[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     47c28eec857bf59e5ffd9d3fc0d1f6daa471aa9b
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Sep  9 23:28:47 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Sep  9 23:28:47 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=47c28eec

Linux patch 4.14.69

 0000_README              |    4 +
 1068_linux-4.14.69.patch | 3362 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3366 insertions(+)

diff --git a/0000_README b/0000_README
index 4fd9ed9..2a8e1bb 100644
--- a/0000_README
+++ b/0000_README
@@ -315,6 +315,10 @@ Patch:  1067_linux-4.14.68.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.68
 
+Patch:  1068_linux-4.14.69.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.69
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1068_linux-4.14.69.patch b/1068_linux-4.14.69.patch
new file mode 100644
index 0000000..461b50e
--- /dev/null
+++ b/1068_linux-4.14.69.patch
@@ -0,0 +1,3362 @@
+diff --git a/Makefile b/Makefile
+index 3da579058926..3ecda1d2e23a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 68
++SUBLEVEL = 69
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
+index a48976dc9bcd..918c3938ef66 100644
+--- a/arch/alpha/kernel/osf_sys.c
++++ b/arch/alpha/kernel/osf_sys.c
+@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path,
+ SYSCALL_DEFINE1(osf_utsname, char __user *, name)
+ {
+ 	int error;
++	char tmp[5 * 32];
+ 
+ 	down_read(&uts_sem);
+-	error = -EFAULT;
+-	if (copy_to_user(name + 0, utsname()->sysname, 32))
+-		goto out;
+-	if (copy_to_user(name + 32, utsname()->nodename, 32))
+-		goto out;
+-	if (copy_to_user(name + 64, utsname()->release, 32))
+-		goto out;
+-	if (copy_to_user(name + 96, utsname()->version, 32))
+-		goto out;
+-	if (copy_to_user(name + 128, utsname()->machine, 32))
+-		goto out;
++	memcpy(tmp + 0 * 32, utsname()->sysname, 32);
++	memcpy(tmp + 1 * 32, utsname()->nodename, 32);
++	memcpy(tmp + 2 * 32, utsname()->release, 32);
++	memcpy(tmp + 3 * 32, utsname()->version, 32);
++	memcpy(tmp + 4 * 32, utsname()->machine, 32);
++	up_read(&uts_sem);
+ 
+-	error = 0;
+- out:
+-	up_read(&uts_sem);	
+-	return error;
++	if (copy_to_user(name, tmp, sizeof(tmp)))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ SYSCALL_DEFINE0(getpagesize)
+@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
+ {
+ 	int len, err = 0;
+ 	char *kname;
++	char tmp[32];
+ 
+-	if (namelen > 32)
++	if (namelen < 0 || namelen > 32)
+ 		namelen = 32;
+ 
+ 	down_read(&uts_sem);
+ 	kname = utsname()->domainname;
+ 	len = strnlen(kname, namelen);
+-	if (copy_to_user(name, kname, min(len + 1, namelen)))
+-		err = -EFAULT;
++	len = min(len + 1, namelen);
++	memcpy(tmp, kname, len);
+ 	up_read(&uts_sem);
+ 
+-	return err;
++	if (copy_to_user(name, tmp, len))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ /*
+@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
+ 	};
+ 	unsigned long offset;
+ 	const char *res;
+-	long len, err = -EINVAL;
++	long len;
++	char tmp[__NEW_UTS_LEN + 1];
+ 
+ 	offset = command-1;
+ 	if (offset >= ARRAY_SIZE(sysinfo_table)) {
+ 		/* Digital UNIX has a few unpublished interfaces here */
+ 		printk("sysinfo(%d)", command);
+-		goto out;
++		return -EINVAL;
+ 	}
+ 
+ 	down_read(&uts_sem);
+@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
+ 	len = strlen(res)+1;
+ 	if ((unsigned long)len > (unsigned long)count)
+ 		len = count;
+-	if (copy_to_user(buf, res, len))
+-		err = -EFAULT;
+-	else
+-		err = 0;
++	memcpy(tmp, res, len);
+ 	up_read(&uts_sem);
+- out:
+-	return err;
++	if (copy_to_user(buf, tmp, len))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
+diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+index 92a9740c533f..3b1db7b9ec50 100644
+--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi
++++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi
+@@ -206,6 +206,7 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			reg = <0x70>;
++			reset-gpio = <&gpio TEGRA_GPIO(BB, 0) GPIO_ACTIVE_LOW>;
+ 		};
+ 	};
+ 
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 1bbb89d37f57..c30cd78b6918 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -693,7 +693,6 @@ config NEED_PER_CPU_EMBED_FIRST_CHUNK
+ 
+ config HOLES_IN_ZONE
+ 	def_bool y
+-	depends on NUMA
+ 
+ source kernel/Kconfig.preempt
+ source kernel/Kconfig.hz
+diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
+index 5a23010af600..1e7a33592e29 100644
+--- a/arch/powerpc/include/asm/fadump.h
++++ b/arch/powerpc/include/asm/fadump.h
+@@ -195,9 +195,6 @@ struct fadump_crash_info_header {
+ 	struct cpumask	online_mask;
+ };
+ 
+-/* Crash memory ranges */
+-#define INIT_CRASHMEM_RANGES	(INIT_MEMBLOCK_REGIONS + 2)
+-
+ struct fad_crash_memory_ranges {
+ 	unsigned long long	base;
+ 	unsigned long long	size;
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index d0020bc1f209..5a6470383ca3 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -47,8 +47,10 @@ static struct fadump_mem_struct fdm;
+ static const struct fadump_mem_struct *fdm_active;
+ 
+ static DEFINE_MUTEX(fadump_mutex);
+-struct fad_crash_memory_ranges crash_memory_ranges[INIT_CRASHMEM_RANGES];
++struct fad_crash_memory_ranges *crash_memory_ranges;
++int crash_memory_ranges_size;
+ int crash_mem_ranges;
++int max_crash_mem_ranges;
+ 
+ /* Scan the Firmware Assisted dump configuration details. */
+ int __init early_init_dt_scan_fw_dump(unsigned long node,
+@@ -843,38 +845,88 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active)
+ 	return 0;
+ }
+ 
+-static inline void fadump_add_crash_memory(unsigned long long base,
+-					unsigned long long end)
++static void free_crash_memory_ranges(void)
++{
++	kfree(crash_memory_ranges);
++	crash_memory_ranges = NULL;
++	crash_memory_ranges_size = 0;
++	max_crash_mem_ranges = 0;
++}
++
++/*
++ * Allocate or reallocate crash memory ranges array in incremental units
++ * of PAGE_SIZE.
++ */
++static int allocate_crash_memory_ranges(void)
++{
++	struct fad_crash_memory_ranges *new_array;
++	u64 new_size;
++
++	new_size = crash_memory_ranges_size + PAGE_SIZE;
++	pr_debug("Allocating %llu bytes of memory for crash memory ranges\n",
++		 new_size);
++
++	new_array = krealloc(crash_memory_ranges, new_size, GFP_KERNEL);
++	if (new_array == NULL) {
++		pr_err("Insufficient memory for setting up crash memory ranges\n");
++		free_crash_memory_ranges();
++		return -ENOMEM;
++	}
++
++	crash_memory_ranges = new_array;
++	crash_memory_ranges_size = new_size;
++	max_crash_mem_ranges = (new_size /
++				sizeof(struct fad_crash_memory_ranges));
++	return 0;
++}
++
++static inline int fadump_add_crash_memory(unsigned long long base,
++					  unsigned long long end)
+ {
+ 	if (base == end)
+-		return;
++		return 0;
++
++	if (crash_mem_ranges == max_crash_mem_ranges) {
++		int ret;
++
++		ret = allocate_crash_memory_ranges();
++		if (ret)
++			return ret;
++	}
+ 
+ 	pr_debug("crash_memory_range[%d] [%#016llx-%#016llx], %#llx bytes\n",
+ 		crash_mem_ranges, base, end - 1, (end - base));
+ 	crash_memory_ranges[crash_mem_ranges].base = base;
+ 	crash_memory_ranges[crash_mem_ranges].size = end - base;
+ 	crash_mem_ranges++;
++	return 0;
+ }
+ 
+-static void fadump_exclude_reserved_area(unsigned long long start,
++static int fadump_exclude_reserved_area(unsigned long long start,
+ 					unsigned long long end)
+ {
+ 	unsigned long long ra_start, ra_end;
++	int ret = 0;
+ 
+ 	ra_start = fw_dump.reserve_dump_area_start;
+ 	ra_end = ra_start + fw_dump.reserve_dump_area_size;
+ 
+ 	if ((ra_start < end) && (ra_end > start)) {
+ 		if ((start < ra_start) && (end > ra_end)) {
+-			fadump_add_crash_memory(start, ra_start);
+-			fadump_add_crash_memory(ra_end, end);
++			ret = fadump_add_crash_memory(start, ra_start);
++			if (ret)
++				return ret;
++
++			ret = fadump_add_crash_memory(ra_end, end);
+ 		} else if (start < ra_start) {
+-			fadump_add_crash_memory(start, ra_start);
++			ret = fadump_add_crash_memory(start, ra_start);
+ 		} else if (ra_end < end) {
+-			fadump_add_crash_memory(ra_end, end);
++			ret = fadump_add_crash_memory(ra_end, end);
+ 		}
+ 	} else
+-		fadump_add_crash_memory(start, end);
++		ret = fadump_add_crash_memory(start, end);
++
++	return ret;
+ }
+ 
+ static int fadump_init_elfcore_header(char *bufp)
+@@ -914,10 +966,11 @@ static int fadump_init_elfcore_header(char *bufp)
+  * Traverse through memblock structure and setup crash memory ranges. These
+  * ranges will be used create PT_LOAD program headers in elfcore header.
+  */
+-static void fadump_setup_crash_memory_ranges(void)
++static int fadump_setup_crash_memory_ranges(void)
+ {
+ 	struct memblock_region *reg;
+ 	unsigned long long start, end;
++	int ret;
+ 
+ 	pr_debug("Setup crash memory ranges.\n");
+ 	crash_mem_ranges = 0;
+@@ -928,7 +981,9 @@ static void fadump_setup_crash_memory_ranges(void)
+ 	 * specified during fadump registration. We need to create a separate
+ 	 * program header for this chunk with the correct offset.
+ 	 */
+-	fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size);
++	ret = fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size);
++	if (ret)
++		return ret;
+ 
+ 	for_each_memblock(memory, reg) {
+ 		start = (unsigned long long)reg->base;
+@@ -948,8 +1003,12 @@ static void fadump_setup_crash_memory_ranges(void)
+ 		}
+ 
+ 		/* add this range excluding the reserved dump area. */
+-		fadump_exclude_reserved_area(start, end);
++		ret = fadump_exclude_reserved_area(start, end);
++		if (ret)
++			return ret;
+ 	}
++
++	return 0;
+ }
+ 
+ /*
+@@ -1072,6 +1131,7 @@ static int register_fadump(void)
+ {
+ 	unsigned long addr;
+ 	void *vaddr;
++	int ret;
+ 
+ 	/*
+ 	 * If no memory is reserved then we can not register for firmware-
+@@ -1080,7 +1140,9 @@ static int register_fadump(void)
+ 	if (!fw_dump.reserve_dump_area_size)
+ 		return -ENODEV;
+ 
+-	fadump_setup_crash_memory_ranges();
++	ret = fadump_setup_crash_memory_ranges();
++	if (ret)
++		return ret;
+ 
+ 	addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len);
+ 	/* Initialize fadump crash info header. */
+@@ -1158,6 +1220,7 @@ void fadump_cleanup(void)
+ 	} else if (fw_dump.dump_registered) {
+ 		/* Un-register Firmware-assisted dump if it was registered. */
+ 		fadump_unregister_dump(&fdm);
++		free_crash_memory_ranges();
+ 	}
+ }
+ 
+diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c
+index 816055927ee4..d735937d975c 100644
+--- a/arch/powerpc/mm/mmu_context_iommu.c
++++ b/arch/powerpc/mm/mmu_context_iommu.c
+@@ -130,6 +130,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ 	long i, j, ret = 0, locked_entries = 0;
+ 	unsigned int pageshift;
+ 	unsigned long flags;
++	unsigned long cur_ua;
+ 	struct page *page = NULL;
+ 
+ 	mutex_lock(&mem_list_mutex);
+@@ -178,7 +179,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ 	}
+ 
+ 	for (i = 0; i < entries; ++i) {
+-		if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT),
++		cur_ua = ua + (i << PAGE_SHIFT);
++		if (1 != get_user_pages_fast(cur_ua,
+ 					1/* pages */, 1/* iswrite */, &page)) {
+ 			ret = -EFAULT;
+ 			for (j = 0; j < i; ++j)
+@@ -197,7 +199,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ 		if (is_migrate_cma_page(page)) {
+ 			if (mm_iommu_move_page_from_cma(page))
+ 				goto populate;
+-			if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT),
++			if (1 != get_user_pages_fast(cur_ua,
+ 						1/* pages */, 1/* iswrite */,
+ 						&page)) {
+ 				ret = -EFAULT;
+@@ -211,20 +213,21 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries,
+ 		}
+ populate:
+ 		pageshift = PAGE_SHIFT;
+-		if (PageCompound(page)) {
++		if (mem->pageshift > PAGE_SHIFT && PageCompound(page)) {
+ 			pte_t *pte;
+ 			struct page *head = compound_head(page);
+ 			unsigned int compshift = compound_order(head);
++			unsigned int pteshift;
+ 
+ 			local_irq_save(flags); /* disables as well */
+-			pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift);
+-			local_irq_restore(flags);
++			pte = find_linux_pte(mm->pgd, cur_ua, NULL, &pteshift);
+ 
+ 			/* Double check it is still the same pinned page */
+ 			if (pte && pte_page(*pte) == head &&
+-					pageshift == compshift)
+-				pageshift = max_t(unsigned int, pageshift,
++			    pteshift == compshift + PAGE_SHIFT)
++				pageshift = max_t(unsigned int, pteshift,
+ 						PAGE_SHIFT);
++			local_irq_restore(flags);
+ 		}
+ 		mem->pageshift = min(mem->pageshift, pageshift);
+ 		mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT;
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 677b29ef4532..e919696c7137 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -3286,12 +3286,49 @@ static void pnv_pci_ioda_create_dbgfs(void)
+ #endif /* CONFIG_DEBUG_FS */
+ }
+ 
++static void pnv_pci_enable_bridge(struct pci_bus *bus)
++{
++	struct pci_dev *dev = bus->self;
++	struct pci_bus *child;
++
++	/* Empty bus ? bail */
++	if (list_empty(&bus->devices))
++		return;
++
++	/*
++	 * If there's a bridge associated with that bus enable it. This works
++	 * around races in the generic code if the enabling is done during
++	 * parallel probing. This can be removed once those races have been
++	 * fixed.
++	 */
++	if (dev) {
++		int rc = pci_enable_device(dev);
++		if (rc)
++			pci_err(dev, "Error enabling bridge (%d)\n", rc);
++		pci_set_master(dev);
++	}
++
++	/* Perform the same to child busses */
++	list_for_each_entry(child, &bus->children, node)
++		pnv_pci_enable_bridge(child);
++}
++
++static void pnv_pci_enable_bridges(void)
++{
++	struct pci_controller *hose;
++
++	list_for_each_entry(hose, &hose_list, list_node)
++		pnv_pci_enable_bridge(hose->bus);
++}
++
+ static void pnv_pci_ioda_fixup(void)
+ {
+ 	pnv_pci_ioda_setup_PEs();
+ 	pnv_pci_ioda_setup_iommu_api();
+ 	pnv_pci_ioda_create_dbgfs();
+ 
++	pnv_pci_enable_bridges();
++
+ #ifdef CONFIG_EEH
+ 	eeh_init();
+ 	eeh_addr_cache_build();
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 5e1ef9150182..2edc673be137 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -360,7 +360,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
+ 	}
+ 
+ 	savep = __va(regs->gpr[3]);
+-	regs->gpr[3] = savep[0];	/* restore original r3 */
++	regs->gpr[3] = be64_to_cpu(savep[0]);	/* restore original r3 */
+ 
+ 	/* If it isn't an extended log we can use the per cpu 64bit buffer */
+ 	h = (struct rtas_error_log *)&savep[1];
+diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
+index 990703b7cf4d..4b7719b2a73c 100644
+--- a/arch/sparc/kernel/sys_sparc_32.c
++++ b/arch/sparc/kernel/sys_sparc_32.c
+@@ -204,23 +204,27 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig,
+ 
+ asmlinkage long sys_getdomainname(char __user *name, int len)
+ {
+- 	int nlen, err;
+- 	
++	int nlen, err;
++	char tmp[__NEW_UTS_LEN + 1];
++
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
+- 	down_read(&uts_sem);
+- 	
++	down_read(&uts_sem);
++
+ 	nlen = strlen(utsname()->domainname) + 1;
+ 	err = -EINVAL;
+ 	if (nlen > len)
+-		goto out;
++		goto out_unlock;
++	memcpy(tmp, utsname()->domainname, nlen);
+ 
+-	err = -EFAULT;
+-	if (!copy_to_user(name, utsname()->domainname, nlen))
+-		err = 0;
++	up_read(&uts_sem);
+ 
+-out:
++	if (copy_to_user(name, tmp, nlen))
++		return -EFAULT;
++	return 0;
++
++out_unlock:
+ 	up_read(&uts_sem);
+ 	return err;
+ }
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 55416db482ad..d79c1c74873c 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -527,23 +527,27 @@ extern void check_pending(int signum);
+ 
+ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
+ {
+-        int nlen, err;
++	int nlen, err;
++	char tmp[__NEW_UTS_LEN + 1];
+ 
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
+- 	down_read(&uts_sem);
+- 	
++	down_read(&uts_sem);
++
+ 	nlen = strlen(utsname()->domainname) + 1;
+ 	err = -EINVAL;
+ 	if (nlen > len)
+-		goto out;
++		goto out_unlock;
++	memcpy(tmp, utsname()->domainname, nlen);
++
++	up_read(&uts_sem);
+ 
+-	err = -EFAULT;
+-	if (!copy_to_user(name, utsname()->domainname, nlen))
+-		err = 0;
++	if (copy_to_user(name, tmp, nlen))
++		return -EFAULT;
++	return 0;
+ 
+-out:
++out_unlock:
+ 	up_read(&uts_sem);
+ 	return err;
+ }
+diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
+index f24cd9f1799a..928b0c6083c9 100644
+--- a/arch/x86/kernel/kexec-bzimage64.c
++++ b/arch/x86/kernel/kexec-bzimage64.c
+@@ -532,7 +532,7 @@ static int bzImage64_cleanup(void *loader_data)
+ static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
+ {
+ 	return verify_pefile_signature(kernel, kernel_len,
+-				       NULL,
++				       VERIFY_USE_SECONDARY_KEYRING,
+ 				       VERIFYING_KEXEC_PE_SIGNATURE);
+ }
+ #endif
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8958b35f6008..a466ee14ad41 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -200,12 +200,14 @@ static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_
+ 
+ static const struct {
+ 	const char *option;
+-	enum vmx_l1d_flush_state cmd;
++	bool for_parse;
+ } vmentry_l1d_param[] = {
+-	{"auto",	VMENTER_L1D_FLUSH_AUTO},
+-	{"never",	VMENTER_L1D_FLUSH_NEVER},
+-	{"cond",	VMENTER_L1D_FLUSH_COND},
+-	{"always",	VMENTER_L1D_FLUSH_ALWAYS},
++	[VMENTER_L1D_FLUSH_AUTO]	 = {"auto", true},
++	[VMENTER_L1D_FLUSH_NEVER]	 = {"never", true},
++	[VMENTER_L1D_FLUSH_COND]	 = {"cond", true},
++	[VMENTER_L1D_FLUSH_ALWAYS]	 = {"always", true},
++	[VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
++	[VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
+ };
+ 
+ #define L1D_CACHE_ORDER 4
+@@ -289,8 +291,9 @@ static int vmentry_l1d_flush_parse(const char *s)
+ 
+ 	if (s) {
+ 		for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+-			if (sysfs_streq(s, vmentry_l1d_param[i].option))
+-				return vmentry_l1d_param[i].cmd;
++			if (vmentry_l1d_param[i].for_parse &&
++			    sysfs_streq(s, vmentry_l1d_param[i].option))
++				return i;
+ 		}
+ 	}
+ 	return -EINVAL;
+@@ -300,13 +303,13 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+ {
+ 	int l1tf, ret;
+ 
+-	if (!boot_cpu_has(X86_BUG_L1TF))
+-		return 0;
+-
+ 	l1tf = vmentry_l1d_flush_parse(s);
+ 	if (l1tf < 0)
+ 		return l1tf;
+ 
++	if (!boot_cpu_has(X86_BUG_L1TF))
++		return 0;
++
+ 	/*
+ 	 * Has vmx_init() run already? If not then this is the pre init
+ 	 * parameter parsing. In that case just store the value and let
+@@ -326,6 +329,9 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+ 
+ static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
+ {
++	if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
++		return sprintf(s, "???\n");
++
+ 	return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
+ }
+ 
+diff --git a/arch/xtensa/include/asm/cacheasm.h b/arch/xtensa/include/asm/cacheasm.h
+index 2041abb10a23..34545ecfdd6b 100644
+--- a/arch/xtensa/include/asm/cacheasm.h
++++ b/arch/xtensa/include/asm/cacheasm.h
+@@ -31,16 +31,32 @@
+  *
+  */
+ 
+-	.macro	__loop_cache_all ar at insn size line_width
+ 
+-	movi	\ar, 0
++	.macro	__loop_cache_unroll ar at insn size line_width max_immed
++
++	.if	(1 << (\line_width)) > (\max_immed)
++	.set	_reps, 1
++	.elseif	(2 << (\line_width)) > (\max_immed)
++	.set	_reps, 2
++	.else
++	.set	_reps, 4
++	.endif
++
++	__loopi	\ar, \at, \size, (_reps << (\line_width))
++	.set	_index, 0
++	.rep	_reps
++	\insn	\ar, _index << (\line_width)
++	.set	_index, _index + 1
++	.endr
++	__endla	\ar, \at, _reps << (\line_width)
++
++	.endm
++
+ 
+-	__loopi	\ar, \at, \size, (4 << (\line_width))
+-	\insn	\ar, 0 << (\line_width)
+-	\insn	\ar, 1 << (\line_width)
+-	\insn	\ar, 2 << (\line_width)
+-	\insn	\ar, 3 << (\line_width)
+-	__endla	\ar, \at, 4 << (\line_width)
++	.macro	__loop_cache_all ar at insn size line_width max_immed
++
++	movi	\ar, 0
++	__loop_cache_unroll \ar, \at, \insn, \size, \line_width, \max_immed
+ 
+ 	.endm
+ 
+@@ -57,14 +73,9 @@
+ 	.endm
+ 
+ 
+-	.macro	__loop_cache_page ar at insn line_width
++	.macro	__loop_cache_page ar at insn line_width max_immed
+ 
+-	__loopi	\ar, \at, PAGE_SIZE, 4 << (\line_width)
+-	\insn	\ar, 0 << (\line_width)
+-	\insn	\ar, 1 << (\line_width)
+-	\insn	\ar, 2 << (\line_width)
+-	\insn	\ar, 3 << (\line_width)
+-	__endla	\ar, \at, 4 << (\line_width)
++	__loop_cache_unroll \ar, \at, \insn, PAGE_SIZE, \line_width, \max_immed
+ 
+ 	.endm
+ 
+@@ -72,7 +83,8 @@
+ 	.macro	___unlock_dcache_all ar at
+ 
+ #if XCHAL_DCACHE_LINE_LOCKABLE && XCHAL_DCACHE_SIZE
+-	__loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE \
++		XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+ 
+ 	.endm
+@@ -81,7 +93,8 @@
+ 	.macro	___unlock_icache_all ar at
+ 
+ #if XCHAL_ICACHE_LINE_LOCKABLE && XCHAL_ICACHE_SIZE
+-	__loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE XCHAL_ICACHE_LINEWIDTH
++	__loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE \
++		XCHAL_ICACHE_LINEWIDTH 240
+ #endif
+ 
+ 	.endm
+@@ -90,7 +103,8 @@
+ 	.macro	___flush_invalidate_dcache_all ar at
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE \
++		XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+ 
+ 	.endm
+@@ -99,7 +113,8 @@
+ 	.macro	___flush_dcache_all ar at
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE \
++		XCHAL_DCACHE_LINEWIDTH 240
+ #endif
+ 
+ 	.endm
+@@ -108,8 +123,8 @@
+ 	.macro	___invalidate_dcache_all ar at
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_all \ar \at dii __stringify(DCACHE_WAY_SIZE) \
+-			 XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_all \ar \at dii XCHAL_DCACHE_SIZE \
++			 XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+@@ -118,8 +133,8 @@
+ 	.macro	___invalidate_icache_all ar at
+ 
+ #if XCHAL_ICACHE_SIZE
+-	__loop_cache_all \ar \at iii __stringify(ICACHE_WAY_SIZE) \
+-			 XCHAL_ICACHE_LINEWIDTH
++	__loop_cache_all \ar \at iii XCHAL_ICACHE_SIZE \
++			 XCHAL_ICACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+@@ -166,7 +181,7 @@
+ 	.macro	___flush_invalidate_dcache_page ar as
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+@@ -175,7 +190,7 @@
+ 	.macro ___flush_dcache_page ar as
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+@@ -184,7 +199,7 @@
+ 	.macro	___invalidate_dcache_page ar as
+ 
+ #if XCHAL_DCACHE_SIZE
+-	__loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH
++	__loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+@@ -193,7 +208,7 @@
+ 	.macro	___invalidate_icache_page ar as
+ 
+ #if XCHAL_ICACHE_SIZE
+-	__loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH
++	__loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH 1020
+ #endif
+ 
+ 	.endm
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 5d53e504acae..4b571f3ea009 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -887,7 +887,8 @@ static ssize_t bfq_io_set_weight(struct kernfs_open_file *of,
+ 	if (ret)
+ 		return ret;
+ 
+-	return bfq_io_set_weight_legacy(of_css(of), NULL, weight);
++	ret = bfq_io_set_weight_legacy(of_css(of), NULL, weight);
++	return ret ?: nbytes;
+ }
+ 
+ static int bfqg_print_stat(struct seq_file *sf, void *v)
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 68bae6338ad4..1d27e2a152e0 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -1025,6 +1025,7 @@ out_exit_flush_rq:
+ 		q->exit_rq_fn(q, q->fq->flush_rq);
+ out_free_flush_queue:
+ 	blk_free_flush_queue(q->fq);
++	q->fq = NULL;
+ 	return -ENOMEM;
+ }
+ EXPORT_SYMBOL(blk_init_allocated_queue);
+@@ -3458,9 +3459,11 @@ EXPORT_SYMBOL(blk_finish_plug);
+  */
+ void blk_pm_runtime_init(struct request_queue *q, struct device *dev)
+ {
+-	/* not support for RQF_PM and ->rpm_status in blk-mq yet */
+-	if (q->mq_ops)
++	/* Don't enable runtime PM for blk-mq until it is ready */
++	if (q->mq_ops) {
++		pm_runtime_disable(dev);
+ 		return;
++	}
+ 
+ 	q->dev = dev;
+ 	q->rpm_status = RPM_ACTIVE;
+diff --git a/certs/system_keyring.c b/certs/system_keyring.c
+index 6251d1b27f0c..81728717523d 100644
+--- a/certs/system_keyring.c
++++ b/certs/system_keyring.c
+@@ -15,6 +15,7 @@
+ #include <linux/cred.h>
+ #include <linux/err.h>
+ #include <linux/slab.h>
++#include <linux/verification.h>
+ #include <keys/asymmetric-type.h>
+ #include <keys/system_keyring.h>
+ #include <crypto/pkcs7.h>
+@@ -230,7 +231,7 @@ int verify_pkcs7_signature(const void *data, size_t len,
+ 
+ 	if (!trusted_keys) {
+ 		trusted_keys = builtin_trusted_keys;
+-	} else if (trusted_keys == (void *)1UL) {
++	} else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) {
+ #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+ 		trusted_keys = secondary_trusted_keys;
+ #else
+diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c
+index 1063b644efcd..b2aa925a84bc 100644
+--- a/crypto/asymmetric_keys/pkcs7_key_type.c
++++ b/crypto/asymmetric_keys/pkcs7_key_type.c
+@@ -62,7 +62,7 @@ static int pkcs7_preparse(struct key_preparsed_payload *prep)
+ 
+ 	return verify_pkcs7_signature(NULL, 0,
+ 				      prep->data, prep->datalen,
+-				      (void *)1UL, usage,
++				      VERIFY_USE_SECONDARY_KEYRING, usage,
+ 				      pkcs7_view_content, prep);
+ }
+ 
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index f149d3e61234..1e2648e4c286 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -321,6 +321,7 @@ static ssize_t backing_dev_store(struct device *dev,
+ 		struct device_attribute *attr, const char *buf, size_t len)
+ {
+ 	char *file_name;
++	size_t sz;
+ 	struct file *backing_dev = NULL;
+ 	struct inode *inode;
+ 	struct address_space *mapping;
+@@ -341,7 +342,11 @@ static ssize_t backing_dev_store(struct device *dev,
+ 		goto out;
+ 	}
+ 
+-	strlcpy(file_name, buf, len);
++	strlcpy(file_name, buf, PATH_MAX);
++	/* ignore trailing newline */
++	sz = strlen(file_name);
++	if (sz > 0 && file_name[sz - 1] == '\n')
++		file_name[sz - 1] = 0x00;
+ 
+ 	backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0);
+ 	if (IS_ERR(backing_dev)) {
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index 43e14bb512c8..6a16d22bc604 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -555,12 +555,20 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_stop);
+ 
+ void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy)
+ {
+-	struct policy_dbs_info *policy_dbs = policy->governor_data;
++	struct policy_dbs_info *policy_dbs;
++
++	/* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
++	mutex_lock(&gov_dbs_data_mutex);
++	policy_dbs = policy->governor_data;
++	if (!policy_dbs)
++		goto out;
+ 
+ 	mutex_lock(&policy_dbs->update_mutex);
+ 	cpufreq_policy_apply_limits(policy);
+ 	gov_update_sample_delay(policy_dbs, 0);
+-
+ 	mutex_unlock(&policy_dbs->update_mutex);
++
++out:
++	mutex_unlock(&gov_dbs_data_mutex);
+ }
+ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_limits);
+diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
+index e7966e37a5aa..ecc6d755d3c1 100644
+--- a/drivers/crypto/caam/caamalg_qi.c
++++ b/drivers/crypto/caam/caamalg_qi.c
+@@ -350,10 +350,8 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
+ 	int ret = 0;
+ 
+ 	if (keylen != 2 * AES_MIN_KEY_SIZE  && keylen != 2 * AES_MAX_KEY_SIZE) {
+-		crypto_ablkcipher_set_flags(ablkcipher,
+-					    CRYPTO_TFM_RES_BAD_KEY_LEN);
+ 		dev_err(jrdev, "key size mismatch\n");
+-		return -EINVAL;
++		goto badkey;
+ 	}
+ 
+ 	memcpy(ctx->key, key, keylen);
+@@ -388,7 +386,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher,
+ 	return ret;
+ badkey:
+ 	crypto_ablkcipher_set_flags(ablkcipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
+-	return 0;
++	return -EINVAL;
+ }
+ 
+ /*
+diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
+index 7ff4a25440ac..6f3f81bb880b 100644
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -71,8 +71,8 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc,
+ 	dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE);
+ 	dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE);
+ 	dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
+-	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+-	dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
++	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
++	dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
+ }
+ 
+ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
+@@ -90,8 +90,8 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc,
+ 	dma_unmap_single(dev, pdb->dp_dma, p_sz, DMA_TO_DEVICE);
+ 	dma_unmap_single(dev, pdb->dq_dma, q_sz, DMA_TO_DEVICE);
+ 	dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
+-	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
+-	dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE);
++	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
++	dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL);
+ }
+ 
+ /* RSA Job Completion handler */
+@@ -417,13 +417,13 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
+ 		goto unmap_p;
+ 	}
+ 
+-	pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
++	pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
+ 	if (dma_mapping_error(dev, pdb->tmp1_dma)) {
+ 		dev_err(dev, "Unable to map RSA tmp1 memory\n");
+ 		goto unmap_q;
+ 	}
+ 
+-	pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
++	pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
+ 	if (dma_mapping_error(dev, pdb->tmp2_dma)) {
+ 		dev_err(dev, "Unable to map RSA tmp2 memory\n");
+ 		goto unmap_tmp1;
+@@ -451,7 +451,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req,
+ 	return 0;
+ 
+ unmap_tmp1:
+-	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
++	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+ unmap_q:
+ 	dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE);
+ unmap_p:
+@@ -504,13 +504,13 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
+ 		goto unmap_dq;
+ 	}
+ 
+-	pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE);
++	pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL);
+ 	if (dma_mapping_error(dev, pdb->tmp1_dma)) {
+ 		dev_err(dev, "Unable to map RSA tmp1 memory\n");
+ 		goto unmap_qinv;
+ 	}
+ 
+-	pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE);
++	pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL);
+ 	if (dma_mapping_error(dev, pdb->tmp2_dma)) {
+ 		dev_err(dev, "Unable to map RSA tmp2 memory\n");
+ 		goto unmap_tmp1;
+@@ -538,7 +538,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req,
+ 	return 0;
+ 
+ unmap_tmp1:
+-	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE);
++	dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL);
+ unmap_qinv:
+ 	dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE);
+ unmap_dq:
+diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
+index d258953ff488..7fa1be184553 100644
+--- a/drivers/crypto/caam/jr.c
++++ b/drivers/crypto/caam/jr.c
+@@ -190,7 +190,8 @@ static void caam_jr_dequeue(unsigned long devarg)
+ 		BUG_ON(CIRC_CNT(head, tail + i, JOBR_DEPTH) <= 0);
+ 
+ 		/* Unmap just-run descriptor so we can post-process */
+-		dma_unmap_single(dev, jrp->outring[hw_idx].desc,
++		dma_unmap_single(dev,
++				 caam_dma_to_cpu(jrp->outring[hw_idx].desc),
+ 				 jrp->entinfo[sw_idx].desc_size,
+ 				 DMA_TO_DEVICE);
+ 
+diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
+index 5285ece4f33a..b71895871be3 100644
+--- a/drivers/crypto/vmx/aes_cbc.c
++++ b/drivers/crypto/vmx/aes_cbc.c
+@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc,
+ 		ret = crypto_skcipher_encrypt(req);
+ 		skcipher_request_zero(req);
+ 	} else {
+-		preempt_disable();
+-		pagefault_disable();
+-		enable_kernel_vsx();
+-
+ 		blkcipher_walk_init(&walk, dst, src, nbytes);
+ 		ret = blkcipher_walk_virt(desc, &walk);
+ 		while ((nbytes = walk.nbytes)) {
++			preempt_disable();
++			pagefault_disable();
++			enable_kernel_vsx();
+ 			aes_p8_cbc_encrypt(walk.src.virt.addr,
+ 					   walk.dst.virt.addr,
+ 					   nbytes & AES_BLOCK_MASK,
+ 					   &ctx->enc_key, walk.iv, 1);
++			disable_kernel_vsx();
++			pagefault_enable();
++			preempt_enable();
++
+ 			nbytes &= AES_BLOCK_SIZE - 1;
+ 			ret = blkcipher_walk_done(desc, &walk, nbytes);
+ 		}
+-
+-		disable_kernel_vsx();
+-		pagefault_enable();
+-		preempt_enable();
+ 	}
+ 
+ 	return ret;
+@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc,
+ 		ret = crypto_skcipher_decrypt(req);
+ 		skcipher_request_zero(req);
+ 	} else {
+-		preempt_disable();
+-		pagefault_disable();
+-		enable_kernel_vsx();
+-
+ 		blkcipher_walk_init(&walk, dst, src, nbytes);
+ 		ret = blkcipher_walk_virt(desc, &walk);
+ 		while ((nbytes = walk.nbytes)) {
++			preempt_disable();
++			pagefault_disable();
++			enable_kernel_vsx();
+ 			aes_p8_cbc_encrypt(walk.src.virt.addr,
+ 					   walk.dst.virt.addr,
+ 					   nbytes & AES_BLOCK_MASK,
+ 					   &ctx->dec_key, walk.iv, 0);
++			disable_kernel_vsx();
++			pagefault_enable();
++			preempt_enable();
++
+ 			nbytes &= AES_BLOCK_SIZE - 1;
+ 			ret = blkcipher_walk_done(desc, &walk, nbytes);
+ 		}
+-
+-		disable_kernel_vsx();
+-		pagefault_enable();
+-		preempt_enable();
+ 	}
+ 
+ 	return ret;
+diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
+index 8bd9aff0f55f..e9954a7d4694 100644
+--- a/drivers/crypto/vmx/aes_xts.c
++++ b/drivers/crypto/vmx/aes_xts.c
+@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
+ 		ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
+ 		skcipher_request_zero(req);
+ 	} else {
++		blkcipher_walk_init(&walk, dst, src, nbytes);
++
++		ret = blkcipher_walk_virt(desc, &walk);
++
+ 		preempt_disable();
+ 		pagefault_disable();
+ 		enable_kernel_vsx();
+ 
+-		blkcipher_walk_init(&walk, dst, src, nbytes);
+-
+-		ret = blkcipher_walk_virt(desc, &walk);
+ 		iv = walk.iv;
+ 		memset(tweak, 0, AES_BLOCK_SIZE);
+ 		aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
+ 
++		disable_kernel_vsx();
++		pagefault_enable();
++		preempt_enable();
++
+ 		while ((nbytes = walk.nbytes)) {
++			preempt_disable();
++			pagefault_disable();
++			enable_kernel_vsx();
+ 			if (enc)
+ 				aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ 						nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak);
+ 			else
+ 				aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr,
+ 						nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak);
++			disable_kernel_vsx();
++			pagefault_enable();
++			preempt_enable();
+ 
+ 			nbytes &= AES_BLOCK_SIZE - 1;
+ 			ret = blkcipher_walk_done(desc, &walk, nbytes);
+ 		}
+-
+-		disable_kernel_vsx();
+-		pagefault_enable();
+-		preempt_enable();
+ 	}
+ 	return ret;
+ }
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 35e9fb885486..95e96f04bf6f 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -433,8 +433,8 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id)
+ 		return index;
+ 
+ 	spin_lock_irqsave(&edev->lock, flags);
+-
+ 	state = !!(edev->state & BIT(index));
++	spin_unlock_irqrestore(&edev->lock, flags);
+ 
+ 	/*
+ 	 * Call functions in a raw notifier chain for the specific one
+@@ -448,6 +448,7 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id)
+ 	 */
+ 	raw_notifier_call_chain(&edev->nh_all, state, edev);
+ 
++	spin_lock_irqsave(&edev->lock, flags);
+ 	/* This could be in interrupt handler */
+ 	prop_buf = (char *)get_zeroed_page(GFP_ATOMIC);
+ 	if (!prop_buf) {
+diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
+index 709efe2357ea..05ae8c4a8a1b 100644
+--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
+@@ -782,6 +782,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev, void *data, struct drm_file *file
+ 			    I915_USERPTR_UNSYNCHRONIZED))
+ 		return -EINVAL;
+ 
++	if (!args->user_size)
++		return -EINVAL;
++
+ 	if (offset_in_page(args->user_ptr | args->user_size))
+ 		return -EINVAL;
+ 
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 05964347008d..d96b09fea835 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -541,11 +541,8 @@ static void reset_channel_cb(void *arg)
+ 	channel->onchannel_callback = NULL;
+ }
+ 
+-static int vmbus_close_internal(struct vmbus_channel *channel)
++void vmbus_reset_channel_cb(struct vmbus_channel *channel)
+ {
+-	struct vmbus_channel_close_channel *msg;
+-	int ret;
+-
+ 	/*
+ 	 * vmbus_on_event(), running in the per-channel tasklet, can race
+ 	 * with vmbus_close_internal() in the case of SMP guest, e.g., when
+@@ -555,6 +552,29 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ 	 */
+ 	tasklet_disable(&channel->callback_event);
+ 
++	channel->sc_creation_callback = NULL;
++
++	/* Stop the callback asap */
++	if (channel->target_cpu != get_cpu()) {
++		put_cpu();
++		smp_call_function_single(channel->target_cpu, reset_channel_cb,
++					 channel, true);
++	} else {
++		reset_channel_cb(channel);
++		put_cpu();
++	}
++
++	/* Re-enable tasklet for use on re-open */
++	tasklet_enable(&channel->callback_event);
++}
++
++static int vmbus_close_internal(struct vmbus_channel *channel)
++{
++	struct vmbus_channel_close_channel *msg;
++	int ret;
++
++	vmbus_reset_channel_cb(channel);
++
+ 	/*
+ 	 * In case a device driver's probe() fails (e.g.,
+ 	 * util_probe() -> vmbus_open() returns -ENOMEM) and the device is
+@@ -568,16 +588,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ 	}
+ 
+ 	channel->state = CHANNEL_OPEN_STATE;
+-	channel->sc_creation_callback = NULL;
+-	/* Stop callback and cancel the timer asap */
+-	if (channel->target_cpu != get_cpu()) {
+-		put_cpu();
+-		smp_call_function_single(channel->target_cpu, reset_channel_cb,
+-					 channel, true);
+-	} else {
+-		reset_channel_cb(channel);
+-		put_cpu();
+-	}
+ 
+ 	/* Send a closing message */
+ 
+@@ -620,8 +630,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ 		get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
+ 
+ out:
+-	/* re-enable tasklet for use on re-open */
+-	tasklet_enable(&channel->callback_event);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 1939c0ca3741..1700b4e7758d 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -881,6 +881,12 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ 		return;
+ 	}
+ 
++	/*
++	 * Before setting channel->rescind in vmbus_rescind_cleanup(), we
++	 * should make sure the channel callback is not running any more.
++	 */
++	vmbus_reset_channel_cb(channel);
++
+ 	/*
+ 	 * Now wait for offer handling to complete.
+ 	 */
+diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c
+index 565f7d8d3304..f2761b385541 100644
+--- a/drivers/iio/accel/sca3000.c
++++ b/drivers/iio/accel/sca3000.c
+@@ -797,6 +797,7 @@ static int sca3000_write_raw(struct iio_dev *indio_dev,
+ 		mutex_lock(&st->lock);
+ 		ret = sca3000_write_3db_freq(st, val);
+ 		mutex_unlock(&st->lock);
++		return ret;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/iio/frequency/ad9523.c b/drivers/iio/frequency/ad9523.c
+index 99eba524f6dd..1642b55f70da 100644
+--- a/drivers/iio/frequency/ad9523.c
++++ b/drivers/iio/frequency/ad9523.c
+@@ -508,7 +508,7 @@ static ssize_t ad9523_store(struct device *dev,
+ 		return ret;
+ 
+ 	if (!state)
+-		return 0;
++		return len;
+ 
+ 	mutex_lock(&indio_dev->mlock);
+ 	switch ((u32)this_attr->address) {
+@@ -642,7 +642,7 @@ static int ad9523_read_raw(struct iio_dev *indio_dev,
+ 		code = (AD9523_CLK_DIST_DIV_PHASE_REV(ret) * 3141592) /
+ 			AD9523_CLK_DIST_DIV_REV(ret);
+ 		*val = code / 1000000;
+-		*val2 = (code % 1000000) * 10;
++		*val2 = code % 1000000;
+ 		return IIO_VAL_INT_PLUS_MICRO;
+ 	default:
+ 		return -EINVAL;
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 9eb12c2e3c74..83cfe44f070e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -276,6 +276,7 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ 	case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ 		if (wqe->wr.opcode != IB_WR_RDMA_READ &&
+ 		    wqe->wr.opcode != IB_WR_RDMA_READ_WITH_INV) {
++			wqe->status = IB_WC_FATAL_ERR;
+ 			return COMPST_ERROR;
+ 		}
+ 		reset_retry_counters(qp);
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 97c2225829ea..60105ba77889 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1713,8 +1713,7 @@ static bool srpt_close_ch(struct srpt_rdma_ch *ch)
+ 	int ret;
+ 
+ 	if (!srpt_set_ch_state(ch, CH_DRAINING)) {
+-		pr_debug("%s-%d: already closed\n", ch->sess_name,
+-			 ch->qp->qp_num);
++		pr_debug("%s: already closed\n", ch->sess_name);
+ 		return false;
+ 	}
+ 
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index e3dbb6101b4a..c0d1c4db5794 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1336,8 +1336,8 @@ void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
+ 	qi_submit_sync(&desc, iommu);
+ }
+ 
+-void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+-			u64 addr, unsigned mask)
++void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
++			u16 qdep, u64 addr, unsigned mask)
+ {
+ 	struct qi_desc desc;
+ 
+@@ -1352,7 +1352,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+ 		qdep = 0;
+ 
+ 	desc.low = QI_DEV_IOTLB_SID(sid) | QI_DEV_IOTLB_QDEP(qdep) |
+-		   QI_DIOTLB_TYPE;
++		   QI_DIOTLB_TYPE | QI_DEV_IOTLB_PFSID(pfsid);
+ 
+ 	qi_submit_sync(&desc, iommu);
+ }
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index e8414bcf8390..aaf3fed97477 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -422,6 +422,7 @@ struct device_domain_info {
+ 	struct list_head global; /* link to global list */
+ 	u8 bus;			/* PCI bus number */
+ 	u8 devfn;		/* PCI devfn number */
++	u16 pfsid;		/* SRIOV physical function source ID */
+ 	u8 pasid_supported:3;
+ 	u8 pasid_enabled:1;
+ 	u8 pri_supported:1;
+@@ -1502,6 +1503,20 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info)
+ 		return;
+ 
+ 	pdev = to_pci_dev(info->dev);
++	/* For IOMMU that supports device IOTLB throttling (DIT), we assign
++	 * PFSID to the invalidation desc of a VF such that IOMMU HW can gauge
++	 * queue depth at PF level. If DIT is not set, PFSID will be treated as
++	 * reserved, which should be set to 0.
++	 */
++	if (!ecap_dit(info->iommu->ecap))
++		info->pfsid = 0;
++	else {
++		struct pci_dev *pf_pdev;
++
++		/* pdev will be returned if device is not a vf */
++		pf_pdev = pci_physfn(pdev);
++		info->pfsid = PCI_DEVID(pf_pdev->bus->number, pf_pdev->devfn);
++	}
+ 
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ 	/* The PCIe spec, in its wisdom, declares that the behaviour of
+@@ -1567,7 +1582,8 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain,
+ 
+ 		sid = info->bus << 8 | info->devfn;
+ 		qdep = info->ats_qdep;
+-		qi_flush_dev_iotlb(info->iommu, sid, qdep, addr, mask);
++		qi_flush_dev_iotlb(info->iommu, sid, info->pfsid,
++				qdep, addr, mask);
+ 	}
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
+ }
+diff --git a/drivers/mailbox/mailbox-xgene-slimpro.c b/drivers/mailbox/mailbox-xgene-slimpro.c
+index a7040163dd43..b8b2b3533f46 100644
+--- a/drivers/mailbox/mailbox-xgene-slimpro.c
++++ b/drivers/mailbox/mailbox-xgene-slimpro.c
+@@ -195,9 +195,9 @@ static int slimpro_mbox_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, ctx);
+ 
+ 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	mb_base = devm_ioremap(&pdev->dev, regs->start, resource_size(regs));
+-	if (!mb_base)
+-		return -ENOMEM;
++	mb_base = devm_ioremap_resource(&pdev->dev, regs);
++	if (IS_ERR(mb_base))
++		return PTR_ERR(mb_base);
+ 
+ 	/* Setup mailbox links */
+ 	for (i = 0; i < MBOX_CNT; i++) {
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 930b00f6a3a2..5adb0c850b6c 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -456,8 +456,10 @@ static int bch_writeback_thread(void *arg)
+ 			 * data on cache. BCACHE_DEV_DETACHING flag is set in
+ 			 * bch_cached_dev_detach().
+ 			 */
+-			if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
++			if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) {
++				up_write(&dc->writeback_lock);
+ 				break;
++			}
+ 		}
+ 
+ 		up_write(&dc->writeback_lock);
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 4a4e9c75fc4c..0a5a45f3ec5f 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -362,7 +362,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd)
+ 	disk_super->version = cpu_to_le32(cmd->version);
+ 	memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name));
+ 	memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version));
+-	disk_super->policy_hint_size = 0;
++	disk_super->policy_hint_size = cpu_to_le32(0);
+ 
+ 	__copy_sm_root(cmd, disk_super);
+ 
+@@ -700,6 +700,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd,
+ 	disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]);
+ 	disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]);
+ 	disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]);
++	disk_super->policy_hint_size = cpu_to_le32(cmd->policy_hint_size);
+ 
+ 	disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits);
+ 	disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses);
+@@ -1321,6 +1322,7 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd,
+ 
+ 	dm_oblock_t oblock;
+ 	unsigned flags;
++	bool dirty = true;
+ 
+ 	dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le);
+ 	memcpy(&mapping, mapping_value_le, sizeof(mapping));
+@@ -1331,8 +1333,10 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd,
+ 			dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le);
+ 			memcpy(&hint, hint_value_le, sizeof(hint));
+ 		}
++		if (cmd->clean_when_opened)
++			dirty = flags & M_DIRTY;
+ 
+-		r = fn(context, oblock, to_cblock(cb), flags & M_DIRTY,
++		r = fn(context, oblock, to_cblock(cb), dirty,
+ 		       le32_to_cpu(hint), hints_valid);
+ 		if (r) {
+ 			DMERR("policy couldn't load cache block %llu",
+@@ -1360,7 +1364,7 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd,
+ 
+ 	dm_oblock_t oblock;
+ 	unsigned flags;
+-	bool dirty;
++	bool dirty = true;
+ 
+ 	dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le);
+ 	memcpy(&mapping, mapping_value_le, sizeof(mapping));
+@@ -1371,8 +1375,9 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd,
+ 			dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le);
+ 			memcpy(&hint, hint_value_le, sizeof(hint));
+ 		}
++		if (cmd->clean_when_opened)
++			dirty = dm_bitset_cursor_get_value(dirty_cursor);
+ 
+-		dirty = dm_bitset_cursor_get_value(dirty_cursor);
+ 		r = fn(context, oblock, to_cblock(cb), dirty,
+ 		       le32_to_cpu(hint), hints_valid);
+ 		if (r) {
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index f575110454b6..c60d29d09687 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -3072,11 +3072,11 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ 	 */
+ 	limits->max_segment_size = PAGE_SIZE;
+ 
+-	if (cc->sector_size != (1 << SECTOR_SHIFT)) {
+-		limits->logical_block_size = cc->sector_size;
+-		limits->physical_block_size = cc->sector_size;
+-		blk_limits_io_min(limits, cc->sector_size);
+-	}
++	limits->logical_block_size =
++		max_t(unsigned short, limits->logical_block_size, cc->sector_size);
++	limits->physical_block_size =
++		max_t(unsigned, limits->physical_block_size, cc->sector_size);
++	limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
+ }
+ 
+ static struct target_type crypt_target = {
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index cbc56372ff97..898286ed47a1 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -177,7 +177,7 @@ struct dm_integrity_c {
+ 	__u8 sectors_per_block;
+ 
+ 	unsigned char mode;
+-	bool suspending;
++	int suspending;
+ 
+ 	int failed;
+ 
+@@ -2209,7 +2209,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ 
+ 	del_timer_sync(&ic->autocommit_timer);
+ 
+-	ic->suspending = true;
++	WRITE_ONCE(ic->suspending, 1);
+ 
+ 	queue_work(ic->commit_wq, &ic->commit_work);
+ 	drain_workqueue(ic->commit_wq);
+@@ -2219,7 +2219,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ 		dm_integrity_flush_buffers(ic);
+ 	}
+ 
+-	ic->suspending = false;
++	WRITE_ONCE(ic->suspending, 0);
+ 
+ 	BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
+ 
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 72ae5dc50532..6cf9ad4e4e16 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2514,6 +2514,8 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ 	case PM_WRITE:
+ 		if (old_mode != new_mode)
+ 			notify_of_pool_mode_change(pool, "write");
++		if (old_mode == PM_OUT_OF_DATA_SPACE)
++			cancel_delayed_work_sync(&pool->no_space_timeout);
+ 		pool->out_of_data_space = false;
+ 		pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
+ 		dm_pool_metadata_read_write(pool->pmd);
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 698fa764999c..59b0c1fce9be 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -871,7 +871,7 @@ static int tvp5150_fill_fmt(struct v4l2_subdev *sd,
+ 	f = &format->format;
+ 
+ 	f->width = decoder->rect.width;
+-	f->height = decoder->rect.height;
++	f->height = decoder->rect.height / 2;
+ 
+ 	f->code = MEDIA_BUS_FMT_UYVY8_2X8;
+ 	f->field = V4L2_FIELD_ALTERNATE;
+diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
+index c37ccbfd52f2..96c07fa1802a 100644
+--- a/drivers/mfd/hi655x-pmic.c
++++ b/drivers/mfd/hi655x-pmic.c
+@@ -49,7 +49,7 @@ static struct regmap_config hi655x_regmap_config = {
+ 	.reg_bits = 32,
+ 	.reg_stride = HI655X_STRIDE,
+ 	.val_bits = 8,
+-	.max_register = HI655X_BUS_ADDR(0xFFF),
++	.max_register = HI655X_BUS_ADDR(0x400) - HI655X_STRIDE,
+ };
+ 
+ static struct resource pwrkey_resources[] = {
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index c1ba0d42cbc8..e0f29b8a872d 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -287,7 +287,7 @@ int cxl_adapter_context_get(struct cxl *adapter)
+ 	int rc;
+ 
+ 	rc = atomic_inc_unless_negative(&adapter->contexts_num);
+-	return rc >= 0 ? 0 : -EBUSY;
++	return rc ? 0 : -EBUSY;
+ }
+ 
+ void cxl_adapter_context_put(struct cxl *adapter)
+diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
+index 56c6f79a5c5a..5f8b583c6e41 100644
+--- a/drivers/misc/vmw_balloon.c
++++ b/drivers/misc/vmw_balloon.c
+@@ -341,7 +341,13 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps)
+ 		success = false;
+ 	}
+ 
+-	if (b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS)
++	/*
++	 * 2MB pages are only supported with batching. If batching is for some
++	 * reason disabled, do not use 2MB pages, since otherwise the legacy
++	 * mechanism is used with 2MB pages, causing a failure.
++	 */
++	if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) &&
++	    (b->capabilities & VMW_BALLOON_BATCHED_CMDS))
+ 		b->supported_page_sizes = 2;
+ 	else
+ 		b->supported_page_sizes = 1;
+@@ -450,7 +456,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
+ 
+ 	pfn32 = (u32)pfn;
+ 	if (pfn32 != pfn)
+-		return -1;
++		return -EINVAL;
+ 
+ 	STATS_INC(b->stats.lock[false]);
+ 
+@@ -460,7 +466,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
+ 
+ 	pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+ 	STATS_INC(b->stats.lock_fail[false]);
+-	return 1;
++	return -EIO;
+ }
+ 
+ static int vmballoon_send_batched_lock(struct vmballoon *b,
+@@ -597,11 +603,12 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages,
+ 
+ 	locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status,
+ 								target);
+-	if (locked > 0) {
++	if (locked) {
+ 		STATS_INC(b->stats.refused_alloc[false]);
+ 
+-		if (hv_status == VMW_BALLOON_ERROR_RESET ||
+-				hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED) {
++		if (locked == -EIO &&
++		    (hv_status == VMW_BALLOON_ERROR_RESET ||
++		     hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) {
+ 			vmballoon_free_page(page, false);
+ 			return -EIO;
+ 		}
+@@ -617,7 +624,7 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages,
+ 		} else {
+ 			vmballoon_free_page(page, false);
+ 		}
+-		return -EIO;
++		return locked;
+ 	}
+ 
+ 	/* track allocated page */
+@@ -1029,29 +1036,30 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b)
+  */
+ static int vmballoon_vmci_init(struct vmballoon *b)
+ {
+-	int error = 0;
++	unsigned long error, dummy;
+ 
+-	if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) != 0) {
+-		error = vmci_doorbell_create(&b->vmci_doorbell,
+-				VMCI_FLAG_DELAYED_CB,
+-				VMCI_PRIVILEGE_FLAG_RESTRICTED,
+-				vmballoon_doorbell, b);
+-
+-		if (error == VMCI_SUCCESS) {
+-			VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET,
+-					b->vmci_doorbell.context,
+-					b->vmci_doorbell.resource, error);
+-			STATS_INC(b->stats.doorbell_set);
+-		}
+-	}
++	if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0)
++		return 0;
+ 
+-	if (error != 0) {
+-		vmballoon_vmci_cleanup(b);
++	error = vmci_doorbell_create(&b->vmci_doorbell, VMCI_FLAG_DELAYED_CB,
++				     VMCI_PRIVILEGE_FLAG_RESTRICTED,
++				     vmballoon_doorbell, b);
+ 
+-		return -EIO;
+-	}
++	if (error != VMCI_SUCCESS)
++		goto fail;
++
++	error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context,
++				   b->vmci_doorbell.resource, dummy);
++
++	STATS_INC(b->stats.doorbell_set);
++
++	if (error != VMW_BALLOON_SUCCESS)
++		goto fail;
+ 
+ 	return 0;
++fail:
++	vmballoon_vmci_cleanup(b);
++	return -EIO;
+ }
+ 
+ /*
+@@ -1289,7 +1297,14 @@ static int __init vmballoon_init(void)
+ 
+ 	return 0;
+ }
+-module_init(vmballoon_init);
++
++/*
++ * Using late_initcall() instead of module_init() allows the balloon to use the
++ * VMCI doorbell even when the balloon is built into the kernel. Otherwise the
++ * VMCI is probed only after the balloon is initialized. If the balloon is used
++ * as a module, late_initcall() is equivalent to module_init().
++ */
++late_initcall(vmballoon_init);
+ 
+ static void __exit vmballoon_exit(void)
+ {
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index 8bae88a150fd..713658be6661 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -44,7 +44,7 @@
+ /* DM_CM_RST */
+ #define RST_DTRANRST1		BIT(9)
+ #define RST_DTRANRST0		BIT(8)
+-#define RST_RESERVED_BITS	GENMASK_ULL(32, 0)
++#define RST_RESERVED_BITS	GENMASK_ULL(31, 0)
+ 
+ /* DM_CM_INFO1 and DM_CM_INFO1_MASK */
+ #define INFO1_CLEAR		0
+diff --git a/drivers/net/wireless/marvell/libertas/dev.h b/drivers/net/wireless/marvell/libertas/dev.h
+index dd1ee1f0af48..469134930026 100644
+--- a/drivers/net/wireless/marvell/libertas/dev.h
++++ b/drivers/net/wireless/marvell/libertas/dev.h
+@@ -104,6 +104,7 @@ struct lbs_private {
+ 	u8 fw_ready;
+ 	u8 surpriseremoved;
+ 	u8 setup_fw_on_resume;
++	u8 power_up_on_resume;
+ 	int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb);
+ 	void (*reset_card) (struct lbs_private *priv);
+ 	int (*power_save) (struct lbs_private *priv);
+diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
+index 2300e796c6ab..43743c26c071 100644
+--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
+@@ -1290,15 +1290,23 @@ static void if_sdio_remove(struct sdio_func *func)
+ static int if_sdio_suspend(struct device *dev)
+ {
+ 	struct sdio_func *func = dev_to_sdio_func(dev);
+-	int ret;
+ 	struct if_sdio_card *card = sdio_get_drvdata(func);
++	struct lbs_private *priv = card->priv;
++	int ret;
+ 
+ 	mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
++	priv->power_up_on_resume = false;
+ 
+ 	/* If we're powered off anyway, just let the mmc layer remove the
+ 	 * card. */
+-	if (!lbs_iface_active(card->priv))
+-		return -ENOSYS;
++	if (!lbs_iface_active(priv)) {
++		if (priv->fw_ready) {
++			priv->power_up_on_resume = true;
++			if_sdio_power_off(card);
++		}
++
++		return 0;
++	}
+ 
+ 	dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
+ 		 sdio_func_id(func), flags);
+@@ -1306,9 +1314,14 @@ static int if_sdio_suspend(struct device *dev)
+ 	/* If we aren't being asked to wake on anything, we should bail out
+ 	 * and let the SD stack power down the card.
+ 	 */
+-	if (card->priv->wol_criteria == EHS_REMOVE_WAKEUP) {
++	if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
+ 		dev_info(dev, "Suspend without wake params -- powering down card\n");
+-		return -ENOSYS;
++		if (priv->fw_ready) {
++			priv->power_up_on_resume = true;
++			if_sdio_power_off(card);
++		}
++
++		return 0;
+ 	}
+ 
+ 	if (!(flags & MMC_PM_KEEP_POWER)) {
+@@ -1321,7 +1334,7 @@ static int if_sdio_suspend(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = lbs_suspend(card->priv);
++	ret = lbs_suspend(priv);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1336,6 +1349,11 @@ static int if_sdio_resume(struct device *dev)
+ 
+ 	dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func));
+ 
++	if (card->priv->power_up_on_resume) {
++		if_sdio_power_on(card);
++		wait_event(card->pwron_waitq, card->priv->fw_ready);
++	}
++
+ 	ret = lbs_resume(card->priv);
+ 
+ 	return ret;
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 2fffd42767c7..fb5ab5812a22 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -808,9 +808,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
+ 		 * overshoots the remainder by 4 bytes, assume it was
+ 		 * including 'status'.
+ 		 */
+-		if (out_field[1] - 8 == remainder)
++		if (out_field[1] - 4 == remainder)
+ 			return remainder;
+-		return out_field[1] - 4;
++		return out_field[1] - 8;
+ 	} else if (cmd == ND_CMD_CALL) {
+ 		struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
+ 
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 4c22cb395040..f7b8a86fa5c5 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -33,10 +33,6 @@
+ #define TBCTL			0x00
+ #define TBPRD			0x0A
+ 
+-#define TBCTL_RUN_MASK		(BIT(15) | BIT(14))
+-#define TBCTL_STOP_NEXT		0
+-#define TBCTL_STOP_ON_CYCLE	BIT(14)
+-#define TBCTL_FREE_RUN		(BIT(15) | BIT(14))
+ #define TBCTL_PRDLD_MASK	BIT(3)
+ #define TBCTL_PRDLD_SHDW	0
+ #define TBCTL_PRDLD_IMDT	BIT(3)
+@@ -360,7 +356,7 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 	/* Channels polarity can be configured from action qualifier module */
+ 	configure_polarity(pc, pwm->hwpwm);
+ 
+-	/* Enable TBCLK before enabling PWM device */
++	/* Enable TBCLK */
+ 	ret = clk_enable(pc->tbclk);
+ 	if (ret) {
+ 		dev_err(chip->dev, "Failed to enable TBCLK for %s: %d\n",
+@@ -368,9 +364,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 		return ret;
+ 	}
+ 
+-	/* Enable time counter for free_run */
+-	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_FREE_RUN);
+-
+ 	return 0;
+ }
+ 
+@@ -388,6 +381,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 		aqcsfrc_mask = AQCSFRC_CSFA_MASK;
+ 	}
+ 
++	/* Update shadow register first before modifying active register */
++	ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ 	/*
+ 	 * Changes to immediate action on Action Qualifier. This puts
+ 	 * Action Qualifier control on PWM output from next TBCLK
+@@ -400,9 +395,6 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ 	/* Disabling TBCLK on PWM disable */
+ 	clk_disable(pc->tbclk);
+ 
+-	/* Stop Time base counter */
+-	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_STOP_NEXT);
+-
+ 	/* Disable clock on PWM disable */
+ 	pm_runtime_put_sync(chip->dev);
+ }
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index 13f7cd11c07e..ac6e6a6a194c 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -817,13 +817,6 @@ static int omap_rtc_probe(struct platform_device *pdev)
+ 			goto err;
+ 	}
+ 
+-	if (rtc->is_pmic_controller) {
+-		if (!pm_power_off) {
+-			omap_rtc_power_off_rtc = rtc;
+-			pm_power_off = omap_rtc_power_off;
+-		}
+-	}
+-
+ 	/* Support ext_wakeup pinconf */
+ 	rtc_pinctrl_desc.name = dev_name(&pdev->dev);
+ 
+@@ -833,6 +826,13 @@ static int omap_rtc_probe(struct platform_device *pdev)
+ 		return PTR_ERR(rtc->pctldev);
+ 	}
+ 
++	if (rtc->is_pmic_controller) {
++		if (!pm_power_off) {
++			omap_rtc_power_off_rtc = rtc;
++			pm_power_off = omap_rtc_power_off;
++		}
++	}
++
+ 	return 0;
+ 
+ err:
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 4a001634023e..02bd1eba045b 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -319,7 +319,7 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi)
+ 		 */
+ 		if (cdns_spi_read(xspi, CDNS_SPI_ISR) &
+ 		    CDNS_SPI_IXR_TXFULL)
+-			usleep_range(10, 20);
++			udelay(10);
+ 
+ 		if (xspi->txbuf)
+ 			cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++);
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index 6ddb6ef1fda4..c5bbe08771a4 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -217,7 +217,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
+ 	pdata = &dspi->pdata;
+ 
+ 	/* program delay transfers if tx_delay is non zero */
+-	if (spicfg->wdelay)
++	if (spicfg && spicfg->wdelay)
+ 		spidat1 |= SPIDAT1_WDEL;
+ 
+ 	/*
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index d89127f4a46d..ca013dd4ff6b 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1006,30 +1006,30 @@ static int dspi_probe(struct platform_device *pdev)
+ 		goto out_master_put;
+ 	}
+ 
++	dspi->clk = devm_clk_get(&pdev->dev, "dspi");
++	if (IS_ERR(dspi->clk)) {
++		ret = PTR_ERR(dspi->clk);
++		dev_err(&pdev->dev, "unable to get clock\n");
++		goto out_master_put;
++	}
++	ret = clk_prepare_enable(dspi->clk);
++	if (ret)
++		goto out_master_put;
++
+ 	dspi_init(dspi);
+ 	dspi->irq = platform_get_irq(pdev, 0);
+ 	if (dspi->irq < 0) {
+ 		dev_err(&pdev->dev, "can't get platform irq\n");
+ 		ret = dspi->irq;
+-		goto out_master_put;
++		goto out_clk_put;
+ 	}
+ 
+ 	ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt, 0,
+ 			pdev->name, dspi);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n");
+-		goto out_master_put;
+-	}
+-
+-	dspi->clk = devm_clk_get(&pdev->dev, "dspi");
+-	if (IS_ERR(dspi->clk)) {
+-		ret = PTR_ERR(dspi->clk);
+-		dev_err(&pdev->dev, "unable to get clock\n");
+-		goto out_master_put;
++		goto out_clk_put;
+ 	}
+-	ret = clk_prepare_enable(dspi->clk);
+-	if (ret)
+-		goto out_master_put;
+ 
+ 	if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE) {
+ 		ret = dspi_request_dma(dspi, res->start);
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 4cb515a3104c..3a2e46e49405 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1480,6 +1480,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x31c2), LPSS_BXT_SSP },
+ 	{ PCI_VDEVICE(INTEL, 0x31c4), LPSS_BXT_SSP },
+ 	{ PCI_VDEVICE(INTEL, 0x31c6), LPSS_BXT_SSP },
++	/* ICL-LP */
++	{ PCI_VDEVICE(INTEL, 0x34aa), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0x34ab), LPSS_CNL_SSP },
++	{ PCI_VDEVICE(INTEL, 0x34fb), LPSS_CNL_SSP },
+ 	/* APL */
+ 	{ PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP },
+ 	{ PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP },
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index c8cb0b398cb1..6db8844ef3ec 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -195,6 +195,7 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ {
+ 	struct uart_port *uport = uart_port_check(state);
+ 	unsigned long page;
++	unsigned long flags = 0;
+ 	int retval = 0;
+ 
+ 	if (uport->type == PORT_UNKNOWN)
+@@ -209,15 +210,18 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ 	 * Initialise and allocate the transmit and temporary
+ 	 * buffer.
+ 	 */
+-	if (!state->xmit.buf) {
+-		/* This is protected by the per port mutex */
+-		page = get_zeroed_page(GFP_KERNEL);
+-		if (!page)
+-			return -ENOMEM;
++	page = get_zeroed_page(GFP_KERNEL);
++	if (!page)
++		return -ENOMEM;
+ 
++	uart_port_lock(state, flags);
++	if (!state->xmit.buf) {
+ 		state->xmit.buf = (unsigned char *) page;
+ 		uart_circ_clear(&state->xmit);
++	} else {
++		free_page(page);
+ 	}
++	uart_port_unlock(uport, flags);
+ 
+ 	retval = uport->ops->startup(uport);
+ 	if (retval == 0) {
+@@ -276,6 +280,7 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ {
+ 	struct uart_port *uport = uart_port_check(state);
+ 	struct tty_port *port = &state->port;
++	unsigned long flags = 0;
+ 
+ 	/*
+ 	 * Set the TTY IO error marker
+@@ -308,10 +313,12 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ 	/*
+ 	 * Free the transmit buffer page.
+ 	 */
++	uart_port_lock(state, flags);
+ 	if (state->xmit.buf) {
+ 		free_page((unsigned long)state->xmit.buf);
+ 		state->xmit.buf = NULL;
+ 	}
++	uart_port_unlock(uport, flags);
+ }
+ 
+ /**
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index f741ba8df01b..11d73b5fc885 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1716,12 +1716,12 @@ static int do_register_framebuffer(struct fb_info *fb_info)
+ 	return 0;
+ }
+ 
+-static int do_unregister_framebuffer(struct fb_info *fb_info)
++static int unbind_console(struct fb_info *fb_info)
+ {
+ 	struct fb_event event;
+-	int i, ret = 0;
++	int ret;
++	int i = fb_info->node;
+ 
+-	i = fb_info->node;
+ 	if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info)
+ 		return -EINVAL;
+ 
+@@ -1736,17 +1736,29 @@ static int do_unregister_framebuffer(struct fb_info *fb_info)
+ 	unlock_fb_info(fb_info);
+ 	console_unlock();
+ 
++	return ret;
++}
++
++static int __unlink_framebuffer(struct fb_info *fb_info);
++
++static int do_unregister_framebuffer(struct fb_info *fb_info)
++{
++	struct fb_event event;
++	int ret;
++
++	ret = unbind_console(fb_info);
++
+ 	if (ret)
+ 		return -EINVAL;
+ 
+ 	pm_vt_switch_unregister(fb_info->dev);
+ 
+-	unlink_framebuffer(fb_info);
++	__unlink_framebuffer(fb_info);
+ 	if (fb_info->pixmap.addr &&
+ 	    (fb_info->pixmap.flags & FB_PIXMAP_DEFAULT))
+ 		kfree(fb_info->pixmap.addr);
+ 	fb_destroy_modelist(&fb_info->modelist);
+-	registered_fb[i] = NULL;
++	registered_fb[fb_info->node] = NULL;
+ 	num_registered_fb--;
+ 	fb_cleanup_device(fb_info);
+ 	event.info = fb_info;
+@@ -1759,7 +1771,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info)
+ 	return 0;
+ }
+ 
+-int unlink_framebuffer(struct fb_info *fb_info)
++static int __unlink_framebuffer(struct fb_info *fb_info)
+ {
+ 	int i;
+ 
+@@ -1771,6 +1783,20 @@ int unlink_framebuffer(struct fb_info *fb_info)
+ 		device_destroy(fb_class, MKDEV(FB_MAJOR, i));
+ 		fb_info->dev = NULL;
+ 	}
++
++	return 0;
++}
++
++int unlink_framebuffer(struct fb_info *fb_info)
++{
++	int ret;
++
++	ret = __unlink_framebuffer(fb_info);
++	if (ret)
++		return ret;
++
++	unbind_console(fb_info);
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(unlink_framebuffer);
+diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c
+index f329eee6dc93..352abc39e891 100644
+--- a/fs/9p/xattr.c
++++ b/fs/9p/xattr.c
+@@ -105,7 +105,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,
+ {
+ 	struct kvec kvec = {.iov_base = (void *)value, .iov_len = value_len};
+ 	struct iov_iter from;
+-	int retval;
++	int retval, err;
+ 
+ 	iov_iter_kvec(&from, WRITE | ITER_KVEC, &kvec, 1, value_len);
+ 
+@@ -126,7 +126,9 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,
+ 			 retval);
+ 	else
+ 		p9_client_write(fid, 0, &from, &retval);
+-	p9_client_clunk(fid);
++	err = p9_client_clunk(fid);
++	if (!retval && err)
++		retval = err;
+ 	return retval;
+ }
+ 
+diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
+index 95f74bd2c067..70c4165d2d74 100644
+--- a/fs/nfs/blocklayout/dev.c
++++ b/fs/nfs/blocklayout/dev.c
+@@ -204,7 +204,7 @@ static bool bl_map_stripe(struct pnfs_block_dev *dev, u64 offset,
+ 	chunk = div_u64(offset, dev->chunk_size);
+ 	div_u64_rem(chunk, dev->nr_children, &chunk_idx);
+ 
+-	if (chunk_idx > dev->nr_children) {
++	if (chunk_idx >= dev->nr_children) {
+ 		dprintk("%s: invalid chunk idx %d (%lld/%lld)\n",
+ 			__func__, chunk_idx, offset, dev->chunk_size);
+ 		/* error, should not happen */
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 516b2248cafe..2c3f398995f6 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -433,11 +433,14 @@ validate_seqid(const struct nfs4_slot_table *tbl, const struct nfs4_slot *slot,
+  * a match.  If the slot is in use and the sequence numbers match, the
+  * client is still waiting for a response to the original request.
+  */
+-static bool referring_call_exists(struct nfs_client *clp,
++static int referring_call_exists(struct nfs_client *clp,
+ 				  uint32_t nrclists,
+-				  struct referring_call_list *rclists)
++				  struct referring_call_list *rclists,
++				  spinlock_t *lock)
++	__releases(lock)
++	__acquires(lock)
+ {
+-	bool status = 0;
++	int status = 0;
+ 	int i, j;
+ 	struct nfs4_session *session;
+ 	struct nfs4_slot_table *tbl;
+@@ -460,8 +463,10 @@ static bool referring_call_exists(struct nfs_client *clp,
+ 
+ 		for (j = 0; j < rclist->rcl_nrefcalls; j++) {
+ 			ref = &rclist->rcl_refcalls[j];
++			spin_unlock(lock);
+ 			status = nfs4_slot_wait_on_seqid(tbl, ref->rc_slotid,
+ 					ref->rc_sequenceid, HZ >> 1) < 0;
++			spin_lock(lock);
+ 			if (status)
+ 				goto out;
+ 		}
+@@ -538,7 +543,8 @@ __be32 nfs4_callback_sequence(void *argp, void *resp,
+ 	 * related callback was received before the response to the original
+ 	 * call.
+ 	 */
+-	if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists)) {
++	if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists,
++				&tbl->slot_tbl_lock) < 0) {
+ 		status = htonl(NFS4ERR_DELAY);
+ 		goto out_unlock;
+ 	}
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 51deff8e1f86..dda4a3a3ef6e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -547,8 +547,15 @@ nfs4_async_handle_exception(struct rpc_task *task, struct nfs_server *server,
+ 		ret = -EIO;
+ 	return ret;
+ out_retry:
+-	if (ret == 0)
++	if (ret == 0) {
+ 		exception->retry = 1;
++		/*
++		 * For NFS4ERR_MOVED, the client transport will need to
++		 * be recomputed after migration recovery has completed.
++		 */
++		if (errorcode == -NFS4ERR_MOVED)
++			rpc_task_release_transport(task);
++	}
+ 	return ret;
+ }
+ 
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index 60da59be83b6..4a3dd66175fe 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -61,7 +61,7 @@ EXPORT_SYMBOL_GPL(pnfs_generic_commit_release);
+ 
+ /* The generic layer is about to remove the req from the commit list.
+  * If this will make the bucket empty, it will need to put the lseg reference.
+- * Note this must be called holding i_lock
++ * Note this must be called holding nfsi->commit_mutex
+  */
+ void
+ pnfs_generic_clear_request_commit(struct nfs_page *req,
+@@ -149,9 +149,7 @@ restart:
+ 		if (list_empty(&b->written)) {
+ 			freeme = b->wlseg;
+ 			b->wlseg = NULL;
+-			spin_unlock(&cinfo->inode->i_lock);
+ 			pnfs_put_lseg(freeme);
+-			spin_lock(&cinfo->inode->i_lock);
+ 			goto restart;
+ 		}
+ 	}
+@@ -167,7 +165,7 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
+ 	LIST_HEAD(pages);
+ 	int i;
+ 
+-	spin_lock(&cinfo->inode->i_lock);
++	mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ 	for (i = idx; i < fl_cinfo->nbuckets; i++) {
+ 		bucket = &fl_cinfo->buckets[i];
+ 		if (list_empty(&bucket->committing))
+@@ -177,12 +175,12 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
+ 		list_for_each(pos, &bucket->committing)
+ 			cinfo->ds->ncommitting--;
+ 		list_splice_init(&bucket->committing, &pages);
+-		spin_unlock(&cinfo->inode->i_lock);
++		mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+ 		nfs_retry_commit(&pages, freeme, cinfo, i);
+ 		pnfs_put_lseg(freeme);
+-		spin_lock(&cinfo->inode->i_lock);
++		mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ 	}
+-	spin_unlock(&cinfo->inode->i_lock);
++	mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+ }
+ 
+ static unsigned int
+@@ -222,13 +220,13 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
+ 	struct list_head *pos;
+ 
+ 	bucket = &cinfo->ds->buckets[data->ds_commit_index];
+-	spin_lock(&cinfo->inode->i_lock);
++	mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+ 	list_for_each(pos, &bucket->committing)
+ 		cinfo->ds->ncommitting--;
+ 	list_splice_init(&bucket->committing, pages);
+ 	data->lseg = bucket->clseg;
+ 	bucket->clseg = NULL;
+-	spin_unlock(&cinfo->inode->i_lock);
++	mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+ 
+ }
+ 
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index 7fa7d68baa6d..1d4f9997236f 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -623,6 +623,21 @@ static int ovl_fill_real(struct dir_context *ctx, const char *name,
+ 	return orig_ctx->actor(orig_ctx, name, namelen, offset, ino, d_type);
+ }
+ 
++static bool ovl_is_impure_dir(struct file *file)
++{
++	struct ovl_dir_file *od = file->private_data;
++	struct inode *dir = d_inode(file->f_path.dentry);
++
++	/*
++	 * Only upper dir can be impure, but if we are in the middle of
++	 * iterating a lower real dir, dir could be copied up and marked
++	 * impure. We only want the impure cache if we started iterating
++	 * a real upper dir to begin with.
++	 */
++	return od->is_upper && ovl_test_flag(OVL_IMPURE, dir);
++
++}
++
+ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
+ {
+ 	int err;
+@@ -646,7 +661,7 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
+ 		rdt.parent_ino = stat.ino;
+ 	}
+ 
+-	if (ovl_test_flag(OVL_IMPURE, d_inode(dir))) {
++	if (ovl_is_impure_dir(file)) {
+ 		rdt.cache = ovl_cache_get_impure(&file->f_path);
+ 		if (IS_ERR(rdt.cache))
+ 			return PTR_ERR(rdt.cache);
+@@ -676,7 +691,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
+ 		 * entries.
+ 		 */
+ 		if (ovl_same_sb(dentry->d_sb) &&
+-		    (ovl_test_flag(OVL_IMPURE, d_inode(dentry)) ||
++		    (ovl_is_impure_dir(file) ||
+ 		     OVL_TYPE_MERGE(ovl_path_type(dentry->d_parent)))) {
+ 			return ovl_iterate_real(file, ctx);
+ 		}
+diff --git a/fs/quota/quota.c b/fs/quota/quota.c
+index 43612e2a73af..3f02bab0db4e 100644
+--- a/fs/quota/quota.c
++++ b/fs/quota/quota.c
+@@ -18,6 +18,7 @@
+ #include <linux/quotaops.h>
+ #include <linux/types.h>
+ #include <linux/writeback.h>
++#include <linux/nospec.h>
+ 
+ static int check_quotactl_permission(struct super_block *sb, int type, int cmd,
+ 				     qid_t id)
+@@ -703,6 +704,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
+ 
+ 	if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS))
+ 		return -EINVAL;
++	type = array_index_nospec(type, MAXQUOTAS);
+ 	/*
+ 	 * Quota not supported on this fs? Check this before s_quota_types
+ 	 * since they needn't be set if quota is not supported at all.
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 8ae1cd8611cc..69051f7a9606 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -665,6 +665,11 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ 	spin_lock(&ui->ui_lock);
+ 	ui->synced_i_size = ui->ui_size;
+ 	spin_unlock(&ui->ui_lock);
++	if (xent) {
++		spin_lock(&host_ui->ui_lock);
++		host_ui->synced_i_size = host_ui->ui_size;
++		spin_unlock(&host_ui->ui_lock);
++	}
+ 	mark_inode_clean(c, ui);
+ 	mark_inode_clean(c, host_ui);
+ 	return 0;
+@@ -1283,11 +1288,10 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in
+ 			      int *new_len)
+ {
+ 	void *buf;
+-	int err, compr_type;
+-	u32 dlen, out_len, old_dlen;
++	int err, dlen, compr_type, out_len, old_dlen;
+ 
+ 	out_len = le32_to_cpu(dn->size);
+-	buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS);
++	buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS);
+ 	if (!buf)
+ 		return -ENOMEM;
+ 
+@@ -1389,7 +1393,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
+ 		else if (err)
+ 			goto out_free;
+ 		else {
+-			if (le32_to_cpu(dn->size) <= dlen)
++			int dn_len = le32_to_cpu(dn->size);
++
++			if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) {
++				ubifs_err(c, "bad data node (block %u, inode %lu)",
++					  blk, inode->i_ino);
++				ubifs_dump_node(c, dn);
++				goto out_free;
++			}
++
++			if (dn_len <= dlen)
+ 				dlen = 0; /* Nothing to do */
+ 			else {
+ 				err = truncate_data_node(c, inode, blk, dn, &dlen);
+diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
+index 6c3a1abd0e22..780a436d8c45 100644
+--- a/fs/ubifs/lprops.c
++++ b/fs/ubifs/lprops.c
+@@ -1091,10 +1091,6 @@ static int scan_check_cb(struct ubifs_info *c,
+ 		}
+ 	}
+ 
+-	buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
+-	if (!buf)
+-		return -ENOMEM;
+-
+ 	/*
+ 	 * After an unclean unmount, empty and freeable LEBs
+ 	 * may contain garbage - do not scan them.
+@@ -1113,6 +1109,10 @@ static int scan_check_cb(struct ubifs_info *c,
+ 		return LPT_SCAN_CONTINUE;
+ 	}
+ 
++	buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
+ 	sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ 	if (IS_ERR(sleb)) {
+ 		ret = PTR_ERR(sleb);
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index c13eae819cbc..d47f16c0d582 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -152,6 +152,12 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ 	ui->data_len = size;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
++
++	if (!host->i_nlink) {
++		err = -ENOENT;
++		goto out_noent;
++	}
++
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_cnt += 1;
+ 	host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+@@ -183,6 +189,7 @@ out_cancel:
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ 	host_ui->xattr_names -= fname_len(nm);
+ 	host_ui->flags &= ~UBIFS_CRYPT_FL;
++out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ out_free:
+ 	make_bad_inode(inode);
+@@ -234,6 +241,12 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ 	mutex_unlock(&ui->ui_mutex);
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
++
++	if (!host->i_nlink) {
++		err = -ENOENT;
++		goto out_noent;
++	}
++
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(old_size);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(size);
+@@ -255,6 +268,7 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ out_cancel:
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(old_size);
++out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ 	make_bad_inode(inode);
+ out_free:
+@@ -483,6 +497,12 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
+ 		return err;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
++
++	if (!host->i_nlink) {
++		err = -ENOENT;
++		goto out_noent;
++	}
++
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_cnt -= 1;
+ 	host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm));
+@@ -502,6 +522,7 @@ out_cancel:
+ 	host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
+ 	host_ui->xattr_names += fname_len(nm);
++out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ 	ubifs_release_budget(c, &req);
+ 	make_bad_inode(inode);
+@@ -541,6 +562,9 @@ static int ubifs_xattr_remove(struct inode *host, const char *name)
+ 
+ 	ubifs_assert(inode_is_locked(host));
+ 
++	if (!host->i_nlink)
++		return -ENOENT;
++
+ 	if (fname_len(&nm) > UBIFS_MAX_NLEN)
+ 		return -ENAMETOOLONG;
+ 
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 61cd28ba25f3..be2ce57cd6ad 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -541,7 +541,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
+ 	if (error > 0) {
+ 		if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
+ 		    (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
+-			posix_acl_fix_xattr_to_user(kvalue, size);
++			posix_acl_fix_xattr_to_user(kvalue, error);
+ 		if (size && copy_to_user(value, kvalue, error))
+ 			error = -EFAULT;
+ 	} else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index ba74eaa8eadf..0c51f753652d 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -1026,6 +1026,8 @@ extern int vmbus_establish_gpadl(struct vmbus_channel *channel,
+ extern int vmbus_teardown_gpadl(struct vmbus_channel *channel,
+ 				     u32 gpadl_handle);
+ 
++void vmbus_reset_channel_cb(struct vmbus_channel *channel);
++
+ extern int vmbus_recvpacket(struct vmbus_channel *channel,
+ 				  void *buffer,
+ 				  u32 bufferlen,
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 485a5b48f038..a6ab2f51f703 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -112,6 +112,7 @@
+  * Extended Capability Register
+  */
+ 
++#define ecap_dit(e)		((e >> 41) & 0x1)
+ #define ecap_pasid(e)		((e >> 40) & 0x1)
+ #define ecap_pss(e)		((e >> 35) & 0x1f)
+ #define ecap_eafs(e)		((e >> 34) & 0x1)
+@@ -281,6 +282,7 @@ enum {
+ #define QI_DEV_IOTLB_SID(sid)	((u64)((sid) & 0xffff) << 32)
+ #define QI_DEV_IOTLB_QDEP(qdep)	(((qdep) & 0x1f) << 16)
+ #define QI_DEV_IOTLB_ADDR(addr)	((u64)(addr) & VTD_PAGE_MASK)
++#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
+ #define QI_DEV_IOTLB_SIZE	1
+ #define QI_DEV_IOTLB_MAX_INVS	32
+ 
+@@ -305,6 +307,7 @@ enum {
+ #define QI_DEV_EIOTLB_PASID(p)	(((u64)p) << 32)
+ #define QI_DEV_EIOTLB_SID(sid)	((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd)	((u64)((qd) & 0x1f) << 4)
++#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
+ #define QI_DEV_EIOTLB_MAX_INVS	32
+ 
+ #define QI_PGRP_IDX(idx)	(((u64)(idx)) << 55)
+@@ -450,9 +453,8 @@ extern void qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid,
+ 			     u8 fm, u64 type);
+ extern void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
+ 			  unsigned int size_order, u64 type);
+-extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+-			       u64 addr, unsigned mask);
+-
++extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
++			u16 qdep, u64 addr, unsigned mask);
+ extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
+ 
+ extern int dmar_ir_support(void);
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 9d6fae809c09..b1abbcc614cf 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2292,4 +2292,16 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ /* provide the legacy pci_dma_* API */
+ #include <linux/pci-dma-compat.h>
+ 
++#define pci_printk(level, pdev, fmt, arg...) \
++	dev_printk(level, &(pdev)->dev, fmt, ##arg)
++
++#define pci_emerg(pdev, fmt, arg...)	dev_emerg(&(pdev)->dev, fmt, ##arg)
++#define pci_alert(pdev, fmt, arg...)	dev_alert(&(pdev)->dev, fmt, ##arg)
++#define pci_crit(pdev, fmt, arg...)	dev_crit(&(pdev)->dev, fmt, ##arg)
++#define pci_err(pdev, fmt, arg...)	dev_err(&(pdev)->dev, fmt, ##arg)
++#define pci_warn(pdev, fmt, arg...)	dev_warn(&(pdev)->dev, fmt, ##arg)
++#define pci_notice(pdev, fmt, arg...)	dev_notice(&(pdev)->dev, fmt, ##arg)
++#define pci_info(pdev, fmt, arg...)	dev_info(&(pdev)->dev, fmt, ##arg)
++#define pci_dbg(pdev, fmt, arg...)	dev_dbg(&(pdev)->dev, fmt, ##arg)
++
+ #endif /* LINUX_PCI_H */
+diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
+index 71c237e8240e..166fc4e76df6 100644
+--- a/include/linux/sunrpc/clnt.h
++++ b/include/linux/sunrpc/clnt.h
+@@ -156,6 +156,7 @@ int		rpc_switch_client_transport(struct rpc_clnt *,
+ 
+ void		rpc_shutdown_client(struct rpc_clnt *);
+ void		rpc_release_client(struct rpc_clnt *);
++void		rpc_task_release_transport(struct rpc_task *);
+ void		rpc_task_release_client(struct rpc_task *);
+ 
+ int		rpcb_create_local(struct net *);
+diff --git a/include/linux/verification.h b/include/linux/verification.h
+index a10549a6c7cd..cfa4730d607a 100644
+--- a/include/linux/verification.h
++++ b/include/linux/verification.h
+@@ -12,6 +12,12 @@
+ #ifndef _LINUX_VERIFICATION_H
+ #define _LINUX_VERIFICATION_H
+ 
++/*
++ * Indicate that both builtin trusted keys and secondary trusted keys
++ * should be used.
++ */
++#define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
++
+ /*
+  * The use to which an asymmetric key is being put.
+  */
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index 1252a7a89bc0..85e32ee739fc 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -88,7 +88,7 @@ struct dlfb_data {
+ #define MIN_RAW_PIX_BYTES	2
+ #define MIN_RAW_CMD_BYTES	(RAW_HEADER_BYTES + MIN_RAW_PIX_BYTES)
+ 
+-#define DL_DEFIO_WRITE_DELAY    5 /* fb_deferred_io.delay in jiffies */
++#define DL_DEFIO_WRITE_DELAY    msecs_to_jiffies(HZ <= 300 ? 4 : 10) /* optimal value for 720p video */
+ #define DL_DEFIO_WRITE_DISABLE  (HZ*60) /* "disable" with long delay */
+ 
+ /* remove these once align.h patch is taken into kernel */
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index bf8c8fd72589..7c51f065b212 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -605,6 +605,9 @@ static int klp_init_func(struct klp_object *obj, struct klp_func *func)
+ 	if (!func->old_name || !func->new_func)
+ 		return -EINVAL;
+ 
++	if (strlen(func->old_name) >= KSYM_NAME_LEN)
++		return -EINVAL;
++
+ 	INIT_LIST_HEAD(&func->stack_node);
+ 	func->patched = false;
+ 	func->transition = false;
+@@ -678,6 +681,9 @@ static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
+ 	if (!obj->funcs)
+ 		return -EINVAL;
+ 
++	if (klp_is_module(obj) && strlen(obj->name) >= MODULE_NAME_LEN)
++		return -EINVAL;
++
+ 	obj->patched = false;
+ 	obj->mod = NULL;
+ 
+diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
+index e8517b63eb37..dd2b5a4d89a5 100644
+--- a/kernel/power/Kconfig
++++ b/kernel/power/Kconfig
+@@ -105,6 +105,7 @@ config PM_SLEEP
+ 	def_bool y
+ 	depends on SUSPEND || HIBERNATE_CALLBACKS
+ 	select PM
++	select SRCU
+ 
+ config PM_SLEEP_SMP
+ 	def_bool y
+diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
+index d482fd61ac67..64f8046586b6 100644
+--- a/kernel/printk/printk_safe.c
++++ b/kernel/printk/printk_safe.c
+@@ -309,12 +309,12 @@ static __printf(1, 0) int vprintk_nmi(const char *fmt, va_list args)
+ 	return printk_safe_log_store(s, fmt, args);
+ }
+ 
+-void printk_nmi_enter(void)
++void notrace printk_nmi_enter(void)
+ {
+ 	this_cpu_or(printk_context, PRINTK_NMI_CONTEXT_MASK);
+ }
+ 
+-void printk_nmi_exit(void)
++void notrace printk_nmi_exit(void)
+ {
+ 	this_cpu_and(printk_context, ~PRINTK_NMI_CONTEXT_MASK);
+ }
+diff --git a/kernel/sys.c b/kernel/sys.c
+index de4ed027dfd7..e25ec93aea22 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1176,18 +1176,19 @@ static int override_release(char __user *release, size_t len)
+ 
+ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
+ {
+-	int errno = 0;
++	struct new_utsname tmp;
+ 
+ 	down_read(&uts_sem);
+-	if (copy_to_user(name, utsname(), sizeof *name))
+-		errno = -EFAULT;
++	memcpy(&tmp, utsname(), sizeof(tmp));
+ 	up_read(&uts_sem);
++	if (copy_to_user(name, &tmp, sizeof(tmp)))
++		return -EFAULT;
+ 
+-	if (!errno && override_release(name->release, sizeof(name->release)))
+-		errno = -EFAULT;
+-	if (!errno && override_architecture(name))
+-		errno = -EFAULT;
+-	return errno;
++	if (override_release(name->release, sizeof(name->release)))
++		return -EFAULT;
++	if (override_architecture(name))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ #ifdef __ARCH_WANT_SYS_OLD_UNAME
+@@ -1196,55 +1197,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
+  */
+ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+ {
+-	int error = 0;
++	struct old_utsname tmp;
+ 
+ 	if (!name)
+ 		return -EFAULT;
+ 
+ 	down_read(&uts_sem);
+-	if (copy_to_user(name, utsname(), sizeof(*name)))
+-		error = -EFAULT;
++	memcpy(&tmp, utsname(), sizeof(tmp));
+ 	up_read(&uts_sem);
++	if (copy_to_user(name, &tmp, sizeof(tmp)))
++		return -EFAULT;
+ 
+-	if (!error && override_release(name->release, sizeof(name->release)))
+-		error = -EFAULT;
+-	if (!error && override_architecture(name))
+-		error = -EFAULT;
+-	return error;
++	if (override_release(name->release, sizeof(name->release)))
++		return -EFAULT;
++	if (override_architecture(name))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+ {
+-	int error;
++	struct oldold_utsname tmp = {};
+ 
+ 	if (!name)
+ 		return -EFAULT;
+-	if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname)))
+-		return -EFAULT;
+ 
+ 	down_read(&uts_sem);
+-	error = __copy_to_user(&name->sysname, &utsname()->sysname,
+-			       __OLD_UTS_LEN);
+-	error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
+-	error |= __copy_to_user(&name->nodename, &utsname()->nodename,
+-				__OLD_UTS_LEN);
+-	error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
+-	error |= __copy_to_user(&name->release, &utsname()->release,
+-				__OLD_UTS_LEN);
+-	error |= __put_user(0, name->release + __OLD_UTS_LEN);
+-	error |= __copy_to_user(&name->version, &utsname()->version,
+-				__OLD_UTS_LEN);
+-	error |= __put_user(0, name->version + __OLD_UTS_LEN);
+-	error |= __copy_to_user(&name->machine, &utsname()->machine,
+-				__OLD_UTS_LEN);
+-	error |= __put_user(0, name->machine + __OLD_UTS_LEN);
++	memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
++	memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
++	memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN);
++	memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN);
++	memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN);
+ 	up_read(&uts_sem);
++	if (copy_to_user(name, &tmp, sizeof(tmp)))
++		return -EFAULT;
+ 
+-	if (!error && override_architecture(name))
+-		error = -EFAULT;
+-	if (!error && override_release(name->release, sizeof(name->release)))
+-		error = -EFAULT;
+-	return error ? -EFAULT : 0;
++	if (override_architecture(name))
++		return -EFAULT;
++	if (override_release(name->release, sizeof(name->release)))
++		return -EFAULT;
++	return 0;
+ }
+ #endif
+ 
+@@ -1258,17 +1250,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
+ 
+ 	if (len < 0 || len > __NEW_UTS_LEN)
+ 		return -EINVAL;
+-	down_write(&uts_sem);
+ 	errno = -EFAULT;
+ 	if (!copy_from_user(tmp, name, len)) {
+-		struct new_utsname *u = utsname();
++		struct new_utsname *u;
+ 
++		down_write(&uts_sem);
++		u = utsname();
+ 		memcpy(u->nodename, tmp, len);
+ 		memset(u->nodename + len, 0, sizeof(u->nodename) - len);
+ 		errno = 0;
+ 		uts_proc_notify(UTS_PROC_HOSTNAME);
++		up_write(&uts_sem);
+ 	}
+-	up_write(&uts_sem);
+ 	return errno;
+ }
+ 
+@@ -1276,8 +1269,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
+ 
+ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
+ {
+-	int i, errno;
++	int i;
+ 	struct new_utsname *u;
++	char tmp[__NEW_UTS_LEN + 1];
+ 
+ 	if (len < 0)
+ 		return -EINVAL;
+@@ -1286,11 +1280,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
+ 	i = 1 + strlen(u->nodename);
+ 	if (i > len)
+ 		i = len;
+-	errno = 0;
+-	if (copy_to_user(name, u->nodename, i))
+-		errno = -EFAULT;
++	memcpy(tmp, u->nodename, i);
+ 	up_read(&uts_sem);
+-	return errno;
++	if (copy_to_user(name, tmp, i))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ #endif
+@@ -1309,17 +1303,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
+ 	if (len < 0 || len > __NEW_UTS_LEN)
+ 		return -EINVAL;
+ 
+-	down_write(&uts_sem);
+ 	errno = -EFAULT;
+ 	if (!copy_from_user(tmp, name, len)) {
+-		struct new_utsname *u = utsname();
++		struct new_utsname *u;
+ 
++		down_write(&uts_sem);
++		u = utsname();
+ 		memcpy(u->domainname, tmp, len);
+ 		memset(u->domainname + len, 0, sizeof(u->domainname) - len);
+ 		errno = 0;
+ 		uts_proc_notify(UTS_PROC_DOMAINNAME);
++		up_write(&uts_sem);
+ 	}
+-	up_write(&uts_sem);
+ 	return errno;
+ }
+ 
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index e73dcab8e9f0..71a8ee6e60dc 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -1809,6 +1809,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
+ 	mutex_lock(&q->blk_trace_mutex);
+ 
+ 	if (attr == &dev_attr_enable) {
++		if (!!value == !!q->blk_trace) {
++			ret = 0;
++			goto out_unlock_bdev;
++		}
+ 		if (value)
+ 			ret = blk_trace_setup_queue(q, bdev);
+ 		else
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index b7302c37c064..e9cbb96cd99e 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7545,7 +7545,9 @@ rb_simple_write(struct file *filp, const char __user *ubuf,
+ 
+ 	if (buffer) {
+ 		mutex_lock(&trace_types_lock);
+-		if (val) {
++		if (!!val == tracer_tracing_is_on(tr)) {
++			val = 0; /* do nothing */
++		} else if (val) {
+ 			tracer_tracing_on(tr);
+ 			if (tr->current_trace->start)
+ 				tr->current_trace->start(tr);
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 7197ff9f0bbd..ea0d90a31fc9 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -967,7 +967,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file)
+ 
+ 		list_del_rcu(&link->list);
+ 		/* synchronize with u{,ret}probe_trace_func */
+-		synchronize_sched();
++		synchronize_rcu();
+ 		kfree(link);
+ 
+ 		if (!list_empty(&tu->tp.files))
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index c490f1e4313b..ed80a88980f0 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -650,7 +650,16 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ 	unsigned idx;
+ 	struct uid_gid_extent *extent = NULL;
+ 	char *kbuf = NULL, *pos, *next_line;
+-	ssize_t ret = -EINVAL;
++	ssize_t ret;
++
++	/* Only allow < page size writes at the beginning of the file */
++	if ((*ppos != 0) || (count >= PAGE_SIZE))
++		return -EINVAL;
++
++	/* Slurp in the user data */
++	kbuf = memdup_user_nul(buf, count);
++	if (IS_ERR(kbuf))
++		return PTR_ERR(kbuf);
+ 
+ 	/*
+ 	 * The userns_state_mutex serializes all writes to any given map.
+@@ -684,19 +693,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ 	if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
+ 		goto out;
+ 
+-	/* Only allow < page size writes at the beginning of the file */
+-	ret = -EINVAL;
+-	if ((*ppos != 0) || (count >= PAGE_SIZE))
+-		goto out;
+-
+-	/* Slurp in the user data */
+-	kbuf = memdup_user_nul(buf, count);
+-	if (IS_ERR(kbuf)) {
+-		ret = PTR_ERR(kbuf);
+-		kbuf = NULL;
+-		goto out;
+-	}
+-
+ 	/* Parse the user data */
+ 	ret = -EINVAL;
+ 	pos = kbuf;
+diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
+index 233cd8fc6910..258033d62cb3 100644
+--- a/kernel/utsname_sysctl.c
++++ b/kernel/utsname_sysctl.c
+@@ -18,7 +18,7 @@
+ 
+ #ifdef CONFIG_PROC_SYSCTL
+ 
+-static void *get_uts(struct ctl_table *table, int write)
++static void *get_uts(struct ctl_table *table)
+ {
+ 	char *which = table->data;
+ 	struct uts_namespace *uts_ns;
+@@ -26,21 +26,9 @@ static void *get_uts(struct ctl_table *table, int write)
+ 	uts_ns = current->nsproxy->uts_ns;
+ 	which = (which - (char *)&init_uts_ns) + (char *)uts_ns;
+ 
+-	if (!write)
+-		down_read(&uts_sem);
+-	else
+-		down_write(&uts_sem);
+ 	return which;
+ }
+ 
+-static void put_uts(struct ctl_table *table, int write, void *which)
+-{
+-	if (!write)
+-		up_read(&uts_sem);
+-	else
+-		up_write(&uts_sem);
+-}
+-
+ /*
+  *	Special case of dostring for the UTS structure. This has locks
+  *	to observe. Should this be in kernel/sys.c ????
+@@ -50,13 +38,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write,
+ {
+ 	struct ctl_table uts_table;
+ 	int r;
++	char tmp_data[__NEW_UTS_LEN + 1];
++
+ 	memcpy(&uts_table, table, sizeof(uts_table));
+-	uts_table.data = get_uts(table, write);
++	uts_table.data = tmp_data;
++
++	/*
++	 * Buffer the value in tmp_data so that proc_dostring() can be called
++	 * without holding any locks.
++	 * We also need to read the original value in the write==1 case to
++	 * support partial writes.
++	 */
++	down_read(&uts_sem);
++	memcpy(tmp_data, get_uts(table), sizeof(tmp_data));
++	up_read(&uts_sem);
+ 	r = proc_dostring(&uts_table, write, buffer, lenp, ppos);
+-	put_uts(table, write, uts_table.data);
+ 
+-	if (write)
++	if (write) {
++		/*
++		 * Write back the new value.
++		 * Note that, since we dropped uts_sem, the result can
++		 * theoretically be incorrect if there are two parallel writes
++		 * at non-zero offsets to the same sysctl.
++		 */
++		down_write(&uts_sem);
++		memcpy(get_uts(table), tmp_data, sizeof(tmp_data));
++		up_write(&uts_sem);
+ 		proc_sys_poll_notify(table->poll);
++	}
+ 
+ 	return r;
+ }
+diff --git a/mm/memory.c b/mm/memory.c
+index c9657f013a4d..93d5d324904b 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -392,15 +392,6 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
+ {
+ 	struct mmu_table_batch **batch = &tlb->batch;
+ 
+-	/*
+-	 * When there's less then two users of this mm there cannot be a
+-	 * concurrent page-table walk.
+-	 */
+-	if (atomic_read(&tlb->mm->mm_users) < 2) {
+-		__tlb_remove_table(table);
+-		return;
+-	}
+-
+ 	if (*batch == NULL) {
+ 		*batch = (struct mmu_table_batch *)__get_free_page(GFP_NOWAIT | __GFP_NOWARN);
+ 		if (*batch == NULL) {
+diff --git a/mm/readahead.c b/mm/readahead.c
+index c4ca70239233..59aa0d06f254 100644
+--- a/mm/readahead.c
++++ b/mm/readahead.c
+@@ -380,6 +380,7 @@ ondemand_readahead(struct address_space *mapping,
+ {
+ 	struct backing_dev_info *bdi = inode_to_bdi(mapping->host);
+ 	unsigned long max_pages = ra->ra_pages;
++	unsigned long add_pages;
+ 	pgoff_t prev_offset;
+ 
+ 	/*
+@@ -469,10 +470,17 @@ readit:
+ 	 * Will this read hit the readahead marker made by itself?
+ 	 * If so, trigger the readahead marker hit now, and merge
+ 	 * the resulted next readahead window into the current one.
++	 * Take care of maximum IO pages as above.
+ 	 */
+ 	if (offset == ra->start && ra->size == ra->async_size) {
+-		ra->async_size = get_next_ra_size(ra, max_pages);
+-		ra->size += ra->async_size;
++		add_pages = get_next_ra_size(ra, max_pages);
++		if (ra->size + add_pages <= max_pages) {
++			ra->async_size = add_pages;
++			ra->size += add_pages;
++		} else {
++			ra->size = max_pages;
++			ra->async_size = max_pages >> 1;
++		}
+ 	}
+ 
+ 	return ra_submit(ra, mapping, filp);
+diff --git a/net/9p/client.c b/net/9p/client.c
+index b433aff5ff13..3ec5a82929b2 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -955,7 +955,7 @@ static int p9_client_version(struct p9_client *c)
+ {
+ 	int err = 0;
+ 	struct p9_req_t *req;
+-	char *version;
++	char *version = NULL;
+ 	int msize;
+ 
+ 	p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 985046ae4231..38e21a1e97bc 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -185,6 +185,8 @@ static void p9_mux_poll_stop(struct p9_conn *m)
+ 	spin_lock_irqsave(&p9_poll_lock, flags);
+ 	list_del_init(&m->poll_pending_link);
+ 	spin_unlock_irqrestore(&p9_poll_lock, flags);
++
++	flush_work(&p9_poll_work);
+ }
+ 
+ /**
+@@ -951,7 +953,7 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (valid_ipaddr4(addr) < 0)
++	if (addr == NULL || valid_ipaddr4(addr) < 0)
+ 		return -EINVAL;
+ 
+ 	csocket = NULL;
+@@ -1001,6 +1003,9 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
+ 
+ 	csocket = NULL;
+ 
++	if (addr == NULL)
++		return -EINVAL;
++
+ 	if (strlen(addr) >= UNIX_PATH_MAX) {
+ 		pr_err("%s (%d): address too long: %s\n",
+ 		       __func__, task_pid_nr(current), addr);
+diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
+index 6d8e3031978f..f58467a49090 100644
+--- a/net/9p/trans_rdma.c
++++ b/net/9p/trans_rdma.c
+@@ -646,6 +646,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
+ 	struct rdma_conn_param conn_param;
+ 	struct ib_qp_init_attr qp_attr;
+ 
++	if (addr == NULL)
++		return -EINVAL;
++
+ 	/* Parse the transport specific mount options */
+ 	err = parse_opts(args, &opts);
+ 	if (err < 0)
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 3aa5a93ad107..da0d3b257459 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -189,7 +189,7 @@ static int pack_sg_list(struct scatterlist *sg, int start,
+ 		s = rest_of_page(data);
+ 		if (s > count)
+ 			s = count;
+-		BUG_ON(index > limit);
++		BUG_ON(index >= limit);
+ 		/* Make sure we don't terminate early. */
+ 		sg_unmark_end(&sg[index]);
+ 		sg_set_buf(&sg[index++], data, s);
+@@ -234,6 +234,7 @@ pack_sg_list_p(struct scatterlist *sg, int start, int limit,
+ 		s = PAGE_SIZE - data_off;
+ 		if (s > count)
+ 			s = count;
++		BUG_ON(index >= limit);
+ 		/* Make sure we don't terminate early. */
+ 		sg_unmark_end(&sg[index]);
+ 		sg_set_page(&sg[index++], pdata[i++], s, data_off);
+@@ -406,6 +407,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ 	p9_debug(P9_DEBUG_TRANS, "virtio request\n");
+ 
+ 	if (uodata) {
++		__le32 sz;
+ 		int n = p9_get_mapped_pages(chan, &out_pages, uodata,
+ 					    outlen, &offs, &need_drop);
+ 		if (n < 0)
+@@ -416,6 +418,12 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ 			memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4);
+ 			outlen = n;
+ 		}
++		/* The size field of the message must include the length of the
++		 * header and the length of the data.  We didn't actually know
++		 * the length of the data until this point so add it in now.
++		 */
++		sz = cpu_to_le32(req->tc->size + outlen);
++		memcpy(&req->tc->sdata[0], &sz, sizeof(sz));
+ 	} else if (uidata) {
+ 		int n = p9_get_mapped_pages(chan, &in_pages, uidata,
+ 					    inlen, &offs, &need_drop);
+@@ -643,6 +651,9 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
+ 	int ret = -ENOENT;
+ 	int found = 0;
+ 
++	if (devname == NULL)
++		return -EINVAL;
++
+ 	mutex_lock(&virtio_9p_lock);
+ 	list_for_each_entry(chan, &virtio_chan_list, chan_list) {
+ 		if (!strncmp(devname, chan->tag, chan->tag_len) &&
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 325c56043007..c10bdf63eae7 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -95,6 +95,9 @@ static int p9_xen_create(struct p9_client *client, const char *addr, char *args)
+ {
+ 	struct xen_9pfs_front_priv *priv;
+ 
++	if (addr == NULL)
++		return -EINVAL;
++
+ 	read_lock(&xen_9pfs_lock);
+ 	list_for_each_entry(priv, &xen_9pfs_devs, list) {
+ 		if (!strcmp(priv->tag, addr)) {
+diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
+index e6ff5128e61a..ca53efa17be1 100644
+--- a/net/ieee802154/6lowpan/tx.c
++++ b/net/ieee802154/6lowpan/tx.c
+@@ -265,9 +265,24 @@ netdev_tx_t lowpan_xmit(struct sk_buff *skb, struct net_device *ldev)
+ 	/* We must take a copy of the skb before we modify/replace the ipv6
+ 	 * header as the header could be used elsewhere
+ 	 */
+-	skb = skb_unshare(skb, GFP_ATOMIC);
+-	if (!skb)
+-		return NET_XMIT_DROP;
++	if (unlikely(skb_headroom(skb) < ldev->needed_headroom ||
++		     skb_tailroom(skb) < ldev->needed_tailroom)) {
++		struct sk_buff *nskb;
++
++		nskb = skb_copy_expand(skb, ldev->needed_headroom,
++				       ldev->needed_tailroom, GFP_ATOMIC);
++		if (likely(nskb)) {
++			consume_skb(skb);
++			skb = nskb;
++		} else {
++			kfree_skb(skb);
++			return NET_XMIT_DROP;
++		}
++	} else {
++		skb = skb_unshare(skb, GFP_ATOMIC);
++		if (!skb)
++			return NET_XMIT_DROP;
++	}
+ 
+ 	ret = lowpan_header(skb, ldev, &dgram_size, &dgram_offset);
+ 	if (ret < 0) {
+diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
+index 7e253455f9dd..bcd1a5e6ebf4 100644
+--- a/net/mac802154/tx.c
++++ b/net/mac802154/tx.c
+@@ -63,8 +63,21 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+ 	int ret;
+ 
+ 	if (!(local->hw.flags & IEEE802154_HW_TX_OMIT_CKSUM)) {
+-		u16 crc = crc_ccitt(0, skb->data, skb->len);
++		struct sk_buff *nskb;
++		u16 crc;
++
++		if (unlikely(skb_tailroom(skb) < IEEE802154_FCS_LEN)) {
++			nskb = skb_copy_expand(skb, 0, IEEE802154_FCS_LEN,
++					       GFP_ATOMIC);
++			if (likely(nskb)) {
++				consume_skb(skb);
++				skb = nskb;
++			} else {
++				goto err_tx;
++			}
++		}
+ 
++		crc = crc_ccitt(0, skb->data, skb->len);
+ 		put_unaligned_le16(crc, skb_put(skb, 2));
+ 	}
+ 
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 2ad827db2704..6d118357d9dc 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -965,10 +965,20 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(rpc_bind_new_program);
+ 
++void rpc_task_release_transport(struct rpc_task *task)
++{
++	struct rpc_xprt *xprt = task->tk_xprt;
++
++	if (xprt) {
++		task->tk_xprt = NULL;
++		xprt_put(xprt);
++	}
++}
++EXPORT_SYMBOL_GPL(rpc_task_release_transport);
++
+ void rpc_task_release_client(struct rpc_task *task)
+ {
+ 	struct rpc_clnt *clnt = task->tk_client;
+-	struct rpc_xprt *xprt = task->tk_xprt;
+ 
+ 	if (clnt != NULL) {
+ 		/* Remove from client task list */
+@@ -979,12 +989,14 @@ void rpc_task_release_client(struct rpc_task *task)
+ 
+ 		rpc_release_client(clnt);
+ 	}
++	rpc_task_release_transport(task);
++}
+ 
+-	if (xprt != NULL) {
+-		task->tk_xprt = NULL;
+-
+-		xprt_put(xprt);
+-	}
++static
++void rpc_task_set_transport(struct rpc_task *task, struct rpc_clnt *clnt)
++{
++	if (!task->tk_xprt)
++		task->tk_xprt = xprt_iter_get_next(&clnt->cl_xpi);
+ }
+ 
+ static
+@@ -992,8 +1004,7 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
+ {
+ 
+ 	if (clnt != NULL) {
+-		if (task->tk_xprt == NULL)
+-			task->tk_xprt = xprt_iter_get_next(&clnt->cl_xpi);
++		rpc_task_set_transport(task, clnt);
+ 		task->tk_client = clnt;
+ 		atomic_inc(&clnt->cl_count);
+ 		if (clnt->cl_softrtry)
+@@ -1529,6 +1540,7 @@ call_start(struct rpc_task *task)
+ 		clnt->cl_program->version[clnt->cl_vers]->counts[idx]++;
+ 	clnt->cl_stats->rpccnt++;
+ 	task->tk_action = call_reserve;
++	rpc_task_set_transport(task, clnt);
+ }
+ 
+ /*
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 1c1f64582bb5..ae26ef006988 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -388,7 +388,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ 	if (strcmp(name, "capability") != 0)
+ 		return -EOPNOTSUPP;
+ 
+-	dentry = d_find_alias(inode);
++	dentry = d_find_any_alias(inode);
+ 	if (!dentry)
+ 		return -EINVAL;
+ 
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 5547457566a7..bbb9823e93b9 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -197,6 +197,9 @@ static int auxtrace_queues__grow(struct auxtrace_queues *queues,
+ 	for (i = 0; i < queues->nr_queues; i++) {
+ 		list_splice_tail(&queues->queue_array[i].head,
+ 				 &queue_array[i].head);
++		queue_array[i].tid = queues->queue_array[i].tid;
++		queue_array[i].cpu = queues->queue_array[i].cpu;
++		queue_array[i].set = queues->queue_array[i].set;
+ 		queue_array[i].priv = queues->queue_array[i].priv;
+ 	}
+