[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Alice Ferrazzi]

commit:     c76265ce51a4f08cd3ac3598b0896bb2adf153d5
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 30 12:13:06 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Nov 30 12:13:06 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c76265ce

linux kernel 4.9.66

 0000_README             |    4 +
 1065_linux-4.9.66.patch | 4726 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4730 insertions(+)

diff --git a/0000_README b/0000_README
index 98ea34c..045a3d8 100644
--- a/0000_README
+++ b/0000_README
@@ -303,6 +303,10 @@ Patch:  1064_linux-4.9.65.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.65
 
+Patch:  1065_linux-4.9.66.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.66
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1065_linux-4.9.66.patch b/1065_linux-4.9.66.patch
new file mode 100644
index 0000000..f277f12
--- /dev/null
+++ b/1065_linux-4.9.66.patch
@@ -0,0 +1,4726 @@
+diff --git a/Makefile b/Makefile
+index 87a641515e9c..8e62f9e2a08c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 65
++SUBLEVEL = 66
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
+index 9fe8e241335c..e1f6f0daa847 100644
+--- a/arch/arm/mm/dump.c
++++ b/arch/arm/mm/dump.c
+@@ -126,8 +126,8 @@ static const struct prot_bits section_bits[] = {
+ 		.val	= PMD_SECT_USER,
+ 		.set	= "USR",
+ 	}, {
+-		.mask	= L_PMD_SECT_RDONLY,
+-		.val	= L_PMD_SECT_RDONLY,
++		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
++		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ 		.set	= "ro",
+ 		.clear	= "RW",
+ #elif __LINUX_ARM_ARCH__ >= 6
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 370581aeb871..4c587ad8bfe3 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -619,8 +619,8 @@ static struct section_perm ro_perms[] = {
+ 		.start  = (unsigned long)_stext,
+ 		.end    = (unsigned long)__init_begin,
+ #ifdef CONFIG_ARM_LPAE
+-		.mask   = ~L_PMD_SECT_RDONLY,
+-		.prot   = L_PMD_SECT_RDONLY,
++		.mask   = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
++		.prot   = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ #else
+ 		.mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
+ 		.prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 61e214015b38..7acd3c5c7643 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -91,6 +91,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+ #define pte_valid_young(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
++#define pte_valid_user(pte) \
++	((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+ 
+ /*
+  * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+@@ -100,6 +102,18 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_accessible(mm, pte)	\
+ 	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
+ 
++/*
++ * p??_access_permitted() is true for valid user mappings (subject to the
++ * write permission check) other than user execute-only which do not have the
++ * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
++ */
++#define pte_access_permitted(pte, write) \
++	(pte_valid_user(pte) && (!(write) || pte_write(pte)))
++#define pmd_access_permitted(pmd, write) \
++	(pte_access_permitted(pmd_pte(pmd), (write)))
++#define pud_access_permitted(pud, write) \
++	(pte_access_permitted(pud_pte(pud), (write)))
++
+ static inline pte_t clear_pte_bit(pte_t pte, pgprot_t prot)
+ {
+ 	pte_val(pte) &= ~pgprot_val(prot);
+diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c
+index d20ae63eb3c2..46abe9e4e0e0 100644
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -330,7 +330,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __initconst = {
+ /* Verified on: WRT54GS V1.0 */
+ static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_type_0101[] __initconst = {
+-	BCM47XX_GPIO_LED(0, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(0, "green", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "green", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+diff --git a/arch/mips/boot/dts/brcm/Makefile b/arch/mips/boot/dts/brcm/Makefile
+index d61bc2aebf69..7d90a8710425 100644
+--- a/arch/mips/boot/dts/brcm/Makefile
++++ b/arch/mips/boot/dts/brcm/Makefile
+@@ -22,7 +22,6 @@ dtb-$(CONFIG_DT_NONE) += \
+ 	bcm63268-comtrend-vr-3032u.dtb \
+ 	bcm93384wvg.dtb \
+ 	bcm93384wvg_viper.dtb \
+-	bcm96358nb4ser.dtb \
+ 	bcm96368mvwg.dtb \
+ 	bcm9ejtagprb.dtb \
+ 	bcm97125cbmb.dtb \
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 83054f79f72a..8333ce90b172 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -19,6 +19,9 @@
+ #include <asm/asmmacro-64.h>
+ #endif
+ 
++/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
++#undef fp
++
+ /*
+  * Helper macros for generating raw instruction encodings.
+  */
+@@ -105,6 +108,7 @@
+ 	.macro	fpu_save_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	sdc1	$f1,  THREAD_FPR1(\thread)
+ 	sdc1	$f3,  THREAD_FPR3(\thread)
+@@ -163,6 +167,7 @@
+ 	.macro	fpu_restore_16odd thread
+ 	.set	push
+ 	.set	mips64r2
++	.set	fp=64
+ 	SET_HARDFLOAT
+ 	ldc1	$f1,  THREAD_FPR1(\thread)
+ 	ldc1	$f3,  THREAD_FPR3(\thread)
+@@ -234,9 +239,6 @@
+ 	.endm
+ 
+ #ifdef TOOLCHAIN_SUPPORTS_MSA
+-/* preprocessor replaces the fp in ".set fp=64" with $30 otherwise */
+-#undef fp
+-
+ 	.macro	_cfcmsa	rd, cs
+ 	.set	push
+ 	.set	mips32r2
+diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
+index 3de026034c35..11890e6e4093 100644
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -647,6 +647,19 @@ static const struct user_regset_view user_mips64_view = {
+ 	.n		= ARRAY_SIZE(mips64_regsets),
+ };
+ 
++#ifdef CONFIG_MIPS32_N32
++
++static const struct user_regset_view user_mipsn32_view = {
++	.name		= "mipsn32",
++	.e_flags	= EF_MIPS_ABI2,
++	.e_machine	= ELF_ARCH,
++	.ei_osabi	= ELF_OSABI,
++	.regsets	= mips64_regsets,
++	.n		= ARRAY_SIZE(mips64_regsets),
++};
++
++#endif /* CONFIG_MIPS32_N32 */
++
+ #endif /* CONFIG_64BIT */
+ 
+ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+@@ -657,6 +670,10 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
+ #ifdef CONFIG_MIPS32_O32
+ 	if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ 		return &user_mips_view;
++#endif
++#ifdef CONFIG_MIPS32_N32
++	if (test_tsk_thread_flag(task, TIF_32BIT_ADDR))
++		return &user_mipsn32_view;
+ #endif
+ 	return &user_mips64_view;
+ #endif
+diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
+index 628c5132b3d8..a7962f79c4fe 100644
+--- a/arch/mips/pci/pci-mt7620.c
++++ b/arch/mips/pci/pci-mt7620.c
+@@ -121,7 +121,7 @@ static int wait_pciephy_busy(void)
+ 		else
+ 			break;
+ 		if (retry++ > WAITRETRY_MAX) {
+-			printk(KERN_WARN "PCIE-PHY retry failed.\n");
++			pr_warn("PCIE-PHY retry failed.\n");
+ 			return -1;
+ 		}
+ 	}
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index 6f892c1f3ad7..0696142048d5 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -141,8 +141,8 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = {
+ 	FUNC("i2c", 0, 4, 2),
+ };
+ 
+-static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
+-static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
++static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) };
++static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) };
+ static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
+ static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
+ 
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 41e60a9c7db2..e775f80ae28c 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -690,15 +690,15 @@ cas_action:
+ 	/* ELF32 Process entry path */
+ lws_compare_and_swap_2:
+ #ifdef CONFIG_64BIT
+-	/* Clip the input registers */
++	/* Clip the input registers. We don't need to clip %r23 as we
++	   only use it for word operations */
+ 	depdi	0, 31, 32, %r26
+ 	depdi	0, 31, 32, %r25
+ 	depdi	0, 31, 32, %r24
+-	depdi	0, 31, 32, %r23
+ #endif
+ 
+ 	/* Check the validity of the size pointer */
+-	subi,>>= 4, %r23, %r0
++	subi,>>= 3, %r23, %r0
+ 	b,n	lws_exit_nosys
+ 
+ 	/* Jump to the functions which will load the old and new values into
+diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
+index bbe77aed198d..3600c0d99ae9 100644
+--- a/arch/powerpc/kernel/signal.c
++++ b/arch/powerpc/kernel/signal.c
+@@ -102,7 +102,7 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka,
+ static void do_signal(struct task_struct *tsk)
+ {
+ 	sigset_t *oldset = sigmask_to_save();
+-	struct ksignal ksig;
++	struct ksignal ksig = { .sig = 0 };
+ 	int ret;
+ 	int is32 = is_32bit_task();
+ 
+diff --git a/arch/s390/include/asm/asm-prototypes.h b/arch/s390/include/asm/asm-prototypes.h
+new file mode 100644
+index 000000000000..2c3413b0ca52
+--- /dev/null
++++ b/arch/s390/include/asm/asm-prototypes.h
+@@ -0,0 +1,8 @@
++#ifndef _ASM_S390_PROTOTYPES_H
++
++#include <linux/kvm_host.h>
++#include <linux/ftrace.h>
++#include <asm/fpu/api.h>
++#include <asm-generic/asm-prototypes.h>
++
++#endif /* _ASM_S390_PROTOTYPES_H */
+diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
+index 12d45f0cfdd9..dde6b52359c5 100644
+--- a/arch/s390/include/asm/switch_to.h
++++ b/arch/s390/include/asm/switch_to.h
+@@ -34,8 +34,8 @@ static inline void restore_access_regs(unsigned int *acrs)
+ 		save_access_regs(&prev->thread.acrs[0]);		\
+ 		save_ri_cb(prev->thread.ri_cb);				\
+ 	}								\
++	update_cr_regs(next);						\
+ 	if (next->mm) {							\
+-		update_cr_regs(next);					\
+ 		set_cpu_flag(CIF_FPU);					\
+ 		restore_access_regs(&next->thread.acrs[0]);		\
+ 		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index c74c59236f44..aaf9dab3c193 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -1548,6 +1548,7 @@ static struct s390_insn opcode_e7[] = {
+ 	{ "vfsq", 0xce, INSTR_VRR_VV000MM },
+ 	{ "vfs", 0xe2, INSTR_VRR_VVV00MM },
+ 	{ "vftci", 0x4a, INSTR_VRI_VVIMM },
++	{ "", 0, INSTR_INVALID }
+ };
+ 
+ static struct s390_insn opcode_eb[] = {
+@@ -1953,7 +1954,7 @@ void show_code(struct pt_regs *regs)
+ {
+ 	char *mode = user_mode(regs) ? "User" : "Krnl";
+ 	unsigned char code[64];
+-	char buffer[64], *ptr;
++	char buffer[128], *ptr;
+ 	mm_segment_t old_fs;
+ 	unsigned long addr;
+ 	int start, end, opsize, hops, i;
+@@ -2016,7 +2017,7 @@ void show_code(struct pt_regs *regs)
+ 		start += opsize;
+ 		pr_cont("%s", buffer);
+ 		ptr = buffer;
+-		ptr += sprintf(ptr, "\n          ");
++		ptr += sprintf(ptr, "\n\t  ");
+ 		hops++;
+ 	}
+ 	pr_cont("\n");
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index 0c196861bc38..29d87444a655 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -345,8 +345,10 @@ static __init void detect_machine_facilities(void)
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_IDTE;
+ 	if (test_facility(40))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_LPP;
+-	if (test_facility(50) && test_facility(73))
++	if (test_facility(50) && test_facility(73)) {
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TE;
++		__ctl_set_bit(0, 55);
++	}
+ 	if (test_facility(51))
+ 		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_LC;
+ 	if (test_facility(129)) {
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index bba4fa74b321..172fe1121d99 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -120,6 +120,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
+ 	memset(&p->thread.per_user, 0, sizeof(p->thread.per_user));
+ 	memset(&p->thread.per_event, 0, sizeof(p->thread.per_event));
+ 	clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
++	p->thread.per_flags = 0;
+ 	/* Initialize per thread user and system timer values */
+ 	ti = task_thread_info(p);
+ 	ti->user_timer = 0;
+diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
+index fffa0e5462af..70cdb03d4acd 100644
+--- a/arch/s390/kernel/runtime_instr.c
++++ b/arch/s390/kernel/runtime_instr.c
+@@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void)
+ {
+ 	struct task_struct *task = current;
+ 
++	preempt_disable();
+ 	if (!task->thread.ri_cb)
+ 		return;
+ 	disable_runtime_instr();
+ 	kfree(task->thread.ri_cb);
+ 	task->thread.ri_cb = NULL;
++	preempt_enable();
+ }
+ 
+ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+@@ -62,9 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (command == S390_RUNTIME_INSTR_STOP) {
+-		preempt_disable();
+ 		exit_thread_runtime_instr();
+-		preempt_enable();
+ 		return 0;
+ 	}
+ 
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index e7b0e7ff4c58..be9df513141e 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -54,15 +54,19 @@ ENTRY(native_usergs_sysret64)
+ ENDPROC(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
+-.macro TRACE_IRQS_IRETQ
++.macro TRACE_IRQS_FLAGS flags:req
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
++	bt	$9, \flags		/* interrupts off? */
+ 	jnc	1f
+ 	TRACE_IRQS_ON
+ 1:
+ #endif
+ .endm
+ 
++.macro TRACE_IRQS_IRETQ
++	TRACE_IRQS_FLAGS EFLAGS(%rsp)
++.endm
++
+ /*
+  * When dynamic function tracer is enabled it will add a breakpoint
+  * to all locations that it is about to modify, sync CPUs, update
+@@ -868,11 +872,13 @@ idtentry simd_coprocessor_error		do_simd_coprocessor_error	has_error_code=0
+ ENTRY(native_load_gs_index)
+ 	pushfq
+ 	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
++	TRACE_IRQS_OFF
+ 	SWAPGS
+ .Lgs_change:
+ 	movl	%edi, %gs
+ 2:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
+ 	SWAPGS
++	TRACE_IRQS_FLAGS (%rsp)
+ 	popfq
+ 	ret
+ END(native_load_gs_index)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8ca1eca5038d..4fbf0c94f2d1 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3583,6 +3583,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ 	u32 ecx = msr->index;
+ 	u64 data = msr->data;
+ 	switch (ecx) {
++	case MSR_IA32_CR_PAT:
++		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++			return 1;
++		vcpu->arch.pat = data;
++		svm->vmcb->save.g_pat = data;
++		mark_dirty(svm->vmcb, VMCB_NPT);
++		break;
+ 	case MSR_IA32_TSC:
+ 		kvm_write_tsc(vcpu, msr);
+ 		break;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a8ae57acb6f6..0f0b27d96f27 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10715,6 +10715,8 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ 	vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
+ 	vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
+ 	vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
++	vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
++	vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
+ 
+ 	/* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1.  */
+ 	if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 767be7c76034..1754e094bc28 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -896,7 +896,7 @@ EndTable
+ 
+ GrpTable: Grp3_1
+ 0: TEST Eb,Ib
+-1:
++1: TEST Eb,Ib
+ 2: NOT Eb
+ 3: NEG Eb
+ 4: MUL AL,Eb
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 1dd796025472..8b5ff88aa4f8 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -1393,7 +1393,17 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
+ 	 * make sure we exit gracefully rather than endlessly redo
+ 	 * the fault.  Since we never set FAULT_FLAG_RETRY_NOWAIT, if
+ 	 * we get VM_FAULT_RETRY back, the mmap_sem has been unlocked.
++	 *
++	 * Note that handle_userfault() may also release and reacquire mmap_sem
++	 * (and not return with VM_FAULT_RETRY), when returning to userland to
++	 * repeat the page fault later with a VM_FAULT_NOPAGE retval
++	 * (potentially after handling any pending signal during the return to
++	 * userland). The return to userland is identified whenever
++	 * FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in flags.
++	 * Thus we have to be careful about not touching vma after handling the
++	 * fault, so we read the pkey beforehand.
+ 	 */
++	pkey = vma_pkey(vma);
+ 	fault = handle_mm_fault(vma, address, flags);
+ 	major |= fault & VM_FAULT_MAJOR;
+ 
+@@ -1420,7 +1430,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
+ 		return;
+ 	}
+ 
+-	pkey = vma_pkey(vma);
+ 	up_read(&mm->mmap_sem);
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		mm_fault_error(regs, error_code, address, &pkey, fault);
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 95379fc83805..b1c76aa73492 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -282,6 +282,7 @@ EXPORT_SYMBOL(blk_stop_queue);
+ void blk_sync_queue(struct request_queue *q)
+ {
+ 	del_timer_sync(&q->timeout);
++	cancel_work_sync(&q->timeout_work);
+ 
+ 	if (q->mq_ops) {
+ 		struct blk_mq_hw_ctx *hctx;
+@@ -720,6 +721,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
+ 	setup_timer(&q->backing_dev_info.laptop_mode_wb_timer,
+ 		    laptop_mode_timer_fn, (unsigned long) q);
+ 	setup_timer(&q->timeout, blk_rq_timed_out_timer, (unsigned long) q);
++	INIT_WORK(&q->timeout_work, NULL);
+ 	INIT_LIST_HEAD(&q->queue_head);
+ 	INIT_LIST_HEAD(&q->timeout_list);
+ 	INIT_LIST_HEAD(&q->icq_list);
+diff --git a/block/blk-timeout.c b/block/blk-timeout.c
+index a30441a200c0..220661a50f58 100644
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -135,8 +135,6 @@ void blk_timeout_work(struct work_struct *work)
+ 	struct request *rq, *tmp;
+ 	int next_set = 0;
+ 
+-	if (blk_queue_enter(q, true))
+-		return;
+ 	spin_lock_irqsave(q->queue_lock, flags);
+ 
+ 	list_for_each_entry_safe(rq, tmp, &q->timeout_list, timeout_list)
+@@ -146,7 +144,6 @@ void blk_timeout_work(struct work_struct *work)
+ 		mod_timer(&q->timeout, round_jiffies_up(next));
+ 
+ 	spin_unlock_irqrestore(q->queue_lock, flags);
+-	blk_queue_exit(q);
+ }
+ 
+ /**
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 51874695a730..c3bcb7f5986e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -482,8 +482,11 @@ static inline void __acpi_ec_enable_event(struct acpi_ec *ec)
+ {
+ 	if (!test_and_set_bit(EC_FLAGS_QUERY_ENABLED, &ec->flags))
+ 		ec_log_drv("event unblocked");
+-	if (!test_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+-		advance_transaction(ec);
++	/*
++	 * Unconditionally invoke this once after enabling the event
++	 * handling mechanism to detect the pending events.
++	 */
++	advance_transaction(ec);
+ }
+ 
+ static inline void __acpi_ec_disable_event(struct acpi_ec *ec)
+@@ -1458,11 +1461,10 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events)
+ 			if (test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+ 			    ec->reference_count >= 1)
+ 				acpi_ec_enable_gpe(ec, true);
+-
+-			/* EC is fully operational, allow queries */
+-			acpi_ec_enable_event(ec);
+ 		}
+ 	}
++	/* EC is fully operational, allow queries */
++	acpi_ec_enable_event(ec);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 0e1ec37070d1..6475a1343483 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2329,8 +2329,8 @@ static void ata_eh_link_autopsy(struct ata_link *link)
+ 		if (dev->flags & ATA_DFLAG_DUBIOUS_XFER)
+ 			eflags |= ATA_EFLAG_DUBIOUS_XFER;
+ 		ehc->i.action |= ata_eh_speed_down(dev, eflags, all_err_mask);
++		trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	}
+-	trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask);
+ 	DPRINTK("EXIT\n");
+ }
+ 
+diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
+index b52c617947ad..69379443e5eb 100644
+--- a/drivers/base/power/opp/of.c
++++ b/drivers/base/power/opp/of.c
+@@ -348,6 +348,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ 		if (ret) {
+ 			dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
+ 				ret);
++			of_node_put(np);
+ 			goto free_table;
+ 		}
+ 	}
+diff --git a/drivers/clk/qcom/gcc-ipq4019.c b/drivers/clk/qcom/gcc-ipq4019.c
+index b593065de8db..8ab6ce4d976f 100644
+--- a/drivers/clk/qcom/gcc-ipq4019.c
++++ b/drivers/clk/qcom/gcc-ipq4019.c
+@@ -525,10 +525,20 @@ static struct clk_rcg2  sdcc1_apps_clk_src = {
+ };
+ 
+ static const struct freq_tbl ftbl_gcc_apps_clk[] = {
+-	F(48000000, P_XO,	   1, 0, 0),
++	F(48000000,  P_XO,         1, 0, 0),
+ 	F(200000000, P_FEPLL200,   1, 0, 0),
++	F(384000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(413000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(448000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(488000000, P_DDRPLLAPSS, 1, 0, 0),
+ 	F(500000000, P_FEPLL500,   1, 0, 0),
+-	F(626000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(512000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(537000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(565000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(597000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(632000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(672000000, P_DDRPLLAPSS, 1, 0, 0),
++	F(716000000, P_DDRPLLAPSS, 1, 0, 0),
+ 	{ }
+ };
+ 
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+index 0cca3601d99e..df97e25aec76 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+@@ -468,8 +468,8 @@ static SUNXI_CCU_MUX_WITH_GATE(daudio0_clk, "daudio0", daudio_parents,
+ static SUNXI_CCU_MUX_WITH_GATE(daudio1_clk, "daudio1", daudio_parents,
+ 			       0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+ 
+-static SUNXI_CCU_M_WITH_GATE(spdif_clk, "spdif", "pll-audio",
+-			     0x0c0, 0, 4, BIT(31), CLK_SET_RATE_PARENT);
++static SUNXI_CCU_MUX_WITH_GATE(spdif_clk, "spdif", daudio_parents,
++			       0x0c0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+ 
+ static SUNXI_CCU_GATE(usb_phy0_clk,	"usb-phy0",	"osc24M",
+ 		      0x0cc, BIT(8), 0);
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+index 9bd1f78a0547..e1dc4e5b34e1 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+@@ -752,6 +752,13 @@ static const struct sunxi_ccu_desc sun8i_a33_ccu_desc = {
+ 	.num_resets	= ARRAY_SIZE(sun8i_a33_ccu_resets),
+ };
+ 
++static struct ccu_mux_nb sun8i_a33_cpu_nb = {
++	.common		= &cpux_clk.common,
++	.cm		= &cpux_clk.mux,
++	.delay_us	= 1, /* > 8 clock cycles at 24 MHz */
++	.bypass_index	= 1, /* index of 24 MHz oscillator */
++};
++
+ static void __init sun8i_a33_ccu_setup(struct device_node *node)
+ {
+ 	void __iomem *reg;
+@@ -775,6 +782,9 @@ static void __init sun8i_a33_ccu_setup(struct device_node *node)
+ 	writel(val, reg + SUN8I_A33_PLL_MIPI_REG);
+ 
+ 	sunxi_ccu_probe(node, reg, &sun8i_a33_ccu_desc);
++
++	ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
++				  &sun8i_a33_cpu_nb);
+ }
+ CLK_OF_DECLARE(sun8i_a33_ccu, "allwinner,sun8i-a33-ccu",
+ 	       sun8i_a33_ccu_setup);
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index c77333230bdf..7d060ffe8975 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -265,8 +265,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ 
+ 		/* Get configuration for the ATL instances */
+ 		snprintf(prop, sizeof(prop), "atl%u", i);
+-		of_node_get(node);
+-		cfg_node = of_find_node_by_name(node, prop);
++		cfg_node = of_get_child_by_name(node, prop);
+ 		if (cfg_node) {
+ 			ret = of_property_read_u32(cfg_node, "bws",
+ 						   &cdesc->bws);
+diff --git a/drivers/crypto/marvell/cesa.h b/drivers/crypto/marvell/cesa.h
+index e423d33decd4..36291840a12c 100644
+--- a/drivers/crypto/marvell/cesa.h
++++ b/drivers/crypto/marvell/cesa.h
+@@ -273,7 +273,8 @@ struct mv_cesa_op_ctx {
+ #define CESA_TDMA_SRC_IN_SRAM			BIT(30)
+ #define CESA_TDMA_END_OF_REQ			BIT(29)
+ #define CESA_TDMA_BREAK_CHAIN			BIT(28)
+-#define CESA_TDMA_TYPE_MSK			GENMASK(27, 0)
++#define CESA_TDMA_SET_STATE			BIT(27)
++#define CESA_TDMA_TYPE_MSK			GENMASK(26, 0)
+ #define CESA_TDMA_DUMMY				0
+ #define CESA_TDMA_DATA				1
+ #define CESA_TDMA_OP				2
+diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
+index 77712b375b84..662cf4ddb04b 100644
+--- a/drivers/crypto/marvell/hash.c
++++ b/drivers/crypto/marvell/hash.c
+@@ -280,13 +280,32 @@ static void mv_cesa_ahash_std_prepare(struct ahash_request *req)
+ 	sreq->offset = 0;
+ }
+ 
++static void mv_cesa_ahash_dma_step(struct ahash_request *req)
++{
++	struct mv_cesa_ahash_req *creq = ahash_request_ctx(req);
++	struct mv_cesa_req *base = &creq->base;
++
++	/* We must explicitly set the digest state. */
++	if (base->chain.first->flags & CESA_TDMA_SET_STATE) {
++		struct mv_cesa_engine *engine = base->engine;
++		int i;
++
++		/* Set the hash state in the IVDIG regs. */
++		for (i = 0; i < ARRAY_SIZE(creq->state); i++)
++			writel_relaxed(creq->state[i], engine->regs +
++				       CESA_IVDIG(i));
++	}
++
++	mv_cesa_dma_step(base);
++}
++
+ static void mv_cesa_ahash_step(struct crypto_async_request *req)
+ {
+ 	struct ahash_request *ahashreq = ahash_request_cast(req);
+ 	struct mv_cesa_ahash_req *creq = ahash_request_ctx(ahashreq);
+ 
+ 	if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ)
+-		mv_cesa_dma_step(&creq->base);
++		mv_cesa_ahash_dma_step(ahashreq);
+ 	else
+ 		mv_cesa_ahash_std_step(ahashreq);
+ }
+@@ -562,11 +581,15 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
+ 	struct mv_cesa_ahash_dma_iter iter;
+ 	struct mv_cesa_op_ctx *op = NULL;
+ 	unsigned int frag_len;
++	bool set_state = false;
+ 	int ret;
+ 
+ 	basereq->chain.first = NULL;
+ 	basereq->chain.last = NULL;
+ 
++	if (!mv_cesa_mac_op_is_first_frag(&creq->op_tmpl))
++		set_state = true;
++
+ 	if (creq->src_nents) {
+ 		ret = dma_map_sg(cesa_dev->dev, req->src, creq->src_nents,
+ 				 DMA_TO_DEVICE);
+@@ -650,6 +673,15 @@ static int mv_cesa_ahash_dma_req_init(struct ahash_request *req)
+ 	basereq->chain.last->flags |= (CESA_TDMA_END_OF_REQ |
+ 				       CESA_TDMA_BREAK_CHAIN);
+ 
++	if (set_state) {
++		/*
++		 * Put the CESA_TDMA_SET_STATE flag on the first tdma desc to
++		 * let the step logic know that the IVDIG registers should be
++		 * explicitly set before launching a TDMA chain.
++		 */
++		basereq->chain.first->flags |= CESA_TDMA_SET_STATE;
++	}
++
+ 	return 0;
+ 
+ err_free_tdma:
+diff --git a/drivers/crypto/marvell/tdma.c b/drivers/crypto/marvell/tdma.c
+index 9fd7a5fbaa1b..0cda6e3f2b4b 100644
+--- a/drivers/crypto/marvell/tdma.c
++++ b/drivers/crypto/marvell/tdma.c
+@@ -112,7 +112,14 @@ void mv_cesa_tdma_chain(struct mv_cesa_engine *engine,
+ 		last->next = dreq->chain.first;
+ 		engine->chain.last = dreq->chain.last;
+ 
+-		if (!(last->flags & CESA_TDMA_BREAK_CHAIN))
++		/*
++		 * Break the DMA chain if the CESA_TDMA_BREAK_CHAIN is set on
++		 * the last element of the current chain, or if the request
++		 * being queued needs the IV regs to be set before lauching
++		 * the request.
++		 */
++		if (!(last->flags & CESA_TDMA_BREAK_CHAIN) &&
++		    !(dreq->chain.first->flags & CESA_TDMA_SET_STATE))
+ 			last->next_dma = dreq->chain.first->cur_dma;
+ 	}
+ }
+diff --git a/drivers/dma/zx296702_dma.c b/drivers/dma/zx296702_dma.c
+index 245d759d5ffc..6059d81e701a 100644
+--- a/drivers/dma/zx296702_dma.c
++++ b/drivers/dma/zx296702_dma.c
+@@ -813,6 +813,7 @@ static int zx_dma_probe(struct platform_device *op)
+ 	INIT_LIST_HEAD(&d->slave.channels);
+ 	dma_cap_set(DMA_SLAVE, d->slave.cap_mask);
+ 	dma_cap_set(DMA_MEMCPY, d->slave.cap_mask);
++	dma_cap_set(DMA_CYCLIC, d->slave.cap_mask);
+ 	dma_cap_set(DMA_PRIVATE, d->slave.cap_mask);
+ 	d->slave.dev = &op->dev;
+ 	d->slave.device_free_chan_resources = zx_dma_free_chan_resources;
+diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
+index 1ef85b0c2b1f..d27e9361e236 100644
+--- a/drivers/gpio/gpio-mockup.c
++++ b/drivers/gpio/gpio-mockup.c
+@@ -126,7 +126,7 @@ static int mockup_gpio_probe(struct platform_device *pdev)
+ 	int i;
+ 	int base;
+ 	int ngpio;
+-	char chip_name[sizeof(GPIO_NAME) + 3];
++	char *chip_name;
+ 
+ 	if (gpio_mockup_params_nr < 2)
+ 		return -EINVAL;
+@@ -146,8 +146,12 @@ static int mockup_gpio_probe(struct platform_device *pdev)
+ 			ngpio = gpio_mockup_ranges[i * 2 + 1] - base;
+ 
+ 		if (ngpio >= 0) {
+-			sprintf(chip_name, "%s-%c", GPIO_NAME,
+-				pins_name_start + i);
++			chip_name = devm_kasprintf(dev, GFP_KERNEL,
++						   "%s-%c", GPIO_NAME,
++						   pins_name_start + i);
++			if (!chip_name)
++				return -ENOMEM;
++
+ 			ret = mockup_gpio_add(dev, &cntr[i],
+ 					      chip_name, base, ngpio);
+ 		} else {
+diff --git a/drivers/gpu/drm/armada/Makefile b/drivers/gpu/drm/armada/Makefile
+index ffd673615772..26412d2f8c98 100644
+--- a/drivers/gpu/drm/armada/Makefile
++++ b/drivers/gpu/drm/armada/Makefile
+@@ -4,3 +4,5 @@ armada-y	+= armada_510.o
+ armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
+ 
+ obj-$(CONFIG_DRM_ARMADA) := armada.o
++
++CFLAGS_armada_trace.o := -I$(src)
+diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
+index ee07bb4a57b7..11f54df0c19b 100644
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -348,14 +348,12 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
+ 
+ 	BUG_ON(!hole_node->hole_follows || node->allocated);
+ 
+-	if (adj_start < start)
+-		adj_start = start;
+-	if (adj_end > end)
+-		adj_end = end;
+-
+ 	if (mm->color_adjust)
+ 		mm->color_adjust(hole_node, color, &adj_start, &adj_end);
+ 
++	adj_start = max(adj_start, start);
++	adj_end = min(adj_end, end);
++
+ 	if (flags & DRM_MM_CREATE_TOP)
+ 		adj_start = adj_end - size;
+ 
+@@ -566,17 +564,15 @@ static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_
+ 			       flags & DRM_MM_SEARCH_BELOW) {
+ 		u64 hole_size = adj_end - adj_start;
+ 
+-		if (adj_start < start)
+-			adj_start = start;
+-		if (adj_end > end)
+-			adj_end = end;
+-
+ 		if (mm->color_adjust) {
+ 			mm->color_adjust(entry, color, &adj_start, &adj_end);
+ 			if (adj_end <= adj_start)
+ 				continue;
+ 		}
+ 
++		adj_start = max(adj_start, start);
++		adj_end = min(adj_end, end);
++
+ 		if (!check_free_hole(adj_start, adj_end, size, alignment))
+ 			continue;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 3ce9ba30d827..a19ec06f9e42 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -457,6 +457,7 @@ struct intel_crtc_scaler_state {
+ 
+ struct intel_pipe_wm {
+ 	struct intel_wm_level wm[5];
++	struct intel_wm_level raw_wm[5];
+ 	uint32_t linetime;
+ 	bool fbc_wm_enabled;
+ 	bool pipe_enabled;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 277a8026460b..49de4760cc16 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -27,7 +27,6 @@
+ 
+ #include <linux/cpufreq.h>
+ #include <drm/drm_plane_helper.h>
+-#include <drm/drm_atomic_helper.h>
+ #include "i915_drv.h"
+ #include "intel_drv.h"
+ #include "../../../platform/x86/intel_ips.h"
+@@ -2018,9 +2017,9 @@ static void ilk_compute_wm_level(const struct drm_i915_private *dev_priv,
+ 				 const struct intel_crtc *intel_crtc,
+ 				 int level,
+ 				 struct intel_crtc_state *cstate,
+-				 const struct intel_plane_state *pristate,
+-				 const struct intel_plane_state *sprstate,
+-				 const struct intel_plane_state *curstate,
++				 struct intel_plane_state *pristate,
++				 struct intel_plane_state *sprstate,
++				 struct intel_plane_state *curstate,
+ 				 struct intel_wm_level *result)
+ {
+ 	uint16_t pri_latency = dev_priv->wm.pri_latency[level];
+@@ -2342,24 +2341,28 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 	struct intel_pipe_wm *pipe_wm;
+ 	struct drm_device *dev = state->dev;
+ 	const struct drm_i915_private *dev_priv = to_i915(dev);
+-	struct drm_plane *plane;
+-	const struct drm_plane_state *plane_state;
+-	const struct intel_plane_state *pristate = NULL;
+-	const struct intel_plane_state *sprstate = NULL;
+-	const struct intel_plane_state *curstate = NULL;
++	struct intel_plane *intel_plane;
++	struct intel_plane_state *pristate = NULL;
++	struct intel_plane_state *sprstate = NULL;
++	struct intel_plane_state *curstate = NULL;
+ 	int level, max_level = ilk_wm_max_level(dev), usable_level;
+ 	struct ilk_wm_maximums max;
+ 
+ 	pipe_wm = &cstate->wm.ilk.optimal;
+ 
+-	drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, &cstate->base) {
+-		const struct intel_plane_state *ps = to_intel_plane_state(plane_state);
++	for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
++		struct intel_plane_state *ps;
+ 
+-		if (plane->type == DRM_PLANE_TYPE_PRIMARY)
++		ps = intel_atomic_get_existing_plane_state(state,
++							   intel_plane);
++		if (!ps)
++			continue;
++
++		if (intel_plane->base.type == DRM_PLANE_TYPE_PRIMARY)
+ 			pristate = ps;
+-		else if (plane->type == DRM_PLANE_TYPE_OVERLAY)
++		else if (intel_plane->base.type == DRM_PLANE_TYPE_OVERLAY)
+ 			sprstate = ps;
+-		else if (plane->type == DRM_PLANE_TYPE_CURSOR)
++		else if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
+ 			curstate = ps;
+ 	}
+ 
+@@ -2381,9 +2384,11 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 	if (pipe_wm->sprites_scaled)
+ 		usable_level = 0;
+ 
+-	memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
+ 	ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
+-			     pristate, sprstate, curstate, &pipe_wm->wm[0]);
++			     pristate, sprstate, curstate, &pipe_wm->raw_wm[0]);
++
++	memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
++	pipe_wm->wm[0] = pipe_wm->raw_wm[0];
+ 
+ 	if (IS_HASWELL(dev) || IS_BROADWELL(dev))
+ 		pipe_wm->linetime = hsw_compute_linetime_wm(cstate);
+@@ -2393,8 +2398,8 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 
+ 	ilk_compute_wm_reg_maximums(dev, 1, &max);
+ 
+-	for (level = 1; level <= usable_level; level++) {
+-		struct intel_wm_level *wm = &pipe_wm->wm[level];
++	for (level = 1; level <= max_level; level++) {
++		struct intel_wm_level *wm = &pipe_wm->raw_wm[level];
+ 
+ 		ilk_compute_wm_level(dev_priv, intel_crtc, level, cstate,
+ 				     pristate, sprstate, curstate, wm);
+@@ -2404,10 +2409,13 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
+ 		 * register maximums since such watermarks are
+ 		 * always invalid.
+ 		 */
+-		if (!ilk_validate_wm_level(level, &max, wm)) {
+-			memset(wm, 0, sizeof(*wm));
+-			break;
+-		}
++		if (level > usable_level)
++			continue;
++
++		if (ilk_validate_wm_level(level, &max, wm))
++			pipe_wm->wm[level] = *wm;
++		else
++			usable_level = level;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index cf83f6507ec8..48dfc163233e 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -321,7 +321,8 @@ static void mtk_drm_unbind(struct device *dev)
+ {
+ 	struct mtk_drm_private *private = dev_get_drvdata(dev);
+ 
+-	drm_put_dev(private->drm);
++	drm_dev_unregister(private->drm);
++	drm_dev_unref(private->drm);
+ 	private->drm = NULL;
+ }
+ 
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index 6e6c59a661b6..223944a3ba18 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -172,7 +172,7 @@ int sun4i_backend_update_layer_formats(struct sun4i_backend *backend,
+ 	ret = sun4i_backend_drm_format_to_layer(plane, fb->pixel_format, &val);
+ 	if (ret) {
+ 		DRM_DEBUG_DRIVER("Invalid format\n");
+-		return val;
++		return ret;
+ 	}
+ 
+ 	regmap_update_bits(backend->regs, SUN4I_BACKEND_ATTCTL_REG1(layer),
+diff --git a/drivers/iio/light/cm3232.c b/drivers/iio/light/cm3232.c
+index fe89b6823217..263e97235ea0 100644
+--- a/drivers/iio/light/cm3232.c
++++ b/drivers/iio/light/cm3232.c
+@@ -119,7 +119,7 @@ static int cm3232_reg_init(struct cm3232_chip *chip)
+ 	if (ret < 0)
+ 		dev_err(&chip->client->dev, "Error writing reg_cmd\n");
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /**
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 1eee8f7e75ca..84f91858b5e6 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -648,12 +648,19 @@ static void srp_path_rec_completion(int status,
+ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ {
+ 	struct srp_target_port *target = ch->target;
+-	int ret;
++	int ret = -ENODEV;
+ 
+ 	ch->path.numb_path = 1;
+ 
+ 	init_completion(&ch->done);
+ 
++	/*
++	 * Avoid that the SCSI host can be removed by srp_remove_target()
++	 * before srp_path_rec_completion() is called.
++	 */
++	if (!scsi_host_get(target->scsi_host))
++		goto out;
++
+ 	ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client,
+ 					       target->srp_host->srp_dev->dev,
+ 					       target->srp_host->port,
+@@ -667,18 +674,24 @@ static int srp_lookup_path(struct srp_rdma_ch *ch)
+ 					       GFP_KERNEL,
+ 					       srp_path_rec_completion,
+ 					       ch, &ch->path_query);
+-	if (ch->path_query_id < 0)
+-		return ch->path_query_id;
++	ret = ch->path_query_id;
++	if (ret < 0)
++		goto put;
+ 
+ 	ret = wait_for_completion_interruptible(&ch->done);
+ 	if (ret < 0)
+-		return ret;
++		goto put;
+ 
+-	if (ch->status < 0)
++	ret = ch->status;
++	if (ret < 0)
+ 		shost_printk(KERN_WARNING, target->scsi_host,
+ 			     PFX "Path record query failed\n");
+ 
+-	return ch->status;
++put:
++	scsi_host_put(target->scsi_host);
++
++out:
++	return ret;
+ }
+ 
+ static int srp_send_req(struct srp_rdma_ch *ch, bool multich)
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 0b1f69ed2e92..b9748970df4a 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2750,7 +2750,7 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ {
+ 	const char *p;
+ 	unsigned len, count, leading_zero_bytes;
+-	int ret, rc;
++	int ret;
+ 
+ 	p = name;
+ 	if (strncasecmp(p, "0x", 2) == 0)
+@@ -2762,10 +2762,9 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name)
+ 	count = min(len / 2, 16U);
+ 	leading_zero_bytes = 16 - count;
+ 	memset(i_port_id, 0, leading_zero_bytes);
+-	rc = hex2bin(i_port_id + leading_zero_bytes, p, count);
+-	if (rc < 0)
+-		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc);
+-	ret = 0;
++	ret = hex2bin(i_port_id + leading_zero_bytes, p, count);
++	if (ret < 0)
++		pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret);
+ out:
+ 	return ret;
+ }
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 24d388d74011..a37576a1798d 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1022,18 +1022,18 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 	int nr_parts;
+ 	struct partition_affinity *parts;
+ 
+-	parts_node = of_find_node_by_name(gic_node, "ppi-partitions");
++	parts_node = of_get_child_by_name(gic_node, "ppi-partitions");
+ 	if (!parts_node)
+ 		return;
+ 
+ 	nr_parts = of_get_child_count(parts_node);
+ 
+ 	if (!nr_parts)
+-		return;
++		goto out_put_node;
+ 
+ 	parts = kzalloc(sizeof(*parts) * nr_parts, GFP_KERNEL);
+ 	if (WARN_ON(!parts))
+-		return;
++		goto out_put_node;
+ 
+ 	for_each_child_of_node(parts_node, child_part) {
+ 		struct partition_affinity *part;
+@@ -1100,6 +1100,9 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ 
+ 		gic_data.ppi_descs[i] = desc;
+ 	}
++
++out_put_node:
++	of_node_put(parts_node);
+ }
+ 
+ static void __init gic_of_setup_kvm_info(struct device_node *node)
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index ca4abe1ccd8d..3fba31cea66e 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -404,7 +404,8 @@ long bch_bucket_alloc(struct cache *ca, unsigned reserve, bool wait)
+ 
+ 	finish_wait(&ca->set->bucket_wait, &w);
+ out:
+-	wake_up_process(ca->alloc_thread);
++	if (ca->alloc_thread)
++		wake_up_process(ca->alloc_thread);
+ 
+ 	trace_bcache_alloc(ca, reserve);
+ 
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index 8bf9667ff46b..7643f72adb1c 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -937,7 +937,8 @@ static void __get_memory_limit(struct dm_bufio_client *c,
+ 		buffers = c->minimum_buffers;
+ 
+ 	*limit_buffers = buffers;
+-	*threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100;
++	*threshold_buffers = mult_frac(buffers,
++				       DM_BUFIO_WRITEBACK_PERCENT, 100);
+ }
+ 
+ /*
+@@ -1856,19 +1857,15 @@ static int __init dm_bufio_init(void)
+ 	memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
+ 	memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
+ 
+-	mem = (__u64)((totalram_pages - totalhigh_pages) *
+-		      DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT;
++	mem = (__u64)mult_frac(totalram_pages - totalhigh_pages,
++			       DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT;
+ 
+ 	if (mem > ULONG_MAX)
+ 		mem = ULONG_MAX;
+ 
+ #ifdef CONFIG_MMU
+-	/*
+-	 * Get the size of vmalloc space the same way as VMALLOC_TOTAL
+-	 * in fs/proc/internal.h
+-	 */
+-	if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100)
+-		mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100;
++	if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100))
++		mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100);
+ #endif
+ 
+ 	dm_bufio_default_cache_size = mem;
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 40ceba1fe8be..1609d4971104 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -29,7 +29,6 @@ struct dm_kobject_holder {
+  * DM targets must _not_ deference a mapped_device to directly access its members!
+  */
+ struct mapped_device {
+-	struct srcu_struct io_barrier;
+ 	struct mutex suspend_lock;
+ 
+ 	/*
+@@ -127,6 +126,8 @@ struct mapped_device {
+ 	struct blk_mq_tag_set *tag_set;
+ 	bool use_blk_mq:1;
+ 	bool init_tio_pdu:1;
++
++	struct srcu_struct io_barrier;
+ };
+ 
+ void dm_init_md_queue(struct mapped_device *md);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index e66f4040d84b..c5522551122f 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -21,6 +21,7 @@
+ #include <linux/delay.h>
+ #include <linux/wait.h>
+ #include <linux/pr.h>
++#include <linux/vmalloc.h>
+ 
+ #define DM_MSG_PREFIX "core"
+ 
+@@ -1511,7 +1512,7 @@ static struct mapped_device *alloc_dev(int minor)
+ 	struct mapped_device *md;
+ 	void *old_md;
+ 
+-	md = kzalloc_node(sizeof(*md), GFP_KERNEL, numa_node_id);
++	md = vzalloc_node(sizeof(*md), numa_node_id);
+ 	if (!md) {
+ 		DMWARN("unable to allocate device, out of memory.");
+ 		return NULL;
+@@ -1605,7 +1606,7 @@ static struct mapped_device *alloc_dev(int minor)
+ bad_minor:
+ 	module_put(THIS_MODULE);
+ bad_module_get:
+-	kfree(md);
++	kvfree(md);
+ 	return NULL;
+ }
+ 
+@@ -1624,7 +1625,7 @@ static void free_dev(struct mapped_device *md)
+ 	free_minor(minor);
+ 
+ 	module_put(THIS_MODULE);
+-	kfree(md);
++	kvfree(md);
+ }
+ 
+ static void __bind_mempools(struct mapped_device *md, struct dm_table *t)
+@@ -2514,11 +2515,15 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
+ 
+ 	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
+ 
+-	if (test_bit(DMF_FREEING, &md->flags) ||
+-	    dm_deleting_md(md))
+-		return NULL;
+-
++	spin_lock(&_minor_lock);
++	if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) {
++		md = NULL;
++		goto out;
++	}
+ 	dm_get(md);
++out:
++	spin_unlock(&_minor_lock);
++
+ 	return md;
+ }
+ 
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index b49f80cb49c9..d9a5710532f4 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -286,11 +286,14 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
+ 		if (!dev->max_timeout)
+ 			return -ENOSYS;
+ 
++		/* Check for multiply overflow */
++		if (val > U32_MAX / 1000)
++			return -EINVAL;
++
+ 		tmp = val * 1000;
+ 
+-		if (tmp < dev->min_timeout ||
+-		    tmp > dev->max_timeout)
+-				return -EINVAL;
++		if (tmp < dev->min_timeout || tmp > dev->max_timeout)
++			return -EINVAL;
+ 
+ 		if (dev->s_timeout)
+ 			ret = dev->s_timeout(dev, tmp);
+diff --git a/drivers/media/usb/as102/as102_fw.c b/drivers/media/usb/as102/as102_fw.c
+index 5a28ce3a1d49..38dbc128340d 100644
+--- a/drivers/media/usb/as102/as102_fw.c
++++ b/drivers/media/usb/as102/as102_fw.c
+@@ -101,18 +101,23 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 				 unsigned char *cmd,
+ 				 const struct firmware *firmware) {
+ 
+-	struct as10x_fw_pkt_t fw_pkt;
++	struct as10x_fw_pkt_t *fw_pkt;
+ 	int total_read_bytes = 0, errno = 0;
+ 	unsigned char addr_has_changed = 0;
+ 
++	fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL);
++	if (!fw_pkt)
++		return -ENOMEM;
++
++
+ 	for (total_read_bytes = 0; total_read_bytes < firmware->size; ) {
+ 		int read_bytes = 0, data_len = 0;
+ 
+ 		/* parse intel hex line */
+ 		read_bytes = parse_hex_line(
+ 				(u8 *) (firmware->data + total_read_bytes),
+-				fw_pkt.raw.address,
+-				fw_pkt.raw.data,
++				fw_pkt->raw.address,
++				fw_pkt->raw.data,
+ 				&data_len,
+ 				&addr_has_changed);
+ 
+@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 		/* detect the end of file */
+ 		total_read_bytes += read_bytes;
+ 		if (total_read_bytes == firmware->size) {
+-			fw_pkt.u.request[0] = 0x00;
+-			fw_pkt.u.request[1] = 0x03;
++			fw_pkt->u.request[0] = 0x00;
++			fw_pkt->u.request[1] = 0x03;
+ 
+ 			/* send EOF command */
+ 			errno = bus_adap->ops->upload_fw_pkt(bus_adap,
+ 							     (uint8_t *)
+-							     &fw_pkt, 2, 0);
++							     fw_pkt, 2, 0);
+ 			if (errno < 0)
+ 				goto error;
+ 		} else {
+ 			if (!addr_has_changed) {
+ 				/* prepare command to send */
+-				fw_pkt.u.request[0] = 0x00;
+-				fw_pkt.u.request[1] = 0x01;
++				fw_pkt->u.request[0] = 0x00;
++				fw_pkt->u.request[1] = 0x01;
+ 
+-				data_len += sizeof(fw_pkt.u.request);
+-				data_len += sizeof(fw_pkt.raw.address);
++				data_len += sizeof(fw_pkt->u.request);
++				data_len += sizeof(fw_pkt->raw.address);
+ 
+ 				/* send cmd to device */
+ 				errno = bus_adap->ops->upload_fw_pkt(bus_adap,
+ 								     (uint8_t *)
+-								     &fw_pkt,
++								     fw_pkt,
+ 								     data_len,
+ 								     0);
+ 				if (errno < 0)
+@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap,
+ 		}
+ 	}
+ error:
++	kfree(fw_pkt);
+ 	return (errno == 0) ? total_read_bytes : errno;
+ }
+ 
+diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
+index be9e3335dcb7..921cf1edb3b1 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
+@@ -1622,7 +1622,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
+ 	nr = dev->devno;
+ 
+ 	assoc_desc = udev->actconfig->intf_assoc[0];
+-	if (assoc_desc->bFirstInterface != ifnum) {
++	if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) {
+ 		dev_err(d, "Not found matching IAD interface\n");
+ 		retval = -ENODEV;
+ 		goto err_if;
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index adc2147fcff7..bd6884223a0d 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1219,6 +1219,16 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
+ }
+ EXPORT_SYMBOL(v4l2_ctrl_fill);
+ 
++static u32 user_flags(const struct v4l2_ctrl *ctrl)
++{
++	u32 flags = ctrl->flags;
++
++	if (ctrl->is_ptr)
++		flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
++
++	return flags;
++}
++
+ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes)
+ {
+ 	memset(ev->reserved, 0, sizeof(ev->reserved));
+@@ -1226,7 +1236,7 @@ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 change
+ 	ev->id = ctrl->id;
+ 	ev->u.ctrl.changes = changes;
+ 	ev->u.ctrl.type = ctrl->type;
+-	ev->u.ctrl.flags = ctrl->flags;
++	ev->u.ctrl.flags = user_flags(ctrl);
+ 	if (ctrl->is_ptr)
+ 		ev->u.ctrl.value64 = 0;
+ 	else
+@@ -2550,10 +2560,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
+ 	else
+ 		qc->id = ctrl->id;
+ 	strlcpy(qc->name, ctrl->name, sizeof(qc->name));
+-	qc->flags = ctrl->flags;
++	qc->flags = user_flags(ctrl);
+ 	qc->type = ctrl->type;
+-	if (ctrl->is_ptr)
+-		qc->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD;
+ 	qc->elem_size = ctrl->elem_size;
+ 	qc->elems = ctrl->elems;
+ 	qc->nr_of_dims = ctrl->nr_of_dims;
+diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
+index dbf256217b3e..ada2d88fd4c7 100644
+--- a/drivers/mtd/nand/mtk_ecc.c
++++ b/drivers/mtd/nand/mtk_ecc.c
+@@ -116,6 +116,11 @@ static irqreturn_t mtk_ecc_irq(int irq, void *id)
+ 		op = ECC_DECODE;
+ 		dec = readw(ecc->regs + ECC_DECDONE);
+ 		if (dec & ecc->sectors) {
++			/*
++			 * Clear decode IRQ status once again to ensure that
++			 * there will be no extra IRQ.
++			 */
++			readw(ecc->regs + ECC_DECIRQ_STA);
+ 			ecc->sectors = 0;
+ 			complete(&ecc->done);
+ 		} else {
+@@ -131,8 +136,6 @@ static irqreturn_t mtk_ecc_irq(int irq, void *id)
+ 		}
+ 	}
+ 
+-	writel(0, ecc->regs + ECC_IRQ_REG(op));
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -342,6 +345,12 @@ void mtk_ecc_disable(struct mtk_ecc *ecc)
+ 
+ 	/* disable it */
+ 	mtk_ecc_wait_idle(ecc, op);
++	if (op == ECC_DECODE)
++		/*
++		 * Clear decode IRQ status in case there is a timeout to wait
++		 * decode IRQ.
++		 */
++		readw(ecc->regs + ECC_DECIRQ_STA);
+ 	writew(0, ecc->regs + ECC_IRQ_REG(op));
+ 	writew(ECC_OP_DISABLE, ecc->regs + ECC_CTL_REG(op));
+ 
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index 31a6ee307d80..a77cfd74a92e 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -2935,15 +2935,18 @@ static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
+ 			    size_t *retlen, const uint8_t *buf)
+ {
+ 	struct nand_chip *chip = mtd_to_nand(mtd);
++	int chipnr = (int)(to >> chip->chip_shift);
+ 	struct mtd_oob_ops ops;
+ 	int ret;
+ 
+-	/* Wait for the device to get ready */
+-	panic_nand_wait(mtd, chip, 400);
+-
+ 	/* Grab the device */
+ 	panic_nand_get_device(chip, mtd, FL_WRITING);
+ 
++	chip->select_chip(mtd, chipnr);
++
++	/* Wait for the device to get ready */
++	panic_nand_wait(mtd, chip, 400);
++
+ 	memset(&ops, 0, sizeof(ops));
+ 	ops.len = len;
+ 	ops.datbuf = (uint8_t *)buf;
+diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
+index c178cb0dd219..f3a516b3f108 100644
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1133,129 +1133,172 @@ static u8  bch8_polynomial[] = {0xef, 0x51, 0x2e, 0x09, 0xed, 0x93, 0x9a, 0xc2,
+ 				0x97, 0x79, 0xe5, 0x24, 0xb5};
+ 
+ /**
+- * omap_calculate_ecc_bch - Generate bytes of ECC bytes
++ * _omap_calculate_ecc_bch - Generate ECC bytes for one sector
+  * @mtd:	MTD device structure
+  * @dat:	The pointer to data on which ecc is computed
+  * @ecc_code:	The ecc_code buffer
++ * @i:		The sector number (for a multi sector page)
+  *
+- * Support calculating of BCH4/8 ecc vectors for the page
++ * Support calculating of BCH4/8/16 ECC vectors for one sector
++ * within a page. Sector number is in @i.
+  */
+-static int __maybe_unused omap_calculate_ecc_bch(struct mtd_info *mtd,
+-					const u_char *dat, u_char *ecc_calc)
++static int _omap_calculate_ecc_bch(struct mtd_info *mtd,
++				   const u_char *dat, u_char *ecc_calc, int i)
+ {
+ 	struct omap_nand_info *info = mtd_to_omap(mtd);
+ 	int eccbytes	= info->nand.ecc.bytes;
+ 	struct gpmc_nand_regs	*gpmc_regs = &info->reg;
+ 	u8 *ecc_code;
+-	unsigned long nsectors, bch_val1, bch_val2, bch_val3, bch_val4;
++	unsigned long bch_val1, bch_val2, bch_val3, bch_val4;
+ 	u32 val;
+-	int i, j;
++	int j;
++
++	ecc_code = ecc_calc;
++	switch (info->ecc_opt) {
++	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
++	case OMAP_ECC_BCH8_CODE_HW:
++		bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
++		bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
++		bch_val3 = readl(gpmc_regs->gpmc_bch_result2[i]);
++		bch_val4 = readl(gpmc_regs->gpmc_bch_result3[i]);
++		*ecc_code++ = (bch_val4 & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val3 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val3 & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val2 & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 24) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 16) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 8) & 0xFF);
++		*ecc_code++ = (bch_val1 & 0xFF);
++		break;
++	case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
++	case OMAP_ECC_BCH4_CODE_HW:
++		bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
++		bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
++		*ecc_code++ = ((bch_val2 >> 12) & 0xFF);
++		*ecc_code++ = ((bch_val2 >> 4) & 0xFF);
++		*ecc_code++ = ((bch_val2 & 0xF) << 4) |
++			((bch_val1 >> 28) & 0xF);
++		*ecc_code++ = ((bch_val1 >> 20) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 12) & 0xFF);
++		*ecc_code++ = ((bch_val1 >> 4) & 0xFF);
++		*ecc_code++ = ((bch_val1 & 0xF) << 4);
++		break;
++	case OMAP_ECC_BCH16_CODE_HW:
++		val = readl(gpmc_regs->gpmc_bch_result6[i]);
++		ecc_code[0]  = ((val >>  8) & 0xFF);
++		ecc_code[1]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result5[i]);
++		ecc_code[2]  = ((val >> 24) & 0xFF);
++		ecc_code[3]  = ((val >> 16) & 0xFF);
++		ecc_code[4]  = ((val >>  8) & 0xFF);
++		ecc_code[5]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result4[i]);
++		ecc_code[6]  = ((val >> 24) & 0xFF);
++		ecc_code[7]  = ((val >> 16) & 0xFF);
++		ecc_code[8]  = ((val >>  8) & 0xFF);
++		ecc_code[9]  = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result3[i]);
++		ecc_code[10] = ((val >> 24) & 0xFF);
++		ecc_code[11] = ((val >> 16) & 0xFF);
++		ecc_code[12] = ((val >>  8) & 0xFF);
++		ecc_code[13] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result2[i]);
++		ecc_code[14] = ((val >> 24) & 0xFF);
++		ecc_code[15] = ((val >> 16) & 0xFF);
++		ecc_code[16] = ((val >>  8) & 0xFF);
++		ecc_code[17] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result1[i]);
++		ecc_code[18] = ((val >> 24) & 0xFF);
++		ecc_code[19] = ((val >> 16) & 0xFF);
++		ecc_code[20] = ((val >>  8) & 0xFF);
++		ecc_code[21] = ((val >>  0) & 0xFF);
++		val = readl(gpmc_regs->gpmc_bch_result0[i]);
++		ecc_code[22] = ((val >> 24) & 0xFF);
++		ecc_code[23] = ((val >> 16) & 0xFF);
++		ecc_code[24] = ((val >>  8) & 0xFF);
++		ecc_code[25] = ((val >>  0) & 0xFF);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	/* ECC scheme specific syndrome customizations */
++	switch (info->ecc_opt) {
++	case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
++		/* Add constant polynomial to remainder, so that
++		 * ECC of blank pages results in 0x0 on reading back
++		 */
++		for (j = 0; j < eccbytes; j++)
++			ecc_calc[j] ^= bch4_polynomial[j];
++		break;
++	case OMAP_ECC_BCH4_CODE_HW:
++		/* Set  8th ECC byte as 0x0 for ROM compatibility */
++		ecc_calc[eccbytes - 1] = 0x0;
++		break;
++	case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
++		/* Add constant polynomial to remainder, so that
++		 * ECC of blank pages results in 0x0 on reading back
++		 */
++		for (j = 0; j < eccbytes; j++)
++			ecc_calc[j] ^= bch8_polynomial[j];
++		break;
++	case OMAP_ECC_BCH8_CODE_HW:
++		/* Set 14th ECC byte as 0x0 for ROM compatibility */
++		ecc_calc[eccbytes - 1] = 0x0;
++		break;
++	case OMAP_ECC_BCH16_CODE_HW:
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++/**
++ * omap_calculate_ecc_bch_sw - ECC generator for sector for SW based correction
++ * @mtd:	MTD device structure
++ * @dat:	The pointer to data on which ecc is computed
++ * @ecc_code:	The ecc_code buffer
++ *
++ * Support calculating of BCH4/8/16 ECC vectors for one sector. This is used
++ * when SW based correction is required as ECC is required for one sector
++ * at a time.
++ */
++static int omap_calculate_ecc_bch_sw(struct mtd_info *mtd,
++				     const u_char *dat, u_char *ecc_calc)
++{
++	return _omap_calculate_ecc_bch(mtd, dat, ecc_calc, 0);
++}
++
++/**
++ * omap_calculate_ecc_bch_multi - Generate ECC for multiple sectors
++ * @mtd:	MTD device structure
++ * @dat:	The pointer to data on which ecc is computed
++ * @ecc_code:	The ecc_code buffer
++ *
++ * Support calculating of BCH4/8/16 ecc vectors for the entire page in one go.
++ */
++static int omap_calculate_ecc_bch_multi(struct mtd_info *mtd,
++					const u_char *dat, u_char *ecc_calc)
++{
++	struct omap_nand_info *info = mtd_to_omap(mtd);
++	int eccbytes = info->nand.ecc.bytes;
++	unsigned long nsectors;
++	int i, ret;
+ 
+ 	nsectors = ((readl(info->reg.gpmc_ecc_config) >> 4) & 0x7) + 1;
+ 	for (i = 0; i < nsectors; i++) {
+-		ecc_code = ecc_calc;
+-		switch (info->ecc_opt) {
+-		case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+-		case OMAP_ECC_BCH8_CODE_HW:
+-			bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			bch_val3 = readl(gpmc_regs->gpmc_bch_result2[i]);
+-			bch_val4 = readl(gpmc_regs->gpmc_bch_result3[i]);
+-			*ecc_code++ = (bch_val4 & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val3 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val3 & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val2 & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 24) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 16) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 8) & 0xFF);
+-			*ecc_code++ = (bch_val1 & 0xFF);
+-			break;
+-		case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
+-		case OMAP_ECC_BCH4_CODE_HW:
+-			bch_val1 = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			bch_val2 = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			*ecc_code++ = ((bch_val2 >> 12) & 0xFF);
+-			*ecc_code++ = ((bch_val2 >> 4) & 0xFF);
+-			*ecc_code++ = ((bch_val2 & 0xF) << 4) |
+-				((bch_val1 >> 28) & 0xF);
+-			*ecc_code++ = ((bch_val1 >> 20) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 12) & 0xFF);
+-			*ecc_code++ = ((bch_val1 >> 4) & 0xFF);
+-			*ecc_code++ = ((bch_val1 & 0xF) << 4);
+-			break;
+-		case OMAP_ECC_BCH16_CODE_HW:
+-			val = readl(gpmc_regs->gpmc_bch_result6[i]);
+-			ecc_code[0]  = ((val >>  8) & 0xFF);
+-			ecc_code[1]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result5[i]);
+-			ecc_code[2]  = ((val >> 24) & 0xFF);
+-			ecc_code[3]  = ((val >> 16) & 0xFF);
+-			ecc_code[4]  = ((val >>  8) & 0xFF);
+-			ecc_code[5]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result4[i]);
+-			ecc_code[6]  = ((val >> 24) & 0xFF);
+-			ecc_code[7]  = ((val >> 16) & 0xFF);
+-			ecc_code[8]  = ((val >>  8) & 0xFF);
+-			ecc_code[9]  = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result3[i]);
+-			ecc_code[10] = ((val >> 24) & 0xFF);
+-			ecc_code[11] = ((val >> 16) & 0xFF);
+-			ecc_code[12] = ((val >>  8) & 0xFF);
+-			ecc_code[13] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result2[i]);
+-			ecc_code[14] = ((val >> 24) & 0xFF);
+-			ecc_code[15] = ((val >> 16) & 0xFF);
+-			ecc_code[16] = ((val >>  8) & 0xFF);
+-			ecc_code[17] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result1[i]);
+-			ecc_code[18] = ((val >> 24) & 0xFF);
+-			ecc_code[19] = ((val >> 16) & 0xFF);
+-			ecc_code[20] = ((val >>  8) & 0xFF);
+-			ecc_code[21] = ((val >>  0) & 0xFF);
+-			val = readl(gpmc_regs->gpmc_bch_result0[i]);
+-			ecc_code[22] = ((val >> 24) & 0xFF);
+-			ecc_code[23] = ((val >> 16) & 0xFF);
+-			ecc_code[24] = ((val >>  8) & 0xFF);
+-			ecc_code[25] = ((val >>  0) & 0xFF);
+-			break;
+-		default:
+-			return -EINVAL;
+-		}
+-
+-		/* ECC scheme specific syndrome customizations */
+-		switch (info->ecc_opt) {
+-		case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
+-			/* Add constant polynomial to remainder, so that
+-			 * ECC of blank pages results in 0x0 on reading back */
+-			for (j = 0; j < eccbytes; j++)
+-				ecc_calc[j] ^= bch4_polynomial[j];
+-			break;
+-		case OMAP_ECC_BCH4_CODE_HW:
+-			/* Set  8th ECC byte as 0x0 for ROM compatibility */
+-			ecc_calc[eccbytes - 1] = 0x0;
+-			break;
+-		case OMAP_ECC_BCH8_CODE_HW_DETECTION_SW:
+-			/* Add constant polynomial to remainder, so that
+-			 * ECC of blank pages results in 0x0 on reading back */
+-			for (j = 0; j < eccbytes; j++)
+-				ecc_calc[j] ^= bch8_polynomial[j];
+-			break;
+-		case OMAP_ECC_BCH8_CODE_HW:
+-			/* Set 14th ECC byte as 0x0 for ROM compatibility */
+-			ecc_calc[eccbytes - 1] = 0x0;
+-			break;
+-		case OMAP_ECC_BCH16_CODE_HW:
+-			break;
+-		default:
+-			return -EINVAL;
+-		}
++		ret = _omap_calculate_ecc_bch(mtd, dat, ecc_calc, i);
++		if (ret)
++			return ret;
+ 
+-	ecc_calc += eccbytes;
++		ecc_calc += eccbytes;
+ 	}
+ 
+ 	return 0;
+@@ -1496,7 +1539,7 @@ static int omap_write_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 	chip->write_buf(mtd, buf, mtd->writesize);
+ 
+ 	/* Update ecc vector from GPMC result registers */
+-	chip->ecc.calculate(mtd, buf, &ecc_calc[0]);
++	omap_calculate_ecc_bch_multi(mtd, buf, &ecc_calc[0]);
+ 
+ 	ret = mtd_ooblayout_set_eccbytes(mtd, ecc_calc, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -1508,6 +1551,72 @@ static int omap_write_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 	return 0;
+ }
+ 
++/**
++ * omap_write_subpage_bch - BCH hardware ECC based subpage write
++ * @mtd:	mtd info structure
++ * @chip:	nand chip info structure
++ * @offset:	column address of subpage within the page
++ * @data_len:	data length
++ * @buf:	data buffer
++ * @oob_required: must write chip->oob_poi to OOB
++ * @page: page number to write
++ *
++ * OMAP optimized subpage write method.
++ */
++static int omap_write_subpage_bch(struct mtd_info *mtd,
++				  struct nand_chip *chip, u32 offset,
++				  u32 data_len, const u8 *buf,
++				  int oob_required, int page)
++{
++	u8 *ecc_calc = chip->buffers->ecccalc;
++	int ecc_size      = chip->ecc.size;
++	int ecc_bytes     = chip->ecc.bytes;
++	int ecc_steps     = chip->ecc.steps;
++	u32 start_step = offset / ecc_size;
++	u32 end_step   = (offset + data_len - 1) / ecc_size;
++	int step, ret = 0;
++
++	/*
++	 * Write entire page at one go as it would be optimal
++	 * as ECC is calculated by hardware.
++	 * ECC is calculated for all subpages but we choose
++	 * only what we want.
++	 */
++
++	/* Enable GPMC ECC engine */
++	chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
++
++	/* Write data */
++	chip->write_buf(mtd, buf, mtd->writesize);
++
++	for (step = 0; step < ecc_steps; step++) {
++		/* mask ECC of un-touched subpages by padding 0xFF */
++		if (step < start_step || step > end_step)
++			memset(ecc_calc, 0xff, ecc_bytes);
++		else
++			ret = _omap_calculate_ecc_bch(mtd, buf, ecc_calc, step);
++
++		if (ret)
++			return ret;
++
++		buf += ecc_size;
++		ecc_calc += ecc_bytes;
++	}
++
++	/* copy calculated ECC for whole page to chip->buffer->oob */
++	/* this include masked-value(0xFF) for unwritten subpages */
++	ecc_calc = chip->buffers->ecccalc;
++	ret = mtd_ooblayout_set_eccbytes(mtd, ecc_calc, chip->oob_poi, 0,
++					 chip->ecc.total);
++	if (ret)
++		return ret;
++
++	/* write OOB buffer to NAND device */
++	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
++
++	return 0;
++}
++
+ /**
+  * omap_read_page_bch - BCH ecc based page read function for entire page
+  * @mtd:		mtd info structure
+@@ -1544,7 +1653,7 @@ static int omap_read_page_bch(struct mtd_info *mtd, struct nand_chip *chip,
+ 		       chip->ecc.total);
+ 
+ 	/* Calculate ecc bytes */
+-	chip->ecc.calculate(mtd, buf, ecc_calc);
++	omap_calculate_ecc_bch_multi(mtd, buf, ecc_calc);
+ 
+ 	ret = mtd_ooblayout_get_eccbytes(mtd, ecc_code, chip->oob_poi, 0,
+ 					 chip->ecc.total);
+@@ -2044,7 +2153,7 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 4;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= nand_bch_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
++		nand_chip->ecc.calculate	= omap_calculate_ecc_bch_sw;
+ 		mtd_set_ooblayout(mtd, &omap_sw_ooblayout_ops);
+ 		/* Reserve one byte for the OMAP marker */
+ 		oobbytes_per_step		= nand_chip->ecc.bytes + 1;
+@@ -2066,9 +2175,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 4;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+@@ -2087,7 +2196,7 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 8;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= nand_bch_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
++		nand_chip->ecc.calculate	= omap_calculate_ecc_bch_sw;
+ 		mtd_set_ooblayout(mtd, &omap_sw_ooblayout_ops);
+ 		/* Reserve one byte for the OMAP marker */
+ 		oobbytes_per_step		= nand_chip->ecc.bytes + 1;
+@@ -2109,9 +2218,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 8;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+@@ -2131,9 +2240,9 @@ static int omap_nand_probe(struct platform_device *pdev)
+ 		nand_chip->ecc.strength		= 16;
+ 		nand_chip->ecc.hwctl		= omap_enable_hwecc_bch;
+ 		nand_chip->ecc.correct		= omap_elm_correct_data;
+-		nand_chip->ecc.calculate	= omap_calculate_ecc_bch;
+ 		nand_chip->ecc.read_page	= omap_read_page_bch;
+ 		nand_chip->ecc.write_page	= omap_write_page_bch;
++		nand_chip->ecc.write_subpage	= omap_write_subpage_bch;
+ 		mtd_set_ooblayout(mtd, &omap_ooblayout_ops);
+ 		oobbytes_per_step		= nand_chip->ecc.bytes;
+ 
+diff --git a/drivers/net/ethernet/3com/typhoon.c b/drivers/net/ethernet/3com/typhoon.c
+index 8f8418d2ac4a..a0012c3cb4f6 100644
+--- a/drivers/net/ethernet/3com/typhoon.c
++++ b/drivers/net/ethernet/3com/typhoon.c
+@@ -2366,9 +2366,9 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 * 4) Get the hardware address.
+ 	 * 5) Put the card to sleep.
+ 	 */
+-	if (typhoon_reset(ioaddr, WaitSleep) < 0) {
++	err = typhoon_reset(ioaddr, WaitSleep);
++	if (err < 0) {
+ 		err_msg = "could not reset 3XP";
+-		err = -EIO;
+ 		goto error_out_dma;
+ 	}
+ 
+@@ -2382,24 +2382,25 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	typhoon_init_interface(tp);
+ 	typhoon_init_rings(tp);
+ 
+-	if(typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST) < 0) {
++	err = typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST);
++	if (err < 0) {
+ 		err_msg = "cannot boot 3XP sleep image";
+-		err = -EIO;
+ 		goto error_out_reset;
+ 	}
+ 
+ 	INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_MAC_ADDRESS);
+-	if(typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp) < 0) {
++	err = typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp);
++	if (err < 0) {
+ 		err_msg = "cannot read MAC address";
+-		err = -EIO;
+ 		goto error_out_reset;
+ 	}
+ 
+ 	*(__be16 *)&dev->dev_addr[0] = htons(le16_to_cpu(xp_resp[0].parm1));
+ 	*(__be32 *)&dev->dev_addr[2] = htonl(le32_to_cpu(xp_resp[0].parm2));
+ 
+-	if(!is_valid_ether_addr(dev->dev_addr)) {
++	if (!is_valid_ether_addr(dev->dev_addr)) {
+ 		err_msg = "Could not obtain valid ethernet address, aborting";
++		err = -EIO;
+ 		goto error_out_reset;
+ 	}
+ 
+@@ -2407,7 +2408,8 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 * later when we print out the version reported.
+ 	 */
+ 	INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_VERSIONS);
+-	if(typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp) < 0) {
++	err = typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp);
++	if (err < 0) {
+ 		err_msg = "Could not get Sleep Image version";
+ 		goto error_out_reset;
+ 	}
+@@ -2424,9 +2426,9 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	if(xp_resp[0].numDesc != 0)
+ 		tp->capabilities |= TYPHOON_WAKEUP_NEEDS_RESET;
+ 
+-	if(typhoon_sleep(tp, PCI_D3hot, 0) < 0) {
++	err = typhoon_sleep(tp, PCI_D3hot, 0);
++	if (err < 0) {
+ 		err_msg = "cannot put adapter to sleep";
+-		err = -EIO;
+ 		goto error_out_reset;
+ 	}
+ 
+@@ -2449,7 +2451,8 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	dev->features = dev->hw_features |
+ 		NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_RXCSUM;
+ 
+-	if(register_netdev(dev) < 0) {
++	err = register_netdev(dev);
++	if (err < 0) {
+ 		err_msg = "unable to register netdev";
+ 		goto error_out_reset;
+ 	}
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 333df540b375..5d2cf56aed0e 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3800,6 +3800,30 @@ static int hwrm_ring_alloc_send_msg(struct bnxt *bp,
+ 	return rc;
+ }
+ 
++static int bnxt_hwrm_set_async_event_cr(struct bnxt *bp, int idx)
++{
++	int rc;
++
++	if (BNXT_PF(bp)) {
++		struct hwrm_func_cfg_input req = {0};
++
++		bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
++		req.fid = cpu_to_le16(0xffff);
++		req.enables = cpu_to_le32(FUNC_CFG_REQ_ENABLES_ASYNC_EVENT_CR);
++		req.async_event_cr = cpu_to_le16(idx);
++		rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	} else {
++		struct hwrm_func_vf_cfg_input req = {0};
++
++		bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_VF_CFG, -1, -1);
++		req.enables =
++			cpu_to_le32(FUNC_VF_CFG_REQ_ENABLES_ASYNC_EVENT_CR);
++		req.async_event_cr = cpu_to_le16(idx);
++		rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	}
++	return rc;
++}
++
+ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
+ {
+ 	int i, rc = 0;
+@@ -3816,6 +3840,12 @@ static int bnxt_hwrm_ring_alloc(struct bnxt *bp)
+ 			goto err_out;
+ 		BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
+ 		bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
++
++		if (!i) {
++			rc = bnxt_hwrm_set_async_event_cr(bp, ring->fw_ring_id);
++			if (rc)
++				netdev_warn(bp->dev, "Failed to set async event completion ring.\n");
++		}
+ 	}
+ 
+ 	for (i = 0; i < bp->tx_nr_rings; i++) {
+diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
+index 0641c0098738..afb7ebe20b24 100644
+--- a/drivers/net/ethernet/intel/e1000e/defines.h
++++ b/drivers/net/ethernet/intel/e1000e/defines.h
+@@ -398,6 +398,7 @@
+ #define E1000_ICR_LSC           0x00000004 /* Link Status Change */
+ #define E1000_ICR_RXSEQ         0x00000008 /* Rx sequence error */
+ #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
++#define E1000_ICR_RXO           0x00000040 /* Receiver Overrun */
+ #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+ #define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
+ /* If this bit asserted, the driver should claim the interrupt */
+diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
+index b322011ec282..f457c5703d0c 100644
+--- a/drivers/net/ethernet/intel/e1000e/mac.c
++++ b/drivers/net/ethernet/intel/e1000e/mac.c
+@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw)
+  *  Checks to see of the link status of the hardware has changed.  If a
+  *  change in link status has been detected, then we read the PHY registers
+  *  to get the current speed/duplex if link exists.
++ *
++ *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
++ *  up).
+  **/
+ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ {
+@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * Change or Rx Sequence Error interrupt.
+ 	 */
+ 	if (!mac->get_link_status)
+-		return 0;
++		return 1;
+ 
+ 	/* First we want to see if the MII Status Register reports
+ 	 * link.  If so, then we want to get the current speed/duplex
+@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
+ 	 * different link partner.
+ 	 */
+ 	ret_val = e1000e_config_fc_after_link_up(hw);
+-	if (ret_val)
++	if (ret_val) {
+ 		e_dbg("Error configuring flow control\n");
++		return ret_val;
++	}
+ 
+-	return ret_val;
++	return 1;
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 7017281ba2dc..0feddf3393f9 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -1905,14 +1905,30 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data)
+ 	struct net_device *netdev = data;
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_hw *hw = &adapter->hw;
++	u32 icr;
++	bool enable = true;
++
++	icr = er32(ICR);
++	if (icr & E1000_ICR_RXO) {
++		ew32(ICR, E1000_ICR_RXO);
++		enable = false;
++		/* napi poll will re-enable Other, make sure it runs */
++		if (napi_schedule_prep(&adapter->napi)) {
++			adapter->total_rx_bytes = 0;
++			adapter->total_rx_packets = 0;
++			__napi_schedule(&adapter->napi);
++		}
++	}
++	if (icr & E1000_ICR_LSC) {
++		ew32(ICR, E1000_ICR_LSC);
++		hw->mac.get_link_status = true;
++		/* guard against interrupt when we're going down */
++		if (!test_bit(__E1000_DOWN, &adapter->state))
++			mod_timer(&adapter->watchdog_timer, jiffies + 1);
++	}
+ 
+-	hw->mac.get_link_status = true;
+-
+-	/* guard against interrupt when we're going down */
+-	if (!test_bit(__E1000_DOWN, &adapter->state)) {
+-		mod_timer(&adapter->watchdog_timer, jiffies + 1);
++	if (enable && !test_bit(__E1000_DOWN, &adapter->state))
+ 		ew32(IMS, E1000_IMS_OTHER);
+-	}
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -2683,7 +2699,8 @@ static int e1000e_poll(struct napi_struct *napi, int weight)
+ 		napi_complete_done(napi, work_done);
+ 		if (!test_bit(__E1000_DOWN, &adapter->state)) {
+ 			if (adapter->msix_entries)
+-				ew32(IMS, adapter->rx_ring->ims_val);
++				ew32(IMS, adapter->rx_ring->ims_val |
++				     E1000_IMS_OTHER);
+ 			else
+ 				e1000_irq_enable(adapter);
+ 		}
+@@ -4178,7 +4195,7 @@ static void e1000e_trigger_lsc(struct e1000_adapter *adapter)
+ 	struct e1000_hw *hw = &adapter->hw;
+ 
+ 	if (adapter->msix_entries)
+-		ew32(ICS, E1000_ICS_OTHER);
++		ew32(ICS, E1000_ICS_LSC | E1000_ICS_OTHER);
+ 	else
+ 		ew32(ICS, E1000_ICS_LSC);
+ }
+@@ -5056,7 +5073,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
+ 	case e1000_media_type_copper:
+ 		if (hw->mac.get_link_status) {
+ 			ret_val = hw->mac.ops.check_for_link(hw);
+-			link_active = !hw->mac.get_link_status;
++			link_active = ret_val > 0;
+ 		} else {
+ 			link_active = true;
+ 		}
+@@ -5074,7 +5091,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter)
+ 		break;
+ 	}
+ 
+-	if ((ret_val == E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
++	if ((ret_val == -E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) &&
+ 	    (er32(CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) {
+ 		/* See e1000_kmrn_lock_loss_workaround_ich8lan() */
+ 		e_info("Gigabit has been disabled, downgrading speed\n");
+diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
+index d78d47b41a71..86ff0969efb6 100644
+--- a/drivers/net/ethernet/intel/e1000e/phy.c
++++ b/drivers/net/ethernet/intel/e1000e/phy.c
+@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 	s32 ret_val = 0;
+ 	u16 i, phy_status;
+ 
++	*success = false;
+ 	for (i = 0; i < iterations; i++) {
+ 		/* Some PHYs require the MII_BMSR register to be read
+ 		 * twice due to the link bit being sticky.  No harm doing
+@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
+ 		ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
+ 		if (ret_val)
+ 			break;
+-		if (phy_status & BMSR_LSTATUS)
++		if (phy_status & BMSR_LSTATUS) {
++			*success = true;
+ 			break;
++		}
+ 		if (usec_interval >= 1000)
+ 			msleep(usec_interval / 1000);
+ 		else
+ 			udelay(usec_interval);
+ 	}
+ 
+-	*success = (i < iterations);
+-
+ 	return ret_val;
+ }
+ 
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+index 5de937852436..2aae6f88dca0 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+@@ -1225,7 +1225,7 @@ static bool fm10k_clean_tx_irq(struct fm10k_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE))
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 31c97e3937a4..2caafebb0295 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -3604,7 +3604,7 @@ static bool i40e_clean_fdir_tx_irq(struct i40e_ring *tx_ring, int budget)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if the descriptor isn't done, no work yet to do */
+ 		if (!(eop_desc->cmd_type_offset_bsz &
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 6287bf63c43c..c5430394fac9 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -679,7 +679,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* we have caught up to head, no work left to do */
+ 		if (tx_head == tx_desc)
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index 75f2a2cdd738..c03800d1000a 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -184,7 +184,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* we have caught up to head, no work left to do */
+ 		if (tx_head == tx_desc)
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index c6c2562d9df3..16839600fb78 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6660,7 +6660,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector, int napi_budget)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
+index 7dff7f6239cd..5428e39fa4e5 100644
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -810,7 +810,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 334eb96ecda3..a5428b6abdac 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1171,7 +1171,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index cbf70fe4028a..1499ce2bf9f6 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -325,7 +325,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_q_vector *q_vector,
+ 			break;
+ 
+ 		/* prevent any other reads prior to eop_desc */
+-		read_barrier_depends();
++		smp_rmb();
+ 
+ 		/* if DD is not set pending work has not been completed */
+ 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
+diff --git a/drivers/net/wireless/admtek/adm8211.c b/drivers/net/wireless/admtek/adm8211.c
+index 70ecd82d674d..098c814e22c8 100644
+--- a/drivers/net/wireless/admtek/adm8211.c
++++ b/drivers/net/wireless/admtek/adm8211.c
+@@ -413,6 +413,13 @@ static void adm8211_interrupt_rci(struct ieee80211_hw *dev)
+ 						       skb_tail_pointer(newskb),
+ 						       RX_PKT_SIZE,
+ 						       PCI_DMA_FROMDEVICE);
++				if (pci_dma_mapping_error(priv->pdev,
++					   priv->rx_buffers[entry].mapping)) {
++					priv->rx_buffers[entry].skb = NULL;
++					dev_kfree_skb(newskb);
++					skb = NULL;
++					/* TODO: update rx dropped stats */
++				}
+ 			} else {
+ 				skb = NULL;
+ 				/* TODO: update rx dropped stats */
+@@ -1450,6 +1457,12 @@ static int adm8211_init_rings(struct ieee80211_hw *dev)
+ 						  skb_tail_pointer(rx_info->skb),
+ 						  RX_PKT_SIZE,
+ 						  PCI_DMA_FROMDEVICE);
++		if (pci_dma_mapping_error(priv->pdev, rx_info->mapping)) {
++			dev_kfree_skb(rx_info->skb);
++			rx_info->skb = NULL;
++			break;
++		}
++
+ 		desc->buffer1 = cpu_to_le32(rx_info->mapping);
+ 		desc->status = cpu_to_le32(RDES0_STATUS_OWN | RDES0_STATUS_SQL);
+ 	}
+@@ -1613,7 +1626,7 @@ static void adm8211_calc_durations(int *dur, int *plcp, size_t payload_len, int
+ }
+ 
+ /* Transmit skb w/adm8211_tx_hdr (802.11 header created by hardware) */
+-static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,
++static int adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,
+ 			   u16 plcp_signal,
+ 			   size_t hdrlen)
+ {
+@@ -1625,6 +1638,8 @@ static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,
+ 
+ 	mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+ 				 PCI_DMA_TODEVICE);
++	if (pci_dma_mapping_error(priv->pdev, mapping))
++		return -ENOMEM;
+ 
+ 	spin_lock_irqsave(&priv->lock, flags);
+ 
+@@ -1657,6 +1672,8 @@ static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,
+ 
+ 	/* Trigger transmit poll */
+ 	ADM8211_CSR_WRITE(TDR, 0);
++
++	return 0;
+ }
+ 
+ /* Put adm8211_tx_hdr on skb and transmit */
+@@ -1710,7 +1727,10 @@ static void adm8211_tx(struct ieee80211_hw *dev,
+ 
+ 	txhdr->retry_limit = info->control.rates[0].count;
+ 
+-	adm8211_tx_raw(dev, skb, plcp_signal, hdrlen);
++	if (adm8211_tx_raw(dev, skb, plcp_signal, hdrlen)) {
++		/* Drop packet */
++		ieee80211_free_txskb(dev, skb);
++	}
+ }
+ 
+ static int adm8211_alloc_rings(struct ieee80211_hw *dev)
+@@ -1843,7 +1863,8 @@ static int adm8211_probe(struct pci_dev *pdev,
+ 	priv->rx_ring_size = rx_ring_size;
+ 	priv->tx_ring_size = tx_ring_size;
+ 
+-	if (adm8211_alloc_rings(dev)) {
++	err = adm8211_alloc_rings(dev);
++	if (err) {
+ 		printk(KERN_ERR "%s (adm8211): Cannot allocate TX/RX ring\n",
+ 		       pci_name(pdev));
+ 		goto err_iounmap;
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 366d3dcb8e9d..7b3017f55e3d 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -691,8 +691,11 @@ static int ath10k_core_get_board_id_from_otp(struct ath10k *ar)
+ 		   "boot get otp board id result 0x%08x board_id %d chip_id %d\n",
+ 		   result, board_id, chip_id);
+ 
+-	if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0)
++	if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0 ||
++	    (board_id == 0)) {
++		ath10k_warn(ar, "board id is not exist in otp, ignore it\n");
+ 		return -EOPNOTSUPP;
++	}
+ 
+ 	ar->id.bmi_ids_valid = true;
+ 	ar->id.bmi_board_id = board_id;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 30e98afa2e68..17ab8efdac35 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1224,6 +1224,36 @@ static int ath10k_monitor_recalc(struct ath10k *ar)
+ 		return ath10k_monitor_stop(ar);
+ }
+ 
++static bool ath10k_mac_can_set_cts_prot(struct ath10k_vif *arvif)
++{
++	struct ath10k *ar = arvif->ar;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	if (!arvif->is_started) {
++		ath10k_dbg(ar, ATH10K_DBG_MAC, "defer cts setup, vdev is not ready yet\n");
++		return false;
++	}
++
++	return true;
++}
++
++static int ath10k_mac_set_cts_prot(struct ath10k_vif *arvif)
++{
++	struct ath10k *ar = arvif->ar;
++	u32 vdev_param;
++
++	lockdep_assert_held(&ar->conf_mutex);
++
++	vdev_param = ar->wmi.vdev_param->protection_mode;
++
++	ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_protection %d\n",
++		   arvif->vdev_id, arvif->use_cts_prot);
++
++	return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
++					 arvif->use_cts_prot ? 1 : 0);
++}
++
+ static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
+ {
+ 	struct ath10k *ar = arvif->ar;
+@@ -4668,7 +4698,8 @@ static int ath10k_mac_txpower_recalc(struct ath10k *ar)
+ 	lockdep_assert_held(&ar->conf_mutex);
+ 
+ 	list_for_each_entry(arvif, &ar->arvifs, list) {
+-		WARN_ON(arvif->txpower < 0);
++		if (arvif->txpower <= 0)
++			continue;
+ 
+ 		if (txpower == -1)
+ 			txpower = arvif->txpower;
+@@ -4676,8 +4707,8 @@ static int ath10k_mac_txpower_recalc(struct ath10k *ar)
+ 			txpower = min(txpower, arvif->txpower);
+ 	}
+ 
+-	if (WARN_ON(txpower == -1))
+-		return -EINVAL;
++	if (txpower == -1)
++		return 0;
+ 
+ 	ret = ath10k_mac_txpower_setup(ar, txpower);
+ 	if (ret) {
+@@ -5321,20 +5352,18 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
+ 
+ 	if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+ 		arvif->use_cts_prot = info->use_cts_prot;
+-		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n",
+-			   arvif->vdev_id, info->use_cts_prot);
+ 
+ 		ret = ath10k_recalc_rtscts_prot(arvif);
+ 		if (ret)
+ 			ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
+ 				    arvif->vdev_id, ret);
+ 
+-		vdev_param = ar->wmi.vdev_param->protection_mode;
+-		ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+-						info->use_cts_prot ? 1 : 0);
+-		if (ret)
+-			ath10k_warn(ar, "failed to set protection mode %d on vdev %i: %d\n",
+-				    info->use_cts_prot, arvif->vdev_id, ret);
++		if (ath10k_mac_can_set_cts_prot(arvif)) {
++			ret = ath10k_mac_set_cts_prot(arvif);
++			if (ret)
++				ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
++					    arvif->vdev_id, ret);
++		}
+ 	}
+ 
+ 	if (changed & BSS_CHANGED_ERP_SLOT) {
+@@ -7355,6 +7384,13 @@ ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
+ 		arvif->is_up = true;
+ 	}
+ 
++	if (ath10k_mac_can_set_cts_prot(arvif)) {
++		ret = ath10k_mac_set_cts_prot(arvif);
++		if (ret)
++			ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n",
++				    arvif->vdev_id, ret);
++	}
++
+ 	mutex_unlock(&ar->conf_mutex);
+ 	return 0;
+ 
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index e64f59300a7c..0e4d49adddd0 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -1105,8 +1105,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar,
+ 		struct ath10k_fw_stats_pdev *dst;
+ 
+ 		src = data;
+-		if (data_len < sizeof(*src))
++		if (data_len < sizeof(*src)) {
++			kfree(tb);
+ 			return -EPROTO;
++		}
+ 
+ 		data += sizeof(*src);
+ 		data_len -= sizeof(*src);
+@@ -1126,8 +1128,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar,
+ 		struct ath10k_fw_stats_vdev *dst;
+ 
+ 		src = data;
2546