b/arch/s390/include/asm/switch_to.h
+@@ -37,8 +37,8 @@ static inline void restore_access_regs(unsigned int *acrs)
+ 		save_ri_cb(prev->thread.ri_cb);				\
+ 		save_gs_cb(prev->thread.gs_cb);				\
+ 	}								\
++	update_cr_regs(next);						\
+ 	if (next->mm) {							\
+-		update_cr_regs(next);					\
+ 		set_cpu_flag(CIF_FPU);					\
+ 		restore_access_regs(&next->thread.acrs[0]);		\
+ 		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index f7e82302a71e..2394557653d5 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -1548,6 +1548,7 @@ static struct s390_insn opcode_e7[] = {
+ 	{ "vfsq", 0xce, INSTR_VRR_VV000MM },
+ 	{ "vfs", 0xe2, INSTR_VRR_VVV00MM },
+ 	{ "vftci", 0x4a, INSTR_VRI_VVIMM },
++	{ "", 0, INSTR_INVALID }
+ };
+ 
+ static struct s390_insn opcode_eb[] = {
+@@ -1953,7 +1954,7 @@ void show_code(struct pt_regs *regs)
+ {
+ 	char *mode = user_mode(regs) ? "User" : "Krnl";
+ 	unsigned char code[64];
+-	char buffer[64], *ptr;
++	char buffer[128], *ptr;
+ 	mm_segment_t old_fs;
+ 	unsigned long addr;
+ 	int start, end, opsize, hops, i;
+@@ -2016,7 +2017,7 @@ void show_code(struct pt_regs *regs)
+ 		start += opsize;
+ 		pr_cont("%s", buffer);
+ 		ptr = buffer;
+-		ptr += sprintf(ptr, "\n          ");
++		ptr += sprintf(ptr, "\n\t  ");
+ 		hops++;
+ 	}
+ 	pr_cont("\n");
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index b945448b9eae..f7b280f0ab16 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -375,8 +375,10 @@ static __init void detect_machine_facilities(void)
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_IDTE;
+ 	if (test_facility(40))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_LPP;
+-	if (test_facility(50) && test_facility(73))
++	if (test_facility(50) && test_facility(73)) {
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TE;
++		__ctl_set_bit(0, 55);
++	}
+ 	if (test_facility(51))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_LC;
+ 	if (test_facility(129)) {
+diff --git a/arch/s390/kernel/guarded_storage.c b/arch/s390/kernel/guarded_storage.c
+index bff39b66c9ff..9ee794e14f33 100644
+--- a/arch/s390/kernel/guarded_storage.c
++++ b/arch/s390/kernel/guarded_storage.c
+@@ -14,9 +14,11 @@
+ 
+ void exit_thread_gs(void)
+ {
++	preempt_disable();
+ 	kfree(current->thread.gs_cb);
+ 	kfree(current->thread.gs_bc_cb);
+ 	current->thread.gs_cb = current->thread.gs_bc_cb = NULL;
++	preempt_enable();
+ }
+ 
+ static int gs_enable(void)
+diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
+index b0ba2c26b45e..d6f7782e75c9 100644
+--- a/arch/s390/kernel/machine_kexec.c
++++ b/arch/s390/kernel/machine_kexec.c
+@@ -269,6 +269,7 @@ static void __do_machine_kexec(void *data)
+ 	s390_reset_system();
+ 	data_mover = (relocate_kernel_t) page_to_phys(image->control_code_page);
+ 
++	__arch_local_irq_stnsm(0xfb); /* disable DAT - avoid no-execute */
+ 	/* Call the moving routine */
+ 	(*data_mover)(&image->head, image->start);
+ 
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index a4a84fb08046..203b7cd7c348 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -100,6 +100,7 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long new_stackp,
+ 	memset(&p->thread.per_user, 0, sizeof(p->thread.per_user));
+ 	memset(&p->thread.per_event, 0, sizeof(p->thread.per_event));
+ 	clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
++	p->thread.per_flags = 0;
+ 	/* Initialize per thread user and system timer values */
+ 	p->thread.user_timer = 0;
+ 	p->thread.guest_timer = 0;
+diff --git a/arch/s390/kernel/relocate_kernel.S b/arch/s390/kernel/relocate_kernel.S
+index ca37e5d5b40c..9c2c96da23d0 100644
+--- a/arch/s390/kernel/relocate_kernel.S
++++ b/arch/s390/kernel/relocate_kernel.S
+@@ -29,7 +29,6 @@
+ ENTRY(relocate_kernel)
+ 		basr	%r13,0		# base address
+ 	.base:
+-		stnsm	sys_msk-.base(%r13),0xfb	# disable DAT
+ 		stctg	%c0,%c15,ctlregs-.base(%r13)
+ 		stmg	%r0,%r15,gprregs-.base(%r13)
+ 		lghi	%r0,3
+@@ -103,8 +102,6 @@ ENTRY(relocate_kernel)
+ 		.align	8
+ 	load_psw:
+ 		.long	0x00080000,0x80000000
+-	sys_msk:
+-		.quad	0
+ 	ctlregs:
+ 		.rept	16
+ 		.quad	0
+diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
+index 32aefb215e59..d85c64821a6b 100644
+--- a/arch/s390/kernel/runtime_instr.c
++++ b/arch/s390/kernel/runtime_instr.c
+@@ -50,11 +50,13 @@ void exit_thread_runtime_instr(void)
+ {
+ 	struct task_struct *task = current;
+ 
++	preempt_disable();
+ 	if (!task->thread.ri_cb)
+ 		return;
+ 	disable_runtime_instr();
+ 	kfree(task->thread.ri_cb);
+ 	task->thread.ri_cb = NULL;
++	preempt_enable();
+ }
+ 
+ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+@@ -65,9 +67,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (command == S390_RUNTIME_INSTR_STOP) {
+-		preempt_disable();
+ 		exit_thread_runtime_instr();
+-		preempt_enable();
+ 		return 0;
+ 	}
+ 
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index bcfc5668dcb2..518d9286b3d1 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -51,15 +51,19 @@ ENTRY(native_usergs_sysret64)
+ END(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
+-.macro TRACE_IRQS_IRETQ
++.macro TRACE_IRQS_FLAGS flags:req
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
++	bt	$9, \flags		/* interrupts off? */
+ 	jnc	1f
+ 	TRACE_IRQS_ON
+ 1:
+ #endif
+ .endm
+ 
++.macro TRACE_IRQS_IRETQ
++	TRACE_IRQS_FLAGS EFLAGS(%rsp)
++.endm
++
+ /*
+  * When dynamic function tracer is enabled it will add a breakpoint
+  * to all locations that it is about to modify, sync CPUs, update
+@@ -148,8 +152,6 @@ ENTRY(entry_SYSCALL_64)
+ 	movq	%rsp, PER_CPU_VAR(rsp_scratch)
+ 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+ 
+-	TRACE_IRQS_OFF
+-
+ 	/* Construct struct pt_regs on stack */
+ 	pushq	$__USER_DS			/* pt_regs->ss */
+ 	pushq	PER_CPU_VAR(rsp_scratch)	/* pt_regs->sp */
+@@ -170,6 +172,8 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ 	sub	$(6*8), %rsp			/* pt_regs->bp, bx, r12-15 not saved */
+ 	UNWIND_HINT_REGS extra=0
+ 
++	TRACE_IRQS_OFF
++
+ 	/*
+ 	 * If we need to do entry work or if we guess we'll need to do
+ 	 * exit work, go straight to the slow path.
+@@ -923,11 +927,13 @@ ENTRY(native_load_gs_index)
+ 	FRAME_BEGIN
+ 	pushfq
+ 	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
++	TRACE_IRQS_OFF
+ 	SWAPGS
+ .Lgs_change:
+ 	movl	%edi, %gs
+ 2:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
+ 	SWAPGS
++	TRACE_IRQS_FLAGS (%rsp)
+ 	popfq
+ 	FRAME_END
+ 	ret
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 9fb9a1f1e47b..f94855000d4e 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3730,6 +3730,19 @@ EVENT_ATTR_STR(cycles-t,	cycles_t,	"event=0x3c,in_tx=1");
+ EVENT_ATTR_STR(cycles-ct,	cycles_ct,	"event=0x3c,in_tx=1,in_tx_cp=1");
+ 
+ static struct attribute *hsw_events_attrs[] = {
++	EVENT_PTR(mem_ld_hsw),
++	EVENT_PTR(mem_st_hsw),
++	EVENT_PTR(td_slots_issued),
++	EVENT_PTR(td_slots_retired),
++	EVENT_PTR(td_fetch_bubbles),
++	EVENT_PTR(td_total_slots),
++	EVENT_PTR(td_total_slots_scale),
++	EVENT_PTR(td_recovery_bubbles),
++	EVENT_PTR(td_recovery_bubbles_scale),
++	NULL
++};
++
++static struct attribute *hsw_tsx_events_attrs[] = {
+ 	EVENT_PTR(tx_start),
+ 	EVENT_PTR(tx_commit),
+ 	EVENT_PTR(tx_abort),
+@@ -3742,18 +3755,16 @@ static struct attribute *hsw_events_attrs[] = {
+ 	EVENT_PTR(el_conflict),
+ 	EVENT_PTR(cycles_t),
+ 	EVENT_PTR(cycles_ct),
+-	EVENT_PTR(mem_ld_hsw),
+-	EVENT_PTR(mem_st_hsw),
+-	EVENT_PTR(td_slots_issued),
+-	EVENT_PTR(td_slots_retired),
+-	EVENT_PTR(td_fetch_bubbles),
+-	EVENT_PTR(td_total_slots),
+-	EVENT_PTR(td_total_slots_scale),
+-	EVENT_PTR(td_recovery_bubbles),
+-	EVENT_PTR(td_recovery_bubbles_scale),
+ 	NULL
+ };
+ 
++static __init struct attribute **get_hsw_events_attrs(void)
++{
++	return boot_cpu_has(X86_FEATURE_RTM) ?
++		merge_attr(hsw_events_attrs, hsw_tsx_events_attrs) :
++		hsw_events_attrs;
++}
++
+ static ssize_t freeze_on_smi_show(struct device *cdev,
+ 				  struct device_attribute *attr,
+ 				  char *buf)
+@@ -4182,7 +4193,7 @@ __init int intel_pmu_init(void)
+ 
+ 		x86_pmu.hw_config = hsw_hw_config;
+ 		x86_pmu.get_event_constraints = hsw_get_event_constraints;
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		x86_pmu.lbr_double_abort = true;
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+@@ -4221,7 +4232,7 @@ __init int intel_pmu_init(void)
+ 
+ 		x86_pmu.hw_config = hsw_hw_config;
+ 		x86_pmu.get_event_constraints = hsw_get_event_constraints;
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		x86_pmu.limit_period = bdw_limit_period;
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+@@ -4279,7 +4290,7 @@ __init int intel_pmu_init(void)
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+ 		extra_attr = merge_attr(extra_attr, skl_format_attr);
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		intel_pmu_pebs_data_source_skl(
+ 			boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
+ 		pr_cont("Skylake events, ");
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index 410c5dadcee3..3a4b12809ab5 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -431,6 +431,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
+ }
+ 
+ static unsigned long mpf_base;
++static bool mpf_found;
+ 
+ static unsigned long __init get_mpc_size(unsigned long physptr)
+ {
+@@ -504,7 +505,7 @@ void __init default_get_smp_config(unsigned int early)
+ 	if (!smp_found_config)
+ 		return;
+ 
+-	if (!mpf_base)
++	if (!mpf_found)
+ 		return;
+ 
+ 	if (acpi_lapic && early)
+@@ -593,6 +594,7 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
+ 			smp_found_config = 1;
+ #endif
+ 			mpf_base = base;
++			mpf_found = true;
+ 
+ 			pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
+ 				base, base + sizeof(*mpf) - 1, mpf);
+@@ -858,7 +860,7 @@ static int __init update_mp_table(void)
+ 	if (!enable_update_mptable)
+ 		return 0;
+ 
+-	if (!mpf_base)
++	if (!mpf_found)
+ 		return 0;
+ 
+ 	mpf = early_memremap(mpf_base, sizeof(*mpf));
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 0e68f0b3cbf7..ca209a4a7834 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3657,6 +3657,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ 	u32 ecx = msr->index;
+ 	u64 data = msr->data;
+ 	switch (ecx) {
++	case MSR_IA32_CR_PAT:
++		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++			return 1;
++		vcpu->arch.pat = data;
++		svm->vmcb->save.g_pat = data;
++		mark_dirty(svm->vmcb, VMCB_NPT);
++		break;
+ 	case MSR_IA32_TSC:
+ 		kvm_write_tsc(vcpu, msr);
+ 		break;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a6f4f095f8f4..21cad7068cbf 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -202,6 +202,10 @@ struct loaded_vmcs {
+ 	bool nmi_known_unmasked;
+ 	unsigned long vmcs_host_cr3;	/* May not match real cr3 */
+ 	unsigned long vmcs_host_cr4;	/* May not match real cr4 */
++	/* Support for vnmi-less CPUs */
++	int soft_vnmi_blocked;
++	ktime_t entry_time;
++	s64 vnmi_blocked_time;
+ 	struct list_head loaded_vmcss_on_cpu_link;
+ };
+ 
+@@ -1286,6 +1290,11 @@ static inline bool cpu_has_vmx_invpcid(void)
+ 		SECONDARY_EXEC_ENABLE_INVPCID;
+ }
+ 
++static inline bool cpu_has_virtual_nmis(void)
++{
++	return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
+ static inline bool cpu_has_vmx_wbinvd_exit(void)
+ {
+ 	return vmcs_config.cpu_based_2nd_exec_ctrl &
+@@ -1343,11 +1352,6 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+ 		(vmcs12->secondary_vm_exec_control & bit);
+ }
+ 
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+-	return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+ static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+ {
+ 	return vmcs12->pin_based_vm_exec_control &
+@@ -3699,9 +3703,9 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 				&_vmexit_control) < 0)
+ 		return -EIO;
+ 
+-	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING |
+-		PIN_BASED_VIRTUAL_NMIS;
+-	opt = PIN_BASED_POSTED_INTR | PIN_BASED_VMX_PREEMPTION_TIMER;
++	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++	opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++		 PIN_BASED_VMX_PREEMPTION_TIMER;
+ 	if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+ 				&_pin_based_exec_control) < 0)
+ 		return -EIO;
+@@ -5667,7 +5671,8 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ 
+ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ {
+-	if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++	if (!cpu_has_virtual_nmis() ||
++	    vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+ 		enable_irq_window(vcpu);
+ 		return;
+ 	}
+@@ -5707,6 +5712,19 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
++	if (!cpu_has_virtual_nmis()) {
++		/*
++		 * Tracking the NMI-blocked state in software is built upon
++		 * finding the next open IRQ window. This, in turn, depends on
++		 * well-behaving guests: They have to keep IRQs disabled at
++		 * least as long as the NMI handler runs. Otherwise we may
++		 * cause NMI nesting, maybe breaking the guest. But as this is
++		 * highly unlikely, we can live with the residual risk.
++		 */
++		vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++		vmx->loaded_vmcs->vnmi_blocked_time = 0;
++	}
++
+ 	++vcpu->stat.nmi_injections;
+ 	vmx->loaded_vmcs->nmi_known_unmasked = false;
+ 
+@@ -5725,6 +5743,8 @@ static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	bool masked;
+ 
++	if (!cpu_has_virtual_nmis())
++		return vmx->loaded_vmcs->soft_vnmi_blocked;
+ 	if (vmx->loaded_vmcs->nmi_known_unmasked)
+ 		return false;
+ 	masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+@@ -5736,13 +5756,20 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+-	vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+-	if (masked)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+-				GUEST_INTR_STATE_NMI);
++	if (!cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++			vmx->loaded_vmcs->vnmi_blocked_time = 0;
++		}
++	} else {
++		vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++		if (masked)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++					GUEST_INTR_STATE_NMI);
++	}
+ }
+ 
+ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+@@ -5750,6 +5777,10 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+ 	if (to_vmx(vcpu)->nested.nested_run_pending)
+ 		return 0;
+ 
++	if (!cpu_has_virtual_nmis() &&
++	    to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++		return 0;
++
+ 	return	!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ 		  (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+ 		   | GUEST_INTR_STATE_NMI));
+@@ -6478,6 +6509,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
+ 	 * AAK134, BY25.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+ 
+@@ -6961,7 +6993,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
+ 	}
+ 
+ 	/* Create a new VMCS */
+-	item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
++	item = kzalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
+ 	if (!item)
+ 		return NULL;
+ 	item->vmcs02.vmcs = alloc_vmcs();
+@@ -7978,6 +8010,7 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)
+ 	 * "blocked by NMI" bit has to be set before next VM entry.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ 				GUEST_INTR_STATE_NMI);
+@@ -8822,6 +8855,25 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ 		return 0;
+ 	}
+ 
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked)) {
++		if (vmx_interrupt_allowed(vcpu)) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		} else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++			   vcpu->arch.nmi_pending) {
++			/*
++			 * This CPU don't support us in finding the end of an
++			 * NMI-blocked window if the guest runs with IRQs
++			 * disabled. So we pull the trigger after 1 s of
++			 * futile waiting, but inform the user about this.
++			 */
++			printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++			       "state on VCPU %d after 1 s timeout\n",
++			       __func__, vcpu->vcpu_id);
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		}
++	}
++
+ 	if (exit_reason < kvm_vmx_max_exit_handlers
+ 	    && kvm_vmx_exit_handlers[exit_reason])
+ 		return kvm_vmx_exit_handlers[exit_reason](vcpu);
+@@ -9104,33 +9156,38 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+ 
+ 	idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ 
+-	if (vmx->loaded_vmcs->nmi_known_unmasked)
+-		return;
+-	/*
+-	 * Can't use vmx->exit_intr_info since we're not sure what
+-	 * the exit reason is.
+-	 */
+-	exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-	unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+-	vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+-	/*
+-	 * SDM 3: 27.7.1.2 (September 2008)
+-	 * Re-set bit "block by NMI" before VM entry if vmexit caused by
+-	 * a guest IRET fault.
+-	 * SDM 3: 23.2.2 (September 2008)
+-	 * Bit 12 is undefined in any of the following cases:
+-	 *  If the VM exit sets the valid bit in the IDT-vectoring
+-	 *   information field.
+-	 *  If the VM exit is due to a double fault.
+-	 */
+-	if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+-	    vector != DF_VECTOR && !idtv_info_valid)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmx->loaded_vmcs->nmi_known_unmasked =
+-			!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+-			  & GUEST_INTR_STATE_NMI);
++	if (cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->nmi_known_unmasked)
++			return;
++		/*
++		 * Can't use vmx->exit_intr_info since we're not sure what
++		 * the exit reason is.
++		 */
++		exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++		unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++		vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++		/*
++		 * SDM 3: 27.7.1.2 (September 2008)
++		 * Re-set bit "block by NMI" before VM entry if vmexit caused by
++		 * a guest IRET fault.
++		 * SDM 3: 23.2.2 (September 2008)
++		 * Bit 12 is undefined in any of the following cases:
++		 *  If the VM exit sets the valid bit in the IDT-vectoring
++		 *   information field.
++		 *  If the VM exit is due to a double fault.
++		 */
++		if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++		    vector != DF_VECTOR && !idtv_info_valid)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmx->loaded_vmcs->nmi_known_unmasked =
++				!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++				  & GUEST_INTR_STATE_NMI);
++	} else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->vnmi_blocked_time +=
++			ktime_to_ns(ktime_sub(ktime_get(),
++					      vmx->loaded_vmcs->entry_time));
+ }
+ 
+ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+@@ -9247,6 +9304,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	unsigned long debugctlmsr, cr3, cr4;
+ 
++	/* Record the guest's net vcpu time for enforced NMI injections. */
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->entry_time = ktime_get();
++
+ 	/* Don't enter VMX if guest state is invalid, let the exit handler
+ 	   start emulation until we arrive back to a valid state */
+ 	if (vmx->emulation_required)
+@@ -11325,6 +11387,8 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ 	vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
+ 	vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
+ 	vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
++	vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
++	vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
+ 
+ 	/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1.  */
+ 	if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 12e377184ee4..c4d55919fac1 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -896,7 +896,7 @@ EndTable
+ 
+ GrpTable: Grp3_1
+ 0: TEST Eb,Ib
+-1:
++1: TEST Eb,Ib
+ 2: NOT Eb
+ 3: NEG Eb
+ 4: MUL AL,Eb
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 048be4aa6024..33ee583cfe45 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -333,6 +333,7 @@ EXPORT_SYMBOL(blk_stop_queue);
+ void blk_sync_queue(struct request_queue *q)
+ {
+ 	del_timer_sync(&q->timeout);
++	cancel_work_sync(&q->timeout_work);
+ 
+ 	if (q->mq_ops) {
+ 		struct blk_mq_hw_ctx *hctx;
+@@ -844,6 +845,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
+ 	setup_timer(&q->backing_dev_info->laptop_mode_wb_timer,
+ 		    laptop_mode_timer_fn, (unsigned long) q);
+ 	setup_timer(&q->timeout, blk_rq_timed_out_timer, (unsigned long) q);
++	INIT_WORK(&q->timeout_work, NULL);
+ 	INIT_LIST_HEAD(&q->queue_head);
+ 	INIT_LIST_HEAD(&q->timeout_list);
+ 	INIT_LIST_HEAD(&q->icq_list);
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 17ec83bb0900..6427be7ac363 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -134,8 +134,6 @@ void blk_timeout_work(struct work_struct *work)
+ 	struct request *rq, *tmp;
+ 	int next_set = 0;
+ 
+-	if (blk_queue_enter(q, true))
+-		return;
+ 	spin_lock_irqsave(q->queue_lock, flags);
+ 
+ 	list_for_each_entry_safe(rq, tmp, &q->timeout_list, timeout_list)
+@@ -145,7 +143,6 @@ void blk_timeout_work(struct work_struct *work)
+ 		mod_timer(&q->timeout, round_jiffies_up(next));
+ 
+ 	spin_unlock_irqrestore(q->queue_lock, flags);
+-	blk_queue_exit(q);
+ }
+ 
+ /**
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index fbcc73f7a099..18af71057b44 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -387,6 +387,7 @@ EXPORT_SYMBOL(acpi_bus_power_manageable);
+ 
+ #ifdef CONFIG_PM
+ static DEFINE_MUTEX(acpi_pm_notifier_lock);
++static DEFINE_MUTEX(acpi_pm_notifier_install_lock);
+ 
+ void acpi_pm_wakeup_event(struct device *dev)
+ {
+@@ -443,24 +444,25 @@ acpi_status acpi_add_pm_notifier(struct acpi_device *adev, struct device *dev,
+ 	if (!dev && !func)
+ 		return AE_BAD_PARAMETER;
+ 
+-	mutex_lock(&acpi_pm_notifier_lock);
++	mutex_lock(&acpi_pm_notifier_install_lock);
+ 
+ 	if (adev->wakeup.flags.notifier_present)
+ 		goto out;
+ 
+-	adev->wakeup.ws = wakeup_source_register(dev_name(&adev->dev));
+-	adev->wakeup.context.dev = dev;
+-	adev->wakeup.context.func = func;
+-
+ 	status = acpi_install_notify_handler(adev->handle, ACPI_SYSTEM_NOTIFY,
+ 					     acpi_pm_notify_handler, NULL);
+ 	if (ACPI_FAILURE(status))
+ 		goto out;
+ 
++	mutex_lock(&acpi_pm_notifier_lock);
++	adev->wakeup.ws = wakeup_source_register(dev_name(&adev->dev));
++	adev->wakeup.context.dev = dev;
++	adev->wakeup.context.func = func;
+ 	adev->wakeup.flags.notifier_present = true;
++	mutex_unlock(&acpi_pm_notifier_lock);
+ 
+  out:
+-	mutex_unlock(&acpi_pm_notifier_lock);
++	mutex_unlock(&acpi_pm_notifier_install_lock);
+ 	return status;
+ }
+ 
+@@ -472,7 +474,7 @@ acpi_status acpi_remove_pm_notifier(struct acpi_device *adev)
+ {
+ 	acpi_status status = AE_BAD_PARAMETER;
+ 
+-	mutex_lock(&acpi_pm_notifier_lock);
++	mutex_lock(&acpi_pm_notifier_install_lock);
+ 
+ 	if (!adev->wakeup.flags.notifier_present)
+ 		goto out;
+@@ -483,14 +485,15 @@ acpi_status acpi_remove_pm_notifier(struct acpi_device *adev)
+ 	if (ACPI_FAILURE(status))
+ 		goto out;
+ 
++	mutex_lock(&acpi_pm_notifier_lock);
+ 	adev->wakeup.context.func = NULL;
+ 	adev->wakeup.context.dev = NULL;
+ 	wakeup_source_unregister(adev->wakeup.ws);
+-
+ 	adev->wakeup.flags.notifier_present = false;
++	mutex_unlock(&acpi_pm_notifier_lock);
+ 
+  out:
+-	mutex_unlock(&acpi_pm_notifier_lock);
++	mutex_unlock(&acpi_pm_notifier_install_lock);
+ 	return status;
+ }
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 236b14324780..82b3ce5e937e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -486,8 +486,11 @@ static inline void __acpi_ec_enable_event(struct acpi_ec *ec)
+ {
+ 	if (!test_and_set_bit(EC_FLAGS_QUERY_ENABLED, &ec->flags))
+ 		ec_log_drv("event unblocked");
+-	if (!test_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+-		advance_transaction(ec);
++	/*
++	 * Unconditionally invoke this once after enabling the event
++	 * handling mechanism to detect the pending events.
++	 */
++	advance_transaction(ec);
+ }
+ 
+ static inline void __acpi_ec_disable_event(struct acpi_ec *ec)
+@@ -1456,11 +1459,10 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events)
+ 			if (test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+ 			    ec->reference_count >= 1)
+ 				acpi_ec_enable_gpe(ec, true);
+-
+-			/* EC is fully operational, allow queries */
+-			acpi_ec_enable_event(ec);
+ 		}
+ 	}
++	/* EC is fully operational, allow queries */
++	acpi_ec_enable_event(ec);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index e4effef0c83f..ea20e0eb4d5a 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2264,8 +2264,8 @@ static void ata_eh_link_autopsy(struct ata_link *link)
+ 		if (dev->flags & ATA_DFLAG_DUBIOUS_XFER)
+ 			eflags |= ATA_EFLAG_DUBIOUS_XFER;
+ 		ehc->i.action |= ata_eh_speed_down(dev, eflags, all_err_mask);
++		trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	}
+-	trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	DPRINTK("EXIT\n");
+ }
+ 
+diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
+index 0b718886479b..87509cb69f79 100644
+--- a/drivers/base/power/opp/of.c
++++ b/drivers/base/power/opp/of.c
+@@ -397,6 +397,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ 			dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
+ 				ret);
+ 			_dev_pm_opp_remove_table(opp_table, dev, false);
++			of_node_put(np);
+ 			goto put_opp_table;
+ 		}
+ 	}
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 9adfb5445f8d..5f2a4240a204 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -288,15 +288,6 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ 		cmd->status = BLK_STS_TIMEOUT;
+ 		return BLK_EH_HANDLED;
+ 	}
+-
+-	/* If we are waiting on our dead timer then we could get timeout
+-	 * callbacks for our request.  For this we just want to reset the timer
+-	 * and let the queue side take care of everything.
+-	 */
+-	if (!completion_done(&cmd->send_complete)) {
+-		nbd_config_put(nbd);
+-		return BLK_EH_RESET_TIMER;
+-	}
+ 	config = nbd->config;
+ 
+ 	if (config->num_connections > 1) {
+@@ -723,9 +714,9 @@ static int wait_for_reconnect(struct nbd_device *nbd)
+ 		return 0;
+ 	if (test_bit(NBD_DISCONNECTED, &config->runtime_flags))
+ 		return 0;
+-	wait_event_interruptible_timeout(config->conn_wait,
+-					 atomic_read(&config->live_connections),
+-					 config->dead_conn_timeout);
++	wait_event_timeout(config->conn_wait,
++			   atomic_read(&config->live_connections),
++			   config->dead_conn_timeout);
+ 	return atomic_read(&config->live_connections);
+ }
+ 
+@@ -740,6 +731,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	if (!refcount_inc_not_zero(&nbd->config_refs)) {
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+ 				    "Socks array is empty\n");
++		blk_mq_start_request(req);
+ 		return -EINVAL;
+ 	}
+ 	config = nbd->config;
+@@ -748,6 +740,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+ 				    "Attempted send on invalid socket\n");
+ 		nbd_config_put(nbd);
++		blk_mq_start_request(req);
+ 		return -EINVAL;
+ 	}
+ 	cmd->status = BLK_STS_OK;
+@@ -771,6 +764,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 			 */
+ 			sock_shutdown(nbd);
+ 			nbd_config_put(nbd);
++			blk_mq_start_request(req);
+ 			return -EIO;
+ 		}
+ 		goto again;
+@@ -781,6 +775,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	 * here so that it gets put _after_ the request that is already on the
+ 	 * dispatch list.
+ 	 */
++	blk_mq_start_request(req);
+ 	if (unlikely(nsock->pending && nsock->pending != req)) {
+ 		blk_mq_requeue_request(req, true);
+ 		ret = 0;
+@@ -793,10 +788,10 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	ret = nbd_send_cmd(nbd, cmd, index);
+ 	if (ret == -EAGAIN) {
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+-				    "Request send failed trying another connection\n");
++				    "Request send failed, requeueing\n");
+ 		nbd_mark_nsock_dead(nbd, nsock, 1);
+-		mutex_unlock(&nsock->tx_lock);
+-		goto again;
++		blk_mq_requeue_request(req, true);
++		ret = 0;
+ 	}
+ out:
+ 	mutex_unlock(&nsock->tx_lock);
+@@ -820,7 +815,6 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
+ 	 * done sending everything over the wire.
+ 	 */
+ 	init_completion(&cmd->send_complete);
+-	blk_mq_start_request(bd->rq);
+ 
+ 	/* We can be called directly from the user space process, which means we
+ 	 * could possibly have signals pending so our sendmsg will fail.  In
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index d00c4fdae924..bd810d01538a 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -26,6 +26,7 @@
+ struct btqcomsmd {
+ 	struct hci_dev *hdev;
+ 
++	bdaddr_t bdaddr;
+ 	struct rpmsg_endpoint *acl_channel;
+ 	struct rpmsg_endpoint *cmd_channel;
+ };
+@@ -100,6 +101,38 @@ static int btqcomsmd_close(struct hci_dev *hdev)
+ 	return 0;
+ }
+ 
++static int btqcomsmd_setup(struct hci_dev *hdev)
++{
++	struct btqcomsmd *btq = hci_get_drvdata(hdev);
++	struct sk_buff *skb;
++	int err;
++
++	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++	kfree_skb(skb);
++
++	/* Devices do not have persistent storage for BD address. If no
++	 * BD address has been retrieved during probe, mark the device
++	 * as having an invalid BD address.
++	 */
++	if (!bacmp(&btq->bdaddr, BDADDR_ANY)) {
++		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
++		return 0;
++	}
++
++	/* When setting a configured BD address fails, mark the device
++	 * as having an invalid BD address.
++	 */
++	err = qca_set_bdaddr_rome(hdev, &btq->bdaddr);
++	if (err) {
++		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
++		return 0;
++	}
++
++	return 0;
++}
++
+ static int btqcomsmd_probe(struct platform_device *pdev)
+ {
+ 	struct btqcomsmd *btq;
+@@ -135,6 +168,7 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ 	hdev->open = btqcomsmd_open;
+ 	hdev->close = btqcomsmd_close;
+ 	hdev->send = btqcomsmd_send;
++	hdev->setup = btqcomsmd_setup;
+ 	hdev->set_bdaddr = qca_set_bdaddr_rome;
+ 
+ 	ret = hci_register_dev(hdev);
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 13eb04f72389..148815470431 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -274,8 +274,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ 
+ 		/* Get configuration for the ATL instances */
+ 		snprintf(prop, sizeof(prop), "atl%u", i);
+-		of_node_get(node);
+-		cfg_node = of_find_node_by_name(node, prop);
++		cfg_node = of_get_child_by_name(node, prop);
+ 		if (cfg_node) {
+ 			ret = of_property_read_u32(cfg_node, "bws",
+ 						   &cdesc->bws);
+diff --git a/drivers/dax/super.c b/drivers/dax/super.c
+index 557b93703532..c4cd034a3820 100644
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -344,6 +344,9 @@ static struct inode *dax_alloc_inode(struct super_block *sb)
+ 	struct inode *inode;
+ 
+ 	dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
++	if (!dax_dev)
++		return NULL;
++
+ 	inode = &dax_dev->inode;
+ 	inode->i_rdev = 0;
+ 	return inode;
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 4c4b46586af2..2af79e4f3235 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1575,7 +1575,7 @@ static void cm_format_req_event(struct cm_work *work,
+ 	param->bth_pkey = cm_get_bth_pkey(work);
+ 	param->port = cm_id_priv->av.port->port_num;
+ 	param->primary_path = &work->path[0];
+-	if (req_msg->alt_local_lid)
++	if (cm_req_has_alt_path(req_msg))
+ 		param->alternate_path = &work->path[1];
+ 	else
+ 		param->alternate_path = NULL;
+@@ -1856,7 +1856,8 @@ static int cm_req_handler(struct cm_work *work)
+ 	cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
+ 
+ 	memset(&work->path[0], 0, sizeof(work->path[0]));
+-	memset(&work->path[1], 0, sizeof(work->path[1]));
++	if (cm_req_has_alt_path(req_msg))
++		memset(&work->path[1], 0, sizeof(work->path[1]));
+ 	grh = rdma_ah_read_grh(&cm_id_priv->av.ah_attr);
+ 	ret = ib_get_cached_gid(work->port->cm_dev->ib_device,
+ 				work->port->port_num,
+@@ -3817,14 +3818,16 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
+ 	struct cm_port *port = mad_agent->context;
+ 	struct cm_work *work;
+ 	enum ib_cm_event_type event;
++	bool alt_path = false;
+ 	u16 attr_id;
+ 	int paths = 0;
+ 	int going_down = 0;
+ 
+ 	switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
+ 	case CM_REQ_ATTR_ID:
+-		paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
+-						    alt_local_lid != 0);
++		alt_path = cm_req_has_alt_path((struct cm_req_msg *)
++						mad_recv_wc->recv_buf.mad);
++		paths = 1 + (alt_path != 0);
+ 		event = IB_CM_REQ_RECEIVED;
+ 		break;
+ 	case CM_MRA_ATTR_ID:
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index f8f53bb90837..cb91245e9163 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -1974,14 +1974,15 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
+ 	unsigned long flags;
+ 	int ret;
+ 
++	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
+ 	ret = ib_mad_enforce_security(mad_agent_priv,
+ 				      mad_recv_wc->wc->pkey_index);
+ 	if (ret) {
+ 		ib_free_recv_mad(mad_recv_wc);
+ 		deref_mad_agent(mad_agent_priv);
++		return;
+ 	}
+ 
+-	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
+ 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
+ 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
+ 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 88bdafb297f5..28607bb42d87 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -87,16 +87,14 @@ static int enforce_qp_pkey_security(u16 pkey,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (qp_sec->qp == qp_sec->qp->real_qp) {
+-		list_for_each_entry(shared_qp_sec,
+-				    &qp_sec->shared_qp_list,
+-				    shared_qp_list) {
+-			ret = security_ib_pkey_access(shared_qp_sec->security,
+-						      subnet_prefix,
+-						      pkey);
+-			if (ret)
+-				return ret;
+-		}
++	list_for_each_entry(shared_qp_sec,
++			    &qp_sec->shared_qp_list,
++			    shared_qp_list) {
++		ret = security_ib_pkey_access(shared_qp_sec->security,
++					      subnet_prefix,
++					      pkey);
++		if (ret)
++			return ret;
+ 	}
+ 	return 0;
+ }
+@@ -560,15 +558,22 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 	int ret = 0;
+ 	struct ib_ports_pkeys *tmp_pps;
+ 	struct ib_ports_pkeys *new_pps;
+-	bool special_qp = (qp->qp_type == IB_QPT_SMI ||
+-			   qp->qp_type == IB_QPT_GSI ||
+-			   qp->qp_type >= IB_QPT_RESERVED1);
++	struct ib_qp *real_qp = qp->real_qp;
++	bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
++			   real_qp->qp_type == IB_QPT_GSI ||
++			   real_qp->qp_type >= IB_QPT_RESERVED1);
+ 	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
+ 			   (qp_attr_mask & IB_QP_ALT_PATH));
+ 
++	/* The port/pkey settings are maintained only for the real QP. Open
++	 * handles on the real QP will be in the shared_qp_list. When
++	 * enforcing security on the real QP all the shared QPs will be
++	 * checked as well.
++	 */
++
+ 	if (pps_change && !special_qp) {
+-		mutex_lock(&qp->qp_sec->mutex);
+-		new_pps = get_new_pps(qp,
++		mutex_lock(&real_qp->qp_sec->mutex);
++		new_pps = get_new_pps(real_qp,
+ 				      qp_attr,
+ 				      qp_attr_mask);
+ 
+@@ -586,14 +591,14 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 
+ 		if (!ret)
+ 			ret = check_qp_port_pkey_settings(new_pps,
+-							  qp->qp_sec);
++							  real_qp->qp_sec);
+ 	}
+ 
+ 	if (!ret)
+-		ret = qp->device->modify_qp(qp->real_qp,
+-					    qp_attr,
+-					    qp_attr_mask,
+-					    udata);
++		ret = real_qp->device->modify_qp(real_qp,
++						 qp_attr,
++						 qp_attr_mask,
++						 udata);
+ 
+ 	if (pps_change && !special_qp) {
+ 		/* Clean up the lists and free the appropriate
+@@ -602,8 +607,8 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 		if (ret) {
+ 			tmp_pps = new_pps;
+ 		} else {
+-			tmp_pps = qp->qp_sec->ports_pkeys;
+-			qp->qp_sec->ports_pkeys = new_pps;
++			tmp_pps = real_qp->qp_sec->ports_pkeys;
++			real_qp->qp_sec->ports_pkeys = new_pps;
+ 		}
+ 
+ 		if (tmp_pps) {
+@@ -611,7 +616,7 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 			port_pkey_list_remove(&tmp_pps->alt);
+ 		}
+ 		kfree(tmp_pps);
+-		mutex_unlock(&qp->qp_sec->mutex);
++		mutex_unlock(&real_qp->qp_sec->mutex);
+ 	}
+ 	return ret;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 0be42787759f..312444386f54 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -13074,7 +13074,7 @@ static int request_msix_irqs(struct hfi1_devdata *dd)
+ 	first_sdma = last_general;
+ 	last_sdma = first_sdma + dd->num_sdma;
+ 	first_rx = last_sdma;
+-	last_rx = first_rx + dd->n_krcv_queues + HFI1_NUM_VNIC_CTXT;
++	last_rx = first_rx + dd->n_krcv_queues + dd->num_vnic_contexts;
+ 
+ 	/* VNIC MSIx interrupts get mapped when VNIC contexts are created */
+ 	dd->first_dyn_msix_idx = first_rx + dd->n_krcv_queues;
+@@ -13294,8 +13294,9 @@ static int set_up_interrupts(struct hfi1_devdata *dd)
+ 	 *		slow source, SDMACleanupDone)
+ 	 *	N interrupts - one per used SDMA engine
+ 	 *	M interrupt - one per kernel receive context
++	 *	V interrupt - one for each VNIC context
+ 	 */
+-	total = 1 + dd->num_sdma + dd->n_krcv_queues + HFI1_NUM_VNIC_CTXT;
++	total = 1 + dd->num_sdma + dd->n_krcv_queues + dd->num_vnic_contexts;
+ 
+ 	/* ask for MSI-X interrupts */
+ 	request = request_msix(dd, total);
+@@ -13356,10 +13357,12 @@ static int set_up_interrupts(struct hfi1_devdata *dd)
+  *                             in array of contexts
+  *	freectxts  - number of free user contexts
+  *	num_send_contexts - number of PIO send contexts being used
++ *	num_vnic_contexts - number of contexts reserved for VNIC
+  */
+ static int set_up_context_variables(struct hfi1_devdata *dd)
+ {
+ 	unsigned long num_kernel_contexts;
++	u16 num_vnic_contexts = HFI1_NUM_VNIC_CTXT;
+ 	int total_contexts;
+ 	int ret;
+ 	unsigned ngroups;
+@@ -13393,6 +13396,14 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 			   num_kernel_contexts);
+ 		num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
+ 	}
++
++	/* Accommodate VNIC contexts if possible */
++	if ((num_kernel_contexts + num_vnic_contexts) > dd->chip_rcv_contexts) {
++		dd_dev_err(dd, "No receive contexts available for VNIC\n");
++		num_vnic_contexts = 0;
++	}
++	total_contexts = num_kernel_contexts + num_vnic_contexts;
++
+ 	/*
+ 	 * User contexts:
+ 	 *	- default to 1 user context per real (non-HT) CPU core if
+@@ -13402,19 +13413,16 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 		num_user_contexts =
+ 			cpumask_weight(&node_affinity.real_cpu_mask);
+ 
+-	total_contexts = num_kernel_contexts + num_user_contexts;
+-
+ 	/*
+ 	 * Adjust the counts given a global max.
+ 	 */
+-	if (total_contexts > dd->chip_rcv_contexts) {
++	if (total_contexts + num_user_contexts > dd->chip_rcv_contexts) {
+ 		dd_dev_err(dd,
+ 			   "Reducing # user receive contexts to: %d, from %d\n",
+-			   (int)(dd->chip_rcv_contexts - num_kernel_contexts),
++			   (int)(dd->chip_rcv_contexts - total_contexts),
+ 			   (int)num_user_contexts);
+-		num_user_contexts = dd->chip_rcv_contexts - num_kernel_contexts;
+ 		/* recalculate */
+-		total_contexts = num_kernel_contexts + num_user_contexts;
++		num_user_contexts = dd->chip_rcv_contexts - total_contexts;
+ 	}
+ 
+ 	/* each user context requires an entry in the RMT */
+@@ -13427,25 +13435,24 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 			   user_rmt_reduced);
+ 		/* recalculate */
+ 		num_user_contexts = user_rmt_reduced;
+-		total_contexts = num_kernel_contexts + num_user_contexts;
+ 	}
+ 
+-	/* Accommodate VNIC contexts */
+-	if ((total_contexts + HFI1_NUM_VNIC_CTXT) <= dd->chip_rcv_contexts)
+-		total_contexts += HFI1_NUM_VNIC_CTXT;
++	total_contexts += num_user_contexts;
+ 
+ 	/* the first N are kernel contexts, the rest are user/vnic contexts */
+ 	dd->num_rcv_contexts = total_contexts;
+ 	dd->n_krcv_queues = num_kernel_contexts;
+ 	dd->first_dyn_alloc_ctxt = num_kernel_contexts;
++	dd->num_vnic_contexts = num_vnic_contexts;
+ 	dd->num_user_contexts = num_user_contexts;
+ 	dd->freectxts = num_user_contexts;
+ 	dd_dev_info(dd,
+-		    "rcv contexts: chip %d, used %d (kernel %d, user %d)\n",
++		    "rcv contexts: chip %d, used %d (kernel %d, vnic %u, user %u)\n",
+ 		    (int)dd->chip_rcv_contexts,
+ 		    (int)dd->num_rcv_contexts,
+ 		    (int)dd->n_krcv_queues,
+-		    (int)dd->num_rcv_contexts - dd->n_krcv_queues);
++		    dd->num_vnic_contexts,
++		    dd->num_user_contexts);
+ 
+ 	/*
+ 	 * Receive array allocation:
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 3ac9c307a285..6ff44dc606eb 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1047,6 +1047,8 @@ struct hfi1_devdata {
+ 	u64 z_send_schedule;
+ 
+ 	u64 __percpu *send_schedule;
++	/* number of reserved contexts for VNIC usage */
++	u16 num_vnic_contexts;
+ 	/* number of receive contexts in use by the driver */
+ 	u32 num_rcv_contexts;
+ 	/* number of pio send contexts in use by the driver */
+diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
+index 6d2702ef34ac..25e867393463 100644
+--- a/drivers/infiniband/hw/hfi1/sysfs.c
++++ b/drivers/infiniband/hw/hfi1/sysfs.c
+@@ -543,7 +543,7 @@ static ssize_t show_nctxts(struct device *device,
+ 	 * give a more accurate picture of total contexts available.
+ 	 */
+ 	return scnprintf(buf, PAGE_SIZE, "%u\n",
+-			 min(dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt,
++			 min(dd->num_user_contexts,
+ 			     (u32)dd->sc_sizes[SC_USER].count));
+ }
+ 
+diff --git a/drivers/infiniband/hw/hfi1/vnic_main.c b/drivers/infiniband/hw/hfi1/vnic_main.c
+index f419cbb05928..1a17708be46a 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_main.c
++++ b/drivers/infiniband/hw/hfi1/vnic_main.c
+@@ -840,6 +840,9 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 	struct rdma_netdev *rn;
+ 	int i, size, rc;
+ 
++	if (!dd->num_vnic_contexts)
++		return ERR_PTR(-ENOMEM);
++
+ 	if (!port_num || (port_num > dd->num_pports))
+ 		return ERR_PTR(-EINVAL);
+ 
+@@ -848,7 +851,7 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 
+ 	size = sizeof(struct opa_vnic_rdma_netdev) + sizeof(*vinfo);
+ 	netdev = alloc_netdev_mqs(size, name, name_assign_type, setup,
+-				  dd->chip_sdma_engines, HFI1_NUM_VNIC_CTXT);
++				  dd->chip_sdma_engines, dd->num_vnic_contexts);
+ 	if (!netdev)
+ 		return ERR_PTR(-ENOMEM);
+ 
+@@ -856,7 +859,7 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 	vinfo = opa_vnic_dev_priv(netdev);
+ 	vinfo->dd = dd;
+ 	vinfo->num_tx_q = dd->chip_sdma_engines;
+-	vinfo->num_rx_q = HFI1_NUM_VNIC_CTXT;
++	vinfo->num_rx_q = dd->num_vnic_contexts;
+ 	vinfo->netdev = netdev;
+ 	rn->free_rdma_netdev = hfi1_vnic_free_rn;
+ 	rn->set_id = hfi1_vnic_set_vesw_id;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index fa5ccdb3bb2a..60d7b493ed2d 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -665,12 +665,19 @@ static void srp_path_rec_completion(int status,
+ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ {
+ 	struct srp_target_port *target = ch->target;
+-	int ret;
++	int ret = -ENODEV;
+ 
+ 	ch->path.numb_path = 1;
+ 
+ 	init_completion(&ch->done);
+ 
++	/*
++	 * Avoid that the SCSI host can be removed by srp_remove_target()
++	 * before srp_path_rec_completion() is called.
++	 */
++	if (!scsi_host_get(target->scsi_host))
++		goto out;
++
+ 	ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
+ 					       target->srp_host->srp_dev->dev,
+ 					       target->srp_host->port,
+@@ -684,18 +691,24 @@ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ 					       GFP_KERNEL,
+ 					       srp_path_rec_completion,
+ 					       ch, &ch->path_query);
+-	if (ch->path_query_id < 0)
+-		return ch->path_query_id;
++	ret = ch->path_query_id;
++	if (ret < 0)
++		goto put;
+ 
+ 	ret = wait_for_completion_interruptible(&ch->done);
+ 	if (ret < 0)
+-		return ret;
++		goto put;
+ 
+-	if (ch->status < 0)
++	ret = ch->status;
++	if (ret < 0)
+ 		shost_printk(KERN_WARNING, target->scsi_host,
+ 			     PFX "Path record query failed\n");
+ 
+-	return ch->status;
++put:
++	scsi_host_put(target->scsi_host);
++
++out:
++	return ret;
+ }
+ 
+ static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 9e8e9220f816..95178b4e3565 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2777,7 +2777,7 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ {
+ 	const char *p;
+ 	unsigned len, count, leading_zero_bytes;
+-	int ret, rc;
++	int ret;
+ 
+ 	p = name;
+ 	if (strncasecmp(p, "0x", 2) == 0)
+@@ -2789,10 +2789,9 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ 	count = min(len / 2, 16U);
+ 	leading_zero_bytes = 16 - count;
+ 	memset(i_port_id, 0, leading_zero_bytes);
+-	rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
+-	if (rc < 0)
+-		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
+-	ret = 0;
++	ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
++	if (ret < 0)
++		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
+ out:
+ 	return ret;
+ }
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index b5df99c6f680..3b35271114ee 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1071,18 +1071,18 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 	int nr_parts;
+ 	struct partition_affinity *parts;
+ 
+-	parts_node = of_find_node_by_name(gic_node, "ppi-partitions");
++	parts_node = of_get_child_by_name(gic_node, "ppi-partitions");
+ 	if (!parts_node)
+ 		return;
+ 
+ 	nr_parts = of_get_child_count(parts_node);
+ 
+ 	if (!nr_parts)
+-		return;
++		goto out_put_node;
+ 
+ 	parts = kzalloc(sizeof(*parts) * nr_parts, GFP_KERNEL);
+ 	if (WARN_ON(!parts))
+-		return;
++		goto out_put_node;
+ 
+ 	for_each_child_of_node(parts_node, child_part) {
+ 		struct partition_affinity *part;
+@@ -1149,6 +1149,9 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 
+ 		gic_data.ppi_descs[i] = desc;
+ 	}
++
++out_put_node:
++	of_node_put(parts_node);
+ }
+ 
+ static void __init gic_of_setup_kvm_info(struct device_node *node)
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index ae6146311934..f052a3eb2098 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1365,8 +1365,8 @@ static void flexrm_shutdown(struct mbox_chan *chan)
+ 	/* Disable/inactivate ring */
+ 	writel_relaxed(0x0, ring->regs + RING_CONTROL);
+ 
+-	/* Flush ring with timeout of 1s */
+-	timeout = 1000;
++	/* Set ring flush state */
++	timeout = 1000; /* timeout of 1s */
+ 	writel_relaxed(BIT(CONTROL_FLUSH_SHIFT),
+ 			ring->regs + RING_CONTROL);
+ 	do {
+@@ -1374,7 +1374,23 @@ static void flexrm_shutdown(struct mbox_chan *chan)
+ 		    FLUSH_DONE_MASK)
+ 			break;
+ 		mdelay(1);
+-	} while (timeout--);
++	} while (--timeout);
++	if (!timeout)
++		dev_err(ring->mbox->dev,
++			"setting ring%d flush state timedout\n", ring->num);
++
++	/* Clear ring flush state */
++	timeout = 1000; /* timeout of 1s */
++	writel_relaxed(0x0, ring + RING_CONTROL);
++	do {
++		if (!(readl_relaxed(ring + RING_FLUSH_DONE) &
++		      FLUSH_DONE_MASK))
++			break;
++		mdelay(1);
++	} while (--timeout);
++	if (!timeout)
++		dev_err(ring->mbox->dev,
++			"clearing ring%d flush state timedout\n", ring->num);
+ 
+ 	/* Abort all in-flight requests */
+ 	for (reqid = 0; reqid < RING_MAX_REQ_COUNT; reqid++) {
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 08035634795c..c9934139d609 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -407,7 +407,8 @@ long bch_bucket_alloc(struct cache *ca, unsigned reserve, bool wait)
+ 
+ 	finish_wait(&ca->set->bucket_wait, &w);
+ out:
+-	wake_up_process(ca->alloc_thread);
++	if (ca->alloc_thread)
++		wake_up_process(ca->alloc_thread);
+ 
+ 	trace_bcache_alloc(ca, reserve);
+ 
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index d2121637b4ab..cae57b5be817 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -625,7 +625,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
+ 		err = read_sb_page(bitmap->mddev,
+ 				   offset,
+ 				   sb_page,
+-				   0, PAGE_SIZE);
++				   0, sizeof(bitmap_super_t));
+ 	}
+ 	if (err)
+ 		return err;
+@@ -2123,7 +2123,7 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 	if (store.sb_page && bitmap->storage.sb_page)
+ 		memcpy(page_address(store.sb_page),
+ 		       page_address(bitmap->storage.sb_page),
+-		       PAGE_SIZE);
++		       sizeof(bitmap_super_t));
+ 	bitmap_file_unmap(&bitmap->storage);
+ 	bitmap->storage = store;
+ 
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index d216a8f7bc22..8e3adcb46851 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -974,7 +974,8 @@ static void __get_memory_limit(struct dm_bufio_client *c,
+ 		buffers = c->minimum_buffers;
+ 
+ 	*limit_buffers = buffers;
+-	*threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100;
++	*threshold_buffers = mult_frac(buffers,
++				       DM_BUFIO_WRITEBACK_PERCENT, 100);
+ }
+ 
+ /*
+@@ -1910,19 +1911,15 @@ static int __init dm_bufio_init(void)
+ 	memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
+ 	memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
+ 
+-	mem = (__u64)((totalram_pages - totalhigh_pages) *
+-		      DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT;
++	mem = (__u64)mult_frac(totalram_pages - totalhigh_pages,
++			       DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT;
+ 
+ 	if (mem > ULONG_MAX)
+ 		mem = ULONG_MAX;
+ 
+ #ifdef CONFIG_MMU
+-	/*
+-	 * Get the size of vmalloc space the same way as VMALLOC_TOTAL
+-	 * in fs/proc/internal.h
+-	 */
+-	if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100)
+-		mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100;
++	if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100))
++		mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100);
+ #endif
+ 
+ 	dm_bufio_default_cache_size = mem;
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 8785134c9f1f..0b7edfd0b454 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1201,6 +1201,18 @@ static void background_work_end(struct cache *cache)
+ 
+ /*----------------------------------------------------------------*/
+ 
++static bool bio_writes_complete_block(struct cache *cache, struct bio *bio)
++{
++	return (bio_data_dir(bio) == WRITE) &&
++		(bio->bi_iter.bi_size == (cache->sectors_per_block << SECTOR_SHIFT));
++}
++
++static bool optimisable_bio(struct cache *cache, struct bio *bio, dm_oblock_t block)
++{
++	return writeback_mode(&cache->features) &&
++		(is_discarded_oblock(cache, block) || bio_writes_complete_block(cache, bio));
++}
++
+ static void quiesce(struct dm_cache_migration *mg,
+ 		    void (*continuation)(struct work_struct *))
+ {
+@@ -1474,12 +1486,50 @@ static void mg_upgrade_lock(struct work_struct *ws)
+ 	}
+ }
+ 
++static void mg_full_copy(struct work_struct *ws)
++{
++	struct dm_cache_migration *mg = ws_to_mg(ws);
++	struct cache *cache = mg->cache;
++	struct policy_work *op = mg->op;
++	bool is_policy_promote = (op->op == POLICY_PROMOTE);
++
++	if ((!is_policy_promote && !is_dirty(cache, op->cblock)) ||
++	    is_discarded_oblock(cache, op->oblock)) {
++		mg_upgrade_lock(ws);
++		return;
++	}
++
++	init_continuation(&mg->k, mg_upgrade_lock);
++
++	if (copy(mg, is_policy_promote)) {
++		DMERR_LIMIT("%s: migration copy failed", cache_device_name(cache));
++		mg->k.input = BLK_STS_IOERR;
++		mg_complete(mg, false);
++	}
++}
++
+ static void mg_copy(struct work_struct *ws)
+ {
+-	int r;
+ 	struct dm_cache_migration *mg = ws_to_mg(ws);
+ 
+ 	if (mg->overwrite_bio) {
++		/*
++		 * No exclusive lock was held when we last checked if the bio
++		 * was optimisable.  So we have to check again in case things
++		 * have changed (eg, the block may no longer be discarded).
++		 */
++		if (!optimisable_bio(mg->cache, mg->overwrite_bio, mg->op->oblock)) {
++			/*
++			 * Fallback to a real full copy after doing some tidying up.
++			 */
++			bool rb = bio_detain_shared(mg->cache, mg->op->oblock, mg->overwrite_bio);
++			BUG_ON(rb); /* An exclussive lock must _not_ be held for this block */
++			mg->overwrite_bio = NULL;
++			inc_io_migrations(mg->cache);
++			mg_full_copy(ws);
++			return;
++		}
++
+ 		/*
+ 		 * It's safe to do this here, even though it's new data
+ 		 * because all IO has been locked out of the block.
+@@ -1489,26 +1539,8 @@ static void mg_copy(struct work_struct *ws)
+ 		 */
+ 		overwrite(mg, mg_update_metadata_after_copy);
+ 
+-	} else {
+-		struct cache *cache = mg->cache;
+-		struct policy_work *op = mg->op;
+-		bool is_policy_promote = (op->op == POLICY_PROMOTE);
+-
+-		if ((!is_policy_promote && !is_dirty(cache, op->cblock)) ||
+-		    is_discarded_oblock(cache, op->oblock)) {
+-			mg_upgrade_lock(ws);
+-			return;
+-		}
+-
+-		init_continuation(&mg->k, mg_upgrade_lock);
+-
+-		r = copy(mg, is_policy_promote);
+-		if (r) {
+-			DMERR_LIMIT("%s: migration copy failed", cache_device_name(cache));
+-			mg->k.input = BLK_STS_IOERR;
+-			mg_complete(mg, false);
+-		}
+-	}
++	} else
++		mg_full_copy(ws);
+ }
+ 
+ static int mg_lock_writes(struct dm_cache_migration *mg)
+@@ -1748,18 +1780,6 @@ static void inc_miss_counter(struct cache *cache, struct bio *bio)
+ 
+ /*----------------------------------------------------------------*/
+ 
+-static bool bio_writes_complete_block(struct cache *cache, struct bio *bio)
+-{
+-	return (bio_data_dir(bio) == WRITE) &&
+-		(bio->bi_iter.bi_size == (cache->sectors_per_block << SECTOR_SHIFT));
+-}
+-
+-static bool optimisable_bio(struct cache *cache, struct bio *bio, dm_oblock_t block)
+-{
+-	return writeback_mode(&cache->features) &&
+-		(is_discarded_oblock(cache, block) || bio_writes_complete_block(cache, bio));
+-}
+-
+ static int map_bio(struct cache *cache, struct bio *bio, dm_oblock_t block,
+ 		   bool *commit_needed)
+ {
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 203144762f36..6a14f945783c 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -29,7 +29,6 @@ struct dm_kobject_holder {
+  * DM targets must _not_ deference a mapped_device to directly access its members!
+  */
+ struct mapped_device {
+-	struct srcu_struct io_barrier;
+ 	struct mutex suspend_lock;
+ 
+ 	/*
+@@ -127,6 +126,8 @@ struct mapped_device {
+ 	struct blk_mq_tag_set *tag_set;
+ 	bool use_blk_mq:1;
+ 	bool init_tio_pdu:1;
++
++	struct srcu_struct io_barrier;
+ };
+ 
+ void dm_init_md_queue(struct mapped_device *md);
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 96ab46512e1f..9fc12f556534 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1075,7 +1075,7 @@ static int crypt_convert_block_aead(struct crypt_config *cc,
+ 	BUG_ON(cc->integrity_iv_size && cc->integrity_iv_size != cc->iv_size);
+ 
+ 	/* Reject unexpected unaligned bio. */
+-	if (unlikely(bv_in.bv_offset & (cc->sector_size - 1)))
++	if (unlikely(bv_in.bv_len & (cc->sector_size - 1)))
+ 		return -EIO;
+ 
+ 	dmreq = dmreq_of_req(cc, req);
+@@ -1168,7 +1168,7 @@ static int crypt_convert_block_skcipher(struct crypt_config *cc,
+ 	int r = 0;
+ 
+ 	/* Reject unexpected unaligned bio. */
+-	if (unlikely(bv_in.bv_offset & (cc->sector_size - 1)))
++	if (unlikely(bv_in.bv_len & (cc->sector_size - 1)))
+ 		return -EIO;
+ 
+ 	dmreq = dmreq_of_req(cc, req);
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 096fe9b66c50..5e6737a44468 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1376,7 +1376,7 @@ static int dm_integrity_map(struct dm_target *ti, struct bio *bio)
+ 		struct bvec_iter iter;
+ 		struct bio_vec bv;
+ 		bio_for_each_segment(bv, bio, iter) {
+-			if (unlikely((bv.bv_offset | bv.bv_len) & ((ic->sectors_per_block << SECTOR_SHIFT) - 1))) {
++			if (unlikely(bv.bv_len & ((ic->sectors_per_block << SECTOR_SHIFT) - 1))) {
+ 				DMERR("Bio vector (%u,%u) is not aligned on %u-sector boundary",
+ 					bv.bv_offset, bv.bv_len, ic->sectors_per_block);
+ 				return DM_MAPIO_KILL;
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 11f273d2f018..e8094d8fbe0d 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -499,8 +499,6 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
+ 	if (IS_ERR(clone)) {
+ 		/* EBUSY, ENODEV or EWOULDBLOCK: requeue */
+ 		bool queue_dying = blk_queue_dying(q);
+-		DMERR_LIMIT("blk_get_request() returned %ld%s - requeuing",
+-			    PTR_ERR(clone), queue_dying ? " (path offline)" : "");
+ 		if (queue_dying) {
+ 			atomic_inc(&m->pg_init_in_progress);
+ 			activate_or_offline_path(pgpath);
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index ef7b8f201f73..4287fc9f3527 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1758,13 +1758,12 @@ static bool dm_table_supports_write_zeroes(struct dm_table *t)
+ 	return true;
+ }
+ 
+-
+-static int device_discard_capable(struct dm_target *ti, struct dm_dev *dev,
+-				  sector_t start, sector_t len, void *data)
++static int device_not_discard_capable(struct dm_target *ti, struct dm_dev *dev,
++				      sector_t start, sector_t len, void *data)
+ {
+ 	struct request_queue *q = bdev_get_queue(dev->bdev);
+ 
+-	return q && blk_queue_discard(q);
++	return q && !blk_queue_discard(q);
+ }
+ 
+ static bool dm_table_supports_discards(struct dm_table *t)
+@@ -1772,28 +1771,24 @@ static bool dm_table_supports_discards(struct dm_table *t)
+ 	struct dm_target *ti;
+ 	unsigned i;
+ 
+-	/*
+-	 * Unless any target used by the table set discards_supported,
+-	 * require at least one underlying device to support discards.
+-	 * t->devices includes internal dm devices such as mirror logs
+-	 * so we need to use iterate_devices here, which targets
+-	 * supporting discard selectively must provide.
+-	 */
+ 	for (i = 0; i < dm_table_get_num_targets(t); i++) {
+ 		ti = dm_table_get_target(t, i);
+ 
+ 		if (!ti->num_discard_bios)
+-			continue;
+-
+-		if (ti->discards_supported)
+-			return true;
++			return false;
+ 
+-		if (ti->type->iterate_devices &&
+-		    ti->type->iterate_devices(ti, device_discard_capable, NULL))
+-			return true;
++		/*
++		 * Either the target provides discard support (as implied by setting
++		 * 'discards_supported') or it relies on _all_ data devices having
++		 * discard support.
++		 */
++		if (!ti->discards_supported &&
++		    (!ti->type->iterate_devices ||
++		     ti->type->iterate_devices(ti, device_not_discard_capable, NULL)))
++			return false;
+ 	}
+ 
+-	return false;
++	return true;
+ }
+ 
+ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index b87c1741da4b..6d7bda6f8190 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -660,6 +660,7 @@ static int dmz_get_zoned_device(struct dm_target *ti, char *path)
+ 	struct dmz_target *dmz = ti->private;
+ 	struct request_queue *q;
+ 	struct dmz_dev *dev;
++	sector_t aligned_capacity;
+ 	int ret;
+ 
+ 	/* Get the target device */
+@@ -685,15 +686,17 @@ static int dmz_get_zoned_device(struct dm_target *ti, char *path)
+ 		goto err;
+ 	}
+ 
++	q = bdev_get_queue(dev->bdev);
+ 	dev->capacity = i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT;
+-	if (ti->begin || (ti->len != dev->capacity)) {
++	aligned_capacity = dev->capacity & ~(blk_queue_zone_sectors(q) - 1);
++	if (ti->begin ||
++	    ((ti->len != dev->capacity) && (ti->len != aligned_capacity))) {
+ 		ti->error = "Partial mapping not supported";
+ 		ret = -EINVAL;
+ 		goto err;
+ 	}
+ 
+-	q = bdev_get_queue(dev->bdev);
+-	dev->zone_nr_sectors = q->limits.chunk_sectors;
++	dev->zone_nr_sectors = blk_queue_zone_sectors(q);
+ 	dev->zone_nr_sectors_shift = ilog2(dev->zone_nr_sectors);
+ 
+ 	dev->zone_nr_blocks = dmz_sect2blk(dev->zone_nr_sectors);
+@@ -929,8 +932,10 @@ static int dmz_iterate_devices(struct dm_target *ti,
+ 			       iterate_devices_callout_fn fn, void *data)
+ {
+ 	struct dmz_target *dmz = ti->private;
++	struct dmz_dev *dev = dmz->dev;
++	sector_t capacity = dev->capacity & ~(dev->zone_nr_sectors - 1);
+ 
+-	return fn(ti, dmz->ddev, 0, dmz->dev->capacity, data);
++	return fn(ti, dmz->ddev, 0, capacity, data);
+ }
+ 
+ static struct target_type dmz_type = {
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 4be85324f44d..804419635cc7 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1695,7 +1695,7 @@ static struct mapped_device *alloc_dev(int minor)
+ 	struct mapped_device *md;
+ 	void *old_md;
+ 
+-	md = kzalloc_node(sizeof(*md), GFP_KERNEL, numa_node_id);
++	md = kvzalloc_node(sizeof(*md), GFP_KERNEL, numa_node_id);
+ 	if (!md) {
+ 		DMWARN("unable to allocate device, out of memory.");
+ 		return NULL;
+@@ -1795,7 +1795,7 @@ static struct mapped_device *alloc_dev(int minor)
+ bad_minor:
+ 	module_put(THIS_MODULE);
+ bad_module_get:
+-	kfree(md);
++	kvfree(md);
+ 	return NULL;
+ }
+ 
+@@ -1814,7 +1814,7 @@ static void free_dev(struct mapped_device *md)
+ 	free_minor(minor);
+ 
+ 	module_put(THIS_MODULE);
+-	kfree(md);
++	kvfree(md);
+ }
+ 
+ static void __bind_mempools(struct mapped_device *md, struct dm_table *t)
+@@ -2709,11 +2709,15 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
+ 
+ 	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
+ 
+-	if (test_bit(DMF_FREEING, &md->flags) ||
+-	    dm_deleting_md(md))
+-		return NULL;
+-
++	spin_lock(&_minor_lock);
++	if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) {
++		md = NULL;
++		goto out;
++	}
+ 	dm_get(md);
++out:
++	spin_unlock(&_minor_lock);
++
+ 	return md;
+ }
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 0ff1bbf6c90e..e019cf8c0d13 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8039,7 +8039,8 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
+ 	if (did_change)
+ 		sysfs_notify_dirent_safe(mddev->sysfs_state);
+ 	wait_event(mddev->sb_wait,
+-		   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) && !mddev->suspended);
++		   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) ||
++		   mddev->suspended);
+ 	if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)) {
+ 		percpu_ref_put(&mddev->writes_pending);
+ 		return false;
+@@ -8110,7 +8111,6 @@ void md_allow_write(struct mddev *mddev)
+ 		sysfs_notify_dirent_safe(mddev->sysfs_state);
+ 		/* wait for the dirty state to be recorded in the metadata */
+ 		wait_event(mddev->sb_wait,
+-			   !test_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags) &&
+ 			   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
+ 	} else
+ 		spin_unlock(&mddev->lock);
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index f3f3e40dc9d8..e4e8f9e565b7 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -990,14 +990,6 @@ static void wait_barrier(struct r1conf *conf, sector_t sector_nr)
+ 	_wait_barrier(conf, idx);
+ }
+ 
+-static void wait_all_barriers(struct r1conf *conf)
+-{
+-	int idx;
+-
+-	for (idx = 0; idx < BARRIER_BUCKETS_NR; idx++)
+-		_wait_barrier(conf, idx);
+-}
+-
+ static void _allow_barrier(struct r1conf *conf, int idx)
+ {
+ 	atomic_dec(&conf->nr_pending[idx]);
+@@ -1011,14 +1003,6 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr)
+ 	_allow_barrier(conf, idx);
+ }
+ 
+-static void allow_all_barriers(struct r1conf *conf)
+-{
+-	int idx;
+-
+-	for (idx = 0; idx < BARRIER_BUCKETS_NR; idx++)
+-		_allow_barrier(conf, idx);
+-}
+-
+ /* conf->resync_lock should be held */
+ static int get_unqueued_pending(struct r1conf *conf)
+ {
+@@ -1654,8 +1638,12 @@ static void print_conf(struct r1conf *conf)
+ 
+ static void close_sync(struct r1conf *conf)
+ {
+-	wait_all_barriers(conf);
+-	allow_all_barriers(conf);
++	int idx;
++
++	for (idx = 0; idx < BARRIER_BUCKETS_NR; idx++) {
++		_wait_barrier(conf, idx);
++		_allow_barrier(conf, idx);
++	}
+ 
+ 	mempool_destroy(conf->r1buf_pool);
+ 	conf->r1buf_pool = NULL;
+diff --git a/drivers/media/platform/qcom/venus/core.h b/drivers/media/platform/qcom/venus/core.h
+index cba092bcb76d..a0fe80df0cbd 100644
+--- a/drivers/media/platform/qcom/venus/core.h
++++ b/drivers/media/platform/qcom/venus/core.h
+@@ -194,7 +194,6 @@ struct venus_buffer {
+  * @fh:	 a holder of v4l file handle structure
+  * @streamon_cap: stream on flag for capture queue
+  * @streamon_out: stream on flag for output queue
+- * @cmd_stop:	a flag to signal encoder/decoder commands
+  * @width:	current capture width
+  * @height:	current capture height
+  * @out_width:	current output width
+@@ -258,7 +257,6 @@ struct venus_inst {
+ 	} controls;
+ 	struct v4l2_fh fh;
+ 	unsigned int streamon_cap, streamon_out;
+-	bool cmd_stop;
+ 	u32 width;
+ 	u32 height;
+ 	u32 out_width;
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index 9b2a401a4891..0ce9559a2924 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -623,13 +623,6 @@ void venus_helper_vb2_buf_queue(struct vb2_buffer *vb)
+ 
+ 	mutex_lock(&inst->lock);
+ 
+-	if (inst->cmd_stop) {
+-		vbuf->flags |= V4L2_BUF_FLAG_LAST;
+-		v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE);
+-		inst->cmd_stop = false;
+-		goto unlock;
+-	}
+-
+ 	v4l2_m2m_buf_queue(m2m_ctx, vbuf);
+ 
+ 	if (!(inst->streamon_out & inst->streamon_cap))
+diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c
+index c09490876516..ba29fd4d4984 100644
+--- a/drivers/media/platform/qcom/venus/hfi.c
++++ b/drivers/media/platform/qcom/venus/hfi.c
+@@ -484,6 +484,7 @@ int hfi_session_process_buf(struct venus_inst *inst, struct hfi_frame_data *fd)
+ 
+ 	return -EINVAL;
+ }
++EXPORT_SYMBOL_GPL(hfi_session_process_buf);
+ 
+ irqreturn_t hfi_isr_thread(int irq, void *dev_id)
+ {
+diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
+index 1caae8feaa36..734ce11b0ed0 100644
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -344,7 +344,7 @@ static int venus_alloc(struct venus_hfi_device *hdev, struct mem_desc *desc,
+ 	desc->attrs = DMA_ATTR_WRITE_COMBINE;
+ 	desc->size = ALIGN(size, SZ_4K);
+ 
+-	desc->kva = dma_alloc_attrs(dev, size, &desc->da, GFP_KERNEL,
++	desc->kva = dma_alloc_attrs(dev, desc->size, &desc->da, GFP_KERNEL,
+ 				    desc->attrs);
+ 	if (!desc->kva)
+ 		return -ENOMEM;
+@@ -710,10 +710,8 @@ static int venus_interface_queues_init(struct venus_hfi_device *hdev)
+ 	if (ret)
+ 		return ret;
+ 
+-	hdev->ifaceq_table.kva = desc.kva;
+-	hdev->ifaceq_table.da = desc.da;
+-	hdev->ifaceq_table.size = IFACEQ_TABLE_SIZE;
+-	offset = hdev->ifaceq_table.size;
++	hdev->ifaceq_table = desc;
++	offset = IFACEQ_TABLE_SIZE;
+ 
+ 	for (i = 0; i < IFACEQ_NUM; i++) {
+ 		queue = &hdev->queues[i];
+@@ -755,9 +753,7 @@ static int venus_interface_queues_init(struct venus_hfi_device *hdev)
+ 	if (ret) {
+ 		hdev->sfr.da = 0;
+ 	} else {
+-		hdev->sfr.da = desc.da;
+-		hdev->sfr.kva = desc.kva;
+-		hdev->sfr.size = ALIGNED_SFR_SIZE;
++		hdev->sfr = desc;
+ 		sfr = hdev->sfr.kva;
+ 		sfr->buf_size = ALIGNED_SFR_SIZE;
+ 	}
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index da611a5eb670..c9e9576bb08a 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -469,8 +469,14 @@ static int vdec_subscribe_event(struct v4l2_fh *fh,
+ static int
+ vdec_try_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ {
+-	if (cmd->cmd != V4L2_DEC_CMD_STOP)
++	switch (cmd->cmd) {
++	case V4L2_DEC_CMD_STOP:
++		if (cmd->flags & V4L2_DEC_CMD_STOP_TO_BLACK)
++			return -EINVAL;
++		break;
++	default:
+ 		return -EINVAL;
++	}
+ 
+ 	return 0;
+ }
+@@ -479,6 +485,7 @@ static int
+ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ {
+ 	struct venus_inst *inst = to_inst(file);
++	struct hfi_frame_data fdata = {0};
+ 	int ret;
+ 
+ 	ret = vdec_try_decoder_cmd(file, fh, cmd);
+@@ -486,12 +493,23 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
+ 		return ret;
+ 
+ 	mutex_lock(&inst->lock);
+-	inst->cmd_stop = true;
+-	mutex_unlock(&inst->lock);
+ 
+-	hfi_session_flush(inst);
++	/*
++	 * Implement V4L2_DEC_CMD_STOP by enqueue an empty buffer on decoder
++	 * input to signal EOS.
++	 */
++	if (!(inst->streamon_out & inst->streamon_cap))
++		goto unlock;
++
++	fdata.buffer_type = HFI_BUFFER_INPUT;
++	fdata.flags |= HFI_BUFFERFLAG_EOS;
++	fdata.device_addr = 0xdeadbeef;
+ 
+-	return 0;
++	ret = hfi_session_process_buf(inst, &fdata);
++
++unlock:
++	mutex_unlock(&inst->lock);
++	return ret;
+ }
+ 
+ static const struct v4l2_ioctl_ops vdec_ioctl_ops = {
+@@ -718,7 +736,6 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
+ 	inst->reconfig = false;
+ 	inst->sequence_cap = 0;
+ 	inst->sequence_out = 0;
+-	inst->cmd_stop = false;
+ 
+ 	ret = vdec_init_session(inst);
+ 	if (ret)
+@@ -807,11 +824,6 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type,
+ 		vb->timestamp = timestamp_us * NSEC_PER_USEC;
+ 		vbuf->sequence = inst->sequence_cap++;
+ 
+-		if (inst->cmd_stop) {
+-			vbuf->flags |= V4L2_BUF_FLAG_LAST;
+-			inst->cmd_stop = false;
+-		}
+-
+ 		if (vbuf->flags & V4L2_BUF_FLAG_LAST) {
+ 			const struct v4l2_event ev = { .type = V4L2_EVENT_EOS };
+ 
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 6f123a387cf9..3fcf0e9b7b29 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -963,13 +963,12 @@ static void venc_buf_done(struct venus_inst *inst, unsigned int buf_type,
+ 	if (!vbuf)
+ 		return;
+ 
+-	vb = &vbuf->vb2_buf;
+-	vb->planes[0].bytesused = bytesused;
+-	vb->planes[0].data_offset = data_offset;
+-
+ 	vbuf->flags = flags;
+ 
+ 	if (type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
++		vb = &vbuf->vb2_buf;
++		vb2_set_plane_payload(vb, 0, bytesused + data_offset);
++		vb->planes[0].data_offset = data_offset;
+ 		vb->timestamp = timestamp_us * NSEC_PER_USEC;
+ 		vbuf->sequence = inst->sequence_cap++;
+ 	} else {
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index d2223c04e9ad..4c8f456238bc 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -298,11 +298,14 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
+ 		if (!dev->max_timeout)
+ 			return -ENOTTY;
+ 
++		/* Check for multiply overflow */
++		if (val > U32_MAX / 1000)
++			return -EINVAL;
++
+ 		tmp = val * 1000;
+ 
+-		if (tmp < dev->min_timeout ||
+-		    tmp > dev->max_timeout)
+-				return -EINVAL;
++		if (tmp < dev->min_timeout || tmp > dev->max_timeout)
++			return -EINVAL;
+ 
+ 		if (dev->s_timeout)
+ 			ret = dev->s_timeout(dev, tmp);
+diff --git a/drivers/media/rc/ir-nec-decoder.c b/drivers/media/rc/ir-nec-decoder.c
+index 817c18f2ddd1..a95d09acc22a 100644
+--- a/drivers/media/rc/ir-nec-decoder.c
++++ b/drivers/media/rc/ir-nec-decoder.c
+@@ -87,8 +87,6 @@ static int ir_nec_decode(struct rc_dev *dev, struct ir_raw_event ev)
+ 			data->state = STATE_BIT_PULSE;
+ 			return 0;
+ 		} else if (eq_margin(ev.duration, NEC_REPEAT_SPACE, NEC_UNIT / 2)) {
+-			rc_repeat(dev);
+-			IR_dprintk(1, "Repeat last key\n");
+ 			data->state = STATE_TRAILER_PULSE;
+ 			return 0;
+ 		}
+@@ -151,19 +149,26 @@ static int ir_nec_decode(struct rc_dev *dev, struct ir_raw_event ev)
+ 		if (!geq_margin(ev.duration, NEC_TRAILER_SPACE, NEC_UNIT / 2))
+ 			break;
+ 
+-		address     = bitrev8((data->bits >> 24) & 0xff);
+-		not_address = bitrev8((data->bits >> 16) & 0xff);
+-		command	    = bitrev8((data->bits >>  8) & 0xff);
+-		not_command = bitrev8((data->bits >>  0) & 0xff);
++		if (data->count == NEC_NBITS) {
++			address     = bitrev8((data->bits >> 24) & 0xff);
++			not_address = bitrev8((data->bits >> 16) & 0xff);
++			command	    = bitrev8((data->bits >>  8) & 0xff);
++			not_command = bitrev8((data->bits >>  0) & 0xff);
++
++			scancode = ir_nec_bytes_to_scancode(address,
++							    not_address,
++							    command,
++							    not_command,
++							    &rc_proto);
+ 
+-		scancode = ir_nec_bytes_to_scancode(address, not_address,
+-						    command, not_command,
+-						    &rc_proto);
++			if (data->is_nec_x)
++				data->necx_repeat = true;
+ 
+-		if (data->is_nec_x)
+-			data->necx_repeat = true;
++			rc_keydown(dev, rc_proto, scancode, 0);
++		} else {
++			rc_repeat(dev);
++		}
+ 
+-		rc_keydown(dev, rc_proto, scancode, 0);
+ 		data->state = STATE_INACTIVE;
+ 		return 0;
+ 	}
+diff --git a/drivers/media/usb/as102/as102_fw.c b/drivers/media/usb/as102/as102_fw.c
+index 5a28ce3a1d49..38dbc128340d 100644
+--- a/drivers/media/usb/as102/as102_fw.c
++++ b/drivers/media/usb/as102/as102_fw.c
+@@ -101,18 +101,23 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 				 unsigned char *cmd,
+ 				 const struct firmware *firmware) {
+ 
+-	struct as10x_fw_pkt_t fw_pkt;
++	struct as10x_fw_pkt_t *fw_pkt;
+ 	int total_read_bytes = 0, errno = 0;
+ 	unsigned char addr_has_changed = 0;
+ 
++	fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL);
++	if (!fw_pkt)
++		return -ENOMEM;
++
++
+ 	for (total_read_bytes = 0; total_read_bytes < firmware->size; ) {
+ 		int read_bytes = 0, data_len = 0;
+ 
+ 		/* parse intel hex line */
+ 		read_bytes = parse_hex_line(
+ 				(u8 *) (firmware->data + total_read_bytes),
+-				fw_pkt.raw.address,
+-				fw_pkt.raw.data,
++				fw_pkt->raw.address,
++				fw_pkt->raw.data,
+ 				&data_len,
+ 				&addr_has_changed);
+ 
+@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 		/* detect the end of file */
+ 		total_read_bytes += read_bytes;
+ 		if (total_read_bytes == firmware->size) {
+-			fw_pkt.u.request[0] = 0x00;
+-			fw_pkt.u.request[1] = 0x03;
++			fw_pkt->u.request[0] = 0x00;
++			fw_pkt->u.request[1] = 0x03;
+ 
+ 			/* send EOF command */
+ 			errno = bus_adap->ops->upload_fw_pkt(bus_adap,
+ 							     (uint8_t *)
+-							     &fw_pkt, 2, 0);
++							     fw_pkt, 2, 0);
+ 			if (errno < 0)
+ 				goto error;
+ 		} else {
+ 			if (!addr_has_changed) {
+ 				/* prepare command to send */
+-				fw_pkt.u.request[0] = 0x00;
+-				fw_pkt.u.request[1] = 0x01;
++				fw_pkt->u.request[0] = 0x00;
++				fw_pkt->u.request[1] = 0x01;
+ 
+-				data_len += sizeof(fw_pkt.u.request);
+-				data_len += sizeof(fw_pkt.raw.address);
++				data_len += sizeof(fw_pkt->u.request);
++				data_len += sizeof(fw_pkt->raw.address);
+ 
+ 				/* send cmd to device */
+ 				errno = bus_adap->ops->upload_fw_pkt(bus_adap,
+ 								     (uint8_t *)
+-								     &fw_pkt,
++								     fw_pkt,
+ 								     data_len,
+ 								     0);
+ 				if (errno < 0)
+@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 		}
+ 	}
+ error:
++	kfree(fw_pkt);
+ 	return (errno == 0) ? total_read_bytes : errno;
+ }
+ 
+diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
+index e0daa9b6c2a0..9b742d569fb5 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -1684,7 +1684,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
+ 	nr = dev->devno;
+ 
+ 	assoc_desc = udev->actconfig->intf_assoc[0];
+-	if (assoc_desc->bFirstInterface != ifnum) {
++	if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) {
+ 		dev_err(d, "Not found matching IAD interface\n");
+ 		retval = -ENODEV;
+ 		goto err_if;
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index dd1db678718c..8033d6f73501 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1227,6 +1227,16 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
+ }
+ EXPORT_SYMBOL(v4l2_ctrl_fill);
+ 
++static u32 user_flags(const struct v4l2_ctrl *ctrl)
++{
++	u32 flags = ctrl->flags;
++
++	if (ctrl->is_ptr)
++		flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
++
++	return flags;
++}
++
+ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes)
+ {
+ 	memset(ev->reserved, 0, sizeof(ev->reserved));
+@@ -1234,7 +1244,7 @@ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 change
+ 	ev->id = ctrl->id;
+ 	ev->u.ctrl.changes = changes;
+ 	ev->u.ctrl.type = ctrl->type;
+-	ev->u.ctrl.flags = ctrl->flags;
++	ev->u.ctrl.flags = user_flags(ctrl);
+ 	if (ctrl->is_ptr)
+ 		ev->u.ctrl.value64 = 0;
+ 	else
+@@ -2577,10 +2587,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
+ 	else
+ 		qc->id = ctrl->id;
+ 	strlcpy(qc->name, ctrl->name, sizeof(qc->name));
+-	qc->flags = ctrl->flags;
++	qc->flags = user_flags(ctrl);
+ 	qc->type = ctrl->type;
+-	if (ctrl->is_ptr)
+-		qc->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
+ 	qc->elem_size = ctrl->elem_size;
+ 	qc->elems = ctrl->elems;
+ 	qc->nr_of_dims = ctrl->nr_of_dims;
+diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
+index 450ae36645aa..cf1120abbf52 100644
+--- a/drivers/mfd/lpc_ich.c
++++ b/drivers/mfd/lpc_ich.c
+@@ -522,6 +522,7 @@ static struct lpc_ich_info lpc_chipset_info[] = {
+ 		.name = "Avoton SoC",
+ 		.iTCO_version = 3,
+ 		.gpio_version = AVOTON_GPIO,
++		.spi_type = INTEL_SPI_BYT,
+ 	},
+ 	[LPC_BAYTRAIL] = {
+ 		.name = "Bay Trail SoC",
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 84b16133554b..0806f72102c0 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1814,8 +1814,13 @@ static void __init doc_dbg_register(struct mtd_info *floor)
+ 	struct dentry *root = floor->dbg.dfs_dir;
+ 	struct docg3 *docg3 = floor->priv;
+ 
+-	if (IS_ERR_OR_NULL(root))
++	if (IS_ERR_OR_NULL(root)) {
++		if (IS_ENABLED(CONFIG_DEBUG_FS) &&
++		    !IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER))
++			dev_warn(floor->dev.parent,
++				 "CONFIG_MTD_PARTITIONED_MASTER must be enabled to expose debugfs stuff\n");
+ 		return;
++	}
+ 
+ 	debugfs_create_file("docg3_flashcontrol", S_IRUSR, root, docg3,
+ 			    &flashcontrol_fops);
+diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c
+index f25eca79f4e5..68c9d98a3347 100644
+--- a/drivers/mtd/nand/atmel/nand-controller.c
++++ b/drivers/mtd/nand/atmel/nand-controller.c
+@@ -2547,6 +2547,7 @@ static struct platform_driver atmel_nand_controller_driver = {
+ 	.driver = {
+ 		.name = "atmel-nand-controller",
+ 		.of_match_table = of_match_ptr(atmel_nand_controller_of_ids),
++		.pm = &atmel_nand_controller_pm_ops,
+ 	},
+ 	.probe = atmel_nand_controller_probe,
+ 	.remove = atmel_nand_controller_remove,
+diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
+index 7f3b065b6b8f..c51d214d169e 100644
+--- a/drivers/mtd/nand/mtk_ecc.c
++++ b/drivers/mtd/nand/mtk_ecc.c
+@@ -115,6 +115,11 @@ static irqreturn_t mtk_ecc_irq(int irq, void *id)
+ 		op = ECC_DECODE;
+ 		dec = readw(ecc->regs + ECC_DECDONE);
+ 		if (dec & ecc->sectors) {
++			/*
++			 * Clear decode IRQ status once again to ensure that
++			 * there will be no extra IRQ.
++			 */
++			readw(ecc->regs + ECC_DECIRQ_STA);
+ 			ecc->sectors = 0;
+ 			complete(&ecc->done);
+ 		} else {
+@@ -130,8 +135,6 @@ static irqreturn_t mtk_ecc_irq(int irq, void *id)
+ 		}
+ 	}
+ 
+-	writel(0, ecc->regs + ECC_IRQ_REG(op));
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -307,6 +310,12 @@ void mtk_ecc_disable(struct mtk_ecc *ecc)
+ 
+ 	/* disable it */
+ 	mtk_ecc_wait_idle(ecc, op);
++	if (op == ECC_DECODE)
++		/*
++		 * Clear decode IRQ status in case there is a timeout to wait
++		 * decode IRQ.
++		 */
++		readw(ecc->regs + ECC_DECIRQ_STA);
+ 	writew(0, ecc->regs + ECC_IRQ_REG(op));
+ 	writew(ECC_OP_DISABLE, ecc->regs + ECC_CTL_REG(op));
+ 
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index 12edaae17d81..3f1d806e590a 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -1246,6 +1246,7 @@ int nand_reset(struct nand_chip *chip, int chipnr)
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(nand_reset);
+ 
+ /**
+  * nand_check_erased_buf - check if a buffer contains (almost) only 0xff data
+@@ -2799,15 +2800,18 @@ static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
+ 			    size_t *retlen, const uint8_t *buf)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
++	int chipnr = (int)(to >> chip->chip_shift);
+ 	struct mtd_oob_ops ops;
+ 	int ret;
+ 
+-	/* Wait for the device to get ready */
+-	panic_nand_wait(mtd, chip, 400);
+-
+ 	/* Grab the device */
+ 	panic_nand_get_device(chip, mtd, FL_WRITING);
+ 
++	chip->select_chip(mtd, chipnr);
++
++	/* Wait for the device to get ready */
++	panic_nand_wait(mtd, chip, 400);
++
+ 	memset(&ops, 0, sizeof(ops));
+ 	ops.len = len;
+ 	ops.datbuf = (uint8_t *)buf;
+diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
+index 246b4393118e..44322a363ba5 100644
+--- a/drivers/mtd/nand/nandsim.c
++++ b/drivers/mtd/nand/nandsim.c
+@@ -520,11 +520,16 @@ static int nandsim_debugfs_create(struct nandsim *dev)
+ 	struct dentry *root = nsmtd->dbg.dfs_dir;
+ 	struct dentry *dent;
+ 
+-	if (!IS_ENABLED(CONFIG_DEBUG_FS))
++	/*
++	 * Just skip debugfs initialization when the debugfs directory is
++	 * missing.
++	 */
++	if (IS_ERR_OR_NULL(root)) {
++		if (IS_ENABLED(CONFIG_DEBUG_FS) &&
++		    !IS_ENABLED(CONFIG_MTD_PARTITIONED_MASTER))
++			NS_WARN("CONFIG_MTD_PARTITIONED_MASTER must be enabled to expose debugfs stuff\n");
+ 		return 0;
+-
+-	if (IS_ERR_OR_NULL(root))
+-		return -1;
++	}
+ 
+ 	dent = debugfs_create_file("nandsim_wear_report", S_IRUSR,
+ 				   root, dev, &dfs_fops);
+diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
+index 54540c8fa1a2..9f98f74ff221 100644
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1133,129 +1133,172 @@ static u8  bch8_polynomial[] = {0xef, 0x51, 0x2e, 0x09, 0xed, 0x93, 0x9a, 0xc2,
+ 				0x97, 0x79, 0xe5, 0x24, 0xb5};
+ 
+ /**
+- * omap_calculate_ecc_bch - Generate bytes of ECC bytes
++ * _omap_calculate_ecc_bch - Generate ECC bytes for one sector
+  * @mtd:	MTD device structure
+  * @dat:	The pointer to data on which ecc is computed
+  * @ecc_code:	The ecc_code buffer
++ * @i:		The sector number (for a multi sector page)
+  *
+- * Support calculating of BCH4/8 ecc vectors for the page
++ * Support calculating of BCH4/8/16 ECC vectors for one sector
++ * within a page. Sector number is in @i.
+  */
+-static int __maybe_unused omap_calculate_ecc_bch(struct mtd_info *mtd,
+-					const u_char *dat, u_char *ecc_calc)
++static int _omap_calculate_ecc_bch(struct mtd_info *mtd,
++				   const u_char *dat, u_char *ecc_calc, int i)
+ {
+ 	struct omap_nand_info *info = mtd_to_omap(mtd);
+ 	int eccbytes	= info->nand.ecc.bytes;
+ 	struct gpmc_nand_regs	*gpmc_regs = &info->reg;
+ 	u8 *ecc_code;
+-	unsigned long nsectors, bch_val1, bch_val2, bch_val3, bch_val4;
++	unsigned long bch_val1, bch_val2, bch_val3, bch_val4;
+ 	u32 val;
+-	int i, j;
++	int j;
++
++	ecc_code = ecc_calc;
++	switch (info->ecc_opt) {
++	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
++	case OMAP_ECC_BCH8_CODE_HW:
++		bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
++		bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
++		bch_val3 = readl(gpmc_regs->gpmc_bch_result2[i]);
++		bch_val4 = readl(gpmc_regs->gpmc_bch_result3[i]);
++		*ecc_code++ = (bch_val4 & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val3 & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val2 & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val1 & 0xFF);
++		break;
++	case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
++	case OMAP_ECC_BCH4_CODE_HW:
++		bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
++		bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
++		*ecc_code++ = ((bch_val2 >> 12) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 4) & 0xFF);
++		*ecc_code++ = ((bch_val2 & 0xF) << 4) |
++			((bch_val1 >> 28) & 0xF);
++		*ecc_code++ = ((bch_val1 >> 20) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 12) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 4) & 0xFF);
++		*ecc_code++ = ((bch_val1 & 0xF) << 4);
++		break;
++	case OMAP_ECC_BCH16_CODE_HW:
++		val = readl(gpmc_regs->gpmc_bch_result6[i]);
++		ecc_code[0]  = ((val >>  8) & 0xFF);
++		ecc_code[1]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result5[i]);
++		ecc_code[2]  = ((val >> 24) & 0xFF);
++		ecc_code[3]  = ((val >> 16) & 0xFF);
++		ecc_code[4]  = ((val >>  8) & 0xFF);
++		ecc_code[5]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result4[i]);
++		ecc_code[6]  = ((val >> 24) & 0xFF);
++		ecc_code[7]  = ((val >> 16) & 0xFF);
++		ecc_code[8]  = ((val >>  8) & 0xFF);
++		ecc_code[9]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result3[i]);
++		ecc_code[10] = ((val >> 24) & 0xFF);
++		ecc_code[11] = ((val >> 16) & 0xFF);
++		ecc_code[12] = ((val >>  8) & 0xFF);
++		ecc_code[13] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result2[i]);
++		ecc_code[14] = ((val >> 24) & 0xFF);
++		ecc_code[15] = ((val >> 16) & 0xFF);
++		ecc_code[16] = ((val >>  8) & 0xFF);
++		ecc_code[17] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result1[i]);
++		ecc_code[18] = ((val >> 24) & 0xFF);
++		ecc_code[19] = ((val >> 16) & 0xFF);
++		ecc_code[20] = ((val >>  8) & 0xFF);
++		ecc_code[21] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result0[i]);
++		ecc_code[22] = ((val >> 24) & 0xFF);
++		ecc_code[23] = ((val >> 16) & 0xFF);
++		ecc_code[24] = ((val >>  8) & 0xFF);
++		ecc_code[25] = ((val >>  0) & 0xFF);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	/* ECC scheme specific syndrome customizations */
++	switch (info->ecc_opt) {
++	case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
++		/* Add constant polynomial to remainder, so that
++		 * ECC of blank pages results in 0x0 on reading back
++		 */
++		for (j = 0; j < eccbytes; j++)
++			ecc_calc[j] ^= bch4_polynomial[j];
++		break;
++	case OMAP_ECC_BCH4_CODE_HW:
++		/* Set  8th ECC byte as 0x0 for ROM compatibility */
++		ecc_calc[eccbytes - 1] = 0x0;
++		break;
++	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
++		/* Add constant polynomial to remainder, so that
++		 * ECC of blank pages results in 0x0 on reading back
++		 */
++		for (j = 0; j < eccbytes; j++)
++			ecc_calc[j] ^= bch8_polynomial[j];
++		break;
++	case OMAP_ECC_BCH8_CODE_HW:
++		/* Set 14th ECC byte as 0x0 for ROM compatibility */
++		ecc_calc[eccbytes - 1] = 0x0;
++		break;
++	case OMAP_ECC_BCH16_CODE_HW:
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * omap_calculate_ecc_bch_sw - ECC generator for sector for SW based correction
++ * @mtd:	MTD device structure
++ * @dat:	The pointer to data on which ecc is computed
++ * @ecc_code:	The ecc_code buffer
++ *
++ * Support calculating of BCH4/8/16 ECC vectors for one sector. This is used
++ * when SW based correction is required as ECC is required for one sector
++ * at a time.
++ */
++static int omap_calculate_ecc_bch_sw(struct mtd_info *mtd,
++				     const u_char *dat, u_char *ecc_calc)
++{
++	return _omap_calculate_ecc_bch(mtd, dat, ecc_calc, 0);
++}
++
++/**
++ * omap_calculate_ecc_bch_multi - Generate ECC for multiple sectors
++ * @mtd:	MTD device structure
++ * @dat:	The pointer to data on which ecc is computed
++ * @ecc_code:	The ecc_code buffer
++ *
++ * Support calculating of BCH4/8/16 ecc vectors for the entire page in one go.
++ */
++static int omap_calculate_ecc_bch_multi(struct mtd_info *mtd,
++					const u_char *dat, u_char *ecc_calc)
++{
++	struct omap_nand_info *info = mtd_to_omap(mtd);
++	int eccbytes = info->nand.ecc.bytes;
++	unsigned long nsectors;
++	int i, ret;
+ 
+ 	nsectors = ((readl(info->reg.gpmc_ecc_config) >> 4) & 0x7) + 1;
+ 	for (i = 0; i < nsectors; i++) {
+-		ecc_code = ecc_calc;
+-		switch (info->ecc_opt) {
+-		case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+-		case OMAP_ECC_BCH8_CODE_HW:
+-			bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			bch_val3 = readl(gpmc_regs->gpmc_bch_result2[i]);
+-			bch_val4 = readl(gpmc_regs->gpmc_bch_result3[i]);
+-			*ecc_code++ = (bch_val4 & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val3 & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val2 & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val1 & 0xFF);
+-			break;
+-		case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
+-		case OMAP_ECC_BCH4_CODE_HW:
+-			bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			*ecc_code++ = ((bch_val2 >> 12) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 4) & 0xFF);
+-			*ecc_code++ = ((bch_val2 & 0xF) << 4) |
+-				((bch_val1 >> 28) & 0xF);
+-			*ecc_code++ = ((bch_val1 >> 20) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 12) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 4) & 0xFF);
+-			*ecc_code++ = ((bch_val1 & 0xF) << 4);
+-			break;
+-		case OMAP_ECC_BCH16_CODE_HW:
+-			val = readl(gpmc_regs->gpmc_bch_result6[i]);
+-			ecc_code[0]  = ((val >>  8) & 0xFF);
+-			ecc_code[1]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result5[i]);
+-			ecc_code[2]  = ((val >> 24) & 0xFF);
+-			ecc_code[3]  = ((val >> 16) & 0xFF);
+-			ecc_code[4]  = ((val >>  8) & 0xFF);
+-			ecc_code[5]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result4[i]);
+-			ecc_code[6]  = ((val >> 24) & 0xFF);
+-			ecc_code[7]  = ((val >> 16) & 0xFF);
+-			ecc_code[8]  = ((val >>  8) & 0xFF);
+-			ecc_code[9]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result3[i]);
+-			ecc_code[10] = ((val >> 24) & 0xFF);
+-			ecc_code[11] = ((val >> 16) & 0xFF);
+-			ecc_code[12] = ((val >>  8) & 0xFF);
+-			ecc_code[13] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result2[i]);
+-			ecc_code[14] = ((val >> 24) & 0xFF);
+-			ecc_code[15] = ((val >> 16) & 0xFF);
+-			ecc_code[16] = ((val >>  8) & 0xFF);
+-			ecc_code[17] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			ecc_code[18] = ((val >> 24) & 0xFF);
+-			ecc_code[19] = ((val >> 16) & 0xFF);
+-			ecc_code[20] = ((val >>  8) & 0xFF);
+-			ecc_code[21] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			ecc_code[22] = ((val >> 24) & 0xFF);
+-			ecc_code[23] = ((val >> 16) & 0xFF);
+-			ecc_code[24] = ((val >>  8) & 0xFF);
+-			ecc_code[25] = ((val >>  0) & 0xFF);
+-			break;
+-		default:
+-			return -EINVAL;
+-		}
+-
+-		/* ECC scheme specific syndrome customizations */
+-		switch (info->ecc_opt) {
+-		case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
+-			/* Add constant polynomial to remainder, so that
+-			 * ECC of blank pages results in 0x0 on reading back */
+-			for (j = 0; j < eccbytes; j++)
+-				ecc_calc[j] ^= bch4_polynomial[j];
+-			break;
+-		case OMAP_ECC_BCH4_CODE_HW:
+-			/* Set  8th ECC byte as 0x0 for ROM compatibility */
+-			ecc_calc[eccbytes - 1] = 0x0;
+-			break;
+-		case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+-			/* Add constant polynomial to remainder, so that
+-			 * ECC of blank pages results in 0x0 on reading back */
+-			for (j = 0; j < eccbytes; j++)
+-				ecc_calc[j] ^= bch8_polynomial[j];
+-			break;
+-		case OMAP_ECC_BCH8_CODE_HW:
+-			/* Set 14th ECC byte as 0x0 for ROM compatibility */
+-			ecc_calc[eccbytes - 1] = 0x0;
+-			break;
+-		case OMAP_ECC_BCH16_CODE_HW:
+-			break;
+-		default:
+-			return -EINVAL;
+-		}
++		ret = _omap_calculate_ecc_bch(mtd, dat, ecc_calc, i);
++		if (ret)
++			return ret;
+ 
+-	ecc_calc += eccbytes;
++		ecc_calc += eccbytes;
+ 	}
+ 
+ 	return 0;
+@@ -1496,7 +1539,7 @@ static int omap_write_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 	chip->write_buf(mtd, buf, mtd->writesize);
+ 
+ 	/* Update ecc vector from GPMC result registers */
+-	chip->ecc.calculate(mtd, buf, &ecc_calc[0]);
++	omap_calculate_ecc_bch_multi(mtd, buf, &ecc_calc[0]);
+ 
+ 	ret = mtd_ooblayout_set_eccbytes(mtd, ecc_calc, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -1508,6 +1551,72 @@ static int omap_write_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 	return 0;
+ }
+ 
++/**
++ * omap_write_subpage_bch - BCH hardware ECC based subpage write
++ * @mtd:	mtd info structure
++ * @chip:	nand chip info structure
++ * @offset:	column address of subpage within the page
++ * @data_len:	data length
++ * @buf:	data buffer
++ * @oob_required: must write chip->oob_poi to OOB
++ * @page: page number to write
++ *
++ * OMAP optimized subpage write method.
++ */
++static int omap_write_subpage_bch(struct mtd_info *mtd,
++				  struct nand_chip *chip, u32 offset,
++				  u32 data_len, const u8 *buf,
++				  int oob_required, int page)
++{
++	u8 *ecc_calc = chip->buffers->ecccalc;
++	int ecc_size      = chip->ecc.size;
++	int ecc_bytes     = chip->ecc.bytes;
++	int ecc_steps     = chip->ecc.steps;
++	u32 start_step = offset / ecc_size;
++	u32 end_step   = (offset + data_len - 1) / ecc_size;
++	int step, ret = 0;
++
++	/*
++	 * Write entire page at one go as it would be optimal
++	 * as ECC is calculated by hardware.
++	 * ECC is calculated for all subpages but we choose
++	 * only what we want.
++	 */
++
++	/* Enable GPMC ECC engine */
++	chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
++
++	/* Write data */
++	chip->write_buf(mtd, buf, mtd->writesize);
++
++	for (step = 0; step < ecc_steps; step++) {
++		/* mask ECC of un-touched subpages by padding 0xFF */
++		if (step < start_step || step > end_step)
++			memset(ecc_calc, 0xff, ecc_bytes);
++		else
++			ret = _omap_calculate_ecc_bch(mtd, buf, ecc_calc, step);
++
++		if (ret)
++			return ret;
++
++		buf += ecc_size;
++		ecc_calc += ecc_bytes;
++	}
++
++	/* copy calculated ECC for whole page to chip->buffer->oob */
++	/* this include masked-value(0xFF) for unwritten subpages */
++	ecc_calc = chip->buffers->ecccalc;
++	ret = mtd_ooblayout_set_eccbytes(mtd, ecc_calc, chip->oob_poi, 0,
++					 chip->ecc.total);
++	if (ret)
++		return ret;
++
++	/* write OOB buffer to NAND device */
++	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
++
++	return 0;
++}
++
+ /**
+  * omap_read_page_bch - BCH ecc based page read function for entire page
+  * @mtd:		mtd info structure
+@@ -1544,7 +1653,7 @@ static int omap_read_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 		       chip->ecc.total);
+ 
+ 	/* Calculate ecc bytes */
+-	chip->ecc.calculate(mtd, buf, ecc_calc);
++	omap_calculate_ecc_bch_multi(mtd, buf, ecc_calc);
+ 
+ 	ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -2044,7 +2153,7 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 4;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= nand_bch_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
++		nand_chip->ecc.calculate	= omap_calculate_ecc_bch_sw;
+ 		mtd_set_ooblayout(mtd, &omap_sw_ooblayout_ops);
+ 		/* Reserve one byte for the OMAP marker */
+ 		oobbytes_per_step		= nand_chip->ecc.bytes + 1;
+@@ -2066,9 +2175,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 4;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+@@ -2087,7 +2196,7 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 8;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= nand_bch_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
++		nand_chip->ecc.calculate	= omap_calculate_ecc_bch_sw;
+ 		mtd_set_ooblayout(mtd, &omap_sw_ooblayout_ops);
+ 		/* Reserve one byte for the OMAP marker */
+ 		oobbytes_per_step		= nand_chip->ecc.bytes + 1;
+@@ -2109,9 +2218,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 8;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+@@ -2131,9 +2240,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 16;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c
+index 8a596bfeddff..7802ac3ba934 100644
+--- a/drivers/mtd/spi-nor/intel-spi.c
++++ b/drivers/mtd/spi-nor/intel-spi.c
+@@ -422,7 +422,7 @@ static int intel_spi_sw_cycle(struct intel_spi *ispi, u8 opcode, u8 *buf,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	val = (len << SSFSTS_CTL_DBC_SHIFT) | SSFSTS_CTL_DS;
++	val = ((len - 1) << SSFSTS_CTL_DBC_SHIFT) | SSFSTS_CTL_DS;
+ 	val |= ret << SSFSTS_CTL_COP_SHIFT;
+ 	val |= SSFSTS_CTL_FCERR | SSFSTS_CTL_FDONE;
+ 	val |= SSFSTS_CTL_SCGO;
+@@ -432,7 +432,7 @@ static int intel_spi_sw_cycle(struct intel_spi *ispi, u8 opcode, u8 *buf,
+ 	if (ret)
+ 		return ret;
+ 
+-	status = readl(ispi->base + SSFSTS_CTL);
++	status = readl(ispi->sregs + SSFSTS_CTL);
+ 	if (status & SSFSTS_CTL_FCERR)
+ 		return -EIO;
+ 	else if (status & SSFSTS_CTL_AEL)
+diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
+index 0641c0098738..afb7ebe20b24 100644
+--- a/drivers/net/ethernet/intel/e1000e/defines.h
++++ b/drivers/net/ethernet/intel/e1000e/defines.h
+@@ -398,6 +398,7 @@
+ #define E1000_ICR_LSC           0x00000004 /* Link Status Change */
+ #define E1000_ICR_RXSEQ         0x00000008 /* Rx sequence error */
+ #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
++#define E1000_ICR_RXO           0x00000040 /* Receiver Overrun */
+ #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+ #define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
+ /* If this bit asserted, the driver should claim the interrupt */
+diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
+index b322011ec282..f457c5703d0c 100644
+--- a/drivers/net/ethernet/intel/e1000e/mac.c
++++ b/drivers/net/ethernet/intel/e1000e/mac.c
+@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw)
+  *  Checks to see of the link status of the hardware has changed.  If a
+  *  change in link status has been detected, then we read the PHY registers
+  *  to get the current speed/duplex if link exists.
++ *
++ *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
++ *  up).
+  **/
+ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ {
+@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * Change or Rx Sequence Error interrupt.
+ 	 */
+ 	if (!mac->get_link_status)
+-		return 0;
++		return 1;
+ 
+ 	/* First we want to see if the MII Status Register reports
+ 	 * link.  If so, then we want to get the current speed/duplex
+@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * different link partner.
+ 	 */
+ 	ret_val = e1000e_config_fc_after_link_up(hw);
+-	if (ret_val)
++	if (ret_val) {
+ 		e_dbg("Error configuring flow control\n");
++		return ret_val;
++	}
+ 
+-	return ret_val;
++	return 1;
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 327dfe5bedc0..c38b00c90f48 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -1910,14 +1910,30 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data)
+ 	struct net_device *netdev = data;
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_hw *hw = &adapter->hw;
++	u32 icr;
++	bool enable = true;
++
++	icr = er32(ICR);
++	if (icr & E1000_ICR_RXO) {
++		ew32(ICR, E1000_ICR_RXO);
++		enable = false;
++		/* napi poll will re-enable Other, make sure it runs */
++		if (napi_schedule_prep(&adapter->napi)) {
++			adapter->total_rx_bytes = 0;
++			adapter->total_rx_packets = 0;
++			__napi_schedule(&adapter->napi);
++		}
++	}
++	if (icr & E1000_ICR_LSC) {
++		ew32(ICR, E1000_ICR_LSC);
++		hw->mac.get_link_status = true;
++		/* guard against interrupt when we're going down */
++		if (!test_bit(__E1000_DOWN, &adapter->state))
++			mod_timer(&adapter->watchdog_timer, jiffies + 1);
++	}
+ 
+-	hw->mac.get_link_status = true;
+-
+-	/* guard against interrupt when we're going down */
+-	if (!test_bit(__E1000_DOWN, &adapter->state)) {
+-		mod_timer(&adapter->watchdog_timer, jiffies + 1);
++	if (enable && !test_bit(__E1000_DOWN, &adapter->state))
+ 		ew32(IMS, E1000_IMS_OTHER);
+-	}
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -2687,7 +2703,8 @@ static int e1000e_poll(struct napi_struct *napi, int weight)
+ 		napi_complete_done(napi, work_done);
+ 		if (!test_bit(__E1000_DOWN, &adapter->state)) {
+ 			if (adapter->msix_entries)
+-				ew32(IMS, adapter->rx_ring->ims_val);
++				ew32(IMS, adapter->rx_ring->ims_val |
++				     E1000_IMS_OTHER);
+ 			else
+ 				e1000_irq_enable(adapter);
+ 		}
+@@ -3004,8 +3021,8 @@ static void e1000_configure_tx(struct e1000_adapter *adapter)
+ 
+ 	hw->mac.ops.config_collision_dist(hw);
+ 
+-	/* SPT and CNP Si errata workaround to avoid data corruption */
+-	if (hw->mac.type >= e1000_pch_spt) {
++	/* SPT and KBL Si errata workaround to avoid data corruption */
++	if (hw->mac.type == e1000_pch_spt) {
+ 		u32 reg_val;
+ 
+ 		reg_val = er32(IOSFPC);
+@@ -3013,7 +3030,9 @@ static void e1000_configure_tx(struct e1000_adapter *adapter)
+ 		ew32(IOSFPC, reg_val);
+ 
+ 		reg_val = er32(TARC(0));
+-		reg_val |= E1000_TARC0_CB_MULTIQ_3_REQ;
++		/* SPT and KBL Si errata workaround to avoid Tx hang */
++		reg_val &= ~BIT(28);
++		reg_val |= BIT(29);
+ 		ew32(TARC(0), reg_val);
+ 	}
+ }
+@@ -4204,7 +4223,7 @@ static void e1000e_trigger_lsc(struct e1000_adapter *adapter)
+ 	struct e1000_hw *hw = &adapter->hw;
+ 
+ 	if (adapter->msix_entries)
+-		ew32(ICS, E1000_ICS_OTHER);
++		ew32(ICS, E1000_ICS_LSC | E1000_ICS_OTHER);
+ 	else
+ 		ew32(ICS, E1000_ICS_LSC);
+ }
+@@ -5081,7 +5100,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
+ 	case e1000_media_type_copper:
+ 		if (hw->mac.get_link_status) {
+ 			ret_val = hw->mac.ops.check_for_link(hw);
+-			link_active = !hw->mac.get_link_status;
++			link_active = ret_val > 0;
+ 		} else {
+ 			link_active = true;
+ 		}
+@@ -5099,7 +5118,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
+ 		break;
+ 	}
+ 
+-	if ((ret_val == E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
++	if ((ret_val == -E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
+ 	    (er32(CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) {
+ 		/* See e1000_kmrn_lock_loss_workaround_ich8lan() */
+ 		e_info("Gigabit has been disabled, downgrading speed\n");
+diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
+index d78d47b41a71..86ff0969efb6 100644
+--- a/drivers/net/ethernet/intel/e1000e/phy.c
++++ b/drivers/net/ethernet/intel/e1000e/phy.c
+@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 	s32 ret_val = 0;
+ 	u16 i, phy_status;
+ 
++	*success = false;
+ 	for (i = 0; i < iterations; i++) {
+ 		/* Some PHYs require the MII_BMSR register to be read
+ 		 * twice due to the link bit being sticky.  No harm doing
+@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+ 		if (ret_val)
+ 			break;
+-		if (phy_status & BMSR_LSTATUS)
++		if (phy_status & BMSR_LSTATUS) {
++			*success = true;
+ 			break;
++		}
+ 		if (usec_interval >= 1000)
+ 			msleep(usec_interval / 1000);
+ 		else
+ 			udelay(usec_interval);
+ 	}
+ 
+-	*success = (i < iterations);
+-
+ 	return ret_val;
+ }
+ 
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+index 9dffaba85ae6..103c0a742d03 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+@@ -1229,7 +1229,7 @@ static bool fm10k_clean_tx_irq(struct fm10k_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE))
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 6498da8806cb..ea20aacd5e1d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -3760,7 +3760,7 @@ static bool i40e_clean_fdir_tx_irq(struct i40e_ring *tx_ring, int budget)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if the descriptor isn't done, no work yet to do */
+ 		if (!(eop_desc->cmd_type_offset_bsz &
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 120c68f78951..3c07ff171ddc 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -759,7 +759,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
+ 		/* we have caught up to head, no work left to do */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index c32c62462c84..07a4e6e13925 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -179,7 +179,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
+ 		/* if the descriptor isn't done, no work yet to do */
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index ea69af267d63..b0031c5ff767 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6970,7 +6970,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector, int napi_budget)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
+index 1ed556911b14..6f5888bd9194 100644
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -810,7 +810,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 6d5f31e94358..879a9c4cef59 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1192,7 +1192,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 032f8ac06357..90ecc4b06462 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -326,7 +326,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 64a04975bcf8..bc93b69cfd1e 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -816,11 +816,14 @@ static void mvneta_txq_pend_desc_add(struct mvneta_port *pp,
+ {
+ 	u32 val;
+ 
+-	/* Only 255 descriptors can be added at once ; Assume caller
+-	 * process TX desriptors in quanta less than 256
+-	 */
+-	val = pend_desc + txq->pending;
+-	mvreg_write(pp, MVNETA_TXQ_UPDATE_REG(txq->id), val);
++	pend_desc += txq->pending;
++
++	/* Only 255 Tx descriptors can be added at once */
++	do {
++		val = min(pend_desc, 255);
++		mvreg_write(pp, MVNETA_TXQ_UPDATE_REG(txq->id), val);
++		pend_desc -= val;
++	} while (pend_desc > 0);
+ 	txq->pending = 0;
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+index e8b5ff42f5a8..c8e7b54a538a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+@@ -72,18 +72,21 @@
+ #define IWL9000_SMEM_OFFSET		0x400000
+ #define IWL9000_SMEM_LEN		0x68000
+ 
+-#define  IWL9000_FW_PRE "iwlwifi-9000-pu-a0-jf-a0-"
++#define  IWL9000A_FW_PRE "iwlwifi-9000-pu-a0-jf-a0-"
++#define  IWL9000B_FW_PRE "iwlwifi-9000-pu-b0-jf-b0-"
+ #define  IWL9000RFB_FW_PRE "iwlwifi-9000-pu-a0-jf-b0-"
+ #define  IWL9260A_FW_PRE "iwlwifi-9260-th-a0-jf-a0-"
+ #define  IWL9260B_FW_PRE "iwlwifi-9260-th-b0-jf-b0-"
+-#define IWL9000_MODULE_FIRMWARE(api) \
+-	IWL9000_FW_PRE "-" __stringify(api) ".ucode"
++#define IWL9000A_MODULE_FIRMWARE(api) \
++	IWL9000A_FW_PRE __stringify(api) ".ucode"
++#define IWL9000B_MODULE_FIRMWARE(api) \
++	IWL9000B_FW_PRE __stringify(api) ".ucode"
+ #define IWL9000RFB_MODULE_FIRMWARE(api) \
+-	IWL9000RFB_FW_PRE "-" __stringify(api) ".ucode"
++	IWL9000RFB_FW_PRE __stringify(api) ".ucode"
+ #define IWL9260A_MODULE_FIRMWARE(api) \
+-	IWL9260A_FW_PRE "-" __stringify(api) ".ucode"
++	IWL9260A_FW_PRE __stringify(api) ".ucode"
+ #define IWL9260B_MODULE_FIRMWARE(api) \
+-	IWL9260B_FW_PRE "-" __stringify(api) ".ucode"
++	IWL9260B_FW_PRE __stringify(api) ".ucode"
+ 
+ #define NVM_HW_SECTION_NUM_FAMILY_9000		10
+ 
+@@ -193,7 +196,48 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
+ 	.nvm_ver = IWL9000_NVM_VERSION,
+ 	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+ 	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++};
++
++const struct iwl_cfg iwl9460_2ac_cfg_soc = {
++	.name = "Intel(R) Dual Band Wireless AC 9460",
++	.fw_name_pre = IWL9000A_FW_PRE,
++	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++	IWL_DEVICE_9000,
++	.ht_params = &iwl9000_ht_params,
++	.nvm_ver = IWL9000_NVM_VERSION,
++	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+ 	.integrated = true,
++	.soc_latency = 5000,
++};
++
++const struct iwl_cfg iwl9461_2ac_cfg_soc = {
++		.name = "Intel(R) Dual Band Wireless AC 9461",
++		.fw_name_pre = IWL9000A_FW_PRE,
++		.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++		.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++		IWL_DEVICE_9000,
++		.ht_params = &iwl9000_ht_params,
++		.nvm_ver = IWL9000_NVM_VERSION,
++		.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++		.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++		.integrated = true,
++		.soc_latency = 5000,
++};
++
++const struct iwl_cfg iwl9462_2ac_cfg_soc = {
++		.name = "Intel(R) Dual Band Wireless AC 9462",
++		.fw_name_pre = IWL9000A_FW_PRE,
++		.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++		.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++		IWL_DEVICE_9000,
++		.ht_params = &iwl9000_ht_params,
++		.nvm_ver = IWL9000_NVM_VERSION,
++		.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++		.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++		.integrated = true,
++		.soc_latency = 5000,
+ };
+ 
+ const struct iwl_cfg iwl9560_2ac_cfg = {
+@@ -205,10 +249,23 @@ const struct iwl_cfg iwl9560_2ac_cfg = {
+ 	.nvm_ver = IWL9000_NVM_VERSION,
+ 	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+ 	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+-	.integrated = true,
+ };
+ 
+-MODULE_FIRMWARE(IWL9000_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
++const struct iwl_cfg iwl9560_2ac_cfg_soc = {
++	.name = "Intel(R) Dual Band Wireless AC 9560",
++	.fw_name_pre = IWL9000A_FW_PRE,
++	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++	IWL_DEVICE_9000,
++	.ht_params = &iwl9000_ht_params,
++	.nvm_ver = IWL9000_NVM_VERSION,
++	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++	.integrated = true,
++	.soc_latency = 5000,
++};
++MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL9260A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL9260B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/a000.c b/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
+index a440140ed8dd..7eade165b747 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
+@@ -80,15 +80,15 @@
+ #define IWL_A000_HR_A0_FW_PRE	"iwlwifi-QuQnj-a0-hr-a0-"
+ 
+ #define IWL_A000_HR_MODULE_FIRMWARE(api) \
+-	IWL_A000_HR_FW_PRE "-" __stringify(api) ".ucode"
++	IWL_A000_HR_FW_PRE __stringify(api) ".ucode"
+ #define IWL_A000_JF_MODULE_FIRMWARE(api) \
+-	IWL_A000_JF_FW_PRE "-" __stringify(api) ".ucode"
++	IWL_A000_JF_FW_PRE __stringify(api) ".ucode"
+ #define IWL_A000_HR_F0_QNJ_MODULE_FIRMWARE(api) \
+-	IWL_A000_HR_F0_FW_PRE "-" __stringify(api) ".ucode"
++	IWL_A000_HR_F0_FW_PRE __stringify(api) ".ucode"
+ #define IWL_A000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
+-	IWL_A000_JF_B0_FW_PRE "-" __stringify(api) ".ucode"
++	IWL_A000_JF_B0_FW_PRE __stringify(api) ".ucode"
+ #define IWL_A000_HR_A0_QNJ_MODULE_FIRMWARE(api) \
+-	IWL_A000_HR_A0_FW_PRE "-" __stringify(api) ".ucode"
++	IWL_A000_HR_A0_FW_PRE __stringify(api) ".ucode"
+ 
+ #define NVM_HW_SECTION_NUM_FAMILY_A000		10
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+index 5a40092febfb..3bfc657f6b42 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+@@ -531,6 +531,8 @@ struct iwl_scan_config_v1 {
+ } __packed; /* SCAN_CONFIG_DB_CMD_API_S */
+ 
+ #define SCAN_TWO_LMACS 2
++#define SCAN_LB_LMAC_IDX 0
++#define SCAN_HB_LMAC_IDX 1
+ 
+ struct iwl_scan_config {
+ 	__le32 flags;
+@@ -578,6 +580,7 @@ enum iwl_umac_scan_general_flags {
+ 	IWL_UMAC_SCAN_GEN_FLAGS_MATCH			= BIT(9),
+ 	IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL		= BIT(10),
+ 	IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED	= BIT(11),
++	IWL_UMAC_SCAN_GEN_FLAGS_ADAPTIVE_DWELL		= BIT(13),
+ };
+ 
+ /**
+@@ -631,12 +634,17 @@ struct iwl_scan_req_umac_tail {
+  * @uid: scan id, &enum iwl_umac_scan_uid_offsets
+  * @ooc_priority: out of channel priority - &enum iwl_scan_priority
+  * @general_flags: &enum iwl_umac_scan_general_flags
+- * @reserved2: for future use and alignment
+  * @scan_start_mac_id: report the scan start TSF time according to this mac TSF
+  * @extended_dwell: dwell time for channels 1, 6 and 11
+  * @active_dwell: dwell time for active scan
+  * @passive_dwell: dwell time for passive scan
+  * @fragmented_dwell: dwell time for fragmented passive scan
++ * @adwell_default_n_aps: for adaptive dwell the default number of APs
++ *	per channel
++ * @adwell_default_n_aps_social: for adaptive dwell the default
++ *	number of APs per social (1,6,11) channel
++ * @adwell_max_budget: for adaptive dwell the maximal budget of TU to be added
++ *	to total scan time
+  * @max_out_time: max out of serving channel time, per LMAC - for CDB there
+  *	are 2 LMACs
+  * @suspend_time: max suspend time, per LMAC - for CDB there are 2 LMACs
+@@ -644,6 +652,8 @@ struct iwl_scan_req_umac_tail {
+  * @channel_flags: &enum iwl_scan_channel_flags
+  * @n_channels: num of channels in scan request
+  * @reserved: for future use and alignment
++ * @reserved2: for future use and alignment
++ * @reserved3: for future use and alignment
+  * @data: &struct iwl_scan_channel_cfg_umac and
+  *	&struct iwl_scan_req_umac_tail
+  */
+@@ -651,41 +661,64 @@ struct iwl_scan_req_umac {
+ 	__le32 flags;
+ 	__le32 uid;
+ 	__le32 ooc_priority;
+-	/* SCAN_GENERAL_PARAMS_API_S_VER_4 */
+ 	__le16 general_flags;
+-	u8 reserved2;
++	u8 reserved;
+ 	u8 scan_start_mac_id;
+-	u8 extended_dwell;
+-	u8 active_dwell;
+-	u8 passive_dwell;
+-	u8 fragmented_dwell;
+ 	union {
+ 		struct {
++			u8 extended_dwell;
++			u8 active_dwell;
++			u8 passive_dwell;
++			u8 fragmented_dwell;
+ 			__le32 max_out_time;
+ 			__le32 suspend_time;
+ 			__le32 scan_priority;
+-			/* SCAN_CHANNEL_PARAMS_API_S_VER_4 */
++			/* SCAN_CHANNEL_PARAMS_API_S_VER_1 */
+ 			u8 channel_flags;
+ 			u8 n_channels;
+-			__le16 reserved;
++			__le16 reserved2;
+ 			u8 data[];
+ 		} v1; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_1 */
+ 		struct {
++			u8 extended_dwell;
++			u8 active_dwell;
++			u8 passive_dwell;
++			u8 fragmented_dwell;
+ 			__le32 max_out_time[SCAN_TWO_LMACS];
+ 			__le32 suspend_time[SCAN_TWO_LMACS];
+ 			__le32 scan_priority;
+-			/* SCAN_CHANNEL_PARAMS_API_S_VER_4 */
++			/* SCAN_CHANNEL_PARAMS_API_S_VER_1 */
+ 			u8 channel_flags;
+ 			u8 n_channels;
+-			__le16 reserved;
++			__le16 reserved2;
+ 			u8 data[];
+ 		} v6; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_6 */
++		struct {
++			u8 active_dwell;
++			u8 passive_dwell;
++			u8 fragmented_dwell;
++			u8 adwell_default_n_aps;
++			u8 adwell_default_n_aps_social;
++			u8 reserved3;
++			__le16 adwell_max_budget;
++			__le32 max_out_time[SCAN_TWO_LMACS];
++			__le32 suspend_time[SCAN_TWO_LMACS];
++			__le32 scan_priority;
++			/* SCAN_CHANNEL_PARAMS_API_S_VER_1 */
++			u8 channel_flags;
++			u8 n_channels;
++			__le16 reserved2;
++			u8 data[];
++		} v7; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_7 */
+ 	};
+ } __packed;
+ 
+-#define IWL_SCAN_REQ_UMAC_SIZE sizeof(struct iwl_scan_req_umac)
++#define IWL_SCAN_REQ_UMAC_SIZE_V7 sizeof(struct iwl_scan_req_umac)
++#define IWL_SCAN_REQ_UMAC_SIZE_V6 (sizeof(struct iwl_scan_req_umac) - \
++				   2 * sizeof(u8) - sizeof(__le16))
+ #define IWL_SCAN_REQ_UMAC_SIZE_V1 (sizeof(struct iwl_scan_req_umac) - \
+-				   2 * sizeof(__le32))
++				   2 * sizeof(__le32) - 2 * sizeof(u8) - \
++				   sizeof(__le16))
+ 
+ /**
+  * struct iwl_umac_scan_abort
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
+index 279248cd9cfb..e988e4c371c4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
+@@ -262,6 +262,7 @@ enum iwl_ucode_tlv_api {
+ 	IWL_UCODE_TLV_API_STA_TYPE		= (__force iwl_ucode_tlv_api_t)30,
+ 	IWL_UCODE_TLV_API_NAN2_VER2		= (__force iwl_ucode_tlv_api_t)31,
+ 	/* API Set 1 */
++	IWL_UCODE_TLV_API_ADAPTIVE_DWELL	= (__force iwl_ucode_tlv_api_t)32,
+ 	IWL_UCODE_TLV_API_NEW_BEACON_TEMPLATE	= (__force iwl_ucode_tlv_api_t)34,
+ 	IWL_UCODE_TLV_API_NEW_RX_STATS		= (__force iwl_ucode_tlv_api_t)35,
+ 	IWL_UCODE_TLV_API_COEX_ATS_EXTERNAL	= (__force iwl_ucode_tlv_api_t)37,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index 71cb1ecde0f7..e226179c32fa 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -364,6 +364,7 @@ struct iwl_cfg {
+ 	u32 dccm2_len;
+ 	u32 smem_offset;
+ 	u32 smem_len;
++	u32 soc_latency;
+ 	u16 nvm_ver;
+ 	u16 nvm_calib_ver;
+ 	u16 rx_with_siso_diversity:1,
+@@ -471,6 +472,10 @@ extern const struct iwl_cfg iwl9260_2ac_cfg;
+ extern const struct iwl_cfg iwl9270_2ac_cfg;
+ extern const struct iwl_cfg iwl9460_2ac_cfg;
+ extern const struct iwl_cfg iwl9560_2ac_cfg;
++extern const struct iwl_cfg iwl9460_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwla000_2ac_cfg_jf;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index 949e63418299..8dcdb522b846 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -1124,6 +1124,12 @@ static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
+ 			    IWL_UCODE_TLV_CAPA_D0I3_SUPPORT);
+ }
+ 
++static inline bool iwl_mvm_is_adaptive_dwell_supported(struct iwl_mvm *mvm)
++{
++	return fw_has_api(&mvm->fw->ucode_capa,
++			  IWL_UCODE_TLV_API_ADAPTIVE_DWELL);
++}
++
+ static inline bool iwl_mvm_enter_d0i3_on_suspend(struct iwl_mvm *mvm)
+ {
+ 	/* For now we only use this mode to differentiate between
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+index 774122fed454..e4fd476e9ccb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -130,6 +130,19 @@ struct iwl_mvm_scan_params {
+ 	u32 measurement_dwell;
+ };
+ 
++static inline void *iwl_mvm_get_scan_req_umac_data(struct iwl_mvm *mvm)
++{
++	struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
++
++	if (iwl_mvm_is_adaptive_dwell_supported(mvm))
++		return (void *)&cmd->v7.data;
++
++	if (iwl_mvm_has_new_tx_api(mvm))
++		return (void *)&cmd->v6.data;
++
++	return (void *)&cmd->v1.data;
++}
++
+ static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
+ {
+ 	if (mvm->scan_rx_ant != ANT_NONE)
+@@ -1075,25 +1088,57 @@ static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
+ {
+ 	struct iwl_mvm_scan_timing_params *timing = &scan_timing[params->type];
+ 
++	if (iwl_mvm_is_regular_scan(params))
++		cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
++	else
++		cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_2);
++
++	if (iwl_mvm_is_adaptive_dwell_supported(mvm)) {
++		if (params->measurement_dwell) {
++			cmd->v7.active_dwell = params->measurement_dwell;
++			cmd->v7.passive_dwell = params->measurement_dwell;
++		} else {
++			cmd->v7.active_dwell = IWL_SCAN_DWELL_ACTIVE;
++			cmd->v7.passive_dwell = IWL_SCAN_DWELL_PASSIVE;
++		}
++		cmd->v7.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
++
++		cmd->v7.scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
++		cmd->v7.max_out_time[SCAN_LB_LMAC_IDX] =
++			cpu_to_le32(timing->max_out_time);
++		cmd->v7.suspend_time[SCAN_LB_LMAC_IDX] =
++			cpu_to_le32(timing->suspend_time);
++		if (iwl_mvm_is_cdb_supported(mvm)) {
++			cmd->v7.max_out_time[SCAN_HB_LMAC_IDX] =
++				cpu_to_le32(timing->max_out_time);
++			cmd->v7.suspend_time[SCAN_HB_LMAC_IDX] =
++				cpu_to_le32(timing->suspend_time);
++		}
++
++		return;
++	}
++
+ 	if (params->measurement_dwell) {
+-		cmd->active_dwell = params->measurement_dwell;
+-		cmd->passive_dwell = params->measurement_dwell;
+-		cmd->extended_dwell = params->measurement_dwell;
++		cmd->v1.active_dwell = params->measurement_dwell;
++		cmd->v1.passive_dwell = params->measurement_dwell;
++		cmd->v1.extended_dwell = params->measurement_dwell;
+ 	} else {
+-		cmd->active_dwell = IWL_SCAN_DWELL_ACTIVE;
+-		cmd->passive_dwell = IWL_SCAN_DWELL_PASSIVE;
+-		cmd->extended_dwell = IWL_SCAN_DWELL_EXTENDED;
++		cmd->v1.active_dwell = IWL_SCAN_DWELL_ACTIVE;
++		cmd->v1.passive_dwell = IWL_SCAN_DWELL_PASSIVE;
++		cmd->v1.extended_dwell = IWL_SCAN_DWELL_EXTENDED;
+ 	}
+-	cmd->fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
++	cmd->v1.fragmented_dwell = IWL_SCAN_DWELL_FRAGMENTED;
+ 
+ 	if (iwl_mvm_has_new_tx_api(mvm)) {
+ 		cmd->v6.scan_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
+-		cmd->v6.max_out_time[0] = cpu_to_le32(timing->max_out_time);
+-		cmd->v6.suspend_time[0] = cpu_to_le32(timing->suspend_time);
++		cmd->v6.max_out_time[SCAN_LB_LMAC_IDX] =
++			cpu_to_le32(timing->max_out_time);
++		cmd->v6.suspend_time[SCAN_LB_LMAC_IDX] =
++			cpu_to_le32(timing->suspend_time);
+ 		if (iwl_mvm_is_cdb_supported(mvm)) {
+-			cmd->v6.max_out_time[1] =
++			cmd->v6.max_out_time[SCAN_HB_LMAC_IDX] =
+ 				cpu_to_le32(timing->max_out_time);
+-			cmd->v6.suspend_time[1] =
++			cmd->v6.suspend_time[SCAN_HB_LMAC_IDX] =
+ 				cpu_to_le32(timing->suspend_time);
+ 		}
+ 	} else {
+@@ -1102,11 +1147,6 @@ static void iwl_mvm_scan_umac_dwell(struct iwl_mvm *mvm,
+ 		cmd->v1.scan_priority =
+ 			cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
+ 	}
+-
+-	if (iwl_mvm_is_regular_scan(params))
+-		cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_6);
+-	else
+-		cmd->ooc_priority = cpu_to_le32(IWL_SCAN_PRIORITY_EXT_2);
+ }
+ 
+ static void
+@@ -1178,8 +1218,7 @@ static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 			     int type)
+ {
+ 	struct iwl_scan_req_umac *cmd = mvm->scan_cmd;
+-	void *cmd_data = iwl_mvm_has_new_tx_api(mvm) ?
+-			 (void *)&cmd->v6.data : (void *)&cmd->v1.data;
++	void *cmd_data = iwl_mvm_get_scan_req_umac_data(mvm);
+ 	struct iwl_scan_req_umac_tail *sec_part = cmd_data +
+ 		sizeof(struct iwl_scan_channel_cfg_umac) *
+ 			mvm->fw->ucode_capa.n_scan_channels;
+@@ -1216,7 +1255,10 @@ static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 				IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+ 				IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
+ 
+-	if (iwl_mvm_has_new_tx_api(mvm)) {
++	if (iwl_mvm_is_adaptive_dwell_supported(mvm)) {
++		cmd->v7.channel_flags = channel_flags;
++		cmd->v7.n_channels = params->n_channels;
++	} else if (iwl_mvm_has_new_tx_api(mvm)) {
+ 		cmd->v6.channel_flags = channel_flags;
+ 		cmd->v6.n_channels = params->n_channels;
+ 	} else {
+@@ -1661,8 +1703,10 @@ int iwl_mvm_scan_size(struct iwl_mvm *mvm)
+ {
+ 	int base_size = IWL_SCAN_REQ_UMAC_SIZE_V1;
+ 
+-	if (iwl_mvm_has_new_tx_api(mvm))
+-		base_size = IWL_SCAN_REQ_UMAC_SIZE;
++	if (iwl_mvm_is_adaptive_dwell_supported(mvm))
++		base_size = IWL_SCAN_REQ_UMAC_SIZE_V7;
++	else if (iwl_mvm_has_new_tx_api(mvm))
++		base_size = IWL_SCAN_REQ_UMAC_SIZE_V6;
+ 
+ 	if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+ 		return base_size +
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 858765fed8f8..548e1928430d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -465,6 +465,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x24F4, 0xC030, iwl8260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x24F4, 0xD030, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)},
+@@ -483,6 +485,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24F3, 0x0000, iwl8265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x24F3, 0x4010, iwl8260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24FD, 0x0010, iwl8265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24FD, 0x0110, iwl8265_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24FD, 0x1110, iwl8265_2ac_cfg)},
+@@ -508,67 +511,143 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x24FD, 0x3E01, iwl8275_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24FD, 0x1012, iwl8275_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x24FD, 0x0012, iwl8275_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x24FD, 0x0014, iwl8265_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
+ 
+ /* 9000 Series */
+-	{IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0410, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0610, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0310, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0510, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0710, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x003C, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x1010, iwl9260_2ac_cfg)},
+ 	{IWL_PCI_DEVICE(0x2526, 0x1030, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0034, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x003C, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x0038, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x9DF0, 0x003C, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0xA370, 0x003C, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg)},
+-	{IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x271B, 0x0214, iwl9260_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x0230, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
++	{IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0230, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0238, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x023C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0038, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x003C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0230, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0238, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x023C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0310, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0410, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0510, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0610, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0710, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x4030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x4034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0x9DF0, 0x40A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x003C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0064, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x00A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x00A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0230, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0234, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0238, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x023C, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0260, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x0264, iwl9461_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x02A0, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x02A4, iwl9462_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x4034, iwl9560_2ac_cfg_soc)},
++	{IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)},
+ 
+ /* a000 Series */
+ 	{IWL_PCI_DEVICE(0x2720, 0x0A10, iwla000_2ac_cfg_hr_cdb)},
+@@ -576,8 +655,14 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ 	{IWL_PCI_DEVICE(0x2720, 0x0000, iwla000_2ax_cfg_hr)},
+ 	{IWL_PCI_DEVICE(0x34F0, 0x0070, iwla000_2ax_cfg_hr)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x0078, iwla000_2ax_cfg_hr)},
+-	{IWL_PCI_DEVICE(0x2720, 0x0070, iwla000_2ax_cfg_hr)},
++	{IWL_PCI_DEVICE(0x2720, 0x0070, iwla000_2ac_cfg_hr_cdb)},
++	{IWL_PCI_DEVICE(0x2720, 0x0030, iwla000_2ac_cfg_hr_cdb)},
+ 	{IWL_PCI_DEVICE(0x2720, 0x1080, iwla000_2ax_cfg_hr)},
++	{IWL_PCI_DEVICE(0x2720, 0x0090, iwla000_2ac_cfg_hr_cdb)},
++	{IWL_PCI_DEVICE(0x2720, 0x0310, iwla000_2ac_cfg_hr_cdb)},
++	{IWL_PCI_DEVICE(0x40C0, 0x0000, iwla000_2ax_cfg_hr)},
++	{IWL_PCI_DEVICE(0x40C0, 0x0A10, iwla000_2ax_cfg_hr)},
++
+ #endif /* CONFIG_IWLMVM */
+ 
+ 	{0}
+diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
+index d5a3bf91a03e..ab6d39e12069 100644
+--- a/drivers/net/wireless/intersil/p54/main.c
++++ b/drivers/net/wireless/intersil/p54/main.c
+@@ -852,12 +852,11 @@ void p54_unregister_common(struct ieee80211_hw *dev)
+ {
+ 	struct p54_common *priv = dev->priv;
+ 
+-#ifdef CONFIG_P54_LEDS
+-	p54_unregister_leds(priv);
+-#endif /* CONFIG_P54_LEDS */
+-
+ 	if (priv->registered) {
+ 		priv->registered = false;
++#ifdef CONFIG_P54_LEDS
++		p54_unregister_leds(priv);
++#endif /* CONFIG_P54_LEDS */
+ 		ieee80211_unregister_hw(dev);
+ 	}
+ 
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+index e2f4f5778267..086aad22743d 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
+@@ -57,7 +57,7 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
+ 		if (status >= 0)
+ 			return 0;
+ 
+-		if (status == -ENODEV) {
++		if (status == -ENODEV || status == -ENOENT) {
+ 			/* Device has disappeared. */
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 			break;
+@@ -321,7 +321,7 @@ static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void *data)
+ 
+ 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+ 	if (status) {
+-		if (status == -ENODEV)
++		if (status == -ENODEV || status == -ENOENT)
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ 		rt2x00lib_dmadone(entry);
+@@ -410,7 +410,7 @@ static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
+ 
+ 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
+ 	if (status) {
+-		if (status == -ENODEV)
++		if (status == -ENODEV || status == -ENOENT)
+ 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+ 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+ 		rt2x00lib_dmadone(entry);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+index 7eae27f8e173..f9563ae301ad 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+@@ -682,7 +682,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ 	struct sk_buff *skb = NULL;
+-
++	bool rtstatus;
+ 	u32 totalpacketlen;
+ 	u8 u1rsvdpageloc[5] = { 0 };
+ 	bool b_dlok = false;
+@@ -768,7 +768,9 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ 	skb = dev_alloc_skb(totalpacketlen);
+ 	skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+ 
+-	b_dlok = true;
++	rtstatus = rtl_cmd_send_packet(hw, skb);
++	if (rtstatus)
++		b_dlok = true;
+ 
+ 	if (b_dlok) {
+ 		RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index 1d431d4bf6d2..9ac1511de7ba 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -1372,6 +1372,7 @@ static void _rtl8821ae_get_wakeup_reason(struct ieee80211_hw *hw)
+ 
+ 	ppsc->wakeup_reason = 0;
+ 
++	do_gettimeofday(&ts);
+ 	rtlhal->last_suspend_sec = ts.tv_sec;
+ 
+ 	switch (fw_reason) {
+diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
+index e0f0e3ce1a32..98466d762c8f 100644
+--- a/drivers/nvdimm/dimm.c
++++ b/drivers/nvdimm/dimm.c
+@@ -68,6 +68,7 @@ static int nvdimm_probe(struct device *dev)
+ 	rc = nd_label_reserve_dpa(ndd);
+ 	if (ndd->ns_current >= 0)
+ 		nvdimm_set_aliasing(dev);
++	nvdimm_clear_locked(dev);
+ 	nvdimm_bus_unlock(dev);
+ 
+ 	if (rc)
+diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
+index f0d1b7e5de01..5f1385b96b13 100644
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -200,6 +200,13 @@ void nvdimm_set_locked(struct device *dev)
+ 	set_bit(NDD_LOCKED, &nvdimm->flags);
+ }
+ 
++void nvdimm_clear_locked(struct device *dev)
++{
++	struct nvdimm *nvdimm = to_nvdimm(dev);
++
++	clear_bit(NDD_LOCKED, &nvdimm->flags);
++}
++
+ static void nvdimm_release(struct device *dev)
+ {
+ 	struct nvdimm *nvdimm = to_nvdimm(dev);
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 9c5f108910e3..de66c02f6140 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -1050,7 +1050,7 @@ static int init_labels(struct nd_mapping *nd_mapping, int num_labels)
+ 	nsindex = to_namespace_index(ndd, 0);
+ 	memset(nsindex, 0, ndd->nsarea.config_size);
+ 	for (i = 0; i < 2; i++) {
+-		int rc = nd_label_write_index(ndd, i, i*2, ND_NSINDEX_INIT);
++		int rc = nd_label_write_index(ndd, i, 3 - i, ND_NSINDEX_INIT);
+ 
+ 		if (rc)
+ 			return rc;
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 3e4d1e7998da..0af988739a06 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1620,7 +1620,7 @@ static umode_t namespace_visible(struct kobject *kobj,
+ 	if (a == &dev_attr_resource.attr) {
+ 		if (is_namespace_blk(dev))
+ 			return 0;
+-		return a->mode;
++		return 0400;
+ 	}
+ 
+ 	if (is_namespace_pmem(dev) || is_namespace_blk(dev)) {
+diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
+index 9c758a91372b..156be00e1f76 100644
+--- a/drivers/nvdimm/nd.h
++++ b/drivers/nvdimm/nd.h
+@@ -254,6 +254,7 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
+ 		unsigned int len);
+ void nvdimm_set_aliasing(struct device *dev);
+ void nvdimm_set_locked(struct device *dev);
++void nvdimm_clear_locked(struct device *dev);
+ struct nd_btt *to_nd_btt(struct device *dev);
+ 
+ struct nd_gen_sb {
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index 9576c444f0ab..65cc171c721d 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -282,8 +282,16 @@ static struct attribute *nd_pfn_attributes[] = {
+ 	NULL,
+ };
+ 
++static umode_t pfn_visible(struct kobject *kobj, struct attribute *a, int n)
++{
++	if (a == &dev_attr_resource.attr)
++		return 0400;
++	return a->mode;
++}
++
+ struct attribute_group nd_pfn_attribute_group = {
+ 	.attrs = nd_pfn_attributes,
++	.is_visible = pfn_visible,
+ };
+ 
+ static const struct attribute_group *nd_pfn_attribute_groups[] = {
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index 829d760f651c..abaf38c61220 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -562,8 +562,12 @@ static umode_t region_visible(struct kobject *kobj, struct attribute *a, int n)
+ 	if (!is_nd_pmem(dev) && a == &dev_attr_badblocks.attr)
+ 		return 0;
+ 
+-	if (!is_nd_pmem(dev) && a == &dev_attr_resource.attr)
+-		return 0;
++	if (a == &dev_attr_resource.attr) {
++		if (is_nd_pmem(dev))
++			return 0400;
++		else
++			return 0;
++	}
+ 
+ 	if (a == &dev_attr_deep_flush.attr) {
+ 		int has_flush = nvdimm_has_flush(nd_region);
+diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
+index 0fe3ea164ee5..04dac6a42c9f 100644
+--- a/drivers/pci/host/pci-hyperv.c
++++ b/drivers/pci/host/pci-hyperv.c
+@@ -879,7 +879,7 @@ static void hv_irq_unmask(struct irq_data *data)
+ 	int cpu;
+ 	u64 res;
+ 
+-	dest = irq_data_get_affinity_mask(data);
++	dest = irq_data_get_effective_affinity_mask(data);
+ 	pdev = msi_desc_to_pci_dev(msi_desc);
+ 	pbus = pdev->bus;
+ 	hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata);
+@@ -1042,6 +1042,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ 	struct hv_pci_dev *hpdev;
+ 	struct pci_bus *pbus;
+ 	struct pci_dev *pdev;
++	struct cpumask *dest;
+ 	struct compose_comp_ctxt comp;
+ 	struct tran_int_desc *int_desc;
+ 	struct {
+@@ -1056,6 +1057,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ 	int ret;
+ 
+ 	pdev = msi_desc_to_pci_dev(irq_data_get_msi_desc(data));
++	dest = irq_data_get_effective_affinity_mask(data);
+ 	pbus = pdev->bus;
+ 	hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata);
+ 	hpdev = get_pcichild_wslot(hbus, devfn_to_wslot(pdev->devfn));
+@@ -1081,14 +1083,14 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ 	switch (pci_protocol_version) {
+ 	case PCI_PROTOCOL_VERSION_1_1:
+ 		size = hv_compose_msi_req_v1(&ctxt.int_pkts.v1,
+-					irq_data_get_affinity_mask(data),
++					dest,
+ 					hpdev->desc.win_slot.slot,
+ 					cfg->vector);
+ 		break;
+ 
+ 	case PCI_PROTOCOL_VERSION_1_2:
+ 		size = hv_compose_msi_req_v2(&ctxt.int_pkts.v2,
+-					irq_data_get_affinity_mask(data),
++					dest,
+ 					hpdev->desc.win_slot.slot,
+ 					cfg->vector);
+ 		break;
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 83e4a892b14b..cae54f8320be 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -453,7 +453,7 @@ static void aspm_calc_l1ss_info(struct pcie_link_state *link,
+ 
+ 	/* Choose the greater of the two T_cmn_mode_rstr_time */
+ 	val1 = (upreg->l1ss_cap >> 8) & 0xFF;
+-	val2 = (upreg->l1ss_cap >> 8) & 0xFF;
++	val2 = (dwreg->l1ss_cap >> 8) & 0xFF;
+ 	if (val1 > val2)
+ 		link->l1ss.ctl1 |= val1 << 8;
+ 	else
+@@ -658,7 +658,7 @@ static void pcie_config_aspm_l1ss(struct pcie_link_state *link, u32 state)
+ 					0xFF00, link->l1ss.ctl1);
+ 
+ 		/* Program LTR L1.2 threshold in both ports */
+-		pci_clear_and_set_dword(parent,	dw_cap_ptr + PCI_L1SS_CTL1,
++		pci_clear_and_set_dword(parent,	up_cap_ptr + PCI_L1SS_CTL1,
+ 					0xE3FF0000, link->l1ss.ctl1);
+ 		pci_clear_and_set_dword(child, dw_cap_ptr + PCI_L1SS_CTL1,
+ 					0xE3FF0000, link->l1ss.ctl1);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 911b3b65c8b2..f66f9375177c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4212,17 +4212,32 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags)
+ #endif
+ }
+ 
++static bool pci_quirk_cavium_acs_match(struct pci_dev *dev)
++{
++	/*
++	 * Effectively selects all downstream ports for whole ThunderX 1
++	 * family by 0xf800 mask (which represents 8 SoCs), while the lower
++	 * bits of device ID are used to indicate which subdevice is used
++	 * within the SoC.
++	 */
++	return (pci_is_pcie(dev) &&
++		(pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) &&
++		((dev->device & 0xf800) == 0xa000));
++}
++
+ static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags)
+ {
+ 	/*
+-	 * Cavium devices matching this quirk do not perform peer-to-peer
+-	 * with other functions, allowing masking out these bits as if they
+-	 * were unimplemented in the ACS capability.
++	 * Cavium root ports don't advertise an ACS capability.  However,
++	 * the RTL internally implements similar protection as if ACS had
++	 * Request Redirection, Completion Redirection, Source Validation,
++	 * and Upstream Forwarding features enabled.  Assert that the
++	 * hardware implements and enables equivalent ACS functionality for
++	 * these flags.
+ 	 */
+-	acs_flags &= ~(PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
+-		       PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT);
++	acs_flags &= ~(PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_SV | PCI_ACS_UF);
+ 
+-	if (!((dev->device >= 0xa000) && (dev->device <= 0xa0ff)))
++	if (!pci_quirk_cavium_acs_match(dev))
+ 		return -ENOTTY;
+ 
+ 	return acs_flags ? 0 : 1;
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index c17677f494af..dc6519b2c53a 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -3134,7 +3134,8 @@ lpfc_txq_hw_show(struct device *dev, struct device_attribute *attr, char *buf)
+ 	struct lpfc_hba   *phba = ((struct lpfc_vport *) shost->hostdata)->phba;
+ 	struct lpfc_sli_ring *pring = lpfc_phba_elsring(phba);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", pring->txq_max);
++	return snprintf(buf, PAGE_SIZE, "%d\n",
++			pring ? pring->txq_max : 0);
+ }
+ 
+ static DEVICE_ATTR(txq_hw, S_IRUGO,
+@@ -3147,7 +3148,8 @@ lpfc_txcmplq_hw_show(struct device *dev, struct device_attribute *attr,
+ 	struct lpfc_hba   *phba = ((struct lpfc_vport *) shost->hostdata)->phba;
+ 	struct lpfc_sli_ring *pring = lpfc_phba_elsring(phba);
+ 
+-	return snprintf(buf, PAGE_SIZE, "%d\n", pring->txcmplq_max);
++	return snprintf(buf, PAGE_SIZE, "%d\n",
++			pring ? pring->txcmplq_max : 0);
+ }
+ 
+ static DEVICE_ATTR(txcmplq_hw, S_IRUGO,
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index fe9e1c079c20..d89816222b23 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -2911,7 +2911,7 @@ static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
+ 		}
+ 	}
+ 
+-	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer) {
++	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer || !pring) {
+ 		ret_val = -ENOMEM;
+ 		goto err_post_rxbufs_exit;
+ 	}
+@@ -5421,6 +5421,8 @@ lpfc_bsg_timeout(struct bsg_job *job)
+ 	struct lpfc_iocbq *check_iocb, *next_iocb;
+ 
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return -EIO;
+ 
+ 	/* if job's driver data is NULL, the command completed or is in the
+ 	 * the process of completing.  In this case, return status to request
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 468a66371de9..3ebf6ccba6e6 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -7430,6 +7430,8 @@ lpfc_els_timeout_handler(struct lpfc_vport *vport)
+ 	timeout = (uint32_t)(phba->fc_ratov << 1);
+ 
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return;
+ 
+ 	if ((phba->pport->load_flag & FC_UNLOADING))
+ 		return;
+@@ -9310,6 +9312,9 @@ void lpfc_fabric_abort_nport(struct lpfc_nodelist *ndlp)
+ 
+ 	pring = lpfc_phba_elsring(phba);
+ 
++	if (unlikely(!pring))
++		return;
++
+ 	spin_lock_irq(&phba->hbalock);
+ 	list_for_each_entry_safe(piocb, tmp_iocb, &phba->fabric_iocb_list,
+ 				 list) {
+@@ -9416,7 +9421,7 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 				rxid, 1);
+ 
+ 			/* Check if TXQ queue needs to be serviced */
+-			if (!(list_empty(&pring->txq)))
++			if (pring && !list_empty(&pring->txq))
+ 				lpfc_worker_wake_up(phba);
+ 			return;
+ 		}
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 20808349a80e..499df9d17339 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -3324,7 +3324,8 @@ lpfc_mbx_cmpl_read_topology(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ 
+ 	/* Unblock ELS traffic */
+ 	pring = lpfc_phba_elsring(phba);
+-	pring->flag &= ~LPFC_STOP_IOCB_EVENT;
++	if (pring)
++		pring->flag &= ~LPFC_STOP_IOCB_EVENT;
+ 
+ 	/* Check for error */
+ 	if (mb->mbxStatus) {
+@@ -5430,6 +5431,8 @@ lpfc_free_tx(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
+ 
+ 	psli = &phba->sli;
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return;
+ 
+ 	/* Error matching iocb on txq or txcmplq
+ 	 * First check the txq.
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 100bc4c8798d..6acf1bb1d320 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -11404,6 +11404,13 @@ lpfc_pci_remove_one_s4(struct pci_dev *pdev)
+ 	/* Remove FC host and then SCSI host with the physical port */
+ 	fc_remove_host(shost);
+ 	scsi_remove_host(shost);
++	/*
++	 * Bring down the SLI Layer. This step disables all interrupts,
++	 * clears the rings, discards all mailbox commands, and resets
++	 * the HBA FCoE function.
++	 */
++	lpfc_debugfs_terminate(vport);
++	lpfc_sli4_hba_unset(phba);
+ 
+ 	/* Perform ndlp cleanup on the physical port.  The nvme and nvmet
+ 	 * localports are destroyed after to cleanup all transport memory.
+@@ -11412,14 +11419,8 @@ lpfc_pci_remove_one_s4(struct pci_dev *pdev)
+ 	lpfc_nvmet_destroy_targetport(phba);
+ 	lpfc_nvme_destroy_localport(vport);
+ 
+-	/*
+-	 * Bring down the SLI Layer. This step disables all interrupts,
+-	 * clears the rings, discards all mailbox commands, and resets
+-	 * the HBA FCoE function.
+-	 */
+-	lpfc_debugfs_terminate(vport);
+-	lpfc_sli4_hba_unset(phba);
+ 
++	lpfc_stop_hba_timers(phba);
+ 	spin_lock_irq(&phba->hbalock);
+ 	list_del_init(&vport->listentry);
+ 	spin_unlock_irq(&phba->hbalock);
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index f3ad7cac355d..b6957d944b9a 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -216,7 +216,7 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
+ 	pring = lpfc_phba_elsring(phba);
+ 
+ 	/* In case of error recovery path, we might have a NULL pring here */
+-	if (!pring)
++	if (unlikely(!pring))
+ 		return;
+ 
+ 	/* Abort outstanding I/O on NPort <nlp_DID> */
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 0b7c1a49e203..3c5b054a56ac 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1138,9 +1138,14 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
+ #endif
+ 	if (error) {
+ 		lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
+-				"6025 Cannot register NVME targetport "
+-				"x%x\n", error);
++				"6025 Cannot register NVME targetport x%x: "
++				"portnm %llx nodenm %llx segs %d qs %d\n",
++				error,
++				pinfo.port_name, pinfo.node_name,
++				lpfc_tgttemplate.max_sgl_segments,
++				lpfc_tgttemplate.max_hw_queues);
+ 		phba->targetport = NULL;
++		phba->nvmet_support = 0;
+ 
+ 		lpfc_nvmet_cleanup_io_context(phba);
+ 
+@@ -1152,9 +1157,11 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
+ 		lpfc_printf_log(phba, KERN_INFO, LOG_NVME_DISC,
+ 				"6026 Registered NVME "
+ 				"targetport: %p, private %p "
+-				"portnm %llx nodenm %llx\n",
++				"portnm %llx nodenm %llx segs %d qs %d\n",
+ 				phba->targetport, tgtp,
+-				pinfo.port_name, pinfo.node_name);
++				pinfo.port_name, pinfo.node_name,
++				lpfc_tgttemplate.max_sgl_segments,
++				lpfc_tgttemplate.max_hw_queues);
+ 
+ 		atomic_set(&tgtp->rcv_ls_req_in, 0);
+ 		atomic_set(&tgtp->rcv_ls_req_out, 0);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 8b119f87b51d..455f3ce9fda9 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -9396,10 +9396,13 @@ lpfc_sli4_calc_ring(struct lpfc_hba *phba, struct lpfc_iocbq *piocb)
+ 			 * for abort iocb hba_wqidx should already
+ 			 * be setup based on what work queue we used.
+ 			 */
+-			if (!(piocb->iocb_flag & LPFC_USE_FCPWQIDX))
++			if (!(piocb->iocb_flag & LPFC_USE_FCPWQIDX)) {
+ 				piocb->hba_wqidx =
+ 					lpfc_sli4_scmd_to_wqidx_distr(phba,
+ 							      piocb->context1);
++				piocb->hba_wqidx = piocb->hba_wqidx %
++					phba->cfg_fcp_io_channel;
++			}
+ 			return phba->sli4_hba.fcp_wq[piocb->hba_wqidx]->pring;
+ 		} else {
+ 			if (unlikely(!phba->sli4_hba.oas_wq))
+@@ -10632,6 +10635,14 @@ lpfc_sli_issue_abort_iotag(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ 	    (cmdiocb->iocb_flag & LPFC_DRIVER_ABORTED) != 0)
+ 		return 0;
+ 
++	if (!pring) {
++		if (cmdiocb->iocb_flag & LPFC_IO_FABRIC)
++			cmdiocb->fabric_iocb_cmpl = lpfc_ignore_els_cmpl;
++		else
++			cmdiocb->iocb_cmpl = lpfc_ignore_els_cmpl;
++		goto abort_iotag_exit;
++	}
++
+ 	/*
+ 	 * If we're unloading, don't abort iocb on the ELS ring, but change
+ 	 * the callback so that nothing happens when it finishes.
+@@ -12500,6 +12511,8 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba,
+ 	unsigned long iflags;
+ 
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return NULL;
+ 
+ 	wcqe = &irspiocbq->cq_event.cqe.wcqe_cmpl;
+ 	spin_lock_irqsave(&pring->ring_lock, iflags);
+@@ -12507,19 +12520,21 @@ lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba,
+ 	/* Look up the ELS command IOCB and create pseudo response IOCB */
+ 	cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring,
+ 				bf_get(lpfc_wcqe_c_request_tag, wcqe));
+-	/* Put the iocb back on the txcmplq */
+-	lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq);
+-	spin_unlock_irqrestore(&pring->ring_lock, iflags);
+-
+ 	if (unlikely(!cmdiocbq)) {
++		spin_unlock_irqrestore(&pring->ring_lock, iflags);
+ 		lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+ 				"0386 ELS complete with no corresponding "
+-				"cmdiocb: iotag (%d)\n",
+-				bf_get(lpfc_wcqe_c_request_tag, wcqe));
++				"cmdiocb: 0x%x 0x%x 0x%x 0x%x\n",
++				wcqe->word0, wcqe->total_data_placed,
++				wcqe->parameter, wcqe->word3);
+ 		lpfc_sli_release_iocbq(phba, irspiocbq);
+ 		return NULL;
+ 	}
+ 
++	/* Put the iocb back on the txcmplq */
++	lpfc_sli_ringtxcmpl_put(phba, pring, cmdiocbq);
++	spin_unlock_irqrestore(&pring->ring_lock, iflags);
++
+ 	/* Fake the irspiocbq and copy necessary response information */
+ 	lpfc_sli4_iocb_param_transfer(phba, irspiocbq, cmdiocbq, wcqe);
+ 
+@@ -17137,7 +17152,8 @@ lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+ 	if (pcmd && pcmd->virt)
+ 		dma_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+ 	kfree(pcmd);
+-	lpfc_sli_release_iocbq(phba, iocbq);
++	if (iocbq)
++		lpfc_sli_release_iocbq(phba, iocbq);
+ 	lpfc_in_buf_free(phba, &dmabuf->dbuf);
+ }
+ 
+@@ -18691,6 +18707,8 @@ lpfc_drain_txq(struct lpfc_hba *phba)
+ 	uint32_t txq_cnt = 0;
+ 
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return 0;
+ 
+ 	spin_lock_irqsave(&pring->ring_lock, iflags);
+ 	list_for_each_entry(piocbq, &pring->txq, list) {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index dce42a416876..6eaaa326e508 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -388,7 +388,7 @@ static void qla_init_base_qpair(struct scsi_qla_host *vha, struct req_que *req,
+ 	INIT_LIST_HEAD(&ha->base_qpair->nvme_done_list);
+ 	ha->base_qpair->enable_class_2 = ql2xenableclass2;
+ 	/* init qpair to this cpu. Will adjust at run time. */
+-	qla_cpu_update(rsp->qpair, smp_processor_id());
++	qla_cpu_update(rsp->qpair, raw_smp_processor_id());
+ 	ha->base_qpair->pdev = ha->pdev;
+ 
+ 	if (IS_QLA27XX(ha) || IS_QLA83XX(ha))
+diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
+index 8aa54779aac1..2eb61d54bbb4 100644
+--- a/drivers/scsi/sd_zbc.c
++++ b/drivers/scsi/sd_zbc.c
+@@ -375,15 +375,15 @@ static int sd_zbc_read_zoned_characteristics(struct scsi_disk *sdkp,
+ 	if (sdkp->device->type != TYPE_ZBC) {
+ 		/* Host-aware */
+ 		sdkp->urswrz = 1;
+-		sdkp->zones_optimal_open = get_unaligned_be64(&buf[8]);
+-		sdkp->zones_optimal_nonseq = get_unaligned_be64(&buf[12]);
++		sdkp->zones_optimal_open = get_unaligned_be32(&buf[8]);
++		sdkp->zones_optimal_nonseq = get_unaligned_be32(&buf[12]);
+ 		sdkp->zones_max_open = 0;
+ 	} else {
+ 		/* Host-managed */
+ 		sdkp->urswrz = buf[4] & 1;
+ 		sdkp->zones_optimal_open = 0;
+ 		sdkp->zones_optimal_nonseq = 0;
+-		sdkp->zones_max_open = get_unaligned_be64(&buf[16]);
++		sdkp->zones_max_open = get_unaligned_be32(&buf[16]);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 5001261f5d69..d9ba4ee2c62b 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1960,7 +1960,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	struct iscsi_tmr_req *tmr_req;
+ 	struct iscsi_tm *hdr;
+ 	int out_of_order_cmdsn = 0, ret;
+-	bool sess_ref = false;
+ 	u8 function, tcm_function = TMR_UNKNOWN;
+ 
+ 	hdr			= (struct iscsi_tm *) buf;
+@@ -1993,22 +1992,23 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 
+ 	cmd->data_direction = DMA_NONE;
+ 	cmd->tmr_req = kzalloc(sizeof(*cmd->tmr_req), GFP_KERNEL);
+-	if (!cmd->tmr_req)
++	if (!cmd->tmr_req) {
+ 		return iscsit_add_reject_cmd(cmd,
+ 					     ISCSI_REASON_BOOKMARK_NO_RESOURCES,
+ 					     buf);
++	}
++
++	transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
++			      conn->sess->se_sess, 0, DMA_NONE,
++			      TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
++
++	target_get_sess_cmd(&cmd->se_cmd, true);
+ 
+ 	/*
+ 	 * TASK_REASSIGN for ERL=2 / connection stays inside of
+ 	 * LIO-Target $FABRIC_MOD
+ 	 */
+ 	if (function != ISCSI_TM_FUNC_TASK_REASSIGN) {
+-		transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops,
+-				      conn->sess->se_sess, 0, DMA_NONE,
+-				      TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
+-
+-		target_get_sess_cmd(&cmd->se_cmd, true);
+-		sess_ref = true;
+ 		tcm_function = iscsit_convert_tmf(function);
+ 		if (tcm_function == TMR_UNKNOWN) {
+ 			pr_err("Unknown iSCSI TMR Function:"
+@@ -2099,12 +2099,14 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 
+ 	if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+ 		int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn);
+-		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP)
++		if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) {
+ 			out_of_order_cmdsn = 1;
+-		else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP)
++		} else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
++			target_put_sess_cmd(&cmd->se_cmd);
+ 			return 0;
+-		else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
++		} else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
+ 			return -1;
++		}
+ 	}
+ 	iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
+ 
+@@ -2124,12 +2126,8 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * For connection recovery, this is also the default action for
+ 	 * TMR TASK_REASSIGN.
+ 	 */
+-	if (sess_ref) {
+-		pr_debug("Handle TMR, using sess_ref=true check\n");
+-		target_put_sess_cmd(&cmd->se_cmd);
+-	}
+-
+ 	iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
++	target_put_sess_cmd(&cmd->se_cmd);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(iscsit_handle_task_mgt_cmd);
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index dd2cd8048582..9f25c9c6f67d 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -4011,6 +4011,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
+ 		 * Set the ADDITIONAL DESCRIPTOR LENGTH
+ 		 */
+ 		put_unaligned_be32(desc_len, &buf[off]);
++		off += 4;
+ 		/*
+ 		 * Size of full desctipor header minus TransportID
+ 		 * containing $FABRIC_MOD specific) initiator device/port
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index e22847bd79b9..9c7bc1ca341a 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -133,6 +133,15 @@ static bool __target_check_io_state(struct se_cmd *se_cmd,
+ 		spin_unlock(&se_cmd->t_state_lock);
+ 		return false;
+ 	}
++	if (se_cmd->transport_state & CMD_T_PRE_EXECUTE) {
++		if (se_cmd->scsi_status) {
++			pr_debug("Attempted to abort io tag: %llu early failure"
++				 " status: 0x%02x\n", se_cmd->tag,
++				 se_cmd->scsi_status);
++			spin_unlock(&se_cmd->t_state_lock);
++			return false;
++		}
++	}
+ 	if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
+ 		pr_debug("Attempted to abort io tag: %llu already shutdown,"
+ 			" skipping\n", se_cmd->tag);
+@@ -217,7 +226,8 @@ static void core_tmr_drain_tmr_list(
+ 	 * LUN_RESET tmr..
+ 	 */
+ 	spin_lock_irqsave(&dev->se_tmr_lock, flags);
+-	list_del_init(&tmr->tmr_list);
++	if (tmr)
++		list_del_init(&tmr->tmr_list);
+ 	list_for_each_entry_safe(tmr_p, tmr_pp, &dev->dev_tmr_list, tmr_list) {
+ 		cmd = tmr_p->task_cmd;
+ 		if (!cmd) {
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 836d552b0385..e6d51135d105 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1730,9 +1730,6 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ {
+ 	int ret = 0, post_ret = 0;
+ 
+-	if (transport_check_aborted_status(cmd, 1))
+-		return;
+-
+ 	pr_debug("-----[ Storage Engine Exception; sense_reason %d\n",
+ 		 sense_reason);
+ 	target_show_cmd("-----[ ", cmd);
+@@ -1741,6 +1738,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ 	 * For SAM Task Attribute emulation for failed struct se_cmd
+ 	 */
+ 	transport_complete_task_attr(cmd);
++
+ 	/*
+ 	 * Handle special case for COMPARE_AND_WRITE failure, where the
+ 	 * callback is expected to drop the per device ->caw_sem.
+@@ -1749,6 +1747,9 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ 	     cmd->transport_complete_callback)
+ 		cmd->transport_complete_callback(cmd, false, &post_ret);
+ 
++	if (transport_check_aborted_status(cmd, 1))
++		return;
++
+ 	switch (sense_reason) {
+ 	case TCM_NON_EXISTENT_LUN:
+ 	case TCM_UNSUPPORTED_SCSI_OPCODE:
+@@ -1973,6 +1974,7 @@ void target_execute_cmd(struct se_cmd *cmd)
+ 	}
+ 
+ 	cmd->t_state = TRANSPORT_PROCESSING;
++	cmd->transport_state &= ~CMD_T_PRE_EXECUTE;
+ 	cmd->transport_state |= CMD_T_ACTIVE | CMD_T_SENT;
+ 	spin_unlock_irq(&cmd->t_state_lock);
+ 
+@@ -2010,6 +2012,8 @@ static void target_restart_delayed_cmds(struct se_device *dev)
+ 		list_del(&cmd->se_delayed_node);
+ 		spin_unlock(&dev->delayed_cmd_lock);
+ 
++		cmd->transport_state |= CMD_T_SENT;
++
+ 		__target_execute_cmd(cmd, true);
+ 
+ 		if (cmd->sam_task_attr == TCM_ORDERED_TAG)
+@@ -2045,6 +2049,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
+ 		pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
+ 			 dev->dev_cur_ordered_id);
+ 	}
++	cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET;
++
+ restart:
+ 	target_restart_delayed_cmds(dev);
+ }
+@@ -2570,7 +2576,20 @@ EXPORT_SYMBOL(transport_generic_new_cmd);
+ 
+ static void transport_write_pending_qf(struct se_cmd *cmd)
+ {
++	unsigned long flags;
+ 	int ret;
++	bool stop;
++
++	spin_lock_irqsave(&cmd->t_state_lock, flags);
++	stop = (cmd->transport_state & (CMD_T_STOP | CMD_T_ABORTED));
++	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
++
++	if (stop) {
++		pr_debug("%s:%d CMD_T_STOP|CMD_T_ABORTED for ITT: 0x%08llx\n",
++			__func__, __LINE__, cmd->tag);
++		complete_all(&cmd->t_transport_stop_comp);
++		return;
++	}
+ 
+ 	ret = cmd->se_tfo->write_pending(cmd);
+ 	if (ret) {
+@@ -2664,6 +2683,7 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ 		ret = -ESHUTDOWN;
+ 		goto out;
+ 	}
++	se_cmd->transport_state |= CMD_T_PRE_EXECUTE;
+ 	list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
+ out:
+ 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
+index c68fb3a8ea1c..97db76afced2 100644
+--- a/drivers/tty/serdev/core.c
++++ b/drivers/tty/serdev/core.c
+@@ -65,21 +65,32 @@ static int serdev_uevent(struct device *dev, struct kobj_uevent_env *env)
+  */
+ int serdev_device_add(struct serdev_device *serdev)
+ {
++	struct serdev_controller *ctrl = serdev->ctrl;
+ 	struct device *parent = serdev->dev.parent;
+ 	int err;
+ 
+ 	dev_set_name(&serdev->dev, "%s-%d", dev_name(parent), serdev->nr);
+ 
++	/* Only a single slave device is currently supported. */
++	if (ctrl->serdev) {
++		dev_err(&serdev->dev, "controller busy\n");
++		return -EBUSY;
++	}
++	ctrl->serdev = serdev;
++
+ 	err = device_add(&serdev->dev);
+ 	if (err < 0) {
+ 		dev_err(&serdev->dev, "Can't add %s, status %d\n",
+ 			dev_name(&serdev->dev), err);
+-		goto err_device_add;
++		goto err_clear_serdev;
+ 	}
+ 
+ 	dev_dbg(&serdev->dev, "device %s registered\n", dev_name(&serdev->dev));
+ 
+-err_device_add:
++	return 0;
++
++err_clear_serdev:
++	ctrl->serdev = NULL;
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(serdev_device_add);
+@@ -90,7 +101,10 @@ EXPORT_SYMBOL_GPL(serdev_device_add);
+  */
+ void serdev_device_remove(struct serdev_device *serdev)
+ {
++	struct serdev_controller *ctrl = serdev->ctrl;
++
+ 	device_unregister(&serdev->dev);
++	ctrl->serdev = NULL;
+ }
+ EXPORT_SYMBOL_GPL(serdev_device_remove);
+ 
+@@ -295,7 +309,6 @@ struct serdev_device *serdev_device_alloc(struct serdev_controller *ctrl)
+ 		return NULL;
+ 
+ 	serdev->ctrl = ctrl;
+-	ctrl->serdev = serdev;
+ 	device_initialize(&serdev->dev);
+ 	serdev->dev.parent = &ctrl->dev;
+ 	serdev->dev.bus = &serdev_bus_type;
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 046f6d280af5..e47c5bc3ddca 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -688,6 +688,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write,
+ 		      struct scatterlist *sg, int sg_count)
+ {
+ 	size_t off = iter->iov_offset;
++	struct scatterlist *p = sg;
+ 	int i, ret;
+ 
+ 	for (i = 0; i < iter->nr_segs; i++) {
+@@ -696,8 +697,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write,
+ 
+ 		ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write);
+ 		if (ret < 0) {
+-			for (i = 0; i < sg_count; i++) {
+-				struct page *page = sg_page(&sg[i]);
++			while (p < sg) {
++				struct page *page = sg_page(p++);
+ 				if (page)
+ 					put_page(page);
+ 			}
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 2a5de610dd8f..bdabb2765d1b 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode *inode, void *data)
+ 
+ 	if (v9inode->qid.type != st->qid.type)
+ 		return 0;
++
++	if (v9inode->qid.path != st->qid.path)
++		return 0;
+ 	return 1;
+ }
+ 
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 70f9887c59a9..7f6ae21a27b3 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct inode *inode, void *data)
+ 
+ 	if (v9inode->qid.type != st->qid.type)
+ 		return 0;
++
++	if (v9inode->qid.path != st->qid.path)
++		return 0;
+ 	return 1;
+ }
+ 
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 4ac49d038bf3..8fc41705c7cd 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -81,7 +81,8 @@ static int autofs4_write(struct autofs_sb_info *sbi,
+ 		spin_unlock_irqrestore(&current->sighand->siglock, flags);
+ 	}
+ 
+-	return (bytes > 0);
++	/* if 'wr' returned 0 (impossible) we assume -EIO (safe) */
++	return bytes == 0 ? 0 : wr < 0 ? wr : -EIO;
+ }
+ 
+ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+@@ -95,6 +96,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 	} pkt;
+ 	struct file *pipe = NULL;
+ 	size_t pktsz;
++	int ret;
+ 
+ 	pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n",
+ 		 (unsigned long) wq->wait_queue_token,
+@@ -169,7 +171,18 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 	mutex_unlock(&sbi->wq_mutex);
+ 
+ 	if (autofs4_write(sbi, pipe, &pkt, pktsz))
++	switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
++	case 0:
++		break;
++	case -ENOMEM:
++	case -ERESTARTSYS:
++		/* Just fail this one */
++		autofs4_wait_release(sbi, wq->wait_queue_token, ret);
++		break;
++	default:
+ 		autofs4_catatonic_mode(sbi);
++		break;
++	}
+ 	fput(pipe);
+ }
+ 
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e2d7e86b51d1..08698105fa4a 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4919,6 +4919,13 @@ static void shrink_delalloc(struct btrfs_fs_info *fs_info, u64 to_reclaim,
+ 	}
+ }
+ 
++struct reserve_ticket {
++	u64 bytes;
++	int error;
++	struct list_head list;
++	wait_queue_head_t wait;
++};
++
+ /**
+  * maybe_commit_transaction - possibly commit the transaction if its ok to
+  * @root - the root we're allocating for
+@@ -4930,18 +4937,29 @@ static void shrink_delalloc(struct btrfs_fs_info *fs_info, u64 to_reclaim,
+  * will return -ENOSPC.
+  */
+ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
+-				  struct btrfs_space_info *space_info,
+-				  u64 bytes, int force)
++				  struct btrfs_space_info *space_info)
+ {
++	struct reserve_ticket *ticket = NULL;
+ 	struct btrfs_block_rsv *delayed_rsv = &fs_info->delayed_block_rsv;
+ 	struct btrfs_trans_handle *trans;
++	u64 bytes;
+ 
+ 	trans = (struct btrfs_trans_handle *)current->journal_info;
+ 	if (trans)
+ 		return -EAGAIN;
+ 
+-	if (force)
+-		goto commit;
++	spin_lock(&space_info->lock);
++	if (!list_empty(&space_info->priority_tickets))
++		ticket = list_first_entry(&space_info->priority_tickets,
++					  struct reserve_ticket, list);
++	else if (!list_empty(&space_info->tickets))
++		ticket = list_first_entry(&space_info->tickets,
++					  struct reserve_ticket, list);
++	bytes = (ticket) ? ticket->bytes : 0;
++	spin_unlock(&space_info->lock);
++
++	if (!bytes)
++		return 0;
+ 
+ 	/* See if there is enough pinned space to make this reservation */
+ 	if (percpu_counter_compare(&space_info->total_bytes_pinned,
+@@ -4956,8 +4974,12 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
+ 		return -ENOSPC;
+ 
+ 	spin_lock(&delayed_rsv->lock);
++	if (delayed_rsv->size > bytes)
++		bytes = 0;
++	else
++		bytes -= delayed_rsv->size;
+ 	if (percpu_counter_compare(&space_info->total_bytes_pinned,
+-				   bytes - delayed_rsv->size) < 0) {
++				   bytes) < 0) {
+ 		spin_unlock(&delayed_rsv->lock);
+ 		return -ENOSPC;
+ 	}
+@@ -4971,13 +4993,6 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
+ 	return btrfs_commit_transaction(trans);
+ }
+ 
+-struct reserve_ticket {
+-	u64 bytes;
+-	int error;
+-	struct list_head list;
+-	wait_queue_head_t wait;
+-};
+-
+ /*
+  * Try to flush some data based on policy set by @state. This is only advisory
+  * and may fail for various reasons. The caller is supposed to examine the
+@@ -5027,8 +5042,7 @@ static void flush_space(struct btrfs_fs_info *fs_info,
+ 			ret = 0;
+ 		break;
+ 	case COMMIT_TRANS:
+-		ret = may_commit_transaction(fs_info, space_info,
+-					     num_bytes, 0);
++		ret = may_commit_transaction(fs_info, space_info);
+ 		break;
+ 	default:
+ 		ret = -ENOSPC;
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 170df856bdb9..b96f3b98a6ef 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -3055,8 +3055,16 @@ void guard_bio_eod(int op, struct bio *bio)
+ 	sector_t maxsector;
+ 	struct bio_vec *bvec = &bio->bi_io_vec[bio->bi_vcnt - 1];
+ 	unsigned truncated_bytes;
++	struct hd_struct *part;
++
++	rcu_read_lock();
++	part = __disk_get_part(bio->bi_disk, bio->bi_partno);
++	if (part)
++		maxsector = part_nr_sects_read(part);
++	else
++		maxsector = get_capacity(bio->bi_disk);
++	rcu_read_unlock();
+ 
+-	maxsector = get_capacity(bio->bi_disk);
+ 	if (!maxsector)
+ 		return;
+ 
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index c7835df7e7b8..d262a93d9b31 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -410,11 +410,8 @@ int fscrypt_initialize(unsigned int cop_flags)
+ {
+ 	int i, res = -ENOMEM;
+ 
+-	/*
+-	 * No need to allocate a bounce page pool if there already is one or
+-	 * this FS won't use it.
+-	 */
+-	if (cop_flags & FS_CFLG_OWN_PAGES || fscrypt_bounce_page_pool)
++	/* No need to allocate a bounce page pool if this FS won't use it. */
++	if (cop_flags & FS_CFLG_OWN_PAGES)
+ 		return 0;
+ 
+ 	mutex_lock(&fscrypt_init_mutex);
+diff --git a/fs/dax.c b/fs/dax.c
+index f001d8c72a06..191306cd8b6b 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1327,7 +1327,7 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf,
+ 	 * this is a reliable test.
+ 	 */
+ 	pgoff = linear_page_index(vma, pmd_addr);
+-	max_pgoff = (i_size_read(inode) - 1) >> PAGE_SHIFT;
++	max_pgoff = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
+ 
+ 	trace_dax_pmd_fault(inode, vmf, max_pgoff, 0);
+ 
+@@ -1351,13 +1351,13 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf,
+ 	if ((pmd_addr + PMD_SIZE) > vma->vm_end)
+ 		goto fallback;
+ 
+-	if (pgoff > max_pgoff) {
++	if (pgoff >= max_pgoff) {
+ 		result = VM_FAULT_SIGBUS;
+ 		goto out;
+ 	}
+ 
+ 	/* If the PMD would extend beyond the file size */
+-	if ((pgoff | PG_PMD_COLOUR) > max_pgoff)
++	if ((pgoff | PG_PMD_COLOUR) >= max_pgoff)
+ 		goto fallback;
+ 
+ 	/*
+diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
+index 286f10b0363b..4f457d5c4933 100644
+--- a/fs/ecryptfs/messaging.c
++++ b/fs/ecryptfs/messaging.c
+@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void)
+ 	}
+ 	if (ecryptfs_daemon_hash) {
+ 		struct ecryptfs_daemon *daemon;
++		struct hlist_node *n;
+ 		int i;
+ 
+ 		mutex_lock(&ecryptfs_daemon_hash_mux);
+ 		for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
+ 			int rc;
+ 
+-			hlist_for_each_entry(daemon,
+-					     &ecryptfs_daemon_hash[i],
+-					     euid_chain) {
++			hlist_for_each_entry_safe(daemon, n,
++						  &ecryptfs_daemon_hash[i],
++						  euid_chain) {
+ 				rc = ecryptfs_exorcise_daemon(daemon);
+ 				if (rc)
+ 					printk(KERN_ERR "%s: Error whilst "
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 97f0fd06728d..07bca11749d4 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4794,7 +4794,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
+ 	}
+ 
+ 	if (!(mode & FALLOC_FL_KEEP_SIZE) &&
+-	     offset + len > i_size_read(inode)) {
++	    (offset + len > i_size_read(inode) ||
++	     offset + len > EXT4_I(inode)->i_disksize)) {
+ 		new_size = offset + len;
+ 		ret = inode_newsize_ok(inode, new_size);
+ 		if (ret)
+@@ -4965,7 +4966,8 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 	}
+ 
+ 	if (!(mode & FALLOC_FL_KEEP_SIZE) &&
+-	     offset + len > i_size_read(inode)) {
++	    (offset + len > i_size_read(inode) ||
++	     offset + len > EXT4_I(inode)->i_disksize)) {
+ 		new_size = offset + len;
+ 		ret = inode_newsize_ok(inode, new_size);
+ 		if (ret)
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 28c5c3abddb3..fd9501977f1c 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -302,11 +302,6 @@ static int ext4_create_inline_data(handle_t *handle,
+ 	EXT4_I(inode)->i_inline_size = len + EXT4_MIN_INLINE_DATA_SIZE;
+ 	ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
+ 	ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
+-	/*
+-	 * Propagate changes to inode->i_flags as well - e.g. S_DAX may
+-	 * get cleared
+-	 */
+-	ext4_set_inode_flags(inode);
+ 	get_bh(is.iloc.bh);
+ 	error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
+ 
+@@ -451,11 +446,6 @@ static int ext4_destroy_inline_data_nolock(handle_t *handle,
+ 		}
+ 	}
+ 	ext4_clear_inode_flag(inode, EXT4_INODE_INLINE_DATA);
+-	/*
+-	 * Propagate changes to inode->i_flags as well - e.g. S_DAX may
+-	 * get set.
+-	 */
+-	ext4_set_inode_flags(inode);
+ 
+ 	get_bh(is.iloc.bh);
+ 	error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 90afeb7293a6..38eb621edd80 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5967,11 +5967,6 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
+ 		ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
+ 	}
+ 	ext4_set_aops(inode);
+-	/*
+-	 * Update inode->i_flags after EXT4_INODE_JOURNAL_DATA was updated.
+-	 * E.g. S_DAX may get cleared / set.
+-	 */
+-	ext4_set_inode_flags(inode);
+ 
+ 	jbd2_journal_unlock_updates(journal);
+ 	percpu_up_write(&sbi->s_journal_flag_rwsem);
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 75d83471f65c..d97f40396765 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -291,10 +291,20 @@ static int ext4_ioctl_setflags(struct inode *inode,
+ 	if (err)
+ 		goto flags_out;
+ 
+-	if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL))
++	if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
++		/*
++		 * Changes to the journaling mode can cause unsafe changes to
++		 * S_DAX if we are using the DAX mount option.
++		 */
++		if (test_opt(inode->i_sb, DAX)) {
++			err = -EBUSY;
++			goto flags_out;
++		}
++
+ 		err = ext4_change_inode_journal_flag(inode, jflag);
+-	if (err)
+-		goto flags_out;
++		if (err)
++			goto flags_out;
++	}
+ 	if (migrate) {
+ 		if (flags & EXT4_EXTENTS_FL)
+ 			err = ext4_ext_migrate(inode);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index b0915b734a38..f29351c66610 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3708,6 +3708,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 	}
+ 
+ 	if (sbi->s_mount_opt & EXT4_MOUNT_DAX) {
++		if (ext4_has_feature_inline_data(sb)) {
++			ext4_msg(sb, KERN_ERR, "Cannot use DAX on a filesystem"
++					" that may contain inline data");
++			goto failed_mount;
++		}
+ 		err = bdev_dax_supported(sb, blocksize);
+ 		if (err)
+ 			goto failed_mount;
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 517e112c8a9a..6ce467872376 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -683,6 +683,12 @@ int f2fs_getattr(const struct path *path, struct kstat *stat,
+ 				  STATX_ATTR_NODUMP);
+ 
+ 	generic_fillattr(inode, stat);
++
++	/* we need to show initial sectors used for inline_data/dentries */
++	if ((S_ISREG(inode->i_mode) && f2fs_has_inline_data(inode)) ||
++					f2fs_has_inline_dentry(inode))
++		stat->blocks += (stat->size + 511) >> 9;
++
+ 	return 0;
+ }
+ 
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 57d4c3e2e94a..8e42b4fbefdc 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -107,7 +107,7 @@ static inline unsigned int isonum_733(char *p)
+ 	/* Ignore bigendian datum due to broken mastering programs */
+ 	return get_unaligned_le32(p);
+ }
+-extern int iso_date(char *, int);
++extern int iso_date(u8 *, int);
+ 
+ struct inode;		/* To make gcc happy */
+ 
+diff --git a/fs/isofs/rock.h b/fs/isofs/rock.h
+index ef03625431bb..ac5cc587d718 100644
+--- a/fs/isofs/rock.h
++++ b/fs/isofs/rock.h
+@@ -66,7 +66,7 @@ struct RR_PL_s {
+ };
+ 
+ struct stamp {
+-	char time[7];
++	__u8 time[7];		/* actually 6 unsigned, 1 signed */
+ } __attribute__ ((packed));
+ 
+ struct RR_TF_s {
+diff --git a/fs/isofs/util.c b/fs/isofs/util.c
+index 42544bf0e222..e88dba721661 100644
+--- a/fs/isofs/util.c
++++ b/fs/isofs/util.c
+@@ -16,7 +16,7 @@
+  * to GMT.  Thus  we should always be correct.
+  */
+ 
+-int iso_date(char * p, int flag)
++int iso_date(u8 *p, int flag)
+ {
+ 	int year, month, day, hour, minute, second, tz;
+ 	int crtime;
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index b995bdc13976..f04ecfc7ece0 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -369,6 +369,7 @@ static int lockd_start_svc(struct svc_serv *serv)
+ 		printk(KERN_WARNING
+ 			"lockd_up: svc_rqst allocation failed, error=%d\n",
+ 			error);
++		lockd_unregister_notifiers();
+ 		goto out_rqst;
+ 	}
+ 
+@@ -459,13 +460,16 @@ int lockd_up(struct net *net)
+ 	}
+ 
+ 	error = lockd_up_net(serv, net);
+-	if (error < 0)
+-		goto err_net;
++	if (error < 0) {
++		lockd_unregister_notifiers();
++		goto err_put;
++	}
+ 
+ 	error = lockd_start_svc(serv);
+-	if (error < 0)
+-		goto err_start;
+-
++	if (error < 0) {
++		lockd_down_net(serv, net);
++		goto err_put;
++	}
+ 	nlmsvc_users++;
+ 	/*
+ 	 * Note: svc_serv structures have an initial use count of 1,
+@@ -476,12 +480,6 @@ int lockd_up(struct net *net)
+ err_create:
+ 	mutex_unlock(&nlmsvc_mutex);
+ 	return error;
+-
+-err_start:
+-	lockd_down_net(serv, net);
+-err_net:
+-	lockd_unregister_notifiers();
+-	goto err_put;
+ }
+ EXPORT_SYMBOL_GPL(lockd_up);
+ 
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 5ceaeb1f6fb6..b03b3bc05f96 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1241,8 +1241,7 @@ static int nfs_weak_revalidate(struct dentry *dentry, unsigned int flags)
+ 		return 0;
+ 	}
+ 
+-	if (nfs_mapping_need_revalidate_inode(inode))
+-		error = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
++	error = nfs_lookup_verify_inode(inode, flags);
+ 	dfprintk(LOOKUPCACHE, "NFS: %s: inode %lu is %s\n",
+ 			__func__, inode->i_ino, error ? "invalid" : "valid");
+ 	return !error;
+@@ -1393,6 +1392,7 @@ static int nfs4_lookup_revalidate(struct dentry *, unsigned int);
+ 
+ const struct dentry_operations nfs4_dentry_operations = {
+ 	.d_revalidate	= nfs4_lookup_revalidate,
++	.d_weak_revalidate	= nfs_weak_revalidate,
+ 	.d_delete	= nfs_dentry_delete,
+ 	.d_iput		= nfs_dentry_iput,
+ 	.d_automount	= nfs_d_automount,
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 0214dd1e1060..81cca49a8375 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -829,23 +829,9 @@ int nfs_flock(struct file *filp, int cmd, struct file_lock *fl)
+ 	if (NFS_SERVER(inode)->flags & NFS_MOUNT_LOCAL_FLOCK)
+ 		is_local = 1;
+ 
+-	/*
+-	 * VFS doesn't require the open mode to match a flock() lock's type.
+-	 * NFS, however, may simulate flock() locking with posix locking which
+-	 * requires the open mode to match the lock type.
+-	 */
+-	switch (fl->fl_type) {
+-	case F_UNLCK:
++	/* We're simulating flock() locks using posix locks on the server */
++	if (fl->fl_type == F_UNLCK)
+ 		return do_unlk(filp, cmd, fl, is_local);
+-	case F_RDLCK:
+-		if (!(filp->f_mode & FMODE_READ))
+-			return -EBADF;
+-		break;
+-	case F_WRLCK:
+-		if (!(filp->f_mode & FMODE_WRITE))
+-			return -EBADF;
+-	}
+-
+ 	return do_setlk(filp, cmd, fl, is_local);
+ }
+ EXPORT_SYMBOL_GPL(nfs_flock);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f90090e8c959..2241d52710f7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -254,15 +254,12 @@ const u32 nfs4_fsinfo_bitmap[3] = { FATTR4_WORD0_MAXFILESIZE
+ };
+ 
+ const u32 nfs4_fs_locations_bitmap[3] = {
+-	FATTR4_WORD0_TYPE
+-	| FATTR4_WORD0_CHANGE
++	FATTR4_WORD0_CHANGE
+ 	| FATTR4_WORD0_SIZE
+ 	| FATTR4_WORD0_FSID
+ 	| FATTR4_WORD0_FILEID
+ 	| FATTR4_WORD0_FS_LOCATIONS,
+-	FATTR4_WORD1_MODE
+-	| FATTR4_WORD1_NUMLINKS
+-	| FATTR4_WORD1_OWNER
++	FATTR4_WORD1_OWNER
+ 	| FATTR4_WORD1_OWNER_GROUP
+ 	| FATTR4_WORD1_RAWDEV
+ 	| FATTR4_WORD1_SPACE_USED
+@@ -6568,6 +6565,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
+ 	    !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
+ 		return -ENOLCK;
+ 
++	/*
++	 * Don't rely on the VFS having checked the file open mode,
++	 * since it won't do this for flock() locks.
++	 */
++	switch (request->fl_type) {
++	case F_RDLCK:
++		if (!(filp->f_mode & FMODE_READ))
++			return -EBADF;
++		break;
++	case F_WRLCK:
++		if (!(filp->f_mode & FMODE_WRITE))
++			return -EBADF;
++	}
++
+ 	status = nfs4_set_lock_state(state, request);
+ 	if (status != 0)
+ 		return status;
+@@ -6763,9 +6774,7 @@ static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+ 				   struct page *page)
+ {
+ 	struct nfs_server *server = NFS_SERVER(dir);
+-	u32 bitmask[3] = {
+-		[0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS,
+-	};
++	u32 bitmask[3];
+ 	struct nfs4_fs_locations_arg args = {
+ 		.dir_fh = NFS_FH(dir),
+ 		.name = name,
+@@ -6784,12 +6793,15 @@ static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+ 
+ 	dprintk("%s: start\n", __func__);
+ 
++	bitmask[0] = nfs4_fattr_bitmap[0] | FATTR4_WORD0_FS_LOCATIONS;
++	bitmask[1] = nfs4_fattr_bitmap[1];
++
+ 	/* Ask for the fileid of the absent filesystem if mounted_on_fileid
+ 	 * is not supported */
+ 	if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
+-		bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
++		bitmask[0] &= ~FATTR4_WORD0_FILEID;
+ 	else
+-		bitmask[0] |= FATTR4_WORD0_FILEID;
++		bitmask[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
+ 
+ 	nfs_fattr_init(&fs_locations->fattr);
+ 	fs_locations->server = server;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index e7c6275519b0..71d2ca04a9f8 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -202,17 +202,13 @@ DECLARE_EVENT_CLASS(nfs4_clientid_event,
+ 		TP_ARGS(clp, error),
+ 
+ 		TP_STRUCT__entry(
+-			__string(dstaddr,
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-					RPC_DISPLAY_ADDR))
++			__string(dstaddr, clp->cl_hostname)
+ 			__field(int, error)
+ 		),
+ 
+ 		TP_fast_assign(
+ 			__entry->error = error;
+-			__assign_str(dstaddr,
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-						RPC_DISPLAY_ADDR));
++			__assign_str(dstaddr, clp->cl_hostname);
+ 		),
+ 
+ 		TP_printk(
+@@ -1133,9 +1129,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_callback_event,
+ 			__field(dev_t, dev)
+ 			__field(u32, fhandle)
+ 			__field(u64, fileid)
+-			__string(dstaddr, clp ?
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-					RPC_DISPLAY_ADDR) : "unknown")
++			__string(dstaddr, clp ? clp->cl_hostname : "unknown")
+ 		),
+ 
+ 		TP_fast_assign(
+@@ -1148,9 +1142,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_callback_event,
+ 				__entry->fileid = 0;
+ 				__entry->dev = 0;
+ 			}
+-			__assign_str(dstaddr, clp ?
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-					RPC_DISPLAY_ADDR) : "unknown")
++			__assign_str(dstaddr, clp ? clp->cl_hostname : "unknown")
+ 		),
+ 
+ 		TP_printk(
+@@ -1192,9 +1184,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_callback_event,
+ 			__field(dev_t, dev)
+ 			__field(u32, fhandle)
+ 			__field(u64, fileid)
+-			__string(dstaddr, clp ?
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-					RPC_DISPLAY_ADDR) : "unknown")
++			__string(dstaddr, clp ? clp->cl_hostname : "unknown")
+ 			__field(int, stateid_seq)
+ 			__field(u32, stateid_hash)
+ 		),
+@@ -1209,9 +1199,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_callback_event,
+ 				__entry->fileid = 0;
+ 				__entry->dev = 0;
+ 			}
+-			__assign_str(dstaddr, clp ?
+-				rpc_peeraddr2str(clp->cl_rpcclient,
+-					RPC_DISPLAY_ADDR) : "unknown")
++			__assign_str(dstaddr, clp ? clp->cl_hostname : "unknown")
+ 			__entry->stateid_seq =
+ 				be32_to_cpu(stateid->seqid);
+ 			__entry->stateid_hash =
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index c9d24bae3025..216f67d628b3 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1332,7 +1332,7 @@ static int nfs_parse_mount_options(char *raw,
+ 			mnt->options |= NFS_OPTION_MIGRATION;
+ 			break;
+ 		case Opt_nomigration:
+-			mnt->options &= NFS_OPTION_MIGRATION;
++			mnt->options &= ~NFS_OPTION_MIGRATION;
+ 			break;
+ 
+ 		/*
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 0c04f81aa63b..d386d569edbc 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3966,7 +3966,8 @@ static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, statei
+ {
+ 	struct nfs4_stid *ret;
+ 
+-	ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
++	ret = find_stateid_by_type(cl, s,
++				NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
+ 	if (!ret)
+ 		return NULL;
+ 	return delegstateid(ret);
+@@ -3989,6 +3990,12 @@ nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
+ 	deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
+ 	if (deleg == NULL)
+ 		goto out;
++	if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
++		nfs4_put_stid(&deleg->dl_stid);
++		if (cl->cl_minorversion)
++			status = nfserr_deleg_revoked;
++		goto out;
++	}
+ 	flags = share_access_to_flags(open->op_share_access);
+ 	status = nfs4_check_delegmode(deleg, flags);
+ 	if (status) {
+@@ -4858,6 +4865,16 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
+ 		     struct nfs4_stid **s, struct nfsd_net *nn)
+ {
+ 	__be32 status;
++	bool return_revoked = false;
++
++	/*
++	 *  only return revoked delegations if explicitly asked.
++	 *  otherwise we report revoked or bad_stateid status.
++	 */
++	if (typemask & NFS4_REVOKED_DELEG_STID)
++		return_revoked = true;
++	else if (typemask & NFS4_DELEG_STID)
++		typemask |= NFS4_REVOKED_DELEG_STID;
+ 
+ 	if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
+ 		return nfserr_bad_stateid;
+@@ -4872,6 +4889,12 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
+ 	*s = find_stateid_by_type(cstate->clp, stateid, typemask);
+ 	if (!*s)
+ 		return nfserr_bad_stateid;
++	if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
++		nfs4_put_stid(*s);
++		if (cstate->minorversion)
++			return nfserr_deleg_revoked;
++		return nfserr_bad_stateid;
++	}
+ 	return nfs_ok;
+ }
+ 
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 70ded52dc1dd..50e12956c737 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -1958,8 +1958,6 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
+ 					  err, ii->vfs_inode.i_ino);
+ 				return err;
+ 			}
+-			mark_buffer_dirty(ibh);
+-			nilfs_mdt_mark_dirty(ifile);
+ 			spin_lock(&nilfs->ns_inode_lock);
+ 			if (likely(!ii->i_bh))
+ 				ii->i_bh = ibh;
+@@ -1968,6 +1966,10 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
+ 			goto retry;
+ 		}
+ 
++		// Always redirty the buffer to avoid race condition
++		mark_buffer_dirty(ii->i_bh);
++		nilfs_mdt_mark_dirty(ifile);
++
+ 		clear_bit(NILFS_I_QUEUED, &ii->i_state);
+ 		set_bit(NILFS_I_BUSY, &ii->i_state);
+ 		list_move_tail(&ii->i_dirty, &sci->sc_dirty_files);
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index 09640b546363..3c7053207297 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -65,19 +65,8 @@ static int fanotify_get_response(struct fsnotify_group *group,
+ 
+ 	pr_debug("%s: group=%p event=%p\n", __func__, group, event);
+ 
+-	/*
+-	 * fsnotify_prepare_user_wait() fails if we race with mark deletion.
+-	 * Just let the operation pass in that case.
+-	 */
+-	if (!fsnotify_prepare_user_wait(iter_info)) {
+-		event->response = FAN_ALLOW;
+-		goto out;
+-	}
+-
+ 	wait_event(group->fanotify_data.access_waitq, event->response);
+ 
+-	fsnotify_finish_user_wait(iter_info);
+-out:
+ 	/* userspace responded, convert to something usable */
+ 	switch (event->response) {
+ 	case FAN_ALLOW:
+@@ -212,9 +201,21 @@ static int fanotify_handle_event(struct fsnotify_group *group,
+ 	pr_debug("%s: group=%p inode=%p mask=%x\n", __func__, group, inode,
+ 		 mask);
+ 
++#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
++	if (mask & FAN_ALL_PERM_EVENTS) {
++		/*
++		 * fsnotify_prepare_user_wait() fails if we race with mark
++		 * deletion.  Just let the operation pass in that case.
++		 */
++		if (!fsnotify_prepare_user_wait(iter_info))
++			return 0;
++	}
++#endif
++
+ 	event = fanotify_alloc_event(inode, mask, data);
++	ret = -ENOMEM;
+ 	if (unlikely(!event))
+-		return -ENOMEM;
++		goto finish;
+ 
+ 	fsn_event = &event->fse;
+ 	ret = fsnotify_add_event(group, fsn_event, fanotify_merge);
+@@ -224,7 +225,8 @@ static int fanotify_handle_event(struct fsnotify_group *group,
+ 		/* Our event wasn't used in the end. Free it. */
+ 		fsnotify_destroy_event(group, fsn_event);
+ 
+-		return 0;
++		ret = 0;
++		goto finish;
+ 	}
+ 
+ #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+@@ -233,6 +235,11 @@ static int fanotify_handle_event(struct fsnotify_group *group,
+ 					    iter_info);
+ 		fsnotify_destroy_event(group, fsn_event);
+ 	}
++finish:
++	if (mask & FAN_ALL_PERM_EVENTS)
++		fsnotify_finish_user_wait(iter_info);
++#else
++finish:
+ #endif
+ 	return ret;
+ }
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 0c4583b61717..074716293829 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -335,6 +335,13 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
+ 						    struct fsnotify_mark, obj_list);
+ 			vfsmount_group = vfsmount_mark->group;
+ 		}
++		/*
++		 * Need to protect both marks against freeing so that we can
++		 * continue iteration from this place, regardless of which mark
++		 * we actually happen to send an event for.
++		 */
++		iter_info.inode_mark = inode_mark;
++		iter_info.vfsmount_mark = vfsmount_mark;
+ 
+ 		if (inode_group && vfsmount_group) {
+ 			int cmp = fsnotify_compare_groups(inode_group,
+@@ -348,9 +355,6 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
+ 			}
+ 		}
+ 
+-		iter_info.inode_mark = inode_mark;
+-		iter_info.vfsmount_mark = vfsmount_mark;
+-
+ 		ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask,
+ 				    data, data_is, cookie, file_name,
+ 				    &iter_info);
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 9991f8826734..258d99087183 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -109,16 +109,6 @@ void fsnotify_get_mark(struct fsnotify_mark *mark)
+ 	atomic_inc(&mark->refcnt);
+ }
+ 
+-/*
+- * Get mark reference when we found the mark via lockless traversal of object
+- * list. Mark can be already removed from the list by now and on its way to be
+- * destroyed once SRCU period ends.
+- */
+-static bool fsnotify_get_mark_safe(struct fsnotify_mark *mark)
+-{
+-	return atomic_inc_not_zero(&mark->refcnt);
+-}
+-
+ static void __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)
+ {
+ 	u32 new_mask = 0;
+@@ -256,32 +246,60 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ 			   FSNOTIFY_REAPER_DELAY);
+ }
+ 
+-bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info)
++/*
++ * Get mark reference when we found the mark via lockless traversal of object
++ * list. Mark can be already removed from the list by now and on its way to be
++ * destroyed once SRCU period ends.
++ *
++ * Also pin the group so it doesn't disappear under us.
++ */
++static bool fsnotify_get_mark_safe(struct fsnotify_mark *mark)
+ {
+-	struct fsnotify_group *group;
+-
+-	if (WARN_ON_ONCE(!iter_info->inode_mark && !iter_info->vfsmount_mark))
+-		return false;
+-
+-	if (iter_info->inode_mark)
+-		group = iter_info->inode_mark->group;
+-	else
+-		group = iter_info->vfsmount_mark->group;
++	if (!mark)
++		return true;
++
++	if (atomic_inc_not_zero(&mark->refcnt)) {
++		spin_lock(&mark->lock);
++		if (mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED) {
++			/* mark is attached, group is still alive then */
++			atomic_inc(&mark->group->user_waits);
++			spin_unlock(&mark->lock);
++			return true;
++		}
++		spin_unlock(&mark->lock);
++		fsnotify_put_mark(mark);
++	}
++	return false;
++}
+ 
+-	/*
+-	 * Since acquisition of mark reference is an atomic op as well, we can
+-	 * be sure this inc is seen before any effect of refcount increment.
+-	 */
+-	atomic_inc(&group->user_waits);
++/*
++ * Puts marks and wakes up group destruction if necessary.
++ *
++ * Pairs with fsnotify_get_mark_safe()
++ */
++static void fsnotify_put_mark_wake(struct fsnotify_mark *mark)
++{
++	if (mark) {
++		struct fsnotify_group *group = mark->group;
+ 
+-	if (iter_info->inode_mark) {
+-		/* This can fail if mark is being removed */
+-		if (!fsnotify_get_mark_safe(iter_info->inode_mark))
+-			goto out_wait;
++		fsnotify_put_mark(mark);
++		/*
++		 * We abuse notification_waitq on group shutdown for waiting for
++		 * all marks pinned when waiting for userspace.
++		 */
++		if (atomic_dec_and_test(&group->user_waits) && group->shutdown)
++			wake_up(&group->notification_waitq);
+ 	}
+-	if (iter_info->vfsmount_mark) {
+-		if (!fsnotify_get_mark_safe(iter_info->vfsmount_mark))
+-			goto out_inode;
++}
++
++bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info)
++{
++	/* This can fail if mark is being removed */
++	if (!fsnotify_get_mark_safe(iter_info->inode_mark))
++		return false;
++	if (!fsnotify_get_mark_safe(iter_info->vfsmount_mark)) {
++		fsnotify_put_mark_wake(iter_info->inode_mark);
++		return false;
+ 	}
+ 
+ 	/*
+@@ -292,34 +310,13 @@ bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info)
+ 	srcu_read_unlock(&fsnotify_mark_srcu, iter_info->srcu_idx);
+ 
+ 	return true;
+-out_inode:
+-	if (iter_info->inode_mark)
+-		fsnotify_put_mark(iter_info->inode_mark);
+-out_wait:
+-	if (atomic_dec_and_test(&group->user_waits) && group->shutdown)
+-		wake_up(&group->notification_waitq);
+-	return false;
+ }
+ 
+ void fsnotify_finish_user_wait(struct fsnotify_iter_info *iter_info)
+ {
+-	struct fsnotify_group *group = NULL;
+-
+ 	iter_info->srcu_idx = srcu_read_lock(&fsnotify_mark_srcu);
+-	if (iter_info->inode_mark) {
+-		group = iter_info->inode_mark->group;
+-		fsnotify_put_mark(iter_info->inode_mark);
+-	}
+-	if (iter_info->vfsmount_mark) {
+-		group = iter_info->vfsmount_mark->group;
+-		fsnotify_put_mark(iter_info->vfsmount_mark);
+-	}
+-	/*
+-	 * We abuse notification_waitq on group shutdown for waiting for all
+-	 * marks pinned when waiting for userspace.
+-	 */
+-	if (atomic_dec_and_test(&group->user_waits) && group->shutdown)
+-		wake_up(&group->notification_waitq);
++	fsnotify_put_mark_wake(iter_info->inode_mark);
++	fsnotify_put_mark_wake(iter_info->vfsmount_mark);
+ }
+ 
+ /*
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index a12dc10bf726..bc6d5c5a3443 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -630,7 +630,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+ 			err = ovl_check_origin(upperdentry, roe->lowerstack,
+ 					       roe->numlower, &stack, &ctr);
+ 			if (err)
+-				goto out;
++				goto out_put_upper;
+ 		}
+ 
+ 		if (d.redirect) {
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 44790523057f..5ade8f2a6987 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -243,6 +243,7 @@ static inline dev_t part_devt(struct hd_struct *part)
+ 	return part_to_dev(part)->devt;
+ }
+ 
++extern struct hd_struct *__disk_get_part(struct gendisk *disk, int partno);
+ extern struct hd_struct *disk_get_part(struct gendisk *disk, int partno);
+ 
+ static inline void disk_put_part(struct hd_struct *part)
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 4536286cc4d2..0d53626405bf 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -211,6 +211,7 @@ struct irq_data {
+  * IRQD_MANAGED_SHUTDOWN	- Interrupt was shutdown due to empty affinity
+  *				  mask. Applies only to affinity managed irqs.
+  * IRQD_SINGLE_TARGET		- IRQ allows only a single affinity target
++ * IRQD_DEFAULT_TRIGGER_SET	- Expected trigger already been set
+  */
+ enum {
+ 	IRQD_TRIGGER_MASK		= 0xf,
+@@ -231,6 +232,7 @@ enum {
+ 	IRQD_IRQ_STARTED		= (1 << 22),
+ 	IRQD_MANAGED_SHUTDOWN		= (1 << 23),
+ 	IRQD_SINGLE_TARGET		= (1 << 24),
++	IRQD_DEFAULT_TRIGGER_SET	= (1 << 25),
+ };
+ 
+ #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
+@@ -260,18 +262,25 @@ static inline void irqd_mark_affinity_was_set(struct irq_data *d)
+ 	__irqd_to_state(d) |= IRQD_AFFINITY_SET;
+ }
+ 
++static inline bool irqd_trigger_type_was_set(struct irq_data *d)
++{
++	return __irqd_to_state(d) & IRQD_DEFAULT_TRIGGER_SET;
++}
++
+ static inline u32 irqd_get_trigger_type(struct irq_data *d)
+ {
+ 	return __irqd_to_state(d) & IRQD_TRIGGER_MASK;
+ }
+ 
+ /*
+- * Must only be called inside irq_chip.irq_set_type() functions.
++ * Must only be called inside irq_chip.irq_set_type() functions or
++ * from the DT/ACPI setup code.
+  */
+ static inline void irqd_set_trigger_type(struct irq_data *d, u32 type)
+ {
+ 	__irqd_to_state(d) &= ~IRQD_TRIGGER_MASK;
+ 	__irqd_to_state(d) |= type & IRQD_TRIGGER_MASK;
++	__irqd_to_state(d) |= IRQD_DEFAULT_TRIGGER_SET;
+ }
+ 
+ static inline bool irqd_is_level_type(struct irq_data *d)
+diff --git a/include/net/tls.h b/include/net/tls.h
+index b89d397dd62f..c06db1eadac2 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -35,6 +35,10 @@
+ #define _TLS_OFFLOAD_H
+ 
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <linux/socket.h>
++#include <linux/tcp.h>
++#include <net/tcp.h>
+ 
+ #include <uapi/linux/tls.h>
+ 
+diff --git a/include/sound/control.h b/include/sound/control.h
+index a1f1152bc687..ca13a44ae9d4 100644
+--- a/include/sound/control.h
++++ b/include/sound/control.h
+@@ -249,7 +249,9 @@ int snd_ctl_add_vmaster_hook(struct snd_kcontrol *kctl,
+ void snd_ctl_sync_vmaster(struct snd_kcontrol *kctl, bool hook_only);
+ #define snd_ctl_sync_vmaster_hook(kctl)	snd_ctl_sync_vmaster(kctl, true)
+ int snd_ctl_apply_vmaster_slaves(struct snd_kcontrol *kctl,
+-				 int (*func)(struct snd_kcontrol *, void *),
++				 int (*func)(struct snd_kcontrol *vslave,
++					     struct snd_kcontrol *slave,
++					     void *arg),
+ 				 void *arg);
+ 
+ /*
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index f5db145e68ec..0d924e968c94 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -490,6 +490,7 @@ struct se_cmd {
+ #define CMD_T_STOP		(1 << 5)
+ #define CMD_T_TAS		(1 << 10)
+ #define CMD_T_FABRIC_STOP	(1 << 11)
++#define CMD_T_PRE_EXECUTE	(1 << 12)
+ 	spinlock_t		t_state_lock;
+ 	struct kref		cmd_kref;
+ 	struct completion	t_transport_stop_comp;
+diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
+index 25a7739514cd..3868b4752324 100644
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -456,20 +456,22 @@ TRACE_EVENT(svc_recv,
+ 	TP_ARGS(rqst, status),
+ 
+ 	TP_STRUCT__entry(
+-		__field(struct sockaddr *, addr)
+ 		__field(__be32, xid)
+ 		__field(int, status)
+ 		__field(unsigned long, flags)
++		__dynamic_array(unsigned char, addr, rqst->rq_addrlen)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__entry->addr = (struct sockaddr *)&rqst->rq_addr;
+ 		__entry->xid = status > 0 ? rqst->rq_xid : 0;
+ 		__entry->status = status;
+ 		__entry->flags = rqst->rq_flags;
++		memcpy(__get_dynamic_array(addr),
++			&rqst->rq_addr, rqst->rq_addrlen);
+ 	),
+ 
+-	TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s", __entry->addr,
++	TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s",
++			(struct sockaddr *)__get_dynamic_array(addr),
+ 			be32_to_cpu(__entry->xid), __entry->status,
+ 			show_rqstp_flags(__entry->flags))
+ );
+@@ -514,22 +516,23 @@ DECLARE_EVENT_CLASS(svc_rqst_status,
+ 	TP_ARGS(rqst, status),
+ 
+ 	TP_STRUCT__entry(
+-		__field(struct sockaddr *, addr)
+ 		__field(__be32, xid)
+-		__field(int, dropme)
+ 		__field(int, status)
+ 		__field(unsigned long, flags)
++		__dynamic_array(unsigned char, addr, rqst->rq_addrlen)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__entry->addr = (struct sockaddr *)&rqst->rq_addr;
+ 		__entry->xid = rqst->rq_xid;
+ 		__entry->status = status;
+ 		__entry->flags = rqst->rq_flags;
++		memcpy(__get_dynamic_array(addr),
++			&rqst->rq_addr, rqst->rq_addrlen);
+ 	),
+ 
+ 	TP_printk("addr=%pIScp rq_xid=0x%x status=%d flags=%s",
+-		__entry->addr, be32_to_cpu(__entry->xid),
++		(struct sockaddr *)__get_dynamic_array(addr),
++		be32_to_cpu(__entry->xid),
+ 		__entry->status, show_rqstp_flags(__entry->flags))
+ );
+ 
+diff --git a/include/uapi/linux/rxrpc.h b/include/uapi/linux/rxrpc.h
+index 9656aad8f8f7..9d4afea308a4 100644
+--- a/include/uapi/linux/rxrpc.h
++++ b/include/uapi/linux/rxrpc.h
+@@ -20,12 +20,12 @@
+  * RxRPC socket address
+  */
+ struct sockaddr_rxrpc {
+-	sa_family_t	srx_family;	/* address family */
+-	u16		srx_service;	/* service desired */
+-	u16		transport_type;	/* type of transport socket (SOCK_DGRAM) */
+-	u16		transport_len;	/* length of transport address */
++	__kernel_sa_family_t	srx_family;	/* address family */
++	__u16			srx_service;	/* service desired */
++	__u16			transport_type;	/* type of transport socket (SOCK_DGRAM) */
++	__u16			transport_len;	/* length of transport address */
+ 	union {
+-		sa_family_t family;		/* transport address family */
++		__kernel_sa_family_t family;	/* transport address family */
+ 		struct sockaddr_in sin;		/* IPv4 transport address */
+ 		struct sockaddr_in6 sin6;	/* IPv6 transport address */
+ 	} transport;
+diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h
+index d5e0682ab837..293b2cdad88d 100644
+--- a/include/uapi/linux/tls.h
++++ b/include/uapi/linux/tls.h
+@@ -35,10 +35,6 @@
+ #define _UAPI_LINUX_TLS_H
+ 
+ #include <linux/types.h>
+-#include <asm/byteorder.h>
+-#include <linux/socket.h>
+-#include <linux/tcp.h>
+-#include <net/tcp.h>
+ 
+ /* TLS socket options */
+ #define TLS_TX			1	/* Set transmit parameters */
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 4bff6a10ae8e..b02caa442776 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1245,7 +1245,18 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+ 		 * set the trigger type must match. Also all must
+ 		 * agree on ONESHOT.
+ 		 */
+-		unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data);
++		unsigned int oldtype;
++
++		/*
++		 * If nobody did set the configuration before, inherit
++		 * the one provided by the requester.
++		 */
++		if (irqd_trigger_type_was_set(&desc->irq_data)) {
++			oldtype = irqd_get_trigger_type(&desc->irq_data);
++		} else {
++			oldtype = new->flags & IRQF_TRIGGER_MASK;
++			irqd_set_trigger_type(&desc->irq_data, oldtype);
++		}
+ 
+ 		if (!((old->flags & new->flags) & IRQF_SHARED) ||
+ 		    (oldtype != (new->flags & IRQF_TRIGGER_MASK)) ||
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index d17c5da523a0..8fa7b6f9e19b 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -505,8 +505,7 @@ void resched_cpu(int cpu)
+ 	struct rq *rq = cpu_rq(cpu);
+ 	unsigned long flags;
+ 
+-	if (!raw_spin_trylock_irqsave(&rq->lock, flags))
+-		return;
++	raw_spin_lock_irqsave(&rq->lock, flags);
+ 	resched_curr(rq);
+ 	raw_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index ba0da243fdd8..2f52ec0f1539 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -282,8 +282,12 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
+ 		 * Do not reduce the frequency if the CPU has not been idle
+ 		 * recently, as the reduction is likely to be premature then.
+ 		 */
+-		if (busy && next_f < sg_policy->next_freq)
++		if (busy && next_f < sg_policy->next_freq) {
+ 			next_f = sg_policy->next_freq;
++
++			/* Reset cached freq as next_freq has changed */
++			sg_policy->cached_raw_freq = 0;
++		}
+ 	}
+ 	sugov_update_commit(sg_policy, time, next_f);
+ }
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 3c96c80e0992..d8c43d73e078 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -74,10 +74,6 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
+ 	raw_spin_unlock(&rt_b->rt_runtime_lock);
+ }
+ 
+-#if defined(CONFIG_SMP) && defined(HAVE_RT_PUSH_IPI)
+-static void push_irq_work_func(struct irq_work *work);
+-#endif
+-
+ void init_rt_rq(struct rt_rq *rt_rq)
+ {
+ 	struct rt_prio_array *array;
+@@ -97,13 +93,6 @@ void init_rt_rq(struct rt_rq *rt_rq)
+ 	rt_rq->rt_nr_migratory = 0;
+ 	rt_rq->overloaded = 0;
+ 	plist_head_init(&rt_rq->pushable_tasks);
+-
+-#ifdef HAVE_RT_PUSH_IPI
+-	rt_rq->push_flags = 0;
+-	rt_rq->push_cpu = nr_cpu_ids;
+-	raw_spin_lock_init(&rt_rq->push_lock);
+-	init_irq_work(&rt_rq->push_work, push_irq_work_func);
+-#endif
+ #endif /* CONFIG_SMP */
+ 	/* We start is dequeued state, because no RT tasks are queued */
+ 	rt_rq->rt_queued = 0;
+@@ -1876,241 +1865,166 @@ static void push_rt_tasks(struct rq *rq)
+ }
+ 
+ #ifdef HAVE_RT_PUSH_IPI
++
+ /*
+- * The search for the next cpu always starts at rq->cpu and ends
+- * when we reach rq->cpu again. It will never return rq->cpu.
+- * This returns the next cpu to check, or nr_cpu_ids if the loop
+- * is complete.
++ * When a high priority task schedules out from a CPU and a lower priority
++ * task is scheduled in, a check is made to see if there's any RT tasks
++ * on other CPUs that are waiting to run because a higher priority RT task
++ * is currently running on its CPU. In this case, the CPU with multiple RT
++ * tasks queued on it (overloaded) needs to be notified that a CPU has opened
++ * up that may be able to run one of its non-running queued RT tasks.
++ *
++ * All CPUs with overloaded RT tasks need to be notified as there is currently
++ * no way to know which of these CPUs have the highest priority task waiting
++ * to run. Instead of trying to take a spinlock on each of these CPUs,
++ * which has shown to cause large latency when done on machines with many
++ * CPUs, sending an IPI to the CPUs to have them push off the overloaded
++ * RT tasks waiting to run.
++ *
++ * Just sending an IPI to each of the CPUs is also an issue, as on large
++ * count CPU machines, this can cause an IPI storm on a CPU, especially
++ * if its the only CPU with multiple RT tasks queued, and a large number
++ * of CPUs scheduling a lower priority task at the same time.
++ *
++ * Each root domain has its own irq work function that can iterate over
++ * all CPUs with RT overloaded tasks. Since all CPUs with overloaded RT
++ * tassk must be checked if there's one or many CPUs that are lowering
++ * their priority, there's a single irq work iterator that will try to
++ * push off RT tasks that are waiting to run.
++ *
++ * When a CPU schedules a lower priority task, it will kick off the
++ * irq work iterator that will jump to each CPU with overloaded RT tasks.
++ * As it only takes the first CPU that schedules a lower priority task
++ * to start the process, the rto_start variable is incremented and if
++ * the atomic result is one, then that CPU will try to take the rto_lock.
++ * This prevents high contention on the lock as the process handles all
++ * CPUs scheduling lower priority tasks.
++ *
++ * All CPUs that are scheduling a lower priority task will increment the
++ * rt_loop_next variable. This will make sure that the irq work iterator
++ * checks all RT overloaded CPUs whenever a CPU schedules a new lower
++ * priority task, even if the iterator is in the middle of a scan. Incrementing
++ * the rt_loop_next will cause the iterator to perform another scan.
+  *
+- * rq->rt.push_cpu holds the last cpu returned by this function,
+- * or if this is the first instance, it must hold rq->cpu.
+  */
+ static int rto_next_cpu(struct rq *rq)
+ {
+-	int prev_cpu = rq->rt.push_cpu;
++	struct root_domain *rd = rq->rd;
++	int next;
+ 	int cpu;
+ 
+-	cpu = cpumask_next(prev_cpu, rq->rd->rto_mask);
+-
+ 	/*
+-	 * If the previous cpu is less than the rq's CPU, then it already
+-	 * passed the end of the mask, and has started from the beginning.
+-	 * We end if the next CPU is greater or equal to rq's CPU.
++	 * When starting the IPI RT pushing, the rto_cpu is set to -1,
++	 * rt_next_cpu() will simply return the first CPU found in
++	 * the rto_mask.
++	 *
++	 * If rto_next_cpu() is called with rto_cpu is a valid cpu, it
++	 * will return the next CPU found in the rto_mask.
++	 *
++	 * If there are no more CPUs left in the rto_mask, then a check is made
++	 * against rto_loop and rto_loop_next. rto_loop is only updated with
++	 * the rto_lock held, but any CPU may increment the rto_loop_next
++	 * without any locking.
+ 	 */
+-	if (prev_cpu < rq->cpu) {
+-		if (cpu >= rq->cpu)
+-			return nr_cpu_ids;
++	for (;;) {
+ 
+-	} else if (cpu >= nr_cpu_ids) {
+-		/*
+-		 * We passed the end of the mask, start at the beginning.
+-		 * If the result is greater or equal to the rq's CPU, then
+-		 * the loop is finished.
+-		 */
+-		cpu = cpumask_first(rq->rd->rto_mask);
+-		if (cpu >= rq->cpu)
+-			return nr_cpu_ids;
+-	}
+-	rq->rt.push_cpu = cpu;
++		/* When rto_cpu is -1 this acts like cpumask_first() */
++		cpu = cpumask_next(rd->rto_cpu, rd->rto_mask);
+ 
+-	/* Return cpu to let the caller know if the loop is finished or not */
+-	return cpu;
+-}
++		rd->rto_cpu = cpu;
+ 
+-static int find_next_push_cpu(struct rq *rq)
+-{
+-	struct rq *next_rq;
+-	int cpu;
++		if (cpu < nr_cpu_ids)
++			return cpu;
+ 
+-	while (1) {
+-		cpu = rto_next_cpu(rq);
+-		if (cpu >= nr_cpu_ids)
+-			break;
+-		next_rq = cpu_rq(cpu);
++		rd->rto_cpu = -1;
++
++		/*
++		 * ACQUIRE ensures we see the @rto_mask changes
++		 * made prior to the @next value observed.
++		 *
++		 * Matches WMB in rt_set_overload().
++		 */
++		next = atomic_read_acquire(&rd->rto_loop_next);
+ 
+-		/* Make sure the next rq can push to this rq */
+-		if (next_rq->rt.highest_prio.next < rq->rt.highest_prio.curr)
++		if (rd->rto_loop == next)
+ 			break;
++
++		rd->rto_loop = next;
+ 	}
+ 
+-	return cpu;
++	return -1;
+ }
+ 
+-#define RT_PUSH_IPI_EXECUTING		1
+-#define RT_PUSH_IPI_RESTART		2
++static inline bool rto_start_trylock(atomic_t *v)
++{
++	return !atomic_cmpxchg_acquire(v, 0, 1);
++}
+ 
+-/*
+- * When a high priority task schedules out from a CPU and a lower priority
+- * task is scheduled in, a check is made to see if there's any RT tasks
+- * on other CPUs that are waiting to run because a higher priority RT task
+- * is currently running on its CPU. In this case, the CPU with multiple RT
+- * tasks queued on it (overloaded) needs to be notified that a CPU has opened
+- * up that may be able to run one of its non-running queued RT tasks.
+- *
+- * On large CPU boxes, there's the case that several CPUs could schedule
+- * a lower priority task at the same time, in which case it will look for
+- * any overloaded CPUs that it could pull a task from. To do this, the runqueue
+- * lock must be taken from that overloaded CPU. Having 10s of CPUs all fighting
+- * for a single overloaded CPU's runqueue lock can produce a large latency.
+- * (This has actually been observed on large boxes running cyclictest).
+- * Instead of taking the runqueue lock of the overloaded CPU, each of the
+- * CPUs that scheduled a lower priority task simply sends an IPI to the
+- * overloaded CPU. An IPI is much cheaper than taking an runqueue lock with
+- * lots of contention. The overloaded CPU will look to push its non-running
+- * RT task off, and if it does, it can then ignore the other IPIs coming
+- * in, and just pass those IPIs off to any other overloaded CPU.
+- *
+- * When a CPU schedules a lower priority task, it only sends an IPI to
+- * the "next" CPU that has overloaded RT tasks. This prevents IPI storms,
+- * as having 10 CPUs scheduling lower priority tasks and 10 CPUs with
+- * RT overloaded tasks, would cause 100 IPIs to go out at once.
+- *
+- * The overloaded RT CPU, when receiving an IPI, will try to push off its
+- * overloaded RT tasks and then send an IPI to the next CPU that has
+- * overloaded RT tasks. This stops when all CPUs with overloaded RT tasks
+- * have completed. Just because a CPU may have pushed off its own overloaded
+- * RT task does not mean it should stop sending the IPI around to other
+- * overloaded CPUs. There may be another RT task waiting to run on one of
+- * those CPUs that are of higher priority than the one that was just
+- * pushed.
+- *
+- * An optimization that could possibly be made is to make a CPU array similar
+- * to the cpupri array mask of all running RT tasks, but for the overloaded
+- * case, then the IPI could be sent to only the CPU with the highest priority
+- * RT task waiting, and that CPU could send off further IPIs to the CPU with
+- * the next highest waiting task. Since the overloaded case is much less likely
+- * to happen, the complexity of this implementation may not be worth it.
+- * Instead, just send an IPI around to all overloaded CPUs.
+- *
+- * The rq->rt.push_flags holds the status of the IPI that is going around.
+- * A run queue can only send out a single IPI at a time. The possible flags
+- * for rq->rt.push_flags are:
+- *
+- *    (None or zero):		No IPI is going around for the current rq
+- *    RT_PUSH_IPI_EXECUTING:	An IPI for the rq is being passed around
+- *    RT_PUSH_IPI_RESTART:	The priority of the running task for the rq
+- *				has changed, and the IPI should restart
+- *				circulating the overloaded CPUs again.
+- *
+- * rq->rt.push_cpu contains the CPU that is being sent the IPI. It is updated
+- * before sending to the next CPU.
+- *
+- * Instead of having all CPUs that schedule a lower priority task send
+- * an IPI to the same "first" CPU in the RT overload mask, they send it
+- * to the next overloaded CPU after their own CPU. This helps distribute
+- * the work when there's more than one overloaded CPU and multiple CPUs
+- * scheduling in lower priority tasks.
+- *
+- * When a rq schedules a lower priority task than what was currently
+- * running, the next CPU with overloaded RT tasks is examined first.
+- * That is, if CPU 1 and 5 are overloaded, and CPU 3 schedules a lower
+- * priority task, it will send an IPI first to CPU 5, then CPU 5 will
+- * send to CPU 1 if it is still overloaded. CPU 1 will clear the
+- * rq->rt.push_flags if RT_PUSH_IPI_RESTART is not set.
+- *
+- * The first CPU to notice IPI_RESTART is set, will clear that flag and then
+- * send an IPI to the next overloaded CPU after the rq->cpu and not the next
+- * CPU after push_cpu. That is, if CPU 1, 4 and 5 are overloaded when CPU 3
+- * schedules a lower priority task, and the IPI_RESTART gets set while the
+- * handling is being done on CPU 5, it will clear the flag and send it back to
+- * CPU 4 instead of CPU 1.
+- *
+- * Note, the above logic can be disabled by turning off the sched_feature
+- * RT_PUSH_IPI. Then the rq lock of the overloaded CPU will simply be
+- * taken by the CPU requesting a pull and the waiting RT task will be pulled
+- * by that CPU. This may be fine for machines with few CPUs.
+- */
+-static void tell_cpu_to_push(struct rq *rq)
++static inline void rto_start_unlock(atomic_t *v)
+ {
+-	int cpu;
++	atomic_set_release(v, 0);
++}
+ 
+-	if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) {
+-		raw_spin_lock(&rq->rt.push_lock);
+-		/* Make sure it's still executing */
+-		if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) {
+-			/*
+-			 * Tell the IPI to restart the loop as things have
+-			 * changed since it started.
+-			 */
+-			rq->rt.push_flags |= RT_PUSH_IPI_RESTART;
+-			raw_spin_unlock(&rq->rt.push_lock);
+-			return;
+-		}
+-		raw_spin_unlock(&rq->rt.push_lock);
+-	}
++static void tell_cpu_to_push(struct rq *rq)
++{
++	int cpu = -1;
+ 
+-	/* When here, there's no IPI going around */
++	/* Keep the loop going if the IPI is currently active */
++	atomic_inc(&rq->rd->rto_loop_next);
+ 
+-	rq->rt.push_cpu = rq->cpu;
+-	cpu = find_next_push_cpu(rq);
+-	if (cpu >= nr_cpu_ids)
++	/* Only one CPU can initiate a loop at a time */
++	if (!rto_start_trylock(&rq->rd->rto_loop_start))
+ 		return;
+ 
+-	rq->rt.push_flags = RT_PUSH_IPI_EXECUTING;
++	raw_spin_lock(&rq->rd->rto_lock);
++
++	/*
++	 * The rto_cpu is updated under the lock, if it has a valid cpu
++	 * then the IPI is still running and will continue due to the
++	 * update to loop_next, and nothing needs to be done here.
++	 * Otherwise it is finishing up and an ipi needs to be sent.
++	 */
++	if (rq->rd->rto_cpu < 0)
++		cpu = rto_next_cpu(rq);
+ 
+-	irq_work_queue_on(&rq->rt.push_work, cpu);
++	raw_spin_unlock(&rq->rd->rto_lock);
++
++	rto_start_unlock(&rq->rd->rto_loop_start);
++
++	if (cpu >= 0)
++		irq_work_queue_on(&rq->rd->rto_push_work, cpu);
+ }
+ 
+ /* Called from hardirq context */
+-static void try_to_push_tasks(void *arg)
++void rto_push_irq_work_func(struct irq_work *work)
+ {
+-	struct rt_rq *rt_rq = arg;
+-	struct rq *rq, *src_rq;
+-	int this_cpu;
++	struct rq *rq;
+ 	int cpu;
+ 
+-	this_cpu = rt_rq->push_cpu;
++	rq = this_rq();
+ 
+-	/* Paranoid check */
+-	BUG_ON(this_cpu != smp_processor_id());
+-
+-	rq = cpu_rq(this_cpu);
+-	src_rq = rq_of_rt_rq(rt_rq);
+-
+-again:
++	/*
++	 * We do not need to grab the lock to check for has_pushable_tasks.
++	 * When it gets updated, a check is made if a push is possible.
++	 */
+ 	if (has_pushable_tasks(rq)) {
+ 		raw_spin_lock(&rq->lock);
+-		push_rt_task(rq);
++		push_rt_tasks(rq);
+ 		raw_spin_unlock(&rq->lock);
+ 	}
+ 
+-	/* Pass the IPI to the next rt overloaded queue */
+-	raw_spin_lock(&rt_rq->push_lock);
+-	/*
+-	 * If the source queue changed since the IPI went out,
+-	 * we need to restart the search from that CPU again.
+-	 */
+-	if (rt_rq->push_flags & RT_PUSH_IPI_RESTART) {
+-		rt_rq->push_flags &= ~RT_PUSH_IPI_RESTART;
+-		rt_rq->push_cpu = src_rq->cpu;
+-	}
++	raw_spin_lock(&rq->rd->rto_lock);
+ 
+-	cpu = find_next_push_cpu(src_rq);
++	/* Pass the IPI to the next rt overloaded queue */
++	cpu = rto_next_cpu(rq);
+ 
+-	if (cpu >= nr_cpu_ids)
+-		rt_rq->push_flags &= ~RT_PUSH_IPI_EXECUTING;
+-	raw_spin_unlock(&rt_rq->push_lock);
++	raw_spin_unlock(&rq->rd->rto_lock);
+ 
+-	if (cpu >= nr_cpu_ids)
++	if (cpu < 0)
+ 		return;
+ 
+-	/*
+-	 * It is possible that a restart caused this CPU to be
+-	 * chosen again. Don't bother with an IPI, just see if we
+-	 * have more to push.
+-	 */
+-	if (unlikely(cpu == rq->cpu))
+-		goto again;
+-
+ 	/* Try the next RT overloaded CPU */
+-	irq_work_queue_on(&rt_rq->push_work, cpu);
+-}
+-
+-static void push_irq_work_func(struct irq_work *work)
+-{
+-	struct rt_rq *rt_rq = container_of(work, struct rt_rq, push_work);
+-
+-	try_to_push_tasks(rt_rq);
++	irq_work_queue_on(&rq->rd->rto_push_work, cpu);
+ }
+ #endif /* HAVE_RT_PUSH_IPI */
+ 
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 3b448ba82225..b732e779fe7d 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -502,7 +502,7 @@ static inline int rt_bandwidth_enabled(void)
+ }
+ 
+ /* RT IPI pull logic requires IRQ_WORK */
+-#ifdef CONFIG_IRQ_WORK
++#if defined(CONFIG_IRQ_WORK) && defined(CONFIG_SMP)
+ # define HAVE_RT_PUSH_IPI
+ #endif
+ 
+@@ -524,12 +524,6 @@ struct rt_rq {
+ 	unsigned long rt_nr_total;
+ 	int overloaded;
+ 	struct plist_head pushable_tasks;
+-#ifdef HAVE_RT_PUSH_IPI
+-	int push_flags;
+-	int push_cpu;
+-	struct irq_work push_work;
+-	raw_spinlock_t push_lock;
+-#endif
+ #endif /* CONFIG_SMP */
+ 	int rt_queued;
+ 
+@@ -638,6 +632,19 @@ struct root_domain {
+ 	struct dl_bw dl_bw;
+ 	struct cpudl cpudl;
+ 
++#ifdef HAVE_RT_PUSH_IPI
++	/*
++	 * For IPI pull requests, loop across the rto_mask.
++	 */
++	struct irq_work rto_push_work;
++	raw_spinlock_t rto_lock;
++	/* These are only updated and read within rto_lock */
++	int rto_loop;
++	int rto_cpu;
++	/* These atomics are updated outside of a lock */
++	atomic_t rto_loop_next;
++	atomic_t rto_loop_start;
++#endif
+ 	/*
+ 	 * The "RT overload" flag: it gets set if a CPU has more than
+ 	 * one runnable RT task.
+@@ -655,6 +662,9 @@ extern void init_defrootdomain(void);
+ extern int sched_init_domains(const struct cpumask *cpu_map);
+ extern void rq_attach_root(struct rq *rq, struct root_domain *rd);
+ 
++#ifdef HAVE_RT_PUSH_IPI
++extern void rto_push_irq_work_func(struct irq_work *work);
++#endif
+ #endif /* CONFIG_SMP */
+ 
+ /*
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 6798276d29af..093f2ceba2e2 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -269,6 +269,12 @@ static int init_rootdomain(struct root_domain *rd)
+ 	if (!zalloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
+ 		goto free_dlo_mask;
+ 
++#ifdef HAVE_RT_PUSH_IPI
++	rd->rto_cpu = -1;
++	raw_spin_lock_init(&rd->rto_lock);
++	init_irq_work(&rd->rto_push_work, rto_push_irq_work_func);
++#endif
++
+ 	init_dl_bw(&rd->dl_bw);
+ 	if (cpudl_init(&rd->cpudl) != 0)
+ 		goto free_rto_mask;
+diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
+index e24388a863a7..468fb7cd1221 100644
+--- a/lib/mpi/mpi-pow.c
++++ b/lib/mpi/mpi-pow.c
+@@ -26,6 +26,7 @@
+  *	 however I decided to publish this code under the plain GPL.
+  */
+ 
++#include <linux/sched.h>
+ #include <linux/string.h>
+ #include "mpi-internal.h"
+ #include "longlong.h"
+@@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
+ 				}
+ 				e <<= 1;
+ 				c--;
++				cond_resched();
+ 			}
+ 
+ 			i--;
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index b2ba2ba585f3..39e19125d6a0 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -404,8 +404,7 @@ static void do_compact_page(struct z3fold_header *zhdr, bool locked)
+ 		WARN_ON(z3fold_page_trylock(zhdr));
+ 	else
+ 		z3fold_page_lock(zhdr);
+-	if (test_bit(PAGE_STALE, &page->private) ||
+-	    !test_and_clear_bit(NEEDS_COMPACTING, &page->private)) {
++	if (WARN_ON(!test_and_clear_bit(NEEDS_COMPACTING, &page->private))) {
+ 		z3fold_page_unlock(zhdr);
+ 		return;
+ 	}
+@@ -413,6 +412,11 @@ static void do_compact_page(struct z3fold_header *zhdr, bool locked)
+ 	list_del_init(&zhdr->buddy);
+ 	spin_unlock(&pool->lock);
+ 
++	if (kref_put(&zhdr->refcount, release_z3fold_page_locked)) {
++		atomic64_dec(&pool->pages_nr);
++		return;
++	}
++
+ 	z3fold_compact_page(zhdr);
+ 	unbuddied = get_cpu_ptr(pool->unbuddied);
+ 	fchunks = num_free_chunks(zhdr);
+@@ -753,9 +757,11 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ 		list_del_init(&zhdr->buddy);
+ 		spin_unlock(&pool->lock);
+ 		zhdr->cpu = -1;
++		kref_get(&zhdr->refcount);
+ 		do_compact_page(zhdr, true);
+ 		return;
+ 	}
++	kref_get(&zhdr->refcount);
+ 	queue_work_on(zhdr->cpu, pool->compact_wq, &zhdr->work);
+ 	z3fold_page_unlock(zhdr);
+ }
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 4674235b0d9b..b433aff5ff13 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -82,7 +82,7 @@ int p9_show_client_options(struct seq_file *m, struct p9_client *clnt)
+ {
+ 	if (clnt->msize != 8192)
+ 		seq_printf(m, ",msize=%u", clnt->msize);
+-	seq_printf(m, "trans=%s", clnt->trans_mod->name);
++	seq_printf(m, ",trans=%s", clnt->trans_mod->name);
+ 
+ 	switch (clnt->proto_version) {
+ 	case p9_proto_legacy:
+@@ -773,8 +773,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
+ 	}
+ again:
+ 	/* Wait for the response */
+-	err = wait_event_interruptible(*req->wq,
+-				       req->status >= REQ_STATUS_RCVD);
++	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
+ 
+ 	/*
+ 	 * Make sure our req is coherent with regard to updates in other
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 903a190319b9..985046ae4231 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -724,12 +724,12 @@ static int p9_fd_show_options(struct seq_file *m, struct p9_client *clnt)
+ {
+ 	if (clnt->trans_mod == &p9_tcp_trans) {
+ 		if (clnt->trans_opts.tcp.port != P9_PORT)
+-			seq_printf(m, "port=%u", clnt->trans_opts.tcp.port);
++			seq_printf(m, ",port=%u", clnt->trans_opts.tcp.port);
+ 	} else if (clnt->trans_mod == &p9_fd_trans) {
+ 		if (clnt->trans_opts.fd.rfd != ~0)
+-			seq_printf(m, "rfd=%u", clnt->trans_opts.fd.rfd);
++			seq_printf(m, ",rfd=%u", clnt->trans_opts.fd.rfd);
+ 		if (clnt->trans_opts.fd.wfd != ~0)
+-			seq_printf(m, "wfd=%u", clnt->trans_opts.fd.wfd);
++			seq_printf(m, ",wfd=%u", clnt->trans_opts.fd.wfd);
+ 	}
+ 	return 0;
+ }
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index f24b25c25106..f3a4efcf1456 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -286,8 +286,8 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
+ 		if (err == -ENOSPC) {
+ 			chan->ring_bufs_avail = 0;
+ 			spin_unlock_irqrestore(&chan->lock, flags);
+-			err = wait_event_interruptible(*chan->vc_wq,
+-							chan->ring_bufs_avail);
++			err = wait_event_killable(*chan->vc_wq,
++						  chan->ring_bufs_avail);
+ 			if (err  == -ERESTARTSYS)
+ 				return err;
+ 
+@@ -327,7 +327,7 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
+ 		 * Other zc request to finish here
+ 		 */
+ 		if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
+-			err = wait_event_interruptible(vp_wq,
++			err = wait_event_killable(vp_wq,
+ 			      (atomic_read(&vp_pinned) < chan->p9_max_pages));
+ 			if (err == -ERESTARTSYS)
+ 				return err;
+@@ -471,8 +471,8 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ 		if (err == -ENOSPC) {
+ 			chan->ring_bufs_avail = 0;
+ 			spin_unlock_irqrestore(&chan->lock, flags);
+-			err = wait_event_interruptible(*chan->vc_wq,
+-						       chan->ring_bufs_avail);
++			err = wait_event_killable(*chan->vc_wq,
++						  chan->ring_bufs_avail);
+ 			if (err  == -ERESTARTSYS)
+ 				goto err_out;
+ 
+@@ -489,8 +489,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ 	virtqueue_kick(chan->vq);
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
+-	err = wait_event_interruptible(*req->wq,
+-				       req->status >= REQ_STATUS_RCVD);
++	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
+ 	/*
+ 	 * Non kernel buffers are pinned, unpin them
+ 	 */
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 6ad3e043c617..325c56043007 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -156,8 +156,8 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
+ 	ring = &priv->rings[num];
+ 
+ again:
+-	while (wait_event_interruptible(ring->wq,
+-					p9_xen_write_todo(ring, size)) != 0)
++	while (wait_event_killable(ring->wq,
++				   p9_xen_write_todo(ring, size)) != 0)
+ 		;
+ 
+ 	spin_lock_irqsave(&ring->lock, flags);
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 489610ac1cdd..bf9d079cbafd 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -37,7 +37,9 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
+ 		return -ENOTSUPP;
+ 	}
+ 
+-	WARN_ON(!key->len);
++	if (!key->len)
++		return -EINVAL;
++
+ 	key->key = kmemdup(buf, key->len, GFP_NOIO);
+ 	if (!key->key) {
+ 		ret = -ENOMEM;
+diff --git a/net/nfc/core.c b/net/nfc/core.c
+index 5cf33df888c3..c699d64a0753 100644
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -1106,7 +1106,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
+ err_free_dev:
+ 	kfree(dev);
+ 
+-	return ERR_PTR(rc);
++	return NULL;
+ }
+ EXPORT_SYMBOL(nfc_allocate_device);
+ 
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index 992594b7cc6b..af7893501e40 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -133,6 +133,10 @@ static int svc_rdma_bc_sendto(struct svcxprt_rdma *rdma,
+ 	if (ret)
+ 		goto out_err;
+ 
++	/* Bump page refcnt so Send completion doesn't release
++	 * the rq_buffer before all retransmits are complete.
++	 */
++	get_page(virt_to_page(rqst->rq_buffer));
+ 	ret = svc_rdma_post_send_wr(rdma, ctxt, 1, 0);
+ 	if (ret)
+ 		goto out_unmap;
+@@ -165,7 +169,6 @@ xprt_rdma_bc_allocate(struct rpc_task *task)
+ 		return -EINVAL;
+ 	}
+ 
+-	/* svc_rdma_sendto releases this page */
+ 	page = alloc_page(RPCRDMA_DEF_GFP);
+ 	if (!page)
+ 		return -ENOMEM;
+@@ -184,6 +187,7 @@ xprt_rdma_bc_free(struct rpc_task *task)
+ {
+ 	struct rpc_rqst *rqst = task->tk_rqstp;
+ 
++	put_page(virt_to_page(rqst->rq_buffer));
+ 	kfree(rqst->rq_rbuffer);
+ }
+ 
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index a93a4235a332..10e7ef7a8804 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -248,8 +248,10 @@ static void update_audio_tstamp(struct snd_pcm_substream *substream,
+ 				runtime->rate);
+ 		*audio_tstamp = ns_to_timespec(audio_nsecs);
+ 	}
+-	runtime->status->audio_tstamp = *audio_tstamp;
+-	runtime->status->tstamp = *curr_tstamp;
++	if (!timespec_equal(&runtime->status->audio_tstamp, audio_tstamp)) {
++		runtime->status->audio_tstamp = *audio_tstamp;
++		runtime->status->tstamp = *curr_tstamp;
++	}
+ 
+ 	/*
+ 	 * re-take a driver timestamp to let apps detect if the reference tstamp
+diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c
+index 59127b6ef39e..e00f7e399e46 100644
+--- a/sound/core/timer_compat.c
++++ b/sound/core/timer_compat.c
+@@ -66,11 +66,11 @@ static int snd_timer_user_info_compat(struct file *file,
+ 	struct snd_timer *t;
+ 
+ 	tu = file->private_data;
+-	if (snd_BUG_ON(!tu->timeri))
+-		return -ENXIO;
++	if (!tu->timeri)
++		return -EBADFD;
+ 	t = tu->timeri->timer;
+-	if (snd_BUG_ON(!t))
+-		return -ENXIO;
++	if (!t)
++		return -EBADFD;
+ 	memset(&info, 0, sizeof(info));
+ 	info.card = t->card ? t->card->number : -1;
+ 	if (t->hw.flags & SNDRV_TIMER_HW_SLAVE)
+@@ -99,8 +99,8 @@ static int snd_timer_user_status_compat(struct file *file,
+ 	struct snd_timer_status32 status;
+ 	
+ 	tu = file->private_data;
+-	if (snd_BUG_ON(!tu->timeri))
+-		return -ENXIO;
++	if (!tu->timeri)
++		return -EBADFD;
+ 	memset(&status, 0, sizeof(status));
+ 	status.tstamp.tv_sec = tu->tstamp.tv_sec;
+ 	status.tstamp.tv_nsec = tu->tstamp.tv_nsec;
+diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
+index e43af18d4383..8632301489fa 100644
+--- a/sound/core/vmaster.c
++++ b/sound/core/vmaster.c
+@@ -495,7 +495,9 @@ EXPORT_SYMBOL_GPL(snd_ctl_sync_vmaster);
+  * Returns 0 if successful, or a negative error code.
+  */
+ int snd_ctl_apply_vmaster_slaves(struct snd_kcontrol *kctl,
+-				 int (*func)(struct snd_kcontrol *, void *),
++				 int (*func)(struct snd_kcontrol *vslave,
++					     struct snd_kcontrol *slave,
++					     void *arg),
+ 				 void *arg)
+ {
+ 	struct link_master *master;
+@@ -507,7 +509,7 @@ int snd_ctl_apply_vmaster_slaves(struct snd_kcontrol *kctl,
+ 	if (err < 0)
+ 		return err;
+ 	list_for_each_entry(slave, &master->slaves, list) {
+-		err = func(&slave->slave, arg);
++		err = func(slave->kctl, &slave->slave, arg);
+ 		if (err < 0)
+ 			return err;
+ 	}
+diff --git a/sound/hda/hdmi_chmap.c b/sound/hda/hdmi_chmap.c
+index 81acc20c2535..f21633cd9b38 100644
+--- a/sound/hda/hdmi_chmap.c
++++ b/sound/hda/hdmi_chmap.c
+@@ -746,7 +746,7 @@ static int hdmi_chmap_ctl_get(struct snd_kcontrol *kcontrol,
+ 	memset(pcm_chmap, 0, sizeof(pcm_chmap));
+ 	chmap->ops.get_chmap(chmap->hdac, pcm_idx, pcm_chmap);
+ 
+-	for (i = 0; i < sizeof(chmap); i++)
++	for (i = 0; i < ARRAY_SIZE(pcm_chmap); i++)
+ 		ucontrol->value.integer.value[i] = pcm_chmap[i];
+ 
+ 	return 0;
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index a0989d231fd0..417abbb1f72c 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1823,7 +1823,9 @@ struct slave_init_arg {
+ };
+ 
+ /* initialize the slave volume with 0dB via snd_ctl_apply_vmaster_slaves() */
+-static int init_slave_0dB(struct snd_kcontrol *kctl, void *_arg)
++static int init_slave_0dB(struct snd_kcontrol *slave,
++			  struct snd_kcontrol *kctl,
++			  void *_arg)
+ {
+ 	struct slave_init_arg *arg = _arg;
+ 	int _tlv[4];
+@@ -1860,7 +1862,7 @@ static int init_slave_0dB(struct snd_kcontrol *kctl, void *_arg)
+ 	arg->step = step;
+ 	val = -tlv[2] / step;
+ 	if (val > 0) {
+-		put_kctl_with_value(kctl, val);
++		put_kctl_with_value(slave, val);
+ 		return val;
+ 	}
+ 
+@@ -1868,7 +1870,9 @@ static int init_slave_0dB(struct snd_kcontrol *kctl, void *_arg)
+ }
+ 
+ /* unmute the slave via snd_ctl_apply_vmaster_slaves() */
+-static int init_slave_unmute(struct snd_kcontrol *slave, void *_arg)
++static int init_slave_unmute(struct snd_kcontrol *slave,
++			     struct snd_kcontrol *kctl,
++			     void *_arg)
+ {
+ 	return put_kctl_with_value(slave, 1);
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index f958d8d54d15..c71dcacea807 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2463,6 +2463,9 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* AMD Hudson */
+ 	{ PCI_DEVICE(0x1022, 0x780d),
+ 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++	/* AMD Raven */
++	{ PCI_DEVICE(0x1022, 0x15e3),
++	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ 	/* ATI HDMI */
+ 	{ PCI_DEVICE(0x1002, 0x0002),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dce0682c5001..7c39114d124f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -341,6 +341,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ 	case 0x10ec0299:
+ 		alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ 		break;
++	case 0x10ec0275:
++		alc_update_coef_idx(codec, 0xe, 0, 1<<0);
++		break;
+ 	case 0x10ec0293:
+ 		alc_update_coef_idx(codec, 0xa, 1<<13, 0);
+ 		break;
+@@ -6863,7 +6866,7 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0703:
+ 		spec->codec_variant = ALC269_TYPE_ALC700;
+ 		spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+-		alc_update_coef_idx(codec, 0x4a, 0, 1 << 15); /* Combo jack auto trigger control */
++		alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
+ 		break;
+ 
+ 	}
+diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
+index abfb710df7cb..7a312168f864 100644
+--- a/sound/soc/sunxi/sun8i-codec.c
++++ b/sound/soc/sunxi/sun8i-codec.c
+@@ -73,6 +73,7 @@
+ #define SUN8I_SYS_SR_CTRL_AIF2_FS_MASK		GENMASK(11, 8)
+ #define SUN8I_AIF1CLK_CTRL_AIF1_WORD_SIZ_MASK	GENMASK(5, 4)
+ #define SUN8I_AIF1CLK_CTRL_AIF1_LRCK_DIV_MASK	GENMASK(8, 6)
++#define SUN8I_AIF1CLK_CTRL_AIF1_BCLK_DIV_MASK	GENMASK(12, 9)
+ 
+ struct sun8i_codec {
+ 	struct device	*dev;
+@@ -170,11 +171,11 @@ static int sun8i_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 
+ 	/* clock masters */
+ 	switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+-	case SND_SOC_DAIFMT_CBS_CFS: /* DAI Slave */
+-		value = 0x0; /* Codec Master */
++	case SND_SOC_DAIFMT_CBS_CFS: /* Codec slave, DAI master */
++		value = 0x1;
+ 		break;
+-	case SND_SOC_DAIFMT_CBM_CFM: /* DAI Master */
+-		value = 0x1; /* Codec Slave */
++	case SND_SOC_DAIFMT_CBM_CFM: /* Codec Master, DAI slave */
++		value = 0x0;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -199,7 +200,7 @@ static int sun8i_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 			   value << SUN8I_AIF1CLK_CTRL_AIF1_BCLK_INV);
+ 	regmap_update_bits(scodec->regmap, SUN8I_AIF1CLK_CTRL,
+ 			   BIT(SUN8I_AIF1CLK_CTRL_AIF1_LRCK_INV),
+-			   value << SUN8I_AIF1CLK_CTRL_AIF1_LRCK_INV);
++			   !value << SUN8I_AIF1CLK_CTRL_AIF1_LRCK_INV);
+ 
+ 	/* DAI format */
+ 	switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+@@ -226,12 +227,57 @@ static int sun8i_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 	return 0;
+ }
+ 
++struct sun8i_codec_clk_div {
++	u8	div;
++	u8	val;
++};
++
++static const struct sun8i_codec_clk_div sun8i_codec_bclk_div[] = {
++	{ .div = 1,	.val = 0 },
++	{ .div = 2,	.val = 1 },
++	{ .div = 4,	.val = 2 },
++	{ .div = 6,	.val = 3 },
++	{ .div = 8,	.val = 4 },
++	{ .div = 12,	.val = 5 },
++	{ .div = 16,	.val = 6 },
++	{ .div = 24,	.val = 7 },
++	{ .div = 32,	.val = 8 },
++	{ .div = 48,	.val = 9 },
++	{ .div = 64,	.val = 10 },
++	{ .div = 96,	.val = 11 },
++	{ .div = 128,	.val = 12 },
++	{ .div = 192,	.val = 13 },
++};
++
++static u8 sun8i_codec_get_bclk_div(struct sun8i_codec *scodec,
++				   unsigned int rate,
++				   unsigned int word_size)
++{
++	unsigned long clk_rate = clk_get_rate(scodec->clk_module);
++	unsigned int div = clk_rate / rate / word_size / 2;
++	unsigned int best_val = 0, best_diff = ~0;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(sun8i_codec_bclk_div); i++) {
++		const struct sun8i_codec_clk_div *bdiv = &sun8i_codec_bclk_div[i];
++		unsigned int diff = abs(bdiv->div - div);
++
++		if (diff < best_diff) {
++			best_diff = diff;
++			best_val = bdiv->val;
++		}
++	}
++
++	return best_val;
++}
++
+ static int sun8i_codec_hw_params(struct snd_pcm_substream *substream,
+ 				 struct snd_pcm_hw_params *params,
+ 				 struct snd_soc_dai *dai)
+ {
+ 	struct sun8i_codec *scodec = snd_soc_codec_get_drvdata(dai->codec);
+ 	int sample_rate;
++	u8 bclk_div;
+ 
+ 	/*
+ 	 * The CPU DAI handles only a sample of 16 bits. Configure the
+@@ -241,6 +287,11 @@ static int sun8i_codec_hw_params(struct snd_pcm_substream *substream,
+ 			   SUN8I_AIF1CLK_CTRL_AIF1_WORD_SIZ_MASK,
+ 			   SUN8I_AIF1CLK_CTRL_AIF1_WORD_SIZ_16);
+ 
++	bclk_div = sun8i_codec_get_bclk_div(scodec, params_rate(params), 16);
++	regmap_update_bits(scodec->regmap, SUN8I_AIF1CLK_CTRL,
++			   SUN8I_AIF1CLK_CTRL_AIF1_BCLK_DIV_MASK,
++			   bclk_div << SUN8I_AIF1CLK_CTRL_AIF1_BCLK_DIV);
++
+ 	regmap_update_bits(scodec->regmap, SUN8I_AIF1CLK_CTRL,
+ 			   SUN8I_AIF1CLK_CTRL_AIF1_LRCK_DIV_MASK,
+ 			   SUN8I_AIF1CLK_CTRL_AIF1_LRCK_DIV_16);
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index 26dd5f20f149..eb3396ffba4c 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -43,7 +43,7 @@ static struct uac_clock_source_descriptor *
+ 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
+ 					     ctrl_iface->extralen,
+ 					     cs, UAC2_CLOCK_SOURCE))) {
+-		if (cs->bClockID == clock_id)
++		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
+ 			return cs;
+ 	}
+ 
+@@ -59,8 +59,11 @@ static struct uac_clock_selector_descriptor *
+ 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
+ 					     ctrl_iface->extralen,
+ 					     cs, UAC2_CLOCK_SELECTOR))) {
+-		if (cs->bClockID == clock_id)
++		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) {
++			if (cs->bLength < 5 + cs->bNrInPins)
++				return NULL;
+ 			return cs;
++		}
+ 	}
+ 
+ 	return NULL;
+@@ -75,7 +78,7 @@ static struct uac_clock_multiplier_descriptor *
+ 	while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra,
+ 					     ctrl_iface->extralen,
+ 					     cs, UAC2_CLOCK_MULTIPLIER))) {
+-		if (cs->bClockID == clock_id)
++		if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id)
+ 			return cs;
+ 	}
+ 
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 91bc8f18791e..2b835cca41b1 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1469,6 +1469,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
+ 	__u8 *bmaControls;
+ 
+ 	if (state->mixer->protocol == UAC_VERSION_1) {
++		if (hdr->bLength < 7) {
++			usb_audio_err(state->chip,
++				      "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
++				      unitid);
++			return -EINVAL;
++		}
+ 		csize = hdr->bControlSize;
+ 		if (!csize) {
+ 			usb_audio_dbg(state->chip,
+@@ -1486,6 +1492,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
+ 		}
+ 	} else {
+ 		struct uac2_feature_unit_descriptor *ftr = _ftr;
++		if (hdr->bLength < 6) {
++			usb_audio_err(state->chip,
++				      "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
++				      unitid);
++			return -EINVAL;
++		}
+ 		csize = 4;
+ 		channels = (hdr->bLength - 6) / 4 - 1;
+ 		bmaControls = ftr->bmaControls;
+@@ -2086,7 +2098,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ 	const struct usbmix_name_map *map;
+ 	char **namelist;
+ 
+-	if (!desc->bNrInPins || desc->bLength < 5 + desc->bNrInPins) {
++	if (desc->bLength < 5 || !desc->bNrInPins ||
++	    desc->bLength < 5 + desc->bNrInPins) {
+ 		usb_audio_err(state->chip,
+ 			"invalid SELECTOR UNIT descriptor %d\n", unitid);
+ 		return -EINVAL;