[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Alice Ferrazzi]

commit:     333a8fe029b7693b974251030f8b07f2a07a8776
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 30 12:08:35 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Nov 30 12:08:35 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=333a8fe0

linux kernel 4.14.3

 0000_README             |    4 +
 1002_linux-4.14.3.patch | 8034 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 8038 insertions(+)

diff --git a/0000_README b/0000_README
index 1324e53..9aaf65a 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch:  1001_linux-4.14.2.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.2
 
+Patch:  1002_linux-4.14.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.3
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1002_linux-4.14.3.patch b/1002_linux-4.14.3.patch
new file mode 100644
index 0000000..269ad50
--- /dev/null
+++ b/1002_linux-4.14.3.patch
@@ -0,0 +1,8034 @@
+diff --git a/Makefile b/Makefile
+index 75d89dc2b94a..ede4de0d8634 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
+index 35ff45470dbf..fc3b44028cfb 100644
+--- a/arch/arm/mm/dump.c
++++ b/arch/arm/mm/dump.c
+@@ -129,8 +129,8 @@ static const struct prot_bits section_bits[] = {
+ 		.val	= PMD_SECT_USER,
+ 		.set	= "USR",
+ 	}, {
+-		.mask	= L_PMD_SECT_RDONLY,
+-		.val	= L_PMD_SECT_RDONLY,
++		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
++		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ 		.set	= "ro",
+ 		.clear	= "RW",
+ #elif __LINUX_ARM_ARCH__ >= 6
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index ad80548325fe..0f6d1537f330 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -639,8 +639,8 @@ static struct section_perm ro_perms[] = {
+ 		.start  = (unsigned long)_stext,
+ 		.end    = (unsigned long)__init_begin,
+ #ifdef CONFIG_ARM_LPAE
+-		.mask   = ~L_PMD_SECT_RDONLY,
+-		.prot   = L_PMD_SECT_RDONLY,
++		.mask   = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
++		.prot   = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ #else
+ 		.mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
+ 		.prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index d8dd3298b15c..fb8d76a17bc5 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -49,6 +49,14 @@
+ 
+ / {
+ 	compatible = "amlogic,meson-gxl";
++
++	reserved-memory {
++		/* Alternate 3 MiB reserved for ARM Trusted Firmware (BL31) */
++		secmon_reserved_alt: secmon@05000000 {
++			reg = <0x0 0x05000000 0x0 0x300000>;
++			no-map;
++		};
++	};
+ };
+ 
+ &ethmac {
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index b46e54c2399b..c9530b5b5ca8 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -98,6 +98,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+ #define pte_valid_young(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
++#define pte_valid_user(pte) \
++	((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+ 
+ /*
+  * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+@@ -107,6 +109,18 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_accessible(mm, pte)	\
+ 	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
+ 
++/*
++ * p??_access_permitted() is true for valid user mappings (subject to the
++ * write permission check) other than user execute-only which do not have the
++ * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
++ */
++#define pte_access_permitted(pte, write) \
++	(pte_valid_user(pte) && (!(write) || pte_write(pte)))
++#define pmd_access_permitted(pmd, write) \
++	(pte_access_permitted(pmd_pte(pmd), (write)))
++#define pud_access_permitted(pud, write) \
++	(pte_access_permitted(pud_pte(pud), (write)))
++
+ static inline pte_t clear_pte_bit(pte_t pte, pgprot_t prot)
+ {
+ 	pte_val(pte) &= ~pgprot_val(prot);
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 5d3284d20678..c3d798b44030 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -65,7 +65,7 @@ config MIPS
+ 	select HAVE_PERF_EVENTS
+ 	select HAVE_REGS_AND_STACK_ACCESS_API
+ 	select HAVE_SYSCALL_TRACEPOINTS
+-	select HAVE_VIRT_CPU_ACCOUNTING_GEN
++	select HAVE_VIRT_CPU_ACCOUNTING_GEN if 64BIT || !SMP
+ 	select IRQ_FORCED_THREADING
+ 	select MODULES_USE_ELF_RELA if MODULES && 64BIT
+ 	select MODULES_USE_ELF_REL if MODULES
+diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c
+index d4f2407a42c6..8307a8a02667 100644
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -331,7 +331,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __initconst = {
+ /* Verified on: WRT54GS V1.0 */
+ static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_type_0101[] __initconst = {
+-	BCM47XX_GPIO_LED(0, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(0, "green", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "green", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+diff --git a/arch/mips/boot/dts/brcm/Makefile b/arch/mips/boot/dts/brcm/Makefile
+index 9e09cc4556b3..398994312361 100644
+--- a/arch/mips/boot/dts/brcm/Makefile
++++ b/arch/mips/boot/dts/brcm/Makefile
+@@ -23,7 +23,6 @@ dtb-$(CONFIG_DT_NONE) += \
+ 	bcm63268-comtrend-vr-3032u.dtb \
+ 	bcm93384wvg.dtb \
+ 	bcm93384wvg_viper.dtb \
+-	bcm96358nb4ser.dtb \
+ 	bcm96368mvwg.dtb \
+ 	bcm9ejtagprb.dtb \
+ 	bcm97125cbmb.dtb \
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 83054f79f72a..feb069cbf44e 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -19,6 +19,9 @@
+ #include <asm/asmmacro-64.h>
+ #endif
+ 
++/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
++#undef fp
++
+ /*
+  * Helper macros for generating raw instruction encodings.
+  */
+@@ -105,6 +108,7 @@
+ 	.macro	fpu_save_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	sdc1	$f1,  THREAD_FPR1(\thread)
+ 	sdc1	$f3,  THREAD_FPR3(\thread)
+@@ -126,8 +130,8 @@
+ 	.endm
+ 
+ 	.macro	fpu_save_double thread status tmp
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	sll	\tmp, \status, 5
+ 	bgez	\tmp, 10f
+ 	fpu_save_16odd \thread
+@@ -163,6 +167,7 @@
+ 	.macro	fpu_restore_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	ldc1	$f1,  THREAD_FPR1(\thread)
+ 	ldc1	$f3,  THREAD_FPR3(\thread)
+@@ -184,8 +189,8 @@
+ 	.endm
+ 
+ 	.macro	fpu_restore_double thread status tmp
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	sll	\tmp, \status, 5
+ 	bgez	\tmp, 10f				# 16 register mode?
+ 
+@@ -234,9 +239,6 @@
+ 	.endm
+ 
+ #ifdef TOOLCHAIN_SUPPORTS_MSA
+-/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+-#undef fp
+-
+ 	.macro	_cfcmsa	rd, cs
+ 	.set	push
+ 	.set	mips32r2
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index 7e25c5cc353a..89e9fb7976fe 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -204,8 +204,10 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+ #else
+ #include <asm-generic/cmpxchg-local.h>
+ #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
++#ifndef CONFIG_SMP
+ #define cmpxchg64(ptr, o, n) cmpxchg64_local((ptr), (o), (n))
+ #endif
++#endif
+ 
+ #undef __scbeqz
+ 
+diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
+index 1395654cfc8d..5a09c2901a76 100644
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -618,6 +618,19 @@ static const struct user_regset_view user_mips64_view = {
+ 	.n		= ARRAY_SIZE(mips64_regsets),
+ };
+ 
++#ifdef CONFIG_MIPS32_N32
++
++static const struct user_regset_view user_mipsn32_view = {
++	.name		= "mipsn32",
++	.e_flags	= EF_MIPS_ABI2,
++	.e_machine	= ELF_ARCH,
++	.ei_osabi	= ELF_OSABI,
++	.regsets	= mips64_regsets,
++	.n		= ARRAY_SIZE(mips64_regsets),
++};
++
++#endif /* CONFIG_MIPS32_N32 */
++
+ #endif /* CONFIG_64BIT */
+ 
+ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+@@ -628,6 +641,10 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+ #ifdef CONFIG_MIPS32_O32
+ 	if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ 		return &user_mips_view;
++#endif
++#ifdef CONFIG_MIPS32_N32
++	if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
++		return &user_mipsn32_view;
+ #endif
+ 	return &user_mips64_view;
+ #endif
+diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
+index 0a83b1708b3c..8e3a6020c613 100644
+--- a/arch/mips/kernel/r4k_fpu.S
++++ b/arch/mips/kernel/r4k_fpu.S
+@@ -40,8 +40,8 @@
+  */
+ LEAF(_save_fp)
+ EXPORT_SYMBOL(_save_fp)
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	mfc0	t0, CP0_STATUS
+ #endif
+ 	fpu_save_double a0 t0 t1		# clobbers t1
+@@ -52,8 +52,8 @@ EXPORT_SYMBOL(_save_fp)
+  * Restore a thread's fp context.
+  */
+ LEAF(_restore_fp)
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	mfc0	t0, CP0_STATUS
+ #endif
+ 	fpu_restore_double a0 t0 t1		# clobbers t1
+@@ -246,11 +246,11 @@ LEAF(_save_fp_context)
+ 	cfc1	t1, fcr31
+ 	.set	pop
+ 
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2) || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2) || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	.set	push
+ 	SET_HARDFLOAT
+-#ifdef CONFIG_CPU_MIPS32_R2
++#ifdef CONFIG_CPU_MIPSR2
+ 	.set	mips32r2
+ 	.set	fp=64
+ 	mfc0	t0, CP0_STATUS
+@@ -314,11 +314,11 @@ LEAF(_save_fp_context)
+ LEAF(_restore_fp_context)
+ 	EX	lw t1, 0(a1)
+ 
+-#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPS32_R2)  || \
+-		defined(CONFIG_CPU_MIPS32_R6)
++#if defined(CONFIG_64BIT) || defined(CONFIG_CPU_MIPSR2)  || \
++		defined(CONFIG_CPU_MIPSR6)
+ 	.set	push
+ 	SET_HARDFLOAT
+-#ifdef CONFIG_CPU_MIPS32_R2
++#ifdef CONFIG_CPU_MIPSR2
+ 	.set	mips32r2
+ 	.set	fp=64
+ 	mfc0	t0, CP0_STATUS
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 16d9ef5a78c5..6f57212f5659 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -1795,7 +1795,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			SPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.s = ieee754sp_maddf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmsubf_op: {
+@@ -1809,7 +1809,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			SPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.s = ieee754sp_msubf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case frint_op: {
+@@ -1834,7 +1834,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.w = ieee754sp_2008class(fs);
+ 			rfmt = w_fmt;
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmin_op: {
+@@ -1847,7 +1847,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmin(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmina_op: {
+@@ -1860,7 +1860,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmina(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmax_op: {
+@@ -1873,7 +1873,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmax(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmaxa_op: {
+@@ -1886,7 +1886,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			SPFROMREG(ft, MIPSInst_FT(ir));
+ 			SPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.s = ieee754sp_fmaxa(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fabs_op:
+@@ -2165,7 +2165,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			DPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.d = ieee754dp_maddf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmsubf_op: {
+@@ -2179,7 +2179,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			DPFROMREG(fd, MIPSInst_FD(ir));
+ 			rv.d = ieee754dp_msubf(fd, fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case frint_op: {
+@@ -2204,7 +2204,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.l = ieee754dp_2008class(fs);
+ 			rfmt = l_fmt;
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmin_op: {
+@@ -2217,7 +2217,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmin(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmina_op: {
+@@ -2230,7 +2230,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmina(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmax_op: {
+@@ -2243,7 +2243,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmax(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fmaxa_op: {
+@@ -2256,7 +2256,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
+ 			DPFROMREG(ft, MIPSInst_FT(ir));
+ 			DPFROMREG(fs, MIPSInst_FS(ir));
+ 			rv.d = ieee754dp_fmaxa(fs, ft);
+-			break;
++			goto copcsr;
+ 		}
+ 
+ 		case fabs_op:
+diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
+index 90fba9bf98da..27ac00c36bc0 100644
+--- a/arch/mips/pci/pci-mt7620.c
++++ b/arch/mips/pci/pci-mt7620.c
+@@ -121,7 +121,7 @@ static int wait_pciephy_busy(void)
+ 		else
+ 			break;
+ 		if (retry++ > WAITRETRY_MAX) {
+-			printk(KERN_WARN "PCIE-PHY retry failed.\n");
++			pr_warn("PCIE-PHY retry failed.\n");
+ 			return -1;
+ 		}
+ 	}
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index 9be8b08ae46b..41b71c4352c2 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -145,8 +145,8 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = {
+ 	FUNC("i2c", 0, 4, 2),
+ };
+ 
+-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
+-static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
++static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) };
++static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) };
+ static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
+ static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
+ 
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 41e60a9c7db2..e775f80ae28c 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -690,15 +690,15 @@ cas_action:
+ 	/* ELF32 Process entry path */
+ lws_compare_and_swap_2:
+ #ifdef CONFIG_64BIT
+-	/* Clip the input registers */
++	/* Clip the input registers. We don't need to clip %r23 as we
++	   only use it for word operations */
+ 	depdi	0, 31, 32, %r26
+ 	depdi	0, 31, 32, %r25
+ 	depdi	0, 31, 32, %r24
+-	depdi	0, 31, 32, %r23
+ #endif
+ 
+ 	/* Check the validity of the size pointer */
+-	subi,>>= 4, %r23, %r0
++	subi,>>= 3, %r23, %r0
+ 	b,n	lws_exit_nosys
+ 
+ 	/* Jump to the functions which will load the old and new values into
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 1c80bd292e48..06598142d755 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -542,7 +542,7 @@ EXC_COMMON_BEGIN(instruction_access_common)
+ 	RECONCILE_IRQ_STATE(r10, r11)
+ 	ld	r12,_MSR(r1)
+ 	ld	r3,_NIP(r1)
+-	andis.	r4,r12,DSISR_BAD_FAULT_64S@h
++	andis.	r4,r12,DSISR_SRR1_MATCH_64S@h
+ 	li	r5,0x400
+ 	std	r3,_DAR(r1)
+ 	std	r4,_DSISR(r1)
+diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
+index e9436c5e1e09..3d7539b90010 100644
+--- a/arch/powerpc/kernel/signal.c
++++ b/arch/powerpc/kernel/signal.c
+@@ -103,7 +103,7 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka,
+ static void do_signal(struct task_struct *tsk)
+ {
+ 	sigset_t *oldset = sigmask_to_save();
+-	struct ksignal ksig;
++	struct ksignal ksig = { .sig = 0 };
+ 	int ret;
+ 	int is32 = is_32bit_task();
+ 
+diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
+index 90644db9d38e..8e0cf8f186df 100644
+--- a/arch/powerpc/kvm/book3s_hv_builtin.c
++++ b/arch/powerpc/kvm/book3s_hv_builtin.c
+@@ -529,6 +529,8 @@ static inline bool is_rm(void)
+ 
+ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_xirr(vcpu);
+@@ -541,6 +543,8 @@ unsigned long kvmppc_rm_h_xirr(struct kvm_vcpu *vcpu)
+ 
+ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	vcpu->arch.gpr[5] = get_tb();
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+@@ -554,6 +558,8 @@ unsigned long kvmppc_rm_h_xirr_x(struct kvm_vcpu *vcpu)
+ 
+ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_ipoll(vcpu, server);
+@@ -567,6 +573,8 @@ unsigned long kvmppc_rm_h_ipoll(struct kvm_vcpu *vcpu, unsigned long server)
+ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
+ 		    unsigned long mfrr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_ipi(vcpu, server, mfrr);
+@@ -579,6 +587,8 @@ int kvmppc_rm_h_ipi(struct kvm_vcpu *vcpu, unsigned long server,
+ 
+ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_cppr(vcpu, cppr);
+@@ -591,6 +601,8 @@ int kvmppc_rm_h_cppr(struct kvm_vcpu *vcpu, unsigned long cppr)
+ 
+ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr)
+ {
++	if (!kvmppc_xics_enabled(vcpu))
++		return H_TOO_HARD;
+ 	if (xive_enabled()) {
+ 		if (is_rm())
+ 			return xive_rm_h_eoi(vcpu, xirr);
+diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
+index c9de03e0c1f1..d469224c4ada 100644
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -21,6 +21,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/page.h>
+ #include <asm/code-patching.h>
++#include <asm/setup.h>
+ 
+ static int __patch_instruction(unsigned int *addr, unsigned int instr)
+ {
+@@ -146,11 +147,8 @@ int patch_instruction(unsigned int *addr, unsigned int instr)
+ 	 * During early early boot patch_instruction is called
+ 	 * when text_poke_area is not ready, but we still need
+ 	 * to allow patching. We just do the plain old patching
+-	 * We use slab_is_available and per cpu read * via this_cpu_read
+-	 * of text_poke_area. Per-CPU areas might not be up early
+-	 * this can create problems with just using this_cpu_read()
+ 	 */
+-	if (!slab_is_available() || !this_cpu_read(text_poke_area))
++	if (!this_cpu_read(*PTRRELOC(&text_poke_area)))
+ 		return __patch_instruction(addr, instr);
+ 
+ 	local_irq_save(flags);
+diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
+index 558e9d3891bf..bd022d16745c 100644
+--- a/arch/powerpc/mm/hugetlbpage-radix.c
++++ b/arch/powerpc/mm/hugetlbpage-radix.c
+@@ -49,17 +49,28 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+ 	struct hstate *h = hstate_file(file);
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
+-	if (unlikely(addr > mm->context.addr_limit && addr < TASK_SIZE))
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > mm->task_size)
++	if (len > high_limit)
+ 		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
+ 
+-	if (flags & MAP_FIXED) {
++	if (unlikely(addr > mm->context.addr_limit &&
++		     mm->context.addr_limit != TASK_SIZE))
++		mm->context.addr_limit = TASK_SIZE;
++
++	if (fixed) {
+ 		if (prepare_hugepage_range(file, addr, len))
+ 			return -EINVAL;
+ 		return addr;
+@@ -68,7 +79,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr &&
++		if (high_limit - len >= addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -79,12 +90,9 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = PAGE_SIZE;
+-	info.high_limit = current->mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
+ 	info.align_offset = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
+index 5d78b193fec4..6d476a7b5611 100644
+--- a/arch/powerpc/mm/mmap.c
++++ b/arch/powerpc/mm/mmap.c
+@@ -106,22 +106,32 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ {
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -129,13 +139,9 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.flags = 0;
+ 	info.length = len;
+ 	info.low_limit = mm->mmap_base;
++	info.high_limit = high_limit;
+ 	info.align_mask = 0;
+ 
+-	if (unlikely(addr > DEFAULT_MAP_WINDOW))
+-		info.high_limit = mm->context.addr_limit;
+-	else
+-		info.high_limit = DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+ 
+@@ -149,37 +155,42 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long addr = addr0;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	/* requested length too big for entire address space */
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+-	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
+-				(!vma || addr + len <= vm_start_gap(vma)))
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
++		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+-	info.high_limit = mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	addr = vm_unmapped_area(&info);
+ 	if (!(addr & ~PAGE_MASK))
+ 		return addr;
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index 05e15386d4cb..b94fb62e60fd 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -93,11 +93,11 @@ static int hash__init_new_context(struct mm_struct *mm)
+ 		return index;
+ 
+ 	/*
+-	 * We do switch_slb() early in fork, even before we setup the
+-	 * mm->context.addr_limit. Default to max task size so that we copy the
+-	 * default values to paca which will help us to handle slb miss early.
++	 * In the case of exec, use the default limit,
++	 * otherwise inherit it from the mm we are duplicating.
+ 	 */
+-	mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
++	if (!mm->context.addr_limit)
++		mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
+ 
+ 	/*
+ 	 * The old code would re-promote on fork, we don't do that when using
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 39c252b54d16..cfbbee941a76 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -169,6 +169,16 @@ void radix__mark_rodata_ro(void)
+ {
+ 	unsigned long start, end;
+ 
++	/*
++	 * mark_rodata_ro() will mark itself as !writable at some point.
++	 * Due to DD1 workaround in radix__pte_update(), we'll end up with
++	 * an invalid pte and the system will crash quite severly.
++	 */
++	if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
++		pr_warn("Warning: Unable to mark rodata read only on P9 DD1\n");
++		return;
++	}
++
+ 	start = (unsigned long)_stext;
+ 	end = (unsigned long)__init_begin;
+ 
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 45f6740dd407..a4f93699194b 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -96,7 +96,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
+ {
+ 	struct vm_area_struct *vma;
+ 
+-	if ((mm->task_size - len) < addr)
++	if ((mm->context.addr_limit - len) < addr)
+ 		return 0;
+ 	vma = find_vma(mm, addr);
+ 	return (!vma || (addr + len) <= vm_start_gap(vma));
+@@ -133,7 +133,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret)
+ 		if (!slice_low_has_vma(mm, i))
+ 			ret->low_slices |= 1u << i;
+ 
+-	if (mm->task_size <= SLICE_LOW_TOP)
++	if (mm->context.addr_limit <= SLICE_LOW_TOP)
+ 		return;
+ 
+ 	for (i = 0; i < GET_HIGH_SLICE_INDEX(mm->context.addr_limit); i++)
+@@ -412,25 +412,31 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	struct slice_mask compat_mask;
+ 	int fixed = (flags & MAP_FIXED);
+ 	int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
++	unsigned long page_size = 1UL << pshift;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long newaddr;
+ 	unsigned long high_limit;
+ 
+-	/*
+-	 * Check if we need to expland slice area.
+-	 */
+-	if (unlikely(addr > mm->context.addr_limit &&
+-		     mm->context.addr_limit != TASK_SIZE)) {
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (len & (page_size - 1))
++		return -EINVAL;
++	if (fixed) {
++		if (addr & (page_size - 1))
++			return -EINVAL;
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
++	if (high_limit > mm->context.addr_limit) {
++		mm->context.addr_limit = high_limit;
+ 		on_each_cpu(slice_flush_segments, mm, 1);
+ 	}
+-	/*
+-	 * This mmap request can allocate upt to 512TB
+-	 */
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		high_limit = mm->context.addr_limit;
+-	else
+-		high_limit = DEFAULT_MAP_WINDOW;
++
+ 	/*
+ 	 * init different masks
+ 	 */
+@@ -446,27 +452,19 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 
+ 	/* Sanity checks */
+ 	BUG_ON(mm->task_size == 0);
++	BUG_ON(mm->context.addr_limit == 0);
+ 	VM_BUG_ON(radix_enabled());
+ 
+ 	slice_dbg("slice_get_unmapped_area(mm=%p, psize=%d...\n", mm, psize);
+ 	slice_dbg(" addr=%lx, len=%lx, flags=%lx, topdown=%d\n",
+ 		  addr, len, flags, topdown);
+ 
+-	if (len > mm->task_size)
+-		return -ENOMEM;
+-	if (len & ((1ul << pshift) - 1))
+-		return -EINVAL;
+-	if (fixed && (addr & ((1ul << pshift) - 1)))
+-		return -EINVAL;
+-	if (fixed && addr > (mm->task_size - len))
+-		return -ENOMEM;
+-
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+-		addr = _ALIGN_UP(addr, 1ul << pshift);
++		addr = _ALIGN_UP(addr, page_size);
+ 		slice_dbg(" aligned addr=%lx\n", addr);
+ 		/* Ignore hint if it's too large or overlaps a VMA */
+-		if (addr > mm->task_size - len ||
++		if (addr > high_limit - len ||
+ 		    !slice_area_is_free(mm, addr, len))
+ 			addr = 0;
+ 	}
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 36344117c680..cf64e16f92c2 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -467,7 +467,7 @@ static int nest_imc_event_init(struct perf_event *event)
+ 	 * Nest HW counter memory resides in a per-chip reserve-memory (HOMER).
+ 	 * Get the base memory addresss for this cpu.
+ 	 */
+-	chip_id = topology_physical_package_id(event->cpu);
++	chip_id = cpu_to_chip_id(event->cpu);
+ 	pcni = pmu->mem_info;
+ 	do {
+ 		if (pcni->id == chip_id) {
+@@ -524,19 +524,19 @@ static int nest_imc_event_init(struct perf_event *event)
+  */
+ static int core_imc_mem_init(int cpu, int size)
+ {
+-	int phys_id, rc = 0, core_id = (cpu / threads_per_core);
++	int nid, rc = 0, core_id = (cpu / threads_per_core);
+ 	struct imc_mem_info *mem_info;
+ 
+ 	/*
+ 	 * alloc_pages_node() will allocate memory for core in the
+ 	 * local node only.
+ 	 */
+-	phys_id = topology_physical_package_id(cpu);
++	nid = cpu_to_node(cpu);
+ 	mem_info = &core_imc_pmu->mem_info[core_id];
+ 	mem_info->id = core_id;
+ 
+ 	/* We need only vbase for core counters */
+-	mem_info->vbase = page_address(alloc_pages_node(phys_id,
++	mem_info->vbase = page_address(alloc_pages_node(nid,
+ 					  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+ 					  __GFP_NOWARN, get_order(size)));
+ 	if (!mem_info->vbase)
+@@ -797,14 +797,14 @@ static int core_imc_event_init(struct perf_event *event)
+ static int thread_imc_mem_alloc(int cpu_id, int size)
+ {
+ 	u64 ldbar_value, *local_mem = per_cpu(thread_imc_mem, cpu_id);
+-	int phys_id = topology_physical_package_id(cpu_id);
++	int nid = cpu_to_node(cpu_id);
+ 
+ 	if (!local_mem) {
+ 		/*
+ 		 * This case could happen only once at start, since we dont
+ 		 * free the memory in cpu offline path.
+ 		 */
+-		local_mem = page_address(alloc_pages_node(phys_id,
++		local_mem = page_address(alloc_pages_node(nid,
+ 				  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+ 				  __GFP_NOWARN, get_order(size)));
+ 		if (!local_mem)
+diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
+index c21fe1d57c00..ec7b476c1ac5 100644
+--- a/arch/s390/include/asm/switch_to.h
++++ b/arch/s390/include/asm/switch_to.h
+@@ -37,8 +37,8 @@ static inline void restore_access_regs(unsigned int *acrs)
+ 		save_ri_cb(prev->thread.ri_cb);				\
+ 		save_gs_cb(prev->thread.gs_cb);				\
+ 	}								\
++	update_cr_regs(next);						\
+ 	if (next->mm) {							\
+-		update_cr_regs(next);					\
+ 		set_cpu_flag(CIF_FPU);					\
+ 		restore_access_regs(&next->thread.acrs[0]);		\
+ 		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index f7e82302a71e..2394557653d5 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -1548,6 +1548,7 @@ static struct s390_insn opcode_e7[] = {
+ 	{ "vfsq", 0xce, INSTR_VRR_VV000MM },
+ 	{ "vfs", 0xe2, INSTR_VRR_VVV00MM },
+ 	{ "vftci", 0x4a, INSTR_VRI_VVIMM },
++	{ "", 0, INSTR_INVALID }
+ };
+ 
+ static struct s390_insn opcode_eb[] = {
+@@ -1953,7 +1954,7 @@ void show_code(struct pt_regs *regs)
+ {
+ 	char *mode = user_mode(regs) ? "User" : "Krnl";
+ 	unsigned char code[64];
+-	char buffer[64], *ptr;
++	char buffer[128], *ptr;
+ 	mm_segment_t old_fs;
+ 	unsigned long addr;
+ 	int start, end, opsize, hops, i;
+@@ -2016,7 +2017,7 @@ void show_code(struct pt_regs *regs)
+ 		start += opsize;
+ 		pr_cont("%s", buffer);
+ 		ptr = buffer;
+-		ptr += sprintf(ptr, "\n          ");
++		ptr += sprintf(ptr, "\n\t  ");
+ 		hops++;
+ 	}
+ 	pr_cont("\n");
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index b945448b9eae..f7b280f0ab16 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -375,8 +375,10 @@ static __init void detect_machine_facilities(void)
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_IDTE;
+ 	if (test_facility(40))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_LPP;
+-	if (test_facility(50) && test_facility(73))
++	if (test_facility(50) && test_facility(73)) {
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TE;
++		__ctl_set_bit(0, 55);
++	}
+ 	if (test_facility(51))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_LC;
+ 	if (test_facility(129)) {
+diff --git a/arch/s390/kernel/guarded_storage.c b/arch/s390/kernel/guarded_storage.c
+index bff39b66c9ff..9ee794e14f33 100644
+--- a/arch/s390/kernel/guarded_storage.c
++++ b/arch/s390/kernel/guarded_storage.c
+@@ -14,9 +14,11 @@
+ 
+ void exit_thread_gs(void)
+ {
++	preempt_disable();
+ 	kfree(current->thread.gs_cb);
+ 	kfree(current->thread.gs_bc_cb);
+ 	current->thread.gs_cb = current->thread.gs_bc_cb = NULL;
++	preempt_enable();
+ }
+ 
+ static int gs_enable(void)
+diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
+index b0ba2c26b45e..d6f7782e75c9 100644
+--- a/arch/s390/kernel/machine_kexec.c
++++ b/arch/s390/kernel/machine_kexec.c
+@@ -269,6 +269,7 @@ static void __do_machine_kexec(void *data)
+ 	s390_reset_system();
+ 	data_mover = (relocate_kernel_t) page_to_phys(image->control_code_page);
+ 
++	__arch_local_irq_stnsm(0xfb); /* disable DAT - avoid no-execute */
+ 	/* Call the moving routine */
+ 	(*data_mover)(&image->head, image->start);
+ 
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index a4a84fb08046..203b7cd7c348 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -100,6 +100,7 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long new_stackp,
+ 	memset(&p->thread.per_user, 0, sizeof(p->thread.per_user));
+ 	memset(&p->thread.per_event, 0, sizeof(p->thread.per_event));
+ 	clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
++	p->thread.per_flags = 0;
+ 	/* Initialize per thread user and system timer values */
+ 	p->thread.user_timer = 0;
+ 	p->thread.guest_timer = 0;
+diff --git a/arch/s390/kernel/relocate_kernel.S b/arch/s390/kernel/relocate_kernel.S
+index ca37e5d5b40c..9c2c96da23d0 100644
+--- a/arch/s390/kernel/relocate_kernel.S
++++ b/arch/s390/kernel/relocate_kernel.S
+@@ -29,7 +29,6 @@
+ ENTRY(relocate_kernel)
+ 		basr	%r13,0		# base address
+ 	.base:
+-		stnsm	sys_msk-.base(%r13),0xfb	# disable DAT
+ 		stctg	%c0,%c15,ctlregs-.base(%r13)
+ 		stmg	%r0,%r15,gprregs-.base(%r13)
+ 		lghi	%r0,3
+@@ -103,8 +102,6 @@ ENTRY(relocate_kernel)
+ 		.align	8
+ 	load_psw:
+ 		.long	0x00080000,0x80000000
+-	sys_msk:
+-		.quad	0
+ 	ctlregs:
+ 		.rept	16
+ 		.quad	0
+diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
+index 32aefb215e59..d85c64821a6b 100644
+--- a/arch/s390/kernel/runtime_instr.c
++++ b/arch/s390/kernel/runtime_instr.c
+@@ -50,11 +50,13 @@ void exit_thread_runtime_instr(void)
+ {
+ 	struct task_struct *task = current;
+ 
++	preempt_disable();
+ 	if (!task->thread.ri_cb)
+ 		return;
+ 	disable_runtime_instr();
+ 	kfree(task->thread.ri_cb);
+ 	task->thread.ri_cb = NULL;
++	preempt_enable();
+ }
+ 
+ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+@@ -65,9 +67,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (command == S390_RUNTIME_INSTR_STOP) {
+-		preempt_disable();
+ 		exit_thread_runtime_instr();
+-		preempt_enable();
+ 		return 0;
+ 	}
+ 
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index bcfc5668dcb2..518d9286b3d1 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -51,15 +51,19 @@ ENTRY(native_usergs_sysret64)
+ END(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
+-.macro TRACE_IRQS_IRETQ
++.macro TRACE_IRQS_FLAGS flags:req
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
++	bt	$9, \flags		/* interrupts off? */
+ 	jnc	1f
+ 	TRACE_IRQS_ON
+ 1:
+ #endif
+ .endm
+ 
++.macro TRACE_IRQS_IRETQ
++	TRACE_IRQS_FLAGS EFLAGS(%rsp)
++.endm
++
+ /*
+  * When dynamic function tracer is enabled it will add a breakpoint
+  * to all locations that it is about to modify, sync CPUs, update
+@@ -148,8 +152,6 @@ ENTRY(entry_SYSCALL_64)
+ 	movq	%rsp, PER_CPU_VAR(rsp_scratch)
+ 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+ 
+-	TRACE_IRQS_OFF
+-
+ 	/* Construct struct pt_regs on stack */
+ 	pushq	$__USER_DS			/* pt_regs->ss */
+ 	pushq	PER_CPU_VAR(rsp_scratch)	/* pt_regs->sp */
+@@ -170,6 +172,8 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ 	sub	$(6*8), %rsp			/* pt_regs->bp, bx, r12-15 not saved */
+ 	UNWIND_HINT_REGS extra=0
+ 
++	TRACE_IRQS_OFF
++
+ 	/*
+ 	 * If we need to do entry work or if we guess we'll need to do
+ 	 * exit work, go straight to the slow path.
+@@ -923,11 +927,13 @@ ENTRY(native_load_gs_index)
+ 	FRAME_BEGIN
+ 	pushfq
+ 	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
++	TRACE_IRQS_OFF
+ 	SWAPGS
+ .Lgs_change:
+ 	movl	%edi, %gs
+ 2:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
+ 	SWAPGS
++	TRACE_IRQS_FLAGS (%rsp)
+ 	popfq
+ 	FRAME_END
+ 	ret
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 9fb9a1f1e47b..f94855000d4e 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3730,6 +3730,19 @@ EVENT_ATTR_STR(cycles-t,	cycles_t,	"event=0x3c,in_tx=1");
+ EVENT_ATTR_STR(cycles-ct,	cycles_ct,	"event=0x3c,in_tx=1,in_tx_cp=1");
+ 
+ static struct attribute *hsw_events_attrs[] = {
++	EVENT_PTR(mem_ld_hsw),
++	EVENT_PTR(mem_st_hsw),
++	EVENT_PTR(td_slots_issued),
++	EVENT_PTR(td_slots_retired),
++	EVENT_PTR(td_fetch_bubbles),
++	EVENT_PTR(td_total_slots),
++	EVENT_PTR(td_total_slots_scale),
++	EVENT_PTR(td_recovery_bubbles),
++	EVENT_PTR(td_recovery_bubbles_scale),
++	NULL
++};
++
++static struct attribute *hsw_tsx_events_attrs[] = {
+ 	EVENT_PTR(tx_start),
+ 	EVENT_PTR(tx_commit),
+ 	EVENT_PTR(tx_abort),
+@@ -3742,18 +3755,16 @@ static struct attribute *hsw_events_attrs[] = {
+ 	EVENT_PTR(el_conflict),
+ 	EVENT_PTR(cycles_t),
+ 	EVENT_PTR(cycles_ct),
+-	EVENT_PTR(mem_ld_hsw),
+-	EVENT_PTR(mem_st_hsw),
+-	EVENT_PTR(td_slots_issued),
+-	EVENT_PTR(td_slots_retired),
+-	EVENT_PTR(td_fetch_bubbles),
+-	EVENT_PTR(td_total_slots),
+-	EVENT_PTR(td_total_slots_scale),
+-	EVENT_PTR(td_recovery_bubbles),
+-	EVENT_PTR(td_recovery_bubbles_scale),
+ 	NULL
+ };
+ 
++static __init struct attribute **get_hsw_events_attrs(void)
++{
++	return boot_cpu_has(X86_FEATURE_RTM) ?
++		merge_attr(hsw_events_attrs, hsw_tsx_events_attrs) :
++		hsw_events_attrs;
++}
++
+ static ssize_t freeze_on_smi_show(struct device *cdev,
+ 				  struct device_attribute *attr,
+ 				  char *buf)
+@@ -4182,7 +4193,7 @@ __init int intel_pmu_init(void)
+ 
+ 		x86_pmu.hw_config = hsw_hw_config;
+ 		x86_pmu.get_event_constraints = hsw_get_event_constraints;
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		x86_pmu.lbr_double_abort = true;
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+@@ -4221,7 +4232,7 @@ __init int intel_pmu_init(void)
+ 
+ 		x86_pmu.hw_config = hsw_hw_config;
+ 		x86_pmu.get_event_constraints = hsw_get_event_constraints;
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		x86_pmu.limit_period = bdw_limit_period;
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+@@ -4279,7 +4290,7 @@ __init int intel_pmu_init(void)
+ 		extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ 			hsw_format_attr : nhm_format_attr;
+ 		extra_attr = merge_attr(extra_attr, skl_format_attr);
+-		x86_pmu.cpu_events = hsw_events_attrs;
++		x86_pmu.cpu_events = get_hsw_events_attrs();
+ 		intel_pmu_pebs_data_source_skl(
+ 			boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
+ 		pr_cont("Skylake events, ");
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index 410c5dadcee3..3a4b12809ab5 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -431,6 +431,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
+ }
+ 
+ static unsigned long mpf_base;
++static bool mpf_found;
+ 
+ static unsigned long __init get_mpc_size(unsigned long physptr)
+ {
+@@ -504,7 +505,7 @@ void __init default_get_smp_config(unsigned int early)
+ 	if (!smp_found_config)
+ 		return;
+ 
+-	if (!mpf_base)
++	if (!mpf_found)
+ 		return;
+ 
+ 	if (acpi_lapic && early)
+@@ -593,6 +594,7 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
+ 			smp_found_config = 1;
+ #endif
+ 			mpf_base = base;
++			mpf_found = true;
+ 
+ 			pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
+ 				base, base + sizeof(*mpf) - 1, mpf);
+@@ -858,7 +860,7 @@ static int __init update_mp_table(void)
+ 	if (!enable_update_mptable)
+ 		return 0;
+ 
+-	if (!mpf_base)
++	if (!mpf_found)
+ 		return 0;
+ 
+ 	mpf = early_memremap(mpf_base, sizeof(*mpf));
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 0e68f0b3cbf7..ca209a4a7834 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3657,6 +3657,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ 	u32 ecx = msr->index;
+ 	u64 data = msr->data;
+ 	switch (ecx) {
++	case MSR_IA32_CR_PAT:
++		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++			return 1;
++		vcpu->arch.pat = data;
++		svm->vmcb->save.g_pat = data;
++		mark_dirty(svm->vmcb, VMCB_NPT);
++		break;
+ 	case MSR_IA32_TSC:
+ 		kvm_write_tsc(vcpu, msr);
+ 		break;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a6f4f095f8f4..21cad7068cbf 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -202,6 +202,10 @@ struct loaded_vmcs {
+ 	bool nmi_known_unmasked;
+ 	unsigned long vmcs_host_cr3;	/* May not match real cr3 */
+ 	unsigned long vmcs_host_cr4;	/* May not match real cr4 */
++	/* Support for vnmi-less CPUs */
++	int soft_vnmi_blocked;
++	ktime_t entry_time;
++	s64 vnmi_blocked_time;
+ 	struct list_head loaded_vmcss_on_cpu_link;
+ };
+ 
+@@ -1286,6 +1290,11 @@ static inline bool cpu_has_vmx_invpcid(void)
+ 		SECONDARY_EXEC_ENABLE_INVPCID;
+ }
+ 
++static inline bool cpu_has_virtual_nmis(void)
++{
++	return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
+ static inline bool cpu_has_vmx_wbinvd_exit(void)
+ {
+ 	return vmcs_config.cpu_based_2nd_exec_ctrl &
+@@ -1343,11 +1352,6 @@ static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+ 		(vmcs12->secondary_vm_exec_control & bit);
+ }
+ 
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+-	return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+ static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+ {
+ 	return vmcs12->pin_based_vm_exec_control &
+@@ -3699,9 +3703,9 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+ 				&_vmexit_control) < 0)
+ 		return -EIO;
+ 
+-	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING |
+-		PIN_BASED_VIRTUAL_NMIS;
+-	opt = PIN_BASED_POSTED_INTR | PIN_BASED_VMX_PREEMPTION_TIMER;
++	min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++	opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++		 PIN_BASED_VMX_PREEMPTION_TIMER;
+ 	if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+ 				&_pin_based_exec_control) < 0)
+ 		return -EIO;
+@@ -5667,7 +5671,8 @@ static void enable_irq_window(struct kvm_vcpu *vcpu)
+ 
+ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ {
+-	if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++	if (!cpu_has_virtual_nmis() ||
++	    vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+ 		enable_irq_window(vcpu);
+ 		return;
+ 	}
+@@ -5707,6 +5712,19 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
++	if (!cpu_has_virtual_nmis()) {
++		/*
++		 * Tracking the NMI-blocked state in software is built upon
++		 * finding the next open IRQ window. This, in turn, depends on
++		 * well-behaving guests: They have to keep IRQs disabled at
++		 * least as long as the NMI handler runs. Otherwise we may
++		 * cause NMI nesting, maybe breaking the guest. But as this is
++		 * highly unlikely, we can live with the residual risk.
++		 */
++		vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++		vmx->loaded_vmcs->vnmi_blocked_time = 0;
++	}
++
+ 	++vcpu->stat.nmi_injections;
+ 	vmx->loaded_vmcs->nmi_known_unmasked = false;
+ 
+@@ -5725,6 +5743,8 @@ static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	bool masked;
+ 
++	if (!cpu_has_virtual_nmis())
++		return vmx->loaded_vmcs->soft_vnmi_blocked;
+ 	if (vmx->loaded_vmcs->nmi_known_unmasked)
+ 		return false;
+ 	masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+@@ -5736,13 +5756,20 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 
+-	vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+-	if (masked)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+-				GUEST_INTR_STATE_NMI);
++	if (!cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++			vmx->loaded_vmcs->vnmi_blocked_time = 0;
++		}
++	} else {
++		vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++		if (masked)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++					GUEST_INTR_STATE_NMI);
++	}
+ }
+ 
+ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+@@ -5750,6 +5777,10 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+ 	if (to_vmx(vcpu)->nested.nested_run_pending)
+ 		return 0;
+ 
++	if (!cpu_has_virtual_nmis() &&
++	    to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++		return 0;
++
+ 	return	!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ 		  (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+ 		   | GUEST_INTR_STATE_NMI));
+@@ -6478,6 +6509,7 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
+ 	 * AAK134, BY25.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+ 
+@@ -6961,7 +6993,7 @@ static struct loaded_vmcs *nested_get_current_vmcs02(struct vcpu_vmx *vmx)
+ 	}
+ 
+ 	/* Create a new VMCS */
+-	item = kmalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
++	item = kzalloc(sizeof(struct vmcs02_list), GFP_KERNEL);
+ 	if (!item)
+ 		return NULL;
+ 	item->vmcs02.vmcs = alloc_vmcs();
+@@ -7978,6 +8010,7 @@ static int handle_pml_full(struct kvm_vcpu *vcpu)
+ 	 * "blocked by NMI" bit has to be set before next VM entry.
+ 	 */
+ 	if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++			cpu_has_virtual_nmis() &&
+ 			(exit_qualification & INTR_INFO_UNBLOCK_NMI))
+ 		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+ 				GUEST_INTR_STATE_NMI);
+@@ -8822,6 +8855,25 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ 		return 0;
+ 	}
+ 
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked)) {
++		if (vmx_interrupt_allowed(vcpu)) {
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		} else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++			   vcpu->arch.nmi_pending) {
++			/*
++			 * This CPU don't support us in finding the end of an
++			 * NMI-blocked window if the guest runs with IRQs
++			 * disabled. So we pull the trigger after 1 s of
++			 * futile waiting, but inform the user about this.
++			 */
++			printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++			       "state on VCPU %d after 1 s timeout\n",
++			       __func__, vcpu->vcpu_id);
++			vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++		}
++	}
++
+ 	if (exit_reason < kvm_vmx_max_exit_handlers
+ 	    && kvm_vmx_exit_handlers[exit_reason])
+ 		return kvm_vmx_exit_handlers[exit_reason](vcpu);
+@@ -9104,33 +9156,38 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+ 
+ 	idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+ 
+-	if (vmx->loaded_vmcs->nmi_known_unmasked)
+-		return;
+-	/*
+-	 * Can't use vmx->exit_intr_info since we're not sure what
+-	 * the exit reason is.
+-	 */
+-	exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-	unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+-	vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+-	/*
+-	 * SDM 3: 27.7.1.2 (September 2008)
+-	 * Re-set bit "block by NMI" before VM entry if vmexit caused by
+-	 * a guest IRET fault.
+-	 * SDM 3: 23.2.2 (September 2008)
+-	 * Bit 12 is undefined in any of the following cases:
+-	 *  If the VM exit sets the valid bit in the IDT-vectoring
+-	 *   information field.
+-	 *  If the VM exit is due to a double fault.
+-	 */
+-	if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+-	    vector != DF_VECTOR && !idtv_info_valid)
+-		vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+-			      GUEST_INTR_STATE_NMI);
+-	else
+-		vmx->loaded_vmcs->nmi_known_unmasked =
+-			!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+-			  & GUEST_INTR_STATE_NMI);
++	if (cpu_has_virtual_nmis()) {
++		if (vmx->loaded_vmcs->nmi_known_unmasked)
++			return;
++		/*
++		 * Can't use vmx->exit_intr_info since we're not sure what
++		 * the exit reason is.
++		 */
++		exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++		unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++		vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++		/*
++		 * SDM 3: 27.7.1.2 (September 2008)
++		 * Re-set bit "block by NMI" before VM entry if vmexit caused by
++		 * a guest IRET fault.
++		 * SDM 3: 23.2.2 (September 2008)
++		 * Bit 12 is undefined in any of the following cases:
++		 *  If the VM exit sets the valid bit in the IDT-vectoring
++		 *   information field.
++		 *  If the VM exit is due to a double fault.
++		 */
++		if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++		    vector != DF_VECTOR && !idtv_info_valid)
++			vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++				      GUEST_INTR_STATE_NMI);
++		else
++			vmx->loaded_vmcs->nmi_known_unmasked =
++				!(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++				  & GUEST_INTR_STATE_NMI);
++	} else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->vnmi_blocked_time +=
++			ktime_to_ns(ktime_sub(ktime_get(),
++					      vmx->loaded_vmcs->entry_time));
+ }
+ 
+ static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+@@ -9247,6 +9304,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	unsigned long debugctlmsr, cr3, cr4;
+ 
++	/* Record the guest's net vcpu time for enforced NMI injections. */
++	if (unlikely(!cpu_has_virtual_nmis() &&
++		     vmx->loaded_vmcs->soft_vnmi_blocked))
++		vmx->loaded_vmcs->entry_time = ktime_get();
++
+ 	/* Don't enter VMX if guest state is invalid, let the exit handler
+ 	   start emulation until we arrive back to a valid state */
+ 	if (vmx->emulation_required)
+@@ -11325,6 +11387,8 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ 	vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
+ 	vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
+ 	vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
++	vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
++	vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
+ 
+ 	/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1.  */
+ 	if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 12e377184ee4..c4d55919fac1 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -896,7 +896,7 @@ EndTable
+ 
+ GrpTable: Grp3_1
+ 0: TEST Eb,Ib
+-1:
++1: TEST Eb,Ib
+ 2: NOT Eb
+ 3: NEG Eb
+ 4: MUL AL,Eb
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 048be4aa6024..33ee583cfe45 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -333,6 +333,7 @@ EXPORT_SYMBOL(blk_stop_queue);
+ void blk_sync_queue(struct request_queue *q)
+ {
+ 	del_timer_sync(&q->timeout);
++	cancel_work_sync(&q->timeout_work);
+ 
+ 	if (q->mq_ops) {
+ 		struct blk_mq_hw_ctx *hctx;
+@@ -844,6 +845,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
+ 	setup_timer(&q->backing_dev_info->laptop_mode_wb_timer,
+ 		    laptop_mode_timer_fn, (unsigned long) q);
+ 	setup_timer(&q->timeout, blk_rq_timed_out_timer, (unsigned long) q);
++	INIT_WORK(&q->timeout_work, NULL);
+ 	INIT_LIST_HEAD(&q->queue_head);
+ 	INIT_LIST_HEAD(&q->timeout_list);
+ 	INIT_LIST_HEAD(&q->icq_list);
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index 17ec83bb0900..6427be7ac363 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -134,8 +134,6 @@ void blk_timeout_work(struct work_struct *work)
+ 	struct request *rq, *tmp;
+ 	int next_set = 0;
+ 
+-	if (blk_queue_enter(q, true))
+-		return;
+ 	spin_lock_irqsave(q->queue_lock, flags);
+ 
+ 	list_for_each_entry_safe(rq, tmp, &q->timeout_list, timeout_list)
+@@ -145,7 +143,6 @@ void blk_timeout_work(struct work_struct *work)
+ 		mod_timer(&q->timeout, round_jiffies_up(next));
+ 
+ 	spin_unlock_irqrestore(q->queue_lock, flags);
+-	blk_queue_exit(q);
+ }
+ 
+ /**
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index fbcc73f7a099..18af71057b44 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -387,6 +387,7 @@ EXPORT_SYMBOL(acpi_bus_power_manageable);
+ 
+ #ifdef CONFIG_PM
+ static DEFINE_MUTEX(acpi_pm_notifier_lock);
++static DEFINE_MUTEX(acpi_pm_notifier_install_lock);
+ 
+ void acpi_pm_wakeup_event(struct device *dev)
+ {
+@@ -443,24 +444,25 @@ acpi_status acpi_add_pm_notifier(struct acpi_device *adev, struct device *dev,
+ 	if (!dev && !func)
+ 		return AE_BAD_PARAMETER;
+ 
+-	mutex_lock(&acpi_pm_notifier_lock);
++	mutex_lock(&acpi_pm_notifier_install_lock);
+ 
+ 	if (adev->wakeup.flags.notifier_present)
+ 		goto out;
+ 
+-	adev->wakeup.ws = wakeup_source_register(dev_name(&adev->dev));
+-	adev->wakeup.context.dev = dev;
+-	adev->wakeup.context.func = func;
+-
+ 	status = acpi_install_notify_handler(adev->handle, ACPI_SYSTEM_NOTIFY,
+ 					     acpi_pm_notify_handler, NULL);
+ 	if (ACPI_FAILURE(status))
+ 		goto out;
+ 
++	mutex_lock(&acpi_pm_notifier_lock);
++	adev->wakeup.ws = wakeup_source_register(dev_name(&adev->dev));
++	adev->wakeup.context.dev = dev;
++	adev->wakeup.context.func = func;
+ 	adev->wakeup.flags.notifier_present = true;
++	mutex_unlock(&acpi_pm_notifier_lock);
+ 
+  out:
+-	mutex_unlock(&acpi_pm_notifier_lock);
++	mutex_unlock(&acpi_pm_notifier_install_lock);
+ 	return status;
+ }
+ 
+@@ -472,7 +474,7 @@ acpi_status acpi_remove_pm_notifier(struct acpi_device *adev)
+ {
+ 	acpi_status status = AE_BAD_PARAMETER;
+ 
+-	mutex_lock(&acpi_pm_notifier_lock);
++	mutex_lock(&acpi_pm_notifier_install_lock);
+ 
+ 	if (!adev->wakeup.flags.notifier_present)
+ 		goto out;
+@@ -483,14 +485,15 @@ acpi_status acpi_remove_pm_notifier(struct acpi_device *adev)
+ 	if (ACPI_FAILURE(status))
+ 		goto out;
+ 
++	mutex_lock(&acpi_pm_notifier_lock);
+ 	adev->wakeup.context.func = NULL;
+ 	adev->wakeup.context.dev = NULL;
+ 	wakeup_source_unregister(adev->wakeup.ws);
+-
+ 	adev->wakeup.flags.notifier_present = false;
++	mutex_unlock(&acpi_pm_notifier_lock);
+ 
+  out:
+-	mutex_unlock(&acpi_pm_notifier_lock);
++	mutex_unlock(&acpi_pm_notifier_install_lock);
+ 	return status;
+ }
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 236b14324780..82b3ce5e937e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -486,8 +486,11 @@ static inline void __acpi_ec_enable_event(struct acpi_ec *ec)
+ {
+ 	if (!test_and_set_bit(EC_FLAGS_QUERY_ENABLED, &ec->flags))
+ 		ec_log_drv("event unblocked");
+-	if (!test_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+-		advance_transaction(ec);
++	/*
++	 * Unconditionally invoke this once after enabling the event
++	 * handling mechanism to detect the pending events.
++	 */
++	advance_transaction(ec);
+ }
+ 
+ static inline void __acpi_ec_disable_event(struct acpi_ec *ec)
+@@ -1456,11 +1459,10 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events)
+ 			if (test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+ 			    ec->reference_count >= 1)
+ 				acpi_ec_enable_gpe(ec, true);
+-
+-			/* EC is fully operational, allow queries */
+-			acpi_ec_enable_event(ec);
+ 		}
+ 	}
++	/* EC is fully operational, allow queries */
++	acpi_ec_enable_event(ec);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index e4effef0c83f..ea20e0eb4d5a 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2264,8 +2264,8 @@ static void ata_eh_link_autopsy(struct ata_link *link)
+ 		if (dev->flags & ATA_DFLAG_DUBIOUS_XFER)
+ 			eflags |= ATA_EFLAG_DUBIOUS_XFER;
+ 		ehc->i.action |= ata_eh_speed_down(dev, eflags, all_err_mask);
++		trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	}
+-	trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	DPRINTK("EXIT\n");
+ }
+ 
+diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
+index 0b718886479b..87509cb69f79 100644
+--- a/drivers/base/power/opp/of.c
++++ b/drivers/base/power/opp/of.c
+@@ -397,6 +397,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ 			dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
+ 				ret);
+ 			_dev_pm_opp_remove_table(opp_table, dev, false);
++			of_node_put(np);
+ 			goto put_opp_table;
+ 		}
+ 	}
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 9adfb5445f8d..5f2a4240a204 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -288,15 +288,6 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ 		cmd->status = BLK_STS_TIMEOUT;
+ 		return BLK_EH_HANDLED;
+ 	}
+-
+-	/* If we are waiting on our dead timer then we could get timeout
+-	 * callbacks for our request.  For this we just want to reset the timer
+-	 * and let the queue side take care of everything.
+-	 */
+-	if (!completion_done(&cmd->send_complete)) {
+-		nbd_config_put(nbd);
+-		return BLK_EH_RESET_TIMER;
+-	}
+ 	config = nbd->config;
+ 
+ 	if (config->num_connections > 1) {
+@@ -723,9 +714,9 @@ static int wait_for_reconnect(struct nbd_device *nbd)
+ 		return 0;
+ 	if (test_bit(NBD_DISCONNECTED, &config->runtime_flags))
+ 		return 0;
+-	wait_event_interruptible_timeout(config->conn_wait,
+-					 atomic_read(&config->live_connections),
+-					 config->dead_conn_timeout);
++	wait_event_timeout(config->conn_wait,
++			   atomic_read(&config->live_connections),
++			   config->dead_conn_timeout);
+ 	return atomic_read(&config->live_connections);
+ }
+ 
+@@ -740,6 +731,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	if (!refcount_inc_not_zero(&nbd->config_refs)) {
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+ 				    "Socks array is empty\n");
++		blk_mq_start_request(req);
+ 		return -EINVAL;
+ 	}
+ 	config = nbd->config;
+@@ -748,6 +740,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+ 				    "Attempted send on invalid socket\n");
+ 		nbd_config_put(nbd);
++		blk_mq_start_request(req);
+ 		return -EINVAL;
+ 	}
+ 	cmd->status = BLK_STS_OK;
+@@ -771,6 +764,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 			 */
+ 			sock_shutdown(nbd);
+ 			nbd_config_put(nbd);
++			blk_mq_start_request(req);
+ 			return -EIO;
+ 		}
+ 		goto again;
+@@ -781,6 +775,7 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	 * here so that it gets put _after_ the request that is already on the
+ 	 * dispatch list.
+ 	 */
++	blk_mq_start_request(req);
+ 	if (unlikely(nsock->pending && nsock->pending != req)) {
+ 		blk_mq_requeue_request(req, true);
+ 		ret = 0;
+@@ -793,10 +788,10 @@ static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+ 	ret = nbd_send_cmd(nbd, cmd, index);
+ 	if (ret == -EAGAIN) {
+ 		dev_err_ratelimited(disk_to_dev(nbd->disk),
+-				    "Request send failed trying another connection\n");
++				    "Request send failed, requeueing\n");
+ 		nbd_mark_nsock_dead(nbd, nsock, 1);
+-		mutex_unlock(&nsock->tx_lock);
+-		goto again;
++		blk_mq_requeue_request(req, true);
++		ret = 0;
+ 	}
+ out:
+ 	mutex_unlock(&nsock->tx_lock);
+@@ -820,7 +815,6 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
+ 	 * done sending everything over the wire.
+ 	 */
+ 	init_completion(&cmd->send_complete);
+-	blk_mq_start_request(bd->rq);
+ 
+ 	/* We can be called directly from the user space process, which means we
+ 	 * could possibly have signals pending so our sendmsg will fail.  In
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index d00c4fdae924..bd810d01538a 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -26,6 +26,7 @@
+ struct btqcomsmd {
+ 	struct hci_dev *hdev;
+ 
++	bdaddr_t bdaddr;
+ 	struct rpmsg_endpoint *acl_channel;
+ 	struct rpmsg_endpoint *cmd_channel;
+ };
+@@ -100,6 +101,38 @@ static int btqcomsmd_close(struct hci_dev *hdev)
+ 	return 0;
+ }
+ 
++static int btqcomsmd_setup(struct hci_dev *hdev)
++{
++	struct btqcomsmd *btq = hci_get_drvdata(hdev);
++	struct sk_buff *skb;
++	int err;
++
++	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++	kfree_skb(skb);
++
++	/* Devices do not have persistent storage for BD address. If no
++	 * BD address has been retrieved during probe, mark the device
++	 * as having an invalid BD address.
++	 */
++	if (!bacmp(&btq->bdaddr, BDADDR_ANY)) {
++		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
++		return 0;
++	}
++
++	/* When setting a configured BD address fails, mark the device
++	 * as having an invalid BD address.
++	 */
++	err = qca_set_bdaddr_rome(hdev, &btq->bdaddr);
++	if (err) {
++		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
++		return 0;
++	}
++
++	return 0;
++}
++
+ static int btqcomsmd_probe(struct platform_device *pdev)
+ {
+ 	struct btqcomsmd *btq;
+@@ -135,6 +168,7 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ 	hdev->open = btqcomsmd_open;
+ 	hdev->close = btqcomsmd_close;
+ 	hdev->send = btqcomsmd_send;
++	hdev->setup = btqcomsmd_setup;
+ 	hdev->set_bdaddr = qca_set_bdaddr_rome;
+ 
+ 	ret = hci_register_dev(hdev);
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 13eb04f72389..148815470431 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -274,8 +274,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ 
+ 		/* Get configuration for the ATL instances */
+ 		snprintf(prop, sizeof(prop), "atl%u", i);
+-		of_node_get(node);
+-		cfg_node = of_find_node_by_name(node, prop);
++		cfg_node = of_get_child_by_name(node, prop);
+ 		if (cfg_node) {
+ 			ret = of_property_read_u32(cfg_node, "bws",
+ 						   &cdesc->bws);
+diff --git a/drivers/dax/super.c b/drivers/dax/super.c
+index 557b93703532..c4cd034a3820 100644
+--- a/drivers/dax/super.c
++++ b/drivers/dax/super.c
+@@ -344,6 +344,9 @@ static struct inode *dax_alloc_inode(struct super_block *sb)
+ 	struct inode *inode;
+ 
+ 	dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
++	if (!dax_dev)
++		return NULL;
++
+ 	inode = &dax_dev->inode;
+ 	inode->i_rdev = 0;
+ 	return inode;
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 4c4b46586af2..2af79e4f3235 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1575,7 +1575,7 @@ static void cm_format_req_event(struct cm_work *work,
+ 	param->bth_pkey = cm_get_bth_pkey(work);
+ 	param->port = cm_id_priv->av.port->port_num;
+ 	param->primary_path = &work->path[0];
+-	if (req_msg->alt_local_lid)
++	if (cm_req_has_alt_path(req_msg))
+ 		param->alternate_path = &work->path[1];
+ 	else
+ 		param->alternate_path = NULL;
+@@ -1856,7 +1856,8 @@ static int cm_req_handler(struct cm_work *work)
+ 	cm_process_routed_req(req_msg, work->mad_recv_wc->wc);
+ 
+ 	memset(&work->path[0], 0, sizeof(work->path[0]));
+-	memset(&work->path[1], 0, sizeof(work->path[1]));
++	if (cm_req_has_alt_path(req_msg))
++		memset(&work->path[1], 0, sizeof(work->path[1]));
+ 	grh = rdma_ah_read_grh(&cm_id_priv->av.ah_attr);
+ 	ret = ib_get_cached_gid(work->port->cm_dev->ib_device,
+ 				work->port->port_num,
+@@ -3817,14 +3818,16 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
+ 	struct cm_port *port = mad_agent->context;
+ 	struct cm_work *work;
+ 	enum ib_cm_event_type event;
++	bool alt_path = false;
+ 	u16 attr_id;
+ 	int paths = 0;
+ 	int going_down = 0;
+ 
+ 	switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
+ 	case CM_REQ_ATTR_ID:
+-		paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
+-						    alt_local_lid != 0);
++		alt_path = cm_req_has_alt_path((struct cm_req_msg *)
++						mad_recv_wc->recv_buf.mad);
++		paths = 1 + (alt_path != 0);
+ 		event = IB_CM_REQ_RECEIVED;
+ 		break;
+ 	case CM_MRA_ATTR_ID:
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index f8f53bb90837..cb91245e9163 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -1974,14 +1974,15 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
+ 	unsigned long flags;
+ 	int ret;
+ 
++	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
+ 	ret = ib_mad_enforce_security(mad_agent_priv,
+ 				      mad_recv_wc->wc->pkey_index);
+ 	if (ret) {
+ 		ib_free_recv_mad(mad_recv_wc);
+ 		deref_mad_agent(mad_agent_priv);
++		return;
+ 	}
+ 
+-	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
+ 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
+ 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
+ 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 88bdafb297f5..28607bb42d87 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -87,16 +87,14 @@ static int enforce_qp_pkey_security(u16 pkey,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (qp_sec->qp == qp_sec->qp->real_qp) {
+-		list_for_each_entry(shared_qp_sec,
+-				    &qp_sec->shared_qp_list,
+-				    shared_qp_list) {
+-			ret = security_ib_pkey_access(shared_qp_sec->security,
+-						      subnet_prefix,
+-						      pkey);
+-			if (ret)
+-				return ret;
+-		}
++	list_for_each_entry(shared_qp_sec,
++			    &qp_sec->shared_qp_list,
++			    shared_qp_list) {
++		ret = security_ib_pkey_access(shared_qp_sec->security,
++					      subnet_prefix,
++					      pkey);
++		if (ret)
++			return ret;
+ 	}
+ 	return 0;
+ }
+@@ -560,15 +558,22 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 	int ret = 0;
+ 	struct ib_ports_pkeys *tmp_pps;
+ 	struct ib_ports_pkeys *new_pps;
+-	bool special_qp = (qp->qp_type == IB_QPT_SMI ||
+-			   qp->qp_type == IB_QPT_GSI ||
+-			   qp->qp_type >= IB_QPT_RESERVED1);
++	struct ib_qp *real_qp = qp->real_qp;
++	bool special_qp = (real_qp->qp_type == IB_QPT_SMI ||
++			   real_qp->qp_type == IB_QPT_GSI ||
++			   real_qp->qp_type >= IB_QPT_RESERVED1);
+ 	bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) ||
+ 			   (qp_attr_mask & IB_QP_ALT_PATH));
+ 
++	/* The port/pkey settings are maintained only for the real QP. Open
++	 * handles on the real QP will be in the shared_qp_list. When
++	 * enforcing security on the real QP all the shared QPs will be
++	 * checked as well.
++	 */
++
+ 	if (pps_change && !special_qp) {
+-		mutex_lock(&qp->qp_sec->mutex);
+-		new_pps = get_new_pps(qp,
++		mutex_lock(&real_qp->qp_sec->mutex);
++		new_pps = get_new_pps(real_qp,
+ 				      qp_attr,
+ 				      qp_attr_mask);
+ 
+@@ -586,14 +591,14 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 
+ 		if (!ret)
+ 			ret = check_qp_port_pkey_settings(new_pps,
+-							  qp->qp_sec);
++							  real_qp->qp_sec);
+ 	}
+ 
+ 	if (!ret)
+-		ret = qp->device->modify_qp(qp->real_qp,
+-					    qp_attr,
+-					    qp_attr_mask,
+-					    udata);
++		ret = real_qp->device->modify_qp(real_qp,
++						 qp_attr,
++						 qp_attr_mask,
++						 udata);
+ 
+ 	if (pps_change && !special_qp) {
+ 		/* Clean up the lists and free the appropriate
+@@ -602,8 +607,8 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 		if (ret) {
+ 			tmp_pps = new_pps;
+ 		} else {
+-			tmp_pps = qp->qp_sec->ports_pkeys;
+-			qp->qp_sec->ports_pkeys = new_pps;
++			tmp_pps = real_qp->qp_sec->ports_pkeys;
++			real_qp->qp_sec->ports_pkeys = new_pps;
+ 		}
+ 
+ 		if (tmp_pps) {
+@@ -611,7 +616,7 @@ int ib_security_modify_qp(struct ib_qp *qp,
+ 			port_pkey_list_remove(&tmp_pps->alt);
+ 		}
+ 		kfree(tmp_pps);
+-		mutex_unlock(&qp->qp_sec->mutex);
++		mutex_unlock(&real_qp->qp_sec->mutex);
+ 	}
+ 	return ret;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 0be42787759f..312444386f54 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -13074,7 +13074,7 @@ static int request_msix_irqs(struct hfi1_devdata *dd)
+ 	first_sdma = last_general;
+ 	last_sdma = first_sdma + dd->num_sdma;
+ 	first_rx = last_sdma;
+-	last_rx = first_rx + dd->n_krcv_queues + HFI1_NUM_VNIC_CTXT;
++	last_rx = first_rx + dd->n_krcv_queues + dd->num_vnic_contexts;
+ 
+ 	/* VNIC MSIx interrupts get mapped when VNIC contexts are created */
+ 	dd->first_dyn_msix_idx = first_rx + dd->n_krcv_queues;
+@@ -13294,8 +13294,9 @@ static int set_up_interrupts(struct hfi1_devdata *dd)
+ 	 *		slow source, SDMACleanupDone)
+ 	 *	N interrupts - one per used SDMA engine
+ 	 *	M interrupt - one per kernel receive context
++	 *	V interrupt - one for each VNIC context
+ 	 */
+-	total = 1 + dd->num_sdma + dd->n_krcv_queues + HFI1_NUM_VNIC_CTXT;
++	total = 1 + dd->num_sdma + dd->n_krcv_queues + dd->num_vnic_contexts;
+ 
+ 	/* ask for MSI-X interrupts */
+ 	request = request_msix(dd, total);
+@@ -13356,10 +13357,12 @@ static int set_up_interrupts(struct hfi1_devdata *dd)
+  *                             in array of contexts
+  *	freectxts  - number of free user contexts
+  *	num_send_contexts - number of PIO send contexts being used
++ *	num_vnic_contexts - number of contexts reserved for VNIC
+  */
+ static int set_up_context_variables(struct hfi1_devdata *dd)
+ {
+ 	unsigned long num_kernel_contexts;
++	u16 num_vnic_contexts = HFI1_NUM_VNIC_CTXT;
+ 	int total_contexts;
+ 	int ret;
+ 	unsigned ngroups;
+@@ -13393,6 +13396,14 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 			   num_kernel_contexts);
+ 		num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
+ 	}
++
++	/* Accommodate VNIC contexts if possible */
++	if ((num_kernel_contexts + num_vnic_contexts) > dd->chip_rcv_contexts) {
++		dd_dev_err(dd, "No receive contexts available for VNIC\n");
++		num_vnic_contexts = 0;
++	}
++	total_contexts = num_kernel_contexts + num_vnic_contexts;
++
+ 	/*
+ 	 * User contexts:
+ 	 *	- default to 1 user context per real (non-HT) CPU core if
+@@ -13402,19 +13413,16 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 		num_user_contexts =
+ 			cpumask_weight(&node_affinity.real_cpu_mask);
+ 
+-	total_contexts = num_kernel_contexts + num_user_contexts;
+-
+ 	/*
+ 	 * Adjust the counts given a global max.
+ 	 */
+-	if (total_contexts > dd->chip_rcv_contexts) {
++	if (total_contexts + num_user_contexts > dd->chip_rcv_contexts) {
+ 		dd_dev_err(dd,
+ 			   "Reducing # user receive contexts to: %d, from %d\n",
+-			   (int)(dd->chip_rcv_contexts - num_kernel_contexts),
++			   (int)(dd->chip_rcv_contexts - total_contexts),
+ 			   (int)num_user_contexts);
+-		num_user_contexts = dd->chip_rcv_contexts - num_kernel_contexts;
+ 		/* recalculate */
+-		total_contexts = num_kernel_contexts + num_user_contexts;
++		num_user_contexts = dd->chip_rcv_contexts - total_contexts;
+ 	}
+ 
+ 	/* each user context requires an entry in the RMT */
+@@ -13427,25 +13435,24 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ 			   user_rmt_reduced);
+ 		/* recalculate */
+ 		num_user_contexts = user_rmt_reduced;
+-		total_contexts = num_kernel_contexts + num_user_contexts;
+ 	}
+ 
+-	/* Accommodate VNIC contexts */
+-	if ((total_contexts + HFI1_NUM_VNIC_CTXT) <= dd->chip_rcv_contexts)
+-		total_contexts += HFI1_NUM_VNIC_CTXT;
++	total_contexts += num_user_contexts;
+ 
+ 	/* the first N are kernel contexts, the rest are user/vnic contexts */
+ 	dd->num_rcv_contexts = total_contexts;
+ 	dd->n_krcv_queues = num_kernel_contexts;
+ 	dd->first_dyn_alloc_ctxt = num_kernel_contexts;
++	dd->num_vnic_contexts = num_vnic_contexts;
+ 	dd->num_user_contexts = num_user_contexts;
+ 	dd->freectxts = num_user_contexts;
+ 	dd_dev_info(dd,
+-		    "rcv contexts: chip %d, used %d (kernel %d, user %d)\n",
++		    "rcv contexts: chip %d, used %d (kernel %d, vnic %u, user %u)\n",
+ 		    (int)dd->chip_rcv_contexts,
+ 		    (int)dd->num_rcv_contexts,
+ 		    (int)dd->n_krcv_queues,
+-		    (int)dd->num_rcv_contexts - dd->n_krcv_queues);
++		    dd->num_vnic_contexts,
++		    dd->num_user_contexts);
+ 
+ 	/*
+ 	 * Receive array allocation:
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 3ac9c307a285..6ff44dc606eb 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1047,6 +1047,8 @@ struct hfi1_devdata {
+ 	u64 z_send_schedule;
+ 
+ 	u64 __percpu *send_schedule;
++	/* number of reserved contexts for VNIC usage */
++	u16 num_vnic_contexts;
+ 	/* number of receive contexts in use by the driver */
+ 	u32 num_rcv_contexts;
+ 	/* number of pio send contexts in use by the driver */
+diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
+index 6d2702ef34ac..25e867393463 100644
+--- a/drivers/infiniband/hw/hfi1/sysfs.c
++++ b/drivers/infiniband/hw/hfi1/sysfs.c
+@@ -543,7 +543,7 @@ static ssize_t show_nctxts(struct device *device,
+ 	 * give a more accurate picture of total contexts available.
+ 	 */
+ 	return scnprintf(buf, PAGE_SIZE, "%u\n",
+-			 min(dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt,
++			 min(dd->num_user_contexts,
+ 			     (u32)dd->sc_sizes[SC_USER].count));
+ }
+ 
+diff --git a/drivers/infiniband/hw/hfi1/vnic_main.c b/drivers/infiniband/hw/hfi1/vnic_main.c
+index f419cbb05928..1a17708be46a 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_main.c
++++ b/drivers/infiniband/hw/hfi1/vnic_main.c
+@@ -840,6 +840,9 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 	struct rdma_netdev *rn;
+ 	int i, size, rc;
+ 
++	if (!dd->num_vnic_contexts)
++		return ERR_PTR(-ENOMEM);
++
+ 	if (!port_num || (port_num > dd->num_pports))
+ 		return ERR_PTR(-EINVAL);
+ 
+@@ -848,7 +851,7 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 
+ 	size = sizeof(struct opa_vnic_rdma_netdev) + sizeof(*vinfo);
+ 	netdev = alloc_netdev_mqs(size, name, name_assign_type, setup,
+-				  dd->chip_sdma_engines, HFI1_NUM_VNIC_CTXT);
++				  dd->chip_sdma_engines, dd->num_vnic_contexts);
+ 	if (!netdev)
+ 		return ERR_PTR(-ENOMEM);
+ 
+@@ -856,7 +859,7 @@ struct net_device *hfi1_vnic_alloc_rn(struct ib_device *device,
+ 	vinfo = opa_vnic_dev_priv(netdev);
+ 	vinfo->dd = dd;
+ 	vinfo->num_tx_q = dd->chip_sdma_engines;
+-	vinfo->num_rx_q = HFI1_NUM_VNIC_CTXT;
++	vinfo->num_rx_q = dd->num_vnic_contexts;
+ 	vinfo->netdev = netdev;
+ 	rn->free_rdma_netdev = hfi1_vnic_free_rn;
+ 	rn->set_id = hfi1_vnic_set_vesw_id;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index fa5ccdb3bb2a..60d7b493ed2d 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -665,12 +665,19 @@ static void srp_path_rec_completion(int status,
+ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ {
+ 	struct srp_target_port *target = ch->target;
+-	int ret;
++	int ret = -ENODEV;
+ 
+ 	ch->path.numb_path = 1;
+ 
+ 	init_completion(&ch->done);
+ 
++	/*
++	 * Avoid that the SCSI host can be removed by srp_remove_target()
++	 * before srp_path_rec_completion() is called.
++	 */
++	if (!scsi_host_get(target->scsi_host))
++		goto out;
++
+ 	ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
+ 					       target->srp_host->srp_dev->dev,
+ 					       target->srp_host->port,
+@@ -684,18 +691,24 @@ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ 					       GFP_KERNEL,
+ 					       srp_path_rec_completion,
+ 					       ch, &ch->path_query);
+-	if (ch->path_query_id < 0)
+-		return ch->path_query_id;
++	ret = ch->path_query_id;
++	if (ret < 0)
++		goto put;
+ 
+ 	ret = wait_for_completion_interruptible(&ch->done);
+ 	if (ret < 0)
+-		return ret;
++		goto put;
+ 
+-	if (ch->status < 0)
++	ret = ch->status;
++	if (ret < 0)
+ 		shost_printk(KERN_WARNING, target->scsi_host,
+ 			     PFX "Path record query failed\n");
+ 
+-	return ch->status;
++put:
++	scsi_host_put(target->scsi_host);
++
++out:
++	return ret;
+ }
+ 
+ static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 9e8e9220f816..95178b4e3565 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2777,7 +2777,7 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ {
+ 	const char *p;
+ 	unsigned len, count, leading_zero_bytes;
+-	int ret, rc;
++	int ret;
+ 
+ 	p = name;
+ 	if (strncasecmp(p, "0x", 2) == 0)
+@@ -2789,10 +2789,9 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ 	count = min(len / 2, 16U);
+ 	leading_zero_bytes = 16 - count;
+ 	memset(i_port_id, 0, leading_zero_bytes);
+-	rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
+-	if (rc < 0)
+-		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
+-	ret = 0;
++	ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
++	if (ret < 0)
++		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
+ out:
+ 	return ret;
+ }
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index b5df99c6f680..3b35271114ee 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1071,18 +1071,18 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 	int nr_parts;
+ 	struct partition_affinity *parts;
+ 
+-	parts_node = of_find_node_by_name(gic_node, "ppi-partitions");
++	parts_node = of_get_child_by_name(gic_node, "ppi-partitions");
+ 	if (!parts_node)
+ 		return;
+ 
+ 	nr_parts = of_get_child_count(parts_node);
+ 
+ 	if (!nr_parts)
+-		return;
++		goto out_put_node;
+ 
+ 	parts = kzalloc(sizeof(*parts) * nr_parts, GFP_KERNEL);
+ 	if (WARN_ON(!parts))
+-		return;
++		goto out_put_node;
+ 
+ 	for_each_child_of_node(parts_node, child_part) {
+ 		struct partition_affinity *part;
+@@ -1149,6 +1149,9 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 
+ 		gic_data.ppi_descs[i] = desc;
+ 	}
++
++out_put_node:
++	of_node_put(parts_node);
+ }
+ 
+ static void __init gic_of_setup_kvm_info(struct device_node *node)
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index ae6146311934..f052a3eb2098 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1365,8 +1365,8 @@ static void flexrm_shutdown(struct mbox_chan *chan)
+ 	/* Disable/inactivate ring */
+ 	writel_relaxed(0x0, ring->regs + RING_CONTROL);
+ 
+-	/* Flush ring with timeout of 1s */
+-	timeout = 1000;
++	/* Set ring flush state */
++	timeout = 1000; /* timeout of 1s */
+ 	writel_relaxed(BIT(CONTROL_FLUSH_SHIFT),
+ 			ring->regs + RING_CONTROL);
+ 	do {
+@@ -1374,7 +1374,23 @@ static void flexrm_shutdown(struct mbox_chan *chan)
+ 		    FLUSH_DONE_MASK)
+ 			break;
+ 		mdelay(1);
+-	} while (timeout--);
++	} while (--timeout);
++	if (!timeout)
++		dev_err(ring->mbox->dev,
++			"setting ring%d flush state timedout\n", ring->num);
++
++	/* Clear ring flush state */
++	timeout = 1000; /* timeout of 1s */
++	writel_relaxed(0x0, ring + RING_CONTROL);
++	do {
++		if (!(readl_relaxed(ring + RING_FLUSH_DONE) &
++		      FLUSH_DONE_MASK))
++			break;
++		mdelay(1);
++	} while (--timeout);
++	if (!timeout)
++		dev_err(ring->mbox->dev,
++			"clearing ring%d flush state timedout\n", ring->num);
+ 
+ 	/* Abort all in-flight requests */
+ 	for (reqid = 0; reqid < RING_MAX_REQ_COUNT; reqid++) {
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 08035634795c..c9934139d609 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -407,7 +407,8 @@ long bch_bucket_alloc(struct cache *ca, unsigned reserve, bool wait)
+ 
+ 	finish_wait(&ca->set->bucket_wait, &w);
+ out:
+-	wake_up_process(ca->alloc_thread);
++	if (ca->alloc_thread)
++		wake_up_process(ca->alloc_thread);
+ 
+ 	trace_bcache_alloc(ca, reserve);
+ 
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index d2121637b4ab..cae57b5be817 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -625,7 +625,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
+ 		err = read_sb_page(bitmap->mddev,
+ 				   offset,
+ 				   sb_page,
+-				   0, PAGE_SIZE);
++				   0, sizeof(bitmap_super_t));
+ 	}
+ 	if (err)
+ 		return err;
+@@ -2123,7 +2123,7 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 	if (store.sb_page && bitmap->storage.sb_page)
+ 		memcpy(page_address(store.sb_page),
+ 		       page_address(bitmap->storage.sb_page),
+-		       PAGE_SIZE);
++		       sizeof(bitmap_super_t));
+ 	bitmap_file_unmap(&bitmap->storage);
+ 	bitmap->storage = store;
+ 
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index d216a8f7bc22..8e3adcb46851 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -974,7 +974,8 @@ static void __get_memory_limit(struct dm_bufio_client *c,
+ 		buffers = c->minimum_buffers;
+ 
+ 	*limit_buffers = buffers;
+-	*threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100;
++	*threshold_buffers = mult_frac(buffers,
++				       DM_BUFIO_WRITEBACK_PERCENT, 100);
+ }
+ 
+ /*
+@@ -1910,19 +1911,15 @@ static int __init dm_bufio_init(void)
+ 	memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
+ 	memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
+ 
+-	mem = (__u64)((totalram_pages - totalhigh_pages) *
+-		      DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT;
++	mem = (__u64)mult_frac(totalram_pages - totalhigh_pages,
++			       DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT;
+ 
+ 	if (mem > ULONG_MAX)
+ 		mem = ULONG_MAX;
+ 
+ #ifdef CONFIG_MMU
+-	/*
+-	 * Get the size of vmalloc space the same way as VMALLOC_TOTAL
+-	 * in fs/proc/internal.h
+-	 */
+-	if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100)
+-		mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100;
++	if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100))
++		mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100);
+ #endif
+ 
+ 	dm_bufio_default_cache_size = mem;
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 8785134c9f1f..0b7edfd0b454 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1201,6 +1201,18 @@ static void background_work_end(struct cache *cache)
+ 
+ /*----------------------------------------------------------------*/
+ 
++static bool bio_writes_complete_block(struct cache *cache, struct bio *bio)
++{
++	return (bio_data_dir(bio) == WRITE) &&
++		(bio->bi_iter.bi_size == (cache->sectors_per_block << SECTOR_SHIFT));
++}
++
++static bool optimisable_bio(struct cache *cache, struct bio *bio, dm_oblock_t block)
++{
++	return writeback_mode(&cache->features) &&
++		(is_discarded_oblock(cache, block) || bio_writes_complete_block(cache, bio));
++}
++
+ static void quiesce(struct dm_cache_migration *mg,
+ 		    void (*continuation)(struct work_struct *))
+ {
+@@ -1474,12 +1486,50 @@ static void mg_upgrade_lock(struct work_struct *ws)
+ 	}
+ }
+ 
++static void mg_full_copy(struct work_struct *ws)
++{
++	struct dm_cache_migration *mg = ws_to_mg(ws);
++	struct cache *cache = mg->cache;
++	struct policy_work *op = mg->op;
++	bool is_policy_promote = (op->op == POLICY_PROMOTE);
++
++	if ((!is_policy_promote && !is_dirty(cache, op->cblock)) ||
++	    is_discarded_oblock(cache, op->oblock)) {
++		mg_upgrade_lock(ws);
++		return;
++	}
++
++	init_continuation(&mg->k, mg_upgrade_lock);
++
++	if (copy(mg, is_policy_promote)) {
2554