1256 files changed, 14318 insertions, 8674 deletions

diff --git a/.mailmap b/.mailmap
index 5273cfd70ad6..c7b10caecc4e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -68,6 +68,8 @@ Jacob Shin <Jacob.Shin@amd.com>
 James Bottomley <jejb@mulgrave.(none)>
 James Bottomley <jejb@titanic.il.steeleye.com>
 James E Wilson <wilson@specifix.com>
+James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
+James Hogan <jhogan@kernel.org> <james@albanarts.com>
 James Ketrenos <jketreno@io.(none)>
 Javi Merino <javi.merino@kernel.org> <javi.merino@arm.com>
 <javier@osg.samsung.com> <javier.martinez@collabora.co.uk>
diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
index 33e96f740639..147d4e8a1403 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
+++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
@@ -14,3 +14,11 @@ Description:
                 Show or set the gain boost of the amp, from 0-31 range.
                 18 = indoors (default)
                 14 = outdoors
+
+What            /sys/bus/iio/devices/iio:deviceX/noise_level_tripped
+Date:           May 2017
+KernelVersion:  4.13
+Contact:        Matt Ranostay <matt.ranostay@konsulko.com>
+Description:
+                When 1 the noise level is over the trip level and not reporting
+                valid data
diff --git a/Documentation/ABI/testing/sysfs-kernel-mm-swap b/Documentation/ABI/testing/sysfs-kernel-mm-swap
index 587db52084c7..94672016c268 100644
--- a/Documentation/ABI/testing/sysfs-kernel-mm-swap
+++ b/Documentation/ABI/testing/sysfs-kernel-mm-swap
@@ -14,13 +14,3 @@ Description:	Enable/disable VMA based swap readahead.
                 still used for tmpfs etc. other users.  If set to
                 false, the global swap readahead algorithm will be
                 used for all swappable pages.
-
-What:           /sys/kernel/mm/swap/vma_ra_max_order
-Date:           August 2017
-Contact:        Linux memory management mailing list <linux-mm@kvack.org>
-Description:    The max readahead size in order for VMA based swap readahead
-
-                VMA based swap readahead algorithm will readahead at
-                most 1 << max_order pages for each readahead.  The
-                real readahead size for each readahead will be scaled
-                according to the estimation algorithm.
diff --git a/Documentation/ABI/testing/sysfs-power b/Documentation/ABI/testing/sysfs-power
index 713cab1d5f12..a1d1612f3651 100644
--- a/Documentation/ABI/testing/sysfs-power
+++ b/Documentation/ABI/testing/sysfs-power
@@ -127,7 +127,7 @@ Description:
 
 What;           /sys/power/pm_trace_dev_match
 Date:           October 2010
-Contact:        James Hogan <james@albanarts.com>
+Contact:        James Hogan <jhogan@kernel.org>
 Description:
                 The /sys/power/pm_trace_dev_match file contains the name of the
                 device associated with the last PM event point saved in the RTC
diff --git a/Documentation/core-api/kernel-api.rst b/Documentation/core-api/kernel-api.rst
index 8282099e0cbf..5da10184d908 100644
--- a/Documentation/core-api/kernel-api.rst
+++ b/Documentation/core-api/kernel-api.rst
@@ -352,44 +352,30 @@ Read-Copy Update (RCU)
 ----------------------
 
 .. kernel-doc:: include/linux/rcupdate.h
-   :external:
 
 .. kernel-doc:: include/linux/rcupdate_wait.h
-   :external:
 
 .. kernel-doc:: include/linux/rcutree.h
-   :external:
 
 .. kernel-doc:: kernel/rcu/tree.c
-   :external:
 
 .. kernel-doc:: kernel/rcu/tree_plugin.h
-   :external:
 
 .. kernel-doc:: kernel/rcu/tree_exp.h
-   :external:
 
 .. kernel-doc:: kernel/rcu/update.c
-   :external:
 
 .. kernel-doc:: include/linux/srcu.h
-   :external:
 
 .. kernel-doc:: kernel/rcu/srcutree.c
-   :external:
 
 .. kernel-doc:: include/linux/rculist_bl.h
-   :external:
 
 .. kernel-doc:: include/linux/rculist.h
-   :external:
 
 .. kernel-doc:: include/linux/rculist_nulls.h
-   :external:
 
 .. kernel-doc:: include/linux/rcu_sync.h
-   :external:
 
 .. kernel-doc:: kernel/rcu/sync.c
-   :external:
 
diff --git a/Documentation/core-api/workqueue.rst b/Documentation/core-api/workqueue.rst
index 3943b5bfa8cf..00a5ba51e63f 100644
--- a/Documentation/core-api/workqueue.rst
+++ b/Documentation/core-api/workqueue.rst
@@ -39,8 +39,8 @@ up.
 Although MT wq wasted a lot of resource, the level of concurrency
 provided was unsatisfactory.  The limitation was common to both ST and
 MT wq albeit less severe on MT.  Each wq maintained its own separate
-worker pool.  A MT wq could provide only one execution context per CPU
-while a ST wq one for the whole system.  Work items had to compete for
+worker pool.  An MT wq could provide only one execution context per CPU
+while an ST wq one for the whole system.  Work items had to compete for
 those very limited execution contexts leading to various problems
 including proneness to deadlocks around the single execution context.
 
@@ -151,7 +151,7 @@ Application Programming Interface (API)
 
 ``alloc_workqueue()`` allocates a wq.  The original
 ``create_*workqueue()`` functions are deprecated and scheduled for
-removal.  ``alloc_workqueue()`` takes three arguments - @``name``,
+removal.  ``alloc_workqueue()`` takes three arguments - ``@name``,
 ``@flags`` and ``@max_active``.  ``@name`` is the name of the wq and
 also used as the name of the rescuer thread if there is one.
 
@@ -197,7 +197,7 @@ resources, scheduled and executed.
   served by worker threads with elevated nice level.
 
   Note that normal and highpri worker-pools don't interact with
-  each other.  Each maintain its separate pool of workers and
+  each other.  Each maintains its separate pool of workers and
   implements concurrency management among its workers.
 
 ``WQ_CPU_INTENSIVE``
@@ -249,8 +249,8 @@ unbound worker-pools and only one work item could be active at any given
 time thus achieving the same ordering property as ST wq.
 
 In the current implementation the above configuration only guarantees
-ST behavior within a given NUMA node. Instead alloc_ordered_queue should
-be used to achieve system wide ST behavior.
+ST behavior within a given NUMA node. Instead ``alloc_ordered_queue()`` should
+be used to achieve system-wide ST behavior.
 
 
 Example Execution Scenarios
diff --git a/Documentation/cpu-freq/index.txt b/Documentation/cpu-freq/index.txt
index 03a7cee6ac73..c15e75386a05 100644
--- a/Documentation/cpu-freq/index.txt
+++ b/Documentation/cpu-freq/index.txt
@@ -32,8 +32,6 @@ cpufreq-stats.txt -	General description of sysfs cpufreq stats.
 
 index.txt       -       File index, Mailing list and Links (this document)
 
-intel-pstate.txt -      Intel pstate cpufreq driver specific file.
-
 pcc-cpufreq.txt -       PCC cpufreq driver specific file.
 
 
diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 4a0a7469fdd7..32df07e29f68 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -344,3 +344,4 @@ Version History
         (wrong raid10_copies/raid10_format sequence)
 1.11.1  Add raid4/5/6 journal write-back support via journal_mode option
 1.12.1  fix for MD deadlock between mddev_suspend() and md_write_start() available
+1.13.0  Fix dev_health status at end of "recover" (was 'a', now 'A')
diff --git a/Documentation/devicetree/bindings/iio/proximity/as3935.txt b/Documentation/devicetree/bindings/iio/proximity/as3935.txt
index 38d74314b7ab..b6c1afa6f02d 100644
--- a/Documentation/devicetree/bindings/iio/proximity/as3935.txt
+++ b/Documentation/devicetree/bindings/iio/proximity/as3935.txt
@@ -16,6 +16,10 @@ Optional properties:
         - ams,tuning-capacitor-pf: Calibration tuning capacitor stepping
           value 0 - 120pF. This will require using the calibration data from
           the manufacturer.
+        - ams,nflwdth: Set the noise and watchdog threshold register on
+          startup. This will need to set according to the noise from the
+          MCU board, and possibly the local environment. Refer to the
+          datasheet for the threshold settings.
 
 Example:
 
@@ -27,4 +31,5 @@ as3935@0 {
         interrupt-parent = <&gpio1>;
         interrupts = <16 1>;
         ams,tuning-capacitor-pf = <80>;
+        ams,nflwdth = <0x44>;
 };
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
index 4c29cdab0ea5..5eb108e180fa 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
@@ -99,7 +99,7 @@ Examples:
                         compatible = "arm,gic-v3-its";
                         msi-controller;
                         #msi-cells = <1>;
-                        reg = <0x0 0x2c200000 0 0x200000>;
+                        reg = <0x0 0x2c200000 0 0x20000>;
                 };
         };
 
@@ -124,14 +124,14 @@ Examples:
                         compatible = "arm,gic-v3-its";
                         msi-controller;
                         #msi-cells = <1>;
-                        reg = <0x0 0x2c200000 0 0x200000>;
+                        reg = <0x0 0x2c200000 0 0x20000>;
                 };
 
                 gic-its@2c400000 {
                         compatible = "arm,gic-v3-its";
                         msi-controller;
                         #msi-cells = <1>;
-                        reg = <0x0 0x2c400000 0 0x200000>;
+                        reg = <0x0 0x2c400000 0 0x20000>;
                 };
 
                 ppi-partitions {
diff --git a/Documentation/devicetree/bindings/leds/ams,as3645a.txt b/Documentation/devicetree/bindings/leds/ams,as3645a.txt
index 12c5ef26ec73..fdc40e354a64 100644
--- a/Documentation/devicetree/bindings/leds/ams,as3645a.txt
+++ b/Documentation/devicetree/bindings/leds/ams,as3645a.txt
@@ -15,11 +15,14 @@ Required properties
 
 compatible      : Must be "ams,as3645a".
 reg             : The I2C address of the device. Typically 0x30.
+#address-cells  : 1
+#size-cells     : 0
 
 
-Required properties of the "flash" child node
-=============================================
+Required properties of the flash child node (0)
+===============================================
 
+reg: 0
 flash-timeout-us: Flash timeout in microseconds. The value must be in
                   the range [100000, 850000] and divisible by 50000.
 flash-max-microamp: Maximum flash current in microamperes. Has to be
@@ -33,20 +36,21 @@ ams,input-max-microamp: Maximum flash controller input current. The
                         and divisible by 50000.
 
 
-Optional properties of the "flash" child node
-=============================================
+Optional properties of the flash child node
+===========================================
 
 label           : The label of the flash LED.
 
 
-Required properties of the "indicator" child node
-=================================================
+Required properties of the indicator child node (1)
+===================================================
 
+reg: 1
 led-max-microamp: Maximum indicator current. The allowed values are
                   2500, 5000, 7500 and 10000.
 
-Optional properties of the "indicator" child node
-=================================================
+Optional properties of the indicator child node
+===============================================
 
 label           : The label of the indicator LED.
 
@@ -55,16 +59,20 @@ Example
 =======
 
         as3645a@30 {
+                #address-cells: 1
+                #size-cells: 0
                 reg = <0x30>;
                 compatible = "ams,as3645a";
-                flash {
+                flash@0 {
+                        reg = <0x0>;
                         flash-timeout-us = <150000>;
                         flash-max-microamp = <320000>;
                         led-max-microamp = <60000>;
                         ams,input-max-microamp = <1750000>;
                         label = "as3645a:flash";
                 };
-                indicator {
+                indicator@1 {
+                        reg = <0x1>;
                         led-max-microamp = <10000>;
                         label = "as3645a:indicator";
                 };
diff --git a/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt b/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
index b878a1e305af..ed1456f5c94d 100644
--- a/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
+++ b/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
@@ -16,11 +16,13 @@ Required Properties:
 
 - clocks:
   Array of clocks required for SDHC.
-  Require at least input clock for Xenon IP core.
+  Require at least input clock for Xenon IP core. For Armada AP806 and
+  CP110, the AXI clock is also mandatory.
 
 - clock-names:
   Array of names corresponding to clocks property.
   The input clock for Xenon IP core should be named as "core".
+  The input clock for the AXI bus must be named as "axi".
 
 - reg:
   * For "marvell,armada-3700-sdhci", two register areas.
@@ -106,8 +108,8 @@ Example:
                 compatible = "marvell,armada-ap806-sdhci";
                 reg = <0xaa0000 0x1000>;
                 interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>
-                clocks = <&emmc_clk>;
-                clock-names = "core";
+                clocks = <&emmc_clk>,<&axi_clk>;
+                clock-names = "core", "axi";
                 bus-width = <4>;
                 marvell,xenon-phy-slow-mode;
                 marvell,xenon-tun-count = <11>;
@@ -126,8 +128,8 @@ Example:
                 interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>
                 vqmmc-supply = <&sd_vqmmc_regulator>;
                 vmmc-supply = <&sd_vmmc_regulator>;
-                clocks = <&sdclk>;
-                clock-names = "core";
+                clocks = <&sdclk>, <&axi_clk>;
+                clock-names = "core", "axi";
                 bus-width = <4>;
                 marvell,xenon-tun-count = <9>;
         };
diff --git a/Documentation/devicetree/bindings/net/marvell-pp2.txt b/Documentation/devicetree/bindings/net/marvell-pp2.txt
index 7e2dad08a12e..1814fa13f6ab 100644
--- a/Documentation/devicetree/bindings/net/marvell-pp2.txt
+++ b/Documentation/devicetree/bindings/net/marvell-pp2.txt
@@ -21,8 +21,9 @@ Required properties:
         - main controller clock (for both armada-375-pp2 and armada-7k-pp2)
         - GOP clock (for both armada-375-pp2 and armada-7k-pp2)
         - MG clock (only for armada-7k-pp2)
-- clock-names: names of used clocks, must be "pp_clk", "gop_clk" and
-  "mg_clk" (the latter only for armada-7k-pp2).
+        - AXI clock (only for armada-7k-pp2)
+- clock-names: names of used clocks, must be "pp_clk", "gop_clk", "mg_clk"
+  and "axi_clk" (the 2 latter only for armada-7k-pp2).
 
 The ethernet ports are represented by subnodes. At least one port is
 required.
@@ -78,8 +79,9 @@ Example for marvell,armada-7k-pp2:
 cpm_ethernet: ethernet@0 {
         compatible = "marvell,armada-7k-pp22";
         reg = <0x0 0x100000>, <0x129000 0xb000>;
-        clocks = <&cpm_syscon0 1 3>, <&cpm_syscon0 1 9>, <&cpm_syscon0 1 5>;
-        clock-names = "pp_clk", "gop_clk", "gp_clk";
+        clocks = <&cpm_syscon0 1 3>, <&cpm_syscon0 1 9>,
+                 <&cpm_syscon0 1 5>, <&cpm_syscon0 1 18>;
+        clock-names = "pp_clk", "gop_clk", "gp_clk", "axi_clk";
 
         eth0: eth0 {
                 interrupts = <ICU_GRP_NSR 39 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/Documentation/devicetree/bindings/net/rockchip-dwmac.txt b/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
index 6af8eed1adeb..9c16ee2965a2 100644
--- a/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
@@ -4,6 +4,7 @@ The device node has following properties.
 
 Required properties:
  - compatible: should be "rockchip,<name>-gamc"
+   "rockchip,rk3128-gmac": found on RK312x SoCs
    "rockchip,rk3228-gmac": found on RK322x SoCs
    "rockchip,rk3288-gmac": found on RK3288 SoCs
    "rockchip,rk3328-gmac": found on RK3328 SoCs
diff --git a/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt b/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
new file mode 100644
index 000000000000..830069b1c37c
--- /dev/null
+++ b/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
@@ -0,0 +1,28 @@
+Binding for the Synopsys HSDK reset controller
+
+This binding uses the common reset binding[1].
+
+[1] Documentation/devicetree/bindings/reset/reset.txt
+
+Required properties:
+- compatible: should be "snps,hsdk-reset".
+- reg: should always contain 2 pairs address - length: first for reset
+  configuration register and second for corresponding SW reset and status bits
+  register.
+- #reset-cells: from common reset binding; Should always be set to 1.
+
+Example:
+        reset: reset@880 {
+                compatible = "snps,hsdk-reset";
+                #reset-cells = <1>;
+                reg = <0x8A0 0x4>, <0xFF0 0x4>;
+        };
+
+Specifying reset lines connected to IP modules:
+        ethernet@.... {
+                ....
+                resets = <&reset HSDK_V1_ETH_RESET>;
+                ....
+        };
+
+The index could be found in <dt-bindings/reset/snps,hsdk-reset.h>
diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
index 4fc96946f81d..cf504d0380ae 100644
--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
+++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
@@ -41,6 +41,8 @@ Required properties:
     - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART.
     - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART.
     - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART.
+    - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART.
+    - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART.
     - "renesas,scif-r8a77995" for R8A77995 (R-Car D3) SCIF compatible UART.
     - "renesas,hscif-r8a77995" for R8A77995 (R-Car D3) HSCIF compatible UART.
     - "renesas,scifa-sh73a0" for SH73A0 (SH-Mobile AG5) SCIFA compatible UART.
diff --git a/Documentation/driver-model/driver.txt b/Documentation/driver-model/driver.txt
index 4421135826a2..d661e6f7e6a0 100644
--- a/Documentation/driver-model/driver.txt
+++ b/Documentation/driver-model/driver.txt
@@ -196,12 +196,13 @@ struct driver_attribute {
 };
 
 Device drivers can export attributes via their sysfs directories. 
-Drivers can declare attributes using a DRIVER_ATTR macro that works
-identically to the DEVICE_ATTR macro. 
+Drivers can declare attributes using a DRIVER_ATTR_RW and DRIVER_ATTR_RO
+macro that works identically to the DEVICE_ATTR_RW and DEVICE_ATTR_RO
+macros.
 
 Example:
 
-DRIVER_ATTR(debug,0644,show_debug,store_debug);
+DRIVER_ATTR_RW(debug);
 
 This is equivalent to declaring:
 
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index 36f528a7fdd6..8caa60734647 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -210,8 +210,11 @@ path as another overlay mount and it may use a lower layer path that is
 beneath or above the path of another overlay lower layer path.
 
 Using an upper layer path and/or a workdir path that are already used by
-another overlay mount is not allowed and will fail with EBUSY.  Using
+another overlay mount is not allowed and may fail with EBUSY.  Using
 partially overlapping paths is not allowed but will not fail with EBUSY.
+If files are accessed from two overlayfs mounts which share or overlap the
+upper layer and/or workdir path the behavior of the overlay is undefined,
+though it will not result in a crash or deadlock.
 
 Mounting an overlay using an upper layer path, where the upper layer path
 was previously used by another mounted overlay in combination with a
diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
index 24da7b32c489..9a3658cc399e 100644
--- a/Documentation/filesystems/sysfs.txt
+++ b/Documentation/filesystems/sysfs.txt
@@ -366,7 +366,8 @@ struct driver_attribute {
 
 Declaring:
 
-DRIVER_ATTR(_name, _mode, _show, _store)
+DRIVER_ATTR_RO(_name)
+DRIVER_ATTR_RW(_name)
 
 Creation/Removal:
 
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 0500193434cb..d47702456926 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -36,6 +36,7 @@ Supported adapters:
   * Intel Gemini Lake (SOC)
   * Intel Cannon Lake-H (PCH)
   * Intel Cannon Lake-LP (PCH)
+  * Intel Cedar Fork (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index 329e740adea7..f6f80380dff2 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -1108,14 +1108,6 @@ When kbuild executes, the following steps are followed (roughly):
     ld
         Link target. Often, LDFLAGS_$@ is used to set specific options to ld.
 
-    objcopy
-        Copy binary. Uses OBJCOPYFLAGS usually specified in
-        arch/$(ARCH)/Makefile.
-        OBJCOPYFLAGS_$@ may be used to set additional options.
-
-    gzip
-        Compress target. Use maximum compression to compress target.
-
         Example:
                 #arch/x86/boot/Makefile
                 LDFLAGS_bootsect := -Ttext 0x0 -s --oformat binary
@@ -1139,6 +1131,19 @@ When kbuild executes, the following steps are followed (roughly):
               resulting in the target file being recompiled for no
               obvious reason.
 
+    objcopy
+        Copy binary. Uses OBJCOPYFLAGS usually specified in
+        arch/$(ARCH)/Makefile.
+        OBJCOPYFLAGS_$@ may be used to set additional options.
+
+    gzip
+        Compress target. Use maximum compression to compress target.
+
+        Example:
+                #arch/x86/boot/compressed/Makefile
+                $(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE
+                        $(call if_changed,gzip)
+
     dtc
         Create flattened device tree blob object suitable for linking
         into vmlinux. Device tree blobs linked into vmlinux are placed
@@ -1219,7 +1224,7 @@ When kbuild executes, the following steps are followed (roughly):
         that may be shared between individual architectures.
         The recommended approach how to use a generic header file is
         to list the file in the Kbuild file.
-        See "7.3 generic-y" for further info on syntax etc.
+        See "7.2 generic-y" for further info on syntax etc.
 
 --- 6.11 Post-link pass
 
@@ -1254,13 +1259,13 @@ A Kbuild file may be defined under arch/<arch>/include/uapi/asm/ and
 arch/<arch>/include/asm/ to list asm files coming from asm-generic.
 See subsequent chapter for the syntax of the Kbuild file.
 
-        --- 7.1 no-export-headers
+--- 7.1 no-export-headers
 
         no-export-headers is essentially used by include/uapi/linux/Kbuild to
         avoid exporting specific headers (e.g. kvm.h) on architectures that do
         not support it. It should be avoided as much as possible.
 
-        --- 7.2 generic-y
+--- 7.2 generic-y
 
         If an architecture uses a verbatim copy of a header from
         include/asm-generic then this is listed in the file
@@ -1287,7 +1292,7 @@ See subsequent chapter for the syntax of the Kbuild file.
                 Example: termios.h
                         #include <asm-generic/termios.h>
 
-        --- 7.3 generated-y
+--- 7.3 generated-y
 
         If an architecture generates other header files alongside generic-y
         wrappers, generated-y specifies them.
@@ -1299,7 +1304,7 @@ See subsequent chapter for the syntax of the Kbuild file.
                         #arch/x86/include/asm/Kbuild
                         generated-y += syscalls_32.h
 
-        --- 7.5 mandatory-y
+--- 7.4 mandatory-y
 
         mandatory-y is essentially used by include/uapi/asm-generic/Kbuild.asm
         to define the minimum set of headers that must be exported in
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 57f52cdce32e..9ba04c0bab8d 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -2387,7 +2387,7 @@ broadcast: Like active-backup, there is not much advantage to this
         and packet type ID), so in a "gatewayed" configuration, all
         outgoing traffic will generally use the same device.  Incoming
         traffic may also end up on a single device, but that is
-        dependent upon the balancing policy of the peer's 8023.ad
+        dependent upon the balancing policy of the peer's 802.3ad
         implementation.  In a "local" configuration, traffic will be
         distributed across the devices in the bond.
 
diff --git a/Documentation/process/index.rst b/Documentation/process/index.rst
index 82fc399fcd33..61e43cc3ed17 100644
--- a/Documentation/process/index.rst
+++ b/Documentation/process/index.rst
@@ -25,6 +25,7 @@ Below are the essential guides that every developer should read.
    submitting-patches
    coding-style
    email-clients
+   kernel-enforcement-statement
 
 Other guides to the community that are of interest to most developers are: 
 
diff --git a/Documentation/process/kernel-enforcement-statement.rst b/Documentation/process/kernel-enforcement-statement.rst
new file mode 100644
index 000000000000..1e23d4227337
--- /dev/null
+++ b/Documentation/process/kernel-enforcement-statement.rst
@@ -0,0 +1,147 @@
+Linux Kernel Enforcement Statement
+----------------------------------
+
+As developers of the Linux kernel, we have a keen interest in how our software
+is used and how the license for our software is enforced.  Compliance with the
+reciprocal sharing obligations of GPL-2.0 is critical to the long-term
+sustainability of our software and community.
+
+Although there is a right to enforce the separate copyright interests in the
+contributions made to our community, we share an interest in ensuring that
+individual enforcement actions are conducted in a manner that benefits our
+community and do not have an unintended negative impact on the health and
+growth of our software ecosystem.  In order to deter unhelpful enforcement
+actions, we agree that it is in the best interests of our development
+community to undertake the following commitment to users of the Linux kernel
+on behalf of ourselves and any successors to our copyright interests:
+
+    Notwithstanding the termination provisions of the GPL-2.0, we agree that
+    it is in the best interests of our development community to adopt the
+    following provisions of GPL-3.0 as additional permissions under our
+    license with respect to any non-defensive assertion of rights under the
+    license.
+
+        However, if you cease all violation of this License, then your license
+        from a particular copyright holder is reinstated (a) provisionally,
+        unless and until the copyright holder explicitly and finally
+        terminates your license, and (b) permanently, if the copyright holder
+        fails to notify you of the violation by some reasonable means prior to
+        60 days after the cessation.
+
+        Moreover, your license from a particular copyright holder is
+        reinstated permanently if the copyright holder notifies you of the
+        violation by some reasonable means, this is the first time you have
+        received notice of violation of this License (for any work) from that
+        copyright holder, and you cure the violation prior to 30 days after
+        your receipt of the notice.
+
+Our intent in providing these assurances is to encourage more use of the
+software.  We want companies and individuals to use, modify and distribute
+this software.  We want to work with users in an open and transparent way to
+eliminate any uncertainty about our expectations regarding compliance or
+enforcement that might limit adoption of our software.  We view legal action
+as a last resort, to be initiated only when other community efforts have
+failed to resolve the problem.
+
+Finally, once a non-compliance issue is resolved, we hope the user will feel
+welcome to join us in our efforts on this project.  Working together, we will
+be stronger.
+
+Except where noted below, we speak only for ourselves, and not for any company
+we might work for today, have in the past, or will in the future.
+
+  - Bjorn Andersson (Linaro)
+  - Andrea Arcangeli (Red Hat)
+  - Neil Armstrong
+  - Jens Axboe
+  - Pablo Neira Ayuso
+  - Khalid Aziz
+  - Ralf Baechle
+  - Felipe Balbi
+  - Arnd Bergmann
+  - Ard Biesheuvel
+  - Paolo Bonzini (Red Hat)
+  - Christian Borntraeger
+  - Mark Brown (Linaro)
+  - Paul Burton
+  - Javier Martinez Canillas
+  - Rob Clark
+  - Jonathan Corbet
+  - Vivien Didelot (Savoir-faire Linux)
+  - Hans de Goede (Red Hat)
+  - Mel Gorman (SUSE)
+  - Sven Eckelmann
+  - Alex Elder (Linaro)
+  - Fabio Estevam
+  - Larry Finger
+  - Bhumika Goyal
+  - Andy Gross
+  - Juergen Gross
+  - Shawn Guo
+  - Ulf Hansson
+  - Tejun Heo
+  - Rob Herring
+  - Masami Hiramatsu
+  - Michal Hocko
+  - Simon Horman
+  - Johan Hovold (Hovold Consulting AB)
+  - Christophe JAILLET
+  - Olof Johansson
+  - Lee Jones (Linaro)
+  - Heiner Kallweit
+  - Srinivas Kandagatla
+  - Jan Kara
+  - Shuah Khan (Samsung)
+  - David Kershner
+  - Jaegeuk Kim
+  - Namhyung Kim
+  - Colin Ian King
+  - Jeff Kirsher
+  - Greg Kroah-Hartman (Linux Foundation)
+  - Christian König
+  - Vinod Koul
+  - Krzysztof Kozlowski
+  - Viresh Kumar
+  - Aneesh Kumar K.V
+  - Julia Lawall
+  - Doug Ledford (Red Hat)
+  - Chuck Lever (Oracle)
+  - Daniel Lezcano
+  - Shaohua Li
+  - Xin Long (Red Hat)
+  - Tony Luck
+  - Mike Marshall
+  - Chris Mason
+  - Paul E. McKenney
+  - David S. Miller
+  - Ingo Molnar
+  - Kuninori Morimoto
+  - Borislav Petkov
+  - Jiri Pirko
+  - Josh Poimboeuf
+  - Sebastian Reichel (Collabora)
+  - Guenter Roeck
+  - Joerg Roedel
+  - Leon Romanovsky
+  - Steven Rostedt (VMware)
+  - Ivan Safonov
+  - Ivan Safonov
+  - Anna Schumaker
+  - Jes Sorensen
+  - K.Y. Srinivasan
+  - Heiko Stuebner
+  - Jiri Kosina (SUSE)
+  - Dmitry Torokhov
+  - Linus Torvalds
+  - Thierry Reding
+  - Rik van Riel
+  - Geert Uytterhoeven (Glider bvba)
+  - Daniel Vetter
+  - Linus Walleij
+  - Richard Weinberger
+  - Dan Williams
+  - Rafael J. Wysocki
+  - Arvind Yadav
+  - Masahiro Yamada
+  - Wei Yongjun
+  - Lv Zheng
diff --git a/MAINTAINERS b/MAINTAINERS
index 6671f375f7fc..bf1d20695cbf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5259,7 +5259,8 @@ S:	Maintained
 F:      drivers/iommu/exynos-iommu.c
 
 EZchip NPS platform support
-M:      Noam Camus <noamc@ezchip.com>
+M:      Elad Kanfi <eladkan@mellanox.com>
+M:      Vineet Gupta <vgupta@synopsys.com>
 S:      Supported
 F:      arch/arc/plat-eznps
 F:      arch/arc/boot/dts/eznps.dts
@@ -5345,9 +5346,7 @@ M:	"J. Bruce Fields" <bfields@fieldses.org>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      include/linux/fcntl.h
-F:      include/linux/fs.h
 F:      include/uapi/linux/fcntl.h
-F:      include/uapi/linux/fs.h
 F:      fs/fcntl.c
 F:      fs/locks.c
 
@@ -5356,6 +5355,8 @@ M:	Alexander Viro <viro@zeniv.linux.org.uk>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      fs/*
+F:      include/linux/fs.h
+F:      include/uapi/linux/fs.h
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:      Riku Voipio <riku.voipio@iki.fi>
@@ -6670,7 +6671,7 @@ F:	include/net/ieee802154_netdev.h
 F:      Documentation/networking/ieee802154.txt
 
 IFE PROTOCOL
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      Yotam Gigi <yotam.gi@gmail.com>
 M:      Jamal Hadi Salim <jhs@mojatatu.com>
 F:      net/ife
 F:      include/net/ife.h
@@ -6738,7 +6739,7 @@ F:	Documentation/devicetree/bindings/auxdisplay/img-ascii-lcd.txt
 F:      drivers/auxdisplay/img-ascii-lcd.c
 
 IMGTEC IR DECODER DRIVER
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 S:      Maintained
 F:      drivers/media/rc/img-ir/
 
@@ -7562,7 +7563,7 @@ F:	arch/arm64/include/asm/kvm*
 F:      arch/arm64/kvm/
 
 KERNEL VIRTUAL MACHINE FOR MIPS (KVM/mips)
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 L:      linux-mips@linux-mips.org
 S:      Supported
 F:      arch/mips/include/uapi/asm/kvm*
@@ -7570,7 +7571,7 @@ F:	arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
 
 KERNEL VIRTUAL MACHINE FOR POWERPC (KVM/powerpc)
-M:      Alexander Graf <agraf@suse.com>
+M:      Paul Mackerras <paulus@ozlabs.org>
 L:      kvm-ppc@vger.kernel.org
 W:      http://www.linux-kvm.org/
 T:      git git://github.com/agraf/linux-2.6.git
@@ -8264,6 +8265,12 @@ L:	libertas-dev@lists.infradead.org
 S:      Orphan
 F:      drivers/net/wireless/marvell/libertas/
 
+MARVELL MACCHIATOBIN SUPPORT
+M:      Russell King <rmk@armlinux.org.uk>
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts
+
 MARVELL MV643XX ETHERNET DRIVER
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      netdev@vger.kernel.org
@@ -8597,6 +8604,12 @@ M:	Sean Wang <sean.wang@mediatek.com>
 S:      Maintained
 F:      drivers/media/rc/mtk-cir.c
 
+MEDIATEK PMIC LED DRIVER
+M:      Sean Wang <sean.wang@mediatek.com>
+S:      Maintained
+F:      drivers/leds/leds-mt6323.c
+F:      Documentation/devicetree/bindings/leds/leds-mt6323.txt
+
 MEDIATEK ETHERNET DRIVER
 M:      Felix Fietkau <nbd@openwrt.org>
 M:      John Crispin <john@phrozen.org>
@@ -8730,7 +8743,7 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlxsw/
 
 MELLANOX FIRMWARE FLASH LIBRARY (mlxfw)
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      mlxsw@mellanox.com
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
@@ -8879,7 +8892,7 @@ F:	Documentation/devicetree/bindings/media/meson-ao-cec.txt
 T:      git git://linuxtv.org/media_tree.git
 
 METAG ARCHITECTURE
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 L:      linux-metag@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag.git
 S:      Odd Fixes
@@ -9200,7 +9213,6 @@ F:	include/linux/isicom.h
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
 M:      Bin Liu <b-liu@ti.com>
 L:      linux-usb@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb.git
 S:      Maintained
 F:      drivers/usb/musb/
 
@@ -9348,7 +9360,7 @@ NETWORK BLOCK DEVICE (NBD)
 M:      Josef Bacik <jbacik@fb.com>
 S:      Maintained
 L:      linux-block@vger.kernel.org
-L:      nbd-general@lists.sourceforge.net
+L:      nbd@other.debian.org
 F:      Documentation/blockdev/nbd.txt
 F:      drivers/block/nbd.c
 F:      include/uapi/linux/nbd.h
@@ -10167,7 +10179,6 @@ F:	Documentation/parport*.txt
 
 PARAVIRT_OPS INTERFACE
 M:      Juergen Gross <jgross@suse.com>
-M:      Chris Wright <chrisw@sous-sol.org>
 M:      Alok Kataria <akataria@vmware.com>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 L:      virtualization@lists.linux-foundation.org
@@ -10547,6 +10558,8 @@ M:	Peter Zijlstra <peterz@infradead.org>
 M:      Ingo Molnar <mingo@redhat.com>
 M:      Arnaldo Carvalho de Melo <acme@kernel.org>
 R:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
+R:      Jiri Olsa <jolsa@redhat.com>
+R:      Namhyung Kim <namhyung@kernel.org>
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git perf/core
 S:      Supported
@@ -10877,7 +10890,7 @@ S:	Maintained
 F:      drivers/block/ps3vram.c
 
 PSAMPLE PACKET SAMPLING SUPPORT:
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      Yotam Gigi <yotam.gi@gmail.com>
 S:      Maintained
 F:      net/psample
 F:      include/net/psample.h
@@ -12925,9 +12938,9 @@ F:	drivers/mmc/host/dw_mmc*
 SYNOPSYS HSDK RESET CONTROLLER DRIVER
 M:      Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
 S:      Supported
-F:      drivers/reset/reset-hsdk-v1.c
-F:      include/dt-bindings/reset/snps,hsdk-v1-reset.h
-F:      Documentation/devicetree/bindings/reset/snps,hsdk-v1-reset.txt
+F:      drivers/reset/reset-hsdk.c
+F:      include/dt-bindings/reset/snps,hsdk-reset.h
+F:      Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
 
 SYSTEM CONFIGURATION (SYSCON)
 M:      Lee Jones <lee.jones@linaro.org>
diff --git a/Makefile b/Makefile
index d1119941261c..5f91a28a3cea 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc7
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -130,8 +130,8 @@ endif
 ifneq ($(KBUILD_OUTPUT),)
 # check that the output directory actually exists
 saved-output := $(KBUILD_OUTPUT)
-$(shell [ -d $(KBUILD_OUTPUT) ] || mkdir -p $(KBUILD_OUTPUT))
-KBUILD_OUTPUT := $(realpath $(KBUILD_OUTPUT))
+KBUILD_OUTPUT := $(shell mkdir -p $(KBUILD_OUTPUT) && cd $(KBUILD_OUTPUT) \
+                                                                && /bin/pwd)
 $(if $(KBUILD_OUTPUT),, \
      $(error failed to create output directory "$(saved-output)"))
 
@@ -697,11 +697,11 @@ KBUILD_CFLAGS += $(stackp-flag)
 
 ifeq ($(cc-name),clang)
 ifneq ($(CROSS_COMPILE),)
-CLANG_TARGET    := -target $(notdir $(CROSS_COMPILE:%-=%))
+CLANG_TARGET    := --target=$(notdir $(CROSS_COMPILE:%-=%))
 GCC_TOOLCHAIN   := $(realpath $(dir $(shell which $(LD)))/..)
 endif
 ifneq ($(GCC_TOOLCHAIN),)
-CLANG_GCC_TC    := -gcc-toolchain $(GCC_TOOLCHAIN)
+CLANG_GCC_TC    := --gcc-toolchain=$(GCC_TOOLCHAIN)
 endif
 KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
 KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
@@ -933,7 +933,11 @@ ifdef CONFIG_STACK_VALIDATION
   ifeq ($(has_libelf),1)
     objtool_target := tools/objtool FORCE
   else
-    $(warning "Cannot use CONFIG_STACK_VALIDATION, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    ifdef CONFIG_ORC_UNWINDER
+      $(error "Cannot generate ORC metadata for CONFIG_ORC_UNWINDER=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    else
+      $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+    endif
     SKIP_STACK_VALIDATION := 1
     export SKIP_STACK_VALIDATION
   endif
@@ -1172,11 +1176,11 @@ headers_check: headers_install
 
 PHONY += kselftest
 kselftest:
-        $(Q)$(MAKE) -C tools/testing/selftests run_tests
+        $(Q)$(MAKE) -C $(srctree)/tools/testing/selftests run_tests
 
 PHONY += kselftest-clean
 kselftest-clean:
-        $(Q)$(MAKE) -C tools/testing/selftests clean
+        $(Q)$(MAKE) -C $(srctree)/tools/testing/selftests clean
 
 PHONY += kselftest-merge
 kselftest-merge:
@@ -1395,7 +1399,7 @@ help:
         @echo  '                    Build, install, and boot kernel before'
         @echo  '                    running kselftest on it'
         @echo  '  kselftest-clean - Remove all generated kselftest files'
-        @echo  '  kselftest-merge - Merge all the config dependencies of kselftest to existed'
+        @echo  '  kselftest-merge - Merge all the config dependencies of kselftest to existing'
         @echo  '                    .config.'
         @echo  ''
         @echo 'Userspace tools targets:'
diff --git a/arch/Kconfig b/arch/Kconfig
index 1aafb4efbb51..d789a89cb32c 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -937,9 +937,6 @@ config STRICT_MODULE_RWX
           and non-text memory will be made non-executable. This provides
           protection against certain security exploits (e.g. writing to text)
 
-config ARCH_WANT_RELAX_ORDER
-        bool
-
 config ARCH_HAS_REFCOUNT
         bool
         help
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index 384bd47b5187..45c020a0fe76 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -8,6 +8,7 @@
  */
 
 #include <linux/mm_types.h>
+#include <linux/sched.h>
 
 #include <asm/machvec.h>
 #include <asm/compiler.h>
diff --git a/arch/alpha/kernel/sys_alcor.c b/arch/alpha/kernel/sys_alcor.c
index 118dc6af1805..7ad074fd5ab5 100644
--- a/arch/alpha/kernel/sys_alcor.c
+++ b/arch/alpha/kernel/sys_alcor.c
@@ -181,10 +181,10 @@ alcor_init_irq(void)
  * comes in on.  This makes interrupt processing much easier.
  */
 
-static int __init
+static int
 alcor_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[7][5] __initdata = {
+        static char irq_tab[7][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 /* note: IDSEL 17 is XLT only */
                 {16+13, 16+13, 16+13, 16+13, 16+13},    /* IdSel 17,  TULIP  */
diff --git a/arch/alpha/kernel/sys_cabriolet.c b/arch/alpha/kernel/sys_cabriolet.c
index 4c50f8f40cbb..c0fa1fe5ce77 100644
--- a/arch/alpha/kernel/sys_cabriolet.c
+++ b/arch/alpha/kernel/sys_cabriolet.c
@@ -173,10 +173,10 @@ pc164_init_irq(void)
  * because it is the Saturn IO (SIO) PCI/ISA Bridge Chip.
  */
 
-static inline int __init
+static inline int
 eb66p_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[5][5] __initdata = {
+        static char irq_tab[5][5] = {
                 /*INT  INTA  INTB  INTC   INTD */
                 {16+0, 16+0, 16+5,  16+9, 16+13},  /* IdSel 6,  slot 0, J25 */
                 {16+1, 16+1, 16+6, 16+10, 16+14},  /* IdSel 7,  slot 1, J26 */
@@ -203,10 +203,10 @@ eb66p_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
  * because it is the Saturn IO (SIO) PCI/ISA Bridge Chip.
  */
 
-static inline int __init
+static inline int
 cabriolet_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[5][5] __initdata = {
+        static char irq_tab[5][5] = {
                 /*INT   INTA  INTB  INTC   INTD */
                 { 16+2, 16+2, 16+7, 16+11, 16+15}, /* IdSel 5,  slot 2, J21 */
                 { 16+0, 16+0, 16+5,  16+9, 16+13}, /* IdSel 6,  slot 0, J19 */
@@ -287,10 +287,10 @@ cia_cab_init_pci(void)
  * 
  */
 
-static inline int __init
+static inline int
 alphapc164_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[7][5] __initdata = {
+        static char irq_tab[7][5] = {
                 /*INT   INTA  INTB   INTC   INTD */
                 { 16+2, 16+2, 16+9,  16+13, 16+17}, /* IdSel  5, slot 2, J20 */
                 { 16+0, 16+0, 16+7,  16+11, 16+15}, /* IdSel  6, slot 0, J29 */
diff --git a/arch/alpha/kernel/sys_dp264.c b/arch/alpha/kernel/sys_dp264.c
index 6c35159bc00e..9e1e40ea1d14 100644
--- a/arch/alpha/kernel/sys_dp264.c
+++ b/arch/alpha/kernel/sys_dp264.c
@@ -356,7 +356,7 @@ clipper_init_irq(void)
  *  10   64 bit PCI option slot 3 (not bus 0)
  */
 
-static int __init
+static int
 isa_irq_fixup(const struct pci_dev *dev, int irq)
 {
         u8 irq8;
@@ -372,10 +372,10 @@ isa_irq_fixup(const struct pci_dev *dev, int irq)
         return irq8 & 0xf;
 }
 
-static int __init
+static int
 dp264_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[6][5] __initdata = {
+        static char irq_tab[6][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {    -1,    -1,    -1,    -1,    -1}, /* IdSel 5 ISA Bridge */
                 { 16+ 3, 16+ 3, 16+ 2, 16+ 2, 16+ 2}, /* IdSel 6 SCSI builtin*/
@@ -394,10 +394,10 @@ dp264_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return isa_irq_fixup(dev, irq);
 }
 
-static int __init
+static int
 monet_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[13][5] __initdata = {
+        static char irq_tab[13][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {    45,    45,    45,    45,    45}, /* IdSel 3 21143 PCI1 */
                 {    -1,    -1,    -1,    -1,    -1}, /* IdSel 4 unused */
@@ -423,7 +423,7 @@ monet_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return isa_irq_fixup(dev, COMMON_TABLE_LOOKUP);
 }
 
-static u8 __init
+static u8
 monet_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         struct pci_controller *hose = dev->sysdata;
@@ -456,10 +456,10 @@ monet_swizzle(struct pci_dev *dev, u8 *pinp)
         return slot;
 }
 
-static int __init
+static int
 webbrick_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[13][5] __initdata = {
+        static char irq_tab[13][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {    -1,    -1,    -1,    -1,    -1}, /* IdSel 7 ISA Bridge */
                 {    -1,    -1,    -1,    -1,    -1}, /* IdSel 8 unused */
@@ -478,10 +478,10 @@ webbrick_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return isa_irq_fixup(dev, COMMON_TABLE_LOOKUP);
 }
 
-static int __init
+static int
 clipper_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[7][5] __initdata = {
+        static char irq_tab[7][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 { 16+ 8, 16+ 8, 16+ 9, 16+10, 16+11}, /* IdSel 1 slot 1 */
                 { 16+12, 16+12, 16+13, 16+14, 16+15}, /* IdSel 2 slot 2 */
diff --git a/arch/alpha/kernel/sys_eb64p.c b/arch/alpha/kernel/sys_eb64p.c
index ad40a425e841..372661c56537 100644
--- a/arch/alpha/kernel/sys_eb64p.c
+++ b/arch/alpha/kernel/sys_eb64p.c
@@ -167,10 +167,10 @@ eb64p_init_irq(void)
  * comes in on.  This makes interrupt processing much easier.
  */
 
-static int __init
+static int
 eb64p_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[5][5] __initdata = {
+        static char irq_tab[5][5] = {
                 /*INT  INTA  INTB  INTC   INTD */
                 {16+7, 16+7, 16+7, 16+7,  16+7},  /* IdSel 5,  slot ?, ?? */
                 {16+0, 16+0, 16+2, 16+4,  16+9},  /* IdSel 6,  slot ?, ?? */
diff --git a/arch/alpha/kernel/sys_eiger.c b/arch/alpha/kernel/sys_eiger.c
index 15f42083bdb3..2731738b5872 100644
--- a/arch/alpha/kernel/sys_eiger.c
+++ b/arch/alpha/kernel/sys_eiger.c
@@ -141,7 +141,7 @@ eiger_init_irq(void)
         }
 }
 
-static int __init
+static int
 eiger_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         u8 irq_orig;
@@ -158,7 +158,7 @@ eiger_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return irq_orig - 0x80;
 }
 
-static u8 __init
+static u8
 eiger_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         struct pci_controller *hose = dev->sysdata;
diff --git a/arch/alpha/kernel/sys_miata.c b/arch/alpha/kernel/sys_miata.c
index d5b9776a608d..731d693fa1f9 100644
--- a/arch/alpha/kernel/sys_miata.c
+++ b/arch/alpha/kernel/sys_miata.c
@@ -149,10 +149,10 @@ miata_init_irq(void)
  * comes in on.  This makes interrupt processing much easier.
  */
 
-static int __init
+static int
 miata_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[18][5] __initdata = {
+        static char irq_tab[18][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {16+ 8, 16+ 8, 16+ 8, 16+ 8, 16+ 8},  /* IdSel 14,  DC21142 */
                 {   -1,    -1,    -1,    -1,    -1},  /* IdSel 15,  EIDE    */
@@ -196,7 +196,7 @@ miata_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return COMMON_TABLE_LOOKUP;
 }
 
-static u8 __init
+static u8
 miata_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         int slot, pin = *pinp;
diff --git a/arch/alpha/kernel/sys_mikasa.c b/arch/alpha/kernel/sys_mikasa.c
index 5e82dc1ad6f2..350ec9c8335b 100644
--- a/arch/alpha/kernel/sys_mikasa.c
+++ b/arch/alpha/kernel/sys_mikasa.c
@@ -145,10 +145,10 @@ mikasa_init_irq(void)
  * comes in on.  This makes interrupt processing much easier.
  */
 
-static int __init
+static int
 mikasa_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[8][5] __initdata = {
+        static char irq_tab[8][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {16+12, 16+12, 16+12, 16+12, 16+12},    /* IdSel 17,  SCSI */
                 {   -1,    -1,    -1,    -1,    -1},    /* IdSel 18,  PCEB */
diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
index 8ae04a121186..d019e4ce07bd 100644
--- a/arch/alpha/kernel/sys_nautilus.c
+++ b/arch/alpha/kernel/sys_nautilus.c
@@ -62,7 +62,7 @@ nautilus_init_irq(void)
         common_init_isa_dma();
 }
 
-static int __init
+static int
 nautilus_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         /* Preserve the IRQ set up by the console.  */
diff --git a/arch/alpha/kernel/sys_noritake.c b/arch/alpha/kernel/sys_noritake.c
index 063e594fd969..2301678d9f9d 100644
--- a/arch/alpha/kernel/sys_noritake.c
+++ b/arch/alpha/kernel/sys_noritake.c
@@ -193,10 +193,10 @@ noritake_init_irq(void)
  * comes in on.  This makes interrupt processing much easier.
  */
 
-static int __init
+static int
 noritake_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[15][5] __initdata = {
+        static char irq_tab[15][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 /* note: IDSELs 16, 17, and 25 are CORELLE only */
                 { 16+1,  16+1,  16+1,  16+1,  16+1},  /* IdSel 16,  QLOGIC */
@@ -221,7 +221,7 @@ noritake_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return COMMON_TABLE_LOOKUP;
 }
 
-static u8 __init
+static u8
 noritake_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         int slot, pin = *pinp;
diff --git a/arch/alpha/kernel/sys_rawhide.c b/arch/alpha/kernel/sys_rawhide.c
index dfd510ae5d8c..546822d07dc7 100644
--- a/arch/alpha/kernel/sys_rawhide.c
+++ b/arch/alpha/kernel/sys_rawhide.c
@@ -221,10 +221,10 @@ rawhide_init_irq(void)
  * 
  */
 
-static int __init
+static int
 rawhide_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[5][5] __initdata = {
+        static char irq_tab[5][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 { 16+16, 16+16, 16+16, 16+16, 16+16}, /* IdSel 1 SCSI PCI 1 */
                 { 16+ 0, 16+ 0, 16+ 1, 16+ 2, 16+ 3}, /* IdSel 2 slot 2 */
diff --git a/arch/alpha/kernel/sys_ruffian.c b/arch/alpha/kernel/sys_ruffian.c
index a3f485257170..3b35e1913492 100644
--- a/arch/alpha/kernel/sys_ruffian.c
+++ b/arch/alpha/kernel/sys_ruffian.c
@@ -117,10 +117,10 @@ ruffian_kill_arch (int mode)
  *
  */
 
-static int __init
+static int
 ruffian_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[11][5] __initdata = {
+        static char irq_tab[11][5] = {
               /*INT  INTA INTB INTC INTD */
                 {-1,  -1,  -1,  -1,  -1},  /* IdSel 13,  21052       */
                 {-1,  -1,  -1,  -1,  -1},  /* IdSel 14,  SIO         */
@@ -139,7 +139,7 @@ ruffian_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return COMMON_TABLE_LOOKUP;
 }
 
-static u8 __init
+static u8
 ruffian_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         int slot, pin = *pinp;
diff --git a/arch/alpha/kernel/sys_rx164.c b/arch/alpha/kernel/sys_rx164.c
index 08ee737d4fba..e178007107ef 100644
--- a/arch/alpha/kernel/sys_rx164.c
+++ b/arch/alpha/kernel/sys_rx164.c
@@ -142,7 +142,7 @@ rx164_init_irq(void)
  * 
  */
 
-static int __init
+static int
 rx164_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
 #if 0
@@ -156,7 +156,7 @@ rx164_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
           { 16+1, 16+1, 16+6, 16+11, 16+16},      /* IdSel 10, slot 4 */
         };
 #else
-        static char irq_tab[6][5] __initdata = {
+        static char irq_tab[6][5] = {
           /*INT   INTA  INTB  INTC   INTD */
           { 16+0, 16+0, 16+6, 16+11, 16+16},      /* IdSel 5,  slot 0 */
           { 16+1, 16+1, 16+7, 16+12, 16+17},      /* IdSel 6,  slot 1 */
diff --git a/arch/alpha/kernel/sys_sable.c b/arch/alpha/kernel/sys_sable.c
index 8a0aa6d67b53..86d259c2612d 100644
--- a/arch/alpha/kernel/sys_sable.c
+++ b/arch/alpha/kernel/sys_sable.c
@@ -192,10 +192,10 @@ sable_init_irq(void)
  * with the values in the irq swizzling tables above.
  */
 
-static int __init
+static int
 sable_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[9][5] __initdata = {
+        static char irq_tab[9][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 { 32+0,  32+0,  32+0,  32+0,  32+0},  /* IdSel 0,  TULIP  */
                 { 32+1,  32+1,  32+1,  32+1,  32+1},  /* IdSel 1,  SCSI   */
@@ -374,10 +374,10 @@ lynx_init_irq(void)
  * with the values in the irq swizzling tables above.
  */
 
-static int __init
+static int
 lynx_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[19][5] __initdata = {
+        static char irq_tab[19][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 {   -1,    -1,    -1,    -1,    -1},  /* IdSel 13,  PCEB   */
                 {   -1,    -1,    -1,    -1,    -1},  /* IdSel 14,  PPB    */
@@ -404,7 +404,7 @@ lynx_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return COMMON_TABLE_LOOKUP;
 }
 
-static u8 __init
+static u8
 lynx_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         int slot, pin = *pinp;
diff --git a/arch/alpha/kernel/sys_sio.c b/arch/alpha/kernel/sys_sio.c
index febd24eba7a6..9fd2895639d5 100644
--- a/arch/alpha/kernel/sys_sio.c
+++ b/arch/alpha/kernel/sys_sio.c
@@ -144,7 +144,7 @@ sio_fixup_irq_levels(unsigned int level_bits)
         outb((level_bits >> 8) & 0xff, 0x4d1);
 }
 
-static inline int __init
+static inline int
 noname_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         /*
@@ -165,7 +165,7 @@ noname_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
          * that they use the default INTA line, if they are interrupt
          * driven at all).
          */
-        static char irq_tab[][5] __initdata = {
+        static char irq_tab[][5] = {
                 /*INT A   B   C   D */
                 { 3,  3,  3,  3,  3}, /* idsel  6 (53c810) */ 
                 {-1, -1, -1, -1, -1}, /* idsel  7 (SIO: PCI/ISA bridge) */
@@ -183,10 +183,10 @@ noname_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return irq >= 0 ? tmp : -1;
 }
 
-static inline int __init
+static inline int
 p2k_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[][5] __initdata = {
+        static char irq_tab[][5] = {
                 /*INT A   B   C   D */
                 { 0,  0, -1, -1, -1}, /* idsel  6 (53c810) */
                 {-1, -1, -1, -1, -1}, /* idsel  7 (SIO: PCI/ISA bridge) */
diff --git a/arch/alpha/kernel/sys_sx164.c b/arch/alpha/kernel/sys_sx164.c
index d063b360efed..23eee54d714a 100644
--- a/arch/alpha/kernel/sys_sx164.c
+++ b/arch/alpha/kernel/sys_sx164.c
@@ -94,10 +94,10 @@ sx164_init_irq(void)
  *   9  32 bit PCI option slot 3
  */
 
-static int __init
+static int
 sx164_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[5][5] __initdata = {
+        static char irq_tab[5][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 { 16+ 9, 16+ 9, 16+13, 16+17, 16+21}, /* IdSel 5 slot 2 J17 */
                 { 16+11, 16+11, 16+15, 16+19, 16+23}, /* IdSel 6 slot 0 J19 */
diff --git a/arch/alpha/kernel/sys_takara.c b/arch/alpha/kernel/sys_takara.c
index dd0f1eae3c68..9101f2bb6176 100644
--- a/arch/alpha/kernel/sys_takara.c
+++ b/arch/alpha/kernel/sys_takara.c
@@ -155,10 +155,10 @@ takara_init_irq(void)
  * assign it whatever the hell IRQ we like and it doesn't matter.
  */
 
-static int __init
+static int
 takara_map_irq_srm(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[15][5] __initdata = {
+        static char irq_tab[15][5] = {
                 { 16+3, 16+3, 16+3, 16+3, 16+3},   /* slot  6 == device 3 */
                 { 16+2, 16+2, 16+2, 16+2, 16+2},   /* slot  7 == device 2 */
                 { 16+1, 16+1, 16+1, 16+1, 16+1},   /* slot  8 == device 1 */
@@ -210,7 +210,7 @@ takara_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         return COMMON_TABLE_LOOKUP;
 }
 
-static u8 __init
+static u8
 takara_swizzle(struct pci_dev *dev, u8 *pinp)
 {
         int slot = PCI_SLOT(dev->devfn);
diff --git a/arch/alpha/kernel/sys_wildfire.c b/arch/alpha/kernel/sys_wildfire.c
index ee1874887776..c3f8b79fe214 100644
--- a/arch/alpha/kernel/sys_wildfire.c
+++ b/arch/alpha/kernel/sys_wildfire.c
@@ -288,10 +288,10 @@ wildfire_device_interrupt(unsigned long vector)
  *   7   64 bit PCI 1 option slot 7
  */
 
-static int __init
+static int
 wildfire_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        static char irq_tab[8][5] __initdata = {
+        static char irq_tab[8][5] = {
                 /*INT    INTA   INTB   INTC   INTD */
                 { -1,    -1,    -1,    -1,    -1}, /* IdSel 0 ISA Bridge */
                 { 36,    36,    36+1, 36+2, 36+3}, /* IdSel 1 SCSI builtin */
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index a598641eed98..c84e67fdea09 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -24,7 +24,7 @@ config ARC
         select GENERIC_SMP_IDLE_THREAD
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
-        select HAVE_FUTEX_CMPXCHG
+        select HAVE_FUTEX_CMPXCHG if FUTEX
         select HAVE_IOREMAP_PROT
         select HAVE_KPROBES
         select HAVE_KRETPROBES
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 3a4b52b7e09d..d37f49d6a27f 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -6,8 +6,6 @@
 # published by the Free Software Foundation.
 #
 
-UTS_MACHINE := arc
-
 ifeq ($(CROSS_COMPILE),)
 ifndef CONFIG_CPU_BIG_ENDIAN
 CROSS_COMPILE := arc-linux-
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 2367a67c5f10..e114000a84f5 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -44,7 +44,14 @@
 
                         mmcclk: mmcclk {
                                 compatible = "fixed-clock";
-                                clock-frequency = <50000000>;
+                                /*
+                                 * DW sdio controller has external ciu clock divider
+                                 * controlled via register in SDIO IP. It divides
+                                 * sdio_ref_clk (which comes from CGU) by 16 for
+                                 * default. So default mmcclk clock (which comes
+                                 * to sdk_in) is 25000000 Hz.
+                                 */
+                                clock-frequency = <25000000>;
                                 #clock-cells = <0>;
                         };
 
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 229d13adbce4..8f627c200d60 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -12,6 +12,7 @@
 /dts-v1/;
 
 #include <dt-bindings/net/ti-dp83867.h>
+#include <dt-bindings/reset/snps,hsdk-reset.h>
 
 / {
         model = "snps,hsdk";
@@ -57,10 +58,10 @@
                 };
         };
 
-        core_clk: core-clk {
+        input_clk: input-clk {
                 #clock-cells = <0>;
                 compatible = "fixed-clock";
-                clock-frequency = <500000000>;
+                clock-frequency = <33333333>;
         };
 
         cpu_intc: cpu-interrupt-controller {
@@ -102,6 +103,19 @@
 
                 ranges = <0x00000000 0xf0000000 0x10000000>;
 
+                cgu_rst: reset-controller@8a0 {
+                        compatible = "snps,hsdk-reset";
+                        #reset-cells = <1>;
+                        reg = <0x8A0 0x4>, <0xFF0 0x4>;
+                };
+
+                core_clk: core-clk@0 {
+                        compatible = "snps,hsdk-core-pll-clock";
+                        reg = <0x00 0x10>, <0x14B8 0x4>;
+                        #clock-cells = <0>;
+                        clocks = <&input_clk>;
+                };
+
                 serial: serial@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
@@ -120,7 +134,18 @@
 
                 mmcclk_ciu: mmcclk-ciu {
                         compatible = "fixed-clock";
-                        clock-frequency = <100000000>;
+                        /*
+                         * DW sdio controller has external ciu clock divider
+                         * controlled via register in SDIO IP. Due to its
+                         * unexpected default value (it should divide by 1
+                         * but it divides by 8) SDIO IP uses wrong clock and
+                         * works unstable (see STAR 9001204800)
+                         * We switched to the minimum possible value of the
+                         * divisor (div-by-2) in HSDK platform code.
+                         * So add temporary fix and change clock frequency
+                         * to 50000000 Hz until we fix dw sdio driver itself.
+                         */
+                        clock-frequency = <50000000>;
                         #clock-cells = <0>;
                 };
 
@@ -141,6 +166,8 @@
                         clocks = <&gmacclk>;
                         clock-names = "stmmaceth";
                         phy-handle = <&phy0>;
+                        resets = <&cgu_rst HSDK_ETH_RESET>;
+                        reset-names = "stmmaceth";
 
                         mdio {
                                 #address-cells = <1>;
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index 6980b966a364..ec7c849a5c8e 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -105,7 +105,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index 2233f5777a71..63d3cf69e0b0 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -104,7 +104,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index 30a3d4cf53d2..f613ecac14a7 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -107,7 +107,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index 821a2e562f3f..3507be2af6fe 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -84,5 +84,5 @@ CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 9a3fcf446388..7b8f8faf8a24 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -72,7 +72,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index c0d6a010751a..4fcf4f2503f6 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -94,7 +94,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_SHIRQ=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index 5c0971787acf..7b71464f6c2f 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -98,7 +98,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_SHIRQ=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index ba8e802dba80..b1c56d35f2a9 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -98,6 +98,7 @@
 
 /* Auxiliary registers */
 #define AUX_IDENTITY            4
+#define AUX_EXEC_CTRL           8
 #define AUX_INTR_VEC_BASE       0x25
 #define AUX_VOL                 0x5e
 
@@ -135,12 +136,12 @@ struct bcr_identity {
 #endif
 };
 
-struct bcr_isa {
+struct bcr_isa_arcv2 {
 #ifdef CONFIG_CPU_BIG_ENDIAN
         unsigned int div_rem:4, pad2:4, ldd:1, unalign:1, atomic:1, be:1,
-                     pad1:11, atomic1:1, ver:8;
+                     pad1:12, ver:8;
 #else
-        unsigned int ver:8, atomic1:1, pad1:11, be:1, atomic:1, unalign:1,
+        unsigned int ver:8, pad1:12, be:1, atomic:1, unalign:1,
                      ldd:1, pad2:4, div_rem:4;
 #endif
 };
@@ -263,13 +264,13 @@ struct cpuinfo_arc {
         struct cpuinfo_arc_mmu mmu;
         struct cpuinfo_arc_bpu bpu;
         struct bcr_identity core;
-        struct bcr_isa isa;
+        struct bcr_isa_arcv2 isa;
         const char *details, *name;
         unsigned int vec_base;
         struct cpuinfo_arc_ccm iccm, dccm;
         struct {
                 unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
-                             fpu_sp:1, fpu_dp:1, pad2:6,
+                             fpu_sp:1, fpu_dp:1, dual_iss_enb:1, dual_iss_exist:1, pad2:4,
                              debug:1, ap:1, smart:1, rtt:1, pad3:4,
                              timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
         } extn;
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 877cec8f5ea2..fb83844daeea 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -51,6 +51,7 @@ static const struct id_to_str arc_cpu_rel[] = {
         { 0x51, "R2.0" },
         { 0x52, "R2.1" },
         { 0x53, "R3.0" },
+        { 0x54, "R4.0" },
 #endif
         { 0x00, NULL   }
 };
@@ -62,6 +63,7 @@ static const struct id_to_str arc_cpu_nm[] = {
 #else
         { 0x40, "ARC EM"  },
         { 0x50, "ARC HS38"  },
+        { 0x54, "ARC HS48"  },
 #endif
         { 0x00, "Unknown"   }
 };
@@ -119,11 +121,11 @@ static void read_arc_build_cfg_regs(void)
         struct bcr_generic bcr;
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
         const struct id_to_str *tbl;
+        struct bcr_isa_arcv2 isa;
 
         FIX_PTR(cpu);
 
         READ_BCR(AUX_IDENTITY, cpu->core);
-        READ_BCR(ARC_REG_ISA_CFG_BCR, cpu->isa);
 
         for (tbl = &arc_cpu_rel[0]; tbl->id != 0; tbl++) {
                 if (cpu->core.family == tbl->id) {
@@ -133,7 +135,7 @@ static void read_arc_build_cfg_regs(void)
         }
 
         for (tbl = &arc_cpu_nm[0]; tbl->id != 0; tbl++) {
-                if ((cpu->core.family & 0xF0) == tbl->id)
+                if ((cpu->core.family & 0xF4) == tbl->id)
                         break;
         }
         cpu->name = tbl->str;
@@ -192,6 +194,14 @@ static void read_arc_build_cfg_regs(void)
                 cpu->bpu.full = bpu.ft;
                 cpu->bpu.num_cache = 256 << bpu.bce;
                 cpu->bpu.num_pred = 2048 << bpu.pte;
+
+                if (cpu->core.family >= 0x54) {
+                        unsigned int exec_ctrl;
+
+                        READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+                        cpu->extn.dual_iss_exist = 1;
+                        cpu->extn.dual_iss_enb = exec_ctrl & 1;
+                }
         }
 
         READ_BCR(ARC_REG_AP_BCR, bcr);
@@ -205,18 +215,25 @@ static void read_arc_build_cfg_regs(void)
 
         cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
 
+        READ_BCR(ARC_REG_ISA_CFG_BCR, isa);
+
         /* some hacks for lack of feature BCR info in old ARC700 cores */
         if (is_isa_arcompact()) {
-                if (!cpu->isa.ver)      /* ISA BCR absent, use Kconfig info */
+                if (!isa.ver)   /* ISA BCR absent, use Kconfig info */
                         cpu->isa.atomic = IS_ENABLED(CONFIG_ARC_HAS_LLSC);
-                else
-                        cpu->isa.atomic = cpu->isa.atomic1;
+                else {
+                        /* ARC700_BUILD only has 2 bits of isa info */
+                        struct bcr_generic bcr = *(struct bcr_generic *)&isa;
+                        cpu->isa.atomic = bcr.info & 1;
+                }
 
                 cpu->isa.be = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN);
 
                  /* there's no direct way to distinguish 750 vs. 770 */
                 if (unlikely(cpu->core.family < 0x34 || cpu->mmu.ver < 3))
                         cpu->name = "ARC750";
+        } else {
+                cpu->isa = isa;
         }
 }
 
@@ -232,10 +249,11 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        "\nIDENTITY\t: ARCVER [%#02x] ARCNUM [%#02x] CHIPID [%#4x]\n",
                        core->family, core->cpu_id, core->chip_id);
 
-        n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s\n",
+        n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s%s%s\n",
                        cpu_id, cpu->name, cpu->details,
                        is_isa_arcompact() ? "ARCompact" : "ARCv2",
-                       IS_AVAIL1(cpu->isa.be, "[Big-Endian]"));
+                       IS_AVAIL1(cpu->isa.be, "[Big-Endian]"),
+                       IS_AVAIL3(cpu->extn.dual_iss_exist, cpu->extn.dual_iss_enb, " Dual-Issue"));
 
         n += scnprintf(buf + n, len - n, "Timers\t\t: %s%s%s%s%s%s\nISA Extn\t: ",
                        IS_AVAIL1(cpu->extn.timer0, "Timer0 "),
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index f46267153ec2..6df9d94a9537 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -23,6 +23,8 @@
 #include <linux/cpumask.h>
 #include <linux/reboot.h>
 #include <linux/irqdomain.h>
+#include <linux/export.h>
+
 #include <asm/processor.h>
 #include <asm/setup.h>
 #include <asm/mach_desc.h>
@@ -30,6 +32,9 @@
 #ifndef CONFIG_ARC_HAS_LLSC
 arch_spinlock_t smp_atomic_ops_lock = __ARCH_SPIN_LOCK_UNLOCKED;
 arch_spinlock_t smp_bitops_lock = __ARCH_SPIN_LOCK_UNLOCKED;
+
+EXPORT_SYMBOL_GPL(smp_atomic_ops_lock);
+EXPORT_SYMBOL_GPL(smp_bitops_lock);
 #endif
 
 struct plat_smp_ops  __weak plat_smp_ops;
diff --git a/arch/arc/plat-axs10x/axs10x.c b/arch/arc/plat-axs10x/axs10x.c
index f1ac6790da5f..cf14ebc36916 100644
--- a/arch/arc/plat-axs10x/axs10x.c
+++ b/arch/arc/plat-axs10x/axs10x.c
@@ -111,6 +111,13 @@ static void __init axs10x_early_init(void)
 
         axs10x_enable_gpio_intc_wire();
 
+        /*
+         * Reset ethernet IP core.
+         * TODO: get rid of this quirk after axs10x reset driver (or simple
+         * reset driver) will be available in upstream.
+         */
+        iowrite32((1 << 5), (void __iomem *) CREG_MB_SW_RESET);
+
         scnprintf(mb, 32, "MainBoard v%d", mb_rev);
         axs10x_print_board_ver(CREG_MB_VER, mb);
 }
diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
index 5a6ed5afb009..19ab3cf98f0f 100644
--- a/arch/arc/plat-hsdk/Kconfig
+++ b/arch/arc/plat-hsdk/Kconfig
@@ -6,4 +6,6 @@
 #
 
 menuconfig ARC_SOC_HSDK
-       bool "ARC HS Development Kit SOC"
+        bool "ARC HS Development Kit SOC"
+        select CLK_HSDK
+        select RESET_HSDK
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index a2e7fd17e36d..fd0ae5e38639 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -38,6 +38,46 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
 #define CREG_PAE                (CREG_BASE + 0x180)
 #define CREG_PAE_UPDATE         (CREG_BASE + 0x194)
 
+#define CREG_CORE_IF_CLK_DIV    (CREG_BASE + 0x4B8)
+#define CREG_CORE_IF_CLK_DIV_2  0x1
+#define CGU_BASE                ARC_PERIPHERAL_BASE
+#define CGU_PLL_STATUS          (ARC_PERIPHERAL_BASE + 0x4)
+#define CGU_PLL_CTRL            (ARC_PERIPHERAL_BASE + 0x0)
+#define CGU_PLL_STATUS_LOCK     BIT(0)
+#define CGU_PLL_STATUS_ERR      BIT(1)
+#define CGU_PLL_CTRL_1GHZ       0x3A10
+#define HSDK_PLL_LOCK_TIMEOUT   500
+
+#define HSDK_PLL_LOCKED() \
+        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_LOCK)
+
+#define HSDK_PLL_ERR() \
+        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_ERR)
+
+static void __init hsdk_set_cpu_freq_1ghz(void)
+{
+        u32 timeout = HSDK_PLL_LOCK_TIMEOUT;
+
+        /*
+         * As we set cpu clock which exceeds 500MHz, the divider for the interface
+         * clock must be programmed to div-by-2.
+         */
+        iowrite32(CREG_CORE_IF_CLK_DIV_2, (void __iomem *) CREG_CORE_IF_CLK_DIV);
+
+        /* Set cpu clock to 1GHz */
+        iowrite32(CGU_PLL_CTRL_1GHZ, (void __iomem *) CGU_PLL_CTRL);
+
+        while (!HSDK_PLL_LOCKED() && timeout--)
+                cpu_relax();
+
+        if (!HSDK_PLL_LOCKED() || HSDK_PLL_ERR())
+                pr_err("Failed to setup CPU frequency to 1GHz!");
+}
+
+#define SDIO_BASE               (ARC_PERIPHERAL_BASE + 0xA000)
+#define SDIO_UHS_REG_EXT        (SDIO_BASE + 0x108)
+#define SDIO_UHS_REG_EXT_DIV_2  (2 << 30)
+
 static void __init hsdk_init_early(void)
 {
         /*
@@ -52,6 +92,18 @@ static void __init hsdk_init_early(void)
 
         /* Really apply settings made above */
         writel(1, (void __iomem *) CREG_PAE_UPDATE);
+
+        /*
+         * Switch SDIO external ciu clock divider from default div-by-8 to
+         * minimum possible div-by-2.
+         */
+        iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT);
+
+        /*
+         * Setup CPU frequency to 1GHz.
+         * TODO: remove it after smart hsdk pll driver will be introduced.
+         */
+        hsdk_set_cpu_freq_1ghz();
 }
 
 static const char *hsdk_compat[] __initconst = {
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 47d3a1ab08d2..817e5cfef83a 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -131,7 +131,7 @@ endif
 KBUILD_CFLAGS   +=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
 KBUILD_AFLAGS   +=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
 
-CHECKFLAGS      += -D__arm__
+CHECKFLAGS      += -D__arm__ -m32
 
 #Default value
 head-y          := arch/arm/kernel/head$(MMUEXT).o
diff --git a/arch/arm/boot/compressed/debug.S b/arch/arm/boot/compressed/debug.S
index 5392ee63338f..8f6e37177de1 100644
--- a/arch/arm/boot/compressed/debug.S
+++ b/arch/arm/boot/compressed/debug.S
@@ -23,7 +23,11 @@ ENTRY(putc)
         strb    r0, [r1]
         mov     r0, #0x03               @ SYS_WRITEC
    ARM( svc     #0x123456       )
+#ifdef CONFIG_CPU_V7M
+ THUMB( bkpt    #0xab           )
+#else
  THUMB( svc     #0xab           )
+#endif
         mov     pc, lr
         .align  2
 1:      .word   _GLOBAL_OFFSET_TABLE_ - .
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 7d7ca054c557..e58fab8aec5d 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -36,6 +36,8 @@
                 phy1 = &usb1_phy;
                 ethernet0 = &cpsw_emac0;
                 ethernet1 = &cpsw_emac1;
+                spi0 = &spi0;
+                spi1 = &spi1;
         };
 
         cpus {
diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index 9d276af7c539..081fa68b6f98 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -388,6 +388,7 @@
         pinctrl-0 = <&cpsw_default>;
         pinctrl-1 = <&cpsw_sleep>;
         status = "okay";
+        slaves = <1>;
 };
 
 &davinci_mdio {
@@ -402,11 +403,6 @@
         phy-mode = "rmii";
 };
 
-&cpsw_emac1 {
-        phy_id = <&davinci_mdio>, <1>;
-        phy-mode = "rmii";
-};
-
 &phy_sel {
         rmii-clock-ext;
 };
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 7ff0811e61db..4960722aab32 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -178,7 +178,7 @@
                         };
 
                         i2c0: i2c@11000 {
-                                compatible = "marvell,mv64xxx-i2c";
+                                compatible = "marvell,mv78230-a0-i2c", "marvell,mv64xxx-i2c";
                                 reg = <0x11000 0x20>;
                                 #address-cells = <1>;
                                 #size-cells = <0>;
@@ -189,7 +189,7 @@
                         };
 
                         i2c1: i2c@11100 {
-                                compatible = "marvell,mv64xxx-i2c";
+                                compatible = "marvell,mv78230-a0-i2c", "marvell,mv64xxx-i2c";
                                 reg = <0x11100 0x20>;
                                 #address-cells = <1>;
                                 #size-cells = <0>;
diff --git a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
index 63a5af898165..cf0087b4c9e1 100644
--- a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
+++ b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
@@ -67,8 +67,8 @@
                                 pinctrl-0 = <&pinctrl_macb0_default>;
                                 phy-mode = "rmii";
 
-                                ethernet-phy@1 {
-                                        reg = <0x1>;
+                                ethernet-phy@0 {
+                                        reg = <0x0>;
                                         interrupt-parent = <&pioA>;
                                         interrupts = <PIN_PD31 IRQ_TYPE_LEVEL_LOW>;
                                         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
index 9c9088c99cc4..60cb084a8d92 100644
--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
@@ -67,7 +67,10 @@
 
                 usb1: ohci@00400000 {
                         num-ports = <3>;
-                        atmel,vbus-gpio = <&pioA PIN_PA10 GPIO_ACTIVE_HIGH>;
+                        atmel,vbus-gpio = <0 /* &pioA PIN_PD20 GPIO_ACTIVE_HIGH */
+                                           &pioA PIN_PA27 GPIO_ACTIVE_HIGH
+                                           0
+                                          >;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb_default>;
                         status = "okay";
@@ -120,7 +123,7 @@
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_mikrobus2_uart>;
                                 atmel,use-dma-rx;
-                                atmel-use-dma-tx;
+                                atmel,use-dma-tx;
                                 status = "okay";
                         };
 
@@ -178,7 +181,7 @@
                         uart4: serial@fc00c000 {
                                 atmel,use-dma-rx;
                                 atmel,use-dma-tx;
-                                pinctrl-name = "default";
+                                pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_mikrobus1_uart>;
                                 status = "okay";
                         };
@@ -330,7 +333,7 @@
                                 };
 
                                 pinctrl_led_gpio_default: led_gpio_default {
-                                        pinmux = <PIN_PA27__GPIO>,
+                                        pinmux = <PIN_PA10__GPIO>,
                                                  <PIN_PB1__GPIO>,
                                                  <PIN_PA31__GPIO>;
                                         bias-pull-up;
@@ -396,7 +399,7 @@
                                 };
 
                                 pinctrl_usb_default: usb_default {
-                                        pinmux = <PIN_PA10__GPIO>,
+                                        pinmux = <PIN_PA27__GPIO>,
                                                  <PIN_PD19__GPIO>;
                                         bias-disable;
                                 };
@@ -520,17 +523,17 @@
 
                 red {
                         label = "red";
-                        gpios = <&pioA PIN_PA27 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PA10 GPIO_ACTIVE_HIGH>;
                 };
 
                 green {
                         label = "green";
-                        gpios = <&pioA PIN_PB1 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PB1 GPIO_ACTIVE_HIGH>;
                 };
 
                 blue {
                         label = "blue";
-                        gpios = <&pioA PIN_PA31 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PA31 GPIO_ACTIVE_HIGH>;
                         linux,default-trigger = "heartbeat";
                 };
         };
diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
index c7e9ccf2bc87..cbc26001247b 100644
--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
@@ -309,7 +309,7 @@
                                 vddana-supply = <&vdd_3v3_lp_reg>;
                                 vref-supply = <&vdd_3v3_lp_reg>;
                                 pinctrl-names = "default";
-                                pinctrl-0 = <&pinctrl_adc_default>;
+                                pinctrl-0 = <&pinctrl_adc_default &pinctrl_adtrg_default>;
                                 status = "okay";
                         };
 
@@ -340,6 +340,20 @@
                                         bias-disable;
                                 };
 
+                                /*
+                                 * The ADTRG pin can work on any edge type.
+                                 * In here it's being pulled up, so need to
+                                 * connect it to ground to get an edge e.g.
+                                 * Trigger can be configured on falling, rise
+                                 * or any edge, and the pull-up can be changed
+                                 * to pull-down or left floating according to
+                                 * needs.
+                                 */
+                                pinctrl_adtrg_default: adtrg_default {
+                                        pinmux = <PIN_PD31__ADTRG>;
+                                        bias-pull-up;
+                                };
+
                                 pinctrl_charger_chglev: charger_chglev {
                                         pinmux = <PIN_PA12__GPIO>;
                                         bias-disable;
diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
index 82651c3eb682..b8565fc33eea 100644
--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
@@ -18,12 +18,9 @@
         compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
         model = "Raspberry Pi Zero W";
 
-        /* Needed by firmware to properly init UARTs */
-        aliases {
-                uart0 = "/soc/serial@7e201000";
-                uart1 = "/soc/serial@7e215040";
-                serial0 = "/soc/serial@7e201000";
-                serial1 = "/soc/serial@7e215040";
+        chosen {
+                /* 8250 auxiliary UART instead of pl011 */
+                stdout-path = "serial1:115200n8";
         };
 
         leds {
diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
index 20725ca487f3..c71a0d73d2a2 100644
--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
@@ -8,6 +8,11 @@
         compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
         model = "Raspberry Pi 3 Model B";
 
+        chosen {
+                /* 8250 auxiliary UART instead of pl011 */
+                stdout-path = "serial1:115200n8";
+        };
+
         memory {
                 reg = <0 0x40000000>;
         };
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 431dcfc900c0..013431e3d7c3 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -20,8 +20,13 @@
         #address-cells = <1>;
         #size-cells = <1>;
 
+        aliases {
+                serial0 = &uart0;
+                serial1 = &uart1;
+        };
+
         chosen {
-                bootargs = "earlyprintk console=ttyAMA0";
+                stdout-path = "serial0:115200n8";
         };
 
         thermal-zones {
diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
index 67e72bc72e80..c75507922f7d 100644
--- a/arch/arm/boot/dts/da850-evm.dts
+++ b/arch/arm/boot/dts/da850-evm.dts
@@ -15,6 +15,13 @@
         compatible = "ti,da850-evm", "ti,da850";
         model = "DA850/AM1808/OMAP-L138 EVM";
 
+        aliases {
+                serial0 = &serial0;
+                serial1 = &serial1;
+                serial2 = &serial2;
+                ethernet0 = &eth0;
+        };
+
         soc@1c00000 {
                 pmx_core: pinmux@14120 {
                         status = "okay";
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index cf229dfabf61..e62b62875cba 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -1817,6 +1817,8 @@
                 clocks = <&abe_24m_fclk>, <&abe_sys_clk_div>, <&func_24m_clk>, <&atl_clkin3_ck>, <&atl_clkin2_ck>, <&atl_clkin1_ck>, <&atl_clkin0_ck>, <&sys_clkin2>, <&ref_clkin0_ck>, <&ref_clkin1_ck>, <&ref_clkin2_ck>, <&ref_clkin3_ck>, <&mlb_clk>, <&mlbp_clk>;
                 ti,bit-shift = <24>;
                 reg = <0x1868>;
+                assigned-clocks = <&mcasp3_ahclkx_mux>;
+                assigned-clock-parents = <&abe_24m_fclk>;
         };
 
         mcasp3_aux_gfclk_mux: mcasp3_aux_gfclk_mux@1868 {
diff --git a/arch/arm/boot/dts/gemini.dtsi b/arch/arm/boot/dts/gemini.dtsi
index c68e8d430234..f0d178c77153 100644
--- a/arch/arm/boot/dts/gemini.dtsi
+++ b/arch/arm/boot/dts/gemini.dtsi
@@ -145,11 +145,12 @@
                 };
 
                 watchdog@41000000 {
-                        compatible = "cortina,gemini-watchdog";
+                        compatible = "cortina,gemini-watchdog", "faraday,ftwdt010";
                         reg = <0x41000000 0x1000>;
                         interrupts = <3 IRQ_TYPE_LEVEL_HIGH>;
                         resets = <&syscon GEMINI_RESET_WDOG>;
                         clocks = <&syscon GEMINI_CLK_APB>;
+                        clock-names = "PCLK";
                 };
 
                 uart0: serial@42000000 {
diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi
index f46814a7ea44..4d308d17f040 100644
--- a/arch/arm/boot/dts/imx7d.dtsi
+++ b/arch/arm/boot/dts/imx7d.dtsi
@@ -144,10 +144,10 @@
                 interrupt-names = "msi";
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0x7>;
-                interrupt-map = <0 0 0 1 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
-                                <0 0 0 2 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
-                                <0 0 0 3 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
-                                <0 0 0 4 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>;
+                interrupt-map = <0 0 0 1 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 2 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 3 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 0 4 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clks IMX7D_PCIE_CTRL_ROOT_CLK>,
                          <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>,
                          <&clks IMX7D_PCIE_PHY_ROOT_CLK>;
diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi
index 1f4c795d3f72..da7b3237bfe9 100644
--- a/arch/arm/boot/dts/moxart.dtsi
+++ b/arch/arm/boot/dts/moxart.dtsi
@@ -87,9 +87,10 @@
                 };
 
                 watchdog: watchdog@98500000 {
-                        compatible = "moxa,moxart-watchdog";
+                        compatible = "moxa,moxart-watchdog", "faraday,ftwdt010";
                         reg = <0x98500000 0x10>;
                         clocks = <&clk_apb>;
+                        clock-names = "PCLK";
                 };
 
                 sdhci: sdhci@98e00000 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 26c20e1167b9..4acd32a1c4ef 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -144,15 +144,6 @@
                 io-channel-names = "temp", "bsi", "vbat";
         };
 
-        rear_camera: camera@0 {
-                compatible = "linux,camera";
-
-                module {
-                        model = "TCM8341MD";
-                        sensor = <&cam1>;
-                };
-        };
-
         pwm9: dmtimer-pwm {
                 compatible = "ti,omap-dmtimer-pwm";
                 #pwm-cells = <3>;
@@ -189,10 +180,8 @@
                                 clock-lanes = <1>;
                                 data-lanes = <0>;
                                 lane-polarity = <0 0>;
-                                clock-inv = <0>;
                                 /* Select strobe = <1> for back camera, <0> for front camera */
                                 strobe = <1>;
-                                crc = <0>;
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index cb47ae79a5f9..1b0bd72945f2 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -267,15 +267,19 @@
         clock-frequency = <400000>;
 
         as3645a@30 {
+                #address-cells = <1>;
+                #size-cells = <0>;
                 reg = <0x30>;
                 compatible = "ams,as3645a";
-                flash {
+                flash@0 {
+                        reg = <0x0>;
                         flash-timeout-us = <150000>;
                         flash-max-microamp = <320000>;
                         led-max-microamp = <60000>;
-                        peak-current-limit = <1750000>;
+                        ams,input-max-microamp = <1750000>;
                 };
-                indicator {
+                indicator@1 {
+                        reg = <0x1>;
                         led-max-microamp = <10000>;
                 };
         };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 38d2216c7ead..b1a26b42d190 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -1430,6 +1430,7 @@
                                 atmel,min-sample-rate-hz = <200000>;
                                 atmel,max-sample-rate-hz = <20000000>;
                                 atmel,startup-time-ms = <4>;
+                                atmel,trigger-edge-type = <IRQ_TYPE_EDGE_RISING>;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/stm32429i-eval.dts b/arch/arm/boot/dts/stm32429i-eval.dts
index 97b1c2321ba9..293ecb957227 100644
--- a/arch/arm/boot/dts/stm32429i-eval.dts
+++ b/arch/arm/boot/dts/stm32429i-eval.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f429-pinctrl.dtsi"
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 
@@ -202,10 +203,8 @@
         stmpe1600: stmpe1600@42 {
                 compatible = "st,stmpe1600";
                 reg = <0x42>;
-                irq-gpio = <&gpioi 8 0>;
-                irq-trigger = <3>;
                 interrupts = <8 3>;
-                interrupt-parent = <&exti>;
+                interrupt-parent = <&gpioi>;
                 interrupt-controller;
                 wakeup-source;
 
diff --git a/arch/arm/boot/dts/stm32f4-pinctrl.dtsi b/arch/arm/boot/dts/stm32f4-pinctrl.dtsi
new file mode 100644
index 000000000000..7f3560c0211d
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f4-pinctrl.dtsi
@@ -0,0 +1,343 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <dt-bindings/pinctrl/stm32f429-pinfunc.h>
+#include <dt-bindings/mfd/stm32f4-rcc.h>
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        ranges = <0 0x40020000 0x3000>;
+                        interrupt-parent = <&exti>;
+                        st,syscfg = <&syscfg 0x8>;
+                        pins-are-numbered;
+
+                        gpioa: gpio@40020000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x0 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOA)>;
+                                st,bank-name = "GPIOA";
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOB)>;
+                                st,bank-name = "GPIOB";
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOC)>;
+                                st,bank-name = "GPIOC";
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0xc00 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOD)>;
+                                st,bank-name = "GPIOD";
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1000 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOE)>;
+                                st,bank-name = "GPIOE";
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOF)>;
+                                st,bank-name = "GPIOF";
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOG)>;
+                                st,bank-name = "GPIOG";
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1c00 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOH)>;
+                                st,bank-name = "GPIOH";
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2000 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOI)>;
+                                st,bank-name = "GPIOI";
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOJ)>;
+                                st,bank-name = "GPIOJ";
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOK)>;
+                                st,bank-name = "GPIOK";
+                        };
+
+                        usart1_pins_a: usart1@0 {
+                                pins1 {
+                                        pinmux = <STM32F429_PA9_FUNC_USART1_TX>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <0>;
+                                };
+                                pins2 {
+                                        pinmux = <STM32F429_PA10_FUNC_USART1_RX>;
+                                        bias-disable;
+                                };
+                        };
+
+                        usart3_pins_a: usart3@0 {
+                                pins1 {
+                                        pinmux = <STM32F429_PB10_FUNC_USART3_TX>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <0>;
+                                };
+                                pins2 {
+                                        pinmux = <STM32F429_PB11_FUNC_USART3_RX>;
+                                        bias-disable;
+                                };
+                        };
+
+                        usbotg_fs_pins_a: usbotg_fs@0 {
+                                pins {
+                                        pinmux = <STM32F429_PA10_FUNC_OTG_FS_ID>,
+                                                 <STM32F429_PA11_FUNC_OTG_FS_DM>,
+                                                 <STM32F429_PA12_FUNC_OTG_FS_DP>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        usbotg_fs_pins_b: usbotg_fs@1 {
+                                pins {
+                                        pinmux = <STM32F429_PB12_FUNC_OTG_HS_ID>,
+                                                 <STM32F429_PB14_FUNC_OTG_HS_DM>,
+                                                 <STM32F429_PB15_FUNC_OTG_HS_DP>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        usbotg_hs_pins_a: usbotg_hs@0 {
+                                pins {
+                                        pinmux = <STM32F429_PH4_FUNC_OTG_HS_ULPI_NXT>,
+                                                 <STM32F429_PI11_FUNC_OTG_HS_ULPI_DIR>,
+                                                 <STM32F429_PC0_FUNC_OTG_HS_ULPI_STP>,
+                                                 <STM32F429_PA5_FUNC_OTG_HS_ULPI_CK>,
+                                                 <STM32F429_PA3_FUNC_OTG_HS_ULPI_D0>,
+                                                 <STM32F429_PB0_FUNC_OTG_HS_ULPI_D1>,
+                                                 <STM32F429_PB1_FUNC_OTG_HS_ULPI_D2>,
+                                                 <STM32F429_PB10_FUNC_OTG_HS_ULPI_D3>,
+                                                 <STM32F429_PB11_FUNC_OTG_HS_ULPI_D4>,
+                                                 <STM32F429_PB12_FUNC_OTG_HS_ULPI_D5>,
+                                                 <STM32F429_PB13_FUNC_OTG_HS_ULPI_D6>,
+                                                 <STM32F429_PB5_FUNC_OTG_HS_ULPI_D7>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        ethernet_mii: mii@0 {
+                                pins {
+                                        pinmux = <STM32F429_PG13_FUNC_ETH_MII_TXD0_ETH_RMII_TXD0>,
+                                                 <STM32F429_PG14_FUNC_ETH_MII_TXD1_ETH_RMII_TXD1>,
+                                                 <STM32F429_PC2_FUNC_ETH_MII_TXD2>,
+                                                 <STM32F429_PB8_FUNC_ETH_MII_TXD3>,
+                                                 <STM32F429_PC3_FUNC_ETH_MII_TX_CLK>,
+                                                 <STM32F429_PG11_FUNC_ETH_MII_TX_EN_ETH_RMII_TX_EN>,
+                                                 <STM32F429_PA2_FUNC_ETH_MDIO>,
+                                                 <STM32F429_PC1_FUNC_ETH_MDC>,
+                                                 <STM32F429_PA1_FUNC_ETH_MII_RX_CLK_ETH_RMII_REF_CLK>,
+                                                 <STM32F429_PA7_FUNC_ETH_MII_RX_DV_ETH_RMII_CRS_DV>,
+                                                 <STM32F429_PC4_FUNC_ETH_MII_RXD0_ETH_RMII_RXD0>,
+                                                 <STM32F429_PC5_FUNC_ETH_MII_RXD1_ETH_RMII_RXD1>,
+                                                 <STM32F429_PH6_FUNC_ETH_MII_RXD2>,
+                                                 <STM32F429_PH7_FUNC_ETH_MII_RXD3>;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        adc3_in8_pin: adc@200 {
+                                pins {
+                                        pinmux = <STM32F429_PF10_FUNC_ANALOG>;
+                                };
+                        };
+
+                        pwm1_pins: pwm@1 {
+                                pins {
+                                        pinmux = <STM32F429_PA8_FUNC_TIM1_CH1>,
+                                                 <STM32F429_PB13_FUNC_TIM1_CH1N>,
+                                                 <STM32F429_PB12_FUNC_TIM1_BKIN>;
+                                };
+                        };
+
+                        pwm3_pins: pwm@3 {
+                                pins {
+                                        pinmux = <STM32F429_PB4_FUNC_TIM3_CH1>,
+                                                 <STM32F429_PB5_FUNC_TIM3_CH2>;
+                                };
+                        };
+
+                        i2c1_pins: i2c1@0 {
+                                pins {
+                                        pinmux = <STM32F429_PB9_FUNC_I2C1_SDA>,
+                                                 <STM32F429_PB6_FUNC_I2C1_SCL>;
+                                        bias-disable;
+                                        drive-open-drain;
+                                        slew-rate = <3>;
+                                };
+                        };
+
+                        ltdc_pins: ltdc@0 {
+                                pins {
+                                        pinmux = <STM32F429_PI12_FUNC_LCD_HSYNC>,
+                                                 <STM32F429_PI13_FUNC_LCD_VSYNC>,
+                                                 <STM32F429_PI14_FUNC_LCD_CLK>,
+                                                 <STM32F429_PI15_FUNC_LCD_R0>,
+                                                 <STM32F429_PJ0_FUNC_LCD_R1>,
+                                                 <STM32F429_PJ1_FUNC_LCD_R2>,
+                                                 <STM32F429_PJ2_FUNC_LCD_R3>,
+                                                 <STM32F429_PJ3_FUNC_LCD_R4>,
+                                                 <STM32F429_PJ4_FUNC_LCD_R5>,
+                                                 <STM32F429_PJ5_FUNC_LCD_R6>,
+                                                 <STM32F429_PJ6_FUNC_LCD_R7>,
+                                                 <STM32F429_PJ7_FUNC_LCD_G0>,
+                                                 <STM32F429_PJ8_FUNC_LCD_G1>,
+                                                 <STM32F429_PJ9_FUNC_LCD_G2>,
+                                                 <STM32F429_PJ10_FUNC_LCD_G3>,
+                                                 <STM32F429_PJ11_FUNC_LCD_G4>,
+                                                 <STM32F429_PJ12_FUNC_LCD_B0>,
+                                                 <STM32F429_PJ13_FUNC_LCD_B1>,
+                                                 <STM32F429_PJ14_FUNC_LCD_B2>,
+                                                 <STM32F429_PJ15_FUNC_LCD_B3>,
+                                                 <STM32F429_PK0_FUNC_LCD_G5>,
+                                                 <STM32F429_PK1_FUNC_LCD_G6>,
+                                                 <STM32F429_PK2_FUNC_LCD_G7>,
+                                                 <STM32F429_PK3_FUNC_LCD_B4>,
+                                                 <STM32F429_PK4_FUNC_LCD_B5>,
+                                                 <STM32F429_PK5_FUNC_LCD_B6>,
+                                                 <STM32F429_PK6_FUNC_LCD_B7>,
+                                                 <STM32F429_PK7_FUNC_LCD_DE>;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        dcmi_pins: dcmi@0 {
+                                pins {
+                                        pinmux = <STM32F429_PA4_FUNC_DCMI_HSYNC>,
+                                                 <STM32F429_PB7_FUNC_DCMI_VSYNC>,
+                                                 <STM32F429_PA6_FUNC_DCMI_PIXCLK>,
+                                                 <STM32F429_PC6_FUNC_DCMI_D0>,
+                                                 <STM32F429_PC7_FUNC_DCMI_D1>,
+                                                 <STM32F429_PC8_FUNC_DCMI_D2>,
+                                                 <STM32F429_PC9_FUNC_DCMI_D3>,
+                                                 <STM32F429_PC11_FUNC_DCMI_D4>,
+                                                 <STM32F429_PD3_FUNC_DCMI_D5>,
+                                                 <STM32F429_PB8_FUNC_DCMI_D6>,
+                                                 <STM32F429_PE6_FUNC_DCMI_D7>,
+                                                 <STM32F429_PC10_FUNC_DCMI_D8>,
+                                                 <STM32F429_PC12_FUNC_DCMI_D9>,
+                                                 <STM32F429_PD6_FUNC_DCMI_D10>,
+                                                 <STM32F429_PD2_FUNC_DCMI_D11>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <3>;
+                                };
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/stm32f429-disco.dts b/arch/arm/boot/dts/stm32f429-disco.dts
index c66d617e4245..5ceb2cf3777f 100644
--- a/arch/arm/boot/dts/stm32f429-disco.dts
+++ b/arch/arm/boot/dts/stm32f429-disco.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f429-pinctrl.dtsi"
 #include <dt-bindings/input/input.h>
 
 / {
diff --git a/arch/arm/boot/dts/stm32f429-pinctrl.dtsi b/arch/arm/boot/dts/stm32f429-pinctrl.dtsi
new file mode 100644
index 000000000000..3e7a17d9112e
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f429-pinctrl.dtsi
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "stm32f4-pinctrl.dtsi"
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        compatible = "st,stm32f429-pinctrl";
+
+                        gpioa: gpio@40020000 {
+                                gpio-ranges = <&pinctrl 0 0 16>;
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-ranges = <&pinctrl 0 16 16>;
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-ranges = <&pinctrl 0 32 16>;
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-ranges = <&pinctrl 0 48 16>;
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-ranges = <&pinctrl 0 64 16>;
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-ranges = <&pinctrl 0 80 16>;
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-ranges = <&pinctrl 0 96 16>;
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-ranges = <&pinctrl 0 112 16>;
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-ranges = <&pinctrl 0 128 16>;
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-ranges = <&pinctrl 0 144 16>;
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-ranges = <&pinctrl 0 160 8>;
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/stm32f429.dtsi b/arch/arm/boot/dts/stm32f429.dtsi
index dd7e99b1f43b..5b36eb114ddc 100644
--- a/arch/arm/boot/dts/stm32f429.dtsi
+++ b/arch/arm/boot/dts/stm32f429.dtsi
@@ -47,7 +47,6 @@
 
 #include "skeleton.dtsi"
 #include "armv7-m.dtsi"
-#include <dt-bindings/pinctrl/stm32f429-pinfunc.h>
 #include <dt-bindings/clock/stm32fx-clock.h>
 #include <dt-bindings/mfd/stm32f4-rcc.h>
 
@@ -591,302 +590,6 @@
                         status = "disabled";
                 };
 
-                pinctrl: pin-controller {
-                        #address-cells = <1>;
-                        #size-cells = <1>;
-                        compatible = "st,stm32f429-pinctrl";
-                        ranges = <0 0x40020000 0x3000>;
-                        interrupt-parent = <&exti>;
-                        st,syscfg = <&syscfg 0x8>;
-                        pins-are-numbered;
-
-                        gpioa: gpio@40020000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x0 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOA)>;
-                                st,bank-name = "GPIOA";
-                        };
-
-                        gpiob: gpio@40020400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOB)>;
-                                st,bank-name = "GPIOB";
-                        };
-
-                        gpioc: gpio@40020800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOC)>;
-                                st,bank-name = "GPIOC";
-                        };
-
-                        gpiod: gpio@40020c00 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0xc00 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOD)>;
-                                st,bank-name = "GPIOD";
-                        };
-
-                        gpioe: gpio@40021000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1000 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOE)>;
-                                st,bank-name = "GPIOE";
-                        };
-
-                        gpiof: gpio@40021400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOF)>;
-                                st,bank-name = "GPIOF";
-                        };
-
-                        gpiog: gpio@40021800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOG)>;
-                                st,bank-name = "GPIOG";
-                        };
-
-                        gpioh: gpio@40021c00 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1c00 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOH)>;
-                                st,bank-name = "GPIOH";
-                        };
-
-                        gpioi: gpio@40022000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2000 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOI)>;
-                                st,bank-name = "GPIOI";
-                        };
-
-                        gpioj: gpio@40022400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOJ)>;
-                                st,bank-name = "GPIOJ";
-                        };
-
-                        gpiok: gpio@40022800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOK)>;
-                                st,bank-name = "GPIOK";
-                        };
-
-                        usart1_pins_a: usart1@0 {
-                                pins1 {
-                                        pinmux = <STM32F429_PA9_FUNC_USART1_TX>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <0>;
-                                };
-                                pins2 {
-                                        pinmux = <STM32F429_PA10_FUNC_USART1_RX>;
-                                        bias-disable;
-                                };
-                        };
-
-                        usart3_pins_a: usart3@0 {
-                                pins1 {
-                                        pinmux = <STM32F429_PB10_FUNC_USART3_TX>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <0>;
-                                };
-                                pins2 {
-                                        pinmux = <STM32F429_PB11_FUNC_USART3_RX>;
-                                        bias-disable;
-                                };
-                        };
-
-                        usbotg_fs_pins_a: usbotg_fs@0 {
-                                pins {
-                                        pinmux = <STM32F429_PA10_FUNC_OTG_FS_ID>,
-                                                 <STM32F429_PA11_FUNC_OTG_FS_DM>,
-                                                 <STM32F429_PA12_FUNC_OTG_FS_DP>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        usbotg_fs_pins_b: usbotg_fs@1 {
-                                pins {
-                                        pinmux = <STM32F429_PB12_FUNC_OTG_HS_ID>,
-                                                 <STM32F429_PB14_FUNC_OTG_HS_DM>,
-                                                 <STM32F429_PB15_FUNC_OTG_HS_DP>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        usbotg_hs_pins_a: usbotg_hs@0 {
-                                pins {
-                                        pinmux = <STM32F429_PH4_FUNC_OTG_HS_ULPI_NXT>,
-                                                 <STM32F429_PI11_FUNC_OTG_HS_ULPI_DIR>,
-                                                 <STM32F429_PC0_FUNC_OTG_HS_ULPI_STP>,
-                                                 <STM32F429_PA5_FUNC_OTG_HS_ULPI_CK>,
-                                                 <STM32F429_PA3_FUNC_OTG_HS_ULPI_D0>,
-                                                 <STM32F429_PB0_FUNC_OTG_HS_ULPI_D1>,
-                                                 <STM32F429_PB1_FUNC_OTG_HS_ULPI_D2>,
-                                                 <STM32F429_PB10_FUNC_OTG_HS_ULPI_D3>,
-                                                 <STM32F429_PB11_FUNC_OTG_HS_ULPI_D4>,
-                                                 <STM32F429_PB12_FUNC_OTG_HS_ULPI_D5>,
-                                                 <STM32F429_PB13_FUNC_OTG_HS_ULPI_D6>,
-                                                 <STM32F429_PB5_FUNC_OTG_HS_ULPI_D7>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        ethernet_mii: mii@0 {
-                                pins {
-                                        pinmux = <STM32F429_PG13_FUNC_ETH_MII_TXD0_ETH_RMII_TXD0>,
-                                                 <STM32F429_PG14_FUNC_ETH_MII_TXD1_ETH_RMII_TXD1>,
-                                                 <STM32F429_PC2_FUNC_ETH_MII_TXD2>,
-                                                 <STM32F429_PB8_FUNC_ETH_MII_TXD3>,
-                                                 <STM32F429_PC3_FUNC_ETH_MII_TX_CLK>,
-                                                 <STM32F429_PG11_FUNC_ETH_MII_TX_EN_ETH_RMII_TX_EN>,
-                                                 <STM32F429_PA2_FUNC_ETH_MDIO>,
-                                                 <STM32F429_PC1_FUNC_ETH_MDC>,
-                                                 <STM32F429_PA1_FUNC_ETH_MII_RX_CLK_ETH_RMII_REF_CLK>,
-                                                 <STM32F429_PA7_FUNC_ETH_MII_RX_DV_ETH_RMII_CRS_DV>,
-                                                 <STM32F429_PC4_FUNC_ETH_MII_RXD0_ETH_RMII_RXD0>,
-                                                 <STM32F429_PC5_FUNC_ETH_MII_RXD1_ETH_RMII_RXD1>,
-                                                 <STM32F429_PH6_FUNC_ETH_MII_RXD2>,
-                                                 <STM32F429_PH7_FUNC_ETH_MII_RXD3>;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        adc3_in8_pin: adc@200 {
-                                pins {
-                                        pinmux = <STM32F429_PF10_FUNC_ANALOG>;
-                                };
-                        };
-
-                        pwm1_pins: pwm@1 {
-                                pins {
-                                        pinmux = <STM32F429_PA8_FUNC_TIM1_CH1>,
-                                                 <STM32F429_PB13_FUNC_TIM1_CH1N>,
-                                                 <STM32F429_PB12_FUNC_TIM1_BKIN>;
-                                };
-                        };
-
-                        pwm3_pins: pwm@3 {
-                                pins {
-                                        pinmux = <STM32F429_PB4_FUNC_TIM3_CH1>,
-                                                 <STM32F429_PB5_FUNC_TIM3_CH2>;
-                                };
-                        };
-
-                        i2c1_pins: i2c1@0 {
-                                pins {
-                                        pinmux = <STM32F429_PB9_FUNC_I2C1_SDA>,
-                                                 <STM32F429_PB6_FUNC_I2C1_SCL>;
-                                        bias-disable;
-                                        drive-open-drain;
-                                        slew-rate = <3>;
-                                };
-                        };
-
-                        ltdc_pins: ltdc@0 {
-                                pins {
-                                        pinmux = <STM32F429_PI12_FUNC_LCD_HSYNC>,
-                                                 <STM32F429_PI13_FUNC_LCD_VSYNC>,
-                                                 <STM32F429_PI14_FUNC_LCD_CLK>,
-                                                 <STM32F429_PI15_FUNC_LCD_R0>,
-                                                 <STM32F429_PJ0_FUNC_LCD_R1>,
-                                                 <STM32F429_PJ1_FUNC_LCD_R2>,
-                                                 <STM32F429_PJ2_FUNC_LCD_R3>,
-                                                 <STM32F429_PJ3_FUNC_LCD_R4>,
-                                                 <STM32F429_PJ4_FUNC_LCD_R5>,
-                                                 <STM32F429_PJ5_FUNC_LCD_R6>,
-                                                 <STM32F429_PJ6_FUNC_LCD_R7>,
-                                                 <STM32F429_PJ7_FUNC_LCD_G0>,
-                                                 <STM32F429_PJ8_FUNC_LCD_G1>,
-                                                 <STM32F429_PJ9_FUNC_LCD_G2>,
-                                                 <STM32F429_PJ10_FUNC_LCD_G3>,
-                                                 <STM32F429_PJ11_FUNC_LCD_G4>,
-                                                 <STM32F429_PJ12_FUNC_LCD_B0>,
-                                                 <STM32F429_PJ13_FUNC_LCD_B1>,
-                                                 <STM32F429_PJ14_FUNC_LCD_B2>,
-                                                 <STM32F429_PJ15_FUNC_LCD_B3>,
-                                                 <STM32F429_PK0_FUNC_LCD_G5>,
-                                                 <STM32F429_PK1_FUNC_LCD_G6>,
-                                                 <STM32F429_PK2_FUNC_LCD_G7>,
-                                                 <STM32F429_PK3_FUNC_LCD_B4>,
-                                                 <STM32F429_PK4_FUNC_LCD_B5>,
-                                                 <STM32F429_PK5_FUNC_LCD_B6>,
-                                                 <STM32F429_PK6_FUNC_LCD_B7>,
-                                                 <STM32F429_PK7_FUNC_LCD_DE>;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        dcmi_pins: dcmi@0 {
-                                pins {
-                                        pinmux = <STM32F429_PA4_FUNC_DCMI_HSYNC>,
-                                                 <STM32F429_PB7_FUNC_DCMI_VSYNC>,
-                                                 <STM32F429_PA6_FUNC_DCMI_PIXCLK>,
-                                                 <STM32F429_PC6_FUNC_DCMI_D0>,
-                                                 <STM32F429_PC7_FUNC_DCMI_D1>,
-                                                 <STM32F429_PC8_FUNC_DCMI_D2>,
-                                                 <STM32F429_PC9_FUNC_DCMI_D3>,
-                                                 <STM32F429_PC11_FUNC_DCMI_D4>,
-                                                 <STM32F429_PD3_FUNC_DCMI_D5>,
-                                                 <STM32F429_PB8_FUNC_DCMI_D6>,
-                                                 <STM32F429_PE6_FUNC_DCMI_D7>,
-                                                 <STM32F429_PC10_FUNC_DCMI_D8>,
-                                                 <STM32F429_PC12_FUNC_DCMI_D9>,
-                                                 <STM32F429_PD6_FUNC_DCMI_D10>,
-                                                 <STM32F429_PD2_FUNC_DCMI_D11>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <3>;
-                                };
-                        };
-                };
-
                 crc: crc@40023000 {
                         compatible = "st,stm32f4-crc";
                         reg = <0x40023000 0x400>;
diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
index 6ae1f037f3f0..c18acbe4cf4e 100644
--- a/arch/arm/boot/dts/stm32f469-disco.dts
+++ b/arch/arm/boot/dts/stm32f469-disco.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f469-pinctrl.dtsi"
 
 / {
         model = "STMicroelectronics STM32F469i-DISCO board";
diff --git a/arch/arm/boot/dts/stm32f469-pinctrl.dtsi b/arch/arm/boot/dts/stm32f469-pinctrl.dtsi
new file mode 100644
index 000000000000..fff542662eea
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f469-pinctrl.dtsi
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "stm32f4-pinctrl.dtsi"
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        compatible = "st,stm32f469-pinctrl";
+
+                        gpioa: gpio@40020000 {
+                                gpio-ranges = <&pinctrl 0 0 16>;
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-ranges = <&pinctrl 0 16 16>;
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-ranges = <&pinctrl 0 32 16>;
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-ranges = <&pinctrl 0 48 16>;
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-ranges = <&pinctrl 0 64 16>;
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-ranges = <&pinctrl 0 80 16>;
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-ranges = <&pinctrl 0 96 16>;
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-ranges = <&pinctrl 0 112 16>;
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-ranges = <&pinctrl 0 128 16>;
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-ranges = <&pinctrl 0 144 6>,
+                                              <&pinctrl 12 156 4>;
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-ranges = <&pinctrl 3 163 5>;
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index b147cb0dc14b..eef072a21acc 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -311,8 +311,8 @@
                                         #size-cells = <0>;
                                         reg = <0>;
 
-                                        tcon1_in_drc1: endpoint@0 {
-                                                reg = <0>;
+                                        tcon1_in_drc1: endpoint@1 {
+                                                reg = <1>;
                                                 remote-endpoint = <&drc1_out_tcon1>;
                                         };
                                 };
@@ -1012,8 +1012,8 @@
                                         #size-cells = <0>;
                                         reg = <1>;
 
-                                        be1_out_drc1: endpoint@0 {
-                                                reg = <0>;
+                                        be1_out_drc1: endpoint@1 {
+                                                reg = <1>;
                                                 remote-endpoint = <&drc1_in_be1>;
                                         };
                                 };
@@ -1042,8 +1042,8 @@
                                         #size-cells = <0>;
                                         reg = <0>;
 
-                                        drc1_in_be1: endpoint@0 {
-                                                reg = <0>;
+                                        drc1_in_be1: endpoint@1 {
+                                                reg = <1>;
                                                 remote-endpoint = <&be1_out_drc1>;
                                         };
                                 };
@@ -1053,8 +1053,8 @@
                                         #size-cells = <0>;
                                         reg = <1>;
 
-                                        drc1_out_tcon1: endpoint@0 {
-                                                reg = <0>;
+                                        drc1_out_tcon1: endpoint@1 {
+                                                reg = <1>;
                                                 remote-endpoint = <&tcon1_in_drc1>;
                                         };
                                 };
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
index d2d75fa664a6..2a63fa10c813 100644
--- a/arch/arm/configs/gemini_defconfig
+++ b/arch/arm/configs/gemini_defconfig
@@ -32,6 +32,7 @@ CONFIG_BLK_DEV_RAM_SIZE=16384
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
+CONFIG_PATA_FTIDE010=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
@@ -55,8 +56,8 @@ CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_GEMINI=y
 CONFIG_DMADEVICES=y
+CONFIG_AMBA_PL08X=y
 # CONFIG_DNOTIFY is not set
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
diff --git a/arch/arm/configs/pxa_defconfig b/arch/arm/configs/pxa_defconfig
index 64e3a2a8cede..d5e1370ec303 100644
--- a/arch/arm/configs/pxa_defconfig
+++ b/arch/arm/configs/pxa_defconfig
@@ -471,7 +471,7 @@ CONFIG_LCD_PLATFORM=m
 CONFIG_LCD_TOSA=m
 CONFIG_BACKLIGHT_PWM=m
 CONFIG_BACKLIGHT_TOSA=m
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
diff --git a/arch/arm/configs/viper_defconfig b/arch/arm/configs/viper_defconfig
index 44d4fa57ba0a..070e5074f1ee 100644
--- a/arch/arm/configs/viper_defconfig
+++ b/arch/arm/configs/viper_defconfig
@@ -113,7 +113,7 @@ CONFIG_FB_PXA_PARAMETERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BACKLIGHT_PWM=m
 # CONFIG_VGA_CONSOLE is not set
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
diff --git a/arch/arm/configs/zeus_defconfig b/arch/arm/configs/zeus_defconfig
index 8d4c0c926c34..09e7050d5653 100644
--- a/arch/arm/configs/zeus_defconfig
+++ b/arch/arm/configs/zeus_defconfig
@@ -112,7 +112,7 @@ CONFIG_FB_PXA=m
 CONFIG_FB_PXA_PARAMETERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 # CONFIG_VGA_CONSOLE is not set
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
diff --git a/arch/arm/kernel/debug.S b/arch/arm/kernel/debug.S
index ea9646cc2a0e..0a498cb3fad8 100644
--- a/arch/arm/kernel/debug.S
+++ b/arch/arm/kernel/debug.S
@@ -115,7 +115,11 @@ ENTRY(printascii)
                 mov     r1, r0
                 mov     r0, #0x04               @ SYS_WRITE0
         ARM(    svc     #0x123456       )
+#ifdef CONFIG_CPU_V7M
+        THUMB(  bkpt    #0xab           )
+#else
         THUMB(  svc     #0xab           )
+#endif
                 ret     lr
 ENDPROC(printascii)
 
@@ -124,7 +128,11 @@ ENTRY(printch)
                 strb    r0, [r1]
                 mov     r0, #0x03               @ SYS_WRITEC
         ARM(    svc     #0x123456       )
+#ifdef CONFIG_CPU_V7M
+        THUMB(  bkpt    #0xab           )
+#else
         THUMB(  svc     #0xab           )
+#endif
                 ret     lr
 ENDPROC(printch)
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 5036f996e694..849014c01cf4 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -533,8 +533,8 @@ static void __init at91_pm_backup_init(void)
         }
 
         pm_bu->suspended = 0;
-        pm_bu->canary = virt_to_phys(&canary);
-        pm_bu->resume = virt_to_phys(cpu_resume);
+        pm_bu->canary = __pa_symbol(&canary);
+        pm_bu->resume = __pa_symbol(cpu_resume);
 
         return;
 
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index 5b614388d72f..6d28aa20a7d3 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -58,10 +58,10 @@ void omap_hsmmc_late_init(struct omap2_hsmmc_info *c)
         struct platform_device *pdev;
         int res;
 
-        if (omap_hsmmc_done != 1)
+        if (omap_hsmmc_done)
                 return;
 
-        omap_hsmmc_done++;
+        omap_hsmmc_done = 1;
 
         for (; c->mmc; c++) {
                 pdev = c->pdev;
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index f040244c57e7..2f4f7002f38d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -839,6 +839,7 @@ static struct omap_hwmod dra7xx_gpio1_hwmod = {
         .name           = "gpio1",
         .class          = &dra7xx_gpio_hwmod_class,
         .clkdm_name     = "wkupaon_clkdm",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .main_clk       = "wkupaon_iclk_mux",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 71a34e8c345a..57058ac46f49 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -32,6 +32,7 @@
 #include <asm/mach/arch.h>
 
 #include "db8500-regs.h"
+#include "pm_domains.h"
 
 static int __init ux500_l2x0_unlock(void)
 {
@@ -157,6 +158,9 @@ static const struct of_device_id u8500_local_bus_nodes[] = {
 
 static void __init u8500_init_machine(void)
 {
+        /* Initialize ux500 power domains */
+        ux500_pm_domains_init();
+
         /* automatically probe child nodes of dbx5x0 devices */
         if (of_machine_is_compatible("st-ericsson,u8540"))
                 of_platform_populate(NULL, u8500_local_bus_nodes,
diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c
index a970e7fcba9e..f6c33a0c1c61 100644
--- a/arch/arm/mach-ux500/pm.c
+++ b/arch/arm/mach-ux500/pm.c
@@ -19,7 +19,6 @@
 #include <linux/of_address.h>
 
 #include "db8500-regs.h"
-#include "pm_domains.h"
 
 /* ARM WFI Standby signal register */
 #define PRCM_ARM_WFI_STANDBY    (prcmu_base + 0x130)
@@ -203,7 +202,4 @@ void __init ux500_pm_init(u32 phy_base, u32 size)
 
         /* Set up ux500 suspend callbacks. */
         suspend_set_ops(UX500_SUSPEND_OPS);
-
-        /* Initialize ux500 power domains */
-        ux500_pm_domains_init();
 }
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 3b8e728cc944..91537d90f5f5 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -344,6 +344,11 @@ void __init arm_mm_memblock_reserve(void)
          * reserved here.
          */
 #endif
+        /*
+         * In any case, always ensure address 0 is never used as many things
+         * get very confused if 0 is returned as a legitimate address.
+         */
+        memblock_reserve(0, 1);
 }
 
 void __init adjust_lowmem_bounds(void)
diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
index e71eefa2e427..0641ba54ab62 100644
--- a/arch/arm/xen/p2m.c
+++ b/arch/arm/xen/p2m.c
@@ -1,7 +1,7 @@
 #include <linux/bootmem.h>
 #include <linux/gfp.h>
 #include <linux/export.h>
-#include <linux/rwlock.h>
+#include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/dma-mapping.h>
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index caf8b6fbe5e3..d06e34b5d192 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -61,13 +61,6 @@
         chosen {
                 stdout-path = "serial0:115200n8";
         };
-
-        reg_vcc3v3: vcc3v3 {
-                compatible = "regulator-fixed";
-                regulator-name = "vcc3v3";
-                regulator-min-microvolt = <3300000>;
-                regulator-max-microvolt = <3300000>;
-        };
 };
 
 &ehci0 {
@@ -91,7 +84,7 @@
 &mmc0 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc0_pins>;
-        vmmc-supply = <&reg_vcc3v3>;
+        vmmc-supply = <&reg_dcdc1>;
         cd-gpios = <&pio 5 6 GPIO_ACTIVE_HIGH>;
         cd-inverted;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index c89010e56488..4157987f4a3d 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -168,7 +168,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -194,7 +195,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -212,10 +214,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 9697a7a79464..4b17a76959b2 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -107,6 +107,9 @@
 
                 states = <3300000 0>,
                          <1800000 1>;
+
+                regulator-settling-time-up-us = <100>;
+                regulator-settling-time-down-us = <5000>;
         };
 
         wifi_32k: wifi-32k {
@@ -250,7 +253,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>, <&sdio_irq_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -276,11 +280,16 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
-        max-frequency = <100000000>;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
+        sd-uhs-sdr104;
+        max-frequency = <200000000>;
         disable-wp;
 
         cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
@@ -294,10 +303,10 @@
 &sd_emmc_c {
         status = "disabled";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         max-frequency = <200000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
index 9c59c3c6d1b6..38dfdde5c147 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
@@ -51,7 +51,7 @@
 / {
         compatible = "nexbox,a95x", "amlogic,meson-gxbb";
         model = "NEXBOX A95X";
-        
+
         aliases {
                 serial0 = &uart_AO;
         };
@@ -232,7 +232,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -253,7 +254,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -271,10 +273,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index d147c853ab05..1ffa1c238a72 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -50,7 +50,7 @@
 / {
         compatible = "hardkernel,odroid-c2", "amlogic,meson-gxbb";
         model = "Hardkernel ODROID-C2";
-        
+
         aliases {
                 serial0 = &uart_AO;
         };
@@ -253,7 +253,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -271,10 +272,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         max-frequency = <200000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
index 81ffc689a5bf..23c08c3afd0a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
@@ -194,7 +194,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -220,10 +221,14 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
         max-frequency = <100000000>;
         disable-wp;
 
@@ -238,10 +243,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 346753fb6324..f2bc6dea1fc6 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -155,7 +155,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins &sdio_irq_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -181,7 +182,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -198,10 +200,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index 52f1687e7a09..af834cdbba79 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -392,6 +392,17 @@
                         };
                 };
 
+                emmc_clk_gate_pins: emmc_clk_gate {
+                        mux {
+                                groups = "BOOT_8";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "BOOT_8";
+                                bias-pull-down;
+                        };
+                };
+
                 nor_pins: nor {
                         mux {
                                 groups = "nor_d",
@@ -430,6 +441,17 @@
                         };
                 };
 
+                sdcard_clk_gate_pins: sdcard_clk_gate {
+                        mux {
+                                groups = "CARD_2";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "CARD_2";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_pins: sdio {
                         mux {
                                 groups = "sdio_d0",
@@ -442,6 +464,17 @@
                         };
                 };
 
+                sdio_clk_gate_pins: sdio_clk_gate {
+                        mux {
+                                groups = "GPIOX_4";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "GPIOX_4";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_irq_pins: sdio_irq {
                         mux {
                                 groups = "sdio_irq";
@@ -661,21 +694,21 @@
 
 &sd_emmc_a {
         clocks = <&clkc CLKID_SD_EMMC_A>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_A_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_b {
         clocks = <&clkc CLKID_SD_EMMC_B>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_B_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_c {
         clocks = <&clkc CLKID_SD_EMMC_C>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_C_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
index 2a5804ce7f4b..977b4240f3c1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
@@ -123,7 +123,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -141,10 +142,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <100000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 69ca14ac10fa..64c54c92e214 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -91,6 +91,9 @@
 
                 states = <3300000 0>,
                          <1800000 1>;
+
+                regulator-settling-time-up-us = <200>;
+                regulator-settling-time-down-us = <50000>;
         };
 
         vddio_boot: regulator-vddio_boot {
@@ -197,10 +200,14 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
         max-frequency = <100000000>;
         disable-wp;
 
@@ -215,10 +222,12 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
         cap-mmc-highspeed;
+        mmc-ddr-3_3v;
         max-frequency = <50000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 4c2ac7650fcd..1b8f32867aa1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -189,7 +189,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -210,7 +211,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -228,10 +230,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index f3eea8e89d12..129af9068814 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -95,7 +95,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -116,7 +117,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -134,10 +136,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index d6876e64979e..d8dd3298b15c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -281,6 +281,17 @@
                         };
                 };
 
+                emmc_clk_gate_pins: emmc_clk_gate {
+                        mux {
+                                groups = "BOOT_8";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "BOOT_8";
+                                bias-pull-down;
+                        };
+                };
+
                 nor_pins: nor {
                         mux {
                                 groups = "nor_d",
@@ -319,6 +330,17 @@
                         };
                 };
 
+                sdcard_clk_gate_pins: sdcard_clk_gate {
+                        mux {
+                                groups = "CARD_2";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "CARD_2";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_pins: sdio {
                         mux {
                                 groups = "sdio_d0",
@@ -331,6 +353,17 @@
                         };
                 };
 
+                sdio_clk_gate_pins: sdio_clk_gate {
+                        mux {
+                                groups = "GPIOX_4";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "GPIOX_4";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_irq_pins: sdio_irq {
                         mux {
                                 groups = "sdio_irq";
@@ -603,21 +636,21 @@
 
 &sd_emmc_a {
         clocks = <&clkc CLKID_SD_EMMC_A>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_A_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_b {
         clocks = <&clkc CLKID_SD_EMMC_B>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_B_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
        clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_c {
         clocks = <&clkc CLKID_SD_EMMC_C>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_C_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index 9b10c5f4f8c0..22c697732f66 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -175,7 +175,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -193,10 +194,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index 08f1dd69b679..470f72bb863c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -220,7 +220,6 @@
         pinctrl-names = "default";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index 4d360713ed12..30d48ecf46e0 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -254,7 +254,7 @@
 
                         ap_syscon: system-controller@6f4000 {
                                 compatible = "syscon", "simple-mfd";
-                                reg = <0x6f4000 0x1000>;
+                                reg = <0x6f4000 0x2000>;
 
                                 ap_clk: clock {
                                         compatible = "marvell,ap806-clock";
@@ -265,7 +265,7 @@
                                         compatible = "marvell,ap806-pinctrl";
                                 };
 
-                                ap_gpio: gpio {
+                                ap_gpio: gpio@1040 {
                                         compatible = "marvell,armada-8k-gpio";
                                         offset = <0x1040>;
                                         ngpios = <20>;
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index 8263a8a504a8..f2aa2a81de4d 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -336,7 +336,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xf6000000 0  0xf6000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cpm_icu 0 ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cpm_icu ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
                         num-lanes = <1>;
                         clocks = <&cpm_clk 1 13>;
@@ -362,7 +362,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xf7000000 0  0xf7000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cpm_icu 0 ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cpm_icu ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
 
                         num-lanes = <1>;
@@ -389,7 +389,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xf8000000 0  0xf8000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cpm_icu 0 ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cpm_icu ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
 
                         num-lanes = <1>;
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index b71ee6c83668..4fe70323abb3 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -335,7 +335,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xfa000000 0  0xfa000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cps_icu 0 ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cps_icu ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 22 IRQ_TYPE_LEVEL_HIGH>;
                         num-lanes = <1>;
                         clocks = <&cps_clk 1 13>;
@@ -361,7 +361,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xfb000000 0  0xfb000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cps_icu 0 ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cps_icu ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 24 IRQ_TYPE_LEVEL_HIGH>;
 
                         num-lanes = <1>;
@@ -388,7 +388,7 @@
                                 /* non-prefetchable memory */
                                 0x82000000 0 0xfc000000 0  0xfc000000 0 0xf00000>;
                         interrupt-map-mask = <0 0 0 0>;
-                        interrupt-map = <0 0 0 0 &cps_icu 0 ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupt-map = <0 0 0 0 &cps_icu ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
                         interrupts = <ICU_GRP_NSR 23 IRQ_TYPE_LEVEL_HIGH>;
 
                         num-lanes = <1>;
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index 4786c67b5e65..d9d885006a8e 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -62,6 +62,7 @@
                 brightness-levels = <256 128 64 16 8 4 0>;
                 default-brightness-level = <6>;
 
+                power-supply = <&reg_12v>;
                 enable-gpios = <&gpio6 7 GPIO_ACTIVE_HIGH>;
         };
 
@@ -83,6 +84,15 @@
                 regulator-always-on;
         };
 
+        reg_12v: regulator2 {
+                compatible = "regulator-fixed";
+                regulator-name = "fixed-12V";
+                regulator-min-microvolt = <12000000>;
+                regulator-max-microvolt = <12000000>;
+                regulator-boot-on;
+                regulator-always-on;
+        };
+
         rsnd_ak4613: sound {
                 compatible = "simple-audio-card";
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 6d615cb6e64d..41d61840fb99 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -582,7 +582,7 @@
         vop_mmu: iommu@ff373f00 {
                 compatible = "rockchip,iommu";
                 reg = <0x0 0xff373f00 0x0 0x100>;
-                interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH 0>;
+                interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
                 interrupt-names = "vop_mmu";
                 #iommu-cells = <0>;
                 status = "disabled";
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index e0518b4bc6c2..1070c8264c13 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -113,8 +113,7 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x0>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
+
                         #cooling-cells = <2>; /* min followed by max */
                 };
 
@@ -123,8 +122,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x1>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_l2: cpu@2 {
@@ -132,8 +129,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x2>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_l3: cpu@3 {
@@ -141,8 +136,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x3>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_b0: cpu@100 {
@@ -150,8 +143,7 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x100>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
+
                         #cooling-cells = <2>; /* min followed by max */
                 };
 
@@ -160,8 +152,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x101>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
                 };
 
                 cpu_b2: cpu@102 {
@@ -169,8 +159,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x102>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
                 };
 
                 cpu_b3: cpu@103 {
@@ -178,62 +166,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x103>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
-                };
-        };
-
-        cluster0_opp: opp-table0 {
-                compatible = "operating-points-v2";
-                opp-shared;
-
-                opp00 {
-                        opp-hz = /bits/ 64 <312000000>;
-                        opp-microvolt = <950000>;
-                        clock-latency-ns = <40000>;
-                };
-                opp01 {
-                        opp-hz = /bits/ 64 <408000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp02 {
-                        opp-hz = /bits/ 64 <600000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp03 {
-                        opp-hz = /bits/ 64 <816000000>;
-                        opp-microvolt = <1025000>;
-                };
-                opp04 {
-                        opp-hz = /bits/ 64 <1008000000>;
-                        opp-microvolt = <1125000>;
-                };
-        };
-
-        cluster1_opp: opp-table1 {
-                compatible = "operating-points-v2";
-                opp-shared;
-
-                opp00 {
-                        opp-hz = /bits/ 64 <312000000>;
-                        opp-microvolt = <950000>;
-                        clock-latency-ns = <40000>;
-                };
-                opp01 {
-                        opp-hz = /bits/ 64 <408000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp02 {
-                        opp-hz = /bits/ 64 <600000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp03 {
-                        opp-hz = /bits/ 64 <816000000>;
-                        opp-microvolt = <975000>;
-                };
-                opp04 {
-                        opp-hz = /bits/ 64 <1008000000>;
-                        opp-microvolt = <1050000>;
                 };
         };
 
@@ -808,7 +740,7 @@
         iep_mmu: iommu@ff900800 {
                 compatible = "rockchip,iommu";
                 reg = <0x0 0xff900800 0x0 0x100>;
-                interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH 0>;
+                interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>;
                 interrupt-names = "iep_mmu";
                 #iommu-cells = <0>;
                 status = "disabled";
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
index 7fd4bfcaa38e..fef82274a39d 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
@@ -371,10 +371,10 @@
                                 regulator-always-on;
                                 regulator-boot-on;
                                 regulator-min-microvolt = <1800000>;
-                                regulator-max-microvolt = <3300000>;
+                                regulator-max-microvolt = <3000000>;
                                 regulator-state-mem {
                                         regulator-on-in-suspend;
-                                        regulator-suspend-microvolt = <3300000>;
+                                        regulator-suspend-microvolt = <3000000>;
                                 };
                         };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
index 53ff3d191a1d..910628d18add 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@@ -325,12 +325,12 @@
                         vcc_sd: LDO_REG4 {
                                 regulator-name = "vcc_sd";
                                 regulator-min-microvolt = <1800000>;
-                                regulator-max-microvolt = <3300000>;
+                                regulator-max-microvolt = <3000000>;
                                 regulator-always-on;
                                 regulator-boot-on;
                                 regulator-state-mem {
                                         regulator-on-in-suspend;
-                                        regulator-suspend-microvolt = <3300000>;
+                                        regulator-suspend-microvolt = <3000000>;
                                 };
                         };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
index 6c30bb02210d..0f873c897d0d 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
@@ -315,10 +315,10 @@
                                 regulator-always-on;
                                 regulator-boot-on;
                                 regulator-min-microvolt = <1800000>;
-                                regulator-max-microvolt = <3300000>;
+                                regulator-max-microvolt = <3000000>;
                                 regulator-state-mem {
                                         regulator-on-in-suspend;
-                                        regulator-suspend-microvolt = <3300000>;
+                                        regulator-suspend-microvolt = <3000000>;
                                 };
                         };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index d79e9b3265b9..ab7629c5b856 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1629,9 +1629,9 @@
                 compatible = "rockchip,rk3399-mipi-dsi", "snps,dw-mipi-dsi";
                 reg = <0x0 0xff960000 0x0 0x8000>;
                 interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH 0>;
-                clocks = <&cru SCLK_MIPIDPHY_REF>, <&cru PCLK_MIPI_DSI0>,
-                         <&cru SCLK_DPHY_TX0_CFG>;
-                clock-names = "ref", "pclk", "phy_cfg";
+                clocks = <&cru SCLK_DPHY_PLL>, <&cru PCLK_MIPI_DSI0>,
+                         <&cru SCLK_DPHY_TX0_CFG>, <&cru PCLK_VIO_GRF>;
+                clock-names = "ref", "pclk", "phy_cfg", "grf";
                 power-domains = <&power RK3399_PD_VIO>;
                 rockchip,grf = <&grf>;
                 status = "disabled";
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 3585a5e26151..f7c4d2146aed 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -95,16 +95,19 @@
 #define KERNEL_END        _end
 
 /*
- * The size of the KASAN shadow region. This should be 1/8th of the
- * size of the entire kernel virtual address space.
+ * KASAN requires 1/8th of the kernel virtual address space for the shadow
+ * region. KASAN can bloat the stack significantly, so double the (minimum)
+ * stack size when KASAN is in use.
  */
 #ifdef CONFIG_KASAN
 #define KASAN_SHADOW_SIZE       (UL(1) << (VA_BITS - 3))
+#define KASAN_THREAD_SHIFT      1
 #else
 #define KASAN_SHADOW_SIZE       (0)
+#define KASAN_THREAD_SHIFT      0
 #endif
 
-#define MIN_THREAD_SHIFT        14
+#define MIN_THREAD_SHIFT        (14 + KASAN_THREAD_SHIFT)
 
 /*
  * VMAP'd stacks are allocated at page granularity, so we must ensure that such
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index bc4e92337d16..b46e54c2399b 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -401,7 +401,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 /* Find an entry in the third-level page table. */
 #define pte_index(addr)         (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
 
-#define pte_offset_phys(dir,addr)       (pmd_page_paddr(*(dir)) + pte_index(addr) * sizeof(pte_t))
+#define pte_offset_phys(dir,addr)       (pmd_page_paddr(READ_ONCE(*(dir))) + pte_index(addr) * sizeof(pte_t))
 #define pte_offset_kernel(dir,addr)     ((pte_t *)__va(pte_offset_phys((dir), (addr))))
 
 #define pte_offset_map(dir,addr)        pte_offset_kernel((dir), (addr))
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index f0e6d717885b..d06fbe4cd38d 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -649,4 +649,4 @@ static int __init armv8_deprecated_init(void)
         return 0;
 }
 
-late_initcall(armv8_deprecated_init);
+core_initcall(armv8_deprecated_init);
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index cd52d365d1f0..21e2c95d24e7 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1307,4 +1307,4 @@ static int __init enable_mrs_emulation(void)
         return 0;
 }
 
-late_initcall(enable_mrs_emulation);
+core_initcall(enable_mrs_emulation);
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index f444f374bd7b..5d547deb6996 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -444,4 +444,4 @@ static int __init fpsimd_init(void)
 
         return 0;
 }
-late_initcall(fpsimd_init);
+core_initcall(fpsimd_init);
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 7434ec0c7a27..0b243ecaf7ac 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -384,6 +384,7 @@ ENTRY(kimage_vaddr)
  * booted in EL1 or EL2 respectively.
  */
 ENTRY(el2_setup)
+        msr     SPsel, #1                       // We want to use SP_EL{1,2}
         mrs     x0, CurrentEL
         cmp     x0, #CurrentEL_EL2
         b.eq    1f
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 89993c4be1be..b64958b23a7f 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -97,7 +97,7 @@ static void data_abort_decode(unsigned int esr)
                          (esr & ESR_ELx_SF) >> ESR_ELx_SF_SHIFT,
                          (esr & ESR_ELx_AR) >> ESR_ELx_AR_SHIFT);
         } else {
-                pr_alert("  ISV = 0, ISS = 0x%08lu\n", esr & ESR_ELx_ISS_MASK);
+                pr_alert("  ISV = 0, ISS = 0x%08lx\n", esr & ESR_ELx_ISS_MASK);
         }
 
         pr_alert("  CM = %lu, WnR = %lu\n",
@@ -651,7 +651,7 @@ static const struct fault_info fault_info[] = {
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 0 translation fault"     },
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 1 translation fault"     },
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 2 translation fault"     },
-        { do_page_fault,        SIGSEGV, SEGV_MAPERR,   "level 3 translation fault"     },
+        { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 3 translation fault"     },
         { do_bad,               SIGBUS,  0,             "unknown 8"                     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 1 access flag fault"     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 2 access flag fault"     },
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 87cde1e4b38c..0777f3a8a1f3 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -194,6 +194,10 @@ config TIMER_DIVIDE
         int "Timer divider (integer)"
         default "128"
 
+config CPU_BIG_ENDIAN
+        bool "Generate big endian code"
+        default n
+
 config CPU_LITTLE_ENDIAN
         bool "Generate little endian code"
         default n
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index 647dd94a0c39..72b96f282689 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -114,6 +114,15 @@ static void set_eit_vector_entries(void)
         _flush_cache_copyback_all();
 }
 
+void abort(void)
+{
+        BUG();
+
+        /* if that doesn't kill us, halt */
+        panic("Oops failed to kill thread");
+}
+EXPORT_SYMBOL(abort);
+
 void __init trap_init(void)
 {
         set_eit_vector_entries();
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 9d26abdf0dc1..4f798aa671dd 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -39,7 +39,7 @@ config MICROBLAZE
 # Endianness selection
 choice
         prompt "Endianness selection"
-        default CPU_BIG_ENDIAN
+        default CPU_LITTLE_ENDIAN
         help
           microblaze architectures can be configured for either little or
           big endian formats. Be sure to select the appropriate mode.
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index e77a596f3f1e..06609ca36115 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += fcntl.h
 generic-y += ioctl.h
 generic-y += ioctls.h
 generic-y += ipcbuf.h
+generic-y += kvm_para.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c
index e45ada8fb006..94700c5270a9 100644
--- a/arch/microblaze/kernel/dma.c
+++ b/arch/microblaze/kernel/dma.c
@@ -165,7 +165,7 @@ int dma_direct_mmap_coherent(struct device *dev, struct vm_area_struct *vma,
                              unsigned long attrs)
 {
 #ifdef CONFIG_MMU
-        unsigned long user_count = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        unsigned long user_count = vma_pages(vma);
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         unsigned long off = vma->vm_pgoff;
         unsigned long pfn;
diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
index 903f3bf48419..7e25c5cc353a 100644
--- a/arch/mips/include/asm/cmpxchg.h
+++ b/arch/mips/include/asm/cmpxchg.h
@@ -155,14 +155,16 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
                 return __cmpxchg_small(ptr, old, new, size);
 
         case 4:
-                return __cmpxchg_asm("ll", "sc", (volatile u32 *)ptr, old, new);
+                return __cmpxchg_asm("ll", "sc", (volatile u32 *)ptr,
+                                     (u32)old, new);
 
         case 8:
                 /* lld/scd are only available for MIPS64 */
                 if (!IS_ENABLED(CONFIG_64BIT))
                         return __cmpxchg_called_with_bad_pointer();
 
-                return __cmpxchg_asm("lld", "scd", (volatile u64 *)ptr, old, new);
+                return __cmpxchg_asm("lld", "scd", (volatile u64 *)ptr,
+                                     (u64)old, new);
 
         default:
                 return __cmpxchg_called_with_bad_pointer();
diff --git a/arch/mips/loongson32/common/platform.c b/arch/mips/loongson32/common/platform.c
index 100f23dfa438..ac584c5823d0 100644
--- a/arch/mips/loongson32/common/platform.c
+++ b/arch/mips/loongson32/common/platform.c
@@ -183,18 +183,20 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
 }
 
 static struct plat_stmmacenet_data ls1x_eth0_pdata = {
-        .bus_id         = 0,
-        .phy_addr       = -1,
+        .bus_id                 = 0,
+        .phy_addr               = -1,
 #if defined(CONFIG_LOONGSON1_LS1B)
-        .interface      = PHY_INTERFACE_MODE_MII,
+        .interface              = PHY_INTERFACE_MODE_MII,
 #elif defined(CONFIG_LOONGSON1_LS1C)
-        .interface      = PHY_INTERFACE_MODE_RMII,
+        .interface              = PHY_INTERFACE_MODE_RMII,
 #endif
-        .mdio_bus_data  = &ls1x_mdio_bus_data,
-        .dma_cfg        = &ls1x_eth_dma_cfg,
-        .has_gmac       = 1,
-        .tx_coe         = 1,
-        .init           = ls1x_eth_mux_init,
+        .mdio_bus_data          = &ls1x_mdio_bus_data,
+        .dma_cfg                = &ls1x_eth_dma_cfg,
+        .has_gmac               = 1,
+        .tx_coe                 = 1,
+        .rx_queues_to_use       = 1,
+        .tx_queues_to_use       = 1,
+        .init                   = ls1x_eth_mux_init,
 };
 
 static struct resource ls1x_eth0_resources[] = {
@@ -222,14 +224,16 @@ struct platform_device ls1x_eth0_pdev = {
 
 #ifdef CONFIG_LOONGSON1_LS1B
 static struct plat_stmmacenet_data ls1x_eth1_pdata = {
-        .bus_id         = 1,
-        .phy_addr       = -1,
-        .interface      = PHY_INTERFACE_MODE_MII,
-        .mdio_bus_data  = &ls1x_mdio_bus_data,
-        .dma_cfg        = &ls1x_eth_dma_cfg,
-        .has_gmac       = 1,
-        .tx_coe         = 1,
-        .init           = ls1x_eth_mux_init,
+        .bus_id                 = 1,
+        .phy_addr               = -1,
+        .interface              = PHY_INTERFACE_MODE_MII,
+        .mdio_bus_data          = &ls1x_mdio_bus_data,
+        .dma_cfg                = &ls1x_eth_dma_cfg,
+        .has_gmac               = 1,
+        .tx_coe                 = 1,
+        .rx_queues_to_use       = 1,
+        .tx_queues_to_use       = 1,
+        .init                   = ls1x_eth_mux_init,
 };
 
 static struct resource ls1x_eth1_resources[] = {
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 192542dbd972..16d9ef5a78c5 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -2558,7 +2558,6 @@ dcopuop:
                                         break;
                                 default:
                                         /* Reserved R6 ops */
-                                        pr_err("Reserved MIPS R6 CMP.condn.S operation\n");
                                         return SIGILL;
                                 }
                         }
@@ -2719,7 +2718,6 @@ dcopuop:
                                         break;
                                 default:
                                         /* Reserved R6 ops */
-                                        pr_err("Reserved MIPS R6 CMP.condn.D operation\n");
                                         return SIGILL;
                                 }
                         }
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index 7646891c4e9b..01b7a87ea678 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -667,7 +667,7 @@ static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
 {
         int src, dst, r, td, ts, mem_off, b_off;
         bool need_swap, did_move, cmp_eq;
-        unsigned int target;
+        unsigned int target = 0;
         u64 t64;
         s64 t64s;
         int bpf_op = BPF_OP(insn->code);
diff --git a/arch/mips/tools/generic-board-config.sh b/arch/mips/tools/generic-board-config.sh
index 5c4f93687039..654d652d7fa1 100755
--- a/arch/mips/tools/generic-board-config.sh
+++ b/arch/mips/tools/generic-board-config.sh
@@ -30,8 +30,6 @@ cfg="$4"
 boards_origin="$5"
 shift 5
 
-cd "${srctree}"
-
 # Only print Skipping... lines if the user explicitly specified BOARDS=. In the
 # general case it only serves to obscure the useful output about what actually
 # was included.
@@ -48,7 +46,7 @@ environment*)
 esac
 
 for board in $@; do
-        board_cfg="arch/mips/configs/generic/board-${board}.config"
+        board_cfg="${srctree}/arch/mips/configs/generic/board-${board}.config"
         if [ ! -f "${board_cfg}" ]; then
                 echo "WARNING: Board config '${board_cfg}' not found"
                 continue
@@ -84,7 +82,7 @@ for board in $@; do
         done || continue
 
         # Merge this board config fragment into our final config file
-        ./scripts/kconfig/merge_config.sh \
+        ${srctree}/scripts/kconfig/merge_config.sh \
                 -m -O ${objtree} ${cfg} ${board_cfg} \
                 | grep -Ev '^(#|Using)'
 done
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index c6d6272a934f..7baa2265d439 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -35,12 +35,12 @@ EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(__xchg8);
 EXPORT_SYMBOL(__xchg32);
 EXPORT_SYMBOL(__cmpxchg_u32);
+EXPORT_SYMBOL(__cmpxchg_u64);
 #ifdef CONFIG_SMP
 EXPORT_SYMBOL(__atomic_hash);
 #endif
 #ifdef CONFIG_64BIT
 EXPORT_SYMBOL(__xchg64);
-EXPORT_SYMBOL(__cmpxchg_u64);
 #endif
 
 #include <linux/uaccess.h>
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index a45a67d526f8..30f92391a93e 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -146,7 +146,7 @@ void machine_power_off(void)
 
         /* prevent soft lockup/stalled CPU messages for endless loop. */
         rcu_sysrq_start();
-        lockup_detector_suspend();
+        lockup_detector_soft_poweroff();
         for (;;);
 }
 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 23de307c3052..41e60a9c7db2 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -742,7 +742,7 @@ lws_compare_and_swap_2:
 10:     ldd     0(%r25), %r25
 11:     ldd     0(%r24), %r24
 #else
-        /* Load new value into r22/r23 - high/low */
+        /* Load old value into r22/r23 - high/low */
 10:     ldw     0(%r25), %r22
 11:     ldw     4(%r25), %r23
         /* Load new value into fr4 for atomic store later */
@@ -834,11 +834,11 @@ cas2_action:
         copy    %r0, %r28
 #else
         /* Compare first word */
-19:     ldw,ma  0(%r26), %r29
+19:     ldw     0(%r26), %r29
         sub,=   %r29, %r22, %r0
         b,n     cas2_end
         /* Compare second word */
-20:     ldw,ma  4(%r26), %r29
+20:     ldw     4(%r26), %r29
         sub,=   %r29, %r23, %r0
         b,n     cas2_end
         /* Perform the store */
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 2d956aa0a38a..8c0105a49839 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -253,7 +253,10 @@ static int __init init_cr16_clocksource(void)
                 cpu0_loc = per_cpu(cpu_data, 0).cpu_loc;
 
                 for_each_online_cpu(cpu) {
-                        if (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc)
+                        if (cpu == 0)
+                                continue;
+                        if ((cpu0_loc != 0) &&
+                            (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc))
                                 continue;
 
                         clocksource_cr16.name = "cr16_unstable";
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 1df770e8cbe0..7275fed271af 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -102,10 +102,10 @@ static void cpufeatures_flush_tlb(void)
         case PVR_POWER8:
         case PVR_POWER8E:
         case PVR_POWER8NVL:
-                __flush_tlb_power8(POWER8_TLB_SETS);
+                __flush_tlb_power8(TLB_INVAL_SCOPE_GLOBAL);
                 break;
         case PVR_POWER9:
-                __flush_tlb_power9(POWER9_TLB_SETS_HASH);
+                __flush_tlb_power9(TLB_INVAL_SCOPE_GLOBAL);
                 break;
         default:
                 pr_err("unknown CPU version for boot TLB flush\n");
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 48da0f5d2f7f..b82586c53560 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -734,7 +734,29 @@ EXC_REAL(program_check, 0x700, 0x100)
 EXC_VIRT(program_check, 0x4700, 0x100, 0x700)
 TRAMP_KVM(PACA_EXGEN, 0x700)
 EXC_COMMON_BEGIN(program_check_common)
-        EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
+        /*
+         * It's possible to receive a TM Bad Thing type program check with
+         * userspace register values (in particular r1), but with SRR1 reporting
+         * that we came from the kernel. Normally that would confuse the bad
+         * stack logic, and we would report a bad kernel stack pointer. Instead
+         * we switch to the emergency stack if we're taking a TM Bad Thing from
+         * the kernel.
+         */
+        li      r10,MSR_PR              /* Build a mask of MSR_PR ..    */
+        oris    r10,r10,0x200000@h      /* .. and SRR1_PROGTM           */
+        and     r10,r10,r12             /* Mask SRR1 with that.         */
+        srdi    r10,r10,8               /* Shift it so we can compare   */
+        cmpldi  r10,(0x200000 >> 8)     /* .. with an immediate.        */
+        bne 1f                          /* If != go to normal path.     */
+
+        /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack  */
+        andi.   r10,r12,MSR_PR;         /* Set CR0 correctly for label  */
+                                        /* 3 in EXCEPTION_PROLOG_COMMON */
+        mr      r10,r1                  /* Save r1                      */
+        ld      r1,PACAEMERGSP(r13)     /* Use emergency stack          */
+        subi    r1,r1,INT_FRAME_SIZE    /* alloc stack frame            */
+        b 3f                            /* Jump into the macro !!       */
+1:      EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
         addi    r3,r1,STACK_FRAME_OVERHEAD
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index b76ca198e09c..72f153c6f3fa 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -624,5 +624,18 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
 
 long __machine_check_early_realmode_p9(struct pt_regs *regs)
 {
+        /*
+         * On POWER9 DD2.1 and below, it's possible to get a machine check
+         * caused by a paste instruction where only DSISR bit 25 is set. This
+         * will result in the MCE handler seeing an unknown event and the kernel
+         * crashing. An MCE that occurs like this is spurious, so we don't need
+         * to do anything in terms of servicing it. If there is something that
+         * needs to be serviced, the CPU will raise the MCE again with the
+         * correct DSISR so that it can be serviced properly. So detect this
+         * case and mark it as handled.
+         */
+        if (SRR1_MC_LOADSTORE(regs->msr) && regs->dsisr == 0x02000000)
+                return 1;
+
         return mce_handle_error(regs, mce_p9_derror_table, mce_p9_ierror_table);
 }
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 0ac741fae90e..2e3bc16d02b2 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -904,9 +904,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 #endif
 
-#ifdef CONFIG_PPC_64K_PAGES
-        init_mm.context.pte_frag = NULL;
-#endif
 #ifdef CONFIG_SPAPR_TCE_IOMMU
         mm_iommu_init(&init_mm);
 #endif
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index c83c115858c1..b2c002993d78 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
         if (MSR_TM_RESV(msr))
                 return -EINVAL;
 
-        /* pull in MSR TM from user context */
+        /* pull in MSR TS bits from user context */
         regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
 
+        /*
+         * Ensure that TM is enabled in regs->msr before we leave the signal
+         * handler. It could be the case that (a) user disabled the TM bit
+         * through the manipulation of the MSR bits in uc_mcontext or (b) the
+         * TM bit was disabled because a sufficient number of context switches
+         * happened whilst in the signal handler and load_tm overflowed,
+         * disabling the TM bit. In either case we can end up with an illegal
+         * TM state leading to a TM Bad Thing when we return to userspace.
+         */
+        regs->msr |= MSR_TM;
+
         /* pull in MSR LE from user context */
         regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
 
diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index c98e90b4ea7b..b4e2b7165f79 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -181,34 +181,25 @@ _GLOBAL(ftrace_stub)
          *  - we have no stack frame and can not allocate one
          *  - LR points back to the original caller (in A)
          *  - CTR holds the new NIP in C
-         *  - r0 & r12 are free
-         *
-         * r0 can't be used as the base register for a DS-form load or store, so
-         * we temporarily shuffle r1 (stack pointer) into r0 and then put it back.
+         *  - r0, r11 & r12 are free
          */
 livepatch_handler:
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
         /* Allocate 3 x 8 bytes */
-        ld      r1, TI_livepatch_sp(r12)
-        addi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
+        addi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Save toc & real LR on livepatch stack */
-        std     r2,  -24(r1)
+        std     r2,  -24(r11)
         mflr    r12
-        std     r12, -16(r1)
+        std     r12, -16(r11)
 
         /* Store stack end marker */
         lis     r12, STACK_END_MAGIC@h
         ori     r12, r12, STACK_END_MAGIC@l
-        std     r12, -8(r1)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        std     r12, -8(r11)
 
         /* Put ctr in r12 for global entry and branch there */
         mfctr   r12
@@ -216,36 +207,30 @@ livepatch_handler:
 
         /*
          * Now we are returning from the patched function to the original
-         * caller A. We are free to use r0 and r12, and we can use r2 until we
+         * caller A. We are free to use r11, r12 and we can use r2 until we
          * restore it.
          */
 
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
-        ld      r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
 
         /* Check stack marker hasn't been trashed */
         lis     r2,  STACK_END_MAGIC@h
         ori     r2,  r2, STACK_END_MAGIC@l
-        ld      r12, -8(r1)
+        ld      r12, -8(r11)
 1:      tdne    r12, r2
         EMIT_BUG_ENTRY 1b, __FILE__, __LINE__ - 1, 0
 
         /* Restore LR & toc from livepatch stack */
-        ld      r12, -16(r1)
+        ld      r12, -16(r11)
         mtlr    r12
-        ld      r2,  -24(r1)
+        ld      r2,  -24(r11)
 
         /* Pop livepatch stack frame */
-        CURRENT_THREAD_INFO(r12, r0)
-        subi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        CURRENT_THREAD_INFO(r12, r1)
+        subi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Return to original caller of live patched function */
         blr
diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
index 2f6eadd9408d..c702a8981452 100644
--- a/arch/powerpc/kernel/watchdog.c
+++ b/arch/powerpc/kernel/watchdog.c
@@ -310,9 +310,6 @@ static int start_wd_on_cpu(unsigned int cpu)
         if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
                 return 0;
 
-        if (watchdog_suspended)
-                return 0;
-
         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
                 return 0;
 
@@ -358,36 +355,39 @@ static void watchdog_calc_timeouts(void)
         wd_timer_period_ms = watchdog_thresh * 1000 * 2 / 5;
 }
 
-void watchdog_nmi_reconfigure(void)
+void watchdog_nmi_stop(void)
 {
         int cpu;
 
-        watchdog_calc_timeouts();
-
         for_each_cpu(cpu, &wd_cpus_enabled)
                 stop_wd_on_cpu(cpu);
+}
 
+void watchdog_nmi_start(void)
+{
+        int cpu;
+
+        watchdog_calc_timeouts();
         for_each_cpu_and(cpu, cpu_online_mask, &watchdog_cpumask)
                 start_wd_on_cpu(cpu);
 }
 
 /*
- * This runs after lockup_detector_init() which sets up watchdog_cpumask.
+ * Invoked from core watchdog init.
  */
-static int __init powerpc_watchdog_init(void)
+int __init watchdog_nmi_probe(void)
 {
         int err;
 
-        watchdog_calc_timeouts();
-
-        err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "powerpc/watchdog:online",
-                                start_wd_on_cpu, stop_wd_on_cpu);
-        if (err < 0)
+        err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
+                                        "powerpc/watchdog:online",
+                                        start_wd_on_cpu, stop_wd_on_cpu);
+        if (err < 0) {
                 pr_warn("Watchdog could not be initialized");
-
+                return err;
+        }
         return 0;
 }
-arch_initcall(powerpc_watchdog_init);
 
 static void handle_backtrace_ipi(struct pt_regs *regs)
 {
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index 8f2da8bba737..4dffa611376d 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -478,28 +478,30 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
                 return ret;
 
         dir = iommu_tce_direction(tce);
+
+        idx = srcu_read_lock(&vcpu->kvm->srcu);
+
         if ((dir != DMA_NONE) && kvmppc_gpa_to_ua(vcpu->kvm,
-                        tce & ~(TCE_PCI_READ | TCE_PCI_WRITE), &ua, NULL))
-                return H_PARAMETER;
+                        tce & ~(TCE_PCI_READ | TCE_PCI_WRITE), &ua, NULL)) {
+                ret = H_PARAMETER;
+                goto unlock_exit;
+        }
 
         entry = ioba >> stt->page_shift;
 
         list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
-                if (dir == DMA_NONE) {
+                if (dir == DMA_NONE)
                         ret = kvmppc_tce_iommu_unmap(vcpu->kvm,
                                         stit->tbl, entry);
-                } else {
-                        idx = srcu_read_lock(&vcpu->kvm->srcu);
+                else
                         ret = kvmppc_tce_iommu_map(vcpu->kvm, stit->tbl,
                                         entry, ua, dir);
-                        srcu_read_unlock(&vcpu->kvm->srcu, idx);
-                }
 
                 if (ret == H_SUCCESS)
                         continue;
 
                 if (ret == H_TOO_HARD)
-                        return ret;
+                        goto unlock_exit;
 
                 WARN_ON_ONCE(1);
                 kvmppc_clear_tce(stit->tbl, entry);
@@ -507,7 +509,10 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
 
         kvmppc_tce_put(stt, entry, tce);
 
-        return H_SUCCESS;
+unlock_exit:
+        srcu_read_unlock(&vcpu->kvm->srcu, idx);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(kvmppc_h_put_tce);
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 17936f82d3c7..42639fba89e8 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -989,13 +989,14 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
         beq     no_xive
         ld      r11, VCPU_XIVE_SAVED_STATE(r4)
         li      r9, TM_QW1_OS
-        stdcix  r11,r9,r10
         eieio
+        stdcix  r11,r9,r10
         lwz     r11, VCPU_XIVE_CAM_WORD(r4)
         li      r9, TM_QW1_OS + TM_WORD2
         stwcix  r11,r9,r10
         li      r9, 1
         stw     r9, VCPU_XIVE_PUSHED(r4)
+        eieio
 no_xive:
 #endif /* CONFIG_KVM_XICS */
 
@@ -1121,6 +1122,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 BEGIN_FTR_SECTION
         mtspr   SPRN_PPR, r0
 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+
+/* Move canary into DSISR to check for later */
+BEGIN_FTR_SECTION
+        li      r0, 0x7fff
+        mtspr   SPRN_HDSISR, r0
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
         ld      r0, VCPU_GPR(R0)(r4)
         ld      r4, VCPU_GPR(R4)(r4)
 
@@ -1303,6 +1311,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         bne     3f
 BEGIN_FTR_SECTION
         PPC_MSGSYNC
+        lwsync
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         lbz     r0, HSTATE_HOST_IPI(r13)
         cmpwi   r0, 0
@@ -1393,8 +1402,8 @@ guest_exit_cont:		/* r9 = vcpu, r12 = trap, r13 = paca */
         cmpldi  cr0, r10, 0
         beq     1f
         /* First load to pull the context, we ignore the value */
-        lwzx    r11, r7, r10
         eieio
+        lwzx    r11, r7, r10
         /* Second load to recover the context state (Words 0 and 1) */
         ldx     r11, r6, r10
         b       3f
@@ -1402,8 +1411,8 @@ guest_exit_cont:		/* r9 = vcpu, r12 = trap, r13 = paca */
         cmpldi  cr0, r10, 0
         beq     1f
         /* First load to pull the context, we ignore the value */
-        lwzcix  r11, r7, r10
         eieio
+        lwzcix  r11, r7, r10
         /* Second load to recover the context state (Words 0 and 1) */
         ldcix   r11, r6, r10
 3:      std     r11, VCPU_XIVE_SAVED_STATE(r9)
@@ -1413,6 +1422,7 @@ guest_exit_cont:		/* r9 = vcpu, r12 = trap, r13 = paca */
         stw     r10, VCPU_XIVE_PUSHED(r9)
         stb     r10, (VCPU_XIVE_SAVED_STATE+3)(r9)
         stb     r0, (VCPU_XIVE_SAVED_STATE+4)(r9)
+        eieio
 1:
 #endif /* CONFIG_KVM_XICS */
         /* Save more register state  */
@@ -1956,9 +1966,14 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
 kvmppc_hdsi:
         ld      r3, VCPU_KVM(r9)
         lbz     r0, KVM_RADIX(r3)
-        cmpwi   r0, 0
         mfspr   r4, SPRN_HDAR
         mfspr   r6, SPRN_HDSISR
+BEGIN_FTR_SECTION
+        /* Look for DSISR canary. If we find it, retry instruction */
+        cmpdi   r6, 0x7fff
+        beq     6f
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+        cmpwi   r0, 0
         bne     .Lradix_hdsi            /* on radix, just save DAR/DSISR/ASDR */
         /* HPTE not found fault or protection fault? */
         andis.  r0, r6, (DSISR_NOHPTE | DSISR_PROTFAULT)@h
@@ -2776,6 +2791,10 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
         PPC_MSGCLR(6)
         /* see if it's a host IPI */
         li      r3, 1
+BEGIN_FTR_SECTION
+        PPC_MSGSYNC
+        lwsync
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         lbz     r0, HSTATE_HOST_IPI(r13)
         cmpwi   r0, 0
         bnelr
diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
index 13304622ab1c..bf457843e032 100644
--- a/arch/powerpc/kvm/book3s_xive.c
+++ b/arch/powerpc/kvm/book3s_xive.c
@@ -622,7 +622,7 @@ int kvmppc_xive_get_xive(struct kvm *kvm, u32 irq, u32 *server,
                 return -EINVAL;
         state = &sb->irq_state[idx];
         arch_spin_lock(&sb->lock);
-        *server = state->guest_server;
+        *server = state->act_server;
         *priority = state->guest_priority;
         arch_spin_unlock(&sb->lock);
 
@@ -1331,7 +1331,7 @@ static int xive_get_source(struct kvmppc_xive *xive, long irq, u64 addr)
         xive->saved_src_count++;
 
         /* Convert saved state into something compatible with xics */
-        val = state->guest_server;
+        val = state->act_server;
         prio = state->saved_scan_prio;
 
         if (prio == MASKED) {
@@ -1507,7 +1507,6 @@ static int xive_set_source(struct kvmppc_xive *xive, long irq, u64 addr)
         /* First convert prio and mark interrupt as untargetted */
         act_prio = xive_prio_from_guest(guest_prio);
         state->act_priority = MASKED;
-        state->guest_server = server;
 
         /*
          * We need to drop the lock due to the mutex below. Hopefully
diff --git a/arch/powerpc/kvm/book3s_xive.h b/arch/powerpc/kvm/book3s_xive.h
index 5938f7644dc1..6ba63f8e8a61 100644
--- a/arch/powerpc/kvm/book3s_xive.h
+++ b/arch/powerpc/kvm/book3s_xive.h
@@ -35,7 +35,6 @@ struct kvmppc_xive_irq_state {
         struct xive_irq_data *pt_data;  /* XIVE Pass-through associated data */
 
         /* Targetting as set by guest */
-        u32 guest_server;               /* Current guest selected target */
         u8 guest_priority;              /* Guest set priority */
         u8 saved_priority;              /* Saved priority when masking */
 
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 3480faaf1ef8..ee279c7f4802 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -644,8 +644,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
                 break;
 #endif
         case KVM_CAP_PPC_HTM:
-                r = cpu_has_feature(CPU_FTR_TM_COMP) &&
-                    is_kvmppc_hv_enabled(kvm);
+                r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled;
                 break;
         default:
                 r = 0;
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 5e8418c28bd8..f208f560aecd 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1684,11 +1684,13 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
  * Logical instructions
  */
                 case 26:        /* cntlzw */
-                        op->val = __builtin_clz((unsigned int) regs->gpr[rd]);
+                        val = (unsigned int) regs->gpr[rd];
+                        op->val = ( val ? __builtin_clz(val) : 32 );
                         goto logical_done;
 #ifdef __powerpc64__
                 case 58:        /* cntlzd */
-                        op->val = __builtin_clzl(regs->gpr[rd]);
+                        val = regs->gpr[rd];
+                        op->val = ( val ? __builtin_clzl(val) : 64 );
                         goto logical_done;
 #endif
                 case 28:        /* and */
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index b95c584ce19d..a51df9ef529d 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1438,7 +1438,6 @@ out:
 
 int arch_update_cpu_topology(void)
 {
-        lockdep_assert_cpus_held();
         return numa_update_cpu_topology(true);
 }
 
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 65eda1997c3f..f6c7f54c0515 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -361,9 +361,9 @@ static int change_page_attr(struct page *page, int numpages, pgprot_t prot)
                         break;
         }
         wmb();
+        local_irq_restore(flags);
         flush_tlb_kernel_range((unsigned long)page_address(start),
                                (unsigned long)page_address(page));
-        local_irq_restore(flags);
         return err;
 }
 
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 9ccac86f3463..88126245881b 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -399,6 +399,20 @@ static void nest_imc_counters_release(struct perf_event *event)
 
         /* Take the mutex lock for this node and then decrement the reference count */
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given node.
+                 *
+                 * In the cpuhotplug offline path, ppc_nest_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given node and make
+                 * an OPAL call to disable the engine in that node.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
@@ -523,8 +537,8 @@ static int core_imc_mem_init(int cpu, int size)
 
         /* We need only vbase for core counters */
         mem_info->vbase = page_address(alloc_pages_node(phys_id,
-                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                          get_order(size)));
+                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                          __GFP_NOWARN, get_order(size)));
         if (!mem_info->vbase)
                 return -ENOMEM;
 
@@ -646,6 +660,20 @@ static void core_imc_counters_release(struct perf_event *event)
                 return;
 
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given core.
+                 *
+                 * In the cpuhotplug offline path, ppc_core_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given core and make
+                 * an OPAL call to disable the engine in that core.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_CORE,
@@ -763,8 +791,8 @@ static int thread_imc_mem_alloc(int cpu_id, int size)
                  * free the memory in cpu offline path.
                  */
                 local_mem = page_address(alloc_pages_node(phys_id,
-                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                  get_order(size)));
+                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                  __GFP_NOWARN, get_order(size)));
                 if (!local_mem)
                         return -ENOMEM;
 
@@ -1148,7 +1176,8 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr)
         }
 
         /* Only free the attr_groups which are dynamically allocated  */
-        kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
+        if (pmu_ptr->attr_groups[IMC_EVENT_ATTR])
+                kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
         kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]);
         kfree(pmu_ptr);
         return;
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 897aa1400eb8..bbb73aa0eb8f 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -272,7 +272,15 @@ static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)
 #ifdef CONFIG_MEMORY_HOTPLUG_SPARSE
 static unsigned long pnv_memory_block_size(void)
 {
-        return 256UL * 1024 * 1024;
+        /*
+         * We map the kernel linear region with 1GB large pages on radix. For
+         * memory hot unplug to work our memory block size must be at least
+         * this size.
+         */
+        if (radix_enabled())
+                return 1UL * 1024 * 1024 * 1024;
+        else
+                return 256UL * 1024 * 1024;
 }
 #endif
 
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 9234be1e66f5..5011ffea4e4b 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -71,6 +71,8 @@
 #define RIWAR_WRTYP_ALLOC       0x00006000
 #define RIWAR_SIZE_MASK         0x0000003F
 
+static DEFINE_SPINLOCK(fsl_rio_config_lock);
+
 #define __fsl_read_rio_config(x, addr, err, op)         \
         __asm__ __volatile__(                           \
                 "1:     "op" %1,0(%2)\n"                \
@@ -184,6 +186,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                         u8 hopcount, u32 offset, int len, u32 *val)
 {
         struct rio_priv *priv = mport->priv;
+        unsigned long flags;
         u8 *data;
         u32 rval, err = 0;
 
@@ -197,6 +200,8 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
         if (offset > (0x1000000 - len) || !IS_ALIGNED(offset, len))
                 return -EINVAL;
 
+        spin_lock_irqsave(&fsl_rio_config_lock, flags);
+
         out_be32(&priv->maint_atmu_regs->rowtar,
                  (destid << 22) | (hopcount << 12) | (offset >> 12));
         out_be32(&priv->maint_atmu_regs->rowtear, (destid >> 10));
@@ -213,6 +218,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                 __fsl_read_rio_config(rval, data, err, "lwz");
                 break;
         default:
+                spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
                 return -EINVAL;
         }
 
@@ -221,6 +227,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                          err, destid, hopcount, offset);
         }
 
+        spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
         *val = rval;
 
         return err;
@@ -244,7 +251,10 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
                         u8 hopcount, u32 offset, int len, u32 val)
 {
         struct rio_priv *priv = mport->priv;
+        unsigned long flags;
         u8 *data;
+        int ret = 0;
+
         pr_debug
                 ("fsl_rio_config_write:"
                 " index %d destid %d hopcount %d offset %8.8x len %d val %8.8x\n",
@@ -255,6 +265,8 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
         if (offset > (0x1000000 - len) || !IS_ALIGNED(offset, len))
                 return -EINVAL;
 
+        spin_lock_irqsave(&fsl_rio_config_lock, flags);
+
         out_be32(&priv->maint_atmu_regs->rowtar,
                  (destid << 22) | (hopcount << 12) | (offset >> 12));
         out_be32(&priv->maint_atmu_regs->rowtear, (destid >> 10));
@@ -271,10 +283,11 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
                 out_be32((u32 *) data, val);
                 break;
         default:
-                return -EINVAL;
+                ret = -EINVAL;
         }
+        spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
 
-        return 0;
+        return ret;
 }
 
 static void fsl_rio_inbound_mem_init(struct rio_priv *priv)
diff --git a/arch/powerpc/sysdev/fsl_rmu.c b/arch/powerpc/sysdev/fsl_rmu.c
index ab7a74c75be8..88b35a3dcdc5 100644
--- a/arch/powerpc/sysdev/fsl_rmu.c
+++ b/arch/powerpc/sysdev/fsl_rmu.c
@@ -104,6 +104,8 @@
 
 #define DOORBELL_MESSAGE_SIZE   0x08
 
+static DEFINE_SPINLOCK(fsl_rio_doorbell_lock);
+
 struct rio_msg_regs {
         u32 omr;
         u32 osr;
@@ -626,9 +628,13 @@ err_out:
 int fsl_rio_doorbell_send(struct rio_mport *mport,
                                 int index, u16 destid, u16 data)
 {
+        unsigned long flags;
+
         pr_debug("fsl_doorbell_send: index %d destid %4.4x data %4.4x\n",
                  index, destid, data);
 
+        spin_lock_irqsave(&fsl_rio_doorbell_lock, flags);
+
         /* In the serial version silicons, such as MPC8548, MPC8641,
          * below operations is must be.
          */
@@ -638,6 +644,8 @@ int fsl_rio_doorbell_send(struct rio_mport *mport,
         out_be32(&dbell->dbell_regs->oddatr, (index << 20) | data);
         out_be32(&dbell->dbell_regs->odmr, 0x00000001);
 
+        spin_unlock_irqrestore(&fsl_rio_doorbell_lock, flags);
+
         return 0;
 }
 
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index f387318678b9..a3b8d7d1316e 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1402,6 +1402,14 @@ void xive_teardown_cpu(void)
 
         if (xive_ops->teardown_cpu)
                 xive_ops->teardown_cpu(cpu, xc);
+
+#ifdef CONFIG_SMP
+        /* Get rid of IPI */
+        xive_cleanup_cpu_ipi(cpu, xc);
+#endif
+
+        /* Disable and free the queues */
+        xive_cleanup_cpu_queues(cpu, xc);
 }
 
 void xive_kexec_teardown_cpu(int secondary)
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index f24a70bc6855..d9c4c9366049 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -431,7 +431,11 @@ static int xive_spapr_get_ipi(unsigned int cpu, struct xive_cpu *xc)
 
 static void xive_spapr_put_ipi(unsigned int cpu, struct xive_cpu *xc)
 {
+        if (!xc->hw_ipi)
+                return;
+
         xive_irq_bitmap_free(xc->hw_ipi);
+        xc->hw_ipi = 0;
 }
 #endif /* CONFIG_SMP */
 
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index afa46a7406ea..04e042edbab7 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -27,6 +27,7 @@ CONFIG_NET=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_BLK_DEV_RAM=y
 # CONFIG_BLK_DEV_XPRAM is not set
 # CONFIG_DCSSBLK is not set
 # CONFIG_DASD is not set
@@ -59,6 +60,7 @@ CONFIG_CONFIGFS_FS=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 21900e1cee9c..d185aa3965bf 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -521,12 +521,15 @@ ENTRY(pgm_check_handler)
         tmhh    %r8,0x0001              # test problem state bit
         jnz     2f                      # -> fault in user space
 #if IS_ENABLED(CONFIG_KVM)
-        # cleanup critical section for sie64a
+        # cleanup critical section for program checks in sie64a
         lgr     %r14,%r9
         slg     %r14,BASED(.Lsie_critical_start)
         clg     %r14,BASED(.Lsie_critical_length)
         jhe     0f
-        brasl   %r14,.Lcleanup_sie
+        lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
+        ni      __SIE_PROG0C+3(%r14),0xfe       # no longer in SIE
+        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
+        larl    %r9,sie_exit                    # skip forward to sie_exit
 #endif
 0:      tmhh    %r8,0x4000              # PER bit set in old PSW ?
         jnz     1f                      # -> enabled, can't be a double fault
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 1cee6753d47a..495ff6959dec 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -293,7 +293,10 @@ static void pcpu_attach_task(struct pcpu *pcpu, struct task_struct *tsk)
         lc->lpp = LPP_MAGIC;
         lc->current_pid = tsk->pid;
         lc->user_timer = tsk->thread.user_timer;
+        lc->guest_timer = tsk->thread.guest_timer;
         lc->system_timer = tsk->thread.system_timer;
+        lc->hardirq_timer = tsk->thread.hardirq_timer;
+        lc->softirq_timer = tsk->thread.softirq_timer;
         lc->steal_timer = 0;
 }
 
diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7264.h b/arch/sh/include/cpu-sh2a/cpu/sh7264.h
index 4d1ef6d74bd6..2ae0e938b657 100644
--- a/arch/sh/include/cpu-sh2a/cpu/sh7264.h
+++ b/arch/sh/include/cpu-sh2a/cpu/sh7264.h
@@ -43,9 +43,7 @@ enum {
         GPIO_PG7, GPIO_PG6, GPIO_PG5, GPIO_PG4,
         GPIO_PG3, GPIO_PG2, GPIO_PG1, GPIO_PG0,
 
-        /* Port H */
-        GPIO_PH7, GPIO_PH6, GPIO_PH5, GPIO_PH4,
-        GPIO_PH3, GPIO_PH2, GPIO_PH1, GPIO_PH0,
+        /* Port H - Port H does not have a Data Register */
 
         /* Port I - not on device */
 
diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
index 2a0ca8780f0d..13c495a9fc00 100644
--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
@@ -45,9 +45,7 @@ enum {
         GPIO_PG7, GPIO_PG6, GPIO_PG5, GPIO_PG4,
         GPIO_PG3, GPIO_PG2, GPIO_PG1, GPIO_PG0,
 
-        /* Port H */
-        GPIO_PH7, GPIO_PH6, GPIO_PH5, GPIO_PH4,
-        GPIO_PH3, GPIO_PH2, GPIO_PH1, GPIO_PH0,
+        /* Port H - Port H does not have a Data Register */
 
         /* Port I - not on device */
 
diff --git a/arch/sh/include/cpu-sh4/cpu/sh7722.h b/arch/sh/include/cpu-sh4/cpu/sh7722.h
index 3bb74e534d0f..78961ab78a5a 100644
--- a/arch/sh/include/cpu-sh4/cpu/sh7722.h
+++ b/arch/sh/include/cpu-sh4/cpu/sh7722.h
@@ -67,7 +67,7 @@ enum {
         GPIO_PTN3, GPIO_PTN2, GPIO_PTN1, GPIO_PTN0,
 
         /* PTQ */
-        GPIO_PTQ7, GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
+        GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
         GPIO_PTQ3, GPIO_PTQ2, GPIO_PTQ1, GPIO_PTQ0,
 
         /* PTR */
diff --git a/arch/sh/include/cpu-sh4/cpu/sh7757.h b/arch/sh/include/cpu-sh4/cpu/sh7757.h
index 5340f3bc1863..b40fb541e72a 100644
--- a/arch/sh/include/cpu-sh4/cpu/sh7757.h
+++ b/arch/sh/include/cpu-sh4/cpu/sh7757.h
@@ -40,7 +40,7 @@ enum {
 
         /* PTJ */
         GPIO_PTJ0, GPIO_PTJ1, GPIO_PTJ2, GPIO_PTJ3,
-        GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6, GPIO_PTJ7_RESV,
+        GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6,
 
         /* PTK */
         GPIO_PTK0, GPIO_PTK1, GPIO_PTK2, GPIO_PTK3,
@@ -48,7 +48,7 @@ enum {
 
         /* PTL */
         GPIO_PTL0, GPIO_PTL1, GPIO_PTL2, GPIO_PTL3,
-        GPIO_PTL4, GPIO_PTL5, GPIO_PTL6, GPIO_PTL7_RESV,
+        GPIO_PTL4, GPIO_PTL5, GPIO_PTL6,
 
         /* PTM */
         GPIO_PTM0, GPIO_PTM1, GPIO_PTM2, GPIO_PTM3,
@@ -56,7 +56,7 @@ enum {
 
         /* PTN */
         GPIO_PTN0, GPIO_PTN1, GPIO_PTN2, GPIO_PTN3,
-        GPIO_PTN4, GPIO_PTN5, GPIO_PTN6, GPIO_PTN7_RESV,
+        GPIO_PTN4, GPIO_PTN5, GPIO_PTN6,
 
         /* PTO */
         GPIO_PTO0, GPIO_PTO1, GPIO_PTO2, GPIO_PTO3,
@@ -68,7 +68,7 @@ enum {
 
         /* PTQ */
         GPIO_PTQ0, GPIO_PTQ1, GPIO_PTQ2, GPIO_PTQ3,
-        GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6, GPIO_PTQ7_RESV,
+        GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6,
 
         /* PTR */
         GPIO_PTR0, GPIO_PTR1, GPIO_PTR2, GPIO_PTR3,
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 0be3828752e5..4e83f950713e 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -44,7 +44,6 @@ config SPARC
         select ARCH_HAS_SG_CHAIN
         select CPU_NO_EFFICIENT_FFS
         select LOCKDEP_SMALL if LOCKDEP
-        select ARCH_WANT_RELAX_ORDER
 
 config SPARC32
         def_bool !64BIT
diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
index 0b034ebbda2a..7f69d17de354 100644
--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@@ -98,7 +98,7 @@ static struct clocksource timer_clocksource = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-static void __init timer_setup(void)
+static void __init um_timer_setup(void)
 {
         int err;
 
@@ -132,5 +132,5 @@ void read_persistent_clock(struct timespec *ts)
 void __init time_init(void)
 {
         timer_set_signal_handler();
-        late_time_init = timer_setup;
+        late_time_init = um_timer_setup;
 }
diff --git a/arch/x86/crypto/chacha20-avx2-x86_64.S b/arch/x86/crypto/chacha20-avx2-x86_64.S
index 3a2dc3dc6cac..f3cd26f48332 100644
--- a/arch/x86/crypto/chacha20-avx2-x86_64.S
+++ b/arch/x86/crypto/chacha20-avx2-x86_64.S
@@ -45,7 +45,7 @@ ENTRY(chacha20_8block_xor_avx2)
 
         vzeroupper
         # 4 * 32 byte stack, 32-byte aligned
-        mov             %rsp, %r8
+        lea             8(%rsp),%r10
         and             $~31, %rsp
         sub             $0x80, %rsp
 
@@ -443,6 +443,6 @@ ENTRY(chacha20_8block_xor_avx2)
         vmovdqu         %ymm15,0x01e0(%rsi)
 
         vzeroupper
-        mov             %r8,%rsp
+        lea             -8(%r10),%rsp
         ret
 ENDPROC(chacha20_8block_xor_avx2)
diff --git a/arch/x86/crypto/chacha20-ssse3-x86_64.S b/arch/x86/crypto/chacha20-ssse3-x86_64.S
index 3f511a7d73b8..512a2b500fd1 100644
--- a/arch/x86/crypto/chacha20-ssse3-x86_64.S
+++ b/arch/x86/crypto/chacha20-ssse3-x86_64.S
@@ -160,7 +160,7 @@ ENTRY(chacha20_4block_xor_ssse3)
         # done with the slightly better performing SSSE3 byte shuffling,
         # 7/12-bit word rotation uses traditional shift+OR.
 
-        mov             %rsp,%r11
+        lea             8(%rsp),%r10
         sub             $0x80,%rsp
         and             $~63,%rsp
 
@@ -625,6 +625,6 @@ ENTRY(chacha20_4block_xor_ssse3)
         pxor            %xmm1,%xmm15
         movdqu          %xmm15,0xf0(%rsi)
 
-        mov             %r11,%rsp
+        lea             -8(%r10),%rsp
         ret
 ENDPROC(chacha20_4block_xor_ssse3)
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 8a13d468635a..50e0d2bc4528 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -176,7 +176,7 @@
 /*
  * This is a sneaky trick to help the unwinder find pt_regs on the stack.  The
  * frame pointer is replaced with an encoded pointer to pt_regs.  The encoding
- * is just setting the LSB, which makes it an invalid stack address and is also
+ * is just clearing the MSB, which makes it an invalid stack address and is also
  * a signal to the unwinder that it's a pt_regs pointer in disguise.
  *
  * NOTE: This macro must be used *after* SAVE_ALL because it corrupts the
@@ -185,7 +185,7 @@
 .macro ENCODE_FRAME_POINTER
 #ifdef CONFIG_FRAME_POINTER
         mov %esp, %ebp
-        orl $0x1, %ebp
+        andl $0x7fffffff, %ebp
 #endif
 .endm
 
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 49167258d587..f6cdb7a1455e 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -808,7 +808,7 @@ apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
 
 .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
 ENTRY(\sym)
-        UNWIND_HINT_IRET_REGS offset=8
+        UNWIND_HINT_IRET_REGS offset=\has_error_code*8
 
         /* Sanity check */
         .if \shift_ist != -1 && \paranoid == 0
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 16076eb34699..141e07b06216 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -546,9 +546,6 @@ static int bts_event_init(struct perf_event *event)
         if (event->attr.type != bts_pmu.type)
                 return -ENOENT;
 
-        if (x86_add_exclusive(x86_lbr_exclusive_bts))
-                return -EBUSY;
-
         /*
          * BTS leaks kernel addresses even when CPL0 tracing is
          * disabled, so disallow intel_bts driver for unprivileged
@@ -562,6 +559,9 @@ static int bts_event_init(struct perf_event *event)
             !capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        if (x86_add_exclusive(x86_lbr_exclusive_bts))
+                return -EBUSY;
+
         ret = x86_reserve_hardware();
         if (ret) {
                 x86_del_exclusive(x86_lbr_exclusive_bts);
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 829e89cfcee2..9fb9a1f1e47b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4409,10 +4409,9 @@ static __init int fixup_ht_bug(void)
                 return 0;
         }
 
-        if (lockup_detector_suspend() != 0) {
-                pr_debug("failed to disable PMU erratum BJ122, BV98, HSD29 workaround\n");
-                return 0;
-        }
+        cpus_read_lock();
+
+        hardlockup_detector_perf_stop();
 
         x86_pmu.flags &= ~(PMU_FL_EXCL_CNTRS | PMU_FL_EXCL_ENABLED);
 
@@ -4420,9 +4419,7 @@ static __init int fixup_ht_bug(void)
         x86_pmu.commit_scheduling = NULL;
         x86_pmu.stop_scheduling = NULL;
 
-        lockup_detector_resume();
-
-        cpus_read_lock();
+        hardlockup_detector_perf_restart();
 
         for_each_online_cpu(c)
                 free_excl_cntrs(c);
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 4cf100ff2a37..72db0664a53d 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -552,6 +552,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
 
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_MOBILE,  snb_cstates),
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_X, snb_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE,  snb_cstates),
         X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, snb_cstates),
@@ -560,6 +561,9 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
         X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNM, knl_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT, glm_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_ATOM_DENVERTON, glm_cstates),
+
+        X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GEMINI_LAKE, glm_cstates),
         { },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 8e2457cb6b4a..005908ee9333 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -775,6 +775,9 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_KABYLAKE_DESKTOP, skl_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT, hsw_rapl_init),
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_DENVERTON, hsw_rapl_init),
+
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GEMINI_LAKE, hsw_rapl_init),
         {},
 };
 
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 1c5390f1cf09..d45e06346f14 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -822,7 +822,7 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
                 pmus[i].type    = type;
                 pmus[i].boxes   = kzalloc(size, GFP_KERNEL);
                 if (!pmus[i].boxes)
-                        return -ENOMEM;
+                        goto err;
         }
 
         type->pmus = pmus;
@@ -836,7 +836,7 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
                 attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
                                         sizeof(*attr_group), GFP_KERNEL);
                 if (!attr_group)
-                        return -ENOMEM;
+                        goto err;
 
                 attrs = (struct attribute **)(attr_group + 1);
                 attr_group->name = "events";
@@ -849,7 +849,15 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
         }
 
         type->pmu_group = &uncore_pmu_attr_group;
+
         return 0;
+
+err:
+        for (i = 0; i < type->num_boxes; i++)
+                kfree(pmus[i].boxes);
+        kfree(pmus);
+
+        return -ENOMEM;
 }
 
 static int __init
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index db1fe377e6dd..a7196818416a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3462,7 +3462,7 @@ static struct intel_uncore_ops skx_uncore_iio_ops = {
 static struct intel_uncore_type skx_uncore_iio = {
         .name                   = "iio",
         .num_counters           = 4,
-        .num_boxes              = 5,
+        .num_boxes              = 6,
         .perf_ctr_bits          = 48,
         .event_ctl              = SKX_IIO0_MSR_PMON_CTL0,
         .perf_ctr               = SKX_IIO0_MSR_PMON_CTR0,
@@ -3492,7 +3492,7 @@ static const struct attribute_group skx_uncore_format_group = {
 static struct intel_uncore_type skx_uncore_irp = {
         .name                   = "irp",
         .num_counters           = 2,
-        .num_boxes              = 5,
+        .num_boxes              = 6,
         .perf_ctr_bits          = 48,
         .event_ctl              = SKX_IRP0_MSR_PMON_CTL0,
         .perf_ctr               = SKX_IRP0_MSR_PMON_CTR0,
diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
index 4bb3ec69e8ea..06723671ae4e 100644
--- a/arch/x86/events/msr.c
+++ b/arch/x86/events/msr.c
@@ -63,6 +63,14 @@ static bool test_intel(int idx)
         case INTEL_FAM6_ATOM_SILVERMONT1:
         case INTEL_FAM6_ATOM_SILVERMONT2:
         case INTEL_FAM6_ATOM_AIRMONT:
+
+        case INTEL_FAM6_ATOM_GOLDMONT:
+        case INTEL_FAM6_ATOM_DENVERTON:
+
+        case INTEL_FAM6_ATOM_GEMINI_LAKE:
+
+        case INTEL_FAM6_XEON_PHI_KNL:
+        case INTEL_FAM6_XEON_PHI_KNM:
                 if (idx == PERF_MSR_SMI)
                         return true;
                 break;
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 1a8eb550c40f..a5db63f728a2 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -85,6 +85,8 @@ EXPORT_SYMBOL_GPL(hyperv_cs);
 u32 *hv_vp_index;
 EXPORT_SYMBOL_GPL(hv_vp_index);
 
+u32 hv_max_vp_index;
+
 static int hv_cpu_init(unsigned int cpu)
 {
         u64 msr_vp_index;
@@ -93,6 +95,9 @@ static int hv_cpu_init(unsigned int cpu)
 
         hv_vp_index[smp_processor_id()] = msr_vp_index;
 
+        if (msr_vp_index > hv_max_vp_index)
+                hv_max_vp_index = msr_vp_index;
+
         return 0;
 }
 
diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
index 39e7f6e50919..9cc9e1c1e2db 100644
--- a/arch/x86/hyperv/mmu.c
+++ b/arch/x86/hyperv/mmu.c
@@ -36,9 +36,9 @@ struct hv_flush_pcpu_ex {
 /* Each gva in gva_list encodes up to 4096 pages to flush */
 #define HV_TLB_FLUSH_UNIT (4096 * PAGE_SIZE)
 
-static struct hv_flush_pcpu __percpu *pcpu_flush;
+static struct hv_flush_pcpu __percpu **pcpu_flush;
 
-static struct hv_flush_pcpu_ex __percpu *pcpu_flush_ex;
+static struct hv_flush_pcpu_ex __percpu **pcpu_flush_ex;
 
 /*
  * Fills in gva_list starting from offset. Returns the number of items added.
@@ -76,6 +76,18 @@ static inline int cpumask_to_vp_set(struct hv_flush_pcpu_ex *flush,
 {
         int cpu, vcpu, vcpu_bank, vcpu_offset, nr_bank = 1;
 
+        /* valid_bank_mask can represent up to 64 banks */
+        if (hv_max_vp_index / 64 >= 64)
+                return 0;
+
+        /*
+         * Clear all banks up to the maximum possible bank as hv_flush_pcpu_ex
+         * structs are not cleared between calls, we risk flushing unneeded
+         * vCPUs otherwise.
+         */
+        for (vcpu_bank = 0; vcpu_bank <= hv_max_vp_index / 64; vcpu_bank++)
+                flush->hv_vp_set.bank_contents[vcpu_bank] = 0;
+
         /*
          * Some banks may end up being empty but this is acceptable.
          */
@@ -83,11 +95,6 @@ static inline int cpumask_to_vp_set(struct hv_flush_pcpu_ex *flush,
                 vcpu = hv_cpu_number_to_vp_number(cpu);
                 vcpu_bank = vcpu / 64;
                 vcpu_offset = vcpu % 64;
-
-                /* valid_bank_mask can represent up to 64 banks */
-                if (vcpu_bank >= 64)
-                        return 0;
-
                 __set_bit(vcpu_offset, (unsigned long *)
                           &flush->hv_vp_set.bank_contents[vcpu_bank]);
                 if (vcpu_bank >= nr_bank)
@@ -102,6 +109,7 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
                                     const struct flush_tlb_info *info)
 {
         int cpu, vcpu, gva_n, max_gvas;
+        struct hv_flush_pcpu **flush_pcpu;
         struct hv_flush_pcpu *flush;
         u64 status = U64_MAX;
         unsigned long flags;
@@ -116,7 +124,17 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
 
         local_irq_save(flags);
 
-        flush = this_cpu_ptr(pcpu_flush);
+        flush_pcpu = this_cpu_ptr(pcpu_flush);
+
+        if (unlikely(!*flush_pcpu))
+                *flush_pcpu = page_address(alloc_page(GFP_ATOMIC));
+
+        flush = *flush_pcpu;
+
+        if (unlikely(!flush)) {
+                local_irq_restore(flags);
+                goto do_native;
+        }
 
         if (info->mm) {
                 flush->address_space = virt_to_phys(info->mm->pgd);
@@ -173,6 +191,7 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
                                        const struct flush_tlb_info *info)
 {
         int nr_bank = 0, max_gvas, gva_n;
+        struct hv_flush_pcpu_ex **flush_pcpu;
         struct hv_flush_pcpu_ex *flush;
         u64 status = U64_MAX;
         unsigned long flags;
@@ -187,7 +206,17 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
 
         local_irq_save(flags);
 
-        flush = this_cpu_ptr(pcpu_flush_ex);
+        flush_pcpu = this_cpu_ptr(pcpu_flush_ex);
+
+        if (unlikely(!*flush_pcpu))
+                *flush_pcpu = page_address(alloc_page(GFP_ATOMIC));
+
+        flush = *flush_pcpu;
+
+        if (unlikely(!flush)) {
+                local_irq_restore(flags);
+                goto do_native;
+        }
 
         if (info->mm) {
                 flush->address_space = virt_to_phys(info->mm->pgd);
@@ -222,18 +251,18 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
                 flush->flags |= HV_FLUSH_NON_GLOBAL_MAPPINGS_ONLY;
                 status = hv_do_rep_hypercall(
                         HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX,
-                        0, nr_bank + 2, flush, NULL);
+                        0, nr_bank, flush, NULL);
         } else if (info->end &&
                    ((info->end - info->start)/HV_TLB_FLUSH_UNIT) > max_gvas) {
                 status = hv_do_rep_hypercall(
                         HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX,
-                        0, nr_bank + 2, flush, NULL);
+                        0, nr_bank, flush, NULL);
         } else {
                 gva_n = fill_gva_list(flush->gva_list, nr_bank,
                                       info->start, info->end);
                 status = hv_do_rep_hypercall(
                         HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX,
-                        gva_n, nr_bank + 2, flush, NULL);
+                        gva_n, nr_bank, flush, NULL);
         }
 
         local_irq_restore(flags);
@@ -266,7 +295,7 @@ void hyper_alloc_mmu(void)
                 return;
 
         if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED))
-                pcpu_flush = __alloc_percpu(PAGE_SIZE, PAGE_SIZE);
+                pcpu_flush = alloc_percpu(struct hv_flush_pcpu *);
         else
-                pcpu_flush_ex = __alloc_percpu(PAGE_SIZE, PAGE_SIZE);
+                pcpu_flush_ex = alloc_percpu(struct hv_flush_pcpu_ex *);
 }
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index e0bb46c02857..0e2a5edbce00 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -231,7 +231,7 @@ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
                  ksig->ka.sa.sa_restorer)
                 sp = (unsigned long) ksig->ka.sa.sa_restorer;
 
-        if (fpu->fpstate_active) {
+        if (fpu->initialized) {
                 unsigned long fx_aligned, math_size;
 
                 sp = fpu__alloc_mathframe(sp, 1, &fx_aligned, &math_size);
diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
index e7636bac7372..6c98821fef5e 100644
--- a/arch/x86/include/asm/alternative-asm.h
+++ b/arch/x86/include/asm/alternative-asm.h
@@ -62,8 +62,10 @@
 #define new_len2                145f-144f
 
 /*
- * max without conditionals. Idea adapted from:
+ * gas compatible max based on the idea from:
  * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax
+ *
+ * The additional "-" is needed because gas uses a "true" value of -1.
  */
 #define alt_max_short(a, b)     ((a) ^ (((a) ^ (b)) & -(-((a) < (b)))))
 
diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index c096624137ae..ccbe24e697c4 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -103,12 +103,12 @@ static inline int alternatives_text_reserved(void *start, void *end)
         alt_end_marker ":\n"
 
 /*
- * max without conditionals. Idea adapted from:
+ * gas compatible max based on the idea from:
  * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax
  *
- * The additional "-" is needed because gas works with s32s.
+ * The additional "-" is needed because gas uses a "true" value of -1.
  */
-#define alt_max_short(a, b)     "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") - (" b ")))))"
+#define alt_max_short(a, b)     "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") < (" b ")))))"
 
 /*
  * Pad the second replacement alternative with additional NOPs if it is
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index c1eadbaf1115..b0dc91f4bedc 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -11,10 +11,12 @@
 # define __ASM_FORM_COMMA(x) " " #x ","
 #endif
 
-#ifdef CONFIG_X86_32
+#ifndef __x86_64__
+/* 32 bit */
 # define __ASM_SEL(a,b) __ASM_FORM(a)
 # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a)
 #else
+/* 64 bit */
 # define __ASM_SEL(a,b) __ASM_FORM(b)
 # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(b)
 #endif
@@ -139,8 +141,8 @@
  * gets set up by the containing function.  If you forget to do this, objtool
  * may print a "call without frame pointer save/setup" warning.
  */
-register unsigned int __asm_call_sp asm("esp");
-#define ASM_CALL_CONSTRAINT "+r" (__asm_call_sp)
+register unsigned long current_stack_pointer asm(_ASM_SP);
+#define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
 #endif
 
 #endif /* _ASM_X86_ASM_H */
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 554cdb205d17..e3221ffa304e 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -23,11 +23,9 @@
 /*
  * High level FPU state handling functions:
  */
-extern void fpu__activate_curr(struct fpu *fpu);
-extern void fpu__activate_fpstate_read(struct fpu *fpu);
-extern void fpu__activate_fpstate_write(struct fpu *fpu);
-extern void fpu__current_fpstate_write_begin(void);
-extern void fpu__current_fpstate_write_end(void);
+extern void fpu__initialize(struct fpu *fpu);
+extern void fpu__prepare_read(struct fpu *fpu);
+extern void fpu__prepare_write(struct fpu *fpu);
 extern void fpu__save(struct fpu *fpu);
 extern void fpu__restore(struct fpu *fpu);
 extern int  fpu__restore_sig(void __user *buf, int ia32_frame);
@@ -120,20 +118,11 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
         err;                                                            \
 })
 
-#define check_insn(insn, output, input...)                              \
-({                                                                      \
-        int err;                                                        \
+#define kernel_insn(insn, output, input...)                             \
         asm volatile("1:" #insn "\n\t"                                  \
                      "2:\n"                                             \
-                     ".section .fixup,\"ax\"\n"                         \
-                     "3:  movl $-1,%[err]\n"                            \
-                     "    jmp  2b\n"                                    \
-                     ".previous\n"                                      \
-                     _ASM_EXTABLE(1b, 3b)                               \
-                     : [err] "=r" (err), output                         \
-                     : "0"(0), input);                                  \
-        err;                                                            \
-})
+                     _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_fprestore)  \
+                     : output : input)
 
 static inline int copy_fregs_to_user(struct fregs_state __user *fx)
 {
@@ -153,20 +142,16 @@ static inline int copy_fxregs_to_user(struct fxregs_state __user *fx)
 
 static inline void copy_kernel_to_fxregs(struct fxregs_state *fx)
 {
-        int err;
-
         if (IS_ENABLED(CONFIG_X86_32)) {
-                err = check_insn(fxrstor %[fx], "=m" (*fx), [fx] "m" (*fx));
+                kernel_insn(fxrstor %[fx], "=m" (*fx), [fx] "m" (*fx));
         } else {
                 if (IS_ENABLED(CONFIG_AS_FXSAVEQ)) {
-                        err = check_insn(fxrstorq %[fx], "=m" (*fx), [fx] "m" (*fx));
+                        kernel_insn(fxrstorq %[fx], "=m" (*fx), [fx] "m" (*fx));
                 } else {
                         /* See comment in copy_fxregs_to_kernel() below. */
-                        err = check_insn(rex64/fxrstor (%[fx]), "=m" (*fx), [fx] "R" (fx), "m" (*fx));
+                        kernel_insn(rex64/fxrstor (%[fx]), "=m" (*fx), [fx] "R" (fx), "m" (*fx));
                 }
         }
-        /* Copying from a kernel buffer to FPU registers should never fail: */
-        WARN_ON_FPU(err);
 }
 
 static inline int copy_user_to_fxregs(struct fxregs_state __user *fx)
@@ -183,9 +168,7 @@ static inline int copy_user_to_fxregs(struct fxregs_state __user *fx)
 
 static inline void copy_kernel_to_fregs(struct fregs_state *fx)
 {
-        int err = check_insn(frstor %[fx], "=m" (*fx), [fx] "m" (*fx));
-
-        WARN_ON_FPU(err);
+        kernel_insn(frstor %[fx], "=m" (*fx), [fx] "m" (*fx));
 }
 
 static inline int copy_user_to_fregs(struct fregs_state __user *fx)
@@ -281,18 +264,13 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
  * Use XRSTORS to restore context if it is enabled. XRSTORS supports compact
  * XSAVE area format.
  */
-#define XSTATE_XRESTORE(st, lmask, hmask, err)                          \
+#define XSTATE_XRESTORE(st, lmask, hmask)                               \
         asm volatile(ALTERNATIVE(XRSTOR,                                \
                                  XRSTORS, X86_FEATURE_XSAVES)           \
                      "\n"                                               \
-                     "xor %[err], %[err]\n"                             \
                      "3:\n"                                             \
-                     ".pushsection .fixup,\"ax\"\n"                     \
-                     "4: movl $-2, %[err]\n"                            \
-                     "jmp 3b\n"                                         \
-                     ".popsection\n"                                    \
-                     _ASM_EXTABLE(661b, 4b)                             \
-                     : [err] "=r" (err)                                 \
+                     _ASM_EXTABLE_HANDLE(661b, 3b, ex_handler_fprestore)\
+                     :                                                  \
                      : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)    \
                      : "memory")
 
@@ -336,7 +314,10 @@ static inline void copy_kernel_to_xregs_booting(struct xregs_state *xstate)
         else
                 XSTATE_OP(XRSTOR, xstate, lmask, hmask, err);
 
-        /* We should never fault when copying from a kernel buffer: */
+        /*
+         * We should never fault when copying from a kernel buffer, and the FPU
+         * state we set at boot time should be valid.
+         */
         WARN_ON_FPU(err);
 }
 
@@ -350,7 +331,7 @@ static inline void copy_xregs_to_kernel(struct xregs_state *xstate)
         u32 hmask = mask >> 32;
         int err;
 
-        WARN_ON(!alternatives_patched);
+        WARN_ON_FPU(!alternatives_patched);
 
         XSTATE_XSAVE(xstate, lmask, hmask, err);
 
@@ -365,12 +346,8 @@ static inline void copy_kernel_to_xregs(struct xregs_state *xstate, u64 mask)
 {
         u32 lmask = mask;
         u32 hmask = mask >> 32;
-        int err;
-
-        XSTATE_XRESTORE(xstate, lmask, hmask, err);
 
-        /* We should never fault when copying from a kernel buffer: */
-        WARN_ON_FPU(err);
+        XSTATE_XRESTORE(xstate, lmask, hmask);
 }
 
 /*
@@ -526,38 +503,17 @@ static inline int fpregs_state_valid(struct fpu *fpu, unsigned int cpu)
  */
 static inline void fpregs_deactivate(struct fpu *fpu)
 {
-        WARN_ON_FPU(!fpu->fpregs_active);
-
-        fpu->fpregs_active = 0;
         this_cpu_write(fpu_fpregs_owner_ctx, NULL);
         trace_x86_fpu_regs_deactivated(fpu);
 }
 
 static inline void fpregs_activate(struct fpu *fpu)
 {
-        WARN_ON_FPU(fpu->fpregs_active);
-
-        fpu->fpregs_active = 1;
         this_cpu_write(fpu_fpregs_owner_ctx, fpu);
         trace_x86_fpu_regs_activated(fpu);
 }
 
 /*
- * The question "does this thread have fpu access?"
- * is slightly racy, since preemption could come in
- * and revoke it immediately after the test.
- *
- * However, even in that very unlikely scenario,
- * we can just assume we have FPU access - typically
- * to save the FP state - we'll just take a #NM
- * fault and get the FPU access back.
- */
-static inline int fpregs_active(void)
-{
-        return current->thread.fpu.fpregs_active;
-}
-
-/*
  * FPU state switching for scheduling.
  *
  * This is a two-stage process:
@@ -571,14 +527,13 @@ static inline int fpregs_active(void)
 static inline void
 switch_fpu_prepare(struct fpu *old_fpu, int cpu)
 {
-        if (old_fpu->fpregs_active) {
+        if (old_fpu->initialized) {
                 if (!copy_fpregs_to_fpstate(old_fpu))
                         old_fpu->last_cpu = -1;
                 else
                         old_fpu->last_cpu = cpu;
 
                 /* But leave fpu_fpregs_owner_ctx! */
-                old_fpu->fpregs_active = 0;
                 trace_x86_fpu_regs_deactivated(old_fpu);
         } else
                 old_fpu->last_cpu = -1;
@@ -595,7 +550,7 @@ switch_fpu_prepare(struct fpu *old_fpu, int cpu)
 static inline void switch_fpu_finish(struct fpu *new_fpu, int cpu)
 {
         bool preload = static_cpu_has(X86_FEATURE_FPU) &&
-                       new_fpu->fpstate_active;
+                       new_fpu->initialized;
 
         if (preload) {
                 if (!fpregs_state_valid(new_fpu, cpu))
@@ -617,8 +572,7 @@ static inline void user_fpu_begin(void)
         struct fpu *fpu = &current->thread.fpu;
 
         preempt_disable();
-        if (!fpregs_active())
-                fpregs_activate(fpu);
+        fpregs_activate(fpu);
         preempt_enable();
 }
 
diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h
index 3c80f5b9c09d..a1520575d86b 100644
--- a/arch/x86/include/asm/fpu/types.h
+++ b/arch/x86/include/asm/fpu/types.h
@@ -68,6 +68,9 @@ struct fxregs_state {
 /* Default value for fxregs_state.mxcsr: */
 #define MXCSR_DEFAULT           0x1f80
 
+/* Copy both mxcsr & mxcsr_flags with a single u64 memcpy: */
+#define MXCSR_AND_FLAGS_SIZE sizeof(u64)
+
 /*
  * Software based FPU emulation state. This is arbitrary really,
  * it matches the x87 format to make it easier to understand:
@@ -290,36 +293,13 @@ struct fpu {
         unsigned int                    last_cpu;
 
         /*
-         * @fpstate_active:
+         * @initialized:
          *
-         * This flag indicates whether this context is active: if the task
+         * This flag indicates whether this context is initialized: if the task
          * is not running then we can restore from this context, if the task
          * is running then we should save into this context.
          */
-        unsigned char                   fpstate_active;
-
-        /*
-         * @fpregs_active:
-         *
-         * This flag determines whether a given context is actively
-         * loaded into the FPU's registers and that those registers
-         * represent the task's current FPU state.
-         *
-         * Note the interaction with fpstate_active:
-         *
-         *   # task does not use the FPU:
-         *   fpstate_active == 0
-         *
-         *   # task uses the FPU and regs are active:
-         *   fpstate_active == 1 && fpregs_active == 1
-         *
-         *   # the regs are inactive but still match fpstate:
-         *   fpstate_active == 1 && fpregs_active == 0 && fpregs_owner == fpu
-         *
-         * The third state is what we use for the lazy restore optimization
-         * on lazy-switching CPUs.
-         */
-        unsigned char                   fpregs_active;
+        unsigned char                   initialized;
 
         /*
          * @state:
diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
index 1b2799e0699a..83fee2469eb7 100644
--- a/arch/x86/include/asm/fpu/xstate.h
+++ b/arch/x86/include/asm/fpu/xstate.h
@@ -48,8 +48,12 @@ void fpu__xstate_clear_all_cpu_caps(void);
 void *get_xsave_addr(struct xregs_state *xsave, int xstate);
 const void *get_xsave_field_ptr(int xstate_field);
 int using_compacted_format(void);
-int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
-                        void __user *ubuf, struct xregs_state *xsave);
-int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
-                     struct xregs_state *xsave);
+int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset, unsigned int size);
+int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned int offset, unsigned int size);
+int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf);
+int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf);
+
+/* Validate an xstate header supplied by userspace (ptrace or sigreturn) */
+extern int validate_xstate_header(const struct xstate_header *hdr);
+
 #endif
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index bc62e7cbf1b1..59ad3d132353 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -88,7 +88,7 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1,
 bool kvm_para_available(void);
 unsigned int kvm_arch_para_features(void);
 void __init kvm_guest_init(void);
-void kvm_async_pf_task_wait(u32 token);
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
 extern void kvm_disable_steal_time(void);
@@ -103,7 +103,7 @@ static inline void kvm_spinlock_init(void)
 
 #else /* CONFIG_KVM_GUEST */
 #define kvm_guest_init() do {} while (0)
-#define kvm_async_pf_task_wait(T) do {} while(0)
+#define kvm_async_pf_task_wait(T, I) do {} while(0)
 #define kvm_async_pf_task_wake(T) do {} while(0)
 
 static inline bool kvm_para_available(void)
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 181264989db5..8edac1de2e35 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -187,7 +187,6 @@ struct mca_msr_regs {
 
 extern struct mce_vendor_flags mce_flags;
 
-extern struct mca_config mca_cfg;
 extern struct mca_msr_regs msr_ops;
 
 enum mce_notifier_prios {
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index c120b5db178a..3c856a15b98e 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -126,13 +126,7 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
         DEBUG_LOCKS_WARN_ON(preemptible());
 }
 
-static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
-{
-        int cpu = smp_processor_id();
-
-        if (cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_clear_cpu(cpu, mm_cpumask(mm));
-}
+void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
 
 static inline int init_new_context(struct task_struct *tsk,
                                    struct mm_struct *mm)
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 738503e1f80c..530f448fddaf 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -289,6 +289,7 @@ static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,
  * to this information.
  */
 extern u32 *hv_vp_index;
+extern u32 hv_max_vp_index;
 
 /**
  * hv_cpu_number_to_vp_number() - Map CPU to VP.
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 5161da1a0fa0..89e7eeb5cec1 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -158,17 +158,6 @@ struct thread_info {
  */
 #ifndef __ASSEMBLY__
 
-static inline unsigned long current_stack_pointer(void)
-{
-        unsigned long sp;
-#ifdef CONFIG_X86_64
-        asm("mov %%rsp,%0" : "=g" (sp));
-#else
-        asm("mov %%esp,%0" : "=g" (sp));
-#endif
-        return sp;
-}
-
 /*
  * Walks up the stack frames to make sure that the specified object is
  * entirely contained by a single stack frame.
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 4893abf7f74f..c4aed0de565e 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -82,6 +82,22 @@ static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)
 #define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
 #endif
 
+static inline bool tlb_defer_switch_to_init_mm(void)
+{
+        /*
+         * If we have PCID, then switching to init_mm is reasonably
+         * fast.  If we don't have PCID, then switching to init_mm is
+         * quite slow, so we try to defer it in the hopes that we can
+         * avoid it entirely.  The latter approach runs the risk of
+         * receiving otherwise unnecessary IPIs.
+         *
+         * This choice is just a heuristic.  The tlb code can handle this
+         * function returning true or false regardless of whether we have
+         * PCID.
+         */
+        return !static_cpu_has(X86_FEATURE_PCID);
+}
+
 /*
  * 6 because 6 should be plenty and struct tlb_state will fit in
  * two cache lines.
@@ -105,6 +121,23 @@ struct tlb_state {
         u16 next_asid;
 
         /*
+         * We can be in one of several states:
+         *
+         *  - Actively using an mm.  Our CPU's bit will be set in
+         *    mm_cpumask(loaded_mm) and is_lazy == false;
+         *
+         *  - Not using a real mm.  loaded_mm == &init_mm.  Our CPU's bit
+         *    will not be set in mm_cpumask(&init_mm) and is_lazy == false.
+         *
+         *  - Lazily using a real mm.  loaded_mm != &init_mm, our bit
+         *    is set in mm_cpumask(loaded_mm), but is_lazy == true.
+         *    We're heuristically guessing that the CR3 load we
+         *    skipped more than makes up for the overhead added by
+         *    lazy mode.
+         */
+        bool is_lazy;
+
+        /*
          * Access to this CR4 shadow and to H/W CR4 is protected by
          * disabling interrupts when modifying either one.
          */
diff --git a/arch/x86/include/asm/trace/fpu.h b/arch/x86/include/asm/trace/fpu.h
index 342e59789fcd..39f7a27bef13 100644
--- a/arch/x86/include/asm/trace/fpu.h
+++ b/arch/x86/include/asm/trace/fpu.h
@@ -12,25 +12,22 @@ DECLARE_EVENT_CLASS(x86_fpu,
 
         TP_STRUCT__entry(
                 __field(struct fpu *, fpu)
-                __field(bool, fpregs_active)
-                __field(bool, fpstate_active)
+                __field(bool, initialized)
                 __field(u64, xfeatures)
                 __field(u64, xcomp_bv)
                 ),
 
         TP_fast_assign(
                 __entry->fpu            = fpu;
-                __entry->fpregs_active  = fpu->fpregs_active;
-                __entry->fpstate_active = fpu->fpstate_active;
+                __entry->initialized    = fpu->initialized;
                 if (boot_cpu_has(X86_FEATURE_OSXSAVE)) {
                         __entry->xfeatures = fpu->state.xsave.header.xfeatures;
                         __entry->xcomp_bv  = fpu->state.xsave.header.xcomp_bv;
                 }
         ),
-        TP_printk("x86/fpu: %p fpregs_active: %d fpstate_active: %d xfeatures: %llx xcomp_bv: %llx",
+        TP_printk("x86/fpu: %p initialized: %d xfeatures: %llx xcomp_bv: %llx",
                         __entry->fpu,
-                        __entry->fpregs_active,
-                        __entry->fpstate_active,
+                        __entry->initialized,
                         __entry->xfeatures,
                         __entry->xcomp_bv
         )
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 78e8fcc87d4c..4b892917edeb 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -337,7 +337,7 @@ do {									\
                      _ASM_EXTABLE(1b, 4b)                               \
                      _ASM_EXTABLE(2b, 4b)                               \
                      : "=r" (retval), "=&A"(x)                          \
-                     : "m" (__m(__ptr)), "m" __m(((u32 *)(__ptr)) + 1), \
+                     : "m" (__m(__ptr)), "m" __m(((u32 __user *)(__ptr)) + 1),  \
                        "i" (errret), "0" (retval));                     \
 })
 
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 128a1a0b1450..7cb282e9e587 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -551,13 +551,13 @@ static inline void
 MULTI_update_descriptor(struct multicall_entry *mcl, u64 maddr,
                         struct desc_struct desc)
 {
-        u32 *p = (u32 *) &desc;
-
         mcl->op = __HYPERVISOR_update_descriptor;
         if (sizeof(maddr) == sizeof(long)) {
                 mcl->args[0] = maddr;
                 mcl->args[1] = *(unsigned long *)&desc;
         } else {
+                u32 *p = (u32 *)&desc;
+
                 mcl->args[0] = maddr;
                 mcl->args[1] = maddr >> 32;
                 mcl->args[2] = *p++;
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 458da8509b75..6db28f17ff28 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -27,6 +27,8 @@ static const struct pci_device_id amd_root_ids[] = {
         {}
 };
 
+#define PCI_DEVICE_ID_AMD_CNB17H_F4     0x1704
+
 const struct pci_device_id amd_nb_misc_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
@@ -37,6 +39,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
         {}
 };
 EXPORT_SYMBOL_GPL(amd_nb_misc_ids);
@@ -48,6 +51,7 @@ static const struct pci_device_id amd_nb_link_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
         {}
 };
 
@@ -402,11 +406,48 @@ void amd_flush_garts(void)
 }
 EXPORT_SYMBOL_GPL(amd_flush_garts);
 
+static void __fix_erratum_688(void *info)
+{
+#define MSR_AMD64_IC_CFG 0xC0011021
+
+        msr_set_bit(MSR_AMD64_IC_CFG, 3);
+        msr_set_bit(MSR_AMD64_IC_CFG, 14);
+}
+
+/* Apply erratum 688 fix so machines without a BIOS fix work. */
+static __init void fix_erratum_688(void)
+{
+        struct pci_dev *F4;
+        u32 val;
+
+        if (boot_cpu_data.x86 != 0x14)
+                return;
+
+        if (!amd_northbridges.num)
+                return;
+
+        F4 = node_to_amd_nb(0)->link;
+        if (!F4)
+                return;
+
+        if (pci_read_config_dword(F4, 0x164, &val))
+                return;
+
+        if (val & BIT(2))
+                return;
+
+        on_each_cpu(__fix_erratum_688, NULL, 0);
+
+        pr_info("x86/cpu/AMD: CPU erratum 688 worked around\n");
+}
+
 static __init int init_amd_nbs(void)
 {
         amd_cache_northbridges();
         amd_cache_gart();
 
+        fix_erratum_688();
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index d705c769f77d..ff891772c9f8 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -573,11 +573,21 @@ static u32 bdx_deadline_rev(void)
         return ~0U;
 }
 
+static u32 skx_deadline_rev(void)
+{
+        switch (boot_cpu_data.x86_mask) {
+        case 0x03: return 0x01000136;
+        case 0x04: return 0x02000014;
+        }
+
+        return ~0U;
+}
+
 static const struct x86_cpu_id deadline_match[] = {
         DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_HASWELL_X,        hsx_deadline_rev),
         DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_BROADWELL_X,      0x0b000020),
         DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_BROADWELL_XEON_D, bdx_deadline_rev),
-        DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_SKYLAKE_X,        0x02000014),
+        DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_SKYLAKE_X,        skx_deadline_rev),
 
         DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_HASWELL_CORE,     0x22),
         DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_HASWELL_ULT,      0x20),
@@ -600,7 +610,8 @@ static void apic_check_deadline_errata(void)
         const struct x86_cpu_id *m;
         u32 rev;
 
-        if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER))
+        if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER) ||
+            boot_cpu_has(X86_FEATURE_HYPERVISOR))
                 return;
 
         m = x86_match_cpu(deadline_match);
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 24f749324c0f..9990a71e311f 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -831,7 +831,6 @@ static int __cache_amd_cpumap_setup(unsigned int cpu, int index,
         } else if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
                 unsigned int apicid, nshared, first, last;
 
-                this_leaf = this_cpu_ci->info_list + index;
                 nshared = base->eax.split.num_threads_sharing + 1;
                 apicid = cpu_data(cpu).apicid;
                 first = apicid - (apicid % nshared);
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index 098530a93bb7..debb974fd17d 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -1,3 +1,6 @@
+#ifndef __X86_MCE_INTERNAL_H__
+#define __X86_MCE_INTERNAL_H__
+
 #include <linux/device.h>
 #include <asm/mce.h>
 
@@ -108,3 +111,7 @@ static inline void mce_work_trigger(void)	{ }
 static inline void mce_register_injector_chain(struct notifier_block *nb)       { }
 static inline void mce_unregister_injector_chain(struct notifier_block *nb)     { }
 #endif
+
+extern struct mca_config mca_cfg;
+
+#endif /* __X86_MCE_INTERNAL_H__ */
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 40e28ed77fbf..486f640b02ef 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -28,6 +28,8 @@
 #include <asm/msr.h>
 #include <asm/trace/irq_vectors.h>
 
+#include "mce-internal.h"
+
 #define NR_BLOCKS         5
 #define THRESHOLD_MAX     0xFFF
 #define INT_TYPE_APIC     0x00020000
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 86e8f0b2537b..c4fa4a85d4cb 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -122,9 +122,6 @@ static bool __init check_loader_disabled_bsp(void)
         bool *res = &dis_ucode_ldr;
 #endif
 
-        if (!have_cpuid_p())
-                return *res;
-
         /*
          * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not
          * completely accurate as xen pv guests don't see that CPUID bit set but
@@ -166,24 +163,36 @@ bool get_builtin_firmware(struct cpio_data *cd, const char *name)
 void __init load_ucode_bsp(void)
 {
         unsigned int cpuid_1_eax;
+        bool intel = true;
 
-        if (check_loader_disabled_bsp())
+        if (!have_cpuid_p())
                 return;
 
         cpuid_1_eax = native_cpuid_eax(1);
 
         switch (x86_cpuid_vendor()) {
         case X86_VENDOR_INTEL:
-                if (x86_family(cpuid_1_eax) >= 6)
-                        load_ucode_intel_bsp();
+                if (x86_family(cpuid_1_eax) < 6)
+                        return;
                 break;
+
         case X86_VENDOR_AMD:
-                if (x86_family(cpuid_1_eax) >= 0x10)
-                        load_ucode_amd_bsp(cpuid_1_eax);
+                if (x86_family(cpuid_1_eax) < 0x10)
+                        return;
+                intel = false;
                 break;
+
         default:
-                break;
+                return;
         }
+
+        if (check_loader_disabled_bsp())
+                return;
+
+        if (intel)
+                load_ucode_intel_bsp();
+        else
+                load_ucode_amd_bsp(cpuid_1_eax);
 }
 
 static bool check_loader_disabled_ap(void)
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 8f7a9bbad514..7dbcb7adf797 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -34,6 +34,7 @@
 #include <linux/mm.h>
 
 #include <asm/microcode_intel.h>
+#include <asm/intel-family.h>
 #include <asm/processor.h>
 #include <asm/tlbflush.h>
 #include <asm/setup.h>
@@ -918,6 +919,18 @@ static int get_ucode_fw(void *to, const void *from, size_t n)
         return 0;
 }
 
+static bool is_blacklisted(unsigned int cpu)
+{
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+        if (c->x86 == 6 && c->x86_model == INTEL_FAM6_BROADWELL_X) {
+                pr_err_once("late loading on model 79 is disabled.\n");
+                return true;
+        }
+
+        return false;
+}
+
 static enum ucode_state request_microcode_fw(int cpu, struct device *device,
                                              bool refresh_fw)
 {
@@ -926,6 +939,9 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
         const struct firmware *firmware;
         enum ucode_state ret;
 
+        if (is_blacklisted(cpu))
+                return UCODE_NFOUND;
+
         sprintf(name, "intel-ucode/%02x-%02x-%02x",
                 c->x86, c->x86_model, c->x86_mask);
 
@@ -950,6 +966,9 @@ static int get_ucode_user(void *to, const void *from, size_t n)
 static enum ucode_state
 request_microcode_user(int cpu, const void __user *buf, size_t size)
 {
+        if (is_blacklisted(cpu))
+                return UCODE_NFOUND;
+
         return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
 }
 
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index e1114f070c2d..f92a6593de1e 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -100,7 +100,7 @@ void __kernel_fpu_begin(void)
 
         kernel_fpu_disable();
 
-        if (fpu->fpregs_active) {
+        if (fpu->initialized) {
                 /*
                  * Ignore return value -- we don't care if reg state
                  * is clobbered.
@@ -116,7 +116,7 @@ void __kernel_fpu_end(void)
 {
         struct fpu *fpu = &current->thread.fpu;
 
-        if (fpu->fpregs_active)
+        if (fpu->initialized)
                 copy_kernel_to_fpregs(&fpu->state);
 
         kernel_fpu_enable();
@@ -148,7 +148,7 @@ void fpu__save(struct fpu *fpu)
 
         preempt_disable();
         trace_x86_fpu_before_save(fpu);
-        if (fpu->fpregs_active) {
+        if (fpu->initialized) {
                 if (!copy_fpregs_to_fpstate(fpu)) {
                         copy_kernel_to_fpregs(&fpu->state);
                 }
@@ -189,10 +189,9 @@ EXPORT_SYMBOL_GPL(fpstate_init);
 
 int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
 {
-        dst_fpu->fpregs_active = 0;
         dst_fpu->last_cpu = -1;
 
-        if (!src_fpu->fpstate_active || !static_cpu_has(X86_FEATURE_FPU))
+        if (!src_fpu->initialized || !static_cpu_has(X86_FEATURE_FPU))
                 return 0;
 
         WARN_ON_FPU(src_fpu != &current->thread.fpu);
@@ -206,26 +205,14 @@ int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
         /*
          * Save current FPU registers directly into the child
          * FPU context, without any memory-to-memory copying.
-         * In lazy mode, if the FPU context isn't loaded into
-         * fpregs, CR0.TS will be set and do_device_not_available
-         * will load the FPU context.
          *
-         * We have to do all this with preemption disabled,
-         * mostly because of the FNSAVE case, because in that
-         * case we must not allow preemption in the window
-         * between the FNSAVE and us marking the context lazy.
-         *
-         * It shouldn't be an issue as even FNSAVE is plenty
-         * fast in terms of critical section length.
+         * ( The function 'fails' in the FNSAVE case, which destroys
+         *   register contents so we have to copy them back. )
          */
-        preempt_disable();
         if (!copy_fpregs_to_fpstate(dst_fpu)) {
-                memcpy(&src_fpu->state, &dst_fpu->state,
-                       fpu_kernel_xstate_size);
-
+                memcpy(&src_fpu->state, &dst_fpu->state, fpu_kernel_xstate_size);
                 copy_kernel_to_fpregs(&src_fpu->state);
         }
-        preempt_enable();
 
         trace_x86_fpu_copy_src(src_fpu);
         trace_x86_fpu_copy_dst(dst_fpu);
@@ -237,45 +224,48 @@ int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
  * Activate the current task's in-memory FPU context,
  * if it has not been used before:
  */
-void fpu__activate_curr(struct fpu *fpu)
+void fpu__initialize(struct fpu *fpu)
 {
         WARN_ON_FPU(fpu != &current->thread.fpu);
 
-        if (!fpu->fpstate_active) {
+        if (!fpu->initialized) {
                 fpstate_init(&fpu->state);
                 trace_x86_fpu_init_state(fpu);
 
                 trace_x86_fpu_activate_state(fpu);
                 /* Safe to do for the current task: */
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
         }
 }
-EXPORT_SYMBOL_GPL(fpu__activate_curr);
+EXPORT_SYMBOL_GPL(fpu__initialize);
 
 /*
  * This function must be called before we read a task's fpstate.
  *
- * If the task has not used the FPU before then initialize its
- * fpstate.
+ * There's two cases where this gets called:
+ *
+ * - for the current task (when coredumping), in which case we have
+ *   to save the latest FPU registers into the fpstate,
+ *
+ * - or it's called for stopped tasks (ptrace), in which case the
+ *   registers were already saved by the context-switch code when
+ *   the task scheduled out - we only have to initialize the registers
+ *   if they've never been initialized.
  *
  * If the task has used the FPU before then save it.
  */
-void fpu__activate_fpstate_read(struct fpu *fpu)
+void fpu__prepare_read(struct fpu *fpu)
 {
-        /*
-         * If fpregs are active (in the current CPU), then
-         * copy them to the fpstate:
-         */
-        if (fpu->fpregs_active) {
+        if (fpu == &current->thread.fpu) {
                 fpu__save(fpu);
         } else {
-                if (!fpu->fpstate_active) {
+                if (!fpu->initialized) {
                         fpstate_init(&fpu->state);
                         trace_x86_fpu_init_state(fpu);
 
                         trace_x86_fpu_activate_state(fpu);
                         /* Safe to do for current and for stopped child tasks: */
-                        fpu->fpstate_active = 1;
+                        fpu->initialized = 1;
                 }
         }
 }
@@ -283,17 +273,17 @@ void fpu__activate_fpstate_read(struct fpu *fpu)
 /*
  * This function must be called before we write a task's fpstate.
  *
- * If the task has used the FPU before then unlazy it.
+ * If the task has used the FPU before then invalidate any cached FPU registers.
  * If the task has not used the FPU before then initialize its fpstate.
  *
  * After this function call, after registers in the fpstate are
  * modified and the child task has woken up, the child task will
  * restore the modified FPU state from the modified context. If we
- * didn't clear its lazy status here then the lazy in-registers
+ * didn't clear its cached status here then the cached in-registers
  * state pending on its former CPU could be restored, corrupting
  * the modifications.
  */
-void fpu__activate_fpstate_write(struct fpu *fpu)
+void fpu__prepare_write(struct fpu *fpu)
 {
         /*
          * Only stopped child tasks can be used to modify the FPU
@@ -301,8 +291,8 @@ void fpu__activate_fpstate_write(struct fpu *fpu)
          */
         WARN_ON_FPU(fpu == &current->thread.fpu);
 
-        if (fpu->fpstate_active) {
-                /* Invalidate any lazy state: */
+        if (fpu->initialized) {
+                /* Invalidate any cached state: */
                 __fpu_invalidate_fpregs_state(fpu);
         } else {
                 fpstate_init(&fpu->state);
@@ -310,74 +300,11 @@ void fpu__activate_fpstate_write(struct fpu *fpu)
 
                 trace_x86_fpu_activate_state(fpu);
                 /* Safe to do for stopped child tasks: */
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
         }
 }
 
 /*
- * This function must be called before we write the current
- * task's fpstate.
- *
- * This call gets the current FPU register state and moves
- * it in to the 'fpstate'.  Preemption is disabled so that
- * no writes to the 'fpstate' can occur from context
- * swiches.
- *
- * Must be followed by a fpu__current_fpstate_write_end().
- */
-void fpu__current_fpstate_write_begin(void)
-{
-        struct fpu *fpu = &current->thread.fpu;
-
-        /*
-         * Ensure that the context-switching code does not write
-         * over the fpstate while we are doing our update.
-         */
-        preempt_disable();
-
-        /*
-         * Move the fpregs in to the fpu's 'fpstate'.
-         */
-        fpu__activate_fpstate_read(fpu);
-
-        /*
-         * The caller is about to write to 'fpu'.  Ensure that no
-         * CPU thinks that its fpregs match the fpstate.  This
-         * ensures we will not be lazy and skip a XRSTOR in the
-         * future.
-         */
-        __fpu_invalidate_fpregs_state(fpu);
-}
-
-/*
- * This function must be paired with fpu__current_fpstate_write_begin()
- *
- * This will ensure that the modified fpstate gets placed back in
- * the fpregs if necessary.
- *
- * Note: This function may be called whether or not an _actual_
- * write to the fpstate occurred.
- */
-void fpu__current_fpstate_write_end(void)
-{
-        struct fpu *fpu = &current->thread.fpu;
-
-        /*
-         * 'fpu' now has an updated copy of the state, but the
-         * registers may still be out of date.  Update them with
-         * an XRSTOR if they are active.
-         */
-        if (fpregs_active())
-                copy_kernel_to_fpregs(&fpu->state);
-
-        /*
-         * Our update is done and the fpregs/fpstate are in sync
-         * if necessary.  Context switches can happen again.
-         */
-        preempt_enable();
-}
-
-/*
  * 'fpu__restore()' is called to copy FPU registers from
  * the FPU fpstate to the live hw registers and to activate
  * access to the hardware registers, so that FPU instructions
@@ -389,7 +316,7 @@ void fpu__current_fpstate_write_end(void)
  */
 void fpu__restore(struct fpu *fpu)
 {
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         /* Avoid __kernel_fpu_begin() right after fpregs_activate() */
         kernel_fpu_disable();
@@ -414,15 +341,17 @@ void fpu__drop(struct fpu *fpu)
 {
         preempt_disable();
 
-        if (fpu->fpregs_active) {
-                /* Ignore delayed exceptions from user space */
-                asm volatile("1: fwait\n"
-                             "2:\n"
-                             _ASM_EXTABLE(1b, 2b));
-                fpregs_deactivate(fpu);
+        if (fpu == &current->thread.fpu) {
+                if (fpu->initialized) {
+                        /* Ignore delayed exceptions from user space */
+                        asm volatile("1: fwait\n"
+                                     "2:\n"
+                                     _ASM_EXTABLE(1b, 2b));
+                        fpregs_deactivate(fpu);
+                }
         }
 
-        fpu->fpstate_active = 0;
+        fpu->initialized = 0;
 
         trace_x86_fpu_dropped(fpu);
 
@@ -462,9 +391,11 @@ void fpu__clear(struct fpu *fpu)
          * Make sure fpstate is cleared and initialized.
          */
         if (static_cpu_has(X86_FEATURE_FPU)) {
-                fpu__activate_curr(fpu);
+                preempt_disable();
+                fpu__initialize(fpu);
                 user_fpu_begin();
                 copy_init_fpstate_to_fpregs();
+                preempt_enable();
         }
 }
 
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index d5d44c452624..7affb7e3d9a5 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -240,7 +240,7 @@ static void __init fpu__init_system_ctx_switch(void)
         WARN_ON_FPU(!on_boot_cpu);
         on_boot_cpu = 0;
 
-        WARN_ON_FPU(current->thread.fpu.fpstate_active);
+        WARN_ON_FPU(current->thread.fpu.initialized);
 }
 
 /*
diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c
index b188b16841e3..3ea151372389 100644
--- a/arch/x86/kernel/fpu/regset.c
+++ b/arch/x86/kernel/fpu/regset.c
@@ -16,14 +16,14 @@ int regset_fpregs_active(struct task_struct *target, const struct user_regset *r
 {
         struct fpu *target_fpu = &target->thread.fpu;
 
-        return target_fpu->fpstate_active ? regset->n : 0;
+        return target_fpu->initialized ? regset->n : 0;
 }
 
 int regset_xregset_fpregs_active(struct task_struct *target, const struct user_regset *regset)
 {
         struct fpu *target_fpu = &target->thread.fpu;
 
-        if (boot_cpu_has(X86_FEATURE_FXSR) && target_fpu->fpstate_active)
+        if (boot_cpu_has(X86_FEATURE_FXSR) && target_fpu->initialized)
                 return regset->n;
         else
                 return 0;
@@ -38,7 +38,7 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
         if (!boot_cpu_has(X86_FEATURE_FXSR))
                 return -ENODEV;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
         fpstate_sanitize_xstate(fpu);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -55,7 +55,7 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
         if (!boot_cpu_has(X86_FEATURE_FXSR))
                 return -ENODEV;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
         fpstate_sanitize_xstate(fpu);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -89,10 +89,13 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
 
         xsave = &fpu->state.xsave;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
 
         if (using_compacted_format()) {
-                ret = copyout_from_xsaves(pos, count, kbuf, ubuf, xsave);
+                if (kbuf)
+                        ret = copy_xstate_to_kernel(kbuf, xsave, pos, count);
+                else
+                        ret = copy_xstate_to_user(ubuf, xsave, pos, count);
         } else {
                 fpstate_sanitize_xstate(fpu);
                 /*
@@ -129,28 +132,29 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
 
         xsave = &fpu->state.xsave;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
 
-        if (boot_cpu_has(X86_FEATURE_XSAVES))
-                ret = copyin_to_xsaves(kbuf, ubuf, xsave);
-        else
+        if (using_compacted_format()) {
+                if (kbuf)
+                        ret = copy_kernel_to_xstate(xsave, kbuf);
+                else
+                        ret = copy_user_to_xstate(xsave, ubuf);
+        } else {
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1);
-
-        /*
-         * In case of failure, mark all states as init:
-         */
-        if (ret)
-                fpstate_init(&fpu->state);
+                if (!ret)
+                        ret = validate_xstate_header(&xsave->header);
+        }
 
         /*
          * mxcsr reserved bits must be masked to zero for security reasons.
          */
         xsave->i387.mxcsr &= mxcsr_feature_mask;
-        xsave->header.xfeatures &= xfeatures_mask;
+
         /*
-         * These bits must be zero.
+         * In case of failure, mark all states as init:
          */
-        memset(&xsave->header.reserved, 0, 48);
+        if (ret)
+                fpstate_init(&fpu->state);
 
         return ret;
 }
@@ -299,7 +303,7 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
         struct fpu *fpu = &target->thread.fpu;
         struct user_i387_ia32_struct env;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
 
         if (!boot_cpu_has(X86_FEATURE_FPU))
                 return fpregs_soft_get(target, regset, pos, count, kbuf, ubuf);
@@ -329,7 +333,7 @@ int fpregs_set(struct task_struct *target, const struct user_regset *regset,
         struct user_i387_ia32_struct env;
         int ret;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
         fpstate_sanitize_xstate(fpu);
 
         if (!boot_cpu_has(X86_FEATURE_FPU))
@@ -369,7 +373,7 @@ int dump_fpu(struct pt_regs *regs, struct user_i387_struct *ufpu)
         struct fpu *fpu = &tsk->thread.fpu;
         int fpvalid;
 
-        fpvalid = fpu->fpstate_active;
+        fpvalid = fpu->initialized;
         if (fpvalid)
                 fpvalid = !fpregs_get(tsk, NULL,
                                       0, sizeof(struct user_i387_ia32_struct),
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 83c23c230b4c..fb639e70048f 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -155,7 +155,8 @@ static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
  */
 int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
 {
-        struct xregs_state *xsave = &current->thread.fpu.state.xsave;
+        struct fpu *fpu = &current->thread.fpu;
+        struct xregs_state *xsave = &fpu->state.xsave;
         struct task_struct *tsk = current;
         int ia32_fxstate = (buf != buf_fx);
 
@@ -170,13 +171,13 @@ int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
                         sizeof(struct user_i387_ia32_struct), NULL,
                         (struct _fpstate_32 __user *) buf) ? -1 : 1;
 
-        if (fpregs_active() || using_compacted_format()) {
+        if (fpu->initialized || using_compacted_format()) {
                 /* Save the live register state to the user directly. */
                 if (copy_fpregs_to_sigframe(buf_fx))
                         return -1;
                 /* Update the thread's fxstate to save the fsave header. */
                 if (ia32_fxstate)
-                        copy_fxregs_to_kernel(&tsk->thread.fpu);
+                        copy_fxregs_to_kernel(fpu);
         } else {
                 /*
                  * It is a *bug* if kernel uses compacted-format for xsave
@@ -189,7 +190,7 @@ int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
                         return -1;
                 }
 
-                fpstate_sanitize_xstate(&tsk->thread.fpu);
+                fpstate_sanitize_xstate(fpu);
                 if (__copy_to_user(buf_fx, xsave, fpu_user_xstate_size))
                         return -1;
         }
@@ -213,8 +214,11 @@ sanitize_restored_xstate(struct task_struct *tsk,
         struct xstate_header *header = &xsave->header;
 
         if (use_xsave()) {
-                /* These bits must be zero. */
-                memset(header->reserved, 0, 48);
+                /*
+                 * Note: we don't need to zero the reserved bits in the
+                 * xstate_header here because we either didn't copy them at all,
+                 * or we checked earlier that they aren't set.
+                 */
 
                 /*
                  * Init the state that is not present in the memory
@@ -223,7 +227,7 @@ sanitize_restored_xstate(struct task_struct *tsk,
                 if (fx_only)
                         header->xfeatures = XFEATURE_MASK_FPSSE;
                 else
-                        header->xfeatures &= (xfeatures_mask & xfeatures);
+                        header->xfeatures &= xfeatures;
         }
 
         if (use_fxsr()) {
@@ -279,7 +283,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
         if (!access_ok(VERIFY_READ, buf, size))
                 return -EACCES;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         if (!static_cpu_has(X86_FEATURE_FPU))
                 return fpregs_soft_set(current, NULL,
@@ -307,28 +311,29 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                 /*
                  * For 32-bit frames with fxstate, copy the user state to the
                  * thread's fpu state, reconstruct fxstate from the fsave
-                 * header. Sanitize the copied state etc.
+                 * header. Validate and sanitize the copied state.
                  */
                 struct fpu *fpu = &tsk->thread.fpu;
                 struct user_i387_ia32_struct env;
                 int err = 0;
 
                 /*
-                 * Drop the current fpu which clears fpu->fpstate_active. This ensures
+                 * Drop the current fpu which clears fpu->initialized. This ensures
                  * that any context-switch during the copy of the new state,
                  * avoids the intermediate state from getting restored/saved.
                  * Thus avoiding the new restored state from getting corrupted.
                  * We will be ready to restore/save the state only after
-                 * fpu->fpstate_active is again set.
+                 * fpu->initialized is again set.
                  */
                 fpu__drop(fpu);
 
                 if (using_compacted_format()) {
-                        err = copyin_to_xsaves(NULL, buf_fx,
-                                               &fpu->state.xsave);
+                        err = copy_user_to_xstate(&fpu->state.xsave, buf_fx);
                 } else {
-                        err = __copy_from_user(&fpu->state.xsave,
-                                               buf_fx, state_size);
+                        err = __copy_from_user(&fpu->state.xsave, buf_fx, state_size);
+
+                        if (!err && state_size > offsetof(struct xregs_state, header))
+                                err = validate_xstate_header(&fpu->state.xsave.header);
                 }
 
                 if (err || __copy_from_user(&env, buf, sizeof(env))) {
@@ -339,7 +344,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                         sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
                 }
 
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
                 preempt_disable();
                 fpu__restore(fpu);
                 preempt_enable();
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index c24ac1efb12d..f1d5476c9022 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -483,6 +483,30 @@ int using_compacted_format(void)
         return boot_cpu_has(X86_FEATURE_XSAVES);
 }
 
+/* Validate an xstate header supplied by userspace (ptrace or sigreturn) */
+int validate_xstate_header(const struct xstate_header *hdr)
+{
+        /* No unknown or supervisor features may be set */
+        if (hdr->xfeatures & (~xfeatures_mask | XFEATURE_MASK_SUPERVISOR))
+                return -EINVAL;
+
+        /* Userspace must use the uncompacted format */
+        if (hdr->xcomp_bv)
+                return -EINVAL;
+
+        /*
+         * If 'reserved' is shrunken to add a new field, make sure to validate
+         * that new field here!
+         */
+        BUILD_BUG_ON(sizeof(hdr->reserved) != 48);
+
+        /* No reserved bits may be set */
+        if (memchr_inv(hdr->reserved, 0, sizeof(hdr->reserved)))
+                return -EINVAL;
+
+        return 0;
+}
+
 static void __xstate_dump_leaves(void)
 {
         int i;
@@ -867,7 +891,7 @@ const void *get_xsave_field_ptr(int xsave_state)
 {
         struct fpu *fpu = &current->thread.fpu;
 
-        if (!fpu->fpstate_active)
+        if (!fpu->initialized)
                 return NULL;
         /*
          * fpu__save() takes the CPU's xstate registers
@@ -921,38 +945,129 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
 #endif /* ! CONFIG_ARCH_HAS_PKEYS */
 
 /*
+ * Weird legacy quirk: SSE and YMM states store information in the
+ * MXCSR and MXCSR_FLAGS fields of the FP area. That means if the FP
+ * area is marked as unused in the xfeatures header, we need to copy
+ * MXCSR and MXCSR_FLAGS if either SSE or YMM are in use.
+ */
+static inline bool xfeatures_mxcsr_quirk(u64 xfeatures)
+{
+        if (!(xfeatures & (XFEATURE_MASK_SSE|XFEATURE_MASK_YMM)))
+                return false;
+
+        if (xfeatures & XFEATURE_MASK_FP)
+                return false;
+
+        return true;
+}
+
+/*
  * This is similar to user_regset_copyout(), but will not add offset to
  * the source data pointer or increment pos, count, kbuf, and ubuf.
  */
-static inline int xstate_copyout(unsigned int pos, unsigned int count,
-                                 void *kbuf, void __user *ubuf,
-                                 const void *data, const int start_pos,
-                                 const int end_pos)
+static inline void
+__copy_xstate_to_kernel(void *kbuf, const void *data,
+                        unsigned int offset, unsigned int size, unsigned int size_total)
 {
-        if ((count == 0) || (pos < start_pos))
-                return 0;
+        if (offset < size_total) {
+                unsigned int copy = min(size, size_total - offset);
 
-        if (end_pos < 0 || pos < end_pos) {
-                unsigned int copy = (end_pos < 0 ? count : min(count, end_pos - pos));
+                memcpy(kbuf + offset, data, copy);
+        }
+}
 
-                if (kbuf) {
-                        memcpy(kbuf + pos, data, copy);
-                } else {
-                        if (__copy_to_user(ubuf + pos, data, copy))
-                                return -EFAULT;
+/*
+ * Convert from kernel XSAVES compacted format to standard format and copy
+ * to a kernel-space ptrace buffer.
+ *
+ * It supports partial copy but pos always starts from zero. This is called
+ * from xstateregs_get() and there we check the CPU has XSAVES.
+ */
+int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
+{
+        unsigned int offset, size;
+        struct xstate_header header;
+        int i;
+
+        /*
+         * Currently copy_regset_to_user() starts from pos 0:
+         */
+        if (unlikely(offset_start != 0))
+                return -EFAULT;
+
+        /*
+         * The destination is a ptrace buffer; we put in only user xstates:
+         */
+        memset(&header, 0, sizeof(header));
+        header.xfeatures = xsave->header.xfeatures;
+        header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;
+
+        /*
+         * Copy xregs_state->header:
+         */
+        offset = offsetof(struct xregs_state, header);
+        size = sizeof(header);
+
+        __copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);
+
+        for (i = 0; i < XFEATURE_MAX; i++) {
+                /*
+                 * Copy only in-use xstates:
+                 */
+                if ((header.xfeatures >> i) & 1) {
+                        void *src = __raw_xsave_addr(xsave, 1 << i);
+
+                        offset = xstate_offsets[i];
+                        size = xstate_sizes[i];
+
+                        /* The next component has to fit fully into the output buffer: */
+                        if (offset + size > size_total)
+                                break;
+
+                        __copy_xstate_to_kernel(kbuf, src, offset, size, size_total);
                 }
+
+        }
+
+        if (xfeatures_mxcsr_quirk(header.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                __copy_xstate_to_kernel(kbuf, &xsave->i387.mxcsr, offset, size, size_total);
+        }
+
+        /*
+         * Fill xsave->i387.sw_reserved value for ptrace frame:
+         */
+        offset = offsetof(struct fxregs_state, sw_reserved);
+        size = sizeof(xstate_fx_sw_bytes);
+
+        __copy_xstate_to_kernel(kbuf, xstate_fx_sw_bytes, offset, size, size_total);
+
+        return 0;
+}
+
+static inline int
+__copy_xstate_to_user(void __user *ubuf, const void *data, unsigned int offset, unsigned int size, unsigned int size_total)
+{
+        if (!size)
+                return 0;
+
+        if (offset < size_total) {
+                unsigned int copy = min(size, size_total - offset);
+
+                if (__copy_to_user(ubuf + offset, data, copy))
+                        return -EFAULT;
         }
         return 0;
 }
 
 /*
  * Convert from kernel XSAVES compacted format to standard format and copy
- * to a ptrace buffer. It supports partial copy but pos always starts from
+ * to a user-space buffer. It supports partial copy but pos always starts from
  * zero. This is called from xstateregs_get() and there we check the CPU
  * has XSAVES.
  */
-int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
-                        void __user *ubuf, struct xregs_state *xsave)
+int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
 {
         unsigned int offset, size;
         int ret, i;
@@ -961,7 +1076,7 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
         /*
          * Currently copy_regset_to_user() starts from pos 0:
          */
-        if (unlikely(pos != 0))
+        if (unlikely(offset_start != 0))
                 return -EFAULT;
 
         /*
@@ -977,8 +1092,7 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
         offset = offsetof(struct xregs_state, header);
         size = sizeof(header);
 
-        ret = xstate_copyout(offset, size, kbuf, ubuf, &header, 0, count);
-
+        ret = __copy_xstate_to_user(ubuf, &header, offset, size, size_total);
         if (ret)
                 return ret;
 
@@ -992,25 +1106,30 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
                         offset = xstate_offsets[i];
                         size = xstate_sizes[i];
 
-                        ret = xstate_copyout(offset, size, kbuf, ubuf, src, 0, count);
+                        /* The next component has to fit fully into the output buffer: */
+                        if (offset + size > size_total)
+                                break;
 
+                        ret = __copy_xstate_to_user(ubuf, src, offset, size, size_total);
                         if (ret)
                                 return ret;
-
-                        if (offset + size >= count)
-                                break;
                 }
 
         }
 
+        if (xfeatures_mxcsr_quirk(header.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                __copy_xstate_to_user(ubuf, &xsave->i387.mxcsr, offset, size, size_total);
+        }
+
         /*
          * Fill xsave->i387.sw_reserved value for ptrace frame:
          */
         offset = offsetof(struct fxregs_state, sw_reserved);
         size = sizeof(xstate_fx_sw_bytes);
 
-        ret = xstate_copyout(offset, size, kbuf, ubuf, xstate_fx_sw_bytes, 0, count);
-
+        ret = __copy_xstate_to_user(ubuf, xstate_fx_sw_bytes, offset, size, size_total);
         if (ret)
                 return ret;
 
@@ -1018,55 +1137,98 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
 }
 
 /*
- * Convert from a ptrace standard-format buffer to kernel XSAVES format
- * and copy to the target thread. This is called from xstateregs_set() and
- * there we check the CPU has XSAVES and a whole standard-sized buffer
- * exists.
+ * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format
+ * and copy to the target thread. This is called from xstateregs_set().
  */
-int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
-                     struct xregs_state *xsave)
+int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 {
         unsigned int offset, size;
         int i;
-        u64 xfeatures;
-        u64 allowed_features;
+        struct xstate_header hdr;
 
         offset = offsetof(struct xregs_state, header);
-        size = sizeof(xfeatures);
+        size = sizeof(hdr);
 
-        if (kbuf) {
-                memcpy(&xfeatures, kbuf + offset, size);
-        } else {
-                if (__copy_from_user(&xfeatures, ubuf + offset, size))
-                        return -EFAULT;
+        memcpy(&hdr, kbuf + offset, size);
+
+        if (validate_xstate_header(&hdr))
+                return -EINVAL;
+
+        for (i = 0; i < XFEATURE_MAX; i++) {
+                u64 mask = ((u64)1 << i);
+
+                if (hdr.xfeatures & mask) {
+                        void *dst = __raw_xsave_addr(xsave, 1 << i);
+
+                        offset = xstate_offsets[i];
+                        size = xstate_sizes[i];
+
+                        memcpy(dst, kbuf + offset, size);
+                }
+        }
+
+        if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                memcpy(&xsave->i387.mxcsr, kbuf + offset, size);
         }
 
         /*
-         * Reject if the user sets any disabled or supervisor features:
+         * The state that came in from userspace was user-state only.
+         * Mask all the user states out of 'xfeatures':
+         */
+        xsave->header.xfeatures &= XFEATURE_MASK_SUPERVISOR;
+
+        /*
+         * Add back in the features that came in from userspace:
          */
-        allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
+        xsave->header.xfeatures |= hdr.xfeatures;
 
-        if (xfeatures & ~allowed_features)
+        return 0;
+}
+
+/*
+ * Convert from a ptrace or sigreturn standard-format user-space buffer to
+ * kernel XSAVES format and copy to the target thread. This is called from
+ * xstateregs_set(), as well as potentially from the sigreturn() and
+ * rt_sigreturn() system calls.
+ */
+int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
+{
+        unsigned int offset, size;
+        int i;
+        struct xstate_header hdr;
+
+        offset = offsetof(struct xregs_state, header);
+        size = sizeof(hdr);
+
+        if (__copy_from_user(&hdr, ubuf + offset, size))
+                return -EFAULT;
+
+        if (validate_xstate_header(&hdr))
                 return -EINVAL;
 
         for (i = 0; i < XFEATURE_MAX; i++) {
                 u64 mask = ((u64)1 << i);
 
-                if (xfeatures & mask) {
+                if (hdr.xfeatures & mask) {
                         void *dst = __raw_xsave_addr(xsave, 1 << i);
 
                         offset = xstate_offsets[i];
                         size = xstate_sizes[i];
 
-                        if (kbuf) {
-                                memcpy(dst, kbuf + offset, size);
-                        } else {
-                                if (__copy_from_user(dst, ubuf + offset, size))
-                                        return -EFAULT;
-                        }
+                        if (__copy_from_user(dst, ubuf + offset, size))
+                                return -EFAULT;
                 }
         }
 
+        if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                if (__copy_from_user(&xsave->i387.mxcsr, ubuf + offset, size))
+                        return -EFAULT;
+        }
+
         /*
          * The state that came in from userspace was user-state only.
          * Mask all the user states out of 'xfeatures':
@@ -1076,7 +1238,7 @@ int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
         /*
          * Add back in the features that came in from userspace:
          */
-        xsave->header.xfeatures |= xfeatures;
+        xsave->header.xfeatures |= hdr.xfeatures;
 
         return 0;
 }
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index cf2ce063f65a..2902ca4d5993 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -30,10 +30,11 @@ static void __init i386_default_early_setup(void)
 
 asmlinkage __visible void __init i386_start_kernel(void)
 {
-        cr4_init_shadow();
-
+        /* Make sure IDT is set up before any exception happens */
         idt_setup_early_handler();
 
+        cr4_init_shadow();
+
         sanitize_boot_params(&boot_params);
 
         x86_early_init_platform_quirks();
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 1f38d9a4d9de..d4eb450144fd 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -64,7 +64,7 @@ static void call_on_stack(void *func, void *stack)
 
 static inline void *current_stack(void)
 {
-        return (void *)(current_stack_pointer() & ~(THREAD_SIZE - 1));
+        return (void *)(current_stack_pointer & ~(THREAD_SIZE - 1));
 }
 
 static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
@@ -88,7 +88,7 @@ static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
 
         /* Save the next esp at the bottom of the stack */
         prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer();
+        *prev_esp = current_stack_pointer;
 
         if (unlikely(overflow))
                 call_on_stack(print_stack_overflow, isp);
@@ -139,7 +139,7 @@ void do_softirq_own_stack(void)
 
         /* Push the previous esp onto the stack */
         prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer();
+        *prev_esp = current_stack_pointer;
 
         call_on_stack(__do_softirq, isp);
 }
diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h
index db2182d63ed0..3fc0f9a794cb 100644
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -3,6 +3,15 @@
 
 /* Kprobes and Optprobes common header */
 
+#include <asm/asm.h>
+
+#ifdef CONFIG_FRAME_POINTER
+# define SAVE_RBP_STRING "      push %" _ASM_BP "\n" \
+                         "      mov  %" _ASM_SP ", %" _ASM_BP "\n"
+#else
+# define SAVE_RBP_STRING "      push %" _ASM_BP "\n"
+#endif
+
 #ifdef CONFIG_X86_64
 #define SAVE_REGS_STRING                        \
         /* Skip cs, ip, orig_ax. */             \
@@ -17,7 +26,7 @@
         "       pushq %r10\n"                   \
         "       pushq %r11\n"                   \
         "       pushq %rbx\n"                   \
-        "       pushq %rbp\n"                   \
+        SAVE_RBP_STRING                         \
         "       pushq %r12\n"                   \
         "       pushq %r13\n"                   \
         "       pushq %r14\n"                   \
@@ -48,7 +57,7 @@
         "       pushl %es\n"                    \
         "       pushl %ds\n"                    \
         "       pushl %eax\n"                   \
-        "       pushl %ebp\n"                   \
+        SAVE_RBP_STRING                         \
         "       pushl %edi\n"                   \
         "       pushl %esi\n"                   \
         "       pushl %edx\n"                   \
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index f0153714ddac..0742491cbb73 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1080,8 +1080,6 @@ int setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
          * raw stack chunk with redzones:
          */
         __memcpy(kcb->jprobes_stack, (kprobe_opcode_t *)addr, MIN_STACK_SIZE(addr));
-        regs->flags &= ~X86_EFLAGS_IF;
-        trace_hardirqs_off();
         regs->ip = (unsigned long)(jp->entry);
 
         /*
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4b0592ca9e47..8c1cc08f514f 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -299,7 +299,7 @@ static int __init create_setup_data_nodes(struct kobject *parent)
         return 0;
 
 out_clean_nodes:
-        for (j = i - 1; j > 0; j--)
+        for (j = i - 1; j >= 0; j--)
                 cleanup_setup_data_node(*(kobjp + j));
         kfree(kobjp);
 out_setup_data_kobj:
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index aa60a08b65b1..8bb9594d0761 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -117,7 +117,11 @@ static struct kvm_task_sleep_node *_find_apf_task(struct kvm_task_sleep_head *b,
         return NULL;
 }
 
-void kvm_async_pf_task_wait(u32 token)
+/*
+ * @interrupt_kernel: Is this called from a routine which interrupts the kernel
+ *                    (other than user space)?
+ */
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 {
         u32 key = hash_32(token, KVM_TASK_SLEEP_HASHBITS);
         struct kvm_task_sleep_head *b = &async_pf_sleepers[key];
@@ -140,7 +144,10 @@ void kvm_async_pf_task_wait(u32 token)
 
         n.token = token;
         n.cpu = smp_processor_id();
-        n.halted = is_idle_task(current) || preempt_count() > 1;
+        n.halted = is_idle_task(current) ||
+                   (IS_ENABLED(CONFIG_PREEMPT_COUNT)
+                    ? preempt_count() > 1 || rcu_preempt_depth()
+                    : interrupt_kernel);
         init_swait_queue_head(&n.wq);
         hlist_add_head(&n.link, &b->list);
         raw_spin_unlock(&b->lock);
@@ -268,7 +275,7 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 /* page is swapped out by the host. */
                 prev_state = exception_enter();
-                kvm_async_pf_task_wait((u32)read_cr2());
+                kvm_async_pf_task_wait((u32)read_cr2(), !user_mode(regs));
                 exception_exit(prev_state);
                 break;
         case KVM_PV_REASON_PAGE_READY:
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 54180fa6f66f..add33f600531 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -105,6 +105,10 @@ void __noreturn machine_real_restart(unsigned int type)
         load_cr3(initial_page_table);
 #else
         write_cr3(real_mode_header->trampoline_pgd);
+
+        /* Exiting long mode will fail if CR4.PCIDE is set. */
+        if (static_cpu_has(X86_FEATURE_PCID))
+                cr4_clear_bits(X86_CR4_PCIDE);
 #endif
 
         /* Jump to the identity-mapped low memory code */
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index e04442345fc0..4e188fda5961 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -263,7 +263,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
                 sp = (unsigned long) ka->sa.sa_restorer;
         }
 
-        if (fpu->fpstate_active) {
+        if (fpu->initialized) {
                 sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32),
                                           &buf_fx, &math_size);
                 *fpstate = (void __user *)sp;
@@ -279,7 +279,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
                 return (void __user *)-1L;
 
         /* save i387 and extended state */
-        if (fpu->fpstate_active &&
+        if (fpu->initialized &&
             copy_fpstate_to_sigframe(*fpstate, (void __user *)buf_fx, math_size) < 0)
                 return (void __user *)-1L;
 
@@ -755,7 +755,7 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                 /*
                  * Ensure the signal handler starts with the new fpu state.
                  */
-                if (fpu->fpstate_active)
+                if (fpu->initialized)
                         fpu__clear(fpu);
         }
         signal_setup_done(failed, ksig, stepping);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 34ea3651362e..67db4f43309e 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -142,7 +142,7 @@ void ist_begin_non_atomic(struct pt_regs *regs)
          * from double_fault.
          */
         BUG_ON((unsigned long)(current_top_of_stack() -
-                               current_stack_pointer()) >= THREAD_SIZE);
+                               current_stack_pointer) >= THREAD_SIZE);
 
         preempt_enable_no_resched();
 }
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index d145a0b1f529..3dc26f95d46e 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -44,7 +44,8 @@ static void unwind_dump(struct unwind_state *state)
                         state->stack_info.type, state->stack_info.next_sp,
                         state->stack_mask, state->graph_idx);
 
-        for (sp = state->orig_sp; sp; sp = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
+        for (sp = PTR_ALIGN(state->orig_sp, sizeof(long)); sp;
+             sp = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
                 if (get_stack_info(sp, state->task, &stack_info, &visit_mask))
                         break;
 
@@ -174,6 +175,7 @@ static bool is_last_task_frame(struct unwind_state *state)
  * This determines if the frame pointer actually contains an encoded pointer to
  * pt_regs on the stack.  See ENCODE_FRAME_POINTER.
  */
+#ifdef CONFIG_X86_64
 static struct pt_regs *decode_frame_pointer(unsigned long *bp)
 {
         unsigned long regs = (unsigned long)bp;
@@ -183,6 +185,23 @@ static struct pt_regs *decode_frame_pointer(unsigned long *bp)
 
         return (struct pt_regs *)(regs & ~0x1);
 }
+#else
+static struct pt_regs *decode_frame_pointer(unsigned long *bp)
+{
+        unsigned long regs = (unsigned long)bp;
+
+        if (regs & 0x80000000)
+                return NULL;
+
+        return (struct pt_regs *)(regs | 0x80000000);
+}
+#endif
+
+#ifdef CONFIG_X86_32
+#define KERNEL_REGS_SIZE (sizeof(struct pt_regs) - 2*sizeof(long))
+#else
+#define KERNEL_REGS_SIZE (sizeof(struct pt_regs))
+#endif
 
 static bool update_stack_state(struct unwind_state *state,
                                unsigned long *next_bp)
@@ -202,7 +221,7 @@ static bool update_stack_state(struct unwind_state *state,
         regs = decode_frame_pointer(next_bp);
         if (regs) {
                 frame = (unsigned long *)regs;
-                len = regs_size(regs);
+                len = KERNEL_REGS_SIZE;
                 state->got_irq = true;
         } else {
                 frame = next_bp;
@@ -226,6 +245,14 @@ static bool update_stack_state(struct unwind_state *state,
             frame < prev_frame_end)
                 return false;
 
+        /*
+         * On 32-bit with user mode regs, make sure the last two regs are safe
+         * to access:
+         */
+        if (IS_ENABLED(CONFIG_X86_32) && regs && user_mode(regs) &&
+            !on_stack(info, frame, len + 2*sizeof(long)))
+                return false;
+
         /* Move state to the next frame: */
         if (regs) {
                 state->regs = regs;
@@ -328,6 +355,13 @@ bad_address:
             state->regs->sp < (unsigned long)task_pt_regs(state->task))
                 goto the_end;
 
+        /*
+         * There are some known frame pointer issues on 32-bit.  Disable
+         * unwinder warnings on 32-bit until it gets objtool support.
+         */
+        if (IS_ENABLED(CONFIG_X86_32))
+                goto the_end;
+
         if (state->regs) {
                 printk_deferred_once(KERN_WARNING
                         "WARNING: kernel stack regs at %p in %s:%d has bad 'bp' value %p\n",
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index 570b70d3f604..b95007e7c1b3 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -86,8 +86,8 @@ static struct orc_entry *orc_find(unsigned long ip)
                 idx = (ip - LOOKUP_START_IP) / LOOKUP_BLOCK_SIZE;
 
                 if (unlikely((idx >= lookup_num_blocks-1))) {
-                        orc_warn("WARNING: bad lookup idx: idx=%u num=%u ip=%lx\n",
-                                 idx, lookup_num_blocks, ip);
+                        orc_warn("WARNING: bad lookup idx: idx=%u num=%u ip=%pB\n",
+                                 idx, lookup_num_blocks, (void *)ip);
                         return NULL;
                 }
 
@@ -96,8 +96,8 @@ static struct orc_entry *orc_find(unsigned long ip)
 
                 if (unlikely((__start_orc_unwind + start >= __stop_orc_unwind) ||
                              (__start_orc_unwind + stop > __stop_orc_unwind))) {
-                        orc_warn("WARNING: bad lookup value: idx=%u num=%u start=%u stop=%u ip=%lx\n",
-                                 idx, lookup_num_blocks, start, stop, ip);
+                        orc_warn("WARNING: bad lookup value: idx=%u num=%u start=%u stop=%u ip=%pB\n",
+                                 idx, lookup_num_blocks, start, stop, (void *)ip);
                         return NULL;
                 }
 
@@ -373,7 +373,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_REG_R10:
                 if (!state->regs || !state->full_regs) {
-                        orc_warn("missing regs for base reg R10 at ip %p\n",
+                        orc_warn("missing regs for base reg R10 at ip %pB\n",
                                  (void *)state->ip);
                         goto done;
                 }
@@ -382,7 +382,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_REG_R13:
                 if (!state->regs || !state->full_regs) {
-                        orc_warn("missing regs for base reg R13 at ip %p\n",
+                        orc_warn("missing regs for base reg R13 at ip %pB\n",
                                  (void *)state->ip);
                         goto done;
                 }
@@ -391,7 +391,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_REG_DI:
                 if (!state->regs || !state->full_regs) {
-                        orc_warn("missing regs for base reg DI at ip %p\n",
+                        orc_warn("missing regs for base reg DI at ip %pB\n",
                                  (void *)state->ip);
                         goto done;
                 }
@@ -400,7 +400,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_REG_DX:
                 if (!state->regs || !state->full_regs) {
-                        orc_warn("missing regs for base reg DX at ip %p\n",
+                        orc_warn("missing regs for base reg DX at ip %pB\n",
                                  (void *)state->ip);
                         goto done;
                 }
@@ -408,7 +408,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 break;
 
         default:
-                orc_warn("unknown SP base reg %d for ip %p\n",
+                orc_warn("unknown SP base reg %d for ip %pB\n",
                          orc->sp_reg, (void *)state->ip);
                 goto done;
         }
@@ -436,7 +436,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_TYPE_REGS:
                 if (!deref_stack_regs(state, sp, &state->ip, &state->sp, true)) {
-                        orc_warn("can't dereference registers at %p for ip %p\n",
+                        orc_warn("can't dereference registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
                         goto done;
                 }
@@ -448,7 +448,7 @@ bool unwind_next_frame(struct unwind_state *state)
 
         case ORC_TYPE_REGS_IRET:
                 if (!deref_stack_regs(state, sp, &state->ip, &state->sp, false)) {
-                        orc_warn("can't dereference iret registers at %p for ip %p\n",
+                        orc_warn("can't dereference iret registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
                         goto done;
                 }
@@ -465,7 +465,8 @@ bool unwind_next_frame(struct unwind_state *state)
                 break;
 
         default:
-                orc_warn("unknown .orc_unwind entry type %d\n", orc->type);
+                orc_warn("unknown .orc_unwind entry type %d for ip %pB\n",
+                         orc->type, (void *)orig_ip);
                 break;
         }
 
@@ -487,7 +488,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 break;
 
         default:
-                orc_warn("unknown BP base reg %d for ip %p\n",
+                orc_warn("unknown BP base reg %d for ip %pB\n",
                          orc->bp_reg, (void *)orig_ip);
                 goto done;
         }
@@ -496,7 +497,7 @@ bool unwind_next_frame(struct unwind_state *state)
         if (state->stack_info.type == prev_type &&
             on_stack(&state->stack_info, (void *)state->sp, sizeof(long)) &&
             state->sp <= prev_sp) {
-                orc_warn("stack going in the wrong direction? ip=%p\n",
+                orc_warn("stack going in the wrong direction? ip=%pB\n",
                          (void *)orig_ip);
                 goto done;
         }
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 3ea624452f93..3c48bc8bf08c 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -23,6 +23,7 @@ config KVM
         depends on HIGH_RES_TIMERS
         # for TASKSTATS/TASK_DELAY_ACCT:
         depends on NET && MULTIUSER
+        depends on X86_LOCAL_APIC
         select PREEMPT_NOTIFIERS
         select MMU_NOTIFIER
         select ANON_INODES
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index a36254cbf776..d90cdc77e077 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -425,8 +425,10 @@ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *));
         #op " %al \n\t" \
         FOP_RET
 
-asm(".global kvm_fastop_exception \n"
-    "kvm_fastop_exception: xor %esi, %esi; ret");
+asm(".pushsection .fixup, \"ax\"\n"
+    ".global kvm_fastop_exception \n"
+    "kvm_fastop_exception: xor %esi, %esi; ret\n"
+    ".popsection");
 
 FOP_START(setcc)
 FOP_SETCC(seto)
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index eca30c1eb1d9..7a69cf053711 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3837,7 +3837,7 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 vcpu->arch.apf.host_apf_reason = 0;
                 local_irq_disable();
-                kvm_async_pf_task_wait(fault_address);
+                kvm_async_pf_task_wait(fault_address, 0);
                 local_irq_enable();
                 break;
         case KVM_PV_REASON_PAGE_READY:
@@ -3974,19 +3974,19 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu,
                                 unsigned level, unsigned gpte)
 {
         /*
-         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
-         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
-         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
-         */
-        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
-
-        /*
          * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
          * If it is clear, there are no large pages at this level, so clear
          * PT_PAGE_SIZE_MASK in gpte if that is the case.
          */
         gpte &= level - mmu->last_nonleaf_level;
 
+        /*
+         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
+         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
+         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
+         */
+        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
+
         return gpte & PT_PAGE_SIZE_MASK;
 }
 
@@ -4555,6 +4555,7 @@ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
 
         update_permission_bitmask(vcpu, context, true);
         update_pkru_bitmask(vcpu, context, true);
+        update_last_nonleaf_level(vcpu, context);
         reset_rsvds_bits_mask_ept(vcpu, context, execonly);
         reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
 }
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 86b68dc5a649..f18d1f8d332b 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -334,10 +334,11 @@ retry_walk:
                 --walker->level;
 
                 index = PT_INDEX(addr, walker->level);
-
                 table_gfn = gpte_to_gfn(pte);
                 offset    = index * sizeof(pt_element_t);
                 pte_gpa   = gfn_to_gpa(table_gfn) + offset;
+
+                BUG_ON(walker->level < 1);
                 walker->table_gfn[walker->level - 1] = table_gfn;
                 walker->pte_gpa[walker->level - 1] = pte_gpa;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 6970249c09fc..95a01609d7ee 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -200,6 +200,8 @@ struct loaded_vmcs {
         int cpu;
         bool launched;
         bool nmi_known_unmasked;
+        unsigned long vmcs_host_cr3;    /* May not match real cr3 */
+        unsigned long vmcs_host_cr4;    /* May not match real cr4 */
         struct list_head loaded_vmcss_on_cpu_link;
 };
 
@@ -600,8 +602,6 @@ struct vcpu_vmx {
                 int           gs_ldt_reload_needed;
                 int           fs_reload_needed;
                 u64           msr_host_bndcfgs;
-                unsigned long vmcs_host_cr3;    /* May not match real cr3 */
-                unsigned long vmcs_host_cr4;    /* May not match real cr4 */
         } host_state;
         struct {
                 int vm86_active;
@@ -2202,46 +2202,44 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
         struct pi_desc old, new;
         unsigned int dest;
 
-        if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
-                !kvm_vcpu_apicv_active(vcpu))
+        /*
+         * In case of hot-plug or hot-unplug, we may have to undo
+         * vmx_vcpu_pi_put even if there is no assigned device.  And we
+         * always keep PI.NDST up to date for simplicity: it makes the
+         * code easier, and CPU migration is not a fast path.
+         */
+        if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
                 return;
 
+        /*
+         * First handle the simple case where no cmpxchg is necessary; just
+         * allow posting non-urgent interrupts.
+         *
+         * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
+         * PI.NDST: pi_post_block will do it for us and the wakeup_handler
+         * expects the VCPU to be on the blocked_vcpu_list that matches
+         * PI.NDST.
+         */
+        if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR ||
+            vcpu->cpu == cpu) {
+                pi_clear_sn(pi_desc);
+                return;
+        }
+
+        /* The full case.  */
         do {
                 old.control = new.control = pi_desc->control;
 
-                /*
-                 * If 'nv' field is POSTED_INTR_WAKEUP_VECTOR, there
-                 * are two possible cases:
-                 * 1. After running 'pre_block', context switch
-                 *    happened. For this case, 'sn' was set in
-                 *    vmx_vcpu_put(), so we need to clear it here.
-                 * 2. After running 'pre_block', we were blocked,
-                 *    and woken up by some other guy. For this case,
-                 *    we don't need to do anything, 'pi_post_block'
-                 *    will do everything for us. However, we cannot
-                 *    check whether it is case #1 or case #2 here
-                 *    (maybe, not needed), so we also clear sn here,
-                 *    I think it is not a big deal.
-                 */
-                if (pi_desc->nv != POSTED_INTR_WAKEUP_VECTOR) {
-                        if (vcpu->cpu != cpu) {
-                                dest = cpu_physical_id(cpu);
-
-                                if (x2apic_enabled())
-                                        new.ndst = dest;
-                                else
-                                        new.ndst = (dest << 8) & 0xFF00;
-                        }
+                dest = cpu_physical_id(cpu);
 
-                        /* set 'NV' to 'notification vector' */
-                        new.nv = POSTED_INTR_VECTOR;
-                }
+                if (x2apic_enabled())
+                        new.ndst = dest;
+                else
+                        new.ndst = (dest << 8) & 0xFF00;
 
-                /* Allow posting non-urgent interrupts */
                 new.sn = 0;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
 }
 
 static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
@@ -5178,12 +5176,12 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
          */
         cr3 = __read_cr3();
         vmcs_writel(HOST_CR3, cr3);             /* 22.2.3  FIXME: shadow tables */
-        vmx->host_state.vmcs_host_cr3 = cr3;
+        vmx->loaded_vmcs->vmcs_host_cr3 = cr3;
 
         /* Save the most likely value for this task's CR4 in the VMCS. */
         cr4 = cr4_read_shadow();
         vmcs_writel(HOST_CR4, cr4);                     /* 22.2.3, 22.2.5 */
-        vmx->host_state.vmcs_host_cr4 = cr4;
+        vmx->loaded_vmcs->vmcs_host_cr4 = cr4;
 
         vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS);  /* 22.2.4 */
 #ifdef CONFIG_X86_64
@@ -9273,15 +9271,15 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
                 vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
 
         cr3 = __get_current_cr3_fast();
-        if (unlikely(cr3 != vmx->host_state.vmcs_host_cr3)) {
+        if (unlikely(cr3 != vmx->loaded_vmcs->vmcs_host_cr3)) {
                 vmcs_writel(HOST_CR3, cr3);
-                vmx->host_state.vmcs_host_cr3 = cr3;
+                vmx->loaded_vmcs->vmcs_host_cr3 = cr3;
         }
 
         cr4 = cr4_read_shadow();
-        if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
+        if (unlikely(cr4 != vmx->loaded_vmcs->vmcs_host_cr4)) {
                 vmcs_writel(HOST_CR4, cr4);
-                vmx->host_state.vmcs_host_cr4 = cr4;
+                vmx->loaded_vmcs->vmcs_host_cr4 = cr4;
         }
 
         /* When single-stepping over STI and MOV SS, we must clear the
@@ -9591,6 +9589,13 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 
         vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
 
+        /*
+         * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
+         * or POSTED_INTR_WAKEUP_VECTOR.
+         */
+        vmx->pi_desc.nv = POSTED_INTR_VECTOR;
+        vmx->pi_desc.sn = 1;
+
         return &vmx->vcpu;
 
 free_vmcs:
@@ -9839,7 +9844,8 @@ static void vmx_inject_page_fault_nested(struct kvm_vcpu *vcpu,
 
         WARN_ON(!is_guest_mode(vcpu));
 
-        if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code)) {
+        if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code) &&
+                !to_vmx(vcpu)->nested.nested_run_pending) {
                 vmcs12->vm_exit_intr_error_code = fault->error_code;
                 nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                                   PF_VECTOR | INTR_TYPE_HARD_EXCEPTION |
@@ -11291,7 +11297,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
 
         /* Same as above - no reason to call set_cr4_guest_host_mask().  */
         vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
-        kvm_set_cr4(vcpu, vmcs12->host_cr4);
+        vmx_set_cr4(vcpu, vmcs12->host_cr4);
 
         nested_ept_uninit_mmu_context(vcpu);
 
@@ -11704,6 +11710,37 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
         kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
 }
 
+static void __pi_post_block(struct kvm_vcpu *vcpu)
+{
+        struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+        struct pi_desc old, new;
+        unsigned int dest;
+
+        do {
+                old.control = new.control = pi_desc->control;
+                WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
+                     "Wakeup handler not enabled while the VCPU is blocked\n");
+
+                dest = cpu_physical_id(vcpu->cpu);
+
+                if (x2apic_enabled())
+                        new.ndst = dest;
+                else
+                        new.ndst = (dest << 8) & 0xFF00;
+
+                /* set 'NV' to 'notification vector' */
+                new.nv = POSTED_INTR_VECTOR;
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
+
+        if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
+                spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                list_del(&vcpu->blocked_vcpu_list);
+                spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                vcpu->pre_pcpu = -1;
+        }
+}
+
 /*
  * This routine does the following things for vCPU which is going
  * to be blocked if VT-d PI is enabled.
@@ -11719,7 +11756,6 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
  */
 static int pi_pre_block(struct kvm_vcpu *vcpu)
 {
-        unsigned long flags;
         unsigned int dest;
         struct pi_desc old, new;
         struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
@@ -11729,34 +11765,20 @@ static int pi_pre_block(struct kvm_vcpu *vcpu)
                 !kvm_vcpu_apicv_active(vcpu))
                 return 0;
 
-        vcpu->pre_pcpu = vcpu->cpu;
-        spin_lock_irqsave(&per_cpu(blocked_vcpu_on_cpu_lock,
-                          vcpu->pre_pcpu), flags);
-        list_add_tail(&vcpu->blocked_vcpu_list,
-                      &per_cpu(blocked_vcpu_on_cpu,
-                      vcpu->pre_pcpu));
-        spin_unlock_irqrestore(&per_cpu(blocked_vcpu_on_cpu_lock,
-                               vcpu->pre_pcpu), flags);
+        WARN_ON(irqs_disabled());
+        local_irq_disable();
+        if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
+                vcpu->pre_pcpu = vcpu->cpu;
+                spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                list_add_tail(&vcpu->blocked_vcpu_list,
+                              &per_cpu(blocked_vcpu_on_cpu,
+                                       vcpu->pre_pcpu));
+                spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+        }
 
         do {
                 old.control = new.control = pi_desc->control;
 
-                /*
-                 * We should not block the vCPU if
-                 * an interrupt is posted for it.
-                 */
-                if (pi_test_on(pi_desc) == 1) {
-                        spin_lock_irqsave(&per_cpu(blocked_vcpu_on_cpu_lock,
-                                          vcpu->pre_pcpu), flags);
-                        list_del(&vcpu->blocked_vcpu_list);
-                        spin_unlock_irqrestore(
-                                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                                        vcpu->pre_pcpu), flags);
-                        vcpu->pre_pcpu = -1;
-
-                        return 1;
-                }
-
                 WARN((pi_desc->sn == 1),
                      "Warning: SN field of posted-interrupts "
                      "is set before blocking\n");
@@ -11778,10 +11800,15 @@ static int pi_pre_block(struct kvm_vcpu *vcpu)
 
                 /* set 'NV' to 'wakeup vector' */
                 new.nv = POSTED_INTR_WAKEUP_VECTOR;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
 
-        return 0;
+        /* We should not block the vCPU if an interrupt is posted for it.  */
+        if (pi_test_on(pi_desc) == 1)
+                __pi_post_block(vcpu);
+
+        local_irq_enable();
+        return (vcpu->pre_pcpu == -1);
 }
 
 static int vmx_pre_block(struct kvm_vcpu *vcpu)
@@ -11797,44 +11824,13 @@ static int vmx_pre_block(struct kvm_vcpu *vcpu)
 
 static void pi_post_block(struct kvm_vcpu *vcpu)
 {
-        struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
-        struct pi_desc old, new;
-        unsigned int dest;
-        unsigned long flags;
-
-        if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
-                !kvm_vcpu_apicv_active(vcpu))
+        if (vcpu->pre_pcpu == -1)
                 return;
 
-        do {
-                old.control = new.control = pi_desc->control;
-
-                dest = cpu_physical_id(vcpu->cpu);
-
-                if (x2apic_enabled())
-                        new.ndst = dest;
-                else
-                        new.ndst = (dest << 8) & 0xFF00;
-
-                /* Allow posting non-urgent interrupts */
-                new.sn = 0;
-
-                /* set 'NV' to 'notification vector' */
-                new.nv = POSTED_INTR_VECTOR;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
-
-        if(vcpu->pre_pcpu != -1) {
-                spin_lock_irqsave(
-                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                        vcpu->pre_pcpu), flags);
-                list_del(&vcpu->blocked_vcpu_list);
-                spin_unlock_irqrestore(
-                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                        vcpu->pre_pcpu), flags);
-                vcpu->pre_pcpu = -1;
-        }
+        WARN_ON(irqs_disabled());
+        local_irq_disable();
+        __pi_post_block(vcpu);
+        local_irq_enable();
 }
 
 static void vmx_post_block(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index cd17b7d9a107..03869eb7fcd6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7225,7 +7225,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         int r;
         sigset_t sigsaved;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         if (vcpu->sigset_active)
                 sigprocmask(SIG_SETMASK, &vcpu->sigset, &sigsaved);
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index d4a7df2205b8..220638a4cb94 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -114,7 +114,7 @@ void math_emulate(struct math_emu_info *info)
         struct desc_struct code_descriptor;
         struct fpu *fpu = &current->thread.fpu;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
 #ifdef RE_ENTRANT_CHECKING
         if (emulating) {
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index 72bf8c01c6e3..e1f095884386 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -1,5 +1,12 @@
-# Kernel does not boot with instrumentation of tlb.c.
-KCOV_INSTRUMENT_tlb.o   := n
+# Kernel does not boot with instrumentation of tlb.c and mem_encrypt.c
+KCOV_INSTRUMENT_tlb.o           := n
+KCOV_INSTRUMENT_mem_encrypt.o   := n
+
+KASAN_SANITIZE_mem_encrypt.o    := n
+
+ifdef CONFIG_FUNCTION_TRACER
+CFLAGS_REMOVE_mem_encrypt.o     = -pg
+endif
 
 obj-y   :=  init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
             pat.o pgtable.o physaddr.o setup_nx.o tlb.o
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index c076f710de4c..c3521e2be396 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -2,6 +2,7 @@
 #include <linux/uaccess.h>
 #include <linux/sched/debug.h>
 
+#include <asm/fpu/internal.h>
 #include <asm/traps.h>
 #include <asm/kdebug.h>
 
@@ -78,6 +79,29 @@ bool ex_handler_refcount(const struct exception_table_entry *fixup,
 }
 EXPORT_SYMBOL_GPL(ex_handler_refcount);
 
+/*
+ * Handler for when we fail to restore a task's FPU state.  We should never get
+ * here because the FPU state of a task using the FPU (task->thread.fpu.state)
+ * should always be valid.  However, past bugs have allowed userspace to set
+ * reserved bits in the XSAVE area using PTRACE_SETREGSET or sys_rt_sigreturn().
+ * These caused XRSTOR to fail when switching to the task, leaking the FPU
+ * registers of the task previously executing on the CPU.  Mitigate this class
+ * of vulnerability by restoring from the initial state (essentially, zeroing
+ * out all the FPU registers) if we can't restore from the task's FPU state.
+ */
+bool ex_handler_fprestore(const struct exception_table_entry *fixup,
+                          struct pt_regs *regs, int trapnr)
+{
+        regs->ip = ex_fixup_addr(fixup);
+
+        WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
+                  (void *)instruction_pointer(regs));
+
+        __copy_kernel_to_fpregs(&init_fpstate, -1);
+        return true;
+}
+EXPORT_SYMBOL_GPL(ex_handler_fprestore);
+
 bool ex_handler_ext(const struct exception_table_entry *fixup,
                    struct pt_regs *regs, int trapnr)
 {
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 39567b5c33da..7101c281c7ce 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -192,8 +192,7 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
  * 6. T1   : reaches here, sees vma_pkey(vma)=5, when we really
  *           faulted on a pte with its pkey=4.
  */
-static void fill_sig_info_pkey(int si_code, siginfo_t *info,
-                struct vm_area_struct *vma)
+static void fill_sig_info_pkey(int si_code, siginfo_t *info, u32 *pkey)
 {
         /* This is effectively an #ifdef */
         if (!boot_cpu_has(X86_FEATURE_OSPKE))
@@ -209,7 +208,7 @@ static void fill_sig_info_pkey(int si_code, siginfo_t *info,
          * valid VMA, so we should never reach this without a
          * valid VMA.
          */
-        if (!vma) {
+        if (!pkey) {
                 WARN_ONCE(1, "PKU fault with no VMA passed in");
                 info->si_pkey = 0;
                 return;
@@ -219,13 +218,12 @@ static void fill_sig_info_pkey(int si_code, siginfo_t *info,
          * absolutely guranteed to be 100% accurate because of
          * the race explained above.
          */
-        info->si_pkey = vma_pkey(vma);
+        info->si_pkey = *pkey;
 }
 
 static void
 force_sig_info_fault(int si_signo, int si_code, unsigned long address,
-                     struct task_struct *tsk, struct vm_area_struct *vma,
-                     int fault)
+                     struct task_struct *tsk, u32 *pkey, int fault)
 {
         unsigned lsb = 0;
         siginfo_t info;
@@ -240,7 +238,7 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
                 lsb = PAGE_SHIFT;
         info.si_addr_lsb = lsb;
 
-        fill_sig_info_pkey(si_code, &info, vma);
+        fill_sig_info_pkey(si_code, &info, pkey);
 
         force_sig_info(si_signo, &info, tsk);
 }
@@ -762,8 +760,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
         struct task_struct *tsk = current;
         unsigned long flags;
         int sig;
-        /* No context means no VMA to pass down */
-        struct vm_area_struct *vma = NULL;
 
         /* Are we prepared to handle this kernel fault? */
         if (fixup_exception(regs, X86_TRAP_PF)) {
@@ -788,7 +784,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
 
                         /* XXX: hwpoison faults will set the wrong code. */
                         force_sig_info_fault(signal, si_code, address,
-                                             tsk, vma, 0);
+                                             tsk, NULL, 0);
                 }
 
                 /*
@@ -896,8 +892,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
 
 static void
 __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
-                       unsigned long address, struct vm_area_struct *vma,
-                       int si_code)
+                       unsigned long address, u32 *pkey, int si_code)
 {
         struct task_struct *tsk = current;
 
@@ -945,7 +940,7 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
                 tsk->thread.error_code  = error_code;
                 tsk->thread.trap_nr     = X86_TRAP_PF;
 
-                force_sig_info_fault(SIGSEGV, si_code, address, tsk, vma, 0);
+                force_sig_info_fault(SIGSEGV, si_code, address, tsk, pkey, 0);
 
                 return;
         }
@@ -958,9 +953,9 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
 
 static noinline void
 bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
-                     unsigned long address, struct vm_area_struct *vma)
+                     unsigned long address, u32 *pkey)
 {
-        __bad_area_nosemaphore(regs, error_code, address, vma, SEGV_MAPERR);
+        __bad_area_nosemaphore(regs, error_code, address, pkey, SEGV_MAPERR);
 }
 
 static void
@@ -968,6 +963,10 @@ __bad_area(struct pt_regs *regs, unsigned long error_code,
            unsigned long address,  struct vm_area_struct *vma, int si_code)
 {
         struct mm_struct *mm = current->mm;
+        u32 pkey;
+
+        if (vma)
+                pkey = vma_pkey(vma);
 
         /*
          * Something tried to access memory that isn't in our memory map..
@@ -975,7 +974,8 @@ __bad_area(struct pt_regs *regs, unsigned long error_code,
          */
         up_read(&mm->mmap_sem);
 
-        __bad_area_nosemaphore(regs, error_code, address, vma, si_code);
+        __bad_area_nosemaphore(regs, error_code, address,
+                               (vma) ? &pkey : NULL, si_code);
 }
 
 static noinline void
@@ -1018,7 +1018,7 @@ bad_area_access_error(struct pt_regs *regs, unsigned long error_code,
 
 static void
 do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
-          struct vm_area_struct *vma, unsigned int fault)
+          u32 *pkey, unsigned int fault)
 {
         struct task_struct *tsk = current;
         int code = BUS_ADRERR;
@@ -1045,13 +1045,12 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
                 code = BUS_MCEERR_AR;
         }
 #endif
-        force_sig_info_fault(SIGBUS, code, address, tsk, vma, fault);
+        force_sig_info_fault(SIGBUS, code, address, tsk, pkey, fault);
 }
 
 static noinline void
 mm_fault_error(struct pt_regs *regs, unsigned long error_code,
-               unsigned long address, struct vm_area_struct *vma,
-               unsigned int fault)
+               unsigned long address, u32 *pkey, unsigned int fault)
 {
         if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
                 no_context(regs, error_code, address, 0, 0);
@@ -1075,9 +1074,9 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
         } else {
                 if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
                              VM_FAULT_HWPOISON_LARGE))
-                        do_sigbus(regs, error_code, address, vma, fault);
+                        do_sigbus(regs, error_code, address, pkey, fault);
                 else if (fault & VM_FAULT_SIGSEGV)
-                        bad_area_nosemaphore(regs, error_code, address, vma);
+                        bad_area_nosemaphore(regs, error_code, address, pkey);
                 else
                         BUG();
         }
@@ -1267,6 +1266,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
         struct mm_struct *mm;
         int fault, major = 0;
         unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        u32 pkey;
 
         tsk = current;
         mm = tsk->mm;
@@ -1440,7 +1440,17 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.  Since we never set FAULT_FLAG_RETRY_NOWAIT, if
          * we get VM_FAULT_RETRY back, the mmap_sem has been unlocked.
+         *
+         * Note that handle_userfault() may also release and reacquire mmap_sem
+         * (and not return with VM_FAULT_RETRY), when returning to userland to
+         * repeat the page fault later with a VM_FAULT_NOPAGE retval
+         * (potentially after handling any pending signal during the return to
+         * userland). The return to userland is identified whenever
+         * FAULT_FLAG_USER|FAULT_FLAG_KILLABLE are both set in flags.
+         * Thus we have to be careful about not touching vma after handling the
+         * fault, so we read the pkey beforehand.
          */
+        pkey = vma_pkey(vma);
         fault = handle_mm_fault(vma, address, flags);
         major |= fault & VM_FAULT_MAJOR;
 
@@ -1469,7 +1479,7 @@ good_area:
 
         up_read(&mm->mmap_sem);
         if (unlikely(fault & VM_FAULT_ERROR)) {
-                mm_fault_error(regs, error_code, address, vma, fault);
+                mm_fault_error(regs, error_code, address, &pkey, fault);
                 return;
         }
 
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index 3fcc8e01683b..16c5f37933a2 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -10,6 +10,8 @@
  * published by the Free Software Foundation.
  */
 
+#define DISABLE_BRANCH_PROFILING
+
 #include <linux/linkage.h>
 #include <linux/init.h>
 #include <linux/mm.h>
diff --git a/arch/x86/mm/pkeys.c b/arch/x86/mm/pkeys.c
index 2dab69a706ec..d7bc0eea20a5 100644
--- a/arch/x86/mm/pkeys.c
+++ b/arch/x86/mm/pkeys.c
@@ -18,7 +18,6 @@
 
 #include <asm/cpufeature.h>             /* boot_cpu_has, ...            */
 #include <asm/mmu_context.h>            /* vma_pkey()                   */
-#include <asm/fpu/internal.h>           /* fpregs_active()              */
 
 int __execute_only_pkey(struct mm_struct *mm)
 {
@@ -45,7 +44,7 @@ int __execute_only_pkey(struct mm_struct *mm)
          */
         preempt_disable();
         if (!need_to_set_mm_pkey &&
-            fpregs_active() &&
+            current->thread.fpu.initialized &&
             !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
                 preempt_enable();
                 return execute_only_pkey;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 93fe97cce581..0f3d0cea4d00 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -30,6 +30,7 @@
 
 atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1);
 
+
 static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen,
                             u16 *new_asid, bool *need_flush)
 {
@@ -80,7 +81,7 @@ void leave_mm(int cpu)
                 return;
 
         /* Warn if we're not lazy. */
-        WARN_ON(cpumask_test_cpu(smp_processor_id(), mm_cpumask(loaded_mm)));
+        WARN_ON(!this_cpu_read(cpu_tlbstate.is_lazy));
 
         switch_mm(NULL, &init_mm, NULL);
 }
@@ -142,45 +143,24 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 __flush_tlb_all();
         }
 #endif
+        this_cpu_write(cpu_tlbstate.is_lazy, false);
 
         if (real_prev == next) {
-                VM_BUG_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=
-                          next->context.ctx_id);
-
-                if (cpumask_test_cpu(cpu, mm_cpumask(next))) {
-                        /*
-                         * There's nothing to do: we weren't lazy, and we
-                         * aren't changing our mm.  We don't need to flush
-                         * anything, nor do we need to update CR3, CR4, or
-                         * LDTR.
-                         */
-                        return;
-                }
-
-                /* Resume remote flushes and then read tlb_gen. */
-                cpumask_set_cpu(cpu, mm_cpumask(next));
-                next_tlb_gen = atomic64_read(&next->context.tlb_gen);
-
-                if (this_cpu_read(cpu_tlbstate.ctxs[prev_asid].tlb_gen) <
-                    next_tlb_gen) {
-                        /*
-                         * Ideally, we'd have a flush_tlb() variant that
-                         * takes the known CR3 value as input.  This would
-                         * be faster on Xen PV and on hypothetical CPUs
-                         * on which INVPCID is fast.
-                         */
-                        this_cpu_write(cpu_tlbstate.ctxs[prev_asid].tlb_gen,
-                                       next_tlb_gen);
-                        write_cr3(build_cr3(next, prev_asid));
-                        trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH,
-                                        TLB_FLUSH_ALL);
-                }
+                VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=
+                           next->context.ctx_id);
 
                 /*
-                 * We just exited lazy mode, which means that CR4 and/or LDTR
-                 * may be stale.  (Changes to the required CR4 and LDTR states
-                 * are not reflected in tlb_gen.)
+                 * We don't currently support having a real mm loaded without
+                 * our cpu set in mm_cpumask().  We have all the bookkeeping
+                 * in place to figure out whether we would need to flush
+                 * if our cpu were cleared in mm_cpumask(), but we don't
+                 * currently use it.
                  */
+                if (WARN_ON_ONCE(real_prev != &init_mm &&
+                                 !cpumask_test_cpu(cpu, mm_cpumask(next))))
+                        cpumask_set_cpu(cpu, mm_cpumask(next));
+
+                return;
         } else {
                 u16 new_asid;
                 bool need_flush;
@@ -191,7 +171,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                          * mapped in the new pgd, we'll double-fault.  Forcibly
                          * map it.
                          */
-                        unsigned int index = pgd_index(current_stack_pointer());
+                        unsigned int index = pgd_index(current_stack_pointer);
                         pgd_t *pgd = next->pgd + index;
 
                         if (unlikely(pgd_none(*pgd)))
@@ -199,10 +179,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 }
 
                 /* Stop remote flushes for the previous mm */
-                if (cpumask_test_cpu(cpu, mm_cpumask(real_prev)))
-                        cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
-
-                VM_WARN_ON_ONCE(cpumask_test_cpu(cpu, mm_cpumask(next)));
+                VM_WARN_ON_ONCE(!cpumask_test_cpu(cpu, mm_cpumask(real_prev)) &&
+                                real_prev != &init_mm);
+                cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
 
                 /*
                  * Start remote flushes and then read tlb_gen.
@@ -233,6 +212,40 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
 }
 
 /*
+ * Please ignore the name of this function.  It should be called
+ * switch_to_kernel_thread().
+ *
+ * enter_lazy_tlb() is a hint from the scheduler that we are entering a
+ * kernel thread or other context without an mm.  Acceptable implementations
+ * include doing nothing whatsoever, switching to init_mm, or various clever
+ * lazy tricks to try to minimize TLB flushes.
+ *
+ * The scheduler reserves the right to call enter_lazy_tlb() several times
+ * in a row.  It will notify us that we're going back to a real mm by
+ * calling switch_mm_irqs_off().
+ */
+void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+{
+        if (this_cpu_read(cpu_tlbstate.loaded_mm) == &init_mm)
+                return;
+
+        if (tlb_defer_switch_to_init_mm()) {
+                /*
+                 * There's a significant optimization that may be possible
+                 * here.  We have accurate enough TLB flush tracking that we
+                 * don't need to maintain coherence of TLB per se when we're
+                 * lazy.  We do, however, need to maintain coherence of
+                 * paging-structure caches.  We could, in principle, leave our
+                 * old mm loaded and only switch to init_mm when
+                 * tlb_remove_page() happens.
+                 */
+                this_cpu_write(cpu_tlbstate.is_lazy, true);
+        } else {
+                switch_mm(NULL, &init_mm, NULL);
+        }
+}
+
+/*
  * Call this when reinitializing a CPU.  It fixes the following potential
  * problems:
  *
@@ -303,16 +316,20 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
         /* This code cannot presently handle being reentered. */
         VM_WARN_ON(!irqs_disabled());
 
+        if (unlikely(loaded_mm == &init_mm))
+                return;
+
         VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[loaded_mm_asid].ctx_id) !=
                    loaded_mm->context.ctx_id);
 
-        if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(loaded_mm))) {
+        if (this_cpu_read(cpu_tlbstate.is_lazy)) {
                 /*
-                 * We're in lazy mode -- don't flush.  We can get here on
-                 * remote flushes due to races and on local flushes if a
-                 * kernel thread coincidentally flushes the mm it's lazily
-                 * still using.
+                 * We're in lazy mode.  We need to at least flush our
+                 * paging-structure cache to avoid speculatively reading
+                 * garbage into our TLB.  Since switching to init_mm is barely
+                 * slower than a minimal flush, just switch to init_mm.
                  */
+                switch_mm_irqs_off(NULL, &init_mm, NULL);
                 return;
         }
 
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 8c9573660d51..0554e8aef4d5 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -284,9 +284,9 @@ static void emit_bpf_tail_call(u8 **pprog)
         /* if (index >= array->map.max_entries)
          *   goto out;
          */
-        EMIT4(0x48, 0x8B, 0x46,                   /* mov rax, qword ptr [rsi + 16] */
+        EMIT2(0x89, 0xD2);                        /* mov edx, edx */
+        EMIT3(0x39, 0x56,                         /* cmp dword ptr [rsi + 16], edx */
               offsetof(struct bpf_array, map.max_entries));
-        EMIT3(0x48, 0x39, 0xD0);                  /* cmp rax, rdx */
 #define OFFSET1 43 /* number of bytes to jump */
         EMIT2(X86_JBE, OFFSET1);                  /* jbe out */
         label1 = cnt;
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0e7ef69e8531..d669e9d89001 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -93,11 +93,11 @@ int xen_cpuhp_setup(int (*cpu_up_prepare_cb)(unsigned int),
         int rc;
 
         rc = cpuhp_setup_state_nocalls(CPUHP_XEN_PREPARE,
-                                       "x86/xen/hvm_guest:prepare",
+                                       "x86/xen/guest:prepare",
                                        cpu_up_prepare_cb, cpu_dead_cb);
         if (rc >= 0) {
                 rc = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                               "x86/xen/hvm_guest:online",
+                                               "x86/xen/guest:online",
                                                xen_cpu_up_online, NULL);
                 if (rc < 0)
                         cpuhp_remove_state_nocalls(CPUHP_XEN_PREPARE);
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 7330cb3b2283..71495f1a86d7 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1238,21 +1238,16 @@ static void __init xen_pagetable_cleanhighmap(void)
          * from _brk_limit way up to the max_pfn_mapped (which is the end of
          * the ramdisk). We continue on, erasing PMD entries that point to page
          * tables - do note that they are accessible at this stage via __va.
-         * For good measure we also round up to the PMD - which means that if
+         * As Xen is aligning the memory end to a 4MB boundary, for good
+         * measure we also round up to PMD_SIZE * 2 - which means that if
          * anybody is using __ka address to the initial boot-stack - and try
          * to use it - they are going to crash. The xen_start_info has been
          * taken care of already in xen_setup_kernel_pagetable. */
         addr = xen_start_info->pt_base;
-        size = roundup(xen_start_info->nr_pt_frames * PAGE_SIZE, PMD_SIZE);
+        size = xen_start_info->nr_pt_frames * PAGE_SIZE;
 
-        xen_cleanhighmap(addr, addr + size);
+        xen_cleanhighmap(addr, roundup(addr + size, PMD_SIZE * 2));
         xen_start_info->pt_base = (unsigned long)__va(__pa(xen_start_info->pt_base));
-#ifdef DEBUG
-        /* This is superfluous and is not necessary, but you know what
-         * lets do it. The MODULES_VADDR -> MODULES_END should be clear of
-         * anything at this stage. */
-        xen_cleanhighmap(MODULES_VADDR, roundup(MODULES_VADDR, PUD_SIZE) - 1);
-#endif
 }
 #endif
 
diff --git a/block/bio.c b/block/bio.c
index b38e962fa83e..101c2a9b5481 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1239,8 +1239,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
          */
         bmd->is_our_pages = map_data ? 0 : 1;
         memcpy(bmd->iov, iter->iov, sizeof(struct iovec) * iter->nr_segs);
-        iov_iter_init(&bmd->iter, iter->type, bmd->iov,
-                        iter->nr_segs, iter->count);
+        bmd->iter = *iter;
+        bmd->iter.iov = bmd->iov;
 
         ret = -ENOMEM;
         bio = bio_kmalloc(gfp_mask, nr_pages);
@@ -1331,6 +1331,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         int ret, offset;
         struct iov_iter i;
         struct iovec iov;
+        struct bio_vec *bvec;
 
         iov_for_each(iov, i, *iter) {
                 unsigned long uaddr = (unsigned long) iov.iov_base;
@@ -1375,7 +1376,12 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 ret = get_user_pages_fast(uaddr, local_nr_pages,
                                 (iter->type & WRITE) != WRITE,
                                 &pages[cur_page]);
-                if (ret < local_nr_pages) {
+                if (unlikely(ret < local_nr_pages)) {
+                        for (j = cur_page; j < page_limit; j++) {
+                                if (!pages[j])
+                                        break;
+                                put_page(pages[j]);
+                        }
                         ret = -EFAULT;
                         goto out_unmap;
                 }
@@ -1383,6 +1389,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 offset = offset_in_page(uaddr);
                 for (j = cur_page; j < page_limit; j++) {
                         unsigned int bytes = PAGE_SIZE - offset;
+                        unsigned short prev_bi_vcnt = bio->bi_vcnt;
 
                         if (len <= 0)
                                 break;
@@ -1397,6 +1404,13 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                                             bytes)
                                 break;
 
+                        /*
+                         * check if vector was merged with previous
+                         * drop page reference if needed
+                         */
+                        if (bio->bi_vcnt == prev_bi_vcnt)
+                                put_page(pages[j]);
+
                         len -= bytes;
                         offset = 0;
                 }
@@ -1423,10 +1437,8 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         return bio;
 
  out_unmap:
-        for (j = 0; j < nr_pages; j++) {
-                if (!pages[j])
-                        break;
-                put_page(pages[j]);
+        bio_for_each_segment_all(bvec, bio, j) {
+                put_page(bvec->bv_page);
         }
  out:
         kfree(pages);
diff --git a/block/blk-core.c b/block/blk-core.c
index aebe676225e6..048be4aa6024 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -854,6 +854,9 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
 
         kobject_init(&q->kobj, &blk_queue_ktype);
 
+#ifdef CONFIG_BLK_DEV_IO_TRACE
+        mutex_init(&q->blk_trace_mutex);
+#endif
         mutex_init(&q->sysfs_lock);
         spin_lock_init(&q->__queue_lock);
 
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 980e73095643..de294d775acf 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -815,10 +815,14 @@ int blk_mq_debugfs_register(struct request_queue *q)
                 goto err;
 
         /*
-         * blk_mq_init_hctx() attempted to do this already, but q->debugfs_dir
+         * blk_mq_init_sched() attempted to do this already, but q->debugfs_dir
          * didn't exist yet (because we don't know what to name the directory
          * until the queue is registered to a gendisk).
          */
+        if (q->elevator && !q->sched_debugfs_dir)
+                blk_mq_debugfs_register_sched(q);
+
+        /* Similarly, blk_mq_init_hctx() couldn't do this previously. */
         queue_for_each_hw_ctx(q, hctx, i) {
                 if (!hctx->debugfs_dir && blk_mq_debugfs_register_hctx(q, hctx))
                         goto err;
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 0fea76aa0f3f..17816a028dcb 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1911,11 +1911,11 @@ static void throtl_upgrade_state(struct throtl_data *td)
 
                 tg->disptime = jiffies - 1;
                 throtl_select_dispatch(sq);
-                throtl_schedule_next_dispatch(sq, false);
+                throtl_schedule_next_dispatch(sq, true);
         }
         rcu_read_unlock();
         throtl_select_dispatch(&td->service_queue);
-        throtl_schedule_next_dispatch(&td->service_queue, false);
+        throtl_schedule_next_dispatch(&td->service_queue, true);
         queue_work(kthrotld_workqueue, &td->dispatch_work);
 }
 
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
index c82408c7cc3c..15d25ccd51a5 100644
--- a/block/bsg-lib.c
+++ b/block/bsg-lib.c
@@ -154,7 +154,6 @@ static int bsg_prepare_job(struct device *dev, struct request *req)
 failjob_rls_rqst_payload:
         kfree(job->request_payload.sg_list);
 failjob_rls_job:
-        kfree(job);
         return -ENOMEM;
 }
 
@@ -208,20 +207,34 @@ static int bsg_init_rq(struct request_queue *q, struct request *req, gfp_t gfp)
         struct bsg_job *job = blk_mq_rq_to_pdu(req);
         struct scsi_request *sreq = &job->sreq;
 
+        /* called right after the request is allocated for the request_queue */
+
+        sreq->sense = kzalloc(SCSI_SENSE_BUFFERSIZE, gfp);
+        if (!sreq->sense)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void bsg_initialize_rq(struct request *req)
+{
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
+        struct scsi_request *sreq = &job->sreq;
+        void *sense = sreq->sense;
+
+        /* called right before the request is given to the request_queue user */
+
         memset(job, 0, sizeof(*job));
 
         scsi_req_init(sreq);
+
+        sreq->sense = sense;
         sreq->sense_len = SCSI_SENSE_BUFFERSIZE;
-        sreq->sense = kzalloc(sreq->sense_len, gfp);
-        if (!sreq->sense)
-                return -ENOMEM;
 
         job->req = req;
-        job->reply = sreq->sense;
+        job->reply = sense;
         job->reply_len = sreq->sense_len;
         job->dd_data = job + 1;
-
-        return 0;
 }
 
 static void bsg_exit_rq(struct request_queue *q, struct request *req)
@@ -252,6 +265,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
         q->cmd_size = sizeof(struct bsg_job) + dd_job_size;
         q->init_rq_fn = bsg_init_rq;
         q->exit_rq_fn = bsg_exit_rq;
+        q->initialize_rq_fn = bsg_initialize_rq;
         q->request_fn = bsg_request_fn;
 
         ret = blk_init_allocated_queue(q);
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 86e8fe1adcdb..88c555db4e5d 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -112,7 +112,7 @@ ssize_t part_stat_show(struct device *dev,
                        struct device_attribute *attr, char *buf)
 {
         struct hd_struct *p = dev_to_part(dev);
-        struct request_queue *q = dev_to_disk(dev)->queue;
+        struct request_queue *q = part_to_disk(p)->queue;
         unsigned int inflight[2];
         int cpu;
 
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index e4b0ed386bc8..39aecad286fe 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -57,6 +57,8 @@ struct key *find_asymmetric_key(struct key *keyring,
         char *req, *p;
         int len;
 
+        BUG_ON(!id_0 && !id_1);
+
         if (id_0) {
                 lookup = id_0->data;
                 len = id_0->len;
@@ -105,7 +107,7 @@ struct key *find_asymmetric_key(struct key *keyring,
         if (id_0 && id_1) {
                 const struct asymmetric_key_ids *kids = asymmetric_key_ids(key);
 
-                if (!kids->id[0]) {
+                if (!kids->id[1]) {
                         pr_debug("First ID matches, but second is missing\n");
                         goto reject;
                 }
diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
index af4cd8649117..d140d8bb2c96 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -88,6 +88,9 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
         bool want = false;
 
         sinfo = msg->signed_infos;
+        if (!sinfo)
+                goto inconsistent;
+
         if (sinfo->authattrs) {
                 want = true;
                 msg->have_authattrs = true;
diff --git a/crypto/shash.c b/crypto/shash.c
index 5e31c8d776df..325a14da5827 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
         int err;
 
         absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1));
-        buffer = kmalloc(absize, GFP_KERNEL);
+        buffer = kmalloc(absize, GFP_ATOMIC);
         if (!buffer)
                 return -ENOMEM;
 
@@ -275,12 +275,14 @@ static int shash_async_finup(struct ahash_request *req)
 
 int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
 {
-        struct scatterlist *sg = req->src;
-        unsigned int offset = sg->offset;
         unsigned int nbytes = req->nbytes;
+        struct scatterlist *sg;
+        unsigned int offset;
         int err;
 
-        if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
+        if (nbytes &&
+            (sg = req->src, offset = sg->offset,
+             nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
                 void *data;
 
                 data = kmap_atomic(sg_page(sg));
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 4faa0fd53b0c..d5692e35fab1 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -426,14 +426,9 @@ static int skcipher_copy_iv(struct skcipher_walk *walk)
 
 static int skcipher_walk_first(struct skcipher_walk *walk)
 {
-        walk->nbytes = 0;
-
         if (WARN_ON_ONCE(in_irq()))
                 return -EDEADLK;
 
-        if (unlikely(!walk->total))
-                return 0;
-
         walk->buffer = NULL;
         if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
                 int err = skcipher_copy_iv(walk);
@@ -452,10 +447,15 @@ static int skcipher_walk_skcipher(struct skcipher_walk *walk,
 {
         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 
+        walk->total = req->cryptlen;
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         scatterwalk_start(&walk->in, req->src);
         scatterwalk_start(&walk->out, req->dst);
 
-        walk->total = req->cryptlen;
         walk->iv = req->iv;
         walk->oiv = req->iv;
 
@@ -509,6 +509,11 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         struct crypto_aead *tfm = crypto_aead_reqtfm(req);
         int err;
 
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         walk->flags &= ~SKCIPHER_WALK_PHYS;
 
         scatterwalk_start(&walk->in, req->src);
diff --git a/crypto/xts.c b/crypto/xts.c
index d86c11a8c882..e31828ed0046 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -554,8 +554,10 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
                 ctx->name[len - 1] = 0;
 
                 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
-                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME)
-                        return -ENAMETOOLONG;
+                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME) {
+                        err = -ENAMETOOLONG;
+                        goto err_drop_spawn;
+                }
         } else
                 goto err_drop_spawn;
 
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 077f9bad6f44..3c3a37b8503b 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -743,17 +743,19 @@ static int ghes_proc(struct ghes *ghes)
         }
         ghes_do_proc(ghes, ghes->estatus);
 
+out:
+        ghes_clear_estatus(ghes);
+
+        if (rc == -ENOENT)
+                return rc;
+
         /*
          * GHESv2 type HEST entries introduce support for error acknowledgment,
          * so only acknowledge the error if this support is present.
          */
-        if (is_hest_type_generic_v2(ghes)) {
-                rc = ghes_ack_error(ghes->generic_v2);
-                if (rc)
-                        return rc;
-        }
-out:
-        ghes_clear_estatus(ghes);
+        if (is_hest_type_generic_v2(ghes))
+                return ghes_ack_error(ghes->generic_v2);
+
         return rc;
 }
 
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 9565d572f8dd..de56394dd161 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -1178,12 +1178,44 @@ dev_put:
         return ret;
 }
 
+static bool __init iort_enable_acs(struct acpi_iort_node *iort_node)
+{
+        if (iort_node->type == ACPI_IORT_NODE_PCI_ROOT_COMPLEX) {
+                struct acpi_iort_node *parent;
+                struct acpi_iort_id_mapping *map;
+                int i;
+
+                map = ACPI_ADD_PTR(struct acpi_iort_id_mapping, iort_node,
+                                   iort_node->mapping_offset);
+
+                for (i = 0; i < iort_node->mapping_count; i++, map++) {
+                        if (!map->output_reference)
+                                continue;
+
+                        parent = ACPI_ADD_PTR(struct acpi_iort_node,
+                                        iort_table,  map->output_reference);
+                        /*
+                         * If we detect a RC->SMMU mapping, make sure
+                         * we enable ACS on the system.
+                         */
+                        if ((parent->type == ACPI_IORT_NODE_SMMU) ||
+                                (parent->type == ACPI_IORT_NODE_SMMU_V3)) {
+                                pci_request_acs();
+                                return true;
+                        }
+                }
+        }
+
+        return false;
+}
+
 static void __init iort_init_platform_devices(void)
 {
         struct acpi_iort_node *iort_node, *iort_end;
         struct acpi_table_iort *iort;
         struct fwnode_handle *fwnode;
         int i, ret;
+        bool acs_enabled = false;
 
         /*
          * iort_table and iort both point to the start of IORT table, but
@@ -1203,6 +1235,9 @@ static void __init iort_init_platform_devices(void)
                         return;
                 }
 
+                if (!acs_enabled)
+                        acs_enabled = iort_enable_acs(iort_node);
+
                 if ((iort_node->type == ACPI_IORT_NODE_SMMU) ||
                         (iort_node->type == ACPI_IORT_NODE_SMMU_V3)) {
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 3fb8ff513461..e26ea209b63e 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -571,10 +571,9 @@ static int acpi_data_get_property_array(const struct acpi_device_data *data,
  *     }
  * }
  *
- * Calling this function with index %2 return %-ENOENT and with index %3
- * returns the last entry. If the property does not contain any more values
- * %-ENODATA is returned. The NULL entry must be single integer and
- * preferably contain value %0.
+ * Calling this function with index %2 or index %3 return %-ENOENT. If the
+ * property does not contain any more values %-ENOENT is returned. The NULL
+ * entry must be single integer and preferably contain value %0.
  *
  * Return: %0 on success, negative error code on failure.
  */
@@ -590,11 +589,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
         data = acpi_device_data_of_node(fwnode);
         if (!data)
-                return -EINVAL;
+                return -ENOENT;
 
         ret = acpi_data_get_property(data, propname, ACPI_TYPE_ANY, &obj);
         if (ret)
-                return ret;
+                return ret == -EINVAL ? -ENOENT : -EINVAL;
 
         /*
          * The simplest case is when the value is a single reference.  Just
@@ -606,7 +605,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
                 ret = acpi_bus_get_device(obj->reference.handle, &device);
                 if (ret)
-                        return ret;
+                        return ret == -ENODEV ? -EINVAL : ret;
 
                 args->adev = device;
                 args->nargs = 0;
@@ -622,8 +621,10 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
          * The index argument is then used to determine which reference
          * the caller wants (along with the arguments).
          */
-        if (obj->type != ACPI_TYPE_PACKAGE || index >= obj->package.count)
-                return -EPROTO;
+        if (obj->type != ACPI_TYPE_PACKAGE)
+                return -EINVAL;
+        if (index >= obj->package.count)
+                return -ENOENT;
 
         element = obj->package.elements;
         end = element + obj->package.count;
@@ -635,7 +636,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                         ret = acpi_bus_get_device(element->reference.handle,
                                                   &device);
                         if (ret)
-                                return -ENODEV;
+                                return -EINVAL;
 
                         nargs = 0;
                         element++;
@@ -649,11 +650,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 else if (type == ACPI_TYPE_LOCAL_REFERENCE)
                                         break;
                                 else
-                                        return -EPROTO;
+                                        return -EINVAL;
                         }
 
                         if (nargs > MAX_ACPI_REFERENCE_ARGS)
-                                return -EPROTO;
+                                return -EINVAL;
 
                         if (idx == index) {
                                 args->adev = device;
@@ -670,13 +671,13 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 return -ENOENT;
                         element++;
                 } else {
-                        return -EPROTO;
+                        return -EINVAL;
                 }
 
                 idx++;
         }
 
-        return -ENODATA;
+        return -ENOENT;
 }
 EXPORT_SYMBOL_GPL(__acpi_node_get_property_reference);
 
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d055b3f2a207..fddf76ef5bd6 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2217,7 +2217,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                                        debug_id, (u64)fda->num_fds);
                                 continue;
                         }
-                        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+                        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
                                 task_close_fd(proc, fd_array[fd_index]);
                 } break;
@@ -2326,7 +2326,6 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                              (u64)node->ptr);
                 binder_node_unlock(node);
         } else {
-                int ret;
                 struct binder_ref_data dest_rdata;
 
                 binder_node_unlock(node);
@@ -2442,7 +2441,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
          */
         parent_buffer = parent->buffer -
                 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
-        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
         if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
                 binder_user_error("%d:%d parent offset not aligned correctly.\n",
                                   proc->pid, thread->pid);
@@ -2508,7 +2507,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
                                   proc->pid, thread->pid);
                 return -EINVAL;
         }
-        parent_buffer = (u8 *)(parent->buffer -
+        parent_buffer = (u8 *)((uintptr_t)parent->buffer -
                         binder_alloc_get_user_buffer_offset(
                                 &target_proc->alloc));
         *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
@@ -2583,6 +2582,48 @@ static bool binder_proc_transaction(struct binder_transaction *t,
         return true;
 }
 
+/**
+ * binder_get_node_refs_for_txn() - Get required refs on node for txn
+ * @node:         struct binder_node for which to get refs
+ * @proc:         returns @node->proc if valid
+ * @error:        if no @proc then returns BR_DEAD_REPLY
+ *
+ * User-space normally keeps the node alive when creating a transaction
+ * since it has a reference to the target. The local strong ref keeps it
+ * alive if the sending process dies before the target process processes
+ * the transaction. If the source process is malicious or has a reference
+ * counting bug, relying on the local strong ref can fail.
+ *
+ * Since user-space can cause the local strong ref to go away, we also take
+ * a tmpref on the node to ensure it survives while we are constructing
+ * the transaction. We also need a tmpref on the proc while we are
+ * constructing the transaction, so we take that here as well.
+ *
+ * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
+ * Also sets @proc if valid. If the @node->proc is NULL indicating that the
+ * target proc has died, @error is set to BR_DEAD_REPLY
+ */
+static struct binder_node *binder_get_node_refs_for_txn(
+                struct binder_node *node,
+                struct binder_proc **procp,
+                uint32_t *error)
+{
+        struct binder_node *target_node = NULL;
+
+        binder_node_inner_lock(node);
+        if (node->proc) {
+                target_node = node;
+                binder_inc_node_nilocked(node, 1, 0, NULL);
+                binder_inc_node_tmpref_ilocked(node);
+                node->proc->tmp_ref++;
+                *procp = node->proc;
+        } else
+                *error = BR_DEAD_REPLY;
+        binder_node_inner_unlock(node);
+
+        return target_node;
+}
+
 static void binder_transaction(struct binder_proc *proc,
                                struct binder_thread *thread,
                                struct binder_transaction_data *tr, int reply,
@@ -2686,43 +2727,35 @@ static void binder_transaction(struct binder_proc *proc,
                         ref = binder_get_ref_olocked(proc, tr->target.handle,
                                                      true);
                         if (ref) {
-                                binder_inc_node(ref->node, 1, 0, NULL);
-                                target_node = ref->node;
-                        }
-                        binder_proc_unlock(proc);
-                        if (target_node == NULL) {
+                                target_node = binder_get_node_refs_for_txn(
+                                                ref->node, &target_proc,
+                                                &return_error);
+                        } else {
                                 binder_user_error("%d:%d got transaction to invalid handle\n",
-                                        proc->pid, thread->pid);
+                                                  proc->pid, thread->pid);
                                 return_error = BR_FAILED_REPLY;
-                                return_error_param = -EINVAL;
-                                return_error_line = __LINE__;
-                                goto err_invalid_target_handle;
                         }
+                        binder_proc_unlock(proc);
                 } else {
                         mutex_lock(&context->context_mgr_node_lock);
                         target_node = context->binder_context_mgr_node;
-                        if (target_node == NULL) {
+                        if (target_node)
+                                target_node = binder_get_node_refs_for_txn(
+                                                target_node, &target_proc,
+                                                &return_error);
+                        else
                                 return_error = BR_DEAD_REPLY;
-                                mutex_unlock(&context->context_mgr_node_lock);
-                                return_error_line = __LINE__;
-                                goto err_no_context_mgr_node;
-                        }
-                        binder_inc_node(target_node, 1, 0, NULL);
                         mutex_unlock(&context->context_mgr_node_lock);
                 }
-                e->to_node = target_node->debug_id;
-                binder_node_lock(target_node);
-                target_proc = target_node->proc;
-                if (target_proc == NULL) {
-                        binder_node_unlock(target_node);
-                        return_error = BR_DEAD_REPLY;
+                if (!target_node) {
+                        /*
+                         * return_error is set above
+                         */
+                        return_error_param = -EINVAL;
                         return_error_line = __LINE__;
                         goto err_dead_binder;
                 }
-                binder_inner_proc_lock(target_proc);
-                target_proc->tmp_ref++;
-                binder_inner_proc_unlock(target_proc);
-                binder_node_unlock(target_node);
+                e->to_node = target_node->debug_id;
                 if (security_binder_transaction(proc->tsk,
                                                 target_proc->tsk) < 0) {
                         return_error = BR_FAILED_REPLY;
@@ -3072,6 +3105,8 @@ static void binder_transaction(struct binder_proc *proc,
         if (target_thread)
                 binder_thread_dec_tmpref(target_thread);
         binder_proc_dec_tmpref(target_proc);
+        if (target_node)
+                binder_dec_node_tmpref(target_node);
         /*
          * write barrier to synchronize with initialization
          * of log entry
@@ -3083,6 +3118,7 @@ static void binder_transaction(struct binder_proc *proc,
 err_dead_proc_or_thread:
         return_error = BR_DEAD_REPLY;
         return_error_line = __LINE__;
+        binder_dequeue_work(proc, tcomplete);
 err_translate_failed:
 err_bad_object_type:
 err_bad_offset:
@@ -3090,6 +3126,8 @@ err_bad_parent:
 err_copy_data_failed:
         trace_binder_transaction_failed_buffer_release(t->buffer);
         binder_transaction_buffer_release(target_proc, t->buffer, offp);
+        if (target_node)
+                binder_dec_node_tmpref(target_node);
         target_node = NULL;
         t->buffer->transaction = NULL;
         binder_alloc_free_buf(&target_proc->alloc, t->buffer);
@@ -3104,13 +3142,14 @@ err_bad_call_stack:
 err_empty_call_stack:
 err_dead_binder:
 err_invalid_target_handle:
-err_no_context_mgr_node:
         if (target_thread)
                 binder_thread_dec_tmpref(target_thread);
         if (target_proc)
                 binder_proc_dec_tmpref(target_proc);
-        if (target_node)
+        if (target_node) {
                 binder_dec_node(target_node, 1, 0);
+                binder_dec_node_tmpref(target_node);
+        }
 
         binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
                      "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n",
@@ -3623,12 +3662,6 @@ static void binder_stat_br(struct binder_proc *proc,
         }
 }
 
-static int binder_has_thread_work(struct binder_thread *thread)
-{
-        return !binder_worklist_empty(thread->proc, &thread->todo) ||
-                thread->looper_need_return;
-}
-
 static int binder_put_node_cmd(struct binder_proc *proc,
                                struct binder_thread *thread,
                                void __user **ptrp,
@@ -4258,12 +4291,9 @@ static unsigned int binder_poll(struct file *filp,
 
         binder_inner_proc_unlock(thread->proc);
 
-        if (binder_has_work(thread, wait_for_proc_work))
-                return POLLIN;
-
         poll_wait(filp, &thread->wait, wait);
 
-        if (binder_has_thread_work(thread))
+        if (binder_has_work(thread, wait_for_proc_work))
                 return POLLIN;
 
         return 0;
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 8fe165844e47..c2819a3d58a6 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -215,17 +215,12 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
                 }
         }
 
-        if (!vma && need_mm)
-                mm = get_task_mm(alloc->tsk);
+        if (!vma && need_mm && mmget_not_zero(alloc->vma_vm_mm))
+                mm = alloc->vma_vm_mm;
 
         if (mm) {
                 down_write(&mm->mmap_sem);
                 vma = alloc->vma;
-                if (vma && mm != alloc->vma_vm_mm) {
-                        pr_err("%d: vma mm and task mm mismatch\n",
-                                alloc->pid);
-                        vma = NULL;
-                }
         }
 
         if (!vma && need_mm) {
@@ -565,7 +560,7 @@ static void binder_delete_free_buffer(struct binder_alloc *alloc,
                 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
                                    "%d: merge free, buffer %pK do not share page with %pK or %pK\n",
                                    alloc->pid, buffer->data,
-                                   prev->data, next->data);
+                                   prev->data, next ? next->data : NULL);
                 binder_update_page_range(alloc, 0, buffer_start_page(buffer),
                                          buffer_start_page(buffer) + PAGE_SIZE,
                                          NULL);
@@ -720,6 +715,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
         barrier();
         alloc->vma = vma;
         alloc->vma_vm_mm = vma->vm_mm;
+        mmgrab(alloc->vma_vm_mm);
 
         return 0;
 
@@ -795,6 +791,8 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
                 vfree(alloc->buffer);
         }
         mutex_unlock(&alloc->mutex);
+        if (alloc->vma_vm_mm)
+                mmdrop(alloc->vma_vm_mm);
 
         binder_alloc_debug(BINDER_DEBUG_OPEN_CLOSE,
                      "%s: %d buffers %d, pages %d\n",
@@ -889,7 +887,6 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
 void binder_alloc_vma_close(struct binder_alloc *alloc)
 {
         WRITE_ONCE(alloc->vma, NULL);
-        WRITE_ONCE(alloc->vma_vm_mm, NULL);
 }
 
 /**
@@ -913,6 +910,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
         struct binder_alloc *alloc;
         uintptr_t page_addr;
         size_t index;
+        struct vm_area_struct *vma;
 
         alloc = page->alloc;
         if (!mutex_trylock(&alloc->mutex))
@@ -923,16 +921,22 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         index = page - alloc->pages;
         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        if (alloc->vma) {
-                mm = get_task_mm(alloc->tsk);
-                if (!mm)
-                        goto err_get_task_mm_failed;
+        vma = alloc->vma;
+        if (vma) {
+                if (!mmget_not_zero(alloc->vma_vm_mm))
+                        goto err_mmget;
+                mm = alloc->vma_vm_mm;
                 if (!down_write_trylock(&mm->mmap_sem))
                         goto err_down_write_mmap_sem_failed;
+        }
+
+        list_lru_isolate(lru, item);
+        spin_unlock(lock);
 
+        if (vma) {
                 trace_binder_unmap_user_start(alloc, index);
 
-                zap_page_range(alloc->vma,
+                zap_page_range(vma,
                                page_addr + alloc->user_buffer_offset,
                                PAGE_SIZE);
 
@@ -950,14 +954,13 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         trace_binder_unmap_kernel_end(alloc, index);
 
-        list_lru_isolate(lru, item);
-
+        spin_lock(lock);
         mutex_unlock(&alloc->mutex);
-        return LRU_REMOVED;
+        return LRU_REMOVED_RETRY;
 
 err_down_write_mmap_sem_failed:
-        mmput(mm);
-err_get_task_mm_failed:
+        mmput_async(mm);
+err_mmget:
 err_page_already_freed:
         mutex_unlock(&alloc->mutex);
 err_get_alloc_mutex_failed:
@@ -996,7 +999,6 @@ struct shrinker binder_shrinker = {
  */
 void binder_alloc_init(struct binder_alloc *alloc)
 {
-        alloc->tsk = current->group_leader;
         alloc->pid = current->group_leader->pid;
         mutex_init(&alloc->mutex);
         INIT_LIST_HEAD(&alloc->buffers);
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index a3a3602c689c..2dd33b6df104 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -100,7 +100,6 @@ struct binder_lru_page {
  */
 struct binder_alloc {
         struct mutex mutex;
-        struct task_struct *tsk;
         struct vm_area_struct *vma;
         struct mm_struct *vma_vm_mm;
         void *buffer;
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index cb9b0e9090e3..9f78bb03bb76 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -621,8 +621,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 static int ahci_pci_reset_controller(struct ata_host *host)
 {
         struct pci_dev *pdev = to_pci_dev(host->dev);
+        int rc;
 
-        ahci_reset_controller(host);
+        rc = ahci_reset_controller(host);
+        if (rc)
+                return rc;
 
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 struct ahci_host_priv *hpriv = host->private_data;
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 8401c3b5be92..b702c20fbc2b 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -492,6 +492,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x27DF, 0x152D, 0x0778 },     /* ICH7 on unknown Intel */
         { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
+        { 0x24CA, 0x10CF, 0x11AB },     /* ICH4M on Fujitsu-Siemens Lifebook S6120 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
         { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1945a8ea2099..ee4c1ec9dca0 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3234,19 +3234,19 @@ static const struct ata_timing ata_timing[] = {
 };
 
 #define ENOUGH(v, unit)         (((v)-1)/(unit)+1)
-#define EZ(v, unit)             ((v)?ENOUGH(v, unit):0)
+#define EZ(v, unit)             ((v)?ENOUGH(((v) * 1000), unit):0)
 
 static void ata_timing_quantize(const struct ata_timing *t, struct ata_timing *q, int T, int UT)
 {
-        q->setup        = EZ(t->setup      * 1000,  T);
-        q->act8b        = EZ(t->act8b      * 1000,  T);
-        q->rec8b        = EZ(t->rec8b      * 1000,  T);
-        q->cyc8b        = EZ(t->cyc8b      * 1000,  T);
-        q->active       = EZ(t->active     * 1000,  T);
-        q->recover      = EZ(t->recover    * 1000,  T);
-        q->dmack_hold   = EZ(t->dmack_hold * 1000,  T);
-        q->cycle        = EZ(t->cycle      * 1000,  T);
-        q->udma         = EZ(t->udma       * 1000, UT);
+        q->setup        = EZ(t->setup,       T);
+        q->act8b        = EZ(t->act8b,       T);
+        q->rec8b        = EZ(t->rec8b,       T);
+        q->cyc8b        = EZ(t->cyc8b,       T);
+        q->active       = EZ(t->active,      T);
+        q->recover      = EZ(t->recover,     T);
+        q->dmack_hold   = EZ(t->dmack_hold,  T);
+        q->cycle        = EZ(t->cycle,       T);
+        q->udma         = EZ(t->udma,       UT);
 }
 
 void ata_timing_merge(const struct ata_timing *a, const struct ata_timing *b,
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index cfeb049a01ef..642afd88870b 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf,
 static int charlcd_open(struct inode *inode, struct file *file)
 {
         struct charlcd_priv *priv = to_priv(the_charlcd);
+        int ret;
 
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&charlcd_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_READ)  /* device is write-only */
-                return -EPERM;
+                goto fail;
 
         if (priv->must_clear) {
                 charlcd_clear_display(&priv->lcd);
                 priv->must_clear = false;
         }
         return nonseekable_open(inode, file);
+
+ fail:
+        atomic_inc(&charlcd_available);
+        return ret;
 }
 
 static int charlcd_release(struct inode *inode, struct file *file)
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index df126dcdaf18..6911acd896d9 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *file,
 
 static int keypad_open(struct inode *inode, struct file *file)
 {
+        int ret;
+
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&keypad_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_WRITE) /* device is read-only */
-                return -EPERM;
+                goto fail;
 
         keypad_buflen = 0;      /* flush the buffer on opening */
         return 0;
+ fail:
+        atomic_inc(&keypad_available);
+        return ret;
 }
 
 static int keypad_release(struct inode *inode, struct file *file)
diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
index 41be9ff7d70a..6df7d6676a48 100644
--- a/drivers/base/arch_topology.c
+++ b/drivers/base/arch_topology.c
@@ -166,11 +166,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu)
 }
 
 #ifdef CONFIG_CPU_FREQ
-static cpumask_var_t cpus_to_visit;
-static void parsing_done_workfn(struct work_struct *work);
-static DECLARE_WORK(parsing_done_work, parsing_done_workfn);
+static cpumask_var_t cpus_to_visit __initdata;
+static void __init parsing_done_workfn(struct work_struct *work);
+static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn);
 
-static int
+static int __init
 init_cpu_capacity_callback(struct notifier_block *nb,
                            unsigned long val,
                            void *data)
@@ -206,7 +206,7 @@ init_cpu_capacity_callback(struct notifier_block *nb,
         return 0;
 }
 
-static struct notifier_block init_cpu_capacity_notifier = {
+static struct notifier_block init_cpu_capacity_notifier __initdata = {
         .notifier_call = init_cpu_capacity_callback,
 };
 
@@ -232,7 +232,7 @@ static int __init register_cpufreq_notifier(void)
 }
 core_initcall(register_cpufreq_notifier);
 
-static void parsing_done_workfn(struct work_struct *work)
+static void __init parsing_done_workfn(struct work_struct *work)
 {
         cpufreq_unregister_notifier(&init_cpu_capacity_notifier,
                                          CPUFREQ_POLICY_NOTIFIER);
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 3855902f2c5b..aae2402f3791 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -27,13 +27,21 @@ static struct bus_type node_subsys = {
 
 static ssize_t node_read_cpumap(struct device *dev, bool list, char *buf)
 {
+        ssize_t n;
+        cpumask_var_t mask;
         struct node *node_dev = to_node(dev);
-        const struct cpumask *mask = cpumask_of_node(node_dev->dev.id);
 
         /* 2008/04/07: buf currently PAGE_SIZE, need 9 chars per 32 bits. */
         BUILD_BUG_ON((NR_CPUS/32 * 9) > (PAGE_SIZE-1));
 
-        return cpumap_print_to_pagebuf(list, buf, mask);
+        if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+                return 0;
+
+        cpumask_and(mask, cpumask_of_node(node_dev->dev.id), cpu_online_mask);
+        n = cpumap_print_to_pagebuf(list, buf, mask);
+        free_cpumask_var(mask);
+
+        return n;
 }
 
 static inline ssize_t node_read_cpumask(struct device *dev,
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index d1bd99271066..9045c5f3734e 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -868,7 +868,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct platform_device *pdev = to_platform_device(dev);
         char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
index a8cc14fd8ae4..a6de32530693 100644
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -1581,6 +1581,9 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
 
         opp->available = availability_req;
 
+        dev_pm_opp_get(opp);
+        mutex_unlock(&opp_table->lock);
+
         /* Notify the change of the OPP availability */
         if (availability_req)
                 blocking_notifier_call_chain(&opp_table->head, OPP_EVENT_ENABLE,
@@ -1589,8 +1592,12 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
                 blocking_notifier_call_chain(&opp_table->head,
                                              OPP_EVENT_DISABLE, opp);
 
+        dev_pm_opp_put(opp);
+        goto put_table;
+
 unlock:
         mutex_unlock(&opp_table->lock);
+put_table:
         dev_pm_opp_put_opp_table(opp_table);
         return r;
 }
diff --git a/drivers/base/property.c b/drivers/base/property.c
index d0b65bbe7e15..7ed99c1b2a8b 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -21,6 +21,7 @@
 #include <linux/phy.h>
 
 struct property_set {
+        struct device *dev;
         struct fwnode_handle fwnode;
         const struct property_entry *properties;
 };
@@ -682,6 +683,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string);
  * Caller is responsible to call fwnode_handle_put() on the returned
  * args->fwnode pointer.
  *
+ * Returns: %0 on success
+ *          %-ENOENT when the index is out of bounds, the index has an empty
+ *                   reference or the property was not found
+ *          %-EINVAL on parse error
  */
 int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode,
                                        const char *prop, const char *nargs_prop,
@@ -891,6 +896,7 @@ static struct property_set *pset_copy_set(const struct property_set *pset)
 void device_remove_properties(struct device *dev)
 {
         struct fwnode_handle *fwnode;
+        struct property_set *pset;
 
         fwnode = dev_fwnode(dev);
         if (!fwnode)
@@ -900,16 +906,16 @@ void device_remove_properties(struct device *dev)
          * the pset. If there is no real firmware node (ACPI/DT) primary
          * will hold the pset.
          */
-        if (is_pset_node(fwnode)) {
+        pset = to_pset_node(fwnode);
+        if (pset) {
                 set_primary_fwnode(dev, NULL);
-                pset_free_set(to_pset_node(fwnode));
         } else {
-                fwnode = fwnode->secondary;
-                if (!IS_ERR(fwnode) && is_pset_node(fwnode)) {
+                pset = to_pset_node(fwnode->secondary);
+                if (pset && dev == pset->dev)
                         set_secondary_fwnode(dev, NULL);
-                        pset_free_set(to_pset_node(fwnode));
-                }
         }
+        if (pset && dev == pset->dev)
+                pset_free_set(pset);
 }
 EXPORT_SYMBOL_GPL(device_remove_properties);
 
@@ -938,6 +944,7 @@ int device_add_properties(struct device *dev,
 
         p->fwnode.ops = &pset_fwnode_ops;
         set_secondary_fwnode(dev, &p->fwnode);
+        p->dev = dev;
         return 0;
 }
 EXPORT_SYMBOL_GPL(device_add_properties);
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 4a438b8abe27..2dfe99b328f8 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -17,7 +17,7 @@ if BLK_DEV
 
 config BLK_DEV_NULL_BLK
         tristate "Null test block driver"
-        depends on CONFIGFS_FS
+        select CONFIGFS_FS
 
 config BLK_DEV_FD
         tristate "Normal floppy disk support"
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bbd0d186cfc0..2d7178f7754e 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -342,7 +342,7 @@ static long __brd_direct_access(struct brd_device *brd, pgoff_t pgoff,
 
         if (!brd)
                 return -ENODEV;
-        page = brd_insert_page(brd, PFN_PHYS(pgoff) / 512);
+        page = brd_insert_page(brd, (sector_t)pgoff << PAGE_SECTORS_SHIFT);
         if (!page)
                 return -ENOSPC;
         *kaddr = page_address(page);
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
 struct loop_cmd {
         struct kthread_work work;
         struct request *rq;
-        union {
-                bool use_aio; /* use AIO interface to handle I/O */
-                atomic_t ref; /* only for aio */
-        };
+        bool use_aio; /* use AIO interface to handle I/O */
+        atomic_t ref; /* only for aio */
         long ret;
         struct kiocb iocb;
         struct bio_vec *bvec;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 2aa87cbdede0..9adfb5445f8d 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -243,7 +243,6 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize,
         struct nbd_config *config = nbd->config;
         config->blksize = blocksize;
         config->bytesize = blocksize * nr_blocks;
-        nbd_size_update(nbd);
 }
 
 static void nbd_complete_rq(struct request *req)
@@ -387,6 +386,15 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
         return result;
 }
 
+/*
+ * Different settings for sk->sk_sndtimeo can result in different return values
+ * if there is a signal pending when we enter sendmsg, because reasons?
+ */
+static inline int was_interrupted(int result)
+{
+        return result == -ERESTARTSYS || result == -EINTR;
+}
+
 /* always call with the tx_lock held */
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
@@ -459,7 +467,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         result = sock_xmit(nbd, index, 1, &from,
                         (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
         if (result <= 0) {
-                if (result == -ERESTARTSYS) {
+                if (was_interrupted(result)) {
                         /* If we havne't sent anything we can just return BUSY,
                          * however if we have sent something we need to make
                          * sure we only allow this req to be sent until we are
@@ -503,7 +511,7 @@ send_pages:
                         }
                         result = sock_xmit(nbd, index, 1, &from, flags, &sent);
                         if (result <= 0) {
-                                if (result == -ERESTARTSYS) {
+                                if (was_interrupted(result)) {
                                         /* We've already sent the header, we
                                          * have no choice but to set pending and
                                          * return BUSY.
@@ -820,9 +828,13 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * appropriate.
          */
         ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_STS_IOERR;
+        else if (!ret)
+                ret = BLK_STS_OK;
         complete(&cmd->send_complete);
 
-        return ret < 0 ? BLK_STS_IOERR : BLK_STS_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
@@ -1090,6 +1102,7 @@ static int nbd_start_device(struct nbd_device *nbd)
                 args->index = i;
                 queue_work(recv_workqueue, &args->work);
         }
+        nbd_size_update(nbd);
         return error;
 }
 
@@ -1194,6 +1207,12 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        /* The block layer will pass back some non-nbd ioctls in case we have
+         * special handling for them, but we don't so just return an error.
+         */
+        if (_IOC_TYPE(cmd) != 0xab)
+                return -EINVAL;
+
         mutex_lock(&nbd->config_lock);
 
         /* Don't allow ioctl operations on a nbd device that was created with
diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
index 7cedb4295e9d..64d0fc17c174 100644
--- a/drivers/block/skd_main.c
+++ b/drivers/block/skd_main.c
@@ -2604,7 +2604,7 @@ static void *skd_alloc_dma(struct skd_device *skdev, struct kmem_cache *s,
                 return NULL;
         *dma_handle = dma_map_single(dev, buf, s->size, dir);
         if (dma_mapping_error(dev, *dma_handle)) {
-                kfree(buf);
+                kmem_cache_free(s, buf);
                 buf = NULL;
         }
         return buf;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 34e17ee799be..68846897d213 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -593,10 +593,22 @@ static int virtblk_map_queues(struct blk_mq_tag_set *set)
         return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
 }
 
+#ifdef CONFIG_VIRTIO_BLK_SCSI
+static void virtblk_initialize_rq(struct request *req)
+{
+        struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
+
+        scsi_req_init(&vbr->sreq);
+}
+#endif
+
 static const struct blk_mq_ops virtio_mq_ops = {
         .queue_rq       = virtio_queue_rq,
         .complete       = virtblk_request_done,
         .init_request   = virtblk_init_request,
+#ifdef CONFIG_VIRTIO_BLK_SCSI
+        .initialize_rq_fn = virtblk_initialize_rq,
+#endif
         .map_queues     = virtblk_map_queues,
 };
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 2981c27d3aae..f149d3e61234 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -766,27 +766,6 @@ static void zram_slot_unlock(struct zram *zram, u32 index)
         bit_spin_unlock(ZRAM_ACCESS, &zram->table[index].value);
 }
 
-static bool zram_same_page_read(struct zram *zram, u32 index,
-                                struct page *page,
-                                unsigned int offset, unsigned int len)
-{
-        zram_slot_lock(zram, index);
-        if (unlikely(!zram_get_handle(zram, index) ||
-                        zram_test_flag(zram, index, ZRAM_SAME))) {
-                void *mem;
-
-                zram_slot_unlock(zram, index);
-                mem = kmap_atomic(page);
-                zram_fill_page(mem + offset, len,
-                                        zram_get_element(zram, index));
-                kunmap_atomic(mem);
-                return true;
-        }
-        zram_slot_unlock(zram, index);
-
-        return false;
-}
-
 static void zram_meta_free(struct zram *zram, u64 disksize)
 {
         size_t num_pages = disksize >> PAGE_SHIFT;
@@ -884,11 +863,20 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index,
                 zram_slot_unlock(zram, index);
         }
 
-        if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE))
-                return 0;
-
         zram_slot_lock(zram, index);
         handle = zram_get_handle(zram, index);
+        if (!handle || zram_test_flag(zram, index, ZRAM_SAME)) {
+                unsigned long value;
+                void *mem;
+
+                value = handle ? zram_get_element(zram, index) : 0;
+                mem = kmap_atomic(page);
+                zram_fill_page(mem, PAGE_SIZE, value);
+                kunmap_atomic(mem);
+                zram_slot_unlock(zram, index);
+                return 0;
+        }
+
         size = zram_get_obj_size(zram, index);
 
         src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO);
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index c7f396903184..70db4d5638a6 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -720,7 +720,7 @@ mvebu_mbus_default_setup_cpu_target(struct mvebu_mbus_state *mbus)
                         if (mbus->hw_io_coherency)
                                 w->mbus_attr |= ATTR_HW_COHERENCY;
                         w->base = base & DDR_BASE_CS_LOW_MASK;
-                        w->size = (size | ~DDR_SIZE_MASK) + 1;
+                        w->size = (u64)(size | ~DDR_SIZE_MASK) + 1;
                 }
         }
         mvebu_mbus_dram_info.num_cs = cs;
diff --git a/drivers/clk/clk-bulk.c b/drivers/clk/clk-bulk.c
index c834f5abfc49..4c10456f8a32 100644
--- a/drivers/clk/clk-bulk.c
+++ b/drivers/clk/clk-bulk.c
@@ -105,6 +105,7 @@ err:
 
         return  ret;
 }
+EXPORT_SYMBOL_GPL(clk_bulk_prepare);
 
 #endif /* CONFIG_HAVE_CLK_PREPARE */
 
diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index 62d7854e4b87..5970a50671b9 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c
@@ -315,13 +315,13 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(10), 8, GFLAGS),
 
         GATE(SCLK_PVTM_CORE, "clk_pvtm_core", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 0, GFLAGS),
         GATE(SCLK_PVTM_GPU, "clk_pvtm_gpu", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 1, GFLAGS),
         GATE(SCLK_PVTM_FUNC, "clk_pvtm_func", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 2, GFLAGS),
         GATE(SCLK_MIPI_24M, "clk_mipi_24m", "xin24m", CLK_IGNORE_UNUSED,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(2), 15, GFLAGS),
 
         COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0,
                         RK2928_CLKSEL_CON(11), 6, 2, MFLAGS, 0, 6, DFLAGS,
@@ -541,7 +541,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
         GATE(0, "pclk_grf", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 4, GFLAGS),
         GATE(0, "pclk_mipiphy", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 0, GFLAGS),
 
-        GATE(0, "pclk_pmu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 2, GFLAGS),
+        GATE(0, "pclk_pmu", "pclk_pmu_pre", 0, RK2928_CLKGATE_CON(9), 2, GFLAGS),
         GATE(0, "pclk_pmu_niu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 3, GFLAGS),
 
         /* PD_MMC */
@@ -577,6 +577,8 @@ static const char *const rk3128_critical_clocks[] __initconst = {
         "aclk_peri",
         "hclk_peri",
         "pclk_peri",
+        "pclk_pmu",
+        "sclk_timer5",
 };
 
 static struct rockchip_clk_provider *__init rk3128_common_clk_init(struct device_node *np)
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index e40b77583c47..d8d3cb67b402 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump src_mask_suspend_e4210[] = {
 #define PLL_ENABLED     (1 << 31)
 #define PLL_LOCKED      (1 << 29)
 
+static void exynos4_clk_enable_pll(u32 reg)
+{
+        u32 pll_con = readl(reg_base + reg);
+        pll_con |= PLL_ENABLED;
+        writel(pll_con, reg_base + reg);
+
+        while (!(pll_con & PLL_LOCKED)) {
+                cpu_relax();
+                pll_con = readl(reg_base + reg);
+        }
+}
+
 static void exynos4_clk_wait_for_pll(u32 reg)
 {
         u32 pll_con;
@@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void)
         samsung_clk_save(reg_base, exynos4_save_pll,
                                 ARRAY_SIZE(exynos4_clk_pll_regs));
 
+        exynos4_clk_enable_pll(EPLL_CON0);
+        exynos4_clk_enable_pll(VPLL_CON0);
+
         if (exynos4_soc == EXYNOS4210) {
                 samsung_clk_save(reg_base, exynos4_save_soc,
                                         ARRAY_SIZE(exynos4210_clk_save));
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index a1df588343f2..1de8cac99a0e 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -117,7 +117,8 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
         /* Turn off the clock (and clear the event) */
         disable_timer(cs5535_event_clock);
 
-        if (clockevent_state_shutdown(&cs5535_clockevent))
+        if (clockevent_state_detached(&cs5535_clockevent) ||
+            clockevent_state_shutdown(&cs5535_clockevent))
                 return IRQ_HANDLED;
 
         /* Clear the counter */
diff --git a/drivers/clocksource/numachip.c b/drivers/clocksource/numachip.c
index 6a20dc8b253f..9a7d7f0f23fe 100644
--- a/drivers/clocksource/numachip.c
+++ b/drivers/clocksource/numachip.c
@@ -43,7 +43,7 @@ static int numachip2_set_next_event(unsigned long delta, struct clock_event_devi
         return 0;
 }
 
-static struct clock_event_device numachip2_clockevent = {
+static const struct clock_event_device numachip2_clockevent __initconst = {
         .name            = "numachip2",
         .rating          = 400,
         .set_next_event  = numachip2_set_next_event,
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 430edadca527..a753c50e9e41 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -118,6 +118,10 @@ static const struct of_device_id blacklist[] __initconst = {
 
         { .compatible = "sigma,tango4", },
 
+        { .compatible = "ti,am33xx", },
+        { .compatible = "ti,am43", },
+        { .compatible = "ti,dra7", },
+
         { }
 };
 
diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
index d9fbbf01062b..0f9754e07719 100644
--- a/drivers/crypto/axis/artpec6_crypto.c
+++ b/drivers/crypto/axis/artpec6_crypto.c
@@ -349,8 +349,6 @@ struct artpec6_crypto_aead_req_ctx {
 /* The crypto framework makes it hard to avoid this global. */
 static struct device *artpec6_crypto_dev;
 
-static struct dentry *dbgfs_root;
-
 #ifdef CONFIG_FAULT_INJECTION
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_status_read);
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_dma_array_full);
@@ -2984,6 +2982,8 @@ struct dbgfs_u32 {
         char *desc;
 };
 
+static struct dentry *dbgfs_root;
+
 static void artpec6_crypto_init_debugfs(void)
 {
         dbgfs_root = debugfs_create_dir("artpec6_crypto", NULL);
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index b585ce54a802..4835dd4a9e50 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -553,9 +553,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
 {
         struct stm32_hash_request_ctx *rctx = ahash_request_ctx(hdev->req);
         struct scatterlist sg[1], *tsg;
-        int err = 0, len = 0, reg, ncp;
+        int err = 0, len = 0, reg, ncp = 0;
         unsigned int i;
-        const u32 *buffer = (const u32 *)rctx->buffer;
+        u32 *buffer = (void *)rctx->buffer;
 
         rctx->sg = hdev->req->src;
         rctx->total = hdev->req->nbytes;
@@ -620,10 +620,13 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
                 reg |= HASH_CR_DMAA;
                 stm32_hash_write(hdev, HASH_CR, reg);
 
-                for (i = 0; i < DIV_ROUND_UP(ncp, sizeof(u32)); i++)
-                        stm32_hash_write(hdev, HASH_DIN, buffer[i]);
-
-                stm32_hash_set_nblw(hdev, ncp);
+                if (ncp) {
+                        memset(buffer + ncp, 0,
+                               DIV_ROUND_UP(ncp, sizeof(u32)) - ncp);
+                        writesl(hdev->io_base + HASH_DIN, buffer,
+                                DIV_ROUND_UP(ncp, sizeof(u32)));
+                }
+                stm32_hash_set_nblw(hdev, DIV_ROUND_UP(ncp, sizeof(u32)));
                 reg = stm32_hash_read(hdev, HASH_STR);
                 reg |= HASH_STR_DCAL;
                 stm32_hash_write(hdev, HASH_STR, reg);
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 66fb40d0ebdb..03830634e141 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -383,7 +383,7 @@ err_put_fd:
         return err;
 }
 
-static void sync_fill_fence_info(struct dma_fence *fence,
+static int sync_fill_fence_info(struct dma_fence *fence,
                                  struct sync_fence_info *info)
 {
         strlcpy(info->obj_name, fence->ops->get_timeline_name(fence),
@@ -399,6 +399,8 @@ static void sync_fill_fence_info(struct dma_fence *fence,
                 test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags) ?
                 ktime_to_ns(fence->timestamp) :
                 ktime_set(0, 0);
+
+        return info->status;
 }
 
 static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
@@ -424,8 +426,12 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
          * sync_fence_info and return the actual number of fences on
          * info->num_fences.
          */
-        if (!info.num_fences)
+        if (!info.num_fences) {
+                info.status = dma_fence_is_signaled(sync_file->fence);
                 goto no_fences;
+        } else {
+                info.status = 1;
+        }
 
         if (info.num_fences < num_fences)
                 return -EINVAL;
@@ -435,8 +441,10 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
         if (!fence_info)
                 return -ENOMEM;
 
-        for (i = 0; i < num_fences; i++)
-                sync_fill_fence_info(fences[i], &fence_info[i]);
+        for (i = 0; i < num_fences; i++) {
+                int status = sync_fill_fence_info(fences[i], &fence_info[i]);
+                info.status = info.status <= 0 ? info.status : status;
+        }
 
         if (copy_to_user(u64_to_user_ptr(info.sync_fence_info), fence_info,
                          size)) {
@@ -446,7 +454,6 @@ static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
 
 no_fences:
         sync_file_get_name(sync_file, info.name, sizeof(info.name));
-        info.status = dma_fence_is_signaled(sync_file->fence);
         info.num_fences = num_fences;
 
         if (copy_to_user((void __user *)arg, &info, sizeof(info)))
diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index 32905d5606ac..55f9c62ee54b 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -212,11 +212,12 @@ struct msgdma_device {
 static struct msgdma_sw_desc *msgdma_get_descriptor(struct msgdma_device *mdev)
 {
         struct msgdma_sw_desc *desc;
+        unsigned long flags;
 
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, flags);
         desc = list_first_entry(&mdev->free_list, struct msgdma_sw_desc, node);
         list_del(&desc->node);
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, flags);
 
         INIT_LIST_HEAD(&desc->tx_list);
 
@@ -306,13 +307,14 @@ static dma_cookie_t msgdma_tx_submit(struct dma_async_tx_descriptor *tx)
         struct msgdma_device *mdev = to_mdev(tx->chan);
         struct msgdma_sw_desc *new;
         dma_cookie_t cookie;
+        unsigned long flags;
 
         new = tx_to_desc(tx);
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, flags);
         cookie = dma_cookie_assign(tx);
 
         list_add_tail(&new->node, &mdev->pending_list);
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, flags);
 
         return cookie;
 }
@@ -336,17 +338,18 @@ msgdma_prep_memcpy(struct dma_chan *dchan, dma_addr_t dma_dst,
         struct msgdma_extended_desc *desc;
         size_t copy;
         u32 desc_cnt;
+        unsigned long irqflags;
 
         desc_cnt = DIV_ROUND_UP(len, MSGDMA_MAX_TRANS_LEN);
 
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, irqflags);
         if (desc_cnt > mdev->desc_free_cnt) {
-                spin_unlock_bh(&mdev->lock);
+                spin_unlock_irqrestore(&mdev->lock, irqflags);
                 dev_dbg(mdev->dev, "mdev %p descs are not available\n", mdev);
                 return NULL;
         }
         mdev->desc_free_cnt -= desc_cnt;
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, irqflags);
 
         do {
                 /* Allocate and populate the descriptor */
@@ -397,18 +400,19 @@ msgdma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
         u32 desc_cnt = 0, i;
         struct scatterlist *sg;
         u32 stride;
+        unsigned long irqflags;
 
         for_each_sg(sgl, sg, sg_len, i)
                 desc_cnt += DIV_ROUND_UP(sg_dma_len(sg), MSGDMA_MAX_TRANS_LEN);
 
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, irqflags);
         if (desc_cnt > mdev->desc_free_cnt) {
-                spin_unlock_bh(&mdev->lock);
+                spin_unlock_irqrestore(&mdev->lock, irqflags);
                 dev_dbg(mdev->dev, "mdev %p descs are not available\n", mdev);
                 return NULL;
         }
         mdev->desc_free_cnt -= desc_cnt;
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, irqflags);
 
         avail = sg_dma_len(sgl);
 
@@ -566,10 +570,11 @@ static void msgdma_start_transfer(struct msgdma_device *mdev)
 static void msgdma_issue_pending(struct dma_chan *chan)
 {
         struct msgdma_device *mdev = to_mdev(chan);
+        unsigned long flags;
 
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, flags);
         msgdma_start_transfer(mdev);
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, flags);
 }
 
 /**
@@ -634,10 +639,11 @@ static void msgdma_free_descriptors(struct msgdma_device *mdev)
 static void msgdma_free_chan_resources(struct dma_chan *dchan)
 {
         struct msgdma_device *mdev = to_mdev(dchan);
+        unsigned long flags;
 
-        spin_lock_bh(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, flags);
         msgdma_free_descriptors(mdev);
-        spin_unlock_bh(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, flags);
         kfree(mdev->sw_desq);
 }
 
@@ -682,8 +688,9 @@ static void msgdma_tasklet(unsigned long data)
         u32 count;
         u32 __maybe_unused size;
         u32 __maybe_unused status;
+        unsigned long flags;
 
-        spin_lock(&mdev->lock);
+        spin_lock_irqsave(&mdev->lock, flags);
 
         /* Read number of responses that are available */
         count = ioread32(mdev->csr + MSGDMA_CSR_RESP_FILL_LEVEL);
@@ -698,13 +705,13 @@ static void msgdma_tasklet(unsigned long data)
                  * bits. So we need to just drop these values.
                  */
                 size = ioread32(mdev->resp + MSGDMA_RESP_BYTES_TRANSFERRED);
-                status = ioread32(mdev->resp - MSGDMA_RESP_STATUS);
+                status = ioread32(mdev->resp + MSGDMA_RESP_STATUS);
 
                 msgdma_complete_descriptor(mdev);
                 msgdma_chan_desc_cleanup(mdev);
         }
 
-        spin_unlock(&mdev->lock);
+        spin_unlock_irqrestore(&mdev->lock, flags);
 }
 
 /**
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 3879f80a4815..a7ea20e7b8e9 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1143,11 +1143,24 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
         struct edma_desc *edesc;
         struct device *dev = chan->device->dev;
         struct edma_chan *echan = to_edma_chan(chan);
-        unsigned int width, pset_len;
+        unsigned int width, pset_len, array_size;
 
         if (unlikely(!echan || !len))
                 return NULL;
 
+        /* Align the array size (acnt block) with the transfer properties */
+        switch (__ffs((src | dest | len))) {
+        case 0:
+                array_size = SZ_32K - 1;
+                break;
+        case 1:
+                array_size = SZ_32K - 2;
+                break;
+        default:
+                array_size = SZ_32K - 4;
+                break;
+        }
+
         if (len < SZ_64K) {
                 /*
                  * Transfer size less than 64K can be handled with one paRAM
@@ -1169,7 +1182,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
                  * When the full_length is multibple of 32767 one slot can be
                  * used to complete the transfer.
                  */
-                width = SZ_32K - 1;
+                width = array_size;
                 pset_len = rounddown(len, width);
                 /* One slot is enough for lengths multiple of (SZ_32K -1) */
                 if (unlikely(pset_len == len))
@@ -1217,7 +1230,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy(
                 }
                 dest += pset_len;
                 src += pset_len;
-                pset_len = width = len % (SZ_32K - 1);
+                pset_len = width = len % array_size;
 
                 ret = edma_config_pset(chan, &edesc->pset[1], src, dest, 1,
                                        width, pset_len, DMA_MEM_TO_MEM);
diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
index 2f65a8fde21d..f1d04b70ee67 100644
--- a/drivers/dma/ti-dma-crossbar.c
+++ b/drivers/dma/ti-dma-crossbar.c
@@ -262,13 +262,14 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
         mutex_lock(&xbar->mutex);
         map->xbar_out = find_first_zero_bit(xbar->dma_inuse,
                                             xbar->dma_requests);
-        mutex_unlock(&xbar->mutex);
         if (map->xbar_out == xbar->dma_requests) {
+                mutex_unlock(&xbar->mutex);
                 dev_err(&pdev->dev, "Run out of free DMA requests\n");
                 kfree(map);
                 return ERR_PTR(-ENOMEM);
         }
         set_bit(map->xbar_out, xbar->dma_inuse);
+        mutex_unlock(&xbar->mutex);
 
         map->xbar_in = (u16)dma_spec->args[0];
 
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 1cb2d1c070c3..a94601d5939e 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -238,7 +238,8 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
 
         efi_random_get_seed(sys_table);
 
-        if (!nokaslr()) {
+        /* hibernation expects the runtime regions to stay in the same place */
+        if (!IS_ENABLED(CONFIG_HIBERNATION) && !nokaslr()) {
                 /*
                  * Randomize the base of the UEFI runtime services region.
                  * Preserve the 2 MB alignment of the region by taking a
diff --git a/drivers/firmware/efi/test/efi_test.c b/drivers/firmware/efi/test/efi_test.c
index 08129b7b80ab..41c48a1e8baa 100644
--- a/drivers/firmware/efi/test/efi_test.c
+++ b/drivers/firmware/efi/test/efi_test.c
@@ -593,6 +593,9 @@ static long efi_runtime_query_capsulecaps(unsigned long arg)
         if (copy_from_user(&qcaps, qcaps_user, sizeof(qcaps)))
                 return -EFAULT;
 
+        if (qcaps.capsule_count == ULONG_MAX)
+                return -EINVAL;
+
         capsules = kcalloc(qcaps.capsule_count + 1,
                            sizeof(efi_capsule_header_t), GFP_KERNEL);
         if (!capsules)
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 08629ee69d11..00e73d28077c 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -361,12 +361,12 @@ static const struct fpga_manager_ops altera_cvp_ops = {
         .write_complete = altera_cvp_write_complete,
 };
 
-static ssize_t show_chkcfg(struct device_driver *dev, char *buf)
+static ssize_t chkcfg_show(struct device_driver *dev, char *buf)
 {
         return snprintf(buf, 3, "%d\n", altera_cvp_chkcfg);
 }
 
-static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
+static ssize_t chkcfg_store(struct device_driver *drv, const char *buf,
                             size_t count)
 {
         int ret;
@@ -378,7 +378,7 @@ static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
         return count;
 }
 
-static DRIVER_ATTR(chkcfg, 0600, show_chkcfg, store_chkcfg);
+static DRIVER_ATTR_RW(chkcfg);
 
 static int altera_cvp_probe(struct pci_dev *pdev,
                             const struct pci_device_id *dev_id);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 3388d54ba114..3f80f167ed56 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -453,7 +453,8 @@ config GPIO_TS4800
 config GPIO_THUNDERX
         tristate "Cavium ThunderX/OCTEON-TX GPIO"
         depends on ARCH_THUNDER || (64BIT && COMPILE_TEST)
-        depends on PCI_MSI && IRQ_DOMAIN_HIERARCHY
+        depends on PCI_MSI
+        select IRQ_DOMAIN_HIERARCHY
         select IRQ_FASTEOI_HIERARCHY_HANDLERS
         help
           Say yes here to support the on-chip GPIO lines on the ThunderX
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index dbf869fb63ce..3233b72b6828 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -518,7 +518,13 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
                 irq_set_handler_locked(d, handle_level_irq);
         else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
-                irq_set_handler_locked(d, handle_edge_irq);
+                /*
+                 * Edge IRQs are already cleared/acked in irq_handler and
+                 * not need to be masked, as result handle_edge_irq()
+                 * logic is excessed here and may cause lose of interrupts.
+                 * So just use handle_simple_irq.
+                 */
+                irq_set_handler_locked(d, handle_simple_irq);
 
         return 0;
 
@@ -678,7 +684,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
 {
         void __iomem *isr_reg = NULL;
-        u32 isr;
+        u32 enabled, isr, level_mask;
         unsigned int bit;
         struct gpio_bank *bank = gpiobank;
         unsigned long wa_lock_flags;
@@ -691,23 +697,21 @@ static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
         pm_runtime_get_sync(bank->chip.parent);
 
         while (1) {
-                u32 isr_saved, level_mask = 0;
-                u32 enabled;
-
                 raw_spin_lock_irqsave(&bank->lock, lock_flags);
 
                 enabled = omap_get_gpio_irqbank_mask(bank);
-                isr_saved = isr = readl_relaxed(isr_reg) & enabled;
+                isr = readl_relaxed(isr_reg) & enabled;
 
                 if (bank->level_mask)
                         level_mask = bank->level_mask & enabled;
+                else
+                        level_mask = 0;
 
                 /* clear edge sensitive interrupts before handler(s) are
                 called so that we don't miss any interrupt occurred while
                 executing them */
-                omap_disable_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_clear_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_enable_gpio_irqbank(bank, isr_saved & ~level_mask);
+                if (isr & ~level_mask)
+                        omap_clear_gpio_irqbank(bank, isr & ~level_mask);
 
                 raw_spin_unlock_irqrestore(&bank->lock, lock_flags);
 
@@ -1010,7 +1014,7 @@ static void omap_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 
 /*---------------------------------------------------------------------*/
 
-static void __init omap_gpio_show_rev(struct gpio_bank *bank)
+static void omap_gpio_show_rev(struct gpio_bank *bank)
 {
         static bool called;
         u32 rev;
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 4d2113530735..eb4528c87c0b 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -203,7 +203,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         if (pin <= 255) {
                 char ev_name[5];
-                sprintf(ev_name, "_%c%02X",
+                sprintf(ev_name, "_%c%02hhX",
                         agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L',
                         pin);
                 if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 7ef6c28a34d9..bc746131987f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -834,7 +834,7 @@ int amdgpu_ttm_bind(struct ttm_buffer_object *bo, struct ttm_mem_reg *bo_mem)
         placement.busy_placement = &placements;
         placements.fpfn = 0;
         placements.lpfn = adev->mc.gart_size >> PAGE_SHIFT;
-        placements.flags = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
+        placements.flags = bo->mem.placement | TTM_PL_FLAG_TT;
 
         r = ttm_bo_mem_space(bo, &placement, &tmp, true, false);
         if (unlikely(r))
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index d228f5a99044..dbbe986f90f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -636,7 +636,194 @@ static void gfx_v6_0_tiling_mode_table_init(struct amdgpu_device *adev)
                                 NUM_BANKS(ADDR_SURF_2_BANK);
                 for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
                         WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
-        } else if (adev->asic_type == CHIP_OLAND || adev->asic_type == CHIP_HAINAN) {
+        } else if (adev->asic_type == CHIP_OLAND) {
+                tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[1] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[2] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[3] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[4] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[5] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[6] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[7] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[8] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[9] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[10] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[11] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[12] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[13] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[14] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[15] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[16] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[17] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[21] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_2) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[22] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[23] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[24] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[25] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_1KB) |
+                                NUM_BANKS(ADDR_SURF_8_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1);
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
+        } else if (adev->asic_type == CHIP_HAINAN) {
                 tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
                                 ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
                                 PIPE_CONFIG(ADDR_SURF_P2) |
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index 31db356476f8..430a6b4dfac9 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -225,11 +225,7 @@ static int uvd_v6_0_suspend(void *handle)
         if (r)
                 return r;
 
-        /* Skip this for APU for now */
-        if (!(adev->flags & AMD_IS_APU))
-                r = amdgpu_uvd_suspend(adev);
-
-        return r;
+        return amdgpu_uvd_suspend(adev);
 }
 
 static int uvd_v6_0_resume(void *handle)
@@ -237,12 +233,10 @@ static int uvd_v6_0_resume(void *handle)
         int r;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        /* Skip this for APU for now */
-        if (!(adev->flags & AMD_IS_APU)) {
-                r = amdgpu_uvd_resume(adev);
-                if (r)
-                        return r;
-        }
+        r = amdgpu_uvd_resume(adev);
+        if (r)
+                return r;
+
         return uvd_v6_0_hw_init(adev);
 }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index e4a8c2e52cb2..660b3fbade41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -892,6 +892,8 @@ static int kfd_ioctl_get_tile_config(struct file *filep,
         int err = 0;
 
         dev = kfd_device_by_id(args->gpu_id);
+        if (!dev)
+                return -EINVAL;
 
         dev->kfd2kgd->get_tile_config(dev->kgd, &config);
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 5979158c3f7b..944abfad39c1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -292,7 +292,10 @@ static int create_signal_event(struct file *devkfd,
                                 struct kfd_event *ev)
 {
         if (p->signal_event_count == KFD_SIGNAL_EVENT_LIMIT) {
-                pr_warn("Signal event wasn't created because limit was reached\n");
+                if (!p->signal_event_limit_reached) {
+                        pr_warn("Signal event wasn't created because limit was reached\n");
+                        p->signal_event_limit_reached = true;
+                }
                 return -ENOMEM;
         }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index 0649dd43e780..ed71ad40e8f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -184,7 +184,7 @@ static void uninitialize(struct kernel_queue *kq)
         if (kq->queue->properties.type == KFD_QUEUE_TYPE_HIQ)
                 kq->mqd->destroy_mqd(kq->mqd,
                                         kq->queue->mqd,
-                                        false,
+                                        KFD_PREEMPT_TYPE_WAVEFRONT_RESET,
                                         QUEUE_PREEMPT_DEFAULT_TIMEOUT_MS,
                                         kq->queue->pipe,
                                         kq->queue->queue);
@@ -210,6 +210,11 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         uint32_t wptr, rptr;
         unsigned int *queue_address;
 
+        /* When rptr == wptr, the buffer is empty.
+         * When rptr == wptr + 1, the buffer is full.
+         * It is always rptr that advances to the position of wptr, rather than
+         * the opposite. So we can only use up to queue_size_dwords - 1 dwords.
+         */
         rptr = *kq->rptr_kernel;
         wptr = *kq->wptr_kernel;
         queue_address = (unsigned int *)kq->pq_kernel_addr;
@@ -219,11 +224,10 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         pr_debug("wptr: %d\n", wptr);
         pr_debug("queue_address 0x%p\n", queue_address);
 
-        available_size = (rptr - 1 - wptr + queue_size_dwords) %
+        available_size = (rptr + queue_size_dwords - 1 - wptr) %
                                                         queue_size_dwords;
 
-        if (packet_size_in_dwords >= queue_size_dwords ||
-                        packet_size_in_dwords >= available_size) {
+        if (packet_size_in_dwords > available_size) {
                 /*
                  * make sure calling functions know
                  * acquire_packet_buffer() failed
@@ -233,6 +237,14 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         }
 
         if (wptr + packet_size_in_dwords >= queue_size_dwords) {
+                /* make sure after rolling back to position 0, there is
+                 * still enough space.
+                 */
+                if (packet_size_in_dwords >= rptr) {
+                        *buffer_ptr = NULL;
+                        return -ENOMEM;
+                }
+                /* fill nops, roll back and start at position 0 */
                 while (wptr > 0) {
                         queue_address[wptr] = kq->nop_packet;
                         wptr = (wptr + 1) % queue_size_dwords;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index b397ec726400..b87e96cee5fa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -521,6 +521,7 @@ struct kfd_process {
         struct list_head signal_event_pages;
         u32 next_nonsignal_event_id;
         size_t signal_event_count;
+        bool signal_event_limit_reached;
 };
 
 /**
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index c2743233ba10..b526f49be65d 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -830,7 +830,7 @@ uint32_t smu7_get_xclk(struct pp_hwmgr *hwmgr)
 {
         uint32_t reference_clock, tmp;
         struct cgs_display_info info = {0};
-        struct cgs_mode_info mode_info;
+        struct cgs_mode_info mode_info = {0};
 
         info.mode_info = &mode_info;
 
@@ -3948,10 +3948,9 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
         uint32_t ref_clock;
         uint32_t refresh_rate = 0;
         struct cgs_display_info info = {0};
-        struct cgs_mode_info mode_info;
+        struct cgs_mode_info mode_info = {0};
 
         info.mode_info = &mode_info;
-
         cgs_get_active_displays_info(hwmgr->device, &info);
         num_active_displays = info.display_count;
 
@@ -3967,6 +3966,7 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
         frame_time_in_us = 1000000 / refresh_rate;
 
         pre_vbi_time_in_us = frame_time_in_us - 200 - mode_info.vblank_time_us;
+
         data->frame_time_x2 = frame_time_in_us * 2 / 100;
 
         display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 97c94f9683fa..38cea6fb25a8 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -205,32 +205,17 @@ void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                            struct amd_sched_entity *entity)
 {
         struct amd_sched_rq *rq = entity->rq;
-        int r;
 
         if (!amd_sched_entity_is_initialized(sched, entity))
                 return;
+
         /**
          * The client will not queue more IBs during this fini, consume existing
-         * queued IBs or discard them on SIGKILL
+         * queued IBs
         */
-        if ((current->flags & PF_SIGNALED) && current->exit_code == SIGKILL)
-                r = -ERESTARTSYS;
-        else
-                r = wait_event_killable(sched->job_scheduled,
-                                        amd_sched_entity_is_idle(entity));
-        amd_sched_rq_remove_entity(rq, entity);
-        if (r) {
-                struct amd_sched_job *job;
+        wait_event(sched->job_scheduled, amd_sched_entity_is_idle(entity));
 
-                /* Park the kernel for a moment to make sure it isn't processing
-                 * our enity.
-                 */
-                kthread_park(sched->thread);
-                kthread_unpark(sched->thread);
-                while (kfifo_out(&entity->job_queue, &job, sizeof(job)))
-                        sched->ops->free_job(job);
-
-        }
+        amd_sched_rq_remove_entity(rq, entity);
         kfifo_free(&entity->job_queue);
 }
 
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 4e53aae9a1fb..0028591f3f95 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -2960,6 +2960,7 @@ out:
                 drm_modeset_backoff(&ctx);
         }
 
+        drm_atomic_state_put(state);
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 5a634594a6ce..57881167ccd2 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -551,12 +551,15 @@ static const struct etnaviv_gem_ops etnaviv_gem_shmem_ops = {
 void etnaviv_gem_free_object(struct drm_gem_object *obj)
 {
         struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
+        struct etnaviv_drm_private *priv = obj->dev->dev_private;
         struct etnaviv_vram_mapping *mapping, *tmp;
 
         /* object should not be active */
         WARN_ON(is_active(etnaviv_obj));
 
+        mutex_lock(&priv->gem_lock);
         list_del(&etnaviv_obj->gem_node);
+        mutex_unlock(&priv->gem_lock);
 
         list_for_each_entry_safe(mapping, tmp, &etnaviv_obj->vram_list,
                                  obj_node) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 026ef4e02f85..46dfe0737f43 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -445,8 +445,10 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
         cmdbuf->user_size = ALIGN(args->stream_size, 8);
 
         ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
-        if (ret == 0)
-                cmdbuf = NULL;
+        if (ret)
+                goto out;
+
+        cmdbuf = NULL;
 
         if (args->flags & ETNA_SUBMIT_FENCE_FD_OUT) {
                 /*
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index e651a58c18cf..82b72425a42f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -168,11 +168,13 @@ static struct drm_driver exynos_drm_driver = {
 static int exynos_drm_suspend(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct exynos_drm_private *private = drm_dev->dev_private;
+        struct exynos_drm_private *private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
+        private = drm_dev->dev_private;
+
         drm_kms_helper_poll_disable(drm_dev);
         exynos_drm_fbdev_suspend(drm_dev);
         private->suspend_state = drm_atomic_helper_suspend(drm_dev);
@@ -188,11 +190,12 @@ static int exynos_drm_suspend(struct device *dev)
 static int exynos_drm_resume(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct exynos_drm_private *private = drm_dev->dev_private;
+        struct exynos_drm_private *private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
+        private = drm_dev->dev_private;
         drm_atomic_helper_resume(drm_dev, private->suspend_state);
         exynos_drm_fbdev_resume(drm_dev);
         drm_kms_helper_poll_enable(drm_dev);
@@ -427,6 +430,7 @@ static void exynos_drm_unbind(struct device *dev)
 
         kfree(drm->dev_private);
         drm->dev_private = NULL;
+        dev_set_drvdata(dev, NULL);
 
         drm_dev_unref(drm);
 }
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 21c36e256884..d4726a3358a4 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -2723,6 +2723,9 @@ static int combine_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         uint32_t per_ctx_start[CACHELINE_DWORDS] = {0};
         unsigned char *bb_start_sva;
 
+        if (!wa_ctx->per_ctx.valid)
+                return 0;
+
         per_ctx_start[0] = 0x18800001;
         per_ctx_start[1] = wa_ctx->per_ctx.guest_gma;
 
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 91b4300f3b39..e5320b4eb698 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -701,8 +701,7 @@ static int submit_context(struct intel_vgpu *vgpu, int ring_id,
                         CACHELINE_BYTES;
                 workload->wa_ctx.per_ctx.guest_gma =
                         per_ctx & PER_CTX_ADDR_MASK;
-
-                WARN_ON(workload->wa_ctx.indirect_ctx.size && !(per_ctx & 0x1));
+                workload->wa_ctx.per_ctx.valid = per_ctx & 1;
         }
 
         if (emulate_schedule_in)
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 2294466dd415..a5bed2e71b92 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1429,18 +1429,7 @@ static int skl_lcpll_write(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
-static int ring_timestamp_mmio_read(struct intel_vgpu *vgpu,
-                unsigned int offset, void *p_data, unsigned int bytes)
-{
-        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
-
-        mmio_hw_access_pre(dev_priv);
-        vgpu_vreg(vgpu, offset) = I915_READ(_MMIO(offset));
-        mmio_hw_access_post(dev_priv);
-        return intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
-}
-
-static int instdone_mmio_read(struct intel_vgpu *vgpu,
+static int mmio_read_from_hw(struct intel_vgpu *vgpu,
                 unsigned int offset, void *p_data, unsigned int bytes)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
@@ -1589,6 +1578,8 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
         MMIO_F(prefix(BLT_RING_BASE), s, f, am, rm, d, r, w); \
         MMIO_F(prefix(GEN6_BSD_RING_BASE), s, f, am, rm, d, r, w); \
         MMIO_F(prefix(VEBOX_RING_BASE), s, f, am, rm, d, r, w); \
+        if (HAS_BSD2(dev_priv)) \
+                MMIO_F(prefix(GEN8_BSD2_RING_BASE), s, f, am, rm, d, r, w); \
 } while (0)
 
 #define MMIO_RING_D(prefix, d) \
@@ -1635,10 +1626,9 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x6c)
-        MMIO_RING_DFH(RING_REG, D_ALL, 0, instdone_mmio_read, NULL);
-        MMIO_DH(RING_REG(GEN8_BSD2_RING_BASE), D_ALL, instdone_mmio_read, NULL);
+        MMIO_RING_DFH(RING_REG, D_ALL, 0, mmio_read_from_hw, NULL);
 #undef RING_REG
-        MMIO_DH(GEN7_SC_INSTDONE, D_BDW_PLUS, instdone_mmio_read, NULL);
+        MMIO_DH(GEN7_SC_INSTDONE, D_BDW_PLUS, mmio_read_from_hw, NULL);
 
         MMIO_GM_RDR(0x2148, D_ALL, NULL, NULL);
         MMIO_GM_RDR(CCID, D_ALL, NULL, NULL);
@@ -1648,7 +1638,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_RING_DFH(RING_TAIL, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_RING_DFH(RING_HEAD, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_RING_DFH(RING_CTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
-        MMIO_RING_DFH(RING_ACTHD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_ACTHD, D_ALL, F_CMD_ACCESS, mmio_read_from_hw, NULL);
         MMIO_RING_GM_RDR(RING_START, D_ALL, NULL, NULL);
 
         /* RING MODE */
@@ -1662,9 +1652,9 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
                         NULL, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP, D_ALL, F_CMD_ACCESS,
-                        ring_timestamp_mmio_read, NULL);
+                        mmio_read_from_hw, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP_UDW, D_ALL, F_CMD_ACCESS,
-                        ring_timestamp_mmio_read, NULL);
+                        mmio_read_from_hw, NULL);
 
         MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
@@ -2411,9 +2401,6 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_DFH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS, NULL,
-                        intel_vgpu_reg_imr_handler);
-
         MMIO_DH(GEN8_GT_IMR(0), D_BDW_PLUS, NULL, intel_vgpu_reg_imr_handler);
         MMIO_DH(GEN8_GT_IER(0), D_BDW_PLUS, NULL, intel_vgpu_reg_ier_handler);
         MMIO_DH(GEN8_GT_IIR(0), D_BDW_PLUS, NULL, intel_vgpu_reg_iir_handler);
@@ -2476,68 +2463,34 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(GEN8_MASTER_IRQ, D_BDW_PLUS, NULL,
                 intel_vgpu_reg_master_irq_handler);
 
-        MMIO_DFH(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
-                F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x1c134, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-
-        MMIO_DFH(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
-                NULL, NULL);
-        MMIO_DFH(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS,
-                F_CMD_ACCESS, NULL, NULL);
-        MMIO_GM_RDR(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
-        MMIO_DFH(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
-                NULL, NULL);
-        MMIO_DFH(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
-                F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
-                F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
-                ring_mode_mmio_write);
-        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
-                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
-                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(RING_TIMESTAMP(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
-                        ring_timestamp_mmio_read, NULL);
-
-        MMIO_RING_DFH(RING_ACTHD_UDW, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_ACTHD_UDW, D_BDW_PLUS, F_CMD_ACCESS,
+                mmio_read_from_hw, NULL);
 
 #define RING_REG(base) (base + 0xd0)
         MMIO_RING_F(RING_REG, 4, F_RO, 0,
                 ~_MASKED_BIT_ENABLE(RESET_CTL_REQUEST_RESET), D_BDW_PLUS, NULL,
                 ring_reset_ctl_write);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO, 0,
-                ~_MASKED_BIT_ENABLE(RESET_CTL_REQUEST_RESET), D_BDW_PLUS, NULL,
-                ring_reset_ctl_write);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x230)
         MMIO_RING_DFH(RING_REG, D_BDW_PLUS, 0, NULL, elsp_mmio_write);
-        MMIO_DH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, elsp_mmio_write);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x234)
         MMIO_RING_F(RING_REG, 8, F_RO | F_CMD_ACCESS, 0, ~0, D_BDW_PLUS,
                 NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO | F_CMD_ACCESS, 0,
-                ~0LL, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x244)
         MMIO_RING_DFH(RING_REG, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
-                NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x370)
         MMIO_RING_F(RING_REG, 48, F_RO, 0, ~0, D_BDW_PLUS, NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 48, F_RO, 0, ~0, D_BDW_PLUS,
-                        NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x3a0)
         MMIO_RING_DFH(RING_REG, D_BDW_PLUS, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK, NULL, NULL);
 #undef RING_REG
 
         MMIO_D(PIPEMISC(PIPE_A), D_BDW_PLUS);
@@ -2557,11 +2510,9 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
 
 #define RING_REG(base) (base + 0x270)
         MMIO_RING_F(RING_REG, 32, 0, 0, 0, D_BDW_PLUS, NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 32, 0, 0, 0, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
         MMIO_RING_GM_RDR(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
-        MMIO_GM_RDR(RING_HWS_PGA(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
 
         MMIO_DFH(HDC_CHICKEN0, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
@@ -2849,7 +2800,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x65f08, D_SKL | D_KBL);
         MMIO_D(0x320f0, D_SKL | D_KBL);
 
-        MMIO_DFH(_REG_VCS2_EXCC, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x70034, D_SKL_PLUS);
         MMIO_D(0x71034, D_SKL_PLUS);
         MMIO_D(0x72034, D_SKL_PLUS);
diff --git a/drivers/gpu/drm/i915/gvt/reg.h b/drivers/gpu/drm/i915/gvt/reg.h
index fbd023a16f18..7d01c77a0f7a 100644
--- a/drivers/gpu/drm/i915/gvt/reg.h
+++ b/drivers/gpu/drm/i915/gvt/reg.h
@@ -54,9 +54,6 @@
 
 #define VGT_SPRSTRIDE(pipe)     _PIPE(pipe, _SPRA_STRIDE, _PLANE_STRIDE_2_B)
 
-#define _REG_VECS_EXCC          0x1A028
-#define _REG_VCS2_EXCC          0x1c028
-
 #define _REG_701C0(pipe, plane) (0x701c0 + pipe * 0x1000 + (plane - 1) * 0x100)
 #define _REG_701C4(pipe, plane) (0x701c4 + pipe * 0x1000 + (plane - 1) * 0x100)
 
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 436377da41ba..03532dfc0cd5 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -308,20 +308,8 @@ static int tbs_sched_init_vgpu(struct intel_vgpu *vgpu)
 
 static void tbs_sched_clean_vgpu(struct intel_vgpu *vgpu)
 {
-        struct intel_gvt_workload_scheduler *scheduler = &vgpu->gvt->scheduler;
-        int ring_id;
-
         kfree(vgpu->sched_data);
         vgpu->sched_data = NULL;
-
-        spin_lock_bh(&scheduler->mmio_context_lock);
-        for (ring_id = 0; ring_id < I915_NUM_ENGINES; ring_id++) {
-                if (scheduler->engine_owner[ring_id] == vgpu) {
-                        intel_gvt_switch_mmio(vgpu, NULL, ring_id);
-                        scheduler->engine_owner[ring_id] = NULL;
-                }
-        }
-        spin_unlock_bh(&scheduler->mmio_context_lock);
 }
 
 static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
@@ -388,6 +376,7 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
 {
         struct intel_gvt_workload_scheduler *scheduler =
                 &vgpu->gvt->scheduler;
+        int ring_id;
 
         gvt_dbg_core("vgpu%d: stop schedule\n", vgpu->id);
 
@@ -401,4 +390,13 @@ void intel_vgpu_stop_schedule(struct intel_vgpu *vgpu)
                 scheduler->need_reschedule = true;
                 scheduler->current_vgpu = NULL;
         }
+
+        spin_lock_bh(&scheduler->mmio_context_lock);
+        for (ring_id = 0; ring_id < I915_NUM_ENGINES; ring_id++) {
+                if (scheduler->engine_owner[ring_id] == vgpu) {
+                        intel_gvt_switch_mmio(vgpu, NULL, ring_id);
+                        scheduler->engine_owner[ring_id] = NULL;
+                }
+        }
+        spin_unlock_bh(&scheduler->mmio_context_lock);
 }
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.h b/drivers/gpu/drm/i915/gvt/scheduler.h
index 0d431a968a32..93a49eb0209e 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.h
+++ b/drivers/gpu/drm/i915/gvt/scheduler.h
@@ -68,6 +68,7 @@ struct shadow_indirect_ctx {
 struct shadow_per_ctx {
         unsigned long guest_gma;
         unsigned long shadow_gma;
+        unsigned valid;
 };
 
 struct intel_shadow_wa_ctx {
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 19404c96eeb1..32e857dc507c 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2657,6 +2657,9 @@ i915_gem_object_pwrite_gtt(struct drm_i915_gem_object *obj,
         if (READ_ONCE(obj->mm.pages))
                 return -ENODEV;
 
+        if (obj->mm.madv != I915_MADV_WILLNEED)
+                return -EFAULT;
+
         /* Before the pages are instantiated the object is treated as being
          * in the CPU domain. The pages will be clflushed as required before
          * use, and we can freely write into the pages directly. If userspace
@@ -3013,10 +3016,15 @@ void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
 
 static void nop_submit_request(struct drm_i915_gem_request *request)
 {
+        unsigned long flags;
+
         GEM_BUG_ON(!i915_terminally_wedged(&request->i915->gpu_error));
         dma_fence_set_error(&request->fence, -EIO);
-        i915_gem_request_submit(request);
+
+        spin_lock_irqsave(&request->engine->timeline->lock, flags);
+        __i915_gem_request_submit(request);
         intel_engine_init_global_seqno(request->engine, request->global_seqno);
+        spin_unlock_irqrestore(&request->engine->timeline->lock, flags);
 }
 
 static void engine_set_wedged(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 4df039ef2ce3..e161d383b526 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -33,21 +33,20 @@
 #include "intel_drv.h"
 #include "i915_trace.h"
 
-static bool ggtt_is_idle(struct drm_i915_private *dev_priv)
+static bool ggtt_is_idle(struct drm_i915_private *i915)
 {
-        struct i915_ggtt *ggtt = &dev_priv->ggtt;
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
+       struct intel_engine_cs *engine;
+       enum intel_engine_id id;
 
-        for_each_engine(engine, dev_priv, id) {
-                struct intel_timeline *tl;
+       if (i915->gt.active_requests)
+               return false;
 
-                tl = &ggtt->base.timeline.engine[engine->id];
-                if (i915_gem_active_isset(&tl->last_request))
-                        return false;
-        }
+       for_each_engine(engine, i915, id) {
+               if (engine->last_retired_context != i915->kernel_context)
+                       return false;
+       }
 
-        return true;
+       return true;
 }
 
 static int ggtt_flush(struct drm_i915_private *i915)
@@ -157,7 +156,8 @@ i915_gem_evict_something(struct i915_address_space *vm,
                                     min_size, alignment, cache_level,
                                     start, end, mode);
 
-        /* Retire before we search the active list. Although we have
+        /*
+         * Retire before we search the active list. Although we have
          * reasonable accuracy in our retirement lists, we may have
          * a stray pin (preventing eviction) that can only be resolved by
          * retiring.
@@ -182,7 +182,8 @@ search_again:
                 BUG_ON(ret);
         }
 
-        /* Can we unpin some objects such as idle hw contents,
+        /*
+         * Can we unpin some objects such as idle hw contents,
          * or pending flips? But since only the GGTT has global entries
          * such as scanouts, rinbuffers and contexts, we can skip the
          * purge when inspecting per-process local address spaces.
@@ -190,19 +191,33 @@ search_again:
         if (!i915_is_ggtt(vm) || flags & PIN_NONBLOCK)
                 return -ENOSPC;
 
-        if (ggtt_is_idle(dev_priv)) {
-                /* If we still have pending pageflip completions, drop
-                 * back to userspace to give our workqueues time to
-                 * acquire our locks and unpin the old scanouts.
-                 */
-                return intel_has_pending_fb_unpin(dev_priv) ? -EAGAIN : -ENOSPC;
-        }
+        /*
+         * Not everything in the GGTT is tracked via VMA using
+         * i915_vma_move_to_active(), otherwise we could evict as required
+         * with minimal stalling. Instead we are forced to idle the GPU and
+         * explicitly retire outstanding requests which will then remove
+         * the pinning for active objects such as contexts and ring,
+         * enabling us to evict them on the next iteration.
+         *
+         * To ensure that all user contexts are evictable, we perform
+         * a switch to the perma-pinned kernel context. This all also gives
+         * us a termination condition, when the last retired context is
+         * the kernel's there is no more we can evict.
+         */
+        if (!ggtt_is_idle(dev_priv)) {
+                ret = ggtt_flush(dev_priv);
+                if (ret)
+                        return ret;
 
-        ret = ggtt_flush(dev_priv);
-        if (ret)
-                return ret;
+                goto search_again;
+        }
 
-        goto search_again;
+        /*
+         * If we still have pending pageflip completions, drop
+         * back to userspace to give our workqueues time to
+         * acquire our locks and unpin the old scanouts.
+         */
+        return intel_has_pending_fb_unpin(dev_priv) ? -EAGAIN : -ENOSPC;
 
 found:
         /* drm_mm doesn't allow any other other operations while
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 94185d610673..370b9d248fed 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -2537,6 +2537,10 @@ static const struct file_operations fops = {
         .poll           = i915_perf_poll,
         .read           = i915_perf_read,
         .unlocked_ioctl = i915_perf_ioctl,
+        /* Our ioctl have no arguments, so it's safe to use the same function
+         * to handle 32bits compatibility.
+         */
+        .compat_ioctl   = i915_perf_ioctl,
 };
 
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index ed7cd9ee2c2a..c9bcc6c45012 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -6998,6 +6998,7 @@ enum {
  */
 #define  L3_GENERAL_PRIO_CREDITS(x)             (((x) >> 1) << 19)
 #define  L3_HIGH_PRIO_CREDITS(x)                (((x) >> 1) << 14)
+#define  L3_PRIO_CREDITS_MASK                   ((0x1f << 19) | (0x1f << 14))
 
 #define GEN7_L3CNTLREG1                         _MMIO(0xB01C)
 #define  GEN7_WA_FOR_GEN7_L3_CONTROL                    0x3C47FF8C
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index d805b6e6fe71..27743be5b768 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -606,11 +606,6 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder,
                          connector->encoder->base.id,
                          connector->encoder->name);
 
-        /* ELD Conn_Type */
-        connector->eld[5] &= ~(3 << 2);
-        if (intel_crtc_has_dp_encoder(crtc_state))
-                connector->eld[5] |= (1 << 2);
-
         connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2;
 
         if (dev_priv->display.audio_codec_enable)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 183e87e8ea31..5d4cd3d00564 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1163,6 +1163,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0;
         is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR);
 
+        if (port == PORT_A && is_dvi) {
+                DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n",
+                              is_hdmi ? "/HDMI" : "");
+                is_dvi = false;
+                is_hdmi = false;
+        }
+
         info->supports_dvi = is_dvi;
         info->supports_hdmi = is_hdmi;
         info->supports_dp = is_dp;
@@ -1233,7 +1240,7 @@ static void parse_ddi_ports(struct drm_i915_private *dev_priv,
 {
         enum port port;
 
-        if (!HAS_DDI(dev_priv))
+        if (!HAS_DDI(dev_priv) && !IS_CHERRYVIEW(dev_priv))
                 return;
 
         if (!dev_priv->vbt.child_dev_num)
diff --git a/drivers/gpu/drm/i915/intel_color.c b/drivers/gpu/drm/i915/intel_color.c
index ff9ecd211abb..b8315bca852b 100644
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -74,7 +74,7 @@
 #define I9XX_CSC_COEFF_1_0              \
         ((7 << 12) | I9XX_CSC_COEFF_FP(CTM_COEFF_1_0, 8))
 
-static bool crtc_state_is_legacy(struct drm_crtc_state *state)
+static bool crtc_state_is_legacy_gamma(struct drm_crtc_state *state)
 {
         return !state->degamma_lut &&
                 !state->ctm &&
@@ -288,7 +288,7 @@ static void cherryview_load_csc_matrix(struct drm_crtc_state *state)
         }
 
         mode = (state->ctm ? CGM_PIPE_MODE_CSC : 0);
-        if (!crtc_state_is_legacy(state)) {
+        if (!crtc_state_is_legacy_gamma(state)) {
                 mode |= (state->degamma_lut ? CGM_PIPE_MODE_DEGAMMA : 0) |
                         (state->gamma_lut ? CGM_PIPE_MODE_GAMMA : 0);
         }
@@ -469,7 +469,7 @@ static void broadwell_load_luts(struct drm_crtc_state *state)
         struct intel_crtc_state *intel_state = to_intel_crtc_state(state);
         enum pipe pipe = to_intel_crtc(state->crtc)->pipe;
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 haswell_load_luts(state);
                 return;
         }
@@ -529,7 +529,7 @@ static void glk_load_luts(struct drm_crtc_state *state)
 
         glk_load_degamma_lut(state);
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 haswell_load_luts(state);
                 return;
         }
@@ -551,7 +551,7 @@ static void cherryview_load_luts(struct drm_crtc_state *state)
         uint32_t i, lut_size;
         uint32_t word0, word1;
 
-        if (crtc_state_is_legacy(state)) {
+        if (crtc_state_is_legacy_gamma(state)) {
                 /* Turn off degamma/gamma on CGM block. */
                 I915_WRITE(CGM_PIPE_MODE(pipe),
                            (state->ctm ? CGM_PIPE_MODE_CSC : 0));
@@ -632,12 +632,10 @@ int intel_color_check(struct drm_crtc *crtc,
                 return 0;
 
         /*
-         * We also allow no degamma lut and a gamma lut at the legacy
+         * We also allow no degamma lut/ctm and a gamma lut at the legacy
          * size (256 entries).
          */
-        if (!crtc_state->degamma_lut &&
-            crtc_state->gamma_lut &&
-            crtc_state->gamma_lut->length == LEGACY_LUT_LENGTH)
+        if (crtc_state_is_legacy_gamma(crtc_state))
                 return 0;
 
         return -EINVAL;
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 965988f79a55..92c1f8e166dc 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -216,7 +216,7 @@ static void gen9_set_dc_state_debugmask(struct drm_i915_private *dev_priv)
 
         mask = DC_STATE_DEBUG_MASK_MEMORY_UP;
 
-        if (IS_BROXTON(dev_priv))
+        if (IS_GEN9_LP(dev_priv))
                 mask |= DC_STATE_DEBUG_MASK_CORES;
 
         /* The below bit doesn't need to be cleared ever afterwards */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4b4fd1f8110b..5e5fe03b638c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -664,8 +664,8 @@ intel_ddi_get_buf_trans_fdi(struct drm_i915_private *dev_priv,
                             int *n_entries)
 {
         if (IS_BROADWELL(dev_priv)) {
-                *n_entries = ARRAY_SIZE(hsw_ddi_translations_fdi);
-                return hsw_ddi_translations_fdi;
+                *n_entries = ARRAY_SIZE(bdw_ddi_translations_fdi);
+                return bdw_ddi_translations_fdi;
         } else if (IS_HASWELL(dev_priv)) {
                 *n_entries = ARRAY_SIZE(hsw_ddi_translations_fdi);
                 return hsw_ddi_translations_fdi;
@@ -1655,7 +1655,8 @@ bool intel_ddi_get_hw_state(struct intel_encoder *encoder,
 out:
         if (ret && IS_GEN9_LP(dev_priv)) {
                 tmp = I915_READ(BXT_PHY_CTL(port));
-                if ((tmp & (BXT_PHY_LANE_POWERDOWN_ACK |
+                if ((tmp & (BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                            BXT_PHY_LANE_POWERDOWN_ACK |
                             BXT_PHY_LANE_ENABLED)) != BXT_PHY_LANE_ENABLED)
                         DRM_ERROR("Port %c enabled but PHY powered down? "
                                   "(PHY_CTL %08x)\n", port_name(port), tmp);
@@ -2101,8 +2102,7 @@ static void intel_ddi_clk_select(struct intel_encoder *encoder,
                  * register writes.
                  */
                 val = I915_READ(DPCLKA_CFGCR0);
-                val &= ~(DPCLKA_CFGCR0_DDI_CLK_OFF(port) |
-                         DPCLKA_CFGCR0_DDI_CLK_SEL_MASK(port));
+                val &= ~DPCLKA_CFGCR0_DDI_CLK_OFF(port);
                 I915_WRITE(DPCLKA_CFGCR0, val);
         } else if (IS_GEN9_BC(dev_priv)) {
                 /* DDI -> PLL mapping  */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 00cd17c76fdc..5c7828c52d12 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -10245,13 +10245,10 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        enum transcoder cpu_transcoder = intel_crtc->config->cpu_transcoder;
+        enum transcoder cpu_transcoder;
         struct drm_display_mode *mode;
         struct intel_crtc_state *pipe_config;
-        int htot = I915_READ(HTOTAL(cpu_transcoder));
-        int hsync = I915_READ(HSYNC(cpu_transcoder));
-        int vtot = I915_READ(VTOTAL(cpu_transcoder));
-        int vsync = I915_READ(VSYNC(cpu_transcoder));
+        u32 htot, hsync, vtot, vsync;
         enum pipe pipe = intel_crtc->pipe;
 
         mode = kzalloc(sizeof(*mode), GFP_KERNEL);
@@ -10279,6 +10276,13 @@ struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
         i9xx_crtc_clock_get(intel_crtc, pipe_config);
 
         mode->clock = pipe_config->port_clock / pipe_config->pixel_multiplier;
+
+        cpu_transcoder = pipe_config->cpu_transcoder;
+        htot = I915_READ(HTOTAL(cpu_transcoder));
+        hsync = I915_READ(HSYNC(cpu_transcoder));
+        vtot = I915_READ(VTOTAL(cpu_transcoder));
+        vsync = I915_READ(VSYNC(cpu_transcoder));
+
         mode->hdisplay = (htot & 0xffff) + 1;
         mode->htotal = ((htot & 0xffff0000) >> 16) + 1;
         mode->hsync_start = (hsync & 0xffff) + 1;
@@ -12359,7 +12363,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
         struct drm_crtc_state *old_crtc_state, *new_crtc_state;
         struct drm_crtc *crtc;
         struct intel_crtc_state *intel_cstate;
-        bool hw_check = intel_state->modeset;
         u64 put_domains[I915_MAX_PIPES] = {};
         unsigned crtc_vblank_mask = 0;
         int i;
@@ -12376,7 +12379,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 
                 if (needs_modeset(new_crtc_state) ||
                     to_intel_crtc_state(new_crtc_state)->update_pipe) {
-                        hw_check = true;
 
                         put_domains[to_intel_crtc(crtc)->pipe] =
                                 modeset_get_crtc_power_domains(crtc,
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 64134947c0aa..203198659ab2 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2307,8 +2307,8 @@ static void edp_panel_off(struct intel_dp *intel_dp)
         I915_WRITE(pp_ctrl_reg, pp);
         POSTING_READ(pp_ctrl_reg);
 
-        intel_dp->panel_power_off_time = ktime_get_boottime();
         wait_panel_off(intel_dp);
+        intel_dp->panel_power_off_time = ktime_get_boottime();
 
         /* We got a reference when we enabled the VDD. */
         intel_display_power_put(dev_priv, intel_dp->aux_power_domain);
@@ -5273,7 +5273,7 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,
          * seems sufficient to avoid this problem.
          */
         if (dev_priv->quirks & QUIRK_INCREASE_T12_DELAY) {
-                vbt.t11_t12 = max_t(u16, vbt.t11_t12, 900 * 10);
+                vbt.t11_t12 = max_t(u16, vbt.t11_t12, 1300 * 10);
                 DRM_DEBUG_KMS("Increasing T12 panel delay as per the quirk to %d\n",
                               vbt.t11_t12);
         }
diff --git a/drivers/gpu/drm/i915/intel_dpio_phy.c b/drivers/gpu/drm/i915/intel_dpio_phy.c
index 09b670929786..de38d014ed39 100644
--- a/drivers/gpu/drm/i915/intel_dpio_phy.c
+++ b/drivers/gpu/drm/i915/intel_dpio_phy.c
@@ -208,12 +208,6 @@ static const struct bxt_ddi_phy_info glk_ddi_phy_info[] = {
         },
 };
 
-static u32 bxt_phy_port_mask(const struct bxt_ddi_phy_info *phy_info)
-{
-        return (phy_info->dual_channel * BIT(phy_info->channel[DPIO_CH1].port)) |
-                BIT(phy_info->channel[DPIO_CH0].port);
-}
-
 static const struct bxt_ddi_phy_info *
 bxt_get_phy_list(struct drm_i915_private *dev_priv, int *count)
 {
@@ -313,7 +307,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                             enum dpio_phy phy)
 {
         const struct bxt_ddi_phy_info *phy_info;
-        enum port port;
 
         phy_info = bxt_get_phy_info(dev_priv, phy);
 
@@ -335,19 +328,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                 return false;
         }
 
-        for_each_port_masked(port, bxt_phy_port_mask(phy_info)) {
-                u32 tmp = I915_READ(BXT_PHY_CTL(port));
-
-                if (tmp & BXT_PHY_CMNLANE_POWERDOWN_ACK) {
-                        DRM_DEBUG_DRIVER("DDI PHY %d powered, but common lane "
-                                         "for port %c powered down "
-                                         "(PHY_CTL %08x)\n",
-                                         phy, port_name(port), tmp);
-
-                        return false;
-                }
-        }
-
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
index a2a3d93d67bd..df808a94c511 100644
--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
@@ -1996,7 +1996,7 @@ static void cnl_ddi_pll_enable(struct drm_i915_private *dev_priv,
 
         /* 3. Configure DPLL_CFGCR0 */
         /* Avoid touch CFGCR1 if HDMI mode is not enabled */
-        if (pll->state.hw_state.cfgcr0 & DPLL_CTRL1_HDMI_MODE(pll->id)) {
+        if (pll->state.hw_state.cfgcr0 & DPLL_CFGCR0_HDMI_MODE) {
                 val = pll->state.hw_state.cfgcr1;
                 I915_WRITE(CNL_DPLL_CFGCR1(pll->id), val);
                 /* 4. Reab back to ensure writes completed */
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 9ab596941372..3c2d9cf22ed5 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1048,9 +1048,12 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
         }
 
         /* WaProgramL3SqcReg1DefaultForPerf:bxt */
-        if (IS_BXT_REVID(dev_priv, BXT_REVID_B0, REVID_FOREVER))
-                I915_WRITE(GEN8_L3SQCREG1, L3_GENERAL_PRIO_CREDITS(62) |
-                                           L3_HIGH_PRIO_CREDITS(2));
+        if (IS_BXT_REVID(dev_priv, BXT_REVID_B0, REVID_FOREVER)) {
+                u32 val = I915_READ(GEN8_L3SQCREG1);
+                val &= ~L3_PRIO_CREDITS_MASK;
+                val |= L3_GENERAL_PRIO_CREDITS(62) | L3_HIGH_PRIO_CREDITS(2);
+                I915_WRITE(GEN8_L3SQCREG1, val);
+        }
 
         /* WaToEnableHwFixForPushConstHWBug:bxt */
         if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER))
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 951e834dd274..28a778b785ac 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -30,6 +30,21 @@
 #include "intel_drv.h"
 #include "i915_drv.h"
 
+static void intel_connector_update_eld_conn_type(struct drm_connector *connector)
+{
+        u8 conn_type;
+
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                conn_type = DRM_ELD_CONN_TYPE_DP;
+        } else {
+                conn_type = DRM_ELD_CONN_TYPE_HDMI;
+        }
+
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] &= ~DRM_ELD_CONN_TYPE_MASK;
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= conn_type;
+}
+
 /**
  * intel_connector_update_modes - update connector from edid
  * @connector: DRM connector device to use
@@ -44,6 +59,8 @@ int intel_connector_update_modes(struct drm_connector *connector,
         ret = drm_add_edid_modes(connector, edid);
         drm_edid_to_eld(connector, edid);
 
+        intel_connector_update_eld_conn_type(connector);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index ed662937ec3c..0a09f8ff6aff 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -8245,14 +8245,17 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv,
                                    int high_prio_credits)
 {
         u32 misccpctl;
+        u32 val;
 
         /* WaTempDisableDOPClkGating:bdw */
         misccpctl = I915_READ(GEN7_MISCCPCTL);
         I915_WRITE(GEN7_MISCCPCTL, misccpctl & ~GEN7_DOP_CLOCK_GATE_ENABLE);
 
-        I915_WRITE(GEN8_L3SQCREG1,
-                   L3_GENERAL_PRIO_CREDITS(general_prio_credits) |
-                   L3_HIGH_PRIO_CREDITS(high_prio_credits));
+        val = I915_READ(GEN8_L3SQCREG1);
+        val &= ~L3_PRIO_CREDITS_MASK;
+        val |= L3_GENERAL_PRIO_CREDITS(general_prio_credits);
+        val |= L3_HIGH_PRIO_CREDITS(high_prio_credits);
+        I915_WRITE(GEN8_L3SQCREG1, val);
 
         /*
          * Wait at least 100 clocks before re-enabling clock gating.
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index b66d8e136aa3..49577eba8e7e 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -368,7 +368,7 @@ static void hsw_power_well_enable(struct drm_i915_private *dev_priv,
 {
         enum i915_power_well_id id = power_well->id;
         bool wait_fuses = power_well->hsw.has_fuses;
-        enum skl_power_gate pg;
+        enum skl_power_gate uninitialized_var(pg);
         u32 val;
 
         if (wait_fuses) {
@@ -2782,6 +2782,9 @@ static void cnl_display_core_init(struct drm_i915_private *dev_priv, bool resume
 
         /* 6. Enable DBUF */
         gen9_dbuf_enable(dev_priv);
+
+        if (resume && dev_priv->csr.dmc_payload)
+                intel_csr_load_program(dev_priv);
 }
 
 #undef CNL_PROCMON_IDX
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index dbb31a014419..deaf869374ea 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -248,7 +248,7 @@ disable_clks:
         clk_disable_unprepare(ahb_clk);
 disable_gdsc:
         regulator_disable(gdsc_reg);
-        pm_runtime_put_autosuspend(dev);
+        pm_runtime_put_sync(dev);
 put_clk:
         clk_put(ahb_clk);
 put_gdsc:
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
index c2bdad88447e..824067d2d427 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
@@ -83,6 +83,8 @@ const struct mdp5_cfg_hw msm8x74v1_config = {
                                   .caps = MDP_LM_CAP_WB },
                              },
                 .nb_stages = 5,
+                .max_width = 2048,
+                .max_height = 0xFFFF,
         },
         .dspp = {
                 .count = 3,
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 6fcb58ab718c..440977677001 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -804,8 +804,6 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
         spin_unlock_irqrestore(&mdp5_crtc->cursor.lock, flags);
 
-        pm_runtime_put_autosuspend(&pdev->dev);
-
 set_cursor:
         ret = mdp5_ctl_set_cursor(ctl, pipeline, 0, cursor_enable);
         if (ret) {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index f15821a0d900..ea5bb0e1632c 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -610,17 +610,6 @@ int msm_gem_sync_object(struct drm_gem_object *obj,
         struct dma_fence *fence;
         int i, ret;
 
-        if (!exclusive) {
-                /* NOTE: _reserve_shared() must happen before _add_shared_fence(),
-                 * which makes this a slightly strange place to call it.  OTOH this
-                 * is a convenient can-fail point to hook it in.  (And similar to
-                 * how etnaviv and nouveau handle this.)
-                 */
-                ret = reservation_object_reserve_shared(msm_obj->resv);
-                if (ret)
-                        return ret;
-        }
-
         fobj = reservation_object_get_list(msm_obj->resv);
         if (!fobj || (fobj->shared_count == 0)) {
                 fence = reservation_object_get_excl(msm_obj->resv);
@@ -1045,10 +1034,10 @@ static void *_msm_gem_kernel_new(struct drm_device *dev, uint32_t size,
         }
 
         vaddr = msm_gem_get_vaddr(obj);
-        if (!vaddr) {
+        if (IS_ERR(vaddr)) {
                 msm_gem_put_iova(obj, aspace);
                 drm_gem_object_unreference(obj);
-                return ERR_PTR(-ENOMEM);
+                return ERR_CAST(vaddr);
         }
 
         if (bo)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 5d0a75d4b249..93535cac0676 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -221,7 +221,7 @@ fail:
         return ret;
 }
 
-static int submit_fence_sync(struct msm_gem_submit *submit)
+static int submit_fence_sync(struct msm_gem_submit *submit, bool no_implicit)
 {
         int i, ret = 0;
 
@@ -229,6 +229,20 @@ static int submit_fence_sync(struct msm_gem_submit *submit)
                 struct msm_gem_object *msm_obj = submit->bos[i].obj;
                 bool write = submit->bos[i].flags & MSM_SUBMIT_BO_WRITE;
 
+                if (!write) {
+                        /* NOTE: _reserve_shared() must happen before
+                         * _add_shared_fence(), which makes this a slightly
+                         * strange place to call it.  OTOH this is a
+                         * convenient can-fail point to hook it in.
+                         */
+                        ret = reservation_object_reserve_shared(msm_obj->resv);
+                        if (ret)
+                                return ret;
+                }
+
+                if (no_implicit)
+                        continue;
+
                 ret = msm_gem_sync_object(&msm_obj->base, submit->gpu->fctx, write);
                 if (ret)
                         break;
@@ -451,11 +465,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto out;
 
-        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
-                ret = submit_fence_sync(submit);
-                if (ret)
-                        goto out;
-        }
+        ret = submit_fence_sync(submit, !!(args->flags & MSM_SUBMIT_NO_IMPLICIT));
+        if (ret)
+                goto out;
 
         ret = submit_pin_objects(submit);
         if (ret)
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index ffbff27600e0..6a887032c66a 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -718,7 +718,8 @@ void msm_gpu_cleanup(struct msm_gpu *gpu)
                         msm_gem_put_iova(gpu->rb->bo, gpu->aspace);
                 msm_ringbuffer_destroy(gpu->rb);
         }
-        if (gpu->aspace) {
+
+        if (!IS_ERR_OR_NULL(gpu->aspace)) {
                 gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu,
                         NULL, 0);
                 msm_gem_address_space_put(gpu->aspace);
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index 0366b8092f97..ec56794ad039 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -111,10 +111,14 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
 
                 wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
 
+                /* Note that smp_load_acquire() is not strictly required
+                 * as CIRC_SPACE_TO_END() does not access the tail more
+                 * than once.
+                 */
                 n = min(sz, circ_space_to_end(&rd->fifo));
                 memcpy(fptr, ptr, n);
 
-                fifo->head = (fifo->head + n) & (BUF_SZ - 1);
+                smp_store_release(&fifo->head, (fifo->head + n) & (BUF_SZ - 1));
                 sz  -= n;
                 ptr += n;
 
@@ -145,13 +149,17 @@ static ssize_t rd_read(struct file *file, char __user *buf,
         if (ret)
                 goto out;
 
+        /* Note that smp_load_acquire() is not strictly required
+         * as CIRC_CNT_TO_END() does not access the head more than
+         * once.
+         */
         n = min_t(int, sz, circ_count_to_end(&rd->fifo));
         if (copy_to_user(buf, fptr, n)) {
                 ret = -EFAULT;
                 goto out;
         }
 
-        fifo->tail = (fifo->tail + n) & (BUF_SZ - 1);
+        smp_store_release(&fifo->tail, (fifo->tail + n) & (BUF_SZ - 1));
         *ppos += n;
 
         wake_up_all(&rd->fifo_event);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index f7707849bb53..2b12d82aac15 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -223,7 +223,7 @@ void
 nouveau_fbcon_accel_save_disable(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
-        if (drm->fbcon) {
+        if (drm->fbcon && drm->fbcon->helper.fbdev) {
                 drm->fbcon->saved_flags = drm->fbcon->helper.fbdev->flags;
                 drm->fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED;
         }
@@ -233,7 +233,7 @@ void
 nouveau_fbcon_accel_restore(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
-        if (drm->fbcon) {
+        if (drm->fbcon && drm->fbcon->helper.fbdev) {
                 drm->fbcon->helper.fbdev->flags = drm->fbcon->saved_flags;
         }
 }
@@ -245,7 +245,8 @@ nouveau_fbcon_accel_fini(struct drm_device *dev)
         struct nouveau_fbdev *fbcon = drm->fbcon;
         if (fbcon && drm->channel) {
                 console_lock();
-                fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED;
+                if (fbcon->helper.fbdev)
+                        fbcon->helper.fbdev->flags |= FBINFO_HWACCEL_DISABLED;
                 console_unlock();
                 nouveau_channel_idle(drm->channel);
                 nvif_object_fini(&fbcon->twod);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 2dbf62a2ac41..e4751f92b342 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -3265,11 +3265,14 @@ nv50_mstm = {
 void
 nv50_mstm_service(struct nv50_mstm *mstm)
 {
-        struct drm_dp_aux *aux = mstm->mgr.aux;
+        struct drm_dp_aux *aux = mstm ? mstm->mgr.aux : NULL;
         bool handled = true;
         int ret;
         u8 esi[8] = {};
 
+        if (!aux)
+                return;
+
         while (handled) {
                 ret = drm_dp_dpcd_read(aux, DP_SINK_COUNT_ESI, esi, 8);
                 if (ret != 8) {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
index 8e2e24a74774..44e116f7880d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
@@ -39,5 +39,5 @@ int
 g84_bsp_new(struct nvkm_device *device, int index, struct nvkm_engine **pengine)
 {
         return nvkm_xtensa_new_(&g84_bsp, device, index,
-                                true, 0x103000, pengine);
+                                device->chipset != 0x92, 0x103000, pengine);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
index d06ad2c372bf..455da298227f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
@@ -241,6 +241,8 @@ nvkm_vm_unmap_pgt(struct nvkm_vm *vm, int big, u32 fpde, u32 lpde)
                         mmu->func->map_pgt(vpgd->obj, pde, vpgt->mem);
                 }
 
+                mmu->func->flush(vm);
+
                 nvkm_memory_del(&pgt);
         }
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 14c5613b4388..afbf50d0c08f 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -509,23 +509,25 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
             .y2 = qfb->base.height
         };
 
-        if (!old_state->fb) {
-                qxl_io_log(qdev,
-                           "create primary fb: %dx%d,%d,%d\n",
-                           bo->surf.width, bo->surf.height,
-                           bo->surf.stride, bo->surf.format);
+        if (old_state->fb) {
+                qfb_old = to_qxl_framebuffer(old_state->fb);
+                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        } else {
+                bo_old = NULL;
+        }
 
-                qxl_io_create_primary(qdev, 0, bo);
-                bo->is_primary = true;
+        if (bo == bo_old)
                 return;
 
-        } else {
-                qfb_old = to_qxl_framebuffer(old_state->fb);
-                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        if (bo_old && bo_old->is_primary) {
+                qxl_io_destroy_primary(qdev);
                 bo_old->is_primary = false;
         }
 
-        bo->is_primary = true;
+        if (!bo->is_primary) {
+                qxl_io_create_primary(qdev, 0, bo);
+                bo->is_primary = true;
+        }
         qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
 }
 
@@ -534,13 +536,15 @@ static void qxl_primary_atomic_disable(struct drm_plane *plane,
 {
         struct qxl_device *qdev = plane->dev->dev_private;
 
-        if (old_state->fb)
-        {       struct qxl_framebuffer *qfb =
+        if (old_state->fb) {
+                struct qxl_framebuffer *qfb =
                         to_qxl_framebuffer(old_state->fb);
                 struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
 
-                qxl_io_destroy_primary(qdev);
-                bo->is_primary = false;
+                if (bo->is_primary) {
+                        qxl_io_destroy_primary(qdev);
+                        bo->is_primary = false;
+                }
         }
 }
 
@@ -698,14 +702,15 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
         struct drm_gem_object *obj;
         struct qxl_bo *user_bo;
 
-        if (!plane->state->fb) {
-                /* we never executed prepare_fb, so there's nothing to
+        if (!old_state->fb) {
+                /*
+                 * we never executed prepare_fb, so there's nothing to
                  * unpin.
                  */
                 return;
         }
 
-        obj = to_qxl_framebuffer(plane->state->fb)->obj;
+        obj = to_qxl_framebuffer(old_state->fb)->obj;
         user_bo = gem_to_qxl_bo(obj);
         qxl_bo_unpin(user_bo);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 997131d58c7f..ffc10cadcf34 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1663,7 +1663,7 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
         radeon_agp_suspend(rdev);
 
         pci_save_state(dev->pdev);
-        if (freeze && rdev->family >= CHIP_CEDAR) {
+        if (freeze && rdev->family >= CHIP_CEDAR && !(rdev->flags & RADEON_IS_IGP)) {
                 rdev->asic->asic_reset(rdev, true);
                 pci_restore_state(dev->pdev);
         } else if (suspend) {
diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
index 06f05302ee75..882d85db9053 100644
--- a/drivers/gpu/drm/sun4i/Kconfig
+++ b/drivers/gpu/drm/sun4i/Kconfig
@@ -26,7 +26,7 @@ config DRM_SUN4I_HDMI_CEC
        bool "Allwinner A10 HDMI CEC Support"
        depends on DRM_SUN4I_HDMI
        select CEC_CORE
-       depends on CEC_PIN
+       select CEC_PIN
        help
           Choose this option if you have an Allwinner SoC with an HDMI
           controller and want to use CEC.
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi.h b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
index 1457750988da..a1f8cba251a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
@@ -15,7 +15,7 @@
 #include <drm/drm_connector.h>
 #include <drm/drm_encoder.h>
 
-#include <media/cec.h>
+#include <media/cec-pin.h>
 
 #define SUN4I_HDMI_CTRL_REG             0x004
 #define SUN4I_HDMI_CTRL_ENABLE                  BIT(31)
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 9ea6cd5a1370..3cf1a6932fac 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -302,26 +302,29 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         hdmi->mod_clk = devm_clk_get(dev, "mod");
         if (IS_ERR(hdmi->mod_clk)) {
                 dev_err(dev, "Couldn't get the HDMI mod clock\n");
-                return PTR_ERR(hdmi->mod_clk);
+                ret = PTR_ERR(hdmi->mod_clk);
+                goto err_disable_bus_clk;
         }
         clk_prepare_enable(hdmi->mod_clk);
 
         hdmi->pll0_clk = devm_clk_get(dev, "pll-0");
         if (IS_ERR(hdmi->pll0_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 0 clock\n");
-                return PTR_ERR(hdmi->pll0_clk);
+                ret = PTR_ERR(hdmi->pll0_clk);
+                goto err_disable_mod_clk;
         }
 
         hdmi->pll1_clk = devm_clk_get(dev, "pll-1");
         if (IS_ERR(hdmi->pll1_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 1 clock\n");
-                return PTR_ERR(hdmi->pll1_clk);
+                ret = PTR_ERR(hdmi->pll1_clk);
+                goto err_disable_mod_clk;
         }
 
         ret = sun4i_tmds_create(hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the TMDS clock\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         writel(SUN4I_HDMI_CTRL_ENABLE, hdmi->base + SUN4I_HDMI_CTRL_REG);
@@ -362,7 +365,7 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         ret = sun4i_hdmi_i2c_create(dev, hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the HDMI I2C adapter\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         drm_encoder_helper_add(&hdmi->encoder,
@@ -422,6 +425,10 @@ err_cleanup_connector:
         drm_encoder_cleanup(&hdmi->encoder);
 err_del_i2c_adapter:
         i2c_del_adapter(hdmi->i2c);
+err_disable_mod_clk:
+        clk_disable_unprepare(hdmi->mod_clk);
+err_disable_bus_clk:
+        clk_disable_unprepare(hdmi->bus_clk);
         return ret;
 }
 
@@ -434,6 +441,8 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
         drm_connector_cleanup(&hdmi->connector);
         drm_encoder_cleanup(&hdmi->encoder);
         i2c_del_adapter(hdmi->i2c);
+        clk_disable_unprepare(hdmi->mod_clk);
+        clk_disable_unprepare(hdmi->bus_clk);
 }
 
 static const struct component_ops sun4i_hdmi_ops = {
diff --git a/drivers/gpu/drm/tegra/trace.h b/drivers/gpu/drm/tegra/trace.h
index e9b7cdad5c4c..5a1ab4046e92 100644
--- a/drivers/gpu/drm/tegra/trace.h
+++ b/drivers/gpu/drm/tegra/trace.h
@@ -63,6 +63,6 @@ DEFINE_EVENT(register_access, sor_readl,
 
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/tegra
 #define TRACE_INCLUDE_FILE trace
 #include <trace/define_trace.h>
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 6a573d21d3cc..658fa2d3e40c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -405,6 +405,14 @@ int ipu_idmac_lock_enable(struct ipuv3_channel *channel, int num_bursts)
                 return -EINVAL;
         }
 
+        /*
+         * IPUv3EX / i.MX51 has a different register layout, and on IPUv3M /
+         * i.MX53 channel arbitration locking doesn't seem to work properly.
+         * Allow enabling the lock feature on IPUv3H / i.MX6 only.
+         */
+        if (bursts && ipu->ipu_type != IPUV3H)
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(idmac_lock_en_info); i++) {
                 if (channel->num == idmac_lock_en_info[i].chnum)
                         break;
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c35f74c83065..c860a7997cb5 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -73,6 +73,14 @@
 #define  IPU_PRE_STORE_ENG_CTRL_WR_NUM_BYTES(v)         ((v & 0x7) << 1)
 #define  IPU_PRE_STORE_ENG_CTRL_OUTPUT_ACTIVE_BPP(v)    ((v & 0x3) << 4)
 
+#define IPU_PRE_STORE_ENG_STATUS                        0x120
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_X_MASK    0xffff
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_X_SHIFT   0
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_MASK    0x3fff
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_SHIFT   16
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_FIFO_FULL       (1 << 30)
+#define  IPU_PRE_STORE_ENG_STATUS_STORE_FIELD           (1 << 31)
+
 #define IPU_PRE_STORE_ENG_SIZE                          0x130
 #define  IPU_PRE_STORE_ENG_SIZE_INPUT_WIDTH(v)          ((v & 0xffff) << 0)
 #define  IPU_PRE_STORE_ENG_SIZE_INPUT_HEIGHT(v)         ((v & 0xffff) << 16)
@@ -93,6 +101,7 @@ struct ipu_pre {
         dma_addr_t              buffer_paddr;
         void                    *buffer_virt;
         bool                    in_use;
+        unsigned int            safe_window_end;
 };
 
 static DEFINE_MUTEX(ipu_pre_list_mutex);
@@ -160,6 +169,9 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
         u32 active_bpp = info->cpp[0] >> 1;
         u32 val;
 
+        /* calculate safe window for ctrl register updates */
+        pre->safe_window_end = height - 2;
+
         writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
 
@@ -199,7 +211,24 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
 
 void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
 {
+        unsigned long timeout = jiffies + msecs_to_jiffies(5);
+        unsigned short current_yblock;
+        u32 val;
+
         writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
+
+        do {
+                if (time_after(jiffies, timeout)) {
+                        dev_warn(pre->dev, "timeout waiting for PRE safe window\n");
+                        return;
+                }
+
+                val = readl(pre->regs + IPU_PRE_STORE_ENG_STATUS);
+                current_yblock =
+                        (val >> IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_SHIFT) &
+                        IPU_PRE_STORE_ENG_STATUS_STORE_BLOCK_Y_MASK;
+        } while (current_yblock == 0 || current_yblock >= pre->safe_window_end);
+
         writel(IPU_PRE_CTRL_SDW_UPDATE, pre->regs + IPU_PRE_CTRL_SET);
 }
 
diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c
index ecc9ea44dc50..0013ca9f72c8 100644
--- a/drivers/gpu/ipu-v3/ipu-prg.c
+++ b/drivers/gpu/ipu-v3/ipu-prg.c
@@ -14,6 +14,7 @@
 #include <drm/drm_fourcc.h>
 #include <linux/clk.h>
 #include <linux/err.h>
+#include <linux/iopoll.h>
 #include <linux/mfd/syscon.h>
 #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
 #include <linux/module.h>
@@ -329,6 +330,12 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan,
         val = IPU_PRG_REG_UPDATE_REG_UPDATE;
         writel(val, prg->regs + IPU_PRG_REG_UPDATE);
 
+        /* wait for both double buffers to be filled */
+        readl_poll_timeout(prg->regs + IPU_PRG_STATUS, val,
+                           (val & IPU_PRG_STATUS_BUFFER0_READY(prg_chan)) &&
+                           (val & IPU_PRG_STATUS_BUFFER1_READY(prg_chan)),
+                           5, 1000);
+
         clk_disable_unprepare(prg->clk_ipg);
 
         chan->enabled = true;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 0a3117cc29e7..374301fcbc86 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -281,6 +281,7 @@ config HID_ELECOM
         Support for ELECOM devices:
           - BM084 Bluetooth Mouse
           - DEFT Trackball (Wired and wireless)
+          - HUGE Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9bc91160819b..330ca983828b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2032,6 +2032,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
 #endif
 #if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index e2c7465df69f..54aeea57d209 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -3,6 +3,7 @@
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
  *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
  *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
+ *  Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
  */
 
 /*
@@ -32,9 +33,11 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 break;
         case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
         case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
-                /* The DEFT trackball has eight buttons, but its descriptor only
-                 * reports five, disabling the three Fn buttons on the top of
-                 * the mouse.
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRED:
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRELESS:
+                /* The DEFT/HUGE trackball has eight buttons, but its descriptor
+                 * only reports five, disabling the three Fn buttons on the top
+                 * of the mouse.
                  *
                  * Apply the following diff to the descriptor:
                  *
@@ -62,7 +65,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                  * End Collection,                     End Collection,
                  */
                 if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
-                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        hid_info(hdev, "Fixing up Elecom DEFT/HUGE Fn buttons\n");
                         rdesc[13] = 8; /* Button/Variable Report Count */
                         rdesc[21] = 8; /* Button/Variable Usage Maximum */
                         rdesc[29] = 0; /* Button/Constant Report Count */
@@ -76,6 +79,8 @@ static const struct hid_device_id elecom_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b397a14ab970..be2e005c3c51 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -368,6 +368,8 @@
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRED 0x010c
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRELESS      0x010d
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
@@ -533,6 +535,7 @@
 #define USB_VENDOR_ID_IDEACOM           0x1cb6
 #define USB_DEVICE_ID_IDEACOM_IDC6650   0x6650
 #define USB_DEVICE_ID_IDEACOM_IDC6651   0x6651
+#define USB_DEVICE_ID_IDEACOM_IDC6680   0x6680
 
 #define USB_VENDOR_ID_ILITEK            0x222a
 #define USB_DEVICE_ID_ILITEK_MULTITOUCH 0x0001
@@ -660,6 +663,7 @@
 #define USB_DEVICE_ID_LENOVO_CBTKBD     0x6048
 #define USB_DEVICE_ID_LENOVO_TPPRODOCK  0x6067
 #define USB_DEVICE_ID_LENOVO_X1_COVER   0x6085
+#define USB_DEVICE_ID_LENOVO_X1_TAB     0x60a3
 
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 440b999304a5..9e8c4d2ba11d 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -930,6 +930,7 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
             field->application != HID_DG_PEN &&
             field->application != HID_DG_TOUCHPAD &&
             field->application != HID_GD_KEYBOARD &&
+            field->application != HID_GD_SYSTEM_CONTROL &&
             field->application != HID_CP_CONSUMER_CONTROL &&
             field->application != HID_GD_WIRELESS_RADIO_CTLS &&
             !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
@@ -1419,6 +1420,12 @@ static const struct hid_device_id mt_devices[] = {
                         USB_VENDOR_ID_ALPS_JP,
                         HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
 
+        /* Lenovo X1 TAB Gen 2 */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+                           USB_VENDOR_ID_LENOVO,
+                           USB_DEVICE_ID_LENOVO_X1_TAB) },
+
         /* Anton devices */
         { .driver_data = MT_CLS_EXPORT_ALL_INPUTS,
                 MT_USB_DEVICE(USB_VENDOR_ID_ANTON,
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 5b40c2614599..ef241d66562e 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_device *hdev)
         if (!(data->device_flags & RMI_DEVICE))
                 return 0;
 
-        ret = rmi_reset_attn_mode(hdev);
+        /* Make sure the HID device is ready to receive events */
+        ret = hid_hw_open(hdev);
         if (ret)
                 return ret;
 
+        ret = rmi_reset_attn_mode(hdev);
+        if (ret)
+                goto out;
+
         ret = rmi_driver_resume(rmi_dev, false);
         if (ret) {
                 hid_warn(hdev, "Failed to resume device: %d\n", ret);
-                return ret;
+                goto out;
         }
 
-        return 0;
+out:
+        hid_hw_close(hdev);
+        return ret;
 }
 #endif /* CONFIG_PM */
 
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index ec530454e6f6..5fbe0f81ab2e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -337,8 +337,8 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                         kfree(hidraw);
                 } else {
                         /* close device for last reader */
-                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                         hid_hw_close(hidraw->hid);
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                 }
         }
 }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 77396145d2d0..9145c2129a96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
 {
         /* the worst case is computed from the set_report command with a
          * reportID > 15 and the maximum report length */
-        int args_len = sizeof(__u8) + /* optional ReportID byte */
+        int args_len = sizeof(__u8) + /* ReportID */
+                       sizeof(__u8) + /* optional ReportID byte */
                        sizeof(__u16) + /* data register */
                        sizeof(__u16) + /* size of the report */
                        report_size; /* report */
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 089bad8a9a21..045b5da9b992 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -975,6 +975,8 @@ static int usbhid_parse(struct hid_device *hid)
         unsigned int rsize = 0;
         char *rdesc;
         int ret, n;
+        int num_descriptors;
+        size_t offset = offsetof(struct hid_descriptor, desc);
 
         quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
                         le16_to_cpu(dev->descriptor.idProduct));
@@ -997,10 +999,18 @@ static int usbhid_parse(struct hid_device *hid)
                 return -ENODEV;
         }
 
+        if (hdesc->bLength < sizeof(struct hid_descriptor)) {
+                dbg_hid("hid descriptor is too short\n");
+                return -EINVAL;
+        }
+
         hid->version = le16_to_cpu(hdesc->bcdHID);
         hid->country = hdesc->bCountryCode;
 
-        for (n = 0; n < hdesc->bNumDescriptors; n++)
+        num_descriptors = min_t(int, hdesc->bNumDescriptors,
+               (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
+
+        for (n = 0; n < num_descriptors; n++)
                 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
                         rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index a83fa76655b9..f489a5cfcb48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -99,6 +99,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index e82a696a1d07..906e654fb0ba 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
         /* Try to find an already-probed interface from the same device */
         list_for_each_entry(data, &wacom_udev_list, list) {
-                if (compare_device_paths(hdev, data->dev, '/'))
+                if (compare_device_paths(hdev, data->dev, '/')) {
+                        kref_get(&data->kref);
                         return data;
+                }
         }
 
         /* Fallback to finding devices that appear to be "siblings" */
@@ -766,6 +768,9 @@ static int wacom_led_control(struct wacom *wacom)
         if (!wacom->led.groups)
                 return -ENOTSUPP;
 
+        if (wacom->wacom_wac.features.type == REMOTE)
+                return -ENOTSUPP;
+
         if (wacom->wacom_wac.pid) { /* wireless connected */
                 report_id = WAC_CMD_WL_LED_CONTROL;
                 buf_size = 13;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index bb17d7bbefd3..aa692e28b2cd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                                 keys = data[9] & 0x07;
                         }
                 } else {
-                        buttons = ((data[6] & 0x10) << 10) |
-                                  ((data[5] & 0x10) << 9)  |
+                        buttons = ((data[6] & 0x10) << 5)  |
+                                  ((data[5] & 0x10) << 4)  |
                                   ((data[6] & 0x0F) << 4)  |
                                   (data[5] & 0x0F);
                 }
@@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                         continue;
 
                 if (range) {
+                        /* Fix rotation alignment: userspace expects zero at left */
+                        int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]);
+                        rotation += 1800/4;
+                        if (rotation > 899)
+                                rotation -= 1800;
+
                         input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
                         input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
-                        input_report_abs(pen_input, ABS_TILT_X, frame[7]);
-                        input_report_abs(pen_input, ABS_TILT_Y, frame[8]);
-                        input_report_abs(pen_input, ABS_Z, get_unaligned_le16(&frame[9]));
+                        input_report_abs(pen_input, ABS_TILT_X, (char)frame[7]);
+                        input_report_abs(pen_input, ABS_TILT_Y, (char)frame[8]);
+                        input_report_abs(pen_input, ABS_Z, rotation);
                         input_report_abs(pen_input, ABS_WHEEL, get_unaligned_le16(&frame[11]));
                 }
                 input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
@@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
 
         int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01);
-        int ring = data[285];
-        int prox = buttons | (ring & 0x80);
+        int ring = data[285] & 0x7F;
+        bool ringstatus = data[285] & 0x80;
+        bool prox = buttons || ringstatus;
+
+        /* Fix touchring data: userspace expects 0 at left and increasing clockwise */
+        ring = 71 - ring;
+        ring += 3*72/16;
+        if (ring > 71)
+                ring -= 72;
 
         wacom_report_numbered_buttons(pad_input, 9, buttons);
 
-        input_report_abs(pad_input, ABS_WHEEL, (ring & 0x80) ? (ring & 0x7f) : 0);
+        input_report_abs(pad_input, ABS_WHEEL, ringstatus ? ring : 0);
 
         input_report_key(pad_input, wacom->tool[1], prox ? 1 : 0);
         input_report_abs(pad_input, ABS_MISC, prox ? PAD_DEVICE_ID : 0);
@@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
         return 0;
 }
 
+static int wacom_offset_rotation(struct input_dev *input, struct hid_usage *usage,
+                                 int value, int num, int denom)
+{
+        struct input_absinfo *abs = &input->absinfo[usage->code];
+        int range = (abs->maximum - abs->minimum + 1);
+
+        value += num*range/denom;
+        if (value > abs->maximum)
+                value -= range;
+        else if (value < abs->minimum)
+                value += range;
+        return value;
+}
+
 int wacom_equivalent_usage(int usage)
 {
         if ((usage & HID_USAGE_PAGE) == WACOM_HID_UP_WACOMDIGITIZER) {
@@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
         int i;
         bool is_touch_on = value;
+        bool do_report = false;
 
         /*
          * Avoid reporting this event and setting inrange_state if this usage
@@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         }
 
         switch (equivalent_usage) {
+        case WACOM_HID_WD_TOUCHRING:
+                /*
+                 * Userspace expects touchrings to increase in value with
+                 * clockwise gestures and have their zero point at the
+                 * tablet's left. HID events "should" be clockwise-
+                 * increasing and zero at top, though the MobileStudio
+                 * Pro and 2nd-gen Intuos Pro don't do this...
+                 */
+                if (hdev->vendor == 0x56a &&
+                    (hdev->product == 0x34d || hdev->product == 0x34e ||  /* MobileStudio Pro */
+                     hdev->product == 0x357 || hdev->product == 0x358)) { /* Intuos Pro 2 */
+                        value = (field->logical_maximum - value);
+
+                        if (hdev->product == 0x357 || hdev->product == 0x358)
+                                value = wacom_offset_rotation(input, usage, value, 3, 16);
+                        else if (hdev->product == 0x34d || hdev->product == 0x34e)
+                                value = wacom_offset_rotation(input, usage, value, 1, 2);
+                }
+                else {
+                        value = wacom_offset_rotation(input, usage, value, 1, 4);
+                }
+                do_report = true;
+                break;
         case WACOM_HID_WD_TOUCHRINGSTATUS:
                 if (!value)
                         input_event(input, usage->type, usage->code, 0);
@@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
                                          value, i);
                  /* fall through*/
         default:
+                do_report = true;
+                break;
+        }
+
+        if (do_report) {
                 input_event(input, usage->type, usage->code, value);
                 if (value)
                         wacom_wac->hid_data.pad_input_event_flag = true;
-                break;
         }
 }
 
@@ -2086,22 +2141,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 wacom_wac->hid_data.tipswitch |= value;
                 return;
         case HID_DG_TOOLSERIALNUMBER:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= (__u32)value;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+                        wacom_wac->serial[0] |= (__u32)value;
+                }
                 return;
+        case HID_DG_TWIST:
+                /*
+                 * Userspace expects pen twist to have its zero point when
+                 * the buttons/finger is on the tablet's left. HID values
+                 * are zero when buttons are toward the top.
+                 */
+                value = wacom_offset_rotation(input, usage, value, 1, 4);
+                break;
         case WACOM_HID_WD_SENSE:
                 wacom_wac->hid_data.sense_state = value;
                 return;
         case WACOM_HID_WD_SERIALHI:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
-                wacom_wac->serial[0] |= ((__u64)value) << 32;
-                /*
-                 * Non-USI EMR devices may contain additional tool type
-                 * information here. See WACOM_HID_WD_TOOLTYPE case for
-                 * more details.
-                 */
-                if (value >> 20 == 1) {
-                        wacom_wac->id[0] |= value & 0xFFFFF;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
+                        wacom_wac->serial[0] |= ((__u64)value) << 32;
+                        /*
+                         * Non-USI EMR devices may contain additional tool type
+                         * information here. See WACOM_HID_WD_TOOLTYPE case for
+                         * more details.
+                         */
+                        if (value >> 20 == 1) {
+                                wacom_wac->id[0] |= value & 0xFFFFF;
+                        }
                 }
                 return;
         case WACOM_HID_WD_TOOLTYPE:
@@ -2205,7 +2272,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
                 input_report_key(input, wacom_wac->tool[0], prox);
                 if (wacom_wac->serial[0]) {
                         input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
-                        input_report_abs(input, ABS_MISC, id);
+                        input_report_abs(input, ABS_MISC, prox ? id : 0);
                 }
 
                 wacom_wac->hid_data.tipswitch = false;
@@ -2216,6 +2283,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
         if (!prox) {
                 wacom_wac->tool[0] = 0;
                 wacom_wac->id[0] = 0;
+                wacom_wac->serial[0] = 0;
         }
 }
 
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index efd5db743319..894b67ac2cae 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -640,6 +640,7 @@ void vmbus_close(struct vmbus_channel *channel)
                  */
                 return;
         }
+        mutex_lock(&vmbus_connection.channel_mutex);
         /*
          * Close all the sub-channels first and then close the
          * primary channel.
@@ -648,16 +649,15 @@ void vmbus_close(struct vmbus_channel *channel)
                 cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
                 vmbus_close_internal(cur_channel);
                 if (cur_channel->rescind) {
-                        mutex_lock(&vmbus_connection.channel_mutex);
-                        hv_process_channel_removal(cur_channel,
+                        hv_process_channel_removal(
                                            cur_channel->offermsg.child_relid);
-                        mutex_unlock(&vmbus_connection.channel_mutex);
                 }
         }
         /*
          * Now close the primary.
          */
         vmbus_close_internal(channel);
+        mutex_unlock(&vmbus_connection.channel_mutex);
 }
 EXPORT_SYMBOL_GPL(vmbus_close);
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 060df71c2e8b..379b0df123be 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -159,7 +159,7 @@ static void vmbus_rescind_cleanup(struct vmbus_channel *channel)
 
 
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
-
+        channel->rescind = true;
         list_for_each_entry(msginfo, &vmbus_connection.chn_msg_list,
                                 msglistentry) {
 
@@ -381,14 +381,21 @@ static void vmbus_release_relid(u32 relid)
                        true);
 }
 
-void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
+void hv_process_channel_removal(u32 relid)
 {
         unsigned long flags;
-        struct vmbus_channel *primary_channel;
+        struct vmbus_channel *primary_channel, *channel;
 
-        BUG_ON(!channel->rescind);
         BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
 
+        /*
+         * Make sure channel is valid as we may have raced.
+         */
+        channel = relid2channel(relid);
+        if (!channel)
+                return;
+
+        BUG_ON(!channel->rescind);
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(channel->target_cpu,
@@ -515,6 +522,7 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
         if (!fnew) {
                 if (channel->sc_creation_callback != NULL)
                         channel->sc_creation_callback(newchannel);
+                newchannel->probe_done = true;
                 return;
         }
 
@@ -834,7 +842,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 {
         struct vmbus_channel_rescind_offer *rescind;
         struct vmbus_channel *channel;
-        unsigned long flags;
         struct device *dev;
 
         rescind = (struct vmbus_channel_rescind_offer *)hdr;
@@ -873,16 +880,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                 return;
         }
 
-        spin_lock_irqsave(&channel->lock, flags);
-        channel->rescind = true;
-        spin_unlock_irqrestore(&channel->lock, flags);
-
-        /*
-         * Now that we have posted the rescind state, perform
-         * rescind related cleanup.
-         */
-        vmbus_rescind_cleanup(channel);
-
         /*
          * Now wait for offer handling to complete.
          */
@@ -901,6 +898,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
         if (channel->device_obj) {
                 if (channel->chn_rescind_callback) {
                         channel->chn_rescind_callback(channel);
+                        vmbus_rescind_cleanup(channel);
                         return;
                 }
                 /*
@@ -909,6 +907,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                  */
                 dev = get_device(&channel->device_obj->device);
                 if (dev) {
+                        vmbus_rescind_cleanup(channel);
                         vmbus_device_unregister(channel->device_obj);
                         put_device(dev);
                 }
@@ -921,29 +920,28 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                  * 1. Close all sub-channels first
                  * 2. Then close the primary channel.
                  */
+                mutex_lock(&vmbus_connection.channel_mutex);
+                vmbus_rescind_cleanup(channel);
                 if (channel->state == CHANNEL_OPEN_STATE) {
                         /*
                          * The channel is currently not open;
                          * it is safe for us to cleanup the channel.
                          */
-                        mutex_lock(&vmbus_connection.channel_mutex);
-                        hv_process_channel_removal(channel,
-                                                channel->offermsg.child_relid);
-                        mutex_unlock(&vmbus_connection.channel_mutex);
+                        hv_process_channel_removal(rescind->child_relid);
                 }
+                mutex_unlock(&vmbus_connection.channel_mutex);
         }
 }
 
 void vmbus_hvsock_device_unregister(struct vmbus_channel *channel)
 {
-        mutex_lock(&vmbus_connection.channel_mutex);
-
         BUG_ON(!is_hvsock_channel(channel));
 
-        channel->rescind = true;
-        vmbus_device_unregister(channel->device_obj);
+        /* We always get a rescind msg when a connection is closed. */
+        while (!READ_ONCE(channel->probe_done) || !READ_ONCE(channel->rescind))
+                msleep(1);
 
-        mutex_unlock(&vmbus_connection.channel_mutex);
+        vmbus_device_unregister(channel->device_obj);
 }
 EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister);
 
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index daa75bd41f86..2364281d8593 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy)
                 out_src = smsg_out;
                 break;
 
+        case WRITE_TO_FILE:
+                out_src = fcopy_transaction.fcopy_msg;
+                out_len = sizeof(struct hv_do_fcopy);
+                break;
         default:
                 out_src = fcopy_transaction.fcopy_msg;
                 out_len = fcopy_transaction.recv_len;
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index a9d49f6f6501..937801ac2fe0 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -768,8 +768,7 @@ static void vmbus_device_release(struct device *device)
         struct vmbus_channel *channel = hv_dev->channel;
 
         mutex_lock(&vmbus_connection.channel_mutex);
-        hv_process_channel_removal(channel,
-                                   channel->offermsg.child_relid);
+        hv_process_channel_removal(channel->offermsg.child_relid);
         mutex_unlock(&vmbus_connection.channel_mutex);
         kfree(hv_dev);
 
diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
index 97a62f5b9ea4..a973eb6a2890 100644
--- a/drivers/hwmon/da9052-hwmon.c
+++ b/drivers/hwmon/da9052-hwmon.c
@@ -477,6 +477,11 @@ static int da9052_hwmon_probe(struct platform_device *pdev)
                 /* disable touchscreen features */
                 da9052_reg_write(hwmon->da9052, DA9052_TSI_CONT_A_REG, 0x00);
 
+                /* Sample every 1ms */
+                da9052_reg_update(hwmon->da9052, DA9052_ADC_CONT_REG,
+                                          DA9052_ADCCONT_ADCMODE,
+                                          DA9052_ADCCONT_ADCMODE);
+
                 err = da9052_request_irq(hwmon->da9052, DA9052_IRQ_TSIREADY,
                                          "tsiready-irq", da9052_tsi_datardy_irq,
                                          hwmon);
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index 5eafbaada795..dfc40c740d07 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -268,14 +268,11 @@ static int tmp102_probe(struct i2c_client *client,
                 return err;
         }
 
-        tmp102->ready_time = jiffies;
-        if (tmp102->config_orig & TMP102_CONF_SD) {
-                /*
-                 * Mark that we are not ready with data until the first
-                 * conversion is complete
-                 */
-                tmp102->ready_time += msecs_to_jiffies(CONVERSION_TIME_MS);
-        }
+        /*
+         * Mark that we are not ready with data until the first
+         * conversion is complete
+         */
+        tmp102->ready_time = jiffies + msecs_to_jiffies(CONVERSION_TIME_MS);
 
         hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name,
                                                          tmp102,
diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
index 9c0dbb8191ad..e1be61095532 100644
--- a/drivers/hwmon/xgene-hwmon.c
+++ b/drivers/hwmon/xgene-hwmon.c
@@ -630,7 +630,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                          sizeof(struct slimpro_resp_msg) * ASYNC_MSG_FIFO_SIZE,
                          GFP_KERNEL);
         if (rc)
-                goto out_mbox_free;
+                return -ENOMEM;
 
         INIT_WORK(&ctx->workq, xgene_hwmon_evt_work);
 
@@ -646,7 +646,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "SLIMpro mailbox channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
         } else {
                 struct acpi_pcct_hw_reduced *cppc_ss;
@@ -654,7 +655,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (device_property_read_u32(&pdev->dev, "pcc-channel",
                                              &ctx->mbox_idx)) {
                         dev_err(&pdev->dev, "no pcc-channel property\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 cl->rx_callback = xgene_hwmon_pcc_rx_cb;
@@ -662,7 +664,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "PPC channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 /*
@@ -675,13 +678,13 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (!cppc_ss) {
                         dev_err(&pdev->dev, "PPC subspace not found\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->mbox_chan->mbox->txdone_irq) {
                         dev_err(&pdev->dev, "PCC IRQ not supported\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
@@ -696,14 +699,14 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 } else {
                         dev_err(&pdev->dev, "Failed to get PCC comm region\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->pcc_comm_addr) {
                         dev_err(&pdev->dev,
                                 "Failed to ioremap PCC comm region\n");
                         rc = -ENOMEM;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index bc9cebc30526..c2a2ce8ee541 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -144,6 +144,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 .driver_data = (kernel_ulong_t)0,
         },
         {
+                /* Lewisburg PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
                 /* Gemini Lake */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -158,6 +163,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
         },
+        {
+                /* Cedar Fork PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
         { 0 },
 };
 
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575d8..f129869e05a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
 
         stm_source_link_drop(src);
 
-        device_destroy(&stm_source_class, src->dev.devt);
+        device_unregister(&src->dev);
 }
 EXPORT_SYMBOL_GPL(stm_source_unregister_device);
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c06dce2c1da7..45a3f3ca29b3 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -131,6 +131,7 @@ config I2C_I801
             Gemini Lake (SOC)
             Cannon Lake-H (PCH)
             Cannon Lake-LP (PCH)
+            Cedar Fork (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index e114e4e00d29..9e12a53ef7b8 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -68,6 +68,7 @@
  * Gemini Lake (SOC)            0x31d4  32      hard    yes     yes     yes
  * Cannon Lake-H (PCH)          0xa323  32      hard    yes     yes     yes
  * Cannon Lake-LP (PCH)         0x9da3  32      hard    yes     yes     yes
+ * Cedar Fork (PCH)             0x18df  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -204,6 +205,7 @@
 
 /* Older devices have their ID defined in <linux/pci_ids.h> */
 #define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS              0x0f12
+#define PCI_DEVICE_ID_INTEL_CDF_SMBUS                   0x18df
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS           0x1c22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS              0x1d22
@@ -1025,6 +1027,7 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CDF_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
@@ -1513,6 +1516,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         case PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS:
+        case PCI_DEVICE_ID_INTEL_CDF_SMBUS:
         case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
         case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
                 priv->features |= FEATURE_I2C_BLOCK_READ;
diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
index 84fb35f6837f..eb1d91b986fd 100644
--- a/drivers/i2c/busses/i2c-img-scb.c
+++ b/drivers/i2c/busses/i2c-img-scb.c
@@ -1459,6 +1459,6 @@ static struct platform_driver img_scb_i2c_driver = {
 };
 module_platform_driver(img_scb_i2c_driver);
 
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("IMG host I2C driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 54a47b40546f..f96830ffd9f1 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1021,7 +1021,7 @@ static int i2c_imx_init_recovery_info(struct imx_i2c_struct *i2c_imx,
         }
 
         dev_dbg(&pdev->dev, "using scl-gpio %d and sda-gpio %d for recovery\n",
-                        rinfo->sda_gpio, rinfo->scl_gpio);
+                        rinfo->scl_gpio, rinfo->sda_gpio);
 
         rinfo->prepare_recovery = i2c_imx_prepare_recovery;
         rinfo->unprepare_recovery = i2c_imx_unprepare_recovery;
@@ -1100,7 +1100,7 @@ static int i2c_imx_probe(struct platform_device *pdev)
         }
 
         /* Request IRQ */
-        ret = devm_request_irq(&pdev->dev, irq, i2c_imx_isr, 0,
+        ret = devm_request_irq(&pdev->dev, irq, i2c_imx_isr, IRQF_SHARED,
                                 pdev->name, i2c_imx);
         if (ret) {
                 dev_err(&pdev->dev, "can't claim irq %d\n", irq);
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 22ffcb73c185..b51adffa4841 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -340,12 +340,15 @@ static int ismt_process_desc(const struct ismt_desc *desc,
                         data->word = dma_buffer[0] | (dma_buffer[1] << 8);
                         break;
                 case I2C_SMBUS_BLOCK_DATA:
-                case I2C_SMBUS_I2C_BLOCK_DATA:
                         if (desc->rxbytes != dma_buffer[0] + 1)
                                 return -EMSGSIZE;
 
                         memcpy(data->block, dma_buffer, desc->rxbytes);
                         break;
+                case I2C_SMBUS_I2C_BLOCK_DATA:
+                        memcpy(&data->block[1], dma_buffer, desc->rxbytes);
+                        data->block[0] = desc->rxbytes;
+                        break;
                 }
                 return 0;
         }
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 1ebb5e947e0b..23c2ea2baedc 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -360,6 +360,7 @@ static int omap_i2c_init(struct omap_i2c_dev *omap)
         unsigned long fclk_rate = 12000000;
         unsigned long internal_clk = 0;
         struct clk *fclk;
+        int error;
 
         if (omap->rev >= OMAP_I2C_REV_ON_3430_3530) {
                 /*
@@ -378,6 +379,13 @@ static int omap_i2c_init(struct omap_i2c_dev *omap)
                  * do this bit unconditionally.
                  */
                 fclk = clk_get(omap->dev, "fck");
+                if (IS_ERR(fclk)) {
+                        error = PTR_ERR(fclk);
+                        dev_err(omap->dev, "could not get fck: %i\n", error);
+
+                        return error;
+                }
+
                 fclk_rate = clk_get_rate(fclk);
                 clk_put(fclk);
 
@@ -410,6 +418,12 @@ static int omap_i2c_init(struct omap_i2c_dev *omap)
                 else
                         internal_clk = 4000;
                 fclk = clk_get(omap->dev, "fck");
+                if (IS_ERR(fclk)) {
+                        error = PTR_ERR(fclk);
+                        dev_err(omap->dev, "could not get fck: %i\n", error);
+
+                        return error;
+                }
                 fclk_rate = clk_get_rate(fclk) / 1000;
                 clk_put(fclk);
 
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 0ecdb47a23ab..174579d32e5f 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -85,6 +85,9 @@
 /* SB800 constants */
 #define SB800_PIIX4_SMB_IDX             0xcd6
 
+#define KERNCZ_IMC_IDX                  0x3e
+#define KERNCZ_IMC_DATA                 0x3f
+
 /*
  * SB800 port is selected by bits 2:1 of the smb_en register (0x2c)
  * or the smb_sel register (0x2e), depending on bit 0 of register 0x2f.
@@ -94,6 +97,12 @@
 #define SB800_PIIX4_PORT_IDX_ALT        0x2e
 #define SB800_PIIX4_PORT_IDX_SEL        0x2f
 #define SB800_PIIX4_PORT_IDX_MASK       0x06
+#define SB800_PIIX4_PORT_IDX_SHIFT      1
+
+/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+#define SB800_PIIX4_PORT_IDX_KERNCZ             0x02
+#define SB800_PIIX4_PORT_IDX_MASK_KERNCZ        0x18
+#define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ       3
 
 /* insmod parameters */
 
@@ -149,6 +158,8 @@ static const struct dmi_system_id piix4_dmi_ibm[] = {
  */
 static DEFINE_MUTEX(piix4_mutex_sb800);
 static u8 piix4_port_sel_sb800;
+static u8 piix4_port_mask_sb800;
+static u8 piix4_port_shift_sb800;
 static const char *piix4_main_port_names_sb800[PIIX4_MAX_ADAPTERS] = {
         " port 0", " port 2", " port 3", " port 4"
 };
@@ -159,6 +170,7 @@ struct i2c_piix4_adapdata {
 
         /* SB800 */
         bool sb800_main;
+        bool notify_imc;
         u8 port;                /* Port number, shifted */
 };
 
@@ -347,7 +359,19 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
 
         /* Find which register is used for port selection */
         if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD) {
-                piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
+                switch (PIIX4_dev->device) {
+                case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
+                        piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
+                        piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
+                        piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
+                        break;
+                case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
+                default:
+                        piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
+                        piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
+                        piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
+                        break;
+                }
         } else {
                 mutex_lock(&piix4_mutex_sb800);
                 outb_p(SB800_PIIX4_PORT_IDX_SEL, SB800_PIIX4_SMB_IDX);
@@ -355,6 +379,8 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
                 piix4_port_sel_sb800 = (port_sel & 0x01) ?
                                        SB800_PIIX4_PORT_IDX_ALT :
                                        SB800_PIIX4_PORT_IDX;
+                piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
+                piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
                 mutex_unlock(&piix4_mutex_sb800);
         }
 
@@ -572,6 +598,67 @@ static s32 piix4_access(struct i2c_adapter * adap, u16 addr,
         return 0;
 }
 
+static uint8_t piix4_imc_read(uint8_t idx)
+{
+        outb_p(idx, KERNCZ_IMC_IDX);
+        return inb_p(KERNCZ_IMC_DATA);
+}
+
+static void piix4_imc_write(uint8_t idx, uint8_t value)
+{
+        outb_p(idx, KERNCZ_IMC_IDX);
+        outb_p(value, KERNCZ_IMC_DATA);
+}
+
+static int piix4_imc_sleep(void)
+{
+        int timeout = MAX_TIMEOUT;
+
+        if (!request_muxed_region(KERNCZ_IMC_IDX, 2, "smbus_kerncz_imc"))
+                return -EBUSY;
+
+        /* clear response register */
+        piix4_imc_write(0x82, 0x00);
+        /* request ownership flag */
+        piix4_imc_write(0x83, 0xB4);
+        /* kick off IMC Mailbox command 96 */
+        piix4_imc_write(0x80, 0x96);
+
+        while (timeout--) {
+                if (piix4_imc_read(0x82) == 0xfa) {
+                        release_region(KERNCZ_IMC_IDX, 2);
+                        return 0;
+                }
+                usleep_range(1000, 2000);
+        }
+
+        release_region(KERNCZ_IMC_IDX, 2);
+        return -ETIMEDOUT;
+}
+
+static void piix4_imc_wakeup(void)
+{
+        int timeout = MAX_TIMEOUT;
+
+        if (!request_muxed_region(KERNCZ_IMC_IDX, 2, "smbus_kerncz_imc"))
+                return;
+
+        /* clear response register */
+        piix4_imc_write(0x82, 0x00);
+        /* release ownership flag */
+        piix4_imc_write(0x83, 0xB5);
+        /* kick off IMC Mailbox command 96 */
+        piix4_imc_write(0x80, 0x96);
+
+        while (timeout--) {
+                if (piix4_imc_read(0x82) == 0xfa)
+                        break;
+                usleep_range(1000, 2000);
+        }
+
+        release_region(KERNCZ_IMC_IDX, 2);
+}
+
 /*
  * Handles access to multiple SMBus ports on the SB800.
  * The port is selected by bits 2:1 of the smb_en register (0x2c).
@@ -612,12 +699,47 @@ static s32 piix4_access_sb800(struct i2c_adapter *adap, u16 addr,
                 return -EBUSY;
         }
 
+        /*
+         * Notify the IMC (Integrated Micro Controller) if required.
+         * Among other responsibilities, the IMC is in charge of monitoring
+         * the System fans and temperature sensors, and act accordingly.
+         * All this is done through SMBus and can/will collide
+         * with our transactions if they are long (BLOCK_DATA).
+         * Therefore we need to request the ownership flag during those
+         * transactions.
+         */
+        if ((size == I2C_SMBUS_BLOCK_DATA) && adapdata->notify_imc) {
+                int ret;
+
+                ret = piix4_imc_sleep();
+                switch (ret) {
+                case -EBUSY:
+                        dev_warn(&adap->dev,
+                                 "IMC base address index region 0x%x already in use.\n",
+                                 KERNCZ_IMC_IDX);
+                        break;
+                case -ETIMEDOUT:
+                        dev_warn(&adap->dev,
+                                 "Failed to communicate with the IMC.\n");
+                        break;
+                default:
+                        break;
+                }
+
+                /* If IMC communication fails do not retry */
+                if (ret) {
+                        dev_warn(&adap->dev,
+                                 "Continuing without IMC notification.\n");
+                        adapdata->notify_imc = false;
+                }
+        }
+
         outb_p(piix4_port_sel_sb800, SB800_PIIX4_SMB_IDX);
         smba_en_lo = inb_p(SB800_PIIX4_SMB_IDX + 1);
 
         port = adapdata->port;
-        if ((smba_en_lo & SB800_PIIX4_PORT_IDX_MASK) != port)
-                outb_p((smba_en_lo & ~SB800_PIIX4_PORT_IDX_MASK) | port,
+        if ((smba_en_lo & piix4_port_mask_sb800) != port)
+                outb_p((smba_en_lo & ~piix4_port_mask_sb800) | port,
                        SB800_PIIX4_SMB_IDX + 1);
 
         retval = piix4_access(adap, addr, flags, read_write,
@@ -628,6 +750,9 @@ static s32 piix4_access_sb800(struct i2c_adapter *adap, u16 addr,
         /* Release the semaphore */
         outb_p(smbslvcnt | 0x20, SMBSLVCNT);
 
+        if ((size == I2C_SMBUS_BLOCK_DATA) && adapdata->notify_imc)
+                piix4_imc_wakeup();
+
         mutex_unlock(&piix4_mutex_sb800);
 
         return retval;
@@ -679,7 +804,7 @@ static struct i2c_adapter *piix4_main_adapters[PIIX4_MAX_ADAPTERS];
 static struct i2c_adapter *piix4_aux_adapter;
 
 static int piix4_add_adapter(struct pci_dev *dev, unsigned short smba,
-                             bool sb800_main, u8 port,
+                             bool sb800_main, u8 port, bool notify_imc,
                              const char *name, struct i2c_adapter **padap)
 {
         struct i2c_adapter *adap;
@@ -706,7 +831,8 @@ static int piix4_add_adapter(struct pci_dev *dev, unsigned short smba,
 
         adapdata->smba = smba;
         adapdata->sb800_main = sb800_main;
-        adapdata->port = port << 1;
+        adapdata->port = port << piix4_port_shift_sb800;
+        adapdata->notify_imc = notify_imc;
 
         /* set up the sysfs linkage to our parent device */
         adap->dev.parent = &dev->dev;
@@ -728,14 +854,15 @@ static int piix4_add_adapter(struct pci_dev *dev, unsigned short smba,
         return 0;
 }
 
-static int piix4_add_adapters_sb800(struct pci_dev *dev, unsigned short smba)
+static int piix4_add_adapters_sb800(struct pci_dev *dev, unsigned short smba,
+                                    bool notify_imc)
 {
         struct i2c_piix4_adapdata *adapdata;
         int port;
         int retval;
 
         for (port = 0; port < PIIX4_MAX_ADAPTERS; port++) {
-                retval = piix4_add_adapter(dev, smba, true, port,
+                retval = piix4_add_adapter(dev, smba, true, port, notify_imc,
                                            piix4_main_port_names_sb800[port],
                                            &piix4_main_adapters[port]);
                 if (retval < 0)
@@ -769,6 +896,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
              dev->device == PCI_DEVICE_ID_ATI_SBX00_SMBUS &&
              dev->revision >= 0x40) ||
             dev->vendor == PCI_VENDOR_ID_AMD) {
+                bool notify_imc = false;
                 is_sb800 = true;
 
                 if (!request_region(SB800_PIIX4_SMB_IDX, 2, "smba_idx")) {
@@ -778,6 +906,20 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         return -EBUSY;
                 }
 
+                if (dev->vendor == PCI_VENDOR_ID_AMD &&
+                    dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS) {
+                        u8 imc;
+
+                        /*
+                         * Detect if IMC is active or not, this method is
+                         * described on coreboot's AMD IMC notes
+                         */
+                        pci_bus_read_config_byte(dev->bus, PCI_DEVFN(0x14, 3),
+                                                 0x40, &imc);
+                        if (imc & 0x80)
+                                notify_imc = true;
+                }
+
                 /* base address location etc changed in SB800 */
                 retval = piix4_setup_sb800(dev, id, 0);
                 if (retval < 0) {
@@ -789,7 +931,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
                  * Try to register multiplexed main SMBus adapter,
                  * give up if we can't
                  */
-                retval = piix4_add_adapters_sb800(dev, retval);
+                retval = piix4_add_adapters_sb800(dev, retval, notify_imc);
                 if (retval < 0) {
                         release_region(SB800_PIIX4_SMB_IDX, 2);
                         return retval;
@@ -800,7 +942,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         return retval;
 
                 /* Try to register main SMBus adapter, give up if we can't */
-                retval = piix4_add_adapter(dev, retval, false, 0, "",
+                retval = piix4_add_adapter(dev, retval, false, 0, false, "",
                                            &piix4_main_adapters[0]);
                 if (retval < 0)
                         return retval;
@@ -827,7 +969,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
         if (retval > 0) {
                 /* Try to add the aux adapter if it exists,
                  * piix4_add_adapter will clean up if this fails */
-                piix4_add_adapter(dev, retval, false, 0,
+                piix4_add_adapter(dev, retval, false, 0, false,
                                   is_sb800 ? piix4_aux_port_name_sb800 : "",
                                   &piix4_aux_adapter);
         }
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 22e08ae1704f..25fcc3c1e32b 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -627,6 +627,7 @@ static const struct dev_pm_ops sprd_i2c_pm_ops = {
 
 static const struct of_device_id sprd_i2c_of_match[] = {
         { .compatible = "sprd,sc9860-i2c", },
+        {},
 };
 
 static struct platform_driver sprd_i2c_driver = {
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 47c67b0ca896..d4a6e9c2e9aa 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -215,7 +215,7 @@ struct stm32f7_i2c_dev {
         unsigned int msg_num;
         unsigned int msg_id;
         struct stm32f7_i2c_msg f7_msg;
-        struct stm32f7_i2c_setup *setup;
+        struct stm32f7_i2c_setup setup;
         struct stm32f7_i2c_timings timing;
 };
 
@@ -265,7 +265,7 @@ static struct stm32f7_i2c_spec i2c_specs[] = {
         },
 };
 
-struct stm32f7_i2c_setup stm32f7_setup = {
+static const struct stm32f7_i2c_setup stm32f7_setup = {
         .rise_time = STM32F7_I2C_RISE_TIME_DEFAULT,
         .fall_time = STM32F7_I2C_FALL_TIME_DEFAULT,
         .dnf = STM32F7_I2C_DNF_DEFAULT,
@@ -537,7 +537,7 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
         writel_relaxed(timing, i2c_dev->base + STM32F7_I2C_TIMINGR);
 
         /* Enable I2C */
-        if (i2c_dev->setup->analog_filter)
+        if (i2c_dev->setup.analog_filter)
                 stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
                                      STM32F7_I2C_CR1_ANFOFF);
         else
@@ -887,22 +887,19 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
         }
 
         setup = of_device_get_match_data(&pdev->dev);
-        i2c_dev->setup->rise_time = setup->rise_time;
-        i2c_dev->setup->fall_time = setup->fall_time;
-        i2c_dev->setup->dnf = setup->dnf;
-        i2c_dev->setup->analog_filter = setup->analog_filter;
+        i2c_dev->setup = *setup;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
                                        &rise_time);
         if (!ret)
-                i2c_dev->setup->rise_time = rise_time;
+                i2c_dev->setup.rise_time = rise_time;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-falling-time-ns",
                                        &fall_time);
         if (!ret)
-                i2c_dev->setup->fall_time = fall_time;
+                i2c_dev->setup.fall_time = fall_time;
 
-        ret = stm32f7_i2c_setup_timing(i2c_dev, i2c_dev->setup);
+        ret = stm32f7_i2c_setup_timing(i2c_dev, &i2c_dev->setup);
         if (ret)
                 goto clk_free;
 
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 81e18f9628d0..a7355ab3bb22 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1328,6 +1328,7 @@ static int ide_cdrom_prep_fs(struct request_queue *q, struct request *rq)
         unsigned long blocks = blk_rq_sectors(rq) / (hard_sect >> 9);
         struct scsi_request *req = scsi_req(rq);
 
+        scsi_req_init(req);
         memset(req->cmd, 0, BLK_MAX_CDB);
 
         if (rq_data_dir(rq) == READ)
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 01b2adfd8226..eaf39e5db08b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1451,6 +1451,7 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif_init(hwif) == 0) {
                         printk(KERN_INFO "%s: failed to initialize IDE "
                                          "interface\n", hwif->name);
+                        device_unregister(hwif->portdev);
                         device_unregister(&hwif->gendev);
                         ide_disable_port(hwif);
                         continue;
diff --git a/drivers/ide/ide-scan-pci.c b/drivers/ide/ide-scan-pci.c
index 86aa88aeb3a6..acf874800ca4 100644
--- a/drivers/ide/ide-scan-pci.c
+++ b/drivers/ide/ide-scan-pci.c
@@ -56,6 +56,7 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
 {
         struct list_head *l;
         struct pci_driver *d;
+        int ret;
 
         list_for_each(l, &ide_pci_drivers) {
                 d = list_entry(l, struct pci_driver, node);
@@ -63,10 +64,14 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
                         const struct pci_device_id *id =
                                 pci_match_id(d->id_table, dev);
 
-                        if (id != NULL && d->probe(dev, id) >= 0) {
-                                dev->driver = d;
-                                pci_dev_get(dev);
-                                return 1;
+                        if (id != NULL) {
+                                pci_assign_irq(dev);
+                                ret = d->probe(dev, id);
+                                if (ret >= 0) {
+                                        dev->driver = d;
+                                        pci_dev_get(dev);
+                                        return 1;
+                                }
                         }
                 }
         }
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 112d2fe1bcdb..fdc8e813170c 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -179,6 +179,7 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
 /**
  *      ide_pci_enable  -       do PCI enables
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *
  *      Enable the IDE PCI device. We attempt to enable the device in full
@@ -189,9 +190,10 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
  *      Returns zero on success or an error code
  */
 
-static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
+static int ide_pci_enable(struct pci_dev *dev, int bars,
+                          const struct ide_port_info *d)
 {
-        int ret, bars;
+        int ret;
 
         if (pci_enable_device(dev)) {
                 ret = pci_enable_device_io(dev);
@@ -216,18 +218,6 @@ static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
                 goto out;
         }
 
-        if (d->host_flags & IDE_HFLAG_SINGLE)
-                bars = (1 << 2) - 1;
-        else
-                bars = (1 << 4) - 1;
-
-        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
-                if (d->host_flags & IDE_HFLAG_CS5520)
-                        bars |= (1 << 2);
-                else
-                        bars |= (1 << 4);
-        }
-
         ret = pci_request_selected_regions(dev, bars, d->name);
         if (ret < 0)
                 printk(KERN_ERR "%s %s: can't reserve resources\n",
@@ -403,6 +393,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
 /**
  *      ide_setup_pci_controller        -       set up IDE PCI
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *      @noisy: verbose flag
  *
@@ -411,7 +402,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
  *      and enables it if need be
  */
 
-static int ide_setup_pci_controller(struct pci_dev *dev,
+static int ide_setup_pci_controller(struct pci_dev *dev, int bars,
                                     const struct ide_port_info *d, int noisy)
 {
         int ret;
@@ -420,7 +411,7 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (noisy)
                 ide_setup_pci_noise(dev, d);
 
-        ret = ide_pci_enable(dev, d);
+        ret = ide_pci_enable(dev, bars, d);
         if (ret < 0)
                 goto out;
 
@@ -428,16 +419,20 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (ret < 0) {
                 printk(KERN_ERR "%s %s: error accessing PCI regs\n",
                         d->name, pci_name(dev));
-                goto out;
+                goto out_free_bars;
         }
         if (!(pcicmd & PCI_COMMAND_IO)) {       /* is device disabled? */
                 ret = ide_pci_configure(dev, d);
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
                 printk(KERN_INFO "%s %s: device enabled (Linux)\n",
                         d->name, pci_name(dev));
         }
 
+        goto out;
+
+out_free_bars:
+        pci_release_selected_regions(dev, bars);
 out:
         return ret;
 }
@@ -540,13 +535,28 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
 {
         struct pci_dev *pdev[] = { dev1, dev2 };
         struct ide_host *host;
-        int ret, i, n_ports = dev2 ? 4 : 2;
+        int ret, i, n_ports = dev2 ? 4 : 2, bars;
         struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
 
+        if (d->host_flags & IDE_HFLAG_SINGLE)
+                bars = (1 << 2) - 1;
+        else
+                bars = (1 << 4) - 1;
+
+        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
+                if (d->host_flags & IDE_HFLAG_CS5520)
+                        bars |= (1 << 2);
+                else
+                        bars |= (1 << 4);
+        }
+
         for (i = 0; i < n_ports / 2; i++) {
-                ret = ide_setup_pci_controller(pdev[i], d, !i);
-                if (ret < 0)
+                ret = ide_setup_pci_controller(pdev[i], bars, d, !i);
+                if (ret < 0) {
+                        if (i == 1)
+                                pci_release_selected_regions(pdev[0], bars);
                         goto out;
+                }
 
                 ide_pci_setup_ports(pdev[i], d, &hw[i*2], &hws[i*2]);
         }
@@ -554,7 +564,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         host = ide_host_alloc(d, hws, n_ports);
         if (host == NULL) {
                 ret = -ENOMEM;
-                goto out;
+                goto out_free_bars;
         }
 
         host->dev[0] = &dev1->dev;
@@ -576,7 +586,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
                  * do_ide_setup_pci_device() on the first device!
                  */
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
 
                 /* fixup IRQ */
                 if (ide_pci_is_in_compatibility_mode(pdev[i])) {
@@ -589,6 +599,13 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         ret = ide_host_register(host, d, hws);
         if (ret)
                 ide_host_free(host);
+        else
+                goto out;
+
+out_free_bars:
+        i = n_ports / 2;
+        while (i--)
+                pci_release_selected_regions(pdev[i], bars);
 out:
         return ret;
 }
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 57625653fcb6..1d13bf03c758 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -243,6 +243,8 @@ config DA9150_GPADC
 config DLN2_ADC
         tristate "Diolan DLN-2 ADC driver support"
         depends on MFD_DLN2
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to build support for Diolan DLN-2 ADC.
 
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index e6706a09e100..47c3d7f32900 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
         unsigned int vref_mv)
 {
         struct ad7793_state *st = iio_priv(indio_dev);
-        int i, ret = -1;
+        int i, ret;
         unsigned long long scale_uv;
         u32 id;
 
@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
                 return ret;
 
         /* reset the serial interface */
-        ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret));
+        ret = ad_sd_reset(&st->sd, 32);
         if (ret < 0)
                 goto out;
         usleep_range(500, 2000); /* Wait for at least 500us */
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index d10bd0c97233..22c4c17cd996 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -177,6 +177,34 @@ out:
 }
 EXPORT_SYMBOL_GPL(ad_sd_read_reg);
 
+/**
+ * ad_sd_reset() - Reset the serial interface
+ *
+ * @sigma_delta: The sigma delta device
+ * @reset_length: Number of SCLKs with DIN = 1
+ *
+ * Returns 0 on success, an error code otherwise.
+ **/
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length)
+{
+        uint8_t *buf;
+        unsigned int size;
+        int ret;
+
+        size = DIV_ROUND_UP(reset_length, 8);
+        buf = kcalloc(size, sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memset(buf, 0xff, size);
+        ret = spi_write(sigma_delta->spi, buf, size);
+        kfree(buf);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ad_sd_reset);
+
 static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
         unsigned int mode, unsigned int channel)
 {
diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
index bc5b38e3a147..a70ef7fec95f 100644
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -225,6 +225,7 @@ struct at91_adc_trigger {
         char                            *name;
         unsigned int                    trgmod_value;
         unsigned int                    edge_type;
+        bool                            hw_trig;
 };
 
 struct at91_adc_state {
@@ -254,16 +255,25 @@ static const struct at91_adc_trigger at91_adc_trigger_list[] = {
                 .name = "external_rising",
                 .trgmod_value = AT91_SAMA5D2_TRGR_TRGMOD_EXT_TRIG_RISE,
                 .edge_type = IRQ_TYPE_EDGE_RISING,
+                .hw_trig = true,
         },
         {
                 .name = "external_falling",
                 .trgmod_value = AT91_SAMA5D2_TRGR_TRGMOD_EXT_TRIG_FALL,
                 .edge_type = IRQ_TYPE_EDGE_FALLING,
+                .hw_trig = true,
         },
         {
                 .name = "external_any",
                 .trgmod_value = AT91_SAMA5D2_TRGR_TRGMOD_EXT_TRIG_ANY,
                 .edge_type = IRQ_TYPE_EDGE_BOTH,
+                .hw_trig = true,
+        },
+        {
+                .name = "software",
+                .trgmod_value = AT91_SAMA5D2_TRGR_TRGMOD_NO_TRIGGER,
+                .edge_type = IRQ_TYPE_NONE,
+                .hw_trig = false,
         },
 };
 
@@ -597,7 +607,7 @@ static int at91_adc_probe(struct platform_device *pdev)
         struct at91_adc_state *st;
         struct resource *res;
         int ret, i;
-        u32 edge_type;
+        u32 edge_type = IRQ_TYPE_NONE;
 
         indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*st));
         if (!indio_dev)
@@ -641,14 +651,14 @@ static int at91_adc_probe(struct platform_device *pdev)
         ret = of_property_read_u32(pdev->dev.of_node,
                                    "atmel,trigger-edge-type", &edge_type);
         if (ret) {
-                dev_err(&pdev->dev,
-                        "invalid or missing value for atmel,trigger-edge-type\n");
-                return ret;
+                dev_dbg(&pdev->dev,
+                        "atmel,trigger-edge-type not specified, only software trigger available\n");
         }
 
         st->selected_trig = NULL;
 
-        for (i = 0; i < AT91_SAMA5D2_HW_TRIG_CNT; i++)
+        /* find the right trigger, or no trigger at all */
+        for (i = 0; i < AT91_SAMA5D2_HW_TRIG_CNT + 1; i++)
                 if (at91_adc_trigger_list[i].edge_type == edge_type) {
                         st->selected_trig = &at91_adc_trigger_list[i];
                         break;
@@ -717,24 +727,27 @@ static int at91_adc_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, indio_dev);
 
-        ret = at91_adc_buffer_init(indio_dev);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "couldn't initialize the buffer.\n");
-                goto per_clk_disable_unprepare;
-        }
+        if (st->selected_trig->hw_trig) {
+                ret = at91_adc_buffer_init(indio_dev);
+                if (ret < 0) {
+                        dev_err(&pdev->dev, "couldn't initialize the buffer.\n");
+                        goto per_clk_disable_unprepare;
+                }
 
-        ret = at91_adc_trigger_init(indio_dev);
-        if (ret < 0) {
-                dev_err(&pdev->dev, "couldn't setup the triggers.\n");
-                goto per_clk_disable_unprepare;
+                ret = at91_adc_trigger_init(indio_dev);
+                if (ret < 0) {
+                        dev_err(&pdev->dev, "couldn't setup the triggers.\n");
+                        goto per_clk_disable_unprepare;
+                }
         }
 
         ret = iio_device_register(indio_dev);
         if (ret < 0)
                 goto per_clk_disable_unprepare;
 
-        dev_info(&pdev->dev, "setting up trigger as %s\n",
-                 st->selected_trig->name);
+        if (st->selected_trig->hw_trig)
+                dev_info(&pdev->dev, "setting up trigger as %s\n",
+                         st->selected_trig->name);
 
         dev_info(&pdev->dev, "version: %x\n",
                  readl_relaxed(st->base + AT91_SAMA5D2_VERSION));
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index 634717ae12f3..071dd23a33d9 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -17,6 +17,8 @@
  * MCP3204
  * MCP3208
  * ------------
+ * 13 bit converter
+ * MCP3301
  *
  * Datasheet can be found here:
  * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf  mcp3001
@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index,
 }
 
 static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
-                                  bool differential, int device_index)
+                                  bool differential, int device_index, int *val)
 {
         int ret;
 
@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
 
         switch (device_index) {
         case mcp3001:
-                return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                return 0;
         case mcp3002:
         case mcp3004:
         case mcp3008:
-                return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                return 0;
         case mcp3201:
-                return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                return 0;
         case mcp3202:
         case mcp3204:
         case mcp3208:
-                return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                return 0;
         case mcp3301:
-                return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12);
+                *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8
+                                    | adc->rx_buf[1], 12);
+                return 0;
         default:
                 return -EINVAL;
         }
@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev,
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 ret = mcp320x_adc_conversion(adc, channel->address,
-                        channel->differential, device_index);
-
+                        channel->differential, device_index, val);
                 if (ret < 0)
                         goto out;
 
-                *val = ret;
                 ret = IIO_VAL_INT;
                 break;
 
@@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi)
         indio_dev->name = spi_get_device_id(spi)->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &mcp320x_info;
+        spi_set_drvdata(spi, indio_dev);
 
         chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data];
         indio_dev->channels = chip_info->channels;
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index e3c15f88075f..4df32cf1650e 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1666,7 +1666,7 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
 
         num_channels = of_property_count_u32_elems(node, "st,adc-channels");
         if (num_channels < 0 ||
-            num_channels >= adc_info->max_channels) {
+            num_channels > adc_info->max_channels) {
                 dev_err(&indio_dev->dev, "Bad st,adc-channels?\n");
                 return num_channels < 0 ? num_channels : -EINVAL;
         }
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index d1210024f6bc..e0dc20488335 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -52,7 +52,7 @@
 
 #define ADS1015_CFG_COMP_QUE_MASK       GENMASK(1, 0)
 #define ADS1015_CFG_COMP_LAT_MASK       BIT(2)
-#define ADS1015_CFG_COMP_POL_MASK       BIT(2)
+#define ADS1015_CFG_COMP_POL_MASK       BIT(3)
 #define ADS1015_CFG_COMP_MODE_MASK      BIT(4)
 #define ADS1015_CFG_DR_MASK     GENMASK(7, 5)
 #define ADS1015_CFG_MOD_MASK    BIT(8)
@@ -1017,10 +1017,12 @@ static int ads1015_probe(struct i2c_client *client,
 
                 switch (irq_trig) {
                 case IRQF_TRIGGER_LOW:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 case IRQF_TRIGGER_HIGH:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 1edd99f0c5e5..e3cfb91bffc6 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -887,21 +887,27 @@ static int twl4030_madc_probe(struct platform_device *pdev)
 
         /* Enable 3v1 bias regulator for MADC[3:6] */
         madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1");
-        if (IS_ERR(madc->usb3v1))
-                return -ENODEV;
+        if (IS_ERR(madc->usb3v1)) {
+                ret = -ENODEV;
+                goto err_i2c;
+        }
 
         ret = regulator_enable(madc->usb3v1);
-        if (ret)
+        if (ret) {
                 dev_err(madc->dev, "could not enable 3v1 bias regulator\n");
+                goto err_i2c;
+        }
 
         ret = iio_device_register(iio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "could not register iio device\n");
-                goto err_i2c;
+                goto err_usb3v1;
         }
 
         return 0;
 
+err_usb3v1:
+        regulator_disable(madc->usb3v1);
 err_i2c:
         twl4030_madc_set_current_generator(madc, 0, 0);
 err_current_generator:
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index d99bb1460fe2..02e833b14db0 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -463,8 +463,17 @@ int st_sensors_set_dataready_irq(struct iio_dev *indio_dev, bool enable)
         u8 drdy_mask;
         struct st_sensor_data *sdata = iio_priv(indio_dev);
 
-        if (!sdata->sensor_settings->drdy_irq.addr)
+        if (!sdata->sensor_settings->drdy_irq.addr) {
+                /*
+                 * there are some devices (e.g. LIS3MDL) where drdy line is
+                 * routed to a given pin and it is not possible to select a
+                 * different one. Take into account irq status register
+                 * to understand if irq trigger can be properly supported
+                 */
+                if (sdata->sensor_settings->drdy_irq.addr_stat_drdy)
+                        sdata->hw_irq_trigger = enable;
                 return 0;
+        }
 
         /* Enable/Disable the interrupt generator 1. */
         if (sdata->sensor_settings->drdy_irq.ig1.en_addr > 0) {
diff --git a/drivers/iio/dummy/iio_simple_dummy_events.c b/drivers/iio/dummy/iio_simple_dummy_events.c
index ed63ffd849f8..7ec2a0bb0807 100644
--- a/drivers/iio/dummy/iio_simple_dummy_events.c
+++ b/drivers/iio/dummy/iio_simple_dummy_events.c
@@ -72,6 +72,7 @@ int iio_simple_dummy_write_event_config(struct iio_dev *indio_dev,
                                 st->event_en = state;
                         else
                                 return -EINVAL;
+                        break;
                 default:
                         return -EINVAL;
                 }
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 17ec4cee51dc..a47428b4d31b 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf,
         ret = indio_dev->info->debugfs_reg_access(indio_dev,
                                                   indio_dev->cached_reg_addr,
                                                   0, &val);
-        if (ret)
+        if (ret) {
                 dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__);
+                return ret;
+        }
 
         len = snprintf(buf, sizeof(buf), "0x%X\n", val);
 
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e68368b5b2a3..08aafba4481c 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -315,6 +315,10 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                                 },
                         },
                 },
+                .drdy_irq = {
+                        /* drdy line is routed drdy pin */
+                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 0d2ea3ee371b..8f26428804a2 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -573,7 +573,7 @@ static int bmp280_chip_config(struct bmp280_data *data)
         u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) |
                   BMP280_OSRS_PRESS_X(data->oversampling_press + 1);
 
-        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS,
+        ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
                                  BMP280_OSRS_TEMP_MASK |
                                  BMP280_OSRS_PRESS_MASK |
                                  BMP280_MODE_MASK,
diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c
index ebfb1de7377f..91431454eb85 100644
--- a/drivers/iio/pressure/zpa2326.c
+++ b/drivers/iio/pressure/zpa2326.c
@@ -865,7 +865,6 @@ complete:
 static int zpa2326_wait_oneshot_completion(const struct iio_dev   *indio_dev,
                                            struct zpa2326_private *private)
 {
-        int          ret;
         unsigned int val;
         long     timeout;
 
@@ -887,14 +886,11 @@ static int zpa2326_wait_oneshot_completion(const struct iio_dev   *indio_dev,
                 /* Timed out. */
                 zpa2326_warn(indio_dev, "no one shot interrupt occurred (%ld)",
                              timeout);
-                ret = -ETIME;
-        } else if (timeout < 0) {
-                zpa2326_warn(indio_dev,
-                             "wait for one shot interrupt cancelled");
-                ret = -ERESTARTSYS;
+                return -ETIME;
         }
 
-        return ret;
+        zpa2326_warn(indio_dev, "wait for one shot interrupt cancelled");
+        return -ERESTARTSYS;
 }
 
 static int zpa2326_init_managed_irq(struct device          *parent,
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 0eeff29b61be..4a48b7ba3a1c 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -39,8 +39,12 @@
 #define AS3935_AFE_GAIN_MAX     0x1F
 #define AS3935_AFE_PWR_BIT      BIT(0)
 
+#define AS3935_NFLWDTH          0x01
+#define AS3935_NFLWDTH_MASK     0x7f
+
 #define AS3935_INT              0x03
 #define AS3935_INT_MASK         0x0f
+#define AS3935_DISTURB_INT      BIT(2)
 #define AS3935_EVENT_INT        BIT(3)
 #define AS3935_NOISE_INT        BIT(0)
 
@@ -48,6 +52,7 @@
 #define AS3935_DATA_MASK        0x3F
 
 #define AS3935_TUNE_CAP         0x08
+#define AS3935_DEFAULTS         0x3C
 #define AS3935_CALIBRATE        0x3D
 
 #define AS3935_READ_DATA        BIT(14)
@@ -62,7 +67,9 @@ struct as3935_state {
         struct mutex lock;
         struct delayed_work work;
 
+        unsigned long noise_tripped;
         u32 tune_cap;
+        u32 nflwdth_reg;
         u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */
         u8 buf[2] ____cacheline_aligned;
 };
@@ -145,12 +152,29 @@ static ssize_t as3935_sensor_sensitivity_store(struct device *dev,
         return len;
 }
 
+static ssize_t as3935_noise_level_tripped_show(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct as3935_state *st = iio_priv(dev_to_iio_dev(dev));
+        int ret;
+
+        mutex_lock(&st->lock);
+        ret = sprintf(buf, "%d\n", !time_after(jiffies, st->noise_tripped + HZ));
+        mutex_unlock(&st->lock);
+
+        return ret;
+}
+
 static IIO_DEVICE_ATTR(sensor_sensitivity, S_IRUGO | S_IWUSR,
         as3935_sensor_sensitivity_show, as3935_sensor_sensitivity_store, 0);
 
+static IIO_DEVICE_ATTR(noise_level_tripped, S_IRUGO,
+        as3935_noise_level_tripped_show, NULL, 0);
 
 static struct attribute *as3935_attributes[] = {
         &iio_dev_attr_sensor_sensitivity.dev_attr.attr,
+        &iio_dev_attr_noise_level_tripped.dev_attr.attr,
         NULL,
 };
 
@@ -246,7 +270,11 @@ static void as3935_event_work(struct work_struct *work)
         case AS3935_EVENT_INT:
                 iio_trigger_poll_chained(st->trig);
                 break;
+        case AS3935_DISTURB_INT:
         case AS3935_NOISE_INT:
+                mutex_lock(&st->lock);
+                st->noise_tripped = jiffies;
+                mutex_unlock(&st->lock);
                 dev_warn(&st->spi->dev, "noise level is too high\n");
                 break;
         }
@@ -269,15 +297,14 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private)
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-        /* mask disturber interrupt bit */
-        as3935_write(st, AS3935_INT, BIT(5));
-
+        as3935_write(st, AS3935_DEFAULTS, 0x96);
         as3935_write(st, AS3935_CALIBRATE, 0x96);
         as3935_write(st, AS3935_TUNE_CAP,
                 BIT(5) | (st->tune_cap / TUNE_CAP_DIV));
 
         mdelay(2);
         as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
+        as3935_write(st, AS3935_NFLWDTH, st->nflwdth_reg);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -370,6 +397,15 @@ static int as3935_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
+        ret = of_property_read_u32(np,
+                        "ams,nflwdth", &st->nflwdth_reg);
+        if (!ret && st->nflwdth_reg > AS3935_NFLWDTH_MASK) {
+                dev_err(&spi->dev,
+                        "invalid nflwdth setting of %d\n",
+                        st->nflwdth_reg);
+                return -EINVAL;
+        }
+
         indio_dev->dev.parent = &spi->dev;
         indio_dev->name = spi_get_device_id(spi)->name;
         indio_dev->channels = as3935_channels;
@@ -384,6 +420,7 @@ static int as3935_probe(struct spi_device *spi)
                 return -ENOMEM;
 
         st->trig = trig;
+        st->noise_tripped = jiffies - HZ;
         trig->dev.parent = indio_dev->dev.parent;
         iio_trigger_set_drvdata(trig, indio_dev);
         trig->ops = &iio_interrupt_trigger_ops;
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index 9b9053494daf..eb212f8c8879 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -174,6 +174,7 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
                 clk_disable(priv->clk);
 
         /* Stop timer */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
         regmap_write(priv->regmap, TIM_PSC, 0);
         regmap_write(priv->regmap, TIM_ARR, 0);
@@ -715,8 +716,9 @@ static ssize_t stm32_count_set_preset(struct iio_dev *indio_dev,
         if (ret)
                 return ret;
 
+        /* TIMx_ARR register shouldn't be buffered (ARPE=0) */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_write(priv->regmap, TIM_ARR, preset);
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
 
         return len;
 }
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 30825bb9b8e9..8861c052155a 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -100,6 +100,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
         if (ret)
                 goto pid_query_error;
 
+        nlmsg_end(skb, nlh);
+
         pr_debug("%s: Multicasting a nlmsg (dev = %s ifname = %s iwpm = %s)\n",
                 __func__, pm_msg->dev_name, pm_msg->if_name, iwpm_ulib_name);
 
@@ -170,6 +172,8 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->loc_addr, IWPM_NLA_MANAGE_ADDR);
         if (ret)
                 goto add_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -246,6 +250,8 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->rem_addr, IWPM_NLA_QUERY_REMOTE_ADDR);
         if (ret)
                 goto query_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -308,6 +314,8 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
         if (ret)
                 goto remove_mapping_error;
 
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
         if (ret) {
                 skb = NULL; /* skb is freed in the netlink send-op handling */
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index c81c55942626..3c4faadb8cdd 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -597,6 +597,9 @@ static int send_mapinfo_num(u32 mapping_num, u8 nl_client, int iwpm_pid)
                                 &mapping_num, IWPM_NLA_MAPINFO_SEND_NUM);
         if (ret)
                 goto mapinfo_num_error;
+
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast(skb, iwpm_pid);
         if (ret) {
                 skb = NULL;
@@ -678,6 +681,8 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid)
                         if (ret)
                                 goto send_mapping_info_unlock;
 
+                        nlmsg_end(skb, nlh);
+
                         iwpm_print_sockaddr(&map_info->local_sockaddr,
                                 "send_mapping_info: Local sockaddr:");
                         iwpm_print_sockaddr(&map_info->mapped_sockaddr,
diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
index b12e58787c3d..1fb72c356e36 100644
--- a/drivers/infiniband/core/netlink.c
+++ b/drivers/infiniband/core/netlink.c
@@ -175,13 +175,24 @@ static int rdma_nl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
             !netlink_capable(skb, CAP_NET_ADMIN))
                 return -EPERM;
 
+        /*
+         * LS responses overload the 0x100 (NLM_F_ROOT) flag.  Don't
+         * mistakenly call the .dump() function.
+         */
+        if (index == RDMA_NL_LS) {
+                if (cb_table[op].doit)
+                        return cb_table[op].doit(skb, nlh, extack);
+                return -EINVAL;
+        }
         /* FIXME: Convert IWCM to properly handle doit callbacks */
         if ((nlh->nlmsg_flags & NLM_F_DUMP) || index == RDMA_NL_RDMA_CM ||
             index == RDMA_NL_IWCM) {
                 struct netlink_dump_control c = {
                         .dump = cb_table[op].dump,
                 };
-                return netlink_dump_start(nls, skb, nlh, &c);
+                if (c.dump)
+                        return netlink_dump_start(nls, skb, nlh, &c);
+                return -EINVAL;
         }
 
         if (cb_table[op].doit)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 3ba24c428c3b..2fae850a3eff 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -214,7 +214,9 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         err = nlmsg_parse(nlh, 0, tb, RDMA_NLDEV_ATTR_MAX - 1,
                           nldev_policy, extack);
-        if (err || !tb[RDMA_NLDEV_ATTR_PORT_INDEX])
+        if (err ||
+            !tb[RDMA_NLDEV_ATTR_DEV_INDEX] ||
+            !tb[RDMA_NLDEV_ATTR_PORT_INDEX])
                 return -EINVAL;
 
         index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 70ad19c4c73e..88bdafb297f5 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -432,8 +432,10 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
         atomic_set(&qp->qp_sec->error_list_count, 0);
         init_completion(&qp->qp_sec->error_complete);
         ret = security_ib_alloc_security(&qp->qp_sec->security);
-        if (ret)
+        if (ret) {
                 kfree(qp->qp_sec);
+                qp->qp_sec = NULL;
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 4ab30d832ac5..52a2cf2d83aa 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3869,15 +3869,15 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
         resp.raw_packet_caps = attr.raw_packet_caps;
         resp.response_length += sizeof(resp.raw_packet_caps);
 
-        if (ucore->outlen < resp.response_length + sizeof(resp.xrq_caps))
+        if (ucore->outlen < resp.response_length + sizeof(resp.tm_caps))
                 goto end;
 
-        resp.xrq_caps.max_rndv_hdr_size = attr.xrq_caps.max_rndv_hdr_size;
-        resp.xrq_caps.max_num_tags      = attr.xrq_caps.max_num_tags;
-        resp.xrq_caps.max_ops           = attr.xrq_caps.max_ops;
-        resp.xrq_caps.max_sge           = attr.xrq_caps.max_sge;
-        resp.xrq_caps.flags             = attr.xrq_caps.flags;
-        resp.response_length += sizeof(resp.xrq_caps);
+        resp.tm_caps.max_rndv_hdr_size  = attr.tm_caps.max_rndv_hdr_size;
+        resp.tm_caps.max_num_tags       = attr.tm_caps.max_num_tags;
+        resp.tm_caps.max_ops            = attr.tm_caps.max_ops;
+        resp.tm_caps.max_sge            = attr.tm_caps.max_sge;
+        resp.tm_caps.flags              = attr.tm_caps.flags;
+        resp.response_length += sizeof(resp.tm_caps);
 end:
         err = ib_copy_to_udata(ucore, &resp, resp.response_length);
         return err;
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b2ed4b9cda6e..0be42787759f 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1066,6 +1066,8 @@ static int read_idle_sma(struct hfi1_devdata *dd, u64 *data);
 static int thermal_init(struct hfi1_devdata *dd);
 
 static void update_statusp(struct hfi1_pportdata *ppd, u32 state);
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs);
 static int wait_logical_linkstate(struct hfi1_pportdata *ppd, u32 state,
                                   int msecs);
 static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
@@ -8238,6 +8240,7 @@ static irqreturn_t general_interrupt(int irq, void *data)
         u64 regs[CCE_NUM_INT_CSRS];
         u32 bit;
         int i;
+        irqreturn_t handled = IRQ_NONE;
 
         this_cpu_inc(*dd->int_counter);
 
@@ -8258,9 +8261,10 @@ static irqreturn_t general_interrupt(int irq, void *data)
         for_each_set_bit(bit, (unsigned long *)&regs[0],
                          CCE_NUM_INT_CSRS * 64) {
                 is_interrupt(dd, bit);
+                handled = IRQ_HANDLED;
         }
 
-        return IRQ_HANDLED;
+        return handled;
 }
 
 static irqreturn_t sdma_interrupt(int irq, void *data)
@@ -9413,7 +9417,7 @@ static void set_qsfp_int_n(struct hfi1_pportdata *ppd, u8 enable)
         write_csr(dd, dd->hfi1_id ? ASIC_QSFP2_MASK : ASIC_QSFP1_MASK, mask);
 }
 
-void reset_qsfp(struct hfi1_pportdata *ppd)
+int reset_qsfp(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u64 mask, qsfp_mask;
@@ -9443,6 +9447,13 @@ void reset_qsfp(struct hfi1_pportdata *ppd)
          * for alarms and warnings
          */
         set_qsfp_int_n(ppd, 1);
+
+        /*
+         * After the reset, AOC transmitters are enabled by default. They need
+         * to be turned off to complete the QSFP setup before they can be
+         * enabled again.
+         */
+        return set_qsfp_tx(ppd, 0);
 }
 
 static int handle_qsfp_error_conditions(struct hfi1_pportdata *ppd,
@@ -10305,6 +10316,7 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u32 previous_state;
+        int offline_state_ret;
         int ret;
 
         update_lcb_cache(dd);
@@ -10326,28 +10338,11 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                 ppd->offline_disabled_reason =
                 HFI1_ODR_MASK(OPA_LINKDOWN_REASON_TRANSIENT);
 
-        /*
-         * Wait for offline transition. It can take a while for
-         * the link to go down.
-         */
-        ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 10000);
-        if (ret < 0)
-                return ret;
-
-        /*
-         * Now in charge of LCB - must be after the physical state is
-         * offline.quiet and before host_link_state is changed.
-         */
-        set_host_lcb_access(dd);
-        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
-
-        /* make sure the logical state is also down */
-        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
-        if (ret)
-                force_logical_link_state_down(ppd);
-
-        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+        offline_state_ret = wait_phys_link_offline_substates(ppd, 10000);
+        if (offline_state_ret < 0)
+                return offline_state_ret;
 
+        /* Disabling AOC transmitters */
         if (ppd->port_type == PORT_TYPE_QSFP &&
             ppd->qsfp_info.limiting_active &&
             qsfp_mod_present(ppd)) {
@@ -10365,6 +10360,30 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
         }
 
         /*
+         * Wait for the offline.Quiet transition if it hasn't happened yet. It
+         * can take a while for the link to go down.
+         */
+        if (offline_state_ret != PLS_OFFLINE_QUIET) {
+                ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 30000);
+                if (ret < 0)
+                        return ret;
+        }
+
+        /*
+         * Now in charge of LCB - must be after the physical state is
+         * offline.quiet and before host_link_state is changed.
+         */
+        set_host_lcb_access(dd);
+        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
+
+        /* make sure the logical state is also down */
+        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
+        if (ret)
+                force_logical_link_state_down(ppd);
+
+        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+
+        /*
          * The LNI has a mandatory wait time after the physical state
          * moves to Offline.Quiet.  The wait time may be different
          * depending on how the link went down.  The 8051 firmware
@@ -10396,6 +10415,9 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                         & (HLS_DN_POLL | HLS_VERIFY_CAP | HLS_GOING_UP)) {
                 /* went down while attempting link up */
                 check_lni_states(ppd);
+
+                /* The QSFP doesn't need to be reset on LNI failure */
+                ppd->qsfp_info.reset_needed = 0;
         }
 
         /* the active link width (downgrade) is 0 on link down */
@@ -12804,6 +12826,39 @@ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
         return 0;
 }
 
+/*
+ * wait_phys_link_offline_quiet_substates - wait for any offline substate
+ * @ppd: port device
+ * @msecs: the number of milliseconds to wait
+ *
+ * Wait up to msecs milliseconds for any offline physical link
+ * state change to occur.
+ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
+ */
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs)
+{
+        u32 read_state;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(msecs);
+        while (1) {
+                read_state = read_physical_state(ppd->dd);
+                if ((read_state & 0xF0) == PLS_OFFLINE)
+                        break;
+                if (time_after(jiffies, timeout)) {
+                        dd_dev_err(ppd->dd,
+                                   "timeout waiting for phy link offline.quiet substates. Read state 0x%x, %dms\n",
+                                   read_state, msecs);
+                        return -ETIMEDOUT;
+                }
+                usleep_range(1950, 2050); /* sleep 2ms-ish */
+        }
+
+        log_state_transition(ppd, read_state);
+        return read_state;
+}
+
 #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
 (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
 
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index b8345a60a0fb..50b8645d0b87 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -204,6 +204,7 @@
 #define PLS_OFFLINE_READY_TO_QUIET_LT      0x92
 #define PLS_OFFLINE_REPORT_FAILURE                 0x93
 #define PLS_OFFLINE_READY_TO_QUIET_BCC     0x94
+#define PLS_OFFLINE_QUIET_DURATION         0x95
 #define PLS_POLLING                                0x20
 #define PLS_POLLING_QUIET                          0x20
 #define PLS_POLLING_ACTIVE                         0x21
@@ -722,7 +723,7 @@ void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
 void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
-void reset_qsfp(struct hfi1_pportdata *ppd);
+int reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
 void start_freeze_handling(struct hfi1_pportdata *ppd, int flags);
 int send_idle_sma(struct hfi1_devdata *dd, u64 message);
diff --git a/drivers/infiniband/hw/hfi1/eprom.c b/drivers/infiniband/hw/hfi1/eprom.c
index d46b17107901..1613af1c58d9 100644
--- a/drivers/infiniband/hw/hfi1/eprom.c
+++ b/drivers/infiniband/hw/hfi1/eprom.c
@@ -204,7 +204,10 @@ done_asic:
         return ret;
 }
 
-/* magic character sequence that trails an image */
+/* magic character sequence that begins an image */
+#define IMAGE_START_MAGIC "APO="
+
+/* magic character sequence that might trail an image */
 #define IMAGE_TRAIL_MAGIC "egamiAPO"
 
 /* EPROM file types */
@@ -250,6 +253,7 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
 {
         void *buffer;
         void *p;
+        u32 length;
         int ret;
 
         buffer = kmalloc(P1_SIZE, GFP_KERNEL);
@@ -262,15 +266,21 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
                 return ret;
         }
 
-        /* scan for image magic that may trail the actual data */
-        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
-        if (!p) {
+        /* config partition is valid only if it starts with IMAGE_START_MAGIC */
+        if (memcmp(buffer, IMAGE_START_MAGIC, strlen(IMAGE_START_MAGIC))) {
                 kfree(buffer);
                 return -ENOENT;
         }
 
+        /* scan for image magic that may trail the actual data */
+        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
+        if (p)
+                length = p - buffer;
+        else
+                length = P1_SIZE;
+
         *data = buffer;
-        *size = p - buffer;
+        *size = length;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 2bc89260235a..d9a1e9893136 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo)
         switch (ret) {
         case 0:
                 ret = setup_base_ctxt(fd, uctxt);
-                if (uctxt->subctxt_cnt) {
-                        /*
-                         * Base context is done (successfully or not), notify
-                         * anybody using a sub-context that is waiting for
-                         * this completion.
-                         */
-                        clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
-                        wake_up(&uctxt->wait);
-                }
+                if (ret)
+                        deallocate_ctxt(uctxt);
                 break;
         case 1:
                 ret = complete_subctxt(fd);
@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         /* Now allocate the RcvHdr queue and eager buffers. */
         ret = hfi1_create_rcvhdrq(dd, uctxt);
         if (ret)
-                return ret;
+                goto done;
 
         ret = hfi1_setup_eagerbufs(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         /* If sub-contexts are enabled, do the appropriate setup */
         if (uctxt->subctxt_cnt)
                 ret = setup_subctxt(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = hfi1_alloc_ctxt_rcv_groups(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = init_user_ctxt(fd, uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         user_init(uctxt);
 
@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         fd->uctxt = uctxt;
         hfi1_rcd_get(uctxt);
 
-        return 0;
+done:
+        if (uctxt->subctxt_cnt) {
+                /*
+                 * On error, set the failed bit so sub-contexts will clean up
+                 * correctly.
+                 */
+                if (ret)
+                        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
 
-setup_failed:
-        /* Set the failed bit so sub-context init can do the right thing */
-        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
-        deallocate_ctxt(uctxt);
+                /*
+                 * Base context is done (successfully or not), notify anybody
+                 * using a sub-context that is waiting for this completion.
+                 */
+                clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
+                wake_up(&uctxt->wait);
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 82447b7cdda1..09e50fd2a08f 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -68,7 +68,7 @@
 /*
  * Code to adjust PCIe capabilities.
  */
-static int tune_pcie_caps(struct hfi1_devdata *);
+static void tune_pcie_caps(struct hfi1_devdata *);
 
 /*
  * Do all the common PCIe setup and initialization.
@@ -351,7 +351,7 @@ int pcie_speeds(struct hfi1_devdata *dd)
  */
 int request_msix(struct hfi1_devdata *dd, u32 msireq)
 {
-        int nvec, ret;
+        int nvec;
 
         nvec = pci_alloc_irq_vectors(dd->pcidev, 1, msireq,
                                      PCI_IRQ_MSIX | PCI_IRQ_LEGACY);
@@ -360,12 +360,7 @@ int request_msix(struct hfi1_devdata *dd, u32 msireq)
                 return nvec;
         }
 
-        ret = tune_pcie_caps(dd);
-        if (ret) {
-                dd_dev_err(dd, "tune_pcie_caps() failed: %d\n", ret);
-                pci_free_irq_vectors(dd->pcidev);
-                return ret;
-        }
+        tune_pcie_caps(dd);
 
         /* check for legacy IRQ */
         if (nvec == 1 && !dd->pcidev->msix_enabled)
@@ -502,7 +497,7 @@ uint aspm_mode = ASPM_MODE_DISABLED;
 module_param_named(aspm, aspm_mode, uint, S_IRUGO);
 MODULE_PARM_DESC(aspm, "PCIe ASPM: 0: disable, 1: enable, 2: dynamic");
 
-static int tune_pcie_caps(struct hfi1_devdata *dd)
+static void tune_pcie_caps(struct hfi1_devdata *dd)
 {
         struct pci_dev *parent;
         u16 rc_mpss, rc_mps, ep_mpss, ep_mps;
@@ -513,22 +508,14 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * Turn on extended tags in DevCtl in case the BIOS has turned it off
          * to improve WFR SDMA bandwidth
          */
-        ret = pcie_capability_read_word(dd->pcidev,
-                                        PCI_EXP_DEVCTL, &ectl);
-        if (ret) {
-                dd_dev_err(dd, "Unable to read from PCI config\n");
-                return ret;
-        }
-
-        if (!(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
+        ret = pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &ectl);
+        if ((!ret) && !(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
                 dd_dev_info(dd, "Enabling PCIe extended tags\n");
                 ectl |= PCI_EXP_DEVCTL_EXT_TAG;
                 ret = pcie_capability_write_word(dd->pcidev,
                                                  PCI_EXP_DEVCTL, ectl);
-                if (ret) {
-                        dd_dev_err(dd, "Unable to write to PCI config\n");
-                        return ret;
-                }
+                if (ret)
+                        dd_dev_info(dd, "Unable to write to PCI config\n");
         }
         /* Find out supported and configured values for parent (root) */
         parent = dd->pcidev->bus->self;
@@ -536,15 +523,22 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * The driver cannot perform the tuning if it does not have
          * access to the upstream component.
          */
-        if (!parent)
-                return -EINVAL;
+        if (!parent) {
+                dd_dev_info(dd, "Parent not found\n");
+                return;
+        }
         if (!pci_is_root_bus(parent->bus)) {
                 dd_dev_info(dd, "Parent not root\n");
-                return -EINVAL;
+                return;
+        }
+        if (!pci_is_pcie(parent)) {
+                dd_dev_info(dd, "Parent is not PCI Express capable\n");
+                return;
+        }
+        if (!pci_is_pcie(dd->pcidev)) {
+                dd_dev_info(dd, "PCI device is not PCI Express capable\n");
+                return;
         }
-
-        if (!pci_is_pcie(parent) || !pci_is_pcie(dd->pcidev))
-                return -EINVAL;
         rc_mpss = parent->pcie_mpss;
         rc_mps = ffs(pcie_get_mps(parent)) - 8;
         /* Find out supported and configured values for endpoint (us) */
@@ -590,8 +584,6 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
                 ep_mrrs = max_mrrs;
                 pcie_set_readrq(dd->pcidev, ep_mrrs);
         }
-
-        return 0;
 }
 
 /* End of PCIe capability tuning */
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index a8af96d2b1b0..d486355880cb 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -790,7 +790,9 @@ static int tune_active_qsfp(struct hfi1_pportdata *ppd, u32 *ptr_tx_preset,
          * reuse of stale settings established in our previous pass through.
          */
         if (ppd->qsfp_info.reset_needed) {
-                reset_qsfp(ppd);
+                ret = reset_qsfp(ppd);
+                if (ret)
+                        return ret;
                 refresh_qsfp_cache(ppd, &ppd->qsfp_info);
         } else {
                 ppd->qsfp_info.reset_needed = 1;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index d1f5345f04f0..42ca5346777d 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -48,7 +48,7 @@
  * @wqe: cqp wqe for header
  * @header: header for the cqp wqe
  */
-static inline void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
 {
         wmb();            /* make sure WQE is populated before polarity is set */
         set_64bit_val(wqe, 24, header);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_p.h b/drivers/infiniband/hw/i40iw/i40iw_p.h
index e217a1259f57..5498ad01c280 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_p.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_p.h
@@ -59,6 +59,8 @@ enum i40iw_status_code i40iw_sc_mr_fast_register(struct i40iw_sc_qp *qp,
                                                  struct i40iw_fast_reg_stag_info *info,
                                                  bool post_sq);
 
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header);
+
 /* HMC/FPM functions */
 enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev,
                                             u8 hmc_fn_id);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index c2cab20c4bc5..59f70676f0e0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -123,12 +123,11 @@ static void i40iw_puda_post_recvbuf(struct i40iw_puda_rsrc *rsrc, u32 wqe_idx,
                 get_64bit_val(wqe, 24, &offset24);
 
         offset24 = (offset24) ? 0 : LS_64(1, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, offset24);
 
         set_64bit_val(wqe, 0, buf->mem.pa);
         set_64bit_val(wqe, 8,
                       LS_64(buf->mem.size, I40IWQPSQ_FRAG_LEN));
-        set_64bit_val(wqe, 24, offset24);
+        i40iw_insert_wqe_hdr(wqe, offset24);
 }
 
 /**
@@ -409,9 +408,7 @@ enum i40iw_status_code i40iw_puda_send(struct i40iw_sc_qp *qp,
         set_64bit_val(wqe, 8, LS_64(info->len, I40IWQPSQ_FRAG_LEN));
         set_64bit_val(wqe, 16, header[0]);
 
-        /* Ensure all data is written before writing valid bit */
-        wmb();
-        set_64bit_val(wqe, 24, header[1]);
+        i40iw_insert_wqe_hdr(wqe, header[1]);
 
         i40iw_debug_buf(qp->dev, I40IW_DEBUG_PUDA, "PUDA SEND WQE", wqe, 32);
         i40iw_qp_post_wr(&qp->qp_uk);
@@ -539,7 +536,7 @@ static enum i40iw_status_code i40iw_puda_qp_wqe(struct i40iw_sc_dev *dev, struct
                  LS_64(2, I40IW_CQPSQ_QP_NEXTIWSTATE) |
                  LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
 
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(cqp->dev, I40IW_DEBUG_PUDA, "PUDA CQE", wqe, 32);
         i40iw_sc_cqp_post_sq(cqp);
@@ -655,7 +652,7 @@ static enum i40iw_status_code i40iw_puda_cq_wqe(struct i40iw_sc_dev *dev, struct
             LS_64(1, I40IW_CQPSQ_CQ_ENCEQEMASK) |
             LS_64(1, I40IW_CQPSQ_CQ_CEQIDVALID) |
             LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(dev, I40IW_DEBUG_PUDA, "PUDA CQE",
                         wqe, I40IW_CQP_WQE_SIZE * 8);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 28b3d02d511b..62be0a41ad0b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -826,12 +826,14 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
         attr->cap.max_inline_data = I40IW_MAX_INLINE_DATA_SIZE;
         attr->cap.max_send_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
         attr->cap.max_recv_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
+        attr->port_num = 1;
         init_attr->event_handler = iwqp->ibqp.event_handler;
         init_attr->qp_context = iwqp->ibqp.qp_context;
         init_attr->send_cq = iwqp->ibqp.send_cq;
         init_attr->recv_cq = iwqp->ibqp.recv_cq;
         init_attr->srq = iwqp->ibqp.srq;
         init_attr->cap = attr->cap;
+        init_attr->port_num = 1;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 05fb4bdff6a0..552f7bd4ecc3 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -778,13 +778,13 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
         }
 
         if (MLX5_CAP_GEN(mdev, tag_matching)) {
-                props->xrq_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
-                props->xrq_caps.max_num_tags =
+                props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+                props->tm_caps.max_num_tags =
                         (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
-                props->xrq_caps.flags = IB_TM_CAP_RC;
-                props->xrq_caps.max_ops =
+                props->tm_caps.flags = IB_TM_CAP_RC;
+                props->tm_caps.max_ops =
                         1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-                props->xrq_caps.max_sge = MLX5_TM_MAX_SGE;
+                props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
         }
 
         if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
@@ -4174,9 +4174,9 @@ err_bfreg:
 err_uar_page:
         mlx5_put_uars_page(dev->mdev, dev->mdev->priv.uar);
 
-err_cnt:
-        mlx5_ib_cleanup_cong_debugfs(dev);
 err_cong:
+        mlx5_ib_cleanup_cong_debugfs(dev);
+err_cnt:
         if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt))
                 mlx5_ib_dealloc_counters(dev);
 
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 914f212e7ef6..f3dbd75a0a96 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -50,13 +50,9 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
 {
         unsigned long tmp;
         unsigned long m;
-        int i, k;
-        u64 base = 0;
-        int p = 0;
-        int skip;
-        int mask;
-        u64 len;
-        u64 pfn;
+        u64 base = ~0, p = 0;
+        u64 len, pfn;
+        int i = 0;
         struct scatterlist *sg;
         int entry;
         unsigned long page_shift = umem->page_shift;
@@ -76,33 +72,24 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
         m = find_first_bit(&tmp, BITS_PER_LONG);
         if (max_page_shift)
                 m = min_t(unsigned long, max_page_shift - page_shift, m);
-        skip = 1 << m;
-        mask = skip - 1;
-        i = 0;
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 len = sg_dma_len(sg) >> page_shift;
                 pfn = sg_dma_address(sg) >> page_shift;
-                for (k = 0; k < len; k++) {
-                        if (!(i & mask)) {
-                                tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
-                                skip = 1 << m;
-                                mask = skip - 1;
-                                base = pfn;
-                                p = 0;
-                        } else {
-                                if (base + p != pfn) {
-                                        tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, BITS_PER_LONG);
-                                        skip = 1 << m;
-                                        mask = skip - 1;
-                                        base = pfn;
-                                        p = 0;
-                                }
-                        }
-                        p++;
-                        i++;
+                if (base + p != pfn) {
+                        /* If either the offset or the new
+                         * base are unaligned update m
+                         */
+                        tmp = (unsigned long)(pfn | p);
+                        if (!IS_ALIGNED(tmp, 1 << m))
+                                m = find_first_bit(&tmp, BITS_PER_LONG);
+
+                        base = pfn;
+                        p = 0;
                 }
+
+                p += len;
+                i += len;
         }
 
         if (i) {
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 0e2789d9bb4d..37bbc543847a 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -47,7 +47,8 @@ enum {
 
 #define MLX5_UMR_ALIGN 2048
 
-static int clean_mr(struct mlx5_ib_mr *mr);
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 
@@ -1270,8 +1271,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
                 err = mlx5_ib_update_xlt(mr, 0, ncont, page_shift,
                                          update_xlt_flags);
+
                 if (err) {
-                        mlx5_ib_dereg_mr(&mr->ibmr);
+                        dereg_mr(dev, mr);
                         return ERR_PTR(err);
                 }
         }
@@ -1356,7 +1358,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                   &npages, &page_shift, &ncont, &order);
                 if (err < 0) {
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1410,7 +1412,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 if (err) {
                         mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                         ib_umem_release(mr->umem);
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1469,9 +1471,8 @@ mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
         }
 }
 
-static int clean_mr(struct mlx5_ib_mr *mr)
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
         int allocated_from_cache = mr->allocated_from_cache;
         int err;
 
@@ -1507,10 +1508,8 @@ static int clean_mr(struct mlx5_ib_mr *mr)
         return 0;
 }
 
-int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
-        struct mlx5_ib_mr *mr = to_mmr(ibmr);
         int npages = mr->npages;
         struct ib_umem *umem = mr->umem;
 
@@ -1539,7 +1538,7 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         }
 #endif
 
-        clean_mr(mr);
+        clean_mr(dev, mr);
 
         if (umem) {
                 ib_umem_release(umem);
@@ -1549,6 +1548,14 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         return 0;
 }
 
+int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+{
+        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
+        struct mlx5_ib_mr *mr = to_mmr(ibmr);
+
+        return dereg_mr(dev, mr);
+}
+
 struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
                                enum ib_mr_type mr_type,
                                u32 max_num_sg)
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index f0dc5f4aa177..442b9bdc0f03 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -3232,7 +3232,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->ibmr.iova);
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_LOW_IDX,
-                                            mr->ibmr.length);
+                                            lower_32_bits(mr->ibmr.length));
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_HIGH_IDX, 0);
                         set_wqe_32bit_value(wqe->wqe_words,
@@ -3274,7 +3274,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->npages * 8);
 
                         nes_debug(NES_DBG_IW_TX, "SQ_REG_MR: iova_start: %llx, "
-                                  "length: %d, rkey: %0x, pgl_paddr: %llx, "
+                                  "length: %lld, rkey: %0x, pgl_paddr: %llx, "
                                   "page_list_len: %u, wqe_misc: %x\n",
                                   (unsigned long long) mr->ibmr.iova,
                                   mr->ibmr.length,
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index b2bb42e2805d..254083b524bd 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -387,7 +387,7 @@ struct qedr_qp {
                 u8 wqe_size;
 
                 u8 smac[ETH_ALEN];
-                u16 vlan_id;
+                u16 vlan;
                 int rc;
         } *rqe_wr_id;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 4689e802b332..ad8965397cf7 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -105,7 +105,7 @@ void qedr_ll2_complete_rx_packet(void *cxt,
 
         qp->rqe_wr_id[qp->rq.gsi_cons].rc = data->u.data_length_error ?
                 -EINVAL : 0;
-        qp->rqe_wr_id[qp->rq.gsi_cons].vlan_id = data->vlan;
+        qp->rqe_wr_id[qp->rq.gsi_cons].vlan = data->vlan;
         /* note: length stands for data length i.e. GRH is excluded */
         qp->rqe_wr_id[qp->rq.gsi_cons].sg_list[0].length =
                 data->length.data_length;
@@ -694,6 +694,7 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct qedr_cq *cq = get_qedr_cq(ibcq);
         struct qedr_qp *qp = dev->gsi_qp;
         unsigned long flags;
+        u16 vlan_id;
         int i = 0;
 
         spin_lock_irqsave(&cq->cq_lock, flags);
@@ -712,9 +713,14 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 wc[i].wc_flags |= IB_WC_GRH | IB_WC_IP_CSUM_OK;
                 ether_addr_copy(wc[i].smac, qp->rqe_wr_id[qp->rq.cons].smac);
                 wc[i].wc_flags |= IB_WC_WITH_SMAC;
-                if (qp->rqe_wr_id[qp->rq.cons].vlan_id) {
+
+                vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan &
+                          VLAN_VID_MASK;
+                if (vlan_id) {
                         wc[i].wc_flags |= IB_WC_WITH_VLAN;
-                        wc[i].vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan_id;
+                        wc[i].vlan_id = vlan_id;
+                        wc[i].sl = (qp->rqe_wr_id[qp->rq.cons].vlan &
+                                    VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
                 }
 
                 qedr_inc_sw_cons(&qp->rq);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2e075377242e..6cd61638b441 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1000,19 +1000,6 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
                  */
                 priv->dev->broadcast[8] = priv->pkey >> 8;
                 priv->dev->broadcast[9] = priv->pkey & 0xff;
-
-                /*
-                 * Update the broadcast address in the priv->broadcast object,
-                 * in case it already exists, otherwise no one will do that.
-                 */
-                if (priv->broadcast) {
-                        spin_lock_irq(&priv->lock);
-                        memcpy(priv->broadcast->mcmember.mgid.raw,
-                               priv->dev->broadcast + 4,
-                        sizeof(union ib_gid));
-                        spin_unlock_irq(&priv->lock);
-                }
-
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index bac95b509a9b..dcc77014018d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2180,6 +2180,7 @@ static struct net_device *ipoib_add_port(const char *format,
 {
         struct ipoib_dev_priv *priv;
         struct ib_port_attr attr;
+        struct rdma_netdev *rn;
         int result = -ENOMEM;
 
         priv = ipoib_intf_alloc(hca, port, format);
@@ -2279,7 +2280,8 @@ register_failed:
         ipoib_dev_cleanup(priv->dev);
 
 device_init_failed:
-        free_netdev(priv->dev);
+        rn = netdev_priv(priv->dev);
+        rn->free_rdma_netdev(priv->dev);
         kfree(priv);
 
 alloc_mem_failed:
@@ -2328,7 +2330,7 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 return;
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
-                struct rdma_netdev *rn = netdev_priv(priv->dev);
+                struct rdma_netdev *parent_rn = netdev_priv(priv->dev);
 
                 ib_unregister_event_handler(&priv->event_handler);
                 flush_workqueue(ipoib_workqueue);
@@ -2350,10 +2352,15 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 unregister_netdev(priv->dev);
                 mutex_unlock(&priv->sysfs_mutex);
 
-                rn->free_rdma_netdev(priv->dev);
+                parent_rn->free_rdma_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) {
+                        struct rdma_netdev *child_rn;
 
-                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        child_rn = netdev_priv(cpriv->dev);
+                        child_rn->free_rdma_netdev(cpriv->dev);
                         kfree(cpriv);
+                }
 
                 kfree(priv);
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 9927cd6b7082..55a9b71ed05a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -141,14 +141,17 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
-        if (!priv) {
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
                 rtnl_unlock();
                 mutex_unlock(&ppriv->sysfs_mutex);
-                return -ENOMEM;
+                return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
+        if (!priv) {
+                result = -ENOMEM;
+                goto out;
+        }
 
         /*
          * First ensure this isn't a duplicate. We check the parent device and
@@ -175,8 +178,11 @@ out:
         rtnl_unlock();
         mutex_unlock(&ppriv->sysfs_mutex);
 
-        if (result) {
-                free_netdev(priv->dev);
+        if (result && priv) {
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(priv->dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
         }
 
@@ -204,7 +210,12 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
+                rtnl_unlock();
+                mutex_unlock(&ppriv->sysfs_mutex);
+                return restart_syscall();
+        }
+
         list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                 if (priv->pkey == pkey &&
                     priv->child_type == IPOIB_LEGACY_CHILD) {
@@ -224,7 +235,10 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
         mutex_unlock(&ppriv->sysfs_mutex);
 
         if (dev) {
-                free_netdev(dev);
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
                 return 0;
         }
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9c3e9ab53a41..322209d5ff58 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -154,7 +154,7 @@ static void iser_dump_page_vec(struct iser_page_vec *page_vec)
 {
         int i;
 
-        iser_err("page vec npages %d data length %d\n",
+        iser_err("page vec npages %d data length %lld\n",
                  page_vec->npages, page_vec->fake_mr.length);
         for (i = 0; i < page_vec->npages; i++)
                 iser_err("vec[%d]: %llx\n", i, page_vec->pages[i]);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index d268fdc23c64..762bfb9487dc 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -933,58 +933,52 @@ int input_set_keycode(struct input_dev *dev,
 }
 EXPORT_SYMBOL(input_set_keycode);
 
+bool input_match_device_id(const struct input_dev *dev,
+                           const struct input_device_id *id)
+{
+        if (id->flags & INPUT_DEVICE_ID_MATCH_BUS)
+                if (id->bustype != dev->id.bustype)
+                        return false;
+
+        if (id->flags & INPUT_DEVICE_ID_MATCH_VENDOR)
+                if (id->vendor != dev->id.vendor)
+                        return false;
+
+        if (id->flags & INPUT_DEVICE_ID_MATCH_PRODUCT)
+                if (id->product != dev->id.product)
+                        return false;
+
+        if (id->flags & INPUT_DEVICE_ID_MATCH_VERSION)
+                if (id->version != dev->id.version)
+                        return false;
+
+        if (!bitmap_subset(id->evbit, dev->evbit, EV_MAX) ||
+            !bitmap_subset(id->keybit, dev->keybit, KEY_MAX) ||
+            !bitmap_subset(id->relbit, dev->relbit, REL_MAX) ||
+            !bitmap_subset(id->absbit, dev->absbit, ABS_MAX) ||
+            !bitmap_subset(id->mscbit, dev->mscbit, MSC_MAX) ||
+            !bitmap_subset(id->ledbit, dev->ledbit, LED_MAX) ||
+            !bitmap_subset(id->sndbit, dev->sndbit, SND_MAX) ||
+            !bitmap_subset(id->ffbit, dev->ffbit, FF_MAX) ||
+            !bitmap_subset(id->swbit, dev->swbit, SW_MAX) ||
+            !bitmap_subset(id->propbit, dev->propbit, INPUT_PROP_MAX)) {
+                return false;
+        }
+
+        return true;
+}
+EXPORT_SYMBOL(input_match_device_id);
+
 static const struct input_device_id *input_match_device(struct input_handler *handler,
                                                         struct input_dev *dev)
 {
         const struct input_device_id *id;
 
         for (id = handler->id_table; id->flags || id->driver_info; id++) {
-
-                if (id->flags & INPUT_DEVICE_ID_MATCH_BUS)
-                        if (id->bustype != dev->id.bustype)
-                                continue;
-
-                if (id->flags & INPUT_DEVICE_ID_MATCH_VENDOR)
-                        if (id->vendor != dev->id.vendor)
-                                continue;
-
-                if (id->flags & INPUT_DEVICE_ID_MATCH_PRODUCT)
-                        if (id->product != dev->id.product)
-                                continue;
-
-                if (id->flags & INPUT_DEVICE_ID_MATCH_VERSION)
-                        if (id->version != dev->id.version)
-                                continue;
-
-                if (!bitmap_subset(id->evbit, dev->evbit, EV_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->keybit, dev->keybit, KEY_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->relbit, dev->relbit, REL_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->absbit, dev->absbit, ABS_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->mscbit, dev->mscbit, MSC_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->ledbit, dev->ledbit, LED_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->sndbit, dev->sndbit, SND_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->ffbit, dev->ffbit, FF_MAX))
-                        continue;
-
-                if (!bitmap_subset(id->swbit, dev->swbit, SW_MAX))
-                        continue;
-
-                if (!handler->match || handler->match(handler, dev))
+                if (input_match_device_id(dev, id) &&
+                    (!handler->match || handler->match(handler, dev))) {
                         return id;
+                }
         }
 
         return NULL;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 29d677c714d2..7b29a8944039 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -747,6 +747,68 @@ static void joydev_cleanup(struct joydev *joydev)
                 input_close_device(handle);
 }
 
+/*
+ * These codes are copied from from hid-ids.h, unfortunately there is no common
+ * usb_ids/bt_ids.h header.
+ */
+#define USB_VENDOR_ID_SONY                      0x054c
+#define USB_DEVICE_ID_SONY_PS3_CONTROLLER               0x0268
+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER               0x05c4
+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2             0x09cc
+#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE        0x0ba0
+
+#define USB_VENDOR_ID_THQ                       0x20d6
+#define USB_DEVICE_ID_THQ_PS3_UDRAW                     0xcb17
+
+#define ACCEL_DEV(vnd, prd)                                             \
+        {                                                               \
+                .flags = INPUT_DEVICE_ID_MATCH_VENDOR |                 \
+                                INPUT_DEVICE_ID_MATCH_PRODUCT |         \
+                                INPUT_DEVICE_ID_MATCH_PROPBIT,          \
+                .vendor = (vnd),                                        \
+                .product = (prd),                                       \
+                .propbit = { BIT_MASK(INPUT_PROP_ACCELEROMETER) },      \
+        }
+
+static const struct input_device_id joydev_blacklist[] = {
+        /* Avoid touchpads and touchscreens */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
+        },
+        /* Avoid tablets, digitisers and similar devices */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+        },
+        /* Disable accelerometers on composite devices */
+        ACCEL_DEV(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER),
+        ACCEL_DEV(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
+        ACCEL_DEV(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
+        ACCEL_DEV(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE),
+        ACCEL_DEV(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW),
+        { /* sentinel */ }
+};
+
+static bool joydev_dev_is_blacklisted(struct input_dev *dev)
+{
+        const struct input_device_id *id;
+
+        for (id = joydev_blacklist; id->flags; id++) {
+                if (input_match_device_id(dev, id)) {
+                        dev_dbg(&dev->dev,
+                                "joydev: blacklisting '%s'\n", dev->name);
+                        return true;
+                }
+        }
+
+        return false;
+}
+
 static bool joydev_dev_is_absolute_mouse(struct input_dev *dev)
 {
         DECLARE_BITMAP(jd_scratch, KEY_CNT);
@@ -807,12 +869,8 @@ static bool joydev_dev_is_absolute_mouse(struct input_dev *dev)
 
 static bool joydev_match(struct input_handler *handler, struct input_dev *dev)
 {
-        /* Avoid touchpads and touchscreens */
-        if (test_bit(EV_KEY, dev->evbit) && test_bit(BTN_TOUCH, dev->keybit))
-                return false;
-
-        /* Avoid tablets, digitisers and similar devices */
-        if (test_bit(EV_KEY, dev->evbit) && test_bit(BTN_DIGI, dev->keybit))
+        /* Disable blacklisted devices */
+        if (joydev_dev_is_blacklisted(dev))
                 return false;
 
         /* Avoid absolute mice */
diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
index e37e335e406f..6da607d3b811 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -234,14 +234,7 @@ static irqreturn_t tca8418_irq_handler(int irq, void *dev_id)
 static int tca8418_configure(struct tca8418_keypad *keypad_data,
                              u32 rows, u32 cols)
 {
-        int reg, error;
-
-        /* Write config register, if this fails assume device not present */
-        error = tca8418_write_byte(keypad_data, REG_CFG,
-                                CFG_INT_CFG | CFG_OVR_FLOW_IEN | CFG_KE_IEN);
-        if (error < 0)
-                return -ENODEV;
-
+        int reg, error = 0;
 
         /* Assemble a mask for row and column registers */
         reg  =  ~(~0 << rows);
@@ -257,6 +250,12 @@ static int tca8418_configure(struct tca8418_keypad *keypad_data,
         error |= tca8418_write_byte(keypad_data, REG_DEBOUNCE_DIS2, reg >> 8);
         error |= tca8418_write_byte(keypad_data, REG_DEBOUNCE_DIS3, reg >> 16);
 
+        if (error)
+                return error;
+
+        error = tca8418_write_byte(keypad_data, REG_CFG,
+                                CFG_INT_CFG | CFG_OVR_FLOW_IEN | CFG_KE_IEN);
+
         return error;
 }
 
@@ -268,6 +267,7 @@ static int tca8418_keypad_probe(struct i2c_client *client,
         struct input_dev *input;
         u32 rows = 0, cols = 0;
         int error, row_shift, max_keys;
+        u8 reg;
 
         /* Check i2c driver capabilities */
         if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE)) {
@@ -301,10 +301,10 @@ static int tca8418_keypad_probe(struct i2c_client *client,
         keypad_data->client = client;
         keypad_data->row_shift = row_shift;
 
-        /* Initialize the chip or fail if chip isn't present */
-        error = tca8418_configure(keypad_data, rows, cols);
-        if (error < 0)
-                return error;
+        /* Read key lock register, if this fails assume device not present */
+        error = tca8418_read_byte(keypad_data, REG_KEY_LCK_EC, &reg);
+        if (error)
+                return -ENODEV;
 
         /* Configure input device */
         input = devm_input_allocate_device(dev);
@@ -340,6 +340,11 @@ static int tca8418_keypad_probe(struct i2c_client *client,
                 return error;
         }
 
+        /* Initialize the chip */
+        error = tca8418_configure(keypad_data, rows, cols);
+        if (error < 0)
+                return error;
+
         error = input_register_device(input);
         if (error) {
                 dev_err(dev, "Unable to register input device, error: %d\n",
diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
index 6cee5adc3b5c..debeeaeb8812 100644
--- a/drivers/input/misc/axp20x-pek.c
+++ b/drivers/input/misc/axp20x-pek.c
@@ -403,6 +403,7 @@ static const struct platform_device_id axp_pek_id_match[] = {
         },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(platform, axp_pek_id_match);
 
 static struct platform_driver axp20x_pek_driver = {
         .probe          = axp20x_pek_probe,
@@ -417,4 +418,3 @@ module_platform_driver(axp20x_pek_driver);
 MODULE_DESCRIPTION("axp20x Power Button");
 MODULE_AUTHOR("Carlo Caione <carlo@caione.org>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:axp20x-pek");
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 6bf82ea8c918..ae473123583b 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
                 return NULL;
         }
 
-        while (buflen > 0) {
+        while (buflen >= sizeof(*union_desc)) {
                 union_desc = (struct usb_cdc_union_desc *)buf;
 
+                if (union_desc->bLength > buflen) {
+                        dev_err(&intf->dev, "Too large descriptor\n");
+                        return NULL;
+                }
+
                 if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
                     union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
                         dev_dbg(&intf->dev, "Found union header\n");
-                        return union_desc;
+
+                        if (union_desc->bLength >= sizeof(*union_desc))
+                                return union_desc;
+
+                        dev_err(&intf->dev,
+                                "Union descriptor to short (%d vs %zd\n)",
+                                union_desc->bLength, sizeof(*union_desc));
+                        return NULL;
                 }
 
                 buflen -= union_desc->bLength;
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 0e761d079dc4..6d6b092e2da9 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1258,6 +1258,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0605", 0 },
         { "ELAN0609", 0 },
         { "ELAN060B", 0 },
+        { "ELAN0611", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 5af0b7d200bc..ee5466a374bf 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1709,8 +1709,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
                 .sensor_pdata = {
                         .sensor_type = rmi_sensor_touchpad,
                         .axis_align.flip_y = true,
-                        /* to prevent cursors jumps: */
-                        .kernel_tracking = true,
+                        .kernel_tracking = false,
                         .topbuttonpad = topbuttonpad,
                 },
                 .f30_data = {
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 34dfee555b20..82e0f0d43d55 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -232,9 +232,10 @@ static int rmi_f30_map_gpios(struct rmi_function *fn,
         unsigned int trackstick_button = BTN_LEFT;
         bool button_mapped = false;
         int i;
+        int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
 
         f30->gpioled_key_map = devm_kcalloc(&fn->dev,
-                                            f30->gpioled_count,
+                                            button_count,
                                             sizeof(f30->gpioled_key_map[0]),
                                             GFP_KERNEL);
         if (!f30->gpioled_key_map) {
@@ -242,7 +243,7 @@ static int rmi_f30_map_gpios(struct rmi_function *fn,
                 return -ENOMEM;
         }
 
-        for (i = 0; i < f30->gpioled_count; i++) {
+        for (i = 0; i < button_count; i++) {
                 if (!rmi_f30_is_valid_button(i, f30->ctrl))
                         continue;
 
diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
index b796e891e2ee..4b8b9d7aa75e 100644
--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -230,13 +230,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 
         /* Walk  this report and pull out the info we need */
         while (i < length) {
-                prefix = report[i];
-
-                /* Skip over prefix */
-                i++;
+                prefix = report[i++];
 
                 /* Determine data size and save the data in the proper variable */
-                size = PREF_SIZE(prefix);
+                size = (1U << PREF_SIZE(prefix)) >> 1;
+                if (i + size > length) {
+                        dev_err(ddev,
+                                "Not enough data (need %d, have %d)\n",
+                                i + size, length);
+                        break;
+                }
+
                 switch (size) {
                 case 1:
                         data = report[i];
@@ -244,8 +248,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
                 case 2:
                         data16 = get_unaligned_le16(&report[i]);
                         break;
-                case 3:
-                        size = 4;
+                case 4:
                         data32 = get_unaligned_le32(&report[i]);
                         break;
                 }
diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 32d2762448aa..b3bbad7d2282 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -72,6 +72,9 @@ struct goodix_ts_data {
 #define GOODIX_REG_CONFIG_DATA          0x8047
 #define GOODIX_REG_ID                   0x8140
 
+#define GOODIX_BUFFER_STATUS_READY      BIT(7)
+#define GOODIX_BUFFER_STATUS_TIMEOUT    20
+
 #define RESOLUTION_LOC          1
 #define MAX_CONTACTS_LOC        5
 #define TRIGGER_LOC             6
@@ -195,35 +198,53 @@ static int goodix_get_cfg_len(u16 id)
 
 static int goodix_ts_read_input_report(struct goodix_ts_data *ts, u8 *data)
 {
+        unsigned long max_timeout;
         int touch_num;
         int error;
 
-        error = goodix_i2c_read(ts->client, GOODIX_READ_COOR_ADDR, data,
-                                GOODIX_CONTACT_SIZE + 1);
-        if (error) {
-                dev_err(&ts->client->dev, "I2C transfer error: %d\n", error);
-                return error;
-        }
+        /*
+         * The 'buffer status' bit, which indicates that the data is valid, is
+         * not set as soon as the interrupt is raised, but slightly after.
+         * This takes around 10 ms to happen, so we poll for 20 ms.
+         */
+        max_timeout = jiffies + msecs_to_jiffies(GOODIX_BUFFER_STATUS_TIMEOUT);
+        do {
+                error = goodix_i2c_read(ts->client, GOODIX_READ_COOR_ADDR,
+                                        data, GOODIX_CONTACT_SIZE + 1);
+                if (error) {
+                        dev_err(&ts->client->dev, "I2C transfer error: %d\n",
+                                        error);
+                        return error;
+                }
 
-        if (!(data[0] & 0x80))
-                return -EAGAIN;
+                if (data[0] & GOODIX_BUFFER_STATUS_READY) {
+                        touch_num = data[0] & 0x0f;
+                        if (touch_num > ts->max_touch_num)
+                                return -EPROTO;
+
+                        if (touch_num > 1) {
+                                data += 1 + GOODIX_CONTACT_SIZE;
+                                error = goodix_i2c_read(ts->client,
+                                                GOODIX_READ_COOR_ADDR +
+                                                        1 + GOODIX_CONTACT_SIZE,
+                                                data,
+                                                GOODIX_CONTACT_SIZE *
+                                                        (touch_num - 1));
+                                if (error)
+                                        return error;
+                        }
+
+                        return touch_num;
+                }
 
-        touch_num = data[0] & 0x0f;
-        if (touch_num > ts->max_touch_num)
-                return -EPROTO;
-
-        if (touch_num > 1) {
-                data += 1 + GOODIX_CONTACT_SIZE;
-                error = goodix_i2c_read(ts->client,
-                                        GOODIX_READ_COOR_ADDR +
-                                                1 + GOODIX_CONTACT_SIZE,
-                                        data,
-                                        GOODIX_CONTACT_SIZE * (touch_num - 1));
-                if (error)
-                        return error;
-        }
+                usleep_range(1000, 2000); /* Poll every 1 - 2 ms */
+        } while (time_before(jiffies, max_timeout));
 
-        return touch_num;
+        /*
+         * The Goodix panel will send spurious interrupts after a
+         * 'finger up' event, which will always cause a timeout.
+         */
+        return 0;
 }
 
 static void goodix_ts_report_touch(struct goodix_ts_data *ts, u8 *coor_data)
diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
index 157fdb4bb2e8..8c6c6178ec12 100644
--- a/drivers/input/touchscreen/stmfts.c
+++ b/drivers/input/touchscreen/stmfts.c
@@ -663,12 +663,10 @@ static int stmfts_probe(struct i2c_client *client,
         sdata->input->open = stmfts_input_open;
         sdata->input->close = stmfts_input_close;
 
+        input_set_capability(sdata->input, EV_ABS, ABS_MT_POSITION_X);
+        input_set_capability(sdata->input, EV_ABS, ABS_MT_POSITION_Y);
         touchscreen_parse_properties(sdata->input, true, &sdata->prop);
 
-        input_set_abs_params(sdata->input, ABS_MT_POSITION_X, 0,
-                                                sdata->prop.max_x, 0, 0);
-        input_set_abs_params(sdata->input, ABS_MT_POSITION_Y, 0,
-                                                sdata->prop.max_y, 0, 0);
         input_set_abs_params(sdata->input, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0);
         input_set_abs_params(sdata->input, ABS_MT_TOUCH_MINOR, 0, 255, 0, 0);
         input_set_abs_params(sdata->input, ABS_MT_ORIENTATION, 0, 255, 0, 0);
diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c
index 7953381d939a..f1043ae71dcc 100644
--- a/drivers/input/touchscreen/ti_am335x_tsc.c
+++ b/drivers/input/touchscreen/ti_am335x_tsc.c
@@ -161,7 +161,7 @@ static void titsc_step_config(struct titsc *ts_dev)
                 break;
         case 5:
                 config |= ts_dev->bit_xp | STEPCONFIG_INP_AN4 |
-                                ts_dev->bit_xn | ts_dev->bit_yp;
+                                STEPCONFIG_XNP | STEPCONFIG_YPN;
                 break;
         case 8:
                 config |= ts_dev->bit_yp | STEPCONFIG_INP(ts_dev->inp_xp);
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 51f8215877f5..8e8874d23717 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2773,14 +2773,16 @@ int __init amd_iommu_init_api(void)
 
 int __init amd_iommu_init_dma_ops(void)
 {
-        swiotlb        = iommu_pass_through ? 1 : 0;
+        swiotlb        = (iommu_pass_through || sme_me_mask) ? 1 : 0;
         iommu_detected = 1;
 
         /*
          * In case we don't initialize SWIOTLB (actually the common case
-         * when AMD IOMMU is enabled), make sure there are global
-         * dma_ops set as a fall-back for devices not handled by this
-         * driver (for example non-PCI devices).
+         * when AMD IOMMU is enabled and SME is not active), make sure there
+         * are global dma_ops set as a fall-back for devices not handled by
+         * this driver (for example non-PCI devices). When SME is active,
+         * make sure that swiotlb variable remains set so the global dma_ops
+         * continue to be SWIOTLB.
          */
         if (!swiotlb)
                 dma_ops = &nommu_dma_ops;
@@ -3046,6 +3048,7 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova,
         mutex_unlock(&domain->api_lock);
 
         domain_flush_tlb_pde(domain);
+        domain_flush_complete(domain);
 
         return unmap_size;
 }
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 382de42b8359..6fe2d0346073 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -874,7 +874,7 @@ static bool copy_device_table(void)
                 hi = readl(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET + 4);
                 entry = (((u64) hi) << 32) + lo;
                 if (last_entry && last_entry != entry) {
-                        pr_err("IOMMU:%d should use the same dev table as others!/n",
+                        pr_err("IOMMU:%d should use the same dev table as others!\n",
                                 iommu->index);
                         return false;
                 }
@@ -882,7 +882,7 @@ static bool copy_device_table(void)
 
                 old_devtb_size = ((entry & ~PAGE_MASK) + 1) << 12;
                 if (old_devtb_size != dev_table_size) {
-                        pr_err("The device table size of IOMMU:%d is not expected!/n",
+                        pr_err("The device table size of IOMMU:%d is not expected!\n",
                                 iommu->index);
                         return false;
                 }
@@ -890,7 +890,7 @@ static bool copy_device_table(void)
 
         old_devtb_phys = entry & PAGE_MASK;
         if (old_devtb_phys >= 0x100000000ULL) {
-                pr_err("The address of old device table is above 4G, not trustworthy!/n");
+                pr_err("The address of old device table is above 4G, not trustworthy!\n");
                 return false;
         }
         old_devtb = memremap(old_devtb_phys, dev_table_size, MEMREMAP_WB);
@@ -901,7 +901,7 @@ static bool copy_device_table(void)
         old_dev_tbl_cpy = (void *)__get_free_pages(gfp_flag,
                                 get_order(dev_table_size));
         if (old_dev_tbl_cpy == NULL) {
-                pr_err("Failed to allocate memory for copying old device table!/n");
+                pr_err("Failed to allocate memory for copying old device table!\n");
                 return false;
         }
 
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index f596fcc32898..25c2c75f5332 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -709,7 +709,7 @@ static const struct dev_pm_ops sysmmu_pm_ops = {
                                 pm_runtime_force_resume)
 };
 
-static const struct of_device_id sysmmu_of_match[] __initconst = {
+static const struct of_device_id sysmmu_of_match[] = {
         { .compatible   = "samsung,exynos-sysmmu", },
         { },
 };
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index d665d0dc16e8..6961fc393f0b 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -245,7 +245,7 @@ static void __arm_v7s_free_table(void *table, int lvl,
 static void __arm_v7s_pte_sync(arm_v7s_iopte *ptep, int num_entries,
                                struct io_pgtable_cfg *cfg)
 {
-        if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA))
+        if (cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)
                 return;
 
         dma_sync_single_for_device(cfg->iommu_dev, __arm_v7s_dma_addr(ptep),
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index bd515be5b380..16d33ac19db0 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -371,7 +371,8 @@ static int mtk_iommu_map(struct iommu_domain *domain, unsigned long iova,
         int ret;
 
         spin_lock_irqsave(&dom->pgtlock, flags);
-        ret = dom->iop->map(dom->iop, iova, paddr, size, prot);
+        ret = dom->iop->map(dom->iop, iova, paddr & DMA_BIT_MASK(32),
+                            size, prot);
         spin_unlock_irqrestore(&dom->pgtlock, flags);
 
         return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e8d89343d613..e88395605e32 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -107,6 +107,10 @@ struct its_node {
 
 #define ITS_ITT_ALIGN           SZ_256
 
+/* The maximum number of VPEID bits supported by VLPI commands */
+#define ITS_MAX_VPEID_BITS      (16)
+#define ITS_MAX_VPEID           (1 << (ITS_MAX_VPEID_BITS))
+
 /* Convert page order to size in bytes */
 #define PAGE_ORDER_TO_SIZE(o)   (PAGE_SIZE << (o))
 
@@ -308,7 +312,7 @@ static void its_encode_size(struct its_cmd_block *cmd, u8 size)
 
 static void its_encode_itt(struct its_cmd_block *cmd, u64 itt_addr)
 {
-        its_mask_encode(&cmd->raw_cmd[2], itt_addr >> 8, 50, 8);
+        its_mask_encode(&cmd->raw_cmd[2], itt_addr >> 8, 51, 8);
 }
 
 static void its_encode_valid(struct its_cmd_block *cmd, int valid)
@@ -318,7 +322,7 @@ static void its_encode_valid(struct its_cmd_block *cmd, int valid)
 
 static void its_encode_target(struct its_cmd_block *cmd, u64 target_addr)
 {
-        its_mask_encode(&cmd->raw_cmd[2], target_addr >> 16, 50, 16);
+        its_mask_encode(&cmd->raw_cmd[2], target_addr >> 16, 51, 16);
 }
 
 static void its_encode_collection(struct its_cmd_block *cmd, u16 col)
@@ -358,7 +362,7 @@ static void its_encode_its_list(struct its_cmd_block *cmd, u16 its_list)
 
 static void its_encode_vpt_addr(struct its_cmd_block *cmd, u64 vpt_pa)
 {
-        its_mask_encode(&cmd->raw_cmd[3], vpt_pa >> 16, 50, 16);
+        its_mask_encode(&cmd->raw_cmd[3], vpt_pa >> 16, 51, 16);
 }
 
 static void its_encode_vpt_size(struct its_cmd_block *cmd, u8 vpt_size)
@@ -1478,9 +1482,9 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser,
         u64 val = its_read_baser(its, baser);
         u64 esz = GITS_BASER_ENTRY_SIZE(val);
         u64 type = GITS_BASER_TYPE(val);
+        u64 baser_phys, tmp;
         u32 alloc_pages;
         void *base;
-        u64 tmp;
 
 retry_alloc_baser:
         alloc_pages = (PAGE_ORDER_TO_SIZE(order) / psz);
@@ -1496,8 +1500,24 @@ retry_alloc_baser:
         if (!base)
                 return -ENOMEM;
 
+        baser_phys = virt_to_phys(base);
+
+        /* Check if the physical address of the memory is above 48bits */
+        if (IS_ENABLED(CONFIG_ARM64_64K_PAGES) && (baser_phys >> 48)) {
+
+                /* 52bit PA is supported only when PageSize=64K */
+                if (psz != SZ_64K) {
+                        pr_err("ITS: no 52bit PA support when psz=%d\n", psz);
+                        free_pages((unsigned long)base, order);
+                        return -ENXIO;
+                }
+
+                /* Convert 52bit PA to 48bit field */
+                baser_phys = GITS_BASER_PHYS_52_to_48(baser_phys);
+        }
+
 retry_baser:
-        val = (virt_to_phys(base)                                |
+        val = (baser_phys                                        |
                 (type << GITS_BASER_TYPE_SHIFT)                  |
                 ((esz - 1) << GITS_BASER_ENTRY_SIZE_SHIFT)       |
                 ((alloc_pages - 1) << GITS_BASER_PAGES_SHIFT)    |
@@ -1582,13 +1602,12 @@ retry_baser:
 
 static bool its_parse_indirect_baser(struct its_node *its,
                                      struct its_baser *baser,
-                                     u32 psz, u32 *order)
+                                     u32 psz, u32 *order, u32 ids)
 {
         u64 tmp = its_read_baser(its, baser);
         u64 type = GITS_BASER_TYPE(tmp);
         u64 esz = GITS_BASER_ENTRY_SIZE(tmp);
         u64 val = GITS_BASER_InnerShareable | GITS_BASER_RaWaWb;
-        u32 ids = its->device_ids;
         u32 new_order = *order;
         bool indirect = false;
 
@@ -1680,9 +1699,13 @@ static int its_alloc_tables(struct its_node *its)
                         continue;
 
                 case GITS_BASER_TYPE_DEVICE:
+                        indirect = its_parse_indirect_baser(its, baser,
+                                                            psz, &order,
+                                                            its->device_ids);
                 case GITS_BASER_TYPE_VCPU:
                         indirect = its_parse_indirect_baser(its, baser,
-                                                            psz, &order);
+                                                            psz, &order,
+                                                            ITS_MAX_VPEID_BITS);
                         break;
                 }
 
@@ -2551,7 +2574,7 @@ static struct irq_chip its_vpe_irq_chip = {
 
 static int its_vpe_id_alloc(void)
 {
-        return ida_simple_get(&its_vpeid_ida, 0, 1 << 16, GFP_KERNEL);
+        return ida_simple_get(&its_vpeid_ida, 0, ITS_MAX_VPEID, GFP_KERNEL);
 }
 
 static void its_vpe_id_free(u16 id)
@@ -2851,7 +2874,7 @@ static int its_init_vpe_domain(void)
                 return -ENOMEM;
         }
 
-        BUG_ON(entries != vpe_proxy.dev->nr_ites);
+        BUG_ON(entries > vpe_proxy.dev->nr_ites);
 
         raw_spin_lock_init(&vpe_proxy.lock);
         vpe_proxy.next_victim = 0;
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 40159ac12ac8..c90976d7e53c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -175,14 +175,13 @@ static void gic_mask_irq(struct irq_data *d)
 
 static void gic_unmask_irq(struct irq_data *d)
 {
-        struct cpumask *affinity = irq_data_get_affinity_mask(d);
         unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
         unsigned int cpu;
 
         write_gic_smask(intr);
 
         gic_clear_pcpu_masks(intr);
-        cpu = cpumask_first_and(affinity, cpu_online_mask);
+        cpu = cpumask_first(irq_data_get_effective_affinity_mask(d));
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
 }
 
@@ -420,13 +419,17 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
                                      irq_hw_number_t hw, unsigned int cpu)
 {
         int intr = GIC_HWIRQ_TO_SHARED(hw);
+        struct irq_data *data;
         unsigned long flags;
 
+        data = irq_get_irq_data(virq);
+
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
         gic_clear_pcpu_masks(intr);
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
+        irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
         return 0;
@@ -645,7 +648,7 @@ static int __init gic_of_init(struct device_node *node,
 
         /* Find the first available CPU vector. */
         i = 0;
-        reserved = (C_SW0 | C_SW1) >> __fls(C_SW0);
+        reserved = (C_SW0 | C_SW1) >> __ffs(C_SW0);
         while (!of_property_read_u32_index(node, "mti,reserved-cpu-vectors",
                                            i++, &cpu_vec))
                 reserved |= BIT(cpu_vec);
@@ -684,11 +687,11 @@ static int __init gic_of_init(struct device_node *node,
 
         gicconfig = read_gic_config();
         gic_shared_intrs = gicconfig & GIC_CONFIG_NUMINTERRUPTS;
-        gic_shared_intrs >>= __fls(GIC_CONFIG_NUMINTERRUPTS);
+        gic_shared_intrs >>= __ffs(GIC_CONFIG_NUMINTERRUPTS);
         gic_shared_intrs = (gic_shared_intrs + 1) * 8;
 
         gic_vpes = gicconfig & GIC_CONFIG_PVPS;
-        gic_vpes >>= __fls(GIC_CONFIG_PVPS);
+        gic_vpes >>= __ffs(GIC_CONFIG_PVPS);
         gic_vpes = gic_vpes + 1;
 
         if (cpu_has_veic) {
diff --git a/drivers/irqchip/irq-tango.c b/drivers/irqchip/irq-tango.c
index bdbb5c0ff7fe..0c085303a583 100644
--- a/drivers/irqchip/irq-tango.c
+++ b/drivers/irqchip/irq-tango.c
@@ -141,7 +141,7 @@ static void __init tangox_irq_init_chip(struct irq_chip_generic *gc,
         for (i = 0; i < 2; i++) {
                 ct[i].chip.irq_ack = irq_gc_ack_set_bit;
                 ct[i].chip.irq_mask = irq_gc_mask_disable_reg;
-                ct[i].chip.irq_mask_ack = irq_gc_mask_disable_reg_and_ack;
+                ct[i].chip.irq_mask_ack = irq_gc_mask_disable_and_ack_set;
                 ct[i].chip.irq_unmask = irq_gc_unmask_enable_reg;
                 ct[i].chip.irq_set_type = tangox_irq_set_type;
                 ct[i].chip.name = gc->domain->name;
diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c
index bbbbe0898233..9a257f969300 100644
--- a/drivers/leds/leds-as3645a.c
+++ b/drivers/leds/leds-as3645a.c
@@ -112,6 +112,10 @@
 #define AS_PEAK_mA_TO_REG(a) \
         ((min_t(u32, AS_PEAK_mA_MAX, a) - 1250) / 250)
 
+/* LED numbers for Devicetree */
+#define AS_LED_FLASH                            0
+#define AS_LED_INDICATOR                        1
+
 enum as_mode {
         AS_MODE_EXT_TORCH = 0 << AS_CONTROL_MODE_SETTING_SHIFT,
         AS_MODE_INDICATOR = 1 << AS_CONTROL_MODE_SETTING_SHIFT,
@@ -491,10 +495,29 @@ static int as3645a_parse_node(struct as3645a *flash,
                               struct device_node *node)
 {
         struct as3645a_config *cfg = &flash->cfg;
+        struct device_node *child;
         const char *name;
         int rval;
 
-        flash->flash_node = of_get_child_by_name(node, "flash");
+        for_each_child_of_node(node, child) {
+                u32 id = 0;
+
+                of_property_read_u32(child, "reg", &id);
+
+                switch (id) {
+                case AS_LED_FLASH:
+                        flash->flash_node = of_node_get(child);
+                        break;
+                case AS_LED_INDICATOR:
+                        flash->indicator_node = of_node_get(child);
+                        break;
+                default:
+                        dev_warn(&flash->client->dev,
+                                 "unknown LED %u encountered, ignoring\n", id);
+                        break;
+                }
+        }
+
         if (!flash->flash_node) {
                 dev_err(&flash->client->dev, "can't find flash node\n");
                 return -ENODEV;
@@ -534,11 +557,10 @@ static int as3645a_parse_node(struct as3645a *flash,
         of_property_read_u32(flash->flash_node, "voltage-reference",
                              &cfg->voltage_reference);
 
-        of_property_read_u32(flash->flash_node, "peak-current-limit",
+        of_property_read_u32(flash->flash_node, "ams,input-max-microamp",
                              &cfg->peak);
         cfg->peak = AS_PEAK_mA_TO_REG(cfg->peak);
 
-        flash->indicator_node = of_get_child_by_name(node, "indicator");
         if (!flash->indicator_node) {
                 dev_warn(&flash->client->dev,
                          "can't find indicator node\n");
@@ -721,6 +743,7 @@ static int as3645a_remove(struct i2c_client *client)
         as3645a_set_control(flash, AS_MODE_EXT_TORCH, false);
 
         v4l2_flash_release(flash->vf);
+        v4l2_flash_release(flash->vfind);
 
         led_classdev_flash_unregister(&flash->fled);
         led_classdev_unregister(&flash->iled_cdev);
diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
index 7d5286b05036..1841d0359bac 100644
--- a/drivers/md/bcache/closure.c
+++ b/drivers/md/bcache/closure.c
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(closure_put);
 void __closure_wake_up(struct closure_waitlist *wait_list)
 {
         struct llist_node *list;
-        struct closure *cl;
+        struct closure *cl, *t;
         struct llist_node *reverse = NULL;
 
         list = llist_del_all(&wait_list->list);
@@ -73,7 +73,7 @@ void __closure_wake_up(struct closure_waitlist *wait_list)
         reverse = llist_reverse_order(list);
 
         /* Then do the wakeups */
-        llist_for_each_entry(cl, reverse, list) {
+        llist_for_each_entry_safe(cl, t, reverse, list) {
                 closure_set_waiting(cl, 0);
                 closure_sub(cl, CLOSURE_WAITING + 1);
         }
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 24eddbdf2ab4..203144762f36 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -149,5 +149,6 @@ static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen
 
 extern atomic_t dm_global_event_nr;
 extern wait_queue_head_t dm_global_eventq;
+void dm_issue_global_event(void);
 
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index a55ffd4f5933..96ab46512e1f 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2466,6 +2466,7 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                 kfree(cipher_api);
                 return ret;
         }
+        kfree(cipher_api);
 
         return 0;
 bad_mem:
@@ -2584,6 +2585,10 @@ static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **ar
                                 ti->error = "Invalid feature value for sector_size";
                                 return -EINVAL;
                         }
+                        if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) {
+                                ti->error = "Device size is not multiple of sector_size feature";
+                                return -EINVAL;
+                        }
                         cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT;
                 } else if (!strcasecmp(opt_string, "iv_large_sectors"))
                         set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 8756a6850431..e52676fa9832 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -477,9 +477,13 @@ static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_si
  * Round up the ptr to an 8-byte boundary.
  */
 #define ALIGN_MASK 7
+static inline size_t align_val(size_t val)
+{
+        return (val + ALIGN_MASK) & ~ALIGN_MASK;
+}
 static inline void *align_ptr(void *ptr)
 {
-        return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK);
+        return (void *)align_val((size_t)ptr);
 }
 
 /*
@@ -505,7 +509,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
         struct hash_cell *hc;
         size_t len, needed = 0;
         struct gendisk *disk;
-        struct dm_name_list *nl, *old_nl = NULL;
+        struct dm_name_list *orig_nl, *nl, *old_nl = NULL;
         uint32_t *event_nr;
 
         down_write(&_hash_lock);
@@ -516,17 +520,15 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
          */
         for (i = 0; i < NUM_BUCKETS; i++) {
                 list_for_each_entry (hc, _name_buckets + i, name_list) {
-                        needed += sizeof(struct dm_name_list);
-                        needed += strlen(hc->name) + 1;
-                        needed += ALIGN_MASK;
-                        needed += (sizeof(uint32_t) + ALIGN_MASK) & ~ALIGN_MASK;
+                        needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);
+                        needed += align_val(sizeof(uint32_t));
                 }
         }
 
         /*
          * Grab our output buffer.
          */
-        nl = get_result_buffer(param, param_size, &len);
+        nl = orig_nl = get_result_buffer(param, param_size, &len);
         if (len < needed) {
                 param->flags |= DM_BUFFER_FULL_FLAG;
                 goto out;
@@ -549,11 +551,16 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
                         strcpy(nl->name, hc->name);
 
                         old_nl = nl;
-                        event_nr = align_ptr(((void *) (nl + 1)) + strlen(hc->name) + 1);
+                        event_nr = align_ptr(nl->name + strlen(hc->name) + 1);
                         *event_nr = dm_get_event_nr(hc->md);
                         nl = align_ptr(event_nr + 1);
                 }
         }
+        /*
+         * If mismatch happens, security may be compromised due to buffer
+         * overflow, so it's better to crash.
+         */
+        BUG_ON((char *)nl - (char *)orig_nl != needed);
 
  out:
         up_write(&_hash_lock);
@@ -1621,7 +1628,8 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
  * which has a variable size, is not used by the function processing
  * the ioctl.
  */
-#define IOCTL_FLAGS_NO_PARAMS   1
+#define IOCTL_FLAGS_NO_PARAMS           1
+#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT  2
 
 /*-----------------------------------------------------------------
  * Implementation of open/close/ioctl on the special char
@@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
                 ioctl_fn fn;
         } _ioctls[] = {
                 {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
-                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all},
+                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},
                 {DM_LIST_DEVICES_CMD, 0, list_devices},
 
-                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create},
-                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove},
-                {DM_DEV_RENAME_CMD, 0, dev_rename},
+                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},
+                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},
+                {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},
                 {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
                 {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
                 {DM_DEV_WAIT_CMD, 0, dev_wait},
@@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
             unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
                 DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
 
+        if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)
+                dm_issue_global_event();
+
         /*
          * Copy the results back to userland.
          */
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5bfe285ea9d1..2245d06d2045 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
         if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
                 return DM_MAPIO_REQUEUE;
 
-        mddev->pers->make_request(mddev, bio);
+        md_handle_request(mddev, bio);
 
         return DM_MAPIO_SUBMITTED;
 }
@@ -3297,11 +3297,10 @@ static const char *__raid_dev_status(struct raid_set *rs, struct md_rdev *rdev,
 static sector_t rs_get_progress(struct raid_set *rs,
                                 sector_t resync_max_sectors, bool *array_in_sync)
 {
-        sector_t r, recovery_cp, curr_resync_completed;
+        sector_t r, curr_resync_completed;
         struct mddev *mddev = &rs->md;
 
         curr_resync_completed = mddev->curr_resync_completed ?: mddev->recovery_cp;
-        recovery_cp = mddev->recovery_cp;
         *array_in_sync = false;
 
         if (rs_is_raid0(rs)) {
@@ -3330,9 +3329,11 @@ static sector_t rs_get_progress(struct raid_set *rs,
                 } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                         r = curr_resync_completed;
                 else
-                        r = recovery_cp;
+                        r = mddev->recovery_cp;
 
-                if (r == MaxSector) {
+                if ((r == MaxSector) ||
+                    (test_bit(MD_RECOVERY_DONE, &mddev->recovery) &&
+                     (mddev->curr_resync_completed == resync_max_sectors))) {
                         /*
                          * Sync complete.
                          */
@@ -3892,7 +3893,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 12, 1},
+        .version = {1, 13, 0},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e54145969c5..4be85324f44d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -52,6 +52,12 @@ static struct workqueue_struct *deferred_remove_workqueue;
 atomic_t dm_global_event_nr = ATOMIC_INIT(0);
 DECLARE_WAIT_QUEUE_HEAD(dm_global_eventq);
 
+void dm_issue_global_event(void)
+{
+        atomic_inc(&dm_global_event_nr);
+        wake_up(&dm_global_eventq);
+}
+
 /*
  * One of these is allocated per bio.
  */
@@ -1865,9 +1871,8 @@ static void event_callback(void *context)
         dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
 
         atomic_inc(&md->event_nr);
-        atomic_inc(&dm_global_event_nr);
         wake_up(&md->eventq);
-        wake_up(&dm_global_eventq);
+        dm_issue_global_event();
 }
 
 /*
@@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         }
 
         map = __bind(md, table, &limits);
+        dm_issue_global_event();
 
 out:
         mutex_unlock(&md->suspend_lock);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08fcaebc61bd..0ff1bbf6c90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -266,6 +266,37 @@ static DEFINE_SPINLOCK(all_mddevs_lock);
  * call has finished, the bio has been linked into some internal structure
  * and so is visible to ->quiesce(), so we don't need the refcount any more.
  */
+void md_handle_request(struct mddev *mddev, struct bio *bio)
+{
+check_suspended:
+        rcu_read_lock();
+        if (mddev->suspended) {
+                DEFINE_WAIT(__wait);
+                for (;;) {
+                        prepare_to_wait(&mddev->sb_wait, &__wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (!mddev->suspended)
+                                break;
+                        rcu_read_unlock();
+                        schedule();
+                        rcu_read_lock();
+                }
+                finish_wait(&mddev->sb_wait, &__wait);
+        }
+        atomic_inc(&mddev->active_io);
+        rcu_read_unlock();
+
+        if (!mddev->pers->make_request(mddev, bio)) {
+                atomic_dec(&mddev->active_io);
+                wake_up(&mddev->sb_wait);
+                goto check_suspended;
+        }
+
+        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
+                wake_up(&mddev->sb_wait);
+}
+EXPORT_SYMBOL(md_handle_request);
+
 static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
 {
         const int rw = bio_data_dir(bio);
@@ -285,23 +316,6 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
                 bio_endio(bio);
                 return BLK_QC_T_NONE;
         }
-check_suspended:
-        rcu_read_lock();
-        if (mddev->suspended) {
-                DEFINE_WAIT(__wait);
-                for (;;) {
-                        prepare_to_wait(&mddev->sb_wait, &__wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        if (!mddev->suspended)
-                                break;
-                        rcu_read_unlock();
-                        schedule();
-                        rcu_read_lock();
-                }
-                finish_wait(&mddev->sb_wait, &__wait);
-        }
-        atomic_inc(&mddev->active_io);
-        rcu_read_unlock();
 
         /*
          * save the sectors now since our bio can
@@ -310,20 +324,14 @@ check_suspended:
         sectors = bio_sectors(bio);
         /* bio could be mergeable after passing to underlayer */
         bio->bi_opf &= ~REQ_NOMERGE;
-        if (!mddev->pers->make_request(mddev, bio)) {
-                atomic_dec(&mddev->active_io);
-                wake_up(&mddev->sb_wait);
-                goto check_suspended;
-        }
+
+        md_handle_request(mddev, bio);
 
         cpu = part_stat_lock();
         part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
         part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
         part_stat_unlock();
 
-        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
-                wake_up(&mddev->sb_wait);
-
         return BLK_QC_T_NONE;
 }
 
@@ -439,16 +447,22 @@ static void md_submit_flush_data(struct work_struct *ws)
         struct mddev *mddev = container_of(ws, struct mddev, flush_work);
         struct bio *bio = mddev->flush_bio;
 
+        /*
+         * must reset flush_bio before calling into md_handle_request to avoid a
+         * deadlock, because other bios passed md_handle_request suspend check
+         * could wait for this and below md_handle_request could wait for those
+         * bios because of suspend check
+         */
+        mddev->flush_bio = NULL;
+        wake_up(&mddev->sb_wait);
+
         if (bio->bi_iter.bi_size == 0)
                 /* an empty barrier - all done */
                 bio_endio(bio);
         else {
                 bio->bi_opf &= ~REQ_PREFLUSH;
-                mddev->pers->make_request(mddev, bio);
+                md_handle_request(mddev, bio);
         }
-
-        mddev->flush_bio = NULL;
-        wake_up(&mddev->sb_wait);
 }
 
 void md_flush_request(struct mddev *mddev, struct bio *bio)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 561d22b9a9a8..d8287d3cd1bf 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -692,6 +692,7 @@ extern void md_stop_writes(struct mddev *mddev);
 extern int md_rdev_init(struct md_rdev *rdev);
 extern void md_rdev_clear(struct md_rdev *rdev);
 
+extern void md_handle_request(struct mddev *mddev, struct bio *bio);
 extern void mddev_suspend(struct mddev *mddev);
 extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 076409455b60..928e24a07133 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6575,14 +6575,17 @@ static ssize_t
 raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
 {
         struct r5conf *conf;
-        unsigned long new;
+        unsigned int new;
         int err;
         struct r5worker_group *new_groups, *old_groups;
         int group_cnt, worker_cnt_per_group;
 
         if (len >= PAGE_SIZE)
                 return -EINVAL;
-        if (kstrtoul(page, 10, &new))
+        if (kstrtouint(page, 10, &new))
+                return -EINVAL;
+        /* 8192 should be big enough */
+        if (new > 8192)
                 return -EINVAL;
 
         err = mddev_lock(mddev);
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index eed6c397d840..f8a808d45034 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1797,12 +1797,19 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
          */
         switch (msg->msg[1]) {
         case CEC_MSG_GET_CEC_VERSION:
-        case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
         case CEC_MSG_ABORT:
         case CEC_MSG_GIVE_DEVICE_POWER_STATUS:
-        case CEC_MSG_GIVE_PHYSICAL_ADDR:
         case CEC_MSG_GIVE_OSD_NAME:
+                /*
+                 * These messages reply with a directed message, so ignore if
+                 * the initiator is Unregistered.
+                 */
+                if (!adap->passthrough && from_unregistered)
+                        return 0;
+                /* Fall through */
+        case CEC_MSG_GIVE_DEVICE_VENDOR_ID:
         case CEC_MSG_GIVE_FEATURES:
+        case CEC_MSG_GIVE_PHYSICAL_ADDR:
                 /*
                  * Skip processing these messages if the passthrough mode
                  * is on.
@@ -1810,7 +1817,7 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
                 if (adap->passthrough)
                         goto skip_processing;
                 /* Ignore if addressing is wrong */
-                if (is_broadcast || from_unregistered)
+                if (is_broadcast)
                         return 0;
                 break;
 
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 2fcba1616168..9139d01ba7ed 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -141,22 +141,39 @@ struct dvb_frontend_private {
 static void dvb_frontend_invoke_release(struct dvb_frontend *fe,
                                         void (*release)(struct dvb_frontend *fe));
 
-static void dvb_frontend_free(struct kref *ref)
+static void __dvb_frontend_free(struct dvb_frontend *fe)
 {
-        struct dvb_frontend *fe =
-                container_of(ref, struct dvb_frontend, refcount);
         struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
+        if (!fepriv)
+                return;
+
         dvb_free_device(fepriv->dvbdev);
 
         dvb_frontend_invoke_release(fe, fe->ops.release);
 
         kfree(fepriv);
+        fe->frontend_priv = NULL;
+}
+
+static void dvb_frontend_free(struct kref *ref)
+{
+        struct dvb_frontend *fe =
+                container_of(ref, struct dvb_frontend, refcount);
+
+        __dvb_frontend_free(fe);
 }
 
 static void dvb_frontend_put(struct dvb_frontend *fe)
 {
-        kref_put(&fe->refcount, dvb_frontend_free);
+        /*
+         * Check if the frontend was registered, as otherwise
+         * kref was not initialized yet.
+         */
+        if (fe->frontend_priv)
+                kref_put(&fe->refcount, dvb_frontend_free);
+        else
+                __dvb_frontend_free(fe);
 }
 
 static void dvb_frontend_get(struct dvb_frontend *fe)
diff --git a/drivers/media/dvb-frontends/dib3000mc.c b/drivers/media/dvb-frontends/dib3000mc.c
index 224283fe100a..4d086a7248e9 100644
--- a/drivers/media/dvb-frontends/dib3000mc.c
+++ b/drivers/media/dvb-frontends/dib3000mc.c
@@ -55,29 +55,57 @@ struct dib3000mc_state {
 
 static u16 dib3000mc_read_word(struct dib3000mc_state *state, u16 reg)
 {
-        u8 wb[2] = { (reg >> 8) | 0x80, reg & 0xff };
-        u8 rb[2];
         struct i2c_msg msg[2] = {
-                { .addr = state->i2c_addr >> 1, .flags = 0,        .buf = wb, .len = 2 },
-                { .addr = state->i2c_addr >> 1, .flags = I2C_M_RD, .buf = rb, .len = 2 },
+                { .addr = state->i2c_addr >> 1, .flags = 0,        .len = 2 },
+                { .addr = state->i2c_addr >> 1, .flags = I2C_M_RD, .len = 2 },
         };
+        u16 word;
+        u8 *b;
+
+        b = kmalloc(4, GFP_KERNEL);
+        if (!b)
+                return 0;
+
+        b[0] = (reg >> 8) | 0x80;
+        b[1] = reg;
+        b[2] = 0;
+        b[3] = 0;
+
+        msg[0].buf = b;
+        msg[1].buf = b + 2;
 
         if (i2c_transfer(state->i2c_adap, msg, 2) != 2)
                 dprintk("i2c read error on %d\n",reg);
 
-        return (rb[0] << 8) | rb[1];
+        word = (b[2] << 8) | b[3];
+        kfree(b);
+
+        return word;
 }
 
 static int dib3000mc_write_word(struct dib3000mc_state *state, u16 reg, u16 val)
 {
-        u8 b[4] = {
-                (reg >> 8) & 0xff, reg & 0xff,
-                (val >> 8) & 0xff, val & 0xff,
-        };
         struct i2c_msg msg = {
-                .addr = state->i2c_addr >> 1, .flags = 0, .buf = b, .len = 4
+                .addr = state->i2c_addr >> 1, .flags = 0, .len = 4
         };
-        return i2c_transfer(state->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0;
+        int rc;
+        u8 *b;
+
+        b = kmalloc(4, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
+        b[0] = reg >> 8;
+        b[1] = reg;
+        b[2] = val >> 8;
+        b[3] = val;
+
+        msg.buf = b;
+
+        rc = i2c_transfer(state->i2c_adap, &msg, 1) != 1 ? -EREMOTEIO : 0;
+        kfree(b);
+
+        return rc;
 }
 
 static int dib3000mc_identify(struct dib3000mc_state *state)
diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
index 7bec3e028bee..5553b89b804e 100644
--- a/drivers/media/dvb-frontends/dvb-pll.c
+++ b/drivers/media/dvb-frontends/dvb-pll.c
@@ -753,13 +753,19 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
                                     struct i2c_adapter *i2c,
                                     unsigned int pll_desc_id)
 {
-        u8 b1 [] = { 0 };
-        struct i2c_msg msg = { .addr = pll_addr, .flags = I2C_M_RD,
-                               .buf = b1, .len = 1 };
+        u8 *b1;
+        struct i2c_msg msg = { .addr = pll_addr, .flags = I2C_M_RD, .len = 1 };
         struct dvb_pll_priv *priv = NULL;
         int ret;
         const struct dvb_pll_desc *desc;
 
+        b1 = kmalloc(1, GFP_KERNEL);
+        if (!b1)
+                return NULL;
+
+        b1[0] = 0;
+        msg.buf = b1;
+
         if ((id[dvb_pll_devcount] > DVB_PLL_UNDEFINED) &&
             (id[dvb_pll_devcount] < ARRAY_SIZE(pll_list)))
                 pll_desc_id = id[dvb_pll_devcount];
@@ -773,15 +779,19 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
                         fe->ops.i2c_gate_ctrl(fe, 1);
 
                 ret = i2c_transfer (i2c, &msg, 1);
-                if (ret != 1)
+                if (ret != 1) {
+                        kfree(b1);
                         return NULL;
+                }
                 if (fe->ops.i2c_gate_ctrl)
                              fe->ops.i2c_gate_ctrl(fe, 0);
         }
 
         priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL);
-        if (priv == NULL)
+        if (!priv) {
+                kfree(b1);
                 return NULL;
+        }
 
         priv->pll_i2c_address = pll_addr;
         priv->i2c = i2c;
@@ -811,6 +821,8 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
                                 "insmod option" : "autodetected");
         }
 
+        kfree(b1);
+
         return fe;
 }
 EXPORT_SYMBOL(dvb_pll_attach);
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 7e7cc49b8674..3c4f7fa7b9d8 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -112,7 +112,7 @@ config VIDEO_PXA27x
 
 config VIDEO_QCOM_CAMSS
         tristate "Qualcomm 8x16 V4L2 Camera Subsystem driver"
-        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && HAS_DMA
         depends on (ARCH_QCOM && IOMMU_DMA) || COMPILE_TEST
         select VIDEOBUF2_DMA_SG
         select V4L2_FWNODE
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
index b21b3c2dc77f..b22d2dfcd3c2 100644
--- a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
@@ -2660,7 +2660,7 @@ static int vfe_get_selection(struct v4l2_subdev *sd,
  *
  * Return -EINVAL or zero on success
  */
-int vfe_set_selection(struct v4l2_subdev *sd,
+static int vfe_set_selection(struct v4l2_subdev *sd,
                              struct v4l2_subdev_pad_config *cfg,
                              struct v4l2_subdev_selection *sel)
 {
diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
index 68933d208063..9b2a401a4891 100644
--- a/drivers/media/platform/qcom/venus/helpers.c
+++ b/drivers/media/platform/qcom/venus/helpers.c
@@ -682,6 +682,7 @@ void venus_helper_vb2_stop_streaming(struct vb2_queue *q)
                         hfi_session_abort(inst);
 
                 load_scale_clocks(core);
+                INIT_LIST_HEAD(&inst->registeredbufs);
         }
 
         venus_helper_buffers_done(inst, VB2_BUF_STATE_ERROR);
diff --git a/drivers/media/platform/s5p-cec/exynos_hdmi_cecctrl.c b/drivers/media/platform/s5p-cec/exynos_hdmi_cecctrl.c
index 1edf667d562a..146ae6f25cdb 100644
--- a/drivers/media/platform/s5p-cec/exynos_hdmi_cecctrl.c
+++ b/drivers/media/platform/s5p-cec/exynos_hdmi_cecctrl.c
@@ -172,7 +172,8 @@ u32 s5p_cec_get_status(struct s5p_cec_dev *cec)
 {
         u32 status = 0;
 
-        status = readb(cec->reg + S5P_CEC_STATUS_0);
+        status = readb(cec->reg + S5P_CEC_STATUS_0) & 0xf;
+        status |= (readb(cec->reg + S5P_CEC_TX_STAT1) & 0xf) << 4;
         status |= readb(cec->reg + S5P_CEC_STATUS_1) << 8;
         status |= readb(cec->reg + S5P_CEC_STATUS_2) << 16;
         status |= readb(cec->reg + S5P_CEC_STATUS_3) << 24;
diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c
index 58d200e7c838..8837e2678bde 100644
--- a/drivers/media/platform/s5p-cec/s5p_cec.c
+++ b/drivers/media/platform/s5p-cec/s5p_cec.c
@@ -92,7 +92,10 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv)
         dev_dbg(cec->dev, "irq received\n");
 
         if (status & CEC_STATUS_TX_DONE) {
-                if (status & CEC_STATUS_TX_ERROR) {
+                if (status & CEC_STATUS_TX_NACK) {
+                        dev_dbg(cec->dev, "CEC_STATUS_TX_NACK set\n");
+                        cec->tx = STATE_NACK;
+                } else if (status & CEC_STATUS_TX_ERROR) {
                         dev_dbg(cec->dev, "CEC_STATUS_TX_ERROR set\n");
                         cec->tx = STATE_ERROR;
                 } else {
@@ -135,6 +138,12 @@ static irqreturn_t s5p_cec_irq_handler_thread(int irq, void *priv)
                 cec_transmit_done(cec->adap, CEC_TX_STATUS_OK, 0, 0, 0, 0);
                 cec->tx = STATE_IDLE;
                 break;
+        case STATE_NACK:
+                cec_transmit_done(cec->adap,
+                        CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_NACK,
+                        0, 1, 0, 0);
+                cec->tx = STATE_IDLE;
+                break;
         case STATE_ERROR:
                 cec_transmit_done(cec->adap,
                         CEC_TX_STATUS_MAX_RETRIES | CEC_TX_STATUS_ERROR,
diff --git a/drivers/media/platform/s5p-cec/s5p_cec.h b/drivers/media/platform/s5p-cec/s5p_cec.h
index 8bcd8dc1aeb9..86ded522ef27 100644
--- a/drivers/media/platform/s5p-cec/s5p_cec.h
+++ b/drivers/media/platform/s5p-cec/s5p_cec.h
@@ -35,6 +35,7 @@
 #define CEC_STATUS_TX_TRANSFERRING      (1 << 1)
 #define CEC_STATUS_TX_DONE              (1 << 2)
 #define CEC_STATUS_TX_ERROR             (1 << 3)
+#define CEC_STATUS_TX_NACK              (1 << 4)
 #define CEC_STATUS_TX_BYTES             (0xFF << 8)
 #define CEC_STATUS_RX_RUNNING           (1 << 16)
 #define CEC_STATUS_RX_RECEIVING         (1 << 17)
@@ -55,6 +56,7 @@ enum cec_state {
         STATE_IDLE,
         STATE_BUSY,
         STATE_DONE,
+        STATE_NACK,
         STATE_ERROR
 };
 
diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index ed43a4212479..129b558acc92 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -245,5 +245,5 @@ module_init(ir_sharp_decode_init);
 module_exit(ir_sharp_decode_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("Sharp IR protocol decoder");
diff --git a/drivers/media/tuners/mt2060.c b/drivers/media/tuners/mt2060.c
index 2e487f9a2cc3..4983eeb39f36 100644
--- a/drivers/media/tuners/mt2060.c
+++ b/drivers/media/tuners/mt2060.c
@@ -38,41 +38,74 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
 static int mt2060_readreg(struct mt2060_priv *priv, u8 reg, u8 *val)
 {
         struct i2c_msg msg[2] = {
-                { .addr = priv->cfg->i2c_address, .flags = 0,        .buf = &reg, .len = 1 },
-                { .addr = priv->cfg->i2c_address, .flags = I2C_M_RD, .buf = val,  .len = 1 },
+                { .addr = priv->cfg->i2c_address, .flags = 0, .len = 1 },
+                { .addr = priv->cfg->i2c_address, .flags = I2C_M_RD, .len = 1 },
         };
+        int rc = 0;
+        u8 *b;
+
+        b = kmalloc(2, GFP_KERNEL);
+        if (!b)
+                return -ENOMEM;
+
+        b[0] = reg;
+        b[1] = 0;
+
+        msg[0].buf = b;
+        msg[1].buf = b + 1;
 
         if (i2c_transfer(priv->i2c, msg, 2) != 2) {
                 printk(KERN_WARNING "mt2060 I2C read failed\n");
-                return -EREMOTEIO;
+                rc = -EREMOTEIO;
         }
-        return 0;
+        *val = b[1];
+        kfree(b);
+
+        return rc;
 }
 
 // Writes a single register
 static int mt2060_writereg(struct mt2060_priv *priv, u8 reg, u8 val)
 {
-        u8 buf[2] = { reg, val };
         struct i2c_msg msg = {
-                .addr = priv->cfg->i2c_address, .flags = 0, .buf = buf, .len = 2
+                .addr = priv->cfg->i2c_address, .flags = 0, .len = 2
         };
+        u8 *buf;
+        int rc = 0;
+
+        buf = kmalloc(2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = reg;
+        buf[1] = val;
+
+        msg.buf = buf;
 
         if (i2c_transfer(priv->i2c, &msg, 1) != 1) {
                 printk(KERN_WARNING "mt2060 I2C write failed\n");
-                return -EREMOTEIO;
+                rc = -EREMOTEIO;
         }
-        return 0;
+        kfree(buf);
+        return rc;
 }
 
 // Writes a set of consecutive registers
 static int mt2060_writeregs(struct mt2060_priv *priv,u8 *buf, u8 len)
 {
         int rem, val_len;
-        u8 xfer_buf[16];
+        u8 *xfer_buf;
+        int rc = 0;
         struct i2c_msg msg = {
-                .addr = priv->cfg->i2c_address, .flags = 0, .buf = xfer_buf
+                .addr = priv->cfg->i2c_address, .flags = 0
         };
 
+        xfer_buf = kmalloc(16, GFP_KERNEL);
+        if (!xfer_buf)
+                return -ENOMEM;
+
+        msg.buf = xfer_buf;
+
         for (rem = len - 1; rem > 0; rem -= priv->i2c_max_regs) {
                 val_len = min_t(int, rem, priv->i2c_max_regs);
                 msg.len = 1 + val_len;
@@ -81,11 +114,13 @@ static int mt2060_writeregs(struct mt2060_priv *priv,u8 *buf, u8 len)
 
                 if (i2c_transfer(priv->i2c, &msg, 1) != 1) {
                         printk(KERN_WARNING "mt2060 I2C write failed (len=%i)\n", val_len);
-                        return -EREMOTEIO;
+                        rc = -EREMOTEIO;
+                        break;
                 }
         }
 
-        return 0;
+        kfree(xfer_buf);
+        return rc;
 }
 
 // Initialisation sequences
diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c
index 5dba23ca2e5f..dc9bc1807fdf 100644
--- a/drivers/misc/cxl/cxllib.c
+++ b/drivers/misc/cxl/cxllib.c
@@ -219,8 +219,17 @@ int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags)
 
         down_read(&mm->mmap_sem);
 
-        for (dar = addr; dar < addr + size; dar += page_size) {
-                if (!vma || dar < vma->vm_start || dar > vma->vm_end) {
+        vma = find_vma(mm, addr);
+        if (!vma) {
+                pr_err("Can't find vma for addr %016llx\n", addr);
+                rc = -EFAULT;
+                goto out;
+        }
+        /* get the size of the pages allocated */
+        page_size = vma_kernel_pagesize(vma);
+
+        for (dar = (addr & ~(page_size - 1)); dar < (addr + size); dar += page_size) {
+                if (dar < vma->vm_start || dar >= vma->vm_end) {
                         vma = find_vma(mm, addr);
                         if (!vma) {
                                 pr_err("Can't find vma for addr %016llx\n", addr);
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index c8307e8b4c16..0ccccbaf530d 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -127,6 +127,8 @@
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 
+#define MEI_DEV_ID_GLK        0x319A  /* Gemini Lake */
+
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
 #define MEI_DEV_ID_KBP_2      0xA2BB  /* Kaby Point 2 */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 4ff40d319676..78b3172c8e6e 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -93,6 +93,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
+
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 
@@ -226,12 +228,15 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         /*
-        * For not wake-able HW runtime pm framework
-        * can't be used on pci device level.
-        * Use domain runtime pm callbacks instead.
-        */
-        if (!pci_dev_run_wake(pdev))
-                mei_me_set_pm_domain(dev);
+         * ME maps runtime suspend/resume to D0i states,
+         * hence we need to go around native PCI runtime service which
+         * eventually brings the device into D3cold/hot state,
+         * but the mei device cannot wake up from D3 unlike from D0i3.
+         * To get around the PCI device native runtime pm,
+         * ME uses runtime pm domain handlers which take precedence
+         * over the driver's pm handlers.
+         */
+        mei_me_set_pm_domain(dev);
 
         if (mei_pg_is_enabled(dev))
                 pm_runtime_put_noidle(&pdev->dev);
@@ -271,8 +276,7 @@ static void mei_me_shutdown(struct pci_dev *pdev)
         dev_dbg(&pdev->dev, "shutdown\n");
         mei_stop(dev);
 
-        if (!pci_dev_run_wake(pdev))
-                mei_me_unset_pm_domain(dev);
+        mei_me_unset_pm_domain(dev);
 
         mei_disable_interrupts(dev);
         free_irq(pdev->irq, dev);
@@ -300,8 +304,7 @@ static void mei_me_remove(struct pci_dev *pdev)
         dev_dbg(&pdev->dev, "stop\n");
         mei_stop(dev);
 
-        if (!pci_dev_run_wake(pdev))
-                mei_me_unset_pm_domain(dev);
+        mei_me_unset_pm_domain(dev);
 
         mei_disable_interrupts(dev);
 
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index e38a5f144373..0566f9bfa7de 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -144,12 +144,14 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         /*
-        * For not wake-able HW runtime pm framework
-        * can't be used on pci device level.
-        * Use domain runtime pm callbacks instead.
-        */
-        if (!pci_dev_run_wake(pdev))
-                mei_txe_set_pm_domain(dev);
+         * TXE maps runtime suspend/resume to own power gating states,
+         * hence we need to go around native PCI runtime service which
+         * eventually brings the device into D3cold/hot state.
+         * But the TXE device cannot wake up from D3 unlike from own
+         * power gating. To get around PCI device native runtime pm,
+         * TXE uses runtime pm domain handlers which take precedence.
+         */
+        mei_txe_set_pm_domain(dev);
 
         pm_runtime_put_noidle(&pdev->dev);
 
@@ -186,8 +188,7 @@ static void mei_txe_shutdown(struct pci_dev *pdev)
         dev_dbg(&pdev->dev, "shutdown\n");
         mei_stop(dev);
 
-        if (!pci_dev_run_wake(pdev))
-                mei_txe_unset_pm_domain(dev);
+        mei_txe_unset_pm_domain(dev);
 
         mei_disable_interrupts(dev);
         free_irq(pdev->irq, dev);
@@ -215,8 +216,7 @@ static void mei_txe_remove(struct pci_dev *pdev)
 
         mei_stop(dev);
 
-        if (!pci_dev_run_wake(pdev))
-                mei_txe_unset_pm_domain(dev);
+        mei_txe_unset_pm_domain(dev);
 
         mei_disable_interrupts(dev);
         free_irq(pdev->irq, dev);
@@ -318,15 +318,7 @@ static int mei_txe_pm_runtime_suspend(struct device *device)
         else
                 ret = -EAGAIN;
 
-        /*
-         * If everything is okay we're about to enter PCI low
-         * power state (D3) therefor we need to disable the
-         * interrupts towards host.
-         * However if device is not wakeable we do not enter
-         * D-low state and we need to keep the interrupt kicking
-         */
-        if (!ret && pci_dev_run_wake(pdev))
-                mei_disable_interrupts(dev);
+        /* keep irq on we are staying in D0 */
 
         dev_dbg(&pdev->dev, "rpm: txe: runtime suspend ret=%d\n", ret);
 
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 29fc1e662891..2ad7b5c69156 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1634,8 +1634,6 @@ static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
         }
 
         mqrq->areq.mrq = &brq->mrq;
-
-        mmc_queue_bounce_pre(mqrq);
 }
 
 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
@@ -1829,7 +1827,6 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 brq = &mq_rq->brq;
                 old_req = mmc_queue_req_to_req(mq_rq);
                 type = rq_data_dir(old_req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
-                mmc_queue_bounce_post(mq_rq);
 
                 switch (status) {
                 case MMC_BLK_SUCCESS:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a7eb623f8daa..36217ad5e9b1 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1286,6 +1286,23 @@ out_err:
         return err;
 }
 
+static void mmc_select_driver_type(struct mmc_card *card)
+{
+        int card_drv_type, drive_strength, drv_type;
+
+        card_drv_type = card->ext_csd.raw_driver_strength |
+                        mmc_driver_type_mask(0);
+
+        drive_strength = mmc_select_drive_strength(card,
+                                                   card->ext_csd.hs200_max_dtr,
+                                                   card_drv_type, &drv_type);
+
+        card->drive_strength = drive_strength;
+
+        if (drv_type)
+                mmc_set_driver_type(card->host, drv_type);
+}
+
 static int mmc_select_hs400es(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
@@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc_card *card)
                 goto out_err;
         }
 
+        mmc_select_driver_type(card);
+
         /* Switch card to HS400 */
         val = EXT_CSD_TIMING_HS400 |
               card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
@@ -1374,23 +1393,6 @@ out_err:
         return err;
 }
 
-static void mmc_select_driver_type(struct mmc_card *card)
-{
-        int card_drv_type, drive_strength, drv_type;
-
-        card_drv_type = card->ext_csd.raw_driver_strength |
-                        mmc_driver_type_mask(0);
-
-        drive_strength = mmc_select_drive_strength(card,
-                                                   card->ext_csd.hs200_max_dtr,
-                                                   card_drv_type, &drv_type);
-
-        card->drive_strength = drive_strength;
-
-        if (drv_type)
-                mmc_set_driver_type(card->host, drv_type);
-}
-
 /*
  * For device supporting HS200 mode, the following sequence
  * should be done before executing the tuning process.
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index 74c663b1c0a7..0a4e77a5ba33 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -23,8 +23,6 @@
 #include "core.h"
 #include "card.h"
 
-#define MMC_QUEUE_BOUNCESZ      65536
-
 /*
  * Prepare a MMC request. This just filters out odd stuff.
  */
@@ -150,26 +148,6 @@ static void mmc_queue_setup_discard(struct request_queue *q,
                 queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, q);
 }
 
-static unsigned int mmc_queue_calc_bouncesz(struct mmc_host *host)
-{
-        unsigned int bouncesz = MMC_QUEUE_BOUNCESZ;
-
-        if (host->max_segs != 1 || (host->caps & MMC_CAP_NO_BOUNCE_BUFF))
-                return 0;
-
-        if (bouncesz > host->max_req_size)
-                bouncesz = host->max_req_size;
-        if (bouncesz > host->max_seg_size)
-                bouncesz = host->max_seg_size;
-        if (bouncesz > host->max_blk_count * 512)
-                bouncesz = host->max_blk_count * 512;
-
-        if (bouncesz <= 512)
-                return 0;
-
-        return bouncesz;
-}
-
 /**
  * mmc_init_request() - initialize the MMC-specific per-request data
  * @q: the request queue
@@ -184,26 +162,9 @@ static int mmc_init_request(struct request_queue *q, struct request *req,
         struct mmc_card *card = mq->card;
         struct mmc_host *host = card->host;
 
-        if (card->bouncesz) {
-                mq_rq->bounce_buf = kmalloc(card->bouncesz, gfp);
-                if (!mq_rq->bounce_buf)
-                        return -ENOMEM;
-                if (card->bouncesz > 512) {
-                        mq_rq->sg = mmc_alloc_sg(1, gfp);
-                        if (!mq_rq->sg)
-                                return -ENOMEM;
-                        mq_rq->bounce_sg = mmc_alloc_sg(card->bouncesz / 512,
-                                                        gfp);
-                        if (!mq_rq->bounce_sg)
-                                return -ENOMEM;
-                }
-        } else {
-                mq_rq->bounce_buf = NULL;
-                mq_rq->bounce_sg = NULL;
-                mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
-                if (!mq_rq->sg)
-                        return -ENOMEM;
-        }
+        mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
+        if (!mq_rq->sg)
+                return -ENOMEM;
 
         return 0;
 }
@@ -212,13 +173,6 @@ static void mmc_exit_request(struct request_queue *q, struct request *req)
 {
         struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
 
-        /* It is OK to kfree(NULL) so this will be smooth */
-        kfree(mq_rq->bounce_sg);
-        mq_rq->bounce_sg = NULL;
-
-        kfree(mq_rq->bounce_buf);
-        mq_rq->bounce_buf = NULL;
-
         kfree(mq_rq->sg);
         mq_rq->sg = NULL;
 }
@@ -242,12 +196,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
                 limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
 
-        /*
-         * mmc_init_request() depends on card->bouncesz so it must be calculated
-         * before blk_init_allocated_queue() starts allocating requests.
-         */
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
-
         mq->card = card;
         mq->queue = blk_alloc_queue(GFP_KERNEL);
         if (!mq->queue)
@@ -271,17 +219,11 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_can_erase(card))
                 mmc_queue_setup_discard(mq->queue, card);
 
-        if (card->bouncesz) {
-                blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segments(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segment_size(mq->queue, card->bouncesz);
-        } else {
-                blk_queue_bounce_limit(mq->queue, limit);
-                blk_queue_max_hw_sectors(mq->queue,
-                        min(host->max_blk_count, host->max_req_size / 512));
-                blk_queue_max_segments(mq->queue, host->max_segs);
-                blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-        }
+        blk_queue_bounce_limit(mq->queue, limit);
+        blk_queue_max_hw_sectors(mq->queue,
+                min(host->max_blk_count, host->max_req_size / 512));
+        blk_queue_max_segments(mq->queue, host->max_segs);
+        blk_queue_max_segment_size(mq->queue, host->max_seg_size);
 
         sema_init(&mq->thread_sem, 1);
 
@@ -370,56 +312,7 @@ void mmc_queue_resume(struct mmc_queue *mq)
  */
 unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
 {
-        unsigned int sg_len;
-        size_t buflen;
-        struct scatterlist *sg;
         struct request *req = mmc_queue_req_to_req(mqrq);
-        int i;
-
-        if (!mqrq->bounce_buf)
-                return blk_rq_map_sg(mq->queue, req, mqrq->sg);
-
-        sg_len = blk_rq_map_sg(mq->queue, req, mqrq->bounce_sg);
-
-        mqrq->bounce_sg_len = sg_len;
-
-        buflen = 0;
-        for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
-                buflen += sg->length;
-
-        sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
-
-        return 1;
-}
-
-/*
- * If writing, bounce the data to the buffer before the request
- * is sent to the host driver
- */
-void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != WRITE)
-                return;
-
-        sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
-}
-
-/*
- * If reading, bounce the data from the buffer after the request
- * has been handled by the host driver
- */
-void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != READ)
-                return;
 
-        sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
+        return blk_rq_map_sg(mq->queue, req, mqrq->sg);
 }
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 04fc89360a7a..f18d3f656baa 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -49,9 +49,6 @@ enum mmc_drv_op {
 struct mmc_queue_req {
         struct mmc_blk_request  brq;
         struct scatterlist      *sg;
-        char                    *bounce_buf;
-        struct scatterlist      *bounce_sg;
-        unsigned int            bounce_sg_len;
         struct mmc_async_req    areq;
         enum mmc_drv_op         drv_op;
         int                     drv_op_result;
@@ -81,11 +78,8 @@ extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *,
 extern void mmc_cleanup_queue(struct mmc_queue *);
 extern void mmc_queue_suspend(struct mmc_queue *);
 extern void mmc_queue_resume(struct mmc_queue *);
-
 extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
                                      struct mmc_queue_req *);
-extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
-extern void mmc_queue_bounce_post(struct mmc_queue_req *);
 
 extern int mmc_access_rpmb(struct mmc_queue *);
 
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 27fb625cbcf3..fbd29f00fca0 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -1038,7 +1038,7 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
          */
         mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                      MMC_CAP_ERASE | MMC_CAP_CMD23 | MMC_CAP_POWER_OFF_CARD |
-                     MMC_CAP_3_3V_DDR | MMC_CAP_NO_BOUNCE_BUFF;
+                     MMC_CAP_3_3V_DDR;
 
         if (host->use_sg)
                 mmc->max_segs = 16;
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c885c2d4b904..85745ef179e2 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -531,8 +531,7 @@ static int meson_mmc_clk_init(struct meson_host *host)
         div->shift = __ffs(CLK_DIV_MASK);
         div->width = __builtin_popcountl(CLK_DIV_MASK);
         div->hw.init = &init;
-        div->flags = (CLK_DIVIDER_ONE_BASED |
-                      CLK_DIVIDER_ROUND_CLOSEST);
+        div->flags = CLK_DIVIDER_ONE_BASED;
 
         clk = devm_clk_register(host->dev, &div->hw);
         if (WARN_ON(IS_ERR(clk)))
@@ -717,6 +716,22 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
+        int ret;
+
+        /*
+         * If this is the initial tuning, try to get a sane Rx starting
+         * phase before doing the actual tuning.
+         */
+        if (!mmc->doing_retune) {
+                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+
+                if (ret)
+                        return ret;
+        }
+
+        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
+        if (ret)
+                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -746,6 +761,11 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         case MMC_POWER_UP:
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+
+                /* Reset phases */
+                clk_set_phase(host->rx_clk, 0);
+                clk_set_phase(host->tx_clk, 270);
+
                 break;
 
         case MMC_POWER_ON:
@@ -759,8 +779,6 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                 host->vqmmc_enabled = true;
                 }
 
-                /* Reset rx phase */
-                clk_set_phase(host->rx_clk, 0);
                 break;
         }
 
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 59ab194cb009..c763b404510f 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -702,11 +702,7 @@ static int pxamci_probe(struct platform_device *pdev)
 
         pxamci_init_ocr(host);
 
-        /*
-         * This architecture used to disable bounce buffers through its
-         * defconfig, now it is done at runtime as a host property.
-         */
-        mmc->caps = MMC_CAP_NO_BOUNCE_BUFF;
+        mmc->caps = 0;
         host->cmdat = 0;
         if (!cpu_is_pxa25x()) {
                 mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_SDIO_IRQ;
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index f905f2361d12..8bae88a150fd 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -146,11 +146,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
         WARN_ON(host->sg_len > 1);
 
         /* This DMAC cannot handle if buffer is not 8-bytes alignment */
-        if (!IS_ALIGNED(sg->offset, 8)) {
-                host->force_pio = true;
-                renesas_sdhi_internal_dmac_enable_dma(host, false);
-                return;
-        }
+        if (!IS_ALIGNED(sg->offset, 8))
+                goto force_pio;
 
         if (data->flags & MMC_DATA_READ) {
                 dtran_mode |= DTRAN_MODE_CH_NUM_CH1;
@@ -163,8 +160,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
         }
 
         ret = dma_map_sg(&host->pdev->dev, sg, host->sg_len, dir);
-        if (ret < 0)
-                return;
+        if (ret == 0)
+                goto force_pio;
 
         renesas_sdhi_internal_dmac_enable_dma(host, true);
 
@@ -176,6 +173,12 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
                                             dtran_mode);
         renesas_sdhi_internal_dmac_dm_write(host, DM_DTRAN_ADDR,
                                             sg->dma_address);
+
+        return;
+
+force_pio:
+        host->force_pio = true;
+        renesas_sdhi_internal_dmac_enable_dma(host, false);
 }
 
 static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg)
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index bbaddf18a1b3..67d787fa3306 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -392,6 +392,7 @@ static const struct sdhci_pci_fixes sdhci_intel_pch_sdio = {
 
 enum {
         INTEL_DSM_FNS           =  0,
+        INTEL_DSM_V18_SWITCH    =  3,
         INTEL_DSM_DRV_STRENGTH  =  9,
         INTEL_DSM_D3_RETUNE     = 10,
 };
@@ -447,6 +448,8 @@ static void intel_dsm_init(struct intel_host *intel_host, struct device *dev,
         int err;
         u32 val;
 
+        intel_host->d3_retune = true;
+
         err = __intel_dsm(intel_host, dev, INTEL_DSM_FNS, &intel_host->dsm_fns);
         if (err) {
                 pr_debug("%s: DSM not supported, error %d\n",
@@ -557,6 +560,19 @@ static void intel_hs400_enhanced_strobe(struct mmc_host *mmc,
         sdhci_writel(host, val, INTEL_HS400_ES_REG);
 }
 
+static void sdhci_intel_voltage_switch(struct sdhci_host *host)
+{
+        struct sdhci_pci_slot *slot = sdhci_priv(host);
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct device *dev = &slot->chip->pdev->dev;
+        u32 result = 0;
+        int err;
+
+        err = intel_dsm(intel_host, dev, INTEL_DSM_V18_SWITCH, &result);
+        pr_debug("%s: %s DSM error %d result %u\n",
+                 mmc_hostname(host->mmc), __func__, err, result);
+}
+
 static const struct sdhci_ops sdhci_intel_byt_ops = {
         .set_clock              = sdhci_set_clock,
         .set_power              = sdhci_intel_set_power,
@@ -565,6 +581,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
         .reset                  = sdhci_reset,
         .set_uhs_signaling      = sdhci_set_uhs_signaling,
         .hw_reset               = sdhci_pci_hw_reset,
+        .voltage_switch         = sdhci_intel_voltage_switch,
 };
 
 static void byt_read_dsm(struct sdhci_pci_slot *slot)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 2eec2e652c53..0842bbc2d7ad 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -466,6 +466,7 @@ static int xenon_probe(struct platform_device *pdev)
 {
         struct sdhci_pltfm_host *pltfm_host;
         struct sdhci_host *host;
+        struct xenon_priv *priv;
         int err;
 
         host = sdhci_pltfm_init(pdev, &sdhci_xenon_pdata,
@@ -474,6 +475,7 @@ static int xenon_probe(struct platform_device *pdev)
                 return PTR_ERR(host);
 
         pltfm_host = sdhci_priv(host);
+        priv = sdhci_pltfm_priv(pltfm_host);
 
         /*
          * Link Xenon specific mmc_host_ops function,
@@ -491,9 +493,20 @@ static int xenon_probe(struct platform_device *pdev)
         if (err)
                 goto free_pltfm;
 
+        priv->axi_clk = devm_clk_get(&pdev->dev, "axi");
+        if (IS_ERR(priv->axi_clk)) {
+                err = PTR_ERR(priv->axi_clk);
+                if (err == -EPROBE_DEFER)
+                        goto err_clk;
+        } else {
+                err = clk_prepare_enable(priv->axi_clk);
+                if (err)
+                        goto err_clk;
+        }
+
         err = mmc_of_parse(host->mmc);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         sdhci_get_of_property(pdev);
 
@@ -502,11 +515,11 @@ static int xenon_probe(struct platform_device *pdev)
         /* Xenon specific dt parse */
         err = xenon_probe_dt(pdev);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         pm_runtime_get_noresume(&pdev->dev);
         pm_runtime_set_active(&pdev->dev);
@@ -527,6 +540,8 @@ remove_sdhc:
         pm_runtime_disable(&pdev->dev);
         pm_runtime_put_noidle(&pdev->dev);
         xenon_sdhc_unprepare(host);
+err_clk_axi:
+        clk_disable_unprepare(priv->axi_clk);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -538,6 +553,7 @@ static int xenon_remove(struct platform_device *pdev)
 {
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
 
         pm_runtime_get_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
@@ -546,7 +562,7 @@ static int xenon_remove(struct platform_device *pdev)
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
-
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(pltfm_host->clk);
 
         sdhci_pltfm_free(pdev);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 2bc0510c0769..9994995c7c56 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -83,6 +83,7 @@ struct xenon_priv {
         unsigned char   bus_width;
         unsigned char   timing;
         unsigned int    clock;
+        struct clk      *axi_clk;
 
         int             phy_type;
         /*
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 12cf8288d663..9c4e6199b854 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -47,6 +47,7 @@
 #include <linux/mmc/sdio.h>
 #include <linux/scatterlist.h>
 #include <linux/spinlock.h>
+#include <linux/swiotlb.h>
 #include <linux/workqueue.h>
 
 #include "tmio_mmc.h"
@@ -129,50 +130,6 @@ static int tmio_mmc_next_sg(struct tmio_mmc_host *host)
 
 #define CMDREQ_TIMEOUT  5000
 
-#ifdef CONFIG_MMC_DEBUG
-
-#define STATUS_TO_TEXT(a, status, i) \
-        do { \
-                if ((status) & TMIO_STAT_##a) { \
-                        if ((i)++) \
-                                printk(KERN_DEBUG " | "); \
-                        printk(KERN_DEBUG #a); \
-                } \
-        } while (0)
-
-static void pr_debug_status(u32 status)
-{
-        int i = 0;
-
-        pr_debug("status: %08x = ", status);
-        STATUS_TO_TEXT(CARD_REMOVE, status, i);
-        STATUS_TO_TEXT(CARD_INSERT, status, i);
-        STATUS_TO_TEXT(SIGSTATE, status, i);
-        STATUS_TO_TEXT(WRPROTECT, status, i);
-        STATUS_TO_TEXT(CARD_REMOVE_A, status, i);
-        STATUS_TO_TEXT(CARD_INSERT_A, status, i);
-        STATUS_TO_TEXT(SIGSTATE_A, status, i);
-        STATUS_TO_TEXT(CMD_IDX_ERR, status, i);
-        STATUS_TO_TEXT(STOPBIT_ERR, status, i);
-        STATUS_TO_TEXT(ILL_FUNC, status, i);
-        STATUS_TO_TEXT(CMD_BUSY, status, i);
-        STATUS_TO_TEXT(CMDRESPEND, status, i);
-        STATUS_TO_TEXT(DATAEND, status, i);
-        STATUS_TO_TEXT(CRCFAIL, status, i);
-        STATUS_TO_TEXT(DATATIMEOUT, status, i);
-        STATUS_TO_TEXT(CMDTIMEOUT, status, i);
-        STATUS_TO_TEXT(RXOVERFLOW, status, i);
-        STATUS_TO_TEXT(TXUNDERRUN, status, i);
-        STATUS_TO_TEXT(RXRDY, status, i);
-        STATUS_TO_TEXT(TXRQ, status, i);
-        STATUS_TO_TEXT(ILL_ACCESS, status, i);
-        printk("\n");
-}
-
-#else
-#define pr_debug_status(s)  do { } while (0)
-#endif
-
 static void tmio_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
 {
         struct tmio_mmc_host *host = mmc_priv(mmc);
@@ -762,9 +719,6 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
         status = sd_ctrl_read16_and_16_as_32(host, CTL_STATUS);
         ireg = status & TMIO_MASK_IRQ & ~host->sdcard_irq_mask;
 
-        pr_debug_status(status);
-        pr_debug_status(ireg);
-
         /* Clear the status except the interrupt status */
         sd_ctrl_write32_as_16_and_16(host, CTL_STATUS, TMIO_MASK_IRQ);
 
@@ -1262,6 +1216,18 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host,
         mmc->max_blk_count = pdata->max_blk_count ? :
                 (PAGE_SIZE / mmc->max_blk_size) * mmc->max_segs;
         mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+        /*
+         * Since swiotlb has memory size limitation, this will calculate
+         * the maximum size locally (because we don't have any APIs for it now)
+         * and check the current max_req_size. And then, this will update
+         * the max_req_size if needed as a workaround.
+         */
+        if (swiotlb_max_segment()) {
+                unsigned int max_size = (1 << IO_TLB_SHIFT) * IO_TLB_SEGSIZE;
+
+                if (mmc->max_req_size > max_size)
+                        mmc->max_req_size = max_size;
+        }
         mmc->max_seg_size = mmc->max_req_size;
 
         _host->native_hotplug = !(pdata->flags & TMIO_MMC_USE_GPIO_CD ||
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 5736b0c90b33..a308e707392d 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -581,6 +581,14 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 slave->mtd.erasesize = parent->erasesize;
         }
 
+        /*
+         * Slave erasesize might differ from the master one if the master
+         * exposes several regions with different erasesize. Adjust
+         * wr_alignment accordingly.
+         */
+        if (!(slave->mtd.flags & MTD_NO_ERASE))
+                wr_alignment = slave->mtd.erasesize;
+
         tmp = slave->offset;
         remainder = do_div(tmp, wr_alignment);
         if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 146af8218314..8268636675ef 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
         size += (req->ecc.strength + 1) * sizeof(u16);
         /* Reserve space for mu, dmu and delta. */
         size = ALIGN(size, sizeof(s32));
-        size += (req->ecc.strength + 1) * sizeof(s32);
+        size += (req->ecc.strength + 1) * sizeof(s32) * 3;
 
         user = kzalloc(size, GFP_KERNEL);
         if (!user)
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 13f0f219d8aa..a13a4896a8bd 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -182,22 +182,23 @@
 /* FLEXCAN hardware feature flags
  *
  * Below is some version info we got:
- *    SOC   Version   IP-Version  Glitch- [TR]WRN_INT Memory err RTR re-
- *                                Filter? connected?  detection  ception in MB
- *   MX25  FlexCAN2  03.00.00.00     no        no         no        no
- *   MX28  FlexCAN2  03.00.04.00    yes       yes         no        no
- *   MX35  FlexCAN2  03.00.00.00     no        no         no        no
- *   MX53  FlexCAN2  03.00.00.00    yes        no         no        no
- *   MX6s  FlexCAN3  10.00.12.00    yes       yes         no       yes
- *   VF610 FlexCAN3  ?               no       yes        yes       yes?
+ *    SOC   Version   IP-Version  Glitch- [TR]WRN_INT IRQ Err Memory err RTR re-
+ *                                Filter? connected?  Passive detection  ception in MB
+ *   MX25  FlexCAN2  03.00.00.00     no        no         ?       no        no
+ *   MX28  FlexCAN2  03.00.04.00    yes       yes        no       no        no
+ *   MX35  FlexCAN2  03.00.00.00     no        no         ?       no        no
+ *   MX53  FlexCAN2  03.00.00.00    yes        no        no       no        no
+ *   MX6s  FlexCAN3  10.00.12.00    yes       yes        no       no       yes
+ *   VF610 FlexCAN3  ?               no       yes         ?      yes       yes?
  *
  * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
  */
-#define FLEXCAN_QUIRK_BROKEN_ERR_STATE  BIT(1) /* [TR]WRN_INT not connected */
+#define FLEXCAN_QUIRK_BROKEN_WERR_STATE BIT(1) /* [TR]WRN_INT not connected */
 #define FLEXCAN_QUIRK_DISABLE_RXFG      BIT(2) /* Disable RX FIFO Global mask */
 #define FLEXCAN_QUIRK_ENABLE_EACEN_RRS  BIT(3) /* Enable EACEN and RRS bit in ctrl2 */
 #define FLEXCAN_QUIRK_DISABLE_MECR      BIT(4) /* Disable Memory error detection */
 #define FLEXCAN_QUIRK_USE_OFF_TIMESTAMP BIT(5) /* Use timestamp based offloading */
+#define FLEXCAN_QUIRK_BROKEN_PERR_STATE BIT(6) /* No interrupt for error passive */
 
 /* Structure of the message buffer */
 struct flexcan_mb {
@@ -281,14 +282,17 @@ struct flexcan_priv {
 };
 
 static const struct flexcan_devtype_data fsl_p1010_devtype_data = {
-        .quirks = FLEXCAN_QUIRK_BROKEN_ERR_STATE,
+        .quirks = FLEXCAN_QUIRK_BROKEN_WERR_STATE |
+                FLEXCAN_QUIRK_BROKEN_PERR_STATE,
 };
 
-static const struct flexcan_devtype_data fsl_imx28_devtype_data;
+static const struct flexcan_devtype_data fsl_imx28_devtype_data = {
+        .quirks = FLEXCAN_QUIRK_BROKEN_PERR_STATE,
+};
 
 static const struct flexcan_devtype_data fsl_imx6q_devtype_data = {
         .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
-                FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
+                FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | FLEXCAN_QUIRK_BROKEN_PERR_STATE,
 };
 
 static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
@@ -335,6 +339,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
 }
 #endif
 
+static inline void flexcan_error_irq_enable(const struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->regs;
+        u32 reg_ctrl = (priv->reg_ctrl_default | FLEXCAN_CTRL_ERR_MSK);
+
+        flexcan_write(reg_ctrl, &regs->ctrl);
+}
+
+static inline void flexcan_error_irq_disable(const struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->regs;
+        u32 reg_ctrl = (priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_MSK);
+
+        flexcan_write(reg_ctrl, &regs->ctrl);
+}
+
 static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
 {
         if (!priv->reg_xceiver)
@@ -713,6 +733,7 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
         struct flexcan_regs __iomem *regs = priv->regs;
         irqreturn_t handled = IRQ_NONE;
         u32 reg_iflag1, reg_esr;
+        enum can_state last_state = priv->can.state;
 
         reg_iflag1 = flexcan_read(&regs->iflag1);
 
@@ -765,8 +786,10 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
                 flexcan_write(reg_esr & FLEXCAN_ESR_ALL_INT, &regs->esr);
         }
 
-        /* state change interrupt */
-        if (reg_esr & FLEXCAN_ESR_ERR_STATE)
+        /* state change interrupt or broken error state quirk fix is enabled */
+        if ((reg_esr & FLEXCAN_ESR_ERR_STATE) ||
+            (priv->devtype_data->quirks & (FLEXCAN_QUIRK_BROKEN_WERR_STATE |
+                                           FLEXCAN_QUIRK_BROKEN_PERR_STATE)))
                 flexcan_irq_state(dev, reg_esr);
 
         /* bus error IRQ - handle if bus error reporting is activated */
@@ -774,6 +797,44 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
             (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING))
                 flexcan_irq_bus_err(dev, reg_esr);
 
+        /* availability of error interrupt among state transitions in case
+         * bus error reporting is de-activated and
+         * FLEXCAN_QUIRK_BROKEN_PERR_STATE is enabled:
+         *  +--------------------------------------------------------------+
+         *  | +----------------------------------------------+ [stopped /  |
+         *  | |                                              |  sleeping] -+
+         *  +-+-> active <-> warning <-> passive -> bus off -+
+         *        ___________^^^^^^^^^^^^_______________________________
+         *        disabled(1)  enabled             disabled
+         *
+         * (1): enabled if FLEXCAN_QUIRK_BROKEN_WERR_STATE is enabled
+         */
+        if ((last_state != priv->can.state) &&
+            (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_PERR_STATE) &&
+            !(priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)) {
+                switch (priv->can.state) {
+                case CAN_STATE_ERROR_ACTIVE:
+                        if (priv->devtype_data->quirks &
+                            FLEXCAN_QUIRK_BROKEN_WERR_STATE)
+                                flexcan_error_irq_enable(priv);
+                        else
+                                flexcan_error_irq_disable(priv);
+                        break;
+
+                case CAN_STATE_ERROR_WARNING:
+                        flexcan_error_irq_enable(priv);
+                        break;
+
+                case CAN_STATE_ERROR_PASSIVE:
+                case CAN_STATE_BUS_OFF:
+                        flexcan_error_irq_disable(priv);
+                        break;
+
+                default:
+                        break;
+                }
+        }
+
         return handled;
 }
 
@@ -887,7 +948,7 @@ static int flexcan_chip_start(struct net_device *dev)
          * on most Flexcan cores, too. Otherwise we don't get
          * any error warning or passive interrupts.
          */
-        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_ERR_STATE ||
+        if (priv->devtype_data->quirks & FLEXCAN_QUIRK_BROKEN_WERR_STATE ||
             priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
                 reg_ctrl |= FLEXCAN_CTRL_ERR_MSK;
         else
diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index 68ef0a4cd821..b0c80859f746 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -342,7 +342,7 @@ static int sun4i_can_start(struct net_device *dev)
 
         /* enter the selected mode */
         mod_reg_val = readl(priv->base + SUN4I_REG_MSEL_ADDR);
-        if (priv->can.ctrlmode & CAN_CTRLMODE_PRESUME_ACK)
+        if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)
                 mod_reg_val |= SUN4I_MSEL_LOOPBACK_MODE;
         else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)
                 mod_reg_val |= SUN4I_MSEL_LISTEN_ONLY_MODE;
@@ -811,7 +811,6 @@ static int sun4ican_probe(struct platform_device *pdev)
         priv->can.ctrlmode_supported = CAN_CTRLMODE_BERR_REPORTING |
                                        CAN_CTRLMODE_LISTENONLY |
                                        CAN_CTRLMODE_LOOPBACK |
-                                       CAN_CTRLMODE_PRESUME_ACK |
                                        CAN_CTRLMODE_3_SAMPLES;
         priv->base = addr;
         priv->clk = clk;
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index be928ce62d32..9fdb0f0bfa06 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv,
                 }
 
                 cf->can_id = id & ESD_IDMASK;
-                cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
+                cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
 
                 if (id & ESD_EXTID)
                         cf->can_id |= CAN_EFF_FLAG;
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index afcc1312dbaf..68ac3e88a8ce 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -375,6 +375,8 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 
                 gs_free_tx_context(txc);
 
+                atomic_dec(&dev->active_tx_urbs);
+
                 netif_wake_queue(netdev);
         }
 
@@ -463,14 +465,6 @@ static void gs_usb_xmit_callback(struct urb *urb)
                           urb->transfer_buffer_length,
                           urb->transfer_buffer,
                           urb->transfer_dma);
-
-        atomic_dec(&dev->active_tx_urbs);
-
-        if (!netif_device_present(netdev))
-                return;
-
-        if (netif_queue_stopped(netdev))
-                netif_wake_queue(netdev);
 }
 
 static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 18cc529fb807..9b18d96ef526 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -137,6 +137,7 @@ static inline bool kvaser_is_usbcan(const struct usb_device_id *id)
 #define CMD_RESET_ERROR_COUNTER         49
 #define CMD_TX_ACKNOWLEDGE              50
 #define CMD_CAN_ERROR_EVENT             51
+#define CMD_FLUSH_QUEUE_REPLY           68
 
 #define CMD_LEAF_USB_THROTTLE           77
 #define CMD_LEAF_LOG_MESSAGE            106
@@ -1301,6 +1302,11 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev,
                         goto warn;
                 break;
 
+        case CMD_FLUSH_QUEUE_REPLY:
+                if (dev->family != KVASER_LEAF)
+                        goto warn;
+                break;
+
         default:
 warn:           dev_warn(dev->udev->dev.parent,
                          "Unhandled message (%d)\n", msg->id);
@@ -1609,7 +1615,8 @@ static int kvaser_usb_close(struct net_device *netdev)
         if (err)
                 netdev_warn(netdev, "Cannot flush queue, error %d\n", err);
 
-        if (kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel))
+        err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel);
+        if (err)
                 netdev_warn(netdev, "Cannot reset card, error %d\n", err);
 
         err = kvaser_usb_stop_chip(priv);
diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
index dce7fa57eb55..f123ed57630d 100644
--- a/drivers/net/dsa/mv88e6060.c
+++ b/drivers/net/dsa/mv88e6060.c
@@ -214,8 +214,14 @@ static int mv88e6060_setup(struct dsa_switch *ds)
 
 static int mv88e6060_set_addr(struct dsa_switch *ds, u8 *addr)
 {
-        /* Use the same MAC Address as FD Pause frames for all ports */
-        REG_WRITE(REG_GLOBAL, GLOBAL_MAC_01, (addr[0] << 9) | addr[1]);
+        u16 val = addr[0] << 8 | addr[1];
+
+        /* The multicast bit is always transmitted as a zero, so the switch uses
+         * bit 8 for "DiffAddr", where 0 means all ports transmit the same SA.
+         */
+        val &= 0xfeff;
+
+        REG_WRITE(REG_GLOBAL, GLOBAL_MAC_01, val);
         REG_WRITE(REG_GLOBAL, GLOBAL_MAC_23, (addr[2] << 8) | addr[3]);
         REG_WRITE(REG_GLOBAL, GLOBAL_MAC_45, (addr[4] << 8) | addr[5]);
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index c6678aa9b4ef..d74c7335c512 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1100,6 +1100,10 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port,
         };
         int i, err;
 
+        /* DSA and CPU ports have to be members of multiple vlans */
+        if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+                return 0;
+
         if (!vid_begin)
                 return -EOPNOTSUPP;
 
@@ -3947,7 +3951,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         if (chip->irq > 0) {
                 if (chip->info->g2_irqs > 0)
                         mv88e6xxx_g2_irq_free(chip);
+                mutex_lock(&chip->reg_lock);
                 mv88e6xxx_g1_irq_free(chip);
+                mutex_unlock(&chip->reg_lock);
         }
 }
 
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index b1212debc2e1..967020fb26ee 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -742,8 +742,8 @@ static void ena_get_channels(struct net_device *netdev,
 {
         struct ena_adapter *adapter = netdev_priv(netdev);
 
-        channels->max_rx = ENA_MAX_NUM_IO_QUEUES;
-        channels->max_tx = ENA_MAX_NUM_IO_QUEUES;
+        channels->max_rx = adapter->num_queues;
+        channels->max_tx = adapter->num_queues;
         channels->max_other = 0;
         channels->max_combined = 0;
         channels->rx_count = adapter->num_queues;
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index f7dc22f65d9f..c6bd5e24005d 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -966,7 +966,7 @@ static inline void ena_rx_checksum(struct ena_ring *rx_ring,
                 u64_stats_update_begin(&rx_ring->syncp);
                 rx_ring->rx_stats.bad_csum++;
                 u64_stats_update_end(&rx_ring->syncp);
-                netif_err(rx_ring->adapter, rx_err, rx_ring->netdev,
+                netif_dbg(rx_ring->adapter, rx_err, rx_ring->netdev,
                           "RX IPv4 header checksum error\n");
                 return;
         }
@@ -979,7 +979,7 @@ static inline void ena_rx_checksum(struct ena_ring *rx_ring,
                         u64_stats_update_begin(&rx_ring->syncp);
                         rx_ring->rx_stats.bad_csum++;
                         u64_stats_update_end(&rx_ring->syncp);
-                        netif_err(rx_ring->adapter, rx_err, rx_ring->netdev,
+                        netif_dbg(rx_ring->adapter, rx_err, rx_ring->netdev,
                                   "RX L4 checksum error\n");
                         skb->ip_summed = CHECKSUM_NONE;
                         return;
@@ -3064,7 +3064,8 @@ static void ena_release_bars(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
         if (ena_dev->mem_bar)
                 devm_iounmap(&pdev->dev, ena_dev->mem_bar);
 
-        devm_iounmap(&pdev->dev, ena_dev->reg_bar);
+        if (ena_dev->reg_bar)
+                devm_iounmap(&pdev->dev, ena_dev->reg_bar);
 
         release_bars = pci_select_bars(pdev, IORESOURCE_MEM) & ENA_BAR_MASK;
         pci_release_selected_regions(pdev, release_bars);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 214986436ece..57e796870595 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -22,8 +22,12 @@
 
 #define AQ_CFG_FORCE_LEGACY_INT 0U
 
-#define AQ_CFG_IS_INTERRUPT_MODERATION_DEF   1U
-#define AQ_CFG_INTERRUPT_MODERATION_RATE_DEF 0xFFFFU
+#define AQ_CFG_INTERRUPT_MODERATION_OFF         0
+#define AQ_CFG_INTERRUPT_MODERATION_ON          1
+#define AQ_CFG_INTERRUPT_MODERATION_AUTO        0xFFFFU
+
+#define AQ_CFG_INTERRUPT_MODERATION_USEC_MAX (0x1FF * 2)
+
 #define AQ_CFG_IRQ_MASK                      0x1FFU
 
 #define AQ_CFG_VECS_MAX   8U
@@ -51,6 +55,10 @@
 
 #define AQ_CFG_SKB_FRAGS_MAX   32U
 
+/* Number of descriptors available in one ring to resume this ring queue
+ */
+#define AQ_CFG_RESTART_DESC_THRES   (AQ_CFG_SKB_FRAGS_MAX * 2)
+
 #define AQ_CFG_NAPI_WEIGHT     64U
 
 #define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
index a761e91471df..d5e99b468870 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -56,10 +56,6 @@ aq_ethtool_set_link_ksettings(struct net_device *ndev,
         return aq_nic_set_link_ksettings(aq_nic, cmd);
 }
 
-/* there "5U" is number of queue[#] stats lines (InPackets+...+InErrors) */
-static const unsigned int aq_ethtool_stat_queue_lines = 5U;
-static const unsigned int aq_ethtool_stat_queue_chars =
-        5U * ETH_GSTRING_LEN;
 static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = {
         "InPackets",
         "InUCast",
@@ -83,56 +79,26 @@ static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = {
         "InOctetsDma",
         "OutOctetsDma",
         "InDroppedDma",
-        "Queue[0] InPackets",
-        "Queue[0] OutPackets",
-        "Queue[0] InJumboPackets",
-        "Queue[0] InLroPackets",
-        "Queue[0] InErrors",
-        "Queue[1] InPackets",
-        "Queue[1] OutPackets",
-        "Queue[1] InJumboPackets",
-        "Queue[1] InLroPackets",
-        "Queue[1] InErrors",
-        "Queue[2] InPackets",
-        "Queue[2] OutPackets",
-        "Queue[2] InJumboPackets",
-        "Queue[2] InLroPackets",
-        "Queue[2] InErrors",
-        "Queue[3] InPackets",
-        "Queue[3] OutPackets",
-        "Queue[3] InJumboPackets",
-        "Queue[3] InLroPackets",
-        "Queue[3] InErrors",
-        "Queue[4] InPackets",
-        "Queue[4] OutPackets",
-        "Queue[4] InJumboPackets",
-        "Queue[4] InLroPackets",
-        "Queue[4] InErrors",
-        "Queue[5] InPackets",
-        "Queue[5] OutPackets",
-        "Queue[5] InJumboPackets",
-        "Queue[5] InLroPackets",
-        "Queue[5] InErrors",
-        "Queue[6] InPackets",
-        "Queue[6] OutPackets",
-        "Queue[6] InJumboPackets",
-        "Queue[6] InLroPackets",
-        "Queue[6] InErrors",
-        "Queue[7] InPackets",
-        "Queue[7] OutPackets",
-        "Queue[7] InJumboPackets",
-        "Queue[7] InLroPackets",
-        "Queue[7] InErrors",
+};
+
+static const char aq_ethtool_queue_stat_names[][ETH_GSTRING_LEN] = {
+        "Queue[%d] InPackets",
+        "Queue[%d] OutPackets",
+        "Queue[%d] Restarts",
+        "Queue[%d] InJumboPackets",
+        "Queue[%d] InLroPackets",
+        "Queue[%d] InErrors",
 };
 
 static void aq_ethtool_stats(struct net_device *ndev,
                              struct ethtool_stats *stats, u64 *data)
 {
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
+        struct aq_nic_cfg_s *cfg = aq_nic_get_cfg(aq_nic);
 
-/* ASSERT: Need add lines to aq_ethtool_stat_names if AQ_CFG_VECS_MAX > 8 */
-        BUILD_BUG_ON(AQ_CFG_VECS_MAX > 8);
-        memset(data, 0, ARRAY_SIZE(aq_ethtool_stat_names) * sizeof(u64));
+        memset(data, 0, (ARRAY_SIZE(aq_ethtool_stat_names) +
+                                ARRAY_SIZE(aq_ethtool_queue_stat_names) *
+                                cfg->vecs) * sizeof(u64));
         aq_nic_get_stats(aq_nic, data);
 }
 
@@ -154,8 +120,8 @@ static void aq_ethtool_get_drvinfo(struct net_device *ndev,
 
         strlcpy(drvinfo->bus_info, pdev ? pci_name(pdev) : "",
                 sizeof(drvinfo->bus_info));
-        drvinfo->n_stats = ARRAY_SIZE(aq_ethtool_stat_names) -
-                (AQ_CFG_VECS_MAX - cfg->vecs) * aq_ethtool_stat_queue_lines;
+        drvinfo->n_stats = ARRAY_SIZE(aq_ethtool_stat_names) +
+                cfg->vecs * ARRAY_SIZE(aq_ethtool_queue_stat_names);
         drvinfo->testinfo_len = 0;
         drvinfo->regdump_len = regs_count;
         drvinfo->eedump_len = 0;
@@ -164,14 +130,25 @@ static void aq_ethtool_get_drvinfo(struct net_device *ndev,
 static void aq_ethtool_get_strings(struct net_device *ndev,
                                    u32 stringset, u8 *data)
 {
+        int i, si;
         struct aq_nic_s *aq_nic = netdev_priv(ndev);
         struct aq_nic_cfg_s *cfg = aq_nic_get_cfg(aq_nic);
-
-        if (stringset == ETH_SS_STATS)
-                memcpy(data, *aq_ethtool_stat_names,
-                       sizeof(aq_ethtool_stat_names) -
-                       (AQ_CFG_VECS_MAX - cfg->vecs) *
-                       aq_ethtool_stat_queue_chars);
+        u8 *p = data;
+
+        if (stringset == ETH_SS_STATS) {
+                memcpy(p, *aq_ethtool_stat_names,
+                       sizeof(aq_ethtool_stat_names));
+                p = p + sizeof(aq_ethtool_stat_names);
+                for (i = 0; i < cfg->vecs; i++) {
+                        for (si = 0;
+                                si < ARRAY_SIZE(aq_ethtool_queue_stat_names);
+                                si++) {
+                                snprintf(p, ETH_GSTRING_LEN,
+                                         aq_ethtool_queue_stat_names[si], i);
+                                p += ETH_GSTRING_LEN;
+                        }
+                }
+        }
 }
 
 static int aq_ethtool_get_sset_count(struct net_device *ndev, int stringset)
@@ -182,9 +159,8 @@ static int aq_ethtool_get_sset_count(struct net_device *ndev, int stringset)
 
         switch (stringset) {
         case ETH_SS_STATS:
-                ret = ARRAY_SIZE(aq_ethtool_stat_names) -
-                        (AQ_CFG_VECS_MAX - cfg->vecs) *
-                        aq_ethtool_stat_queue_lines;
+                ret = ARRAY_SIZE(aq_ethtool_stat_names) +
+                        cfg->vecs * ARRAY_SIZE(aq_ethtool_queue_stat_names);
                 break;
         default:
                 ret = -EOPNOTSUPP;
@@ -245,6 +221,69 @@ static int aq_ethtool_get_rxnfc(struct net_device *ndev,
         return err;
 }
 
+int aq_ethtool_get_coalesce(struct net_device *ndev,
+                            struct ethtool_coalesce *coal)
+{
+        struct aq_nic_s *aq_nic = netdev_priv(ndev);
+        struct aq_nic_cfg_s *cfg = aq_nic_get_cfg(aq_nic);
+
+        if (cfg->itr == AQ_CFG_INTERRUPT_MODERATION_ON ||
+            cfg->itr == AQ_CFG_INTERRUPT_MODERATION_AUTO) {
+                coal->rx_coalesce_usecs = cfg->rx_itr;
+                coal->tx_coalesce_usecs = cfg->tx_itr;
+                coal->rx_max_coalesced_frames = 0;
+                coal->tx_max_coalesced_frames = 0;
+        } else {
+                coal->rx_coalesce_usecs = 0;
+                coal->tx_coalesce_usecs = 0;
+                coal->rx_max_coalesced_frames = 1;
+                coal->tx_max_coalesced_frames = 1;
+        }
+        return 0;
+}
+
+int aq_ethtool_set_coalesce(struct net_device *ndev,
+                            struct ethtool_coalesce *coal)
+{
+        struct aq_nic_s *aq_nic = netdev_priv(ndev);
+        struct aq_nic_cfg_s *cfg = aq_nic_get_cfg(aq_nic);
+
+        /* This is not yet supported
+         */
+        if (coal->use_adaptive_rx_coalesce || coal->use_adaptive_tx_coalesce)
+                return -EOPNOTSUPP;
+
+        /* Atlantic only supports timing based coalescing
+         */
+        if (coal->rx_max_coalesced_frames > 1 ||
+            coal->rx_coalesce_usecs_irq ||
+            coal->rx_max_coalesced_frames_irq)
+                return -EOPNOTSUPP;
+
+        if (coal->tx_max_coalesced_frames > 1 ||
+            coal->tx_coalesce_usecs_irq ||
+            coal->tx_max_coalesced_frames_irq)
+                return -EOPNOTSUPP;
+
+        /* We do not support frame counting. Check this
+         */
+        if (!(coal->rx_max_coalesced_frames == !coal->rx_coalesce_usecs))
+                return -EOPNOTSUPP;
+        if (!(coal->tx_max_coalesced_frames == !coal->tx_coalesce_usecs))
+                return -EOPNOTSUPP;
+
+        if (coal->rx_coalesce_usecs > AQ_CFG_INTERRUPT_MODERATION_USEC_MAX ||
+            coal->tx_coalesce_usecs > AQ_CFG_INTERRUPT_MODERATION_USEC_MAX)
+                return -EINVAL;
+
+        cfg->itr = AQ_CFG_INTERRUPT_MODERATION_ON;
+
+        cfg->rx_itr = coal->rx_coalesce_usecs;
+        cfg->tx_itr = coal->tx_coalesce_usecs;
+
+        return aq_nic_update_interrupt_moderation_settings(aq_nic);
+}
+
 const struct ethtool_ops aq_ethtool_ops = {
         .get_link            = aq_ethtool_get_link,
         .get_regs_len        = aq_ethtool_get_regs_len,
@@ -259,4 +298,6 @@ const struct ethtool_ops aq_ethtool_ops = {
         .get_ethtool_stats   = aq_ethtool_stats,
         .get_link_ksettings  = aq_ethtool_get_link_ksettings,
         .set_link_ksettings  = aq_ethtool_set_link_ksettings,
+        .get_coalesce        = aq_ethtool_get_coalesce,
+        .set_coalesce        = aq_ethtool_set_coalesce,
 };
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index bf9b3f020e10..0207927dc8a6 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -151,8 +151,7 @@ struct aq_hw_ops {
                                      [ETH_ALEN],
                                      u32 count);
 
-        int (*hw_interrupt_moderation_set)(struct aq_hw_s *self,
-                                           bool itr_enabled);
+        int (*hw_interrupt_moderation_set)(struct aq_hw_s *self);
 
         int (*hw_rss_set)(struct aq_hw_s *self,
                           struct aq_rss_parameters *rss_params);
@@ -163,6 +162,8 @@ struct aq_hw_ops {
         int (*hw_get_regs)(struct aq_hw_s *self,
                            struct aq_hw_caps_s *aq_hw_caps, u32 *regs_buff);
 
+        int (*hw_update_stats)(struct aq_hw_s *self);
+
         int (*hw_get_hw_stats)(struct aq_hw_s *self, u64 *data,
                                unsigned int *p_count);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 6ac9e2602d6d..483e97691eea 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -16,6 +16,7 @@
 #include "aq_pci_func.h"
 #include "aq_nic_internal.h"
 
+#include <linux/moduleparam.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/timer.h>
@@ -24,6 +25,18 @@
 #include <linux/tcp.h>
 #include <net/ip.h>
 
+static unsigned int aq_itr = AQ_CFG_INTERRUPT_MODERATION_AUTO;
+module_param_named(aq_itr, aq_itr, uint, 0644);
+MODULE_PARM_DESC(aq_itr, "Interrupt throttling mode");
+
+static unsigned int aq_itr_tx;
+module_param_named(aq_itr_tx, aq_itr_tx, uint, 0644);
+MODULE_PARM_DESC(aq_itr_tx, "TX interrupt throttle rate");
+
+static unsigned int aq_itr_rx;
+module_param_named(aq_itr_rx, aq_itr_rx, uint, 0644);
+MODULE_PARM_DESC(aq_itr_rx, "RX interrupt throttle rate");
+
 static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
 {
         struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
@@ -61,9 +74,9 @@ static void aq_nic_cfg_init_defaults(struct aq_nic_s *self)
 
         cfg->is_polling = AQ_CFG_IS_POLLING_DEF;
 
-        cfg->is_interrupt_moderation = AQ_CFG_IS_INTERRUPT_MODERATION_DEF;
-        cfg->itr = cfg->is_interrupt_moderation ?
-                AQ_CFG_INTERRUPT_MODERATION_RATE_DEF : 0U;
+        cfg->itr = aq_itr;
+        cfg->tx_itr = aq_itr_tx;
+        cfg->rx_itr = aq_itr_rx;
 
         cfg->is_rss = AQ_CFG_IS_RSS_DEF;
         cfg->num_rss_queues = AQ_CFG_NUM_RSS_QUEUES_DEF;
@@ -119,6 +132,37 @@ int aq_nic_cfg_start(struct aq_nic_s *self)
         return 0;
 }
 
+static int aq_nic_update_link_status(struct aq_nic_s *self)
+{
+        int err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
+
+        if (err)
+                return err;
+
+        if (self->link_status.mbps != self->aq_hw->aq_link_status.mbps) {
+                pr_info("%s: link change old %d new %d\n",
+                        AQ_CFG_DRV_NAME, self->link_status.mbps,
+                        self->aq_hw->aq_link_status.mbps);
+                aq_nic_update_interrupt_moderation_settings(self);
+        }
+
+        self->link_status = self->aq_hw->aq_link_status;
+        if (!netif_carrier_ok(self->ndev) && self->link_status.mbps) {
+                aq_utils_obj_set(&self->header.flags,
+                                 AQ_NIC_FLAG_STARTED);
+                aq_utils_obj_clear(&self->header.flags,
+                                   AQ_NIC_LINK_DOWN);
+                netif_carrier_on(self->ndev);
+                netif_tx_wake_all_queues(self->ndev);
+        }
+        if (netif_carrier_ok(self->ndev) && !self->link_status.mbps) {
+                netif_carrier_off(self->ndev);
+                netif_tx_disable(self->ndev);
+                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
+        }
+        return 0;
+}
+
 static void aq_nic_service_timer_cb(unsigned long param)
 {
         struct aq_nic_s *self = (struct aq_nic_s *)param;
@@ -131,25 +175,12 @@ static void aq_nic_service_timer_cb(unsigned long param)
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
 
-        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
-        if (err < 0)
+        err = aq_nic_update_link_status(self);
+        if (err)
                 goto err_exit;
 
-        self->link_status = self->aq_hw->aq_link_status;
-
-        self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
-                    self->aq_nic_cfg.is_interrupt_moderation);
-
-        if (self->link_status.mbps) {
-                aq_utils_obj_set(&self->header.flags,
-                                 AQ_NIC_FLAG_STARTED);
-                aq_utils_obj_clear(&self->header.flags,
-                                   AQ_NIC_LINK_DOWN);
-                netif_carrier_on(self->ndev);
-        } else {
-                netif_carrier_off(self->ndev);
-                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
-        }
+        if (self->aq_hw_ops.hw_update_stats)
+                self->aq_hw_ops.hw_update_stats(self->aq_hw);
 
         memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
         memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
@@ -214,7 +245,6 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
         SET_NETDEV_DEV(ndev, dev);
 
         ndev->if_port = port;
-        ndev->min_mtu = ETH_MIN_MTU;
         self->ndev = ndev;
 
         self->aq_pci_func = aq_pci_func;
@@ -241,7 +271,6 @@ err_exit:
 int aq_nic_ndev_register(struct aq_nic_s *self)
 {
         int err = 0;
-        unsigned int i = 0U;
 
         if (!self->ndev) {
                 err = -EINVAL;
@@ -263,8 +292,7 @@ int aq_nic_ndev_register(struct aq_nic_s *self)
 
         netif_carrier_off(self->ndev);
 
-        for (i = AQ_CFG_VECS_MAX; i--;)
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
 
         err = register_netdev(self->ndev);
         if (err < 0)
@@ -283,6 +311,7 @@ int aq_nic_ndev_init(struct aq_nic_s *self)
         self->ndev->features = aq_hw_caps->hw_features;
         self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
         self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
+        self->ndev->max_mtu = self->aq_hw_caps.mtu - ETH_FCS_LEN - ETH_HLEN;
 
         return 0;
 }
@@ -318,12 +347,9 @@ struct aq_nic_s *aq_nic_alloc_hot(struct net_device *ndev)
                 err = -EINVAL;
                 goto err_exit;
         }
-        if (netif_running(ndev)) {
-                unsigned int i;
-
-                for (i = AQ_CFG_VECS_MAX; i--;)
-                        netif_stop_subqueue(ndev, i);
-        }
+        if (netif_running(ndev))
+                netif_tx_disable(ndev);
+        netif_carrier_off(self->ndev);
 
         for (self->aq_vecs = 0; self->aq_vecs < self->aq_nic_cfg.vecs;
                 self->aq_vecs++) {
@@ -383,16 +409,6 @@ err_exit:
         return err;
 }
 
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_start_subqueue(self->ndev, idx);
-}
-
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_stop_subqueue(self->ndev, idx);
-}
-
 int aq_nic_start(struct aq_nic_s *self)
 {
         struct aq_vec_s *aq_vec = NULL;
@@ -421,9 +437,8 @@ int aq_nic_start(struct aq_nic_s *self)
         if (err < 0)
                 goto err_exit;
 
-        err = self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
-                            self->aq_nic_cfg.is_interrupt_moderation);
-        if (err < 0)
+        err = aq_nic_update_interrupt_moderation_settings(self);
+        if (err)
                 goto err_exit;
         setup_timer(&self->service_timer, &aq_nic_service_timer_cb,
                     (unsigned long)self);
@@ -451,10 +466,6 @@ int aq_nic_start(struct aq_nic_s *self)
                         goto err_exit;
         }
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_start(self, i);
-
         err = netif_set_real_num_tx_queues(self->ndev, self->aq_vecs);
         if (err < 0)
                 goto err_exit;
@@ -463,6 +474,8 @@ int aq_nic_start(struct aq_nic_s *self)
         if (err < 0)
                 goto err_exit;
 
+        netif_tx_start_all_queues(self->ndev);
+
 err_exit:
         return err;
 }
@@ -475,6 +488,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int frag_count = 0U;
         unsigned int dx = ring->sw_tail;
+        struct aq_ring_buff_s *first = NULL;
         struct aq_ring_buff_s *dx_buff = &ring->buff_ring[dx];
 
         if (unlikely(skb_is_gso(skb))) {
@@ -485,6 +499,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                 dx_buff->len_l4 = tcp_hdrlen(skb);
                 dx_buff->mss = skb_shinfo(skb)->gso_size;
                 dx_buff->is_txc = 1U;
+                dx_buff->eop_index = 0xffffU;
 
                 dx_buff->is_ipv6 =
                         (ip_hdr(skb)->version == 6) ? 1U : 0U;
@@ -504,6 +519,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
                 goto exit;
 
+        first = dx_buff;
         dx_buff->len_pkt = skb->len;
         dx_buff->is_sop = 1U;
         dx_buff->is_mapped = 1U;
@@ -532,40 +548,46 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
 
         for (; nr_frags--; ++frag_count) {
                 unsigned int frag_len = 0U;
+                unsigned int buff_offset = 0U;
+                unsigned int buff_size = 0U;
                 dma_addr_t frag_pa;
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[frag_count];
 
                 frag_len = skb_frag_size(frag);
-                frag_pa = skb_frag_dma_map(aq_nic_get_dev(self), frag, 0,
-                                           frag_len, DMA_TO_DEVICE);
 
-                if (unlikely(dma_mapping_error(aq_nic_get_dev(self), frag_pa)))
-                        goto mapping_error;
+                while (frag_len) {
+                        if (frag_len > AQ_CFG_TX_FRAME_MAX)
+                                buff_size = AQ_CFG_TX_FRAME_MAX;
+                        else
+                                buff_size = frag_len;
+
+                        frag_pa = skb_frag_dma_map(aq_nic_get_dev(self),
+                                                   frag,
+                                                   buff_offset,
+                                                   buff_size,
+                                                   DMA_TO_DEVICE);
+
+                        if (unlikely(dma_mapping_error(aq_nic_get_dev(self),
+                                                       frag_pa)))
+                                goto mapping_error;
 
-                while (frag_len > AQ_CFG_TX_FRAME_MAX) {
                         dx = aq_ring_next_dx(ring, dx);
                         dx_buff = &ring->buff_ring[dx];
 
                         dx_buff->flags = 0U;
-                        dx_buff->len = AQ_CFG_TX_FRAME_MAX;
+                        dx_buff->len = buff_size;
                         dx_buff->pa = frag_pa;
                         dx_buff->is_mapped = 1U;
+                        dx_buff->eop_index = 0xffffU;
+
+                        frag_len -= buff_size;
+                        buff_offset += buff_size;
 
-                        frag_len -= AQ_CFG_TX_FRAME_MAX;
-                        frag_pa += AQ_CFG_TX_FRAME_MAX;
                         ++ret;
                 }
-
-                dx = aq_ring_next_dx(ring, dx);
-                dx_buff = &ring->buff_ring[dx];
-
-                dx_buff->flags = 0U;
-                dx_buff->len = frag_len;
-                dx_buff->pa = frag_pa;
-                dx_buff->is_mapped = 1U;
-                ++ret;
         }
 
+        first->eop_index = dx;
         dx_buff->is_eop = 1U;
         dx_buff->skb = skb;
         goto exit;
@@ -602,7 +624,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
         unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs;
         unsigned int tc = 0U;
         int err = NETDEV_TX_OK;
-        bool is_nic_in_bad_state;
 
         frags = skb_shinfo(skb)->nr_frags + 1;
 
@@ -613,13 +634,10 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                 goto err_exit;
         }
 
-        is_nic_in_bad_state = aq_utils_obj_test(&self->header.flags,
-                                                AQ_NIC_FLAGS_IS_NOT_TX_READY) ||
-                                                (aq_ring_avail_dx(ring) <
-                                                AQ_CFG_SKB_FRAGS_MAX);
+        aq_ring_update_queue_state(ring);
 
-        if (is_nic_in_bad_state) {
-                aq_nic_ndev_queue_stop(self, ring->idx);
+        /* Above status update may stop the queue. Check this. */
+        if (__netif_subqueue_stopped(self->ndev, ring->idx)) {
                 err = NETDEV_TX_BUSY;
                 goto err_exit;
         }
@@ -631,9 +649,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                                                       ring,
                                                       frags);
                 if (err >= 0) {
-                        if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1)
-                                aq_nic_ndev_queue_stop(self, ring->idx);
-
                         ++ring->stats.tx.packets;
                         ring->stats.tx.bytes += skb->len;
                 }
@@ -645,6 +660,11 @@ err_exit:
         return err;
 }
 
+int aq_nic_update_interrupt_moderation_settings(struct aq_nic_s *self)
+{
+        return self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw);
+}
+
 int aq_nic_set_packet_filter(struct aq_nic_s *self, unsigned int flags)
 {
         int err = 0;
@@ -693,16 +713,9 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
 {
-        int err = 0;
-
-        if (new_mtu > self->aq_hw_caps.mtu) {
-                err = -EINVAL;
-                goto err_exit;
-        }
         self->aq_nic_cfg.mtu = new_mtu;
 
-err_exit:
-        return err;
+        return 0;
 }
 
 int aq_nic_set_mac(struct aq_nic_s *self, struct net_device *ndev)
@@ -905,9 +918,8 @@ int aq_nic_stop(struct aq_nic_s *self)
         struct aq_vec_s *aq_vec = NULL;
         unsigned int i = 0U;
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
+        netif_carrier_off(self->ndev);
 
         del_timer_sync(&self->service_timer);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 7fc2a5ecb2b7..4309983acdd6 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -40,6 +40,8 @@ struct aq_nic_cfg_s {
         u32 vecs;               /* vecs==allocated irqs */
         u32 irq_type;
         u32 itr;
+        u16 rx_itr;
+        u16 tx_itr;
         u32 num_rss_queues;
         u32 mtu;
         u32 ucp_0x364;
@@ -49,7 +51,6 @@ struct aq_nic_cfg_s {
         u16 is_mc_list_enabled;
         u16 mc_list_count;
         bool is_autoneg;
-        bool is_interrupt_moderation;
         bool is_polling;
         bool is_rss;
         bool is_lro;
@@ -83,8 +84,6 @@ struct net_device *aq_nic_get_ndev(struct aq_nic_s *self);
 int aq_nic_init(struct aq_nic_s *self);
 int aq_nic_cfg_start(struct aq_nic_s *self);
 int aq_nic_ndev_register(struct aq_nic_s *self);
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx);
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx);
 void aq_nic_ndev_free(struct aq_nic_s *self);
 int aq_nic_start(struct aq_nic_s *self);
 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb);
@@ -106,5 +105,6 @@ int aq_nic_set_link_ksettings(struct aq_nic_s *self,
 struct aq_nic_cfg_s *aq_nic_get_cfg(struct aq_nic_s *self);
 u32 aq_nic_get_fw_version(struct aq_nic_s *self);
 int aq_nic_change_pm_state(struct aq_nic_s *self, pm_message_t *pm_msg);
+int aq_nic_update_interrupt_moderation_settings(struct aq_nic_s *self);
 
 #endif /* AQ_NIC_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 4c6c882c6a1c..cadaa646c89f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -85,6 +85,7 @@ int aq_pci_func_init(struct aq_pci_func_s *self)
         int err = 0;
         unsigned int bar = 0U;
         unsigned int port = 0U;
+        unsigned int numvecs = 0U;
 
         err = pci_enable_device(self->pdev);
         if (err < 0)
@@ -142,10 +143,12 @@ int aq_pci_func_init(struct aq_pci_func_s *self)
                 }
         }
 
-        /*enable interrupts */
+        numvecs = min((u8)AQ_CFG_VECS_DEF, self->aq_hw_caps.msix_irqs);
+        numvecs = min(numvecs, num_online_cpus());
+
+        /* enable interrupts */
 #if !AQ_CFG_FORCE_LEGACY_INT
-        err = pci_alloc_irq_vectors(self->pdev, self->aq_hw_caps.msix_irqs,
-                              self->aq_hw_caps.msix_irqs, PCI_IRQ_MSIX);
+        err = pci_alloc_irq_vectors(self->pdev, numvecs, numvecs, PCI_IRQ_MSIX);
 
         if (err < 0) {
                 err = pci_alloc_irq_vectors(self->pdev, 1, 1,
@@ -153,7 +156,7 @@ int aq_pci_func_init(struct aq_pci_func_s *self)
                 if (err < 0)
                         goto err_exit;
         }
-#endif
+#endif /* AQ_CFG_FORCE_LEGACY_INT */
 
         /* net device init */
         for (port = 0; port < self->ports; ++port) {
@@ -265,6 +268,9 @@ void aq_pci_func_free(struct aq_pci_func_s *self)
                 aq_nic_ndev_free(self->port[port]);
         }
 
+        if (self->mmio)
+                iounmap(self->mmio);
+
         kfree(self);
 
 err_exit:;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 4eee1996a825..0654e0c76bc2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -104,6 +104,38 @@ int aq_ring_init(struct aq_ring_s *self)
         return 0;
 }
 
+static inline bool aq_ring_dx_in_range(unsigned int h, unsigned int i,
+                                       unsigned int t)
+{
+        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+}
+
+void aq_ring_update_queue_state(struct aq_ring_s *ring)
+{
+        if (aq_ring_avail_dx(ring) <= AQ_CFG_SKB_FRAGS_MAX)
+                aq_ring_queue_stop(ring);
+        else if (aq_ring_avail_dx(ring) > AQ_CFG_RESTART_DESC_THRES)
+                aq_ring_queue_wake(ring);
+}
+
+void aq_ring_queue_wake(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (__netif_subqueue_stopped(ndev, ring->idx)) {
+                netif_wake_subqueue(ndev, ring->idx);
+                ring->stats.tx.queue_restarts++;
+        }
+}
+
+void aq_ring_queue_stop(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (!__netif_subqueue_stopped(ndev, ring->idx))
+                netif_stop_subqueue(ndev, ring->idx);
+}
+
 void aq_ring_tx_clean(struct aq_ring_s *self)
 {
         struct device *dev = aq_nic_get_dev(self->aq_nic);
@@ -113,23 +145,28 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                 struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
 
                 if (likely(buff->is_mapped)) {
-                        if (unlikely(buff->is_sop))
+                        if (unlikely(buff->is_sop)) {
+                                if (!buff->is_eop &&
+                                    buff->eop_index != 0xffffU &&
+                                    (!aq_ring_dx_in_range(self->sw_head,
+                                                buff->eop_index,
+                                                self->hw_head)))
+                                        break;
+
                                 dma_unmap_single(dev, buff->pa, buff->len,
                                                  DMA_TO_DEVICE);
-                        else
+                        } else {
                                 dma_unmap_page(dev, buff->pa, buff->len,
                                                DMA_TO_DEVICE);
+                        }
                 }
 
                 if (unlikely(buff->is_eop))
                         dev_kfree_skb_any(buff->skb);
-        }
-}
 
-static inline unsigned int aq_ring_dx_in_range(unsigned int h, unsigned int i,
-                                               unsigned int t)
-{
-        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+                buff->pa = 0U;
+                buff->eop_index = 0xffffU;
+        }
 }
 
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 782176c5f4f8..5844078764bd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -65,7 +65,7 @@ struct __packed aq_ring_buff_s {
         };
         union {
                 struct {
-                        u32 len:16;
+                        u16 len;
                         u32 is_ip_cso:1;
                         u32 is_udp_cso:1;
                         u32 is_tcp_cso:1;
@@ -77,8 +77,10 @@ struct __packed aq_ring_buff_s {
                         u32 is_cleaned:1;
                         u32 is_error:1;
                         u32 rsvd3:6;
+                        u16 eop_index;
+                        u16 rsvd4;
                 };
-                u32 flags;
+                u64 flags;
         };
 };
 
@@ -94,6 +96,7 @@ struct aq_ring_stats_tx_s {
         u64 errors;
         u64 packets;
         u64 bytes;
+        u64 queue_restarts;
 };
 
 union aq_ring_stats_s {
@@ -147,6 +150,9 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
 int aq_ring_init(struct aq_ring_s *self);
 void aq_ring_rx_deinit(struct aq_ring_s *self);
 void aq_ring_free(struct aq_ring_s *self);
+void aq_ring_update_queue_state(struct aq_ring_s *ring);
+void aq_ring_queue_wake(struct aq_ring_s *ring);
+void aq_ring_queue_stop(struct aq_ring_s *ring);
 void aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                      struct napi_struct *napi,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index ebf588004c46..5fecc9a099ef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -59,12 +59,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                         if (ring[AQ_VEC_TX_ID].sw_head !=
                             ring[AQ_VEC_TX_ID].hw_head) {
                                 aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
-
-                                if (aq_ring_avail_dx(&ring[AQ_VEC_TX_ID]) >
-                                    AQ_CFG_SKB_FRAGS_MAX) {
-                                        aq_nic_ndev_queue_start(self->aq_nic,
-                                                ring[AQ_VEC_TX_ID].idx);
-                                }
+                                aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
                                 was_tx_cleaned = true;
                         }
 
@@ -364,6 +359,7 @@ void aq_vec_add_stats(struct aq_vec_s *self,
                 stats_tx->packets += tx->packets;
                 stats_tx->bytes += tx->bytes;
                 stats_tx->errors += tx->errors;
+                stats_tx->queue_restarts += tx->queue_restarts;
         }
 }
 
@@ -377,8 +373,11 @@ int aq_vec_get_sw_stats(struct aq_vec_s *self, u64 *data, unsigned int *p_count)
         memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
         aq_vec_add_stats(self, &stats_rx, &stats_tx);
 
+        /* This data should mimic aq_ethtool_queue_stat_names structure
+         */
         data[count] += stats_rx.packets;
         data[++count] += stats_tx.packets;
+        data[++count] += stats_tx.queue_restarts;
         data[++count] += stats_rx.jumbo_packets;
         data[++count] += stats_rx.lro_packets;
         data[++count] += stats_rx.errors;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index c5a02df7a48b..07b3c49a16a4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -765,24 +765,23 @@ err_exit:
         return err;
 }
 
-static int hw_atl_a0_hw_interrupt_moderation_set(struct aq_hw_s *self,
-                                                 bool itr_enabled)
+static int hw_atl_a0_hw_interrupt_moderation_set(struct aq_hw_s *self)
 {
         unsigned int i = 0U;
+        u32 itr_rx;
 
-        if (itr_enabled && self->aq_nic_cfg->itr) {
-                if (self->aq_nic_cfg->itr != 0xFFFFU) {
+        if (self->aq_nic_cfg->itr) {
+                if (self->aq_nic_cfg->itr != AQ_CFG_INTERRUPT_MODERATION_AUTO) {
                         u32 itr_ = (self->aq_nic_cfg->itr >> 1);
 
                         itr_ = min(AQ_CFG_IRQ_MASK, itr_);
 
-                        PHAL_ATLANTIC_A0->itr_rx = 0x80000000U |
-                                        (itr_ << 0x10);
+                        itr_rx = 0x80000000U | (itr_ << 0x10);
                 } else  {
                         u32 n = 0xFFFFU & aq_hw_read_reg(self, 0x00002A00U);
 
                         if (n < self->aq_link_status.mbps) {
-                                PHAL_ATLANTIC_A0->itr_rx = 0U;
+                                itr_rx = 0U;
                         } else {
                                 static unsigned int hw_timers_tbl_[] = {
                                         0x01CU, /* 10Gbit */
@@ -797,8 +796,7 @@ static int hw_atl_a0_hw_interrupt_moderation_set(struct aq_hw_s *self,
                                         hw_atl_utils_mbps_2_speed_index(
                                                 self->aq_link_status.mbps);
 
-                                PHAL_ATLANTIC_A0->itr_rx =
-                                        0x80000000U |
+                                itr_rx = 0x80000000U |
                                         (hw_timers_tbl_[speed_index] << 0x10U);
                         }
 
@@ -806,11 +804,11 @@ static int hw_atl_a0_hw_interrupt_moderation_set(struct aq_hw_s *self,
                         aq_hw_write_reg(self, 0x00002A00U, 0x8D000000U);
                 }
         } else {
-                PHAL_ATLANTIC_A0->itr_rx = 0U;
+                itr_rx = 0U;
         }
 
         for (i = HW_ATL_A0_RINGS_MAX; i--;)
-                reg_irq_thr_set(self, PHAL_ATLANTIC_A0->itr_rx, i);
+                reg_irq_thr_set(self, itr_rx, i);
 
         return aq_hw_err_from_flags(self);
 }
@@ -885,6 +883,7 @@ static struct aq_hw_ops hw_atl_ops_ = {
         .hw_rss_set                  = hw_atl_a0_hw_rss_set,
         .hw_rss_hash_set             = hw_atl_a0_hw_rss_hash_set,
         .hw_get_regs                 = hw_atl_utils_hw_get_regs,
+        .hw_update_stats             = hw_atl_utils_update_stats,
         .hw_get_hw_stats             = hw_atl_utils_get_hw_stats,
         .hw_get_fw_version           = hw_atl_utils_get_fw_version,
 };
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 21784cc39dab..ec68c20efcbd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -788,39 +788,45 @@ err_exit:
         return err;
 }
 
-static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self,
-                                                 bool itr_enabled)
+static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
 {
         unsigned int i = 0U;
+        u32 itr_tx = 2U;
+        u32 itr_rx = 2U;
 
-        if (itr_enabled && self->aq_nic_cfg->itr) {
+        switch (self->aq_nic_cfg->itr) {
+        case  AQ_CFG_INTERRUPT_MODERATION_ON:
+        case  AQ_CFG_INTERRUPT_MODERATION_AUTO:
                 tdm_tx_desc_wr_wb_irq_en_set(self, 0U);
                 tdm_tdm_intr_moder_en_set(self, 1U);
                 rdm_rx_desc_wr_wb_irq_en_set(self, 0U);
                 rdm_rdm_intr_moder_en_set(self, 1U);
 
-                PHAL_ATLANTIC_B0->itr_tx = 2U;
-                PHAL_ATLANTIC_B0->itr_rx = 2U;
+                if (self->aq_nic_cfg->itr == AQ_CFG_INTERRUPT_MODERATION_ON) {
+                        /* HW timers are in 2us units */
+                        int tx_max_timer = self->aq_nic_cfg->tx_itr / 2;
+                        int tx_min_timer = tx_max_timer / 2;
 
-                if (self->aq_nic_cfg->itr != 0xFFFFU) {
-                        unsigned int max_timer = self->aq_nic_cfg->itr / 2U;
-                        unsigned int min_timer = self->aq_nic_cfg->itr / 32U;
+                        int rx_max_timer = self->aq_nic_cfg->rx_itr / 2;
+                        int rx_min_timer = rx_max_timer / 2;
 
-                        max_timer = min(0x1FFU, max_timer);
-                        min_timer = min(0xFFU, min_timer);
+                        tx_max_timer = min(HW_ATL_INTR_MODER_MAX, tx_max_timer);
+                        tx_min_timer = min(HW_ATL_INTR_MODER_MIN, tx_min_timer);
+                        rx_max_timer = min(HW_ATL_INTR_MODER_MAX, rx_max_timer);
+                        rx_min_timer = min(HW_ATL_INTR_MODER_MIN, rx_min_timer);
 
-                        PHAL_ATLANTIC_B0->itr_tx |= min_timer << 0x8U;
-                        PHAL_ATLANTIC_B0->itr_tx |= max_timer << 0x10U;
-                        PHAL_ATLANTIC_B0->itr_rx |= min_timer << 0x8U;
-                        PHAL_ATLANTIC_B0->itr_rx |= max_timer << 0x10U;
+                        itr_tx |= tx_min_timer << 0x8U;
+                        itr_tx |= tx_max_timer << 0x10U;
+                        itr_rx |= rx_min_timer << 0x8U;
+                        itr_rx |= rx_max_timer << 0x10U;
                 } else {
                         static unsigned int hw_atl_b0_timers_table_tx_[][2] = {
-                                {0xffU, 0xffU}, /* 10Gbit */
-                                {0xffU, 0x1ffU}, /* 5Gbit */
-                                {0xffU, 0x1ffU}, /* 5Gbit 5GS */
-                                {0xffU, 0x1ffU}, /* 2.5Gbit */
-                                {0xffU, 0x1ffU}, /* 1Gbit */
-                                {0xffU, 0x1ffU}, /* 100Mbit */
+                                {0xfU, 0xffU}, /* 10Gbit */
+                                {0xfU, 0x1ffU}, /* 5Gbit */
+                                {0xfU, 0x1ffU}, /* 5Gbit 5GS */
+                                {0xfU, 0x1ffU}, /* 2.5Gbit */
+                                {0xfU, 0x1ffU}, /* 1Gbit */
+                                {0xfU, 0x1ffU}, /* 100Mbit */
                         };
 
                         static unsigned int hw_atl_b0_timers_table_rx_[][2] = {
@@ -836,34 +842,36 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self,
                                         hw_atl_utils_mbps_2_speed_index(
                                                 self->aq_link_status.mbps);
 
-                        PHAL_ATLANTIC_B0->itr_tx |=
-                                hw_atl_b0_timers_table_tx_[speed_index]
-                                [0] << 0x8U; /* set min timer value */
-                        PHAL_ATLANTIC_B0->itr_tx |=
-                                hw_atl_b0_timers_table_tx_[speed_index]
-                                [1] << 0x10U; /* set max timer value */
-
-                        PHAL_ATLANTIC_B0->itr_rx |=
-                                hw_atl_b0_timers_table_rx_[speed_index]
-                                [0] << 0x8U; /* set min timer value */
-                        PHAL_ATLANTIC_B0->itr_rx |=
-                                hw_atl_b0_timers_table_rx_[speed_index]
-                                [1] << 0x10U; /* set max timer value */
+                        /* Update user visible ITR settings */
+                        self->aq_nic_cfg->tx_itr = hw_atl_b0_timers_table_tx_
+                                                        [speed_index][1] * 2;
+                        self->aq_nic_cfg->rx_itr = hw_atl_b0_timers_table_rx_
+                                                        [speed_index][1] * 2;
+
+                        itr_tx |= hw_atl_b0_timers_table_tx_
+                                                [speed_index][0] << 0x8U;
+                        itr_tx |= hw_atl_b0_timers_table_tx_
+                                                [speed_index][1] << 0x10U;
+
+                        itr_rx |= hw_atl_b0_timers_table_rx_
+                                                [speed_index][0] << 0x8U;
+                        itr_rx |= hw_atl_b0_timers_table_rx_
+                                                [speed_index][1] << 0x10U;
                 }
-        } else {
+                break;
+        case AQ_CFG_INTERRUPT_MODERATION_OFF:
                 tdm_tx_desc_wr_wb_irq_en_set(self, 1U);
                 tdm_tdm_intr_moder_en_set(self, 0U);
                 rdm_rx_desc_wr_wb_irq_en_set(self, 1U);
                 rdm_rdm_intr_moder_en_set(self, 0U);
-                PHAL_ATLANTIC_B0->itr_tx = 0U;
-                PHAL_ATLANTIC_B0->itr_rx = 0U;
+                itr_tx = 0U;
+                itr_rx = 0U;
+                break;
         }
 
         for (i = HW_ATL_B0_RINGS_MAX; i--;) {
-                reg_tx_intr_moder_ctrl_set(self,
-                                           PHAL_ATLANTIC_B0->itr_tx, i);
-                reg_rx_intr_moder_ctrl_set(self,
-                                           PHAL_ATLANTIC_B0->itr_rx, i);
+                reg_tx_intr_moder_ctrl_set(self, itr_tx, i);
+                reg_rx_intr_moder_ctrl_set(self, itr_rx, i);
         }
 
         return aq_hw_err_from_flags(self);
@@ -939,6 +947,7 @@ static struct aq_hw_ops hw_atl_ops_ = {
         .hw_rss_set                  = hw_atl_b0_hw_rss_set,
         .hw_rss_hash_set             = hw_atl_b0_hw_rss_hash_set,
         .hw_get_regs                 = hw_atl_utils_hw_get_regs,
+        .hw_update_stats             = hw_atl_utils_update_stats,
         .hw_get_hw_stats             = hw_atl_utils_get_hw_stats,
         .hw_get_fw_version           = hw_atl_utils_get_fw_version,
 };
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index f3957e930340..9aa2c6edfca2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -16,7 +16,7 @@
 
 #include "../aq_common.h"
 
-#define HW_ATL_B0_MTU_JUMBO (16000U)
+#define HW_ATL_B0_MTU_JUMBO  16352U
 #define HW_ATL_B0_MTU        1514U
 
 #define HW_ATL_B0_TX_RINGS 4U
@@ -139,6 +139,9 @@
 
 #define HW_ATL_B0_FW_VER_EXPECTED 0x01050006U
 
+#define HW_ATL_INTR_MODER_MAX  0x1FF
+#define HW_ATL_INTR_MODER_MIN  0xFF
+
 /* Hardware tx descriptor */
 struct __packed hw_atl_txd_s {
         u64 buf_addr;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 4f5ec9a0fbfb..1fe016fc4bc7 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -255,6 +255,15 @@ err_exit:
         return err;
 }
 
+int hw_atl_utils_mpi_read_mbox(struct aq_hw_s *self,
+                               struct hw_aq_atl_utils_mbox_header *pmbox)
+{
+        return hw_atl_utils_fw_downld_dwords(self,
+                                      PHAL_ATLANTIC->mbox_addr,
+                                      (u32 *)(void *)pmbox,
+                                      sizeof(*pmbox) / sizeof(u32));
+}
+
 void hw_atl_utils_mpi_read_stats(struct aq_hw_s *self,
                                  struct hw_aq_atl_utils_mbox *pmbox)
 {
@@ -267,9 +276,6 @@ void hw_atl_utils_mpi_read_stats(struct aq_hw_s *self,
         if (err < 0)
                 goto err_exit;
 
-        if (pmbox != &PHAL_ATLANTIC->mbox)
-                memcpy(pmbox, &PHAL_ATLANTIC->mbox, sizeof(*pmbox));
-
         if (IS_CHIP_FEATURE(REVISION_A0)) {
                 unsigned int mtu = self->aq_nic_cfg ?
                                         self->aq_nic_cfg->mtu : 1514U;
@@ -299,17 +305,17 @@ void hw_atl_utils_mpi_set(struct aq_hw_s *self,
 {
         int err = 0;
         u32 transaction_id = 0;
+        struct hw_aq_atl_utils_mbox_header mbox;
 
         if (state == MPI_RESET) {
-                hw_atl_utils_mpi_read_stats(self, &PHAL_ATLANTIC->mbox);
+                hw_atl_utils_mpi_read_mbox(self, &mbox);
 
-                transaction_id = PHAL_ATLANTIC->mbox.transaction_id;
+                transaction_id = mbox.transaction_id;
 
                 AQ_HW_WAIT_FOR(transaction_id !=
-                                (hw_atl_utils_mpi_read_stats
-                                        (self, &PHAL_ATLANTIC->mbox),
-                                        PHAL_ATLANTIC->mbox.transaction_id),
-                                        1000U, 100U);
+                                (hw_atl_utils_mpi_read_mbox(self, &mbox),
+                                 mbox.transaction_id),
+                               1000U, 100U);
                 if (err < 0)
                         goto err_exit;
         }
@@ -351,8 +357,7 @@ int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self)
                         break;
 
                 default:
-                        link_status->mbps = 0U;
-                        break;
+                        return -EBUSY;
                 }
         }
 
@@ -493,16 +498,51 @@ int hw_atl_utils_hw_set_power(struct aq_hw_s *self,
         return 0;
 }
 
+int hw_atl_utils_update_stats(struct aq_hw_s *self)
+{
+        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
+        struct hw_aq_atl_utils_mbox mbox;
+
+        if (!self->aq_link_status.mbps)
+                return 0;
+
+        hw_atl_utils_mpi_read_stats(self, &mbox);
+
+#define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \
+                        mbox.stats._N_ - hw_self->last_stats._N_)
+
+        AQ_SDELTA(uprc);
+        AQ_SDELTA(mprc);
+        AQ_SDELTA(bprc);
+        AQ_SDELTA(erpt);
+
+        AQ_SDELTA(uptc);
+        AQ_SDELTA(mptc);
+        AQ_SDELTA(bptc);
+        AQ_SDELTA(erpr);
+
+        AQ_SDELTA(ubrc);
+        AQ_SDELTA(ubtc);
+        AQ_SDELTA(mbrc);
+        AQ_SDELTA(mbtc);
+        AQ_SDELTA(bbrc);
+        AQ_SDELTA(bbtc);
+        AQ_SDELTA(dpc);
+
+#undef AQ_SDELTA
+
+        memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));
+
+        return 0;
+}
+
 int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
                               u64 *data, unsigned int *p_count)
 {
-        struct hw_atl_stats_s *stats = NULL;
+        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
+        struct hw_atl_stats_s *stats = &hw_self->curr_stats;
         int i = 0;
 
-        hw_atl_utils_mpi_read_stats(self, &PHAL_ATLANTIC->mbox);
-
-        stats = &PHAL_ATLANTIC->mbox.stats;
-
         data[i] = stats->uprc + stats->mprc + stats->bprc;
         data[++i] = stats->uprc;
         data[++i] = stats->mprc;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index e0360a6b2202..c99cc690e425 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -115,19 +115,22 @@ struct __packed hw_aq_atl_utils_fw_rpc {
         };
 };
 
-struct __packed hw_aq_atl_utils_mbox {
+struct __packed hw_aq_atl_utils_mbox_header {
         u32 version;
         u32 transaction_id;
-        int error;
+        u32 error;
+};
+
+struct __packed hw_aq_atl_utils_mbox {
+        struct hw_aq_atl_utils_mbox_header header;
         struct hw_atl_stats_s stats;
 };
 
 struct __packed hw_atl_s {
         struct aq_hw_s base;
-        struct hw_aq_atl_utils_mbox mbox;
+        struct hw_atl_stats_s last_stats;
+        struct hw_atl_stats_s curr_stats;
         u64 speed;
-        u32 itr_tx;
-        u32 itr_rx;
         unsigned int chip_features;
         u32 fw_ver_actual;
         atomic_t dpc;
@@ -170,6 +173,9 @@ enum hal_atl_utils_fw_state_e {
 
 void hw_atl_utils_hw_chip_features_init(struct aq_hw_s *self, u32 *p);
 
+int hw_atl_utils_mpi_read_mbox(struct aq_hw_s *self,
+                               struct hw_aq_atl_utils_mbox_header *pmbox);
+
 void hw_atl_utils_mpi_read_stats(struct aq_hw_s *self,
                                  struct hw_aq_atl_utils_mbox *pmbox);
 
@@ -199,6 +205,8 @@ int hw_atl_utils_hw_deinit(struct aq_hw_s *self);
 
 int hw_atl_utils_get_fw_version(struct aq_hw_s *self, u32 *fw_version);
 
+int hw_atl_utils_update_stats(struct aq_hw_s *self);
+
 int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
                               u64 *data,
                               unsigned int *p_count);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index aacec8bc19d5..dc5de275352a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -214,6 +214,8 @@ static const u16 bnxt_async_events_arr[] = {
         ASYNC_EVENT_CMPL_EVENT_ID_LINK_SPEED_CFG_CHANGE,
 };
 
+static struct workqueue_struct *bnxt_pf_wq;
+
 static bool bnxt_vf_pciid(enum board_idx idx)
 {
         return (idx == NETXTREME_C_VF || idx == NETXTREME_E_VF);
@@ -1024,12 +1026,28 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_napi *bnapi,
         return 0;
 }
 
+static void bnxt_queue_sp_work(struct bnxt *bp)
+{
+        if (BNXT_PF(bp))
+                queue_work(bnxt_pf_wq, &bp->sp_task);
+        else
+                schedule_work(&bp->sp_task);
+}
+
+static void bnxt_cancel_sp_work(struct bnxt *bp)
+{
+        if (BNXT_PF(bp))
+                flush_workqueue(bnxt_pf_wq);
+        else
+                cancel_work_sync(&bp->sp_task);
+}
+
 static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
 {
         if (!rxr->bnapi->in_reset) {
                 rxr->bnapi->in_reset = true;
                 set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
-                schedule_work(&bp->sp_task);
+                bnxt_queue_sp_work(bp);
         }
         rxr->rx_next_cons = 0xffff;
 }
@@ -1717,7 +1735,7 @@ static int bnxt_async_event_process(struct bnxt *bp,
         default:
                 goto async_event_process_exit;
         }
-        schedule_work(&bp->sp_task);
+        bnxt_queue_sp_work(bp);
 async_event_process_exit:
         bnxt_ulp_async_events(bp, cmpl);
         return 0;
@@ -1751,7 +1769,7 @@ static int bnxt_hwrm_handler(struct bnxt *bp, struct tx_cmp *txcmp)
 
                 set_bit(vf_id - bp->pf.first_vf_id, bp->pf.vf_event_bmap);
                 set_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event);
-                schedule_work(&bp->sp_task);
+                bnxt_queue_sp_work(bp);
                 break;
 
         case CMPL_BASE_TYPE_HWRM_ASYNC_EVENT:
@@ -3448,6 +3466,12 @@ int _hwrm_send_message(struct bnxt *bp, void *msg, u32 msg_len, int timeout)
         return bnxt_hwrm_do_send_msg(bp, msg, msg_len, timeout, false);
 }
 
+int _hwrm_send_message_silent(struct bnxt *bp, void *msg, u32 msg_len,
+                              int timeout)
+{
+        return bnxt_hwrm_do_send_msg(bp, msg, msg_len, timeout, true);
+}
+
 int hwrm_send_message(struct bnxt *bp, void *msg, u32 msg_len, int timeout)
 {
         int rc;
@@ -6327,7 +6351,9 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         }
 
         if (link_re_init) {
+                mutex_lock(&bp->link_lock);
                 rc = bnxt_update_phy_setting(bp);
+                mutex_unlock(&bp->link_lock);
                 if (rc)
                         netdev_warn(bp->dev, "failed to update phy settings\n");
         }
@@ -6647,7 +6673,7 @@ static void bnxt_set_rx_mode(struct net_device *dev)
                 vnic->rx_mask = mask;
 
                 set_bit(BNXT_RX_MASK_SP_EVENT, &bp->sp_event);
-                schedule_work(&bp->sp_task);
+                bnxt_queue_sp_work(bp);
         }
 }
 
@@ -6920,7 +6946,7 @@ static void bnxt_tx_timeout(struct net_device *dev)
 
         netdev_err(bp->dev,  "TX timeout detected, starting reset task!\n");
         set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
-        schedule_work(&bp->sp_task);
+        bnxt_queue_sp_work(bp);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -6952,7 +6978,7 @@ static void bnxt_timer(unsigned long data)
         if (bp->link_info.link_up && (bp->flags & BNXT_FLAG_PORT_STATS) &&
             bp->stats_coal_ticks) {
                 set_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event);
-                schedule_work(&bp->sp_task);
+                bnxt_queue_sp_work(bp);
         }
 bnxt_restart_timer:
         mod_timer(&bp->timer, jiffies + bp->current_interval);
@@ -7025,30 +7051,28 @@ static void bnxt_sp_task(struct work_struct *work)
         if (test_and_clear_bit(BNXT_PERIODIC_STATS_SP_EVENT, &bp->sp_event))
                 bnxt_hwrm_port_qstats(bp);
 
-        /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
-         * must be the last functions to be called before exiting.
-         */
         if (test_and_clear_bit(BNXT_LINK_CHNG_SP_EVENT, &bp->sp_event)) {
-                int rc = 0;
+                int rc;
 
+                mutex_lock(&bp->link_lock);
                 if (test_and_clear_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT,
                                        &bp->sp_event))
                         bnxt_hwrm_phy_qcaps(bp);
 
-                bnxt_rtnl_lock_sp(bp);
-                if (test_bit(BNXT_STATE_OPEN, &bp->state))
-                        rc = bnxt_update_link(bp, true);
-                bnxt_rtnl_unlock_sp(bp);
+                rc = bnxt_update_link(bp, true);
+                mutex_unlock(&bp->link_lock);
                 if (rc)
                         netdev_err(bp->dev, "SP task can't update link (rc: %x)\n",
                                    rc);
         }
         if (test_and_clear_bit(BNXT_HWRM_PORT_MODULE_SP_EVENT, &bp->sp_event)) {
-                bnxt_rtnl_lock_sp(bp);
-                if (test_bit(BNXT_STATE_OPEN, &bp->state))
-                        bnxt_get_port_module_status(bp);
-                bnxt_rtnl_unlock_sp(bp);
+                mutex_lock(&bp->link_lock);
+                bnxt_get_port_module_status(bp);
+                mutex_unlock(&bp->link_lock);
         }
+        /* These functions below will clear BNXT_STATE_IN_SP_TASK.  They
+         * must be the last functions to be called before exiting.
+         */
         if (test_and_clear_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event))
                 bnxt_reset(bp, false);
 
@@ -7433,7 +7457,7 @@ static int bnxt_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
         spin_unlock_bh(&bp->ntp_fltr_lock);
 
         set_bit(BNXT_RX_NTP_FLTR_SP_EVENT, &bp->sp_event);
-        schedule_work(&bp->sp_task);
+        bnxt_queue_sp_work(bp);
 
         return new_fltr->sw_id;
 
@@ -7516,7 +7540,7 @@ static void bnxt_udp_tunnel_add(struct net_device *dev,
                 if (bp->vxlan_port_cnt == 1) {
                         bp->vxlan_port = ti->port;
                         set_bit(BNXT_VXLAN_ADD_PORT_SP_EVENT, &bp->sp_event);
-                        schedule_work(&bp->sp_task);
+                        bnxt_queue_sp_work(bp);
                 }
                 break;
         case UDP_TUNNEL_TYPE_GENEVE:
@@ -7533,7 +7557,7 @@ static void bnxt_udp_tunnel_add(struct net_device *dev,
                 return;
         }
 
-        schedule_work(&bp->sp_task);
+        bnxt_queue_sp_work(bp);
 }
 
 static void bnxt_udp_tunnel_del(struct net_device *dev,
@@ -7572,7 +7596,7 @@ static void bnxt_udp_tunnel_del(struct net_device *dev,
                 return;
         }
 
-        schedule_work(&bp->sp_task);
+        bnxt_queue_sp_work(bp);
 }
 
 static int bnxt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
@@ -7720,7 +7744,7 @@ static void bnxt_remove_one(struct pci_dev *pdev)
         pci_disable_pcie_error_reporting(pdev);
         unregister_netdev(dev);
         bnxt_shutdown_tc(bp);
-        cancel_work_sync(&bp->sp_task);
+        bnxt_cancel_sp_work(bp);
         bp->sp_event = 0;
 
         bnxt_clear_int_mode(bp);
@@ -7748,6 +7772,7 @@ static int bnxt_probe_phy(struct bnxt *bp)
                            rc);
                 return rc;
         }
+        mutex_init(&bp->link_lock);
 
         rc = bnxt_update_link(bp, false);
         if (rc) {
@@ -7946,7 +7971,7 @@ static void bnxt_parse_log_pcie_link(struct bnxt *bp)
         enum pcie_link_width width = PCIE_LNK_WIDTH_UNKNOWN;
         enum pci_bus_speed speed = PCI_SPEED_UNKNOWN;
 
-        if (pcie_get_minimum_link(bp->pdev, &speed, &width) ||
+        if (pcie_get_minimum_link(pci_physfn(bp->pdev), &speed, &width) ||
             speed == PCI_SPEED_UNKNOWN || width == PCIE_LNK_WIDTH_UNKNOWN)
                 netdev_info(bp->dev, "Failed to determine PCIe Link Info\n");
         else
@@ -8138,8 +8163,17 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         else
                 device_set_wakeup_capable(&pdev->dev, false);
 
-        if (BNXT_PF(bp))
+        if (BNXT_PF(bp)) {
+                if (!bnxt_pf_wq) {
+                        bnxt_pf_wq =
+                                create_singlethread_workqueue("bnxt_pf_wq");
+                        if (!bnxt_pf_wq) {
+                                dev_err(&pdev->dev, "Unable to create workqueue.\n");
+                                goto init_err_pci_clean;
+                        }
+                }
                 bnxt_init_tc(bp);
+        }
 
         rc = register_netdev(dev);
         if (rc)
@@ -8375,4 +8409,17 @@ static struct pci_driver bnxt_pci_driver = {
 #endif
 };
 
-module_pci_driver(bnxt_pci_driver);
+static int __init bnxt_init(void)
+{
+        return pci_register_driver(&bnxt_pci_driver);
+}
+
+static void __exit bnxt_exit(void)
+{
+        pci_unregister_driver(&bnxt_pci_driver);
+        if (bnxt_pf_wq)
+                destroy_workqueue(bnxt_pf_wq);
+}
+
+module_init(bnxt_init);
+module_exit(bnxt_exit);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 7b888d4b2b55..c911e69ff25f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1290,6 +1290,10 @@ struct bnxt {
         unsigned long           *ntp_fltr_bmap;
         int                     ntp_fltr_count;
 
+        /* To protect link related settings during link changes and
+         * ethtool settings changes.
+         */
+        struct mutex            link_lock;
         struct bnxt_link_info   link_info;
         struct ethtool_eee      eee;
         u32                     lpi_tmr_lo;
@@ -1358,6 +1362,7 @@ void bnxt_set_ring_params(struct bnxt *);
 int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode);
 void bnxt_hwrm_cmd_hdr_init(struct bnxt *, void *, u16, u16, u16);
 int _hwrm_send_message(struct bnxt *, void *, u32, int);
+int _hwrm_send_message_silent(struct bnxt *bp, void *msg, u32 len, int timeout);
 int hwrm_send_message(struct bnxt *, void *, u32, int);
 int hwrm_send_message_silent(struct bnxt *, void *, u32, int);
 int bnxt_hwrm_func_rgtr_async_events(struct bnxt *bp, unsigned long *bmap,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index aa1f3a2c7a78..fed37cd9ae1d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -50,7 +50,9 @@ static int bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt *bp, struct ieee_ets *ets)
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PRI2COS_QCFG, -1, -1);
         req.flags = cpu_to_le32(QUEUE_PRI2COS_QCFG_REQ_FLAGS_IVLAN);
-        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (!rc) {
                 u8 *pri2cos = &resp->pri0_cos_queue_id;
                 int i, j;
@@ -66,6 +68,7 @@ static int bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt *bp, struct ieee_ets *ets)
                         }
                 }
         }
+        mutex_unlock(&bp->hwrm_cmd_lock);
         return rc;
 }
 
@@ -119,9 +122,13 @@ static int bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt *bp, struct ieee_ets *ets)
         int rc, i;
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_QCFG, -1, -1);
-        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
-        if (rc)
+
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (rc) {
+                mutex_unlock(&bp->hwrm_cmd_lock);
                 return rc;
+        }
 
         data = &resp->queue_id0 + offsetof(struct bnxt_cos2bw_cfg, queue_id);
         for (i = 0; i < bp->max_tc; i++, data += sizeof(cos2bw) - 4) {
@@ -143,6 +150,7 @@ static int bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt *bp, struct ieee_ets *ets)
                         }
                 }
         }
+        mutex_unlock(&bp->hwrm_cmd_lock);
         return 0;
 }
 
@@ -240,12 +248,17 @@ static int bnxt_hwrm_queue_pfc_qcfg(struct bnxt *bp, struct ieee_pfc *pfc)
         int rc;
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PFCENABLE_QCFG, -1, -1);
-        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
-        if (rc)
+
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (rc) {
+                mutex_unlock(&bp->hwrm_cmd_lock);
                 return rc;
+        }
 
         pri_mask = le32_to_cpu(resp->flags);
         pfc->pfc_en = pri_mask;
+        mutex_unlock(&bp->hwrm_cmd_lock);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 8eff05a3e0e4..3cbe771b3352 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -1052,6 +1052,7 @@ static int bnxt_get_link_ksettings(struct net_device *dev,
         u32 ethtool_speed;
 
         ethtool_link_ksettings_zero_link_mode(lk_ksettings, supported);
+        mutex_lock(&bp->link_lock);
         bnxt_fw_to_ethtool_support_spds(link_info, lk_ksettings);
 
         ethtool_link_ksettings_zero_link_mode(lk_ksettings, advertising);
@@ -1099,6 +1100,7 @@ static int bnxt_get_link_ksettings(struct net_device *dev,
                         base->port = PORT_FIBRE;
         }
         base->phy_address = link_info->phy_addr;
+        mutex_unlock(&bp->link_lock);
 
         return 0;
 }
@@ -1190,6 +1192,7 @@ static int bnxt_set_link_ksettings(struct net_device *dev,
         if (!BNXT_SINGLE_PF(bp))
                 return -EOPNOTSUPP;
 
+        mutex_lock(&bp->link_lock);
         if (base->autoneg == AUTONEG_ENABLE) {
                 BNXT_ETHTOOL_TO_FW_SPDS(fw_advertising, lk_ksettings,
                                         advertising);
@@ -1234,6 +1237,7 @@ static int bnxt_set_link_ksettings(struct net_device *dev,
                 rc = bnxt_hwrm_set_link_setting(bp, set_pause, false);
 
 set_setting_exit:
+        mutex_unlock(&bp->link_lock);
         return rc;
 }
 
@@ -1805,7 +1809,8 @@ static int bnxt_find_nvram_item(struct net_device *dev, u16 type, u16 ordinal,
         req.dir_ordinal = cpu_to_le16(ordinal);
         req.dir_ext = cpu_to_le16(ext);
         req.opt_ordinal = NVM_FIND_DIR_ENTRY_REQ_OPT_ORDINAL_EQ;
-        rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        mutex_lock(&bp->hwrm_cmd_lock);
+        rc = _hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc == 0) {
                 if (index)
                         *index = le16_to_cpu(output->dir_idx);
@@ -1814,6 +1819,7 @@ static int bnxt_find_nvram_item(struct net_device *dev, u16 type, u16 ordinal,
                 if (data_length)
                         *data_length = le32_to_cpu(output->dir_data_length);
         }
+        mutex_unlock(&bp->hwrm_cmd_lock);
         return rc;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index d37925a8a65b..5ee18660bc33 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -502,6 +502,7 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
         int rc = 0, vfs_supported;
         int min_rx_rings, min_tx_rings, min_rss_ctxs;
         int tx_ok = 0, rx_ok = 0, rss_ok = 0;
+        int avail_cp, avail_stat;
 
         /* Check if we can enable requested num of vf's. At a mininum
          * we require 1 RX 1 TX rings for each VF. In this minimum conf
@@ -509,6 +510,10 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
          */
         vfs_supported = *num_vfs;
 
+        avail_cp = bp->pf.max_cp_rings - bp->cp_nr_rings;
+        avail_stat = bp->pf.max_stat_ctxs - bp->num_stat_ctxs;
+        avail_cp = min_t(int, avail_cp, avail_stat);
+
         while (vfs_supported) {
                 min_rx_rings = vfs_supported;
                 min_tx_rings = vfs_supported;
@@ -523,10 +528,12 @@ static int bnxt_sriov_enable(struct bnxt *bp, int *num_vfs)
                             min_rx_rings)
                                 rx_ok = 1;
                 }
-                if (bp->pf.max_vnics - bp->nr_vnics < min_rx_rings)
+                if (bp->pf.max_vnics - bp->nr_vnics < min_rx_rings ||
+                    avail_cp < min_rx_rings)
                         rx_ok = 0;
 
-                if (bp->pf.max_tx_rings - bp->tx_nr_rings >= min_tx_rings)
+                if (bp->pf.max_tx_rings - bp->tx_nr_rings >= min_tx_rings &&
+                    avail_cp >= min_tx_rings)
                         tx_ok = 1;
 
                 if (bp->pf.max_rsscos_ctxs - bp->rsscos_nr_ctxs >= min_rss_ctxs)
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index cec94bbb2ea5..8bc126a156e8 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1278,7 +1278,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 
         ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
         if (ret)
-                return -ENOMEM;
+                goto error;
 
         n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
         for (i = 0, j = 0; i < cp->max_cid_space; i++) {
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index e7f54948173f..5b19826a7e16 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -1847,7 +1847,7 @@ static int liquidio_ptp_settime(struct ptp_clock_info *ptp,
         struct lio *lio = container_of(ptp, struct lio, ptp_info);
         struct octeon_device *oct = (struct octeon_device *)lio->oct_dev;
 
-        ns = timespec_to_ns(ts);
+        ns = timespec64_to_ns(ts);
 
         spin_lock_irqsave(&lio->ptp_lock, flags);
         lio_pci_writeq(oct, ns, CN6XXX_MIO_PTP_CLOCK_HI);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 49b80da51ba7..805ab45e9b5a 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -565,8 +565,10 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 return true;
         default:
                 bpf_warn_invalid_xdp_action(action);
+                /* fall through */
         case XDP_ABORTED:
                 trace_xdp_exception(nic->netdev, prog, action);
+                /* fall through */
         case XDP_DROP:
                 /* Check if it's a recycled page, if not
                  * unmap the DMA mapping.
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 36520634c96a..e77192683dba 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2369,8 +2369,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
                         priv->enet_ver = AE_VERSION_2;
 
                 ae_node = of_parse_phandle(dev->of_node, "ae-handle", 0);
-                if (IS_ERR_OR_NULL(ae_node)) {
-                        ret = PTR_ERR(ae_node);
+                if (!ae_node) {
+                        ret = -ENODEV;
                         dev_err(dev, "not find ae-handle\n");
                         goto out_read_prop_fail;
                 }
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index e0685e630afe..c1cdbfd83bdb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -2652,7 +2652,8 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
                 dev_err(&hdev->pdev->dev,
                         "Configure rss tc size failed, invalid TC_SIZE = %d\n",
                         rss_size);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err;
         }
 
         roundup_size = roundup_pow_of_two(rss_size);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index cb8182f4fdfa..c66abd476023 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1093,11 +1093,12 @@ static int build_hdr_data(u8 hdr_field, struct sk_buff *skb,
  * places them in a descriptor array, scrq_arr
  */
 
-static void create_hdr_descs(u8 hdr_field, u8 *hdr_data, int len, int *hdr_len,
-                             union sub_crq *scrq_arr)
+static int create_hdr_descs(u8 hdr_field, u8 *hdr_data, int len, int *hdr_len,
+                            union sub_crq *scrq_arr)
 {
         union sub_crq hdr_desc;
         int tmp_len = len;
+        int num_descs = 0;
         u8 *data, *cur;
         int tmp;
 
@@ -1126,7 +1127,10 @@ static void create_hdr_descs(u8 hdr_field, u8 *hdr_data, int len, int *hdr_len,
                 tmp_len -= tmp;
                 *scrq_arr = hdr_desc;
                 scrq_arr++;
+                num_descs++;
         }
+
+        return num_descs;
 }
 
 /**
@@ -1144,16 +1148,12 @@ static void build_hdr_descs_arr(struct ibmvnic_tx_buff *txbuff,
                                 int *num_entries, u8 hdr_field)
 {
         int hdr_len[3] = {0, 0, 0};
-        int tot_len, len;
+        int tot_len;
         u8 *hdr_data = txbuff->hdr_data;
 
         tot_len = build_hdr_data(hdr_field, txbuff->skb, hdr_len,
                                  txbuff->hdr_data);
-        len = tot_len;
-        len -= 24;
-        if (len > 0)
-                num_entries += len % 29 ? len / 29 + 1 : len / 29;
-        create_hdr_descs(hdr_field, hdr_data, tot_len, hdr_len,
+        *num_entries += create_hdr_descs(hdr_field, hdr_data, tot_len, hdr_len,
                          txbuff->indir_arr + 1);
 }
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index ec8aa4562cc9..3b3983a1ffbb 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1824,11 +1824,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         int i;
-        char *p = NULL;
         const struct e1000_stats *stat = e1000_gstrings_stats;
 
         e1000_update_stats(adapter);
-        for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) {
+        for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) {
+                char *p;
+
                 switch (stat->type) {
                 case NETDEV_STATS:
                         p = (char *)netdev + stat->stat_offset;
@@ -1839,15 +1840,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
                 default:
                         WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n",
                                   stat->type, i);
-                        break;
+                        continue;
                 }
 
                 if (stat->sizeof_stat == sizeof(u64))
                         data[i] = *(u64 *)p;
                 else
                         data[i] = *(u32 *)p;
-
-                stat++;
         }
 /* BUG_ON(i != E1000_STATS_LEN); */
 }
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 98375e1e1185..1982f7917a8d 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -520,8 +520,6 @@ void e1000_down(struct e1000_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         u32 rctl, tctl;
 
-        netif_carrier_off(netdev);
-
         /* disable receives in the hardware */
         rctl = er32(RCTL);
         ew32(RCTL, rctl & ~E1000_RCTL_EN);
@@ -537,6 +535,15 @@ void e1000_down(struct e1000_adapter *adapter)
         E1000_WRITE_FLUSH();
         msleep(10);
 
+        /* Set the carrier off after transmits have been disabled in the
+         * hardware, to avoid race conditions with e1000_watchdog() (which
+         * may be running concurrently to us, checking for the carrier
+         * bit to decide whether it should enable transmits again). Such
+         * a race condition would result into transmission being disabled
+         * in the hardware until the next IFF_DOWN+IFF_UP cycle.
+         */
+        netif_carrier_off(netdev);
+
         napi_disable(&adapter->napi);
 
         e1000_irq_disable(adapter);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index 57505b1df98d..d591b3e6bd7c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -298,7 +298,7 @@ static i40e_status i40e_read_nvm_word_aq(struct i40e_hw *hw, u16 offset,
 }
 
 /**
- * __i40e_read_nvm_word - Reads nvm word, assumes called does the locking
+ * __i40e_read_nvm_word - Reads nvm word, assumes caller does the locking
  * @hw: pointer to the HW structure
  * @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF)
  * @data: word read from the Shadow RAM
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 1519dfb851d0..120c68f78951 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1038,6 +1038,32 @@ reset_latency:
 }
 
 /**
+ * i40e_reuse_rx_page - page flip buffer and store it back on the ring
+ * @rx_ring: rx descriptor ring to store buffers on
+ * @old_buff: donor buffer to have page reused
+ *
+ * Synchronizes page for reuse by the adapter
+ **/
+static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
+                               struct i40e_rx_buffer *old_buff)
+{
+        struct i40e_rx_buffer *new_buff;
+        u16 nta = rx_ring->next_to_alloc;
+
+        new_buff = &rx_ring->rx_bi[nta];
+
+        /* update, and store next to alloc */
+        nta++;
+        rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
+
+        /* transfer page from old buffer to new buffer */
+        new_buff->dma           = old_buff->dma;
+        new_buff->page          = old_buff->page;
+        new_buff->page_offset   = old_buff->page_offset;
+        new_buff->pagecnt_bias  = old_buff->pagecnt_bias;
+}
+
+/**
  * i40e_rx_is_programming_status - check for programming status descriptor
  * @qw: qword representing status_error_len in CPU ordering
  *
@@ -1071,15 +1097,24 @@ static void i40e_clean_programming_status(struct i40e_ring *rx_ring,
                                           union i40e_rx_desc *rx_desc,
                                           u64 qw)
 {
-        u32 ntc = rx_ring->next_to_clean + 1;
+        struct i40e_rx_buffer *rx_buffer;
+        u32 ntc = rx_ring->next_to_clean;
         u8 id;
 
         /* fetch, update, and store next to clean */
+        rx_buffer = &rx_ring->rx_bi[ntc++];
         ntc = (ntc < rx_ring->count) ? ntc : 0;
         rx_ring->next_to_clean = ntc;
 
         prefetch(I40E_RX_DESC(rx_ring, ntc));
 
+        /* place unused page back on the ring */
+        i40e_reuse_rx_page(rx_ring, rx_buffer);
+        rx_ring->rx_stats.page_reuse_count++;
+
+        /* clear contents of buffer_info */
+        rx_buffer->page = NULL;
+
         id = (qw & I40E_RX_PROG_STATUS_DESC_QW1_PROGID_MASK) >>
                   I40E_RX_PROG_STATUS_DESC_QW1_PROGID_SHIFT;
 
@@ -1639,32 +1674,6 @@ static bool i40e_cleanup_headers(struct i40e_ring *rx_ring, struct sk_buff *skb,
 }
 
 /**
- * i40e_reuse_rx_page - page flip buffer and store it back on the ring
- * @rx_ring: rx descriptor ring to store buffers on
- * @old_buff: donor buffer to have page reused
- *
- * Synchronizes page for reuse by the adapter
- **/
-static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
-                               struct i40e_rx_buffer *old_buff)
-{
-        struct i40e_rx_buffer *new_buff;
-        u16 nta = rx_ring->next_to_alloc;
-
-        new_buff = &rx_ring->rx_bi[nta];
-
-        /* update, and store next to alloc */
-        nta++;
-        rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
-
-        /* transfer page from old buffer to new buffer */
-        new_buff->dma           = old_buff->dma;
-        new_buff->page          = old_buff->page;
-        new_buff->page_offset   = old_buff->page_offset;
-        new_buff->pagecnt_bias  = old_buff->pagecnt_bias;
-}
-
-/**
  * i40e_page_is_reusable - check if any reuse is possible
  * @page: page struct to check
  *
@@ -2093,6 +2102,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 
                 if (unlikely(i40e_rx_is_programming_status(qword))) {
                         i40e_clean_programming_status(rx_ring, rx_desc, qword);
+                        cleaned_count++;
                         continue;
                 }
                 size = (qword & I40E_RXD_QW1_LENGTH_PBUF_MASK) >>
@@ -2260,7 +2270,7 @@ static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
                 goto enable_int;
         }
 
-        if (ITR_IS_DYNAMIC(tx_itr_setting)) {
+        if (ITR_IS_DYNAMIC(rx_itr_setting)) {
                 rx = i40e_set_new_dynamic_itr(&q_vector->rx);
                 rxval = i40e_buildreg_itr(I40E_RX_ITR, q_vector->rx.itr);
         }
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index fd4a46b03cc8..ea69af267d63 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5326,7 +5326,7 @@ dma_error:
                                        DMA_TO_DEVICE);
                 dma_unmap_len_set(tx_buffer, len, 0);
 
-                if (i--)
+                if (i-- == 0)
                         i += tx_ring->count;
                 tx_buffer = &tx_ring->tx_buffer_info[i];
         }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
index 523f9d05a810..8a32eb7d47b9 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
@@ -175,31 +175,9 @@ static s32 ixgbe_init_phy_ops_82598(struct ixgbe_hw *hw)
  **/
 static s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
 {
-#ifndef CONFIG_SPARC
-        u32 regval;
-        u32 i;
-#endif
         s32 ret_val;
 
         ret_val = ixgbe_start_hw_generic(hw);
-
-#ifndef CONFIG_SPARC
-        /* Disable relaxed ordering */
-        for (i = 0; ((i < hw->mac.max_tx_queues) &&
-             (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(i));
-                regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(i), regval);
-        }
-
-        for (i = 0; ((i < hw->mac.max_rx_queues) &&
-             (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
-                regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN |
-                            IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
-        }
-#endif
         if (ret_val)
                 return ret_val;
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 2c19070d2a0b..6e6ab6f6875e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -366,25 +366,6 @@ s32 ixgbe_start_hw_gen2(struct ixgbe_hw *hw)
         }
         IXGBE_WRITE_FLUSH(hw);
 
-#ifndef CONFIG_ARCH_WANT_RELAX_ORDER
-        /* Disable relaxed ordering */
-        for (i = 0; i < hw->mac.max_tx_queues; i++) {
-                u32 regval;
-
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(i));
-                regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(i), regval);
-        }
-
-        for (i = 0; i < hw->mac.max_rx_queues; i++) {
-                u32 regval;
-
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
-                regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN |
-                            IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
-        }
-#endif
         return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 72c565712a5f..c3e7a8191128 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -1048,7 +1048,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         struct ixgbe_ring *temp_ring;
-        int i, err = 0;
+        int i, j, err = 0;
         u32 new_rx_count, new_tx_count;
 
         if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
@@ -1085,8 +1085,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
         }
 
         /* allocate temporary buffer to store rings in */
-        i = max_t(int, adapter->num_tx_queues, adapter->num_rx_queues);
-        i = max_t(int, i, adapter->num_xdp_queues);
+        i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
+                  adapter->num_rx_queues);
         temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
 
         if (!temp_ring) {
@@ -1118,8 +1118,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         }
                 }
 
-                for (i = 0; i < adapter->num_xdp_queues; i++) {
-                        memcpy(&temp_ring[i], adapter->xdp_ring[i],
+                for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
+                        memcpy(&temp_ring[i], adapter->xdp_ring[j],
                                sizeof(struct ixgbe_ring));
 
                         temp_ring[i].count = new_tx_count;
@@ -1139,10 +1139,10 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         memcpy(adapter->tx_ring[i], &temp_ring[i],
                                sizeof(struct ixgbe_ring));
                 }
-                for (i = 0; i < adapter->num_xdp_queues; i++) {
-                        ixgbe_free_tx_resources(adapter->xdp_ring[i]);
+                for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
+                        ixgbe_free_tx_resources(adapter->xdp_ring[j]);
 
-                        memcpy(adapter->xdp_ring[i], &temp_ring[i],
+                        memcpy(adapter->xdp_ring[j], &temp_ring[i],
                                sizeof(struct ixgbe_ring));
                 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index d962368d08d0..6d5f31e94358 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4881,7 +4881,7 @@ static void ixgbe_clear_udp_tunnel_port(struct ixgbe_adapter *adapter, u32 mask)
                                 IXGBE_FLAG_GENEVE_OFFLOAD_CAPABLE)))
                 return;
 
-        vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) && ~mask;
+        vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) & ~mask;
         IXGBE_WRITE_REG(hw, IXGBE_VXLANCTRL, vxlanctrl);
 
         if (mask & IXGBE_VXLANCTRL_VXLAN_UDPPORT_MASK)
@@ -8020,29 +8020,23 @@ static int ixgbe_tx_map(struct ixgbe_ring *tx_ring,
         return 0;
 dma_error:
         dev_err(tx_ring->dev, "TX DMA map failed\n");
-        tx_buffer = &tx_ring->tx_buffer_info[i];
 
         /* clear dma mappings for failed tx_buffer_info map */
-        while (tx_buffer != first) {
+        for (;;) {
+                tx_buffer = &tx_ring->tx_buffer_info[i];
                 if (dma_unmap_len(tx_buffer, len))
                         dma_unmap_page(tx_ring->dev,
                                        dma_unmap_addr(tx_buffer, dma),
                                        dma_unmap_len(tx_buffer, len),
                                        DMA_TO_DEVICE);
                 dma_unmap_len_set(tx_buffer, len, 0);
-
-                if (i--)
+                if (tx_buffer == first)
+                        break;
+                if (i == 0)
                         i += tx_ring->count;
-                tx_buffer = &tx_ring->tx_buffer_info[i];
+                i--;
         }
 
-        if (dma_unmap_len(tx_buffer, len))
-                dma_unmap_single(tx_ring->dev,
-                                 dma_unmap_addr(tx_buffer, dma),
-                                 dma_unmap_len(tx_buffer, len),
-                                 DMA_TO_DEVICE);
-        dma_unmap_len_set(tx_buffer, len, 0);
-
         dev_kfree_skb_any(first->skb);
         first->skb = NULL;
 
@@ -8529,6 +8523,10 @@ static int ixgbe_ioctl(struct net_device *netdev, struct ifreq *req, int cmd)
                 return ixgbe_ptp_set_ts_config(adapter, req);
         case SIOCGHWTSTAMP:
                 return ixgbe_ptp_get_ts_config(adapter, req);
+        case SIOCGMIIPHY:
+                if (!adapter->hw.phy.ops.read_reg)
+                        return -EOPNOTSUPP;
+                /* fall through */
         default:
                 return mdio_mii_ioctl(&adapter->hw.phy.mdio, if_mii(req), cmd);
         }
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index dd0ee2691c86..a37af5813f33 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -333,7 +333,7 @@
 #define     MVPP2_GMAC_INBAND_AN_MASK           BIT(0)
 #define     MVPP2_GMAC_FLOW_CTRL_MASK           GENMASK(2, 1)
 #define     MVPP2_GMAC_PCS_ENABLE_MASK          BIT(3)
-#define     MVPP2_GMAC_PORT_RGMII_MASK          BIT(4)
+#define     MVPP2_GMAC_INTERNAL_CLK_MASK        BIT(4)
 #define     MVPP2_GMAC_DISABLE_PADDING          BIT(5)
 #define     MVPP2_GMAC_PORT_RESET_MASK          BIT(6)
 #define MVPP2_GMAC_AUTONEG_CONFIG               0xc
@@ -676,6 +676,7 @@ enum mvpp2_tag_type {
 #define MVPP2_PRS_RI_L3_MCAST                   BIT(15)
 #define MVPP2_PRS_RI_L3_BCAST                   (BIT(15) | BIT(16))
 #define MVPP2_PRS_RI_IP_FRAG_MASK               0x20000
+#define MVPP2_PRS_RI_IP_FRAG_TRUE               BIT(17)
 #define MVPP2_PRS_RI_UDF3_MASK                  0x300000
 #define MVPP2_PRS_RI_UDF3_RX_SPECIAL            BIT(21)
 #define MVPP2_PRS_RI_L4_PROTO_MASK              0x1c00000
@@ -792,6 +793,7 @@ struct mvpp2 {
         struct clk *pp_clk;
         struct clk *gop_clk;
         struct clk *mg_clk;
+        struct clk *axi_clk;
 
         /* List of pointers to port structures */
         struct mvpp2_port **port_list;
@@ -1165,6 +1167,11 @@ struct mvpp2_bm_pool {
         u32 port_map;
 };
 
+#define IS_TSO_HEADER(txq_pcpu, addr) \
+        ((addr) >= (txq_pcpu)->tso_headers_dma && \
+         (addr) < (txq_pcpu)->tso_headers_dma + \
+         (txq_pcpu)->size * TSO_HEADER_SIZE)
+
 /* Queue modes */
 #define MVPP2_QDIST_SINGLE_MODE 0
 #define MVPP2_QDIST_MULTI_MODE  1
@@ -1532,7 +1539,7 @@ static bool mvpp2_prs_tcam_data_cmp(struct mvpp2_prs_entry *pe, int offs,
         int off = MVPP2_PRS_TCAM_DATA_BYTE(offs);
         u16 tcam_data;
 
-        tcam_data = (8 << pe->tcam.byte[off + 1]) | pe->tcam.byte[off];
+        tcam_data = (pe->tcam.byte[off + 1] << 8) | pe->tcam.byte[off];
         if (tcam_data != data)
                 return false;
         return true;
@@ -2315,7 +2322,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
             (proto != IPPROTO_IGMP))
                 return -EINVAL;
 
-        /* Fragmented packet */
+        /* Not fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2334,8 +2341,12 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
                                   MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
         mvpp2_prs_sram_ai_update(&pe, MVPP2_PRS_IPV4_DIP_AI_BIT,
                                  MVPP2_PRS_IPV4_DIP_AI_BIT);
-        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_MASK,
-                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri, ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK_L);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK);
 
         mvpp2_prs_tcam_data_byte_set(&pe, 5, proto, MVPP2_PRS_TCAM_PROTO_MASK);
         mvpp2_prs_tcam_ai_update(&pe, 0, MVPP2_PRS_IPV4_DIP_AI_BIT);
@@ -2346,7 +2357,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
         mvpp2_prs_hw_write(priv, &pe);
 
-        /* Not fragmented packet */
+        /* Fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2358,8 +2369,11 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         pe.sram.word[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
         mvpp2_prs_sram_ri_update(&pe, ri, ri_mask);
 
-        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, MVPP2_PRS_TCAM_PROTO_MASK_L);
-        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, MVPP2_PRS_TCAM_PROTO_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_TRUE,
+                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, 0x0);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, 0x0);
 
         /* Update shadow table and hw entry */
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
@@ -2600,8 +2614,8 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv)
         /* place holders only - no ports */
         mvpp2_prs_mac_drop_all_set(priv, 0, false);
         mvpp2_prs_mac_promisc_set(priv, 0, false);
-        mvpp2_prs_mac_multi_set(priv, MVPP2_PE_MAC_MC_ALL, 0, false);
-        mvpp2_prs_mac_multi_set(priv, MVPP2_PE_MAC_MC_IP6, 0, false);
+        mvpp2_prs_mac_multi_set(priv, 0, MVPP2_PE_MAC_MC_ALL, false);
+        mvpp2_prs_mac_multi_set(priv, 0, MVPP2_PE_MAC_MC_IP6, false);
 }
 
 /* Set default entries for various types of dsa packets */
@@ -3382,7 +3396,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
         struct mvpp2_prs_entry *pe;
         int tid;
 
-        pe = kzalloc(sizeof(*pe), GFP_KERNEL);
+        pe = kzalloc(sizeof(*pe), GFP_ATOMIC);
         if (!pe)
                 return NULL;
         mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC);
@@ -3444,7 +3458,7 @@ static int mvpp2_prs_mac_da_accept(struct mvpp2 *priv, int port,
                 if (tid < 0)
                         return tid;
 
-                pe = kzalloc(sizeof(*pe), GFP_KERNEL);
+                pe = kzalloc(sizeof(*pe), GFP_ATOMIC);
                 if (!pe)
                         return -ENOMEM;
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC);
@@ -4591,7 +4605,6 @@ static void mvpp2_port_mii_gmac_configure(struct mvpp2_port *port)
                 val |= MVPP2_GMAC_INBAND_AN_MASK | MVPP2_GMAC_PCS_ENABLE_MASK;
         } else if (phy_interface_mode_is_rgmii(port->phy_interface)) {
                 val &= ~MVPP2_GMAC_PCS_ENABLE_MASK;
-                val |= MVPP2_GMAC_PORT_RGMII_MASK;
         }
         writel(val, port->base + MVPP2_GMAC_CTRL_2_REG);
 
@@ -5313,8 +5326,9 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
                 struct mvpp2_txq_pcpu_buf *tx_buf =
                         txq_pcpu->buffs + txq_pcpu->txq_get_index;
 
-                dma_unmap_single(port->dev->dev.parent, tx_buf->dma,
-                                 tx_buf->size, DMA_TO_DEVICE);
+                if (!IS_TSO_HEADER(txq_pcpu, tx_buf->dma))
+                        dma_unmap_single(port->dev->dev.parent, tx_buf->dma,
+                                         tx_buf->size, DMA_TO_DEVICE);
                 if (tx_buf->skb)
                         dev_kfree_skb_any(tx_buf->skb);
 
@@ -5601,7 +5615,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
 
                 txq_pcpu->tso_headers =
                         dma_alloc_coherent(port->dev->dev.parent,
-                                           MVPP2_AGGR_TXQ_SIZE * TSO_HEADER_SIZE,
+                                           txq_pcpu->size * TSO_HEADER_SIZE,
                                            &txq_pcpu->tso_headers_dma,
                                            GFP_KERNEL);
                 if (!txq_pcpu->tso_headers)
@@ -5615,7 +5629,7 @@ cleanup:
                 kfree(txq_pcpu->buffs);
 
                 dma_free_coherent(port->dev->dev.parent,
-                                  MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+                                  txq_pcpu->size * TSO_HEADER_SIZE,
                                   txq_pcpu->tso_headers,
                                   txq_pcpu->tso_headers_dma);
         }
@@ -5639,7 +5653,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
                 kfree(txq_pcpu->buffs);
 
                 dma_free_coherent(port->dev->dev.parent,
-                                  MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+                                  txq_pcpu->size * TSO_HEADER_SIZE,
                                   txq_pcpu->tso_headers,
                                   txq_pcpu->tso_headers_dma);
         }
@@ -6204,12 +6218,15 @@ static inline void
 tx_desc_unmap_put(struct mvpp2_port *port, struct mvpp2_tx_queue *txq,
                   struct mvpp2_tx_desc *desc)
 {
+        struct mvpp2_txq_pcpu *txq_pcpu = this_cpu_ptr(txq->pcpu);
+
         dma_addr_t buf_dma_addr =
                 mvpp2_txdesc_dma_addr_get(port, desc);
         size_t buf_sz =
                 mvpp2_txdesc_size_get(port, desc);
-        dma_unmap_single(port->dev->dev.parent, buf_dma_addr,
-                         buf_sz, DMA_TO_DEVICE);
+        if (!IS_TSO_HEADER(txq_pcpu, buf_dma_addr))
+                dma_unmap_single(port->dev->dev.parent, buf_dma_addr,
+                                 buf_sz, DMA_TO_DEVICE);
         mvpp2_txq_desc_put(txq);
 }
 
@@ -6482,7 +6499,7 @@ out:
         }
 
         /* Finalize TX processing */
-        if (txq_pcpu->count >= txq->done_pkts_coal)
+        if (!port->has_tx_irqs && txq_pcpu->count >= txq->done_pkts_coal)
                 mvpp2_txq_done(port, txq, txq_pcpu);
 
         /* Set the timer in case not all frags were processed */
@@ -7496,7 +7513,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
 /* Ports initialization */
 static int mvpp2_port_probe(struct platform_device *pdev,
                             struct device_node *port_node,
-                            struct mvpp2 *priv)
+                            struct mvpp2 *priv, int index)
 {
         struct device_node *phy_node;
         struct phy *comphy;
@@ -7670,7 +7687,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         }
         netdev_info(dev, "Using %s mac address %pM\n", mac_from, dev->dev_addr);
 
-        priv->port_list[id] = port;
+        priv->port_list[index] = port;
         return 0;
 
 err_free_port_pcpu:
@@ -7963,6 +7980,18 @@ static int mvpp2_probe(struct platform_device *pdev)
                 err = clk_prepare_enable(priv->mg_clk);
                 if (err < 0)
                         goto err_gop_clk;
+
+                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
+                if (IS_ERR(priv->axi_clk)) {
+                        err = PTR_ERR(priv->axi_clk);
+                        if (err == -EPROBE_DEFER)
+                                goto err_gop_clk;
+                        priv->axi_clk = NULL;
+                } else {
+                        err = clk_prepare_enable(priv->axi_clk);
+                        if (err < 0)
+                                goto err_gop_clk;
+                }
         }
 
         /* Get system's tclk rate */
@@ -8005,16 +8034,19 @@ static int mvpp2_probe(struct platform_device *pdev)
         }
 
         /* Initialize ports */
+        i = 0;
         for_each_available_child_of_node(dn, port_node) {
-                err = mvpp2_port_probe(pdev, port_node, priv);
+                err = mvpp2_port_probe(pdev, port_node, priv, i);
                 if (err < 0)
                         goto err_mg_clk;
+                i++;
         }
 
         platform_set_drvdata(pdev, priv);
         return 0;
 
 err_mg_clk:
+        clk_disable_unprepare(priv->axi_clk);
         if (priv->hw_version == MVPP22)
                 clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8052,6 +8084,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                                   aggr_txq->descs_dma);
         }
 
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(priv->mg_clk);
         clk_disable_unprepare(priv->pp_clk);
         clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index ff60cf7342ca..fc281712869b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -77,35 +77,41 @@ static void add_delayed_event(struct mlx5_priv *priv,
         list_add_tail(&delayed_event->list, &priv->waiting_events_list);
 }
 
-static void fire_delayed_event_locked(struct mlx5_device_context *dev_ctx,
-                                      struct mlx5_core_dev *dev,
-                                      struct mlx5_priv *priv)
+static void delayed_event_release(struct mlx5_device_context *dev_ctx,
+                                  struct mlx5_priv *priv)
 {
+        struct mlx5_core_dev *dev = container_of(priv, struct mlx5_core_dev, priv);
         struct mlx5_delayed_event *de;
         struct mlx5_delayed_event *n;
+        struct list_head temp;
 
-        /* stop delaying events */
-        priv->is_accum_events = false;
+        INIT_LIST_HEAD(&temp);
+
+        spin_lock_irq(&priv->ctx_lock);
 
-        /* fire all accumulated events before new event comes */
-        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list) {
+        priv->is_accum_events = false;
+        list_splice_init(&priv->waiting_events_list, &temp);
+        if (!dev_ctx->context)
+                goto out;
+        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list)
                 dev_ctx->intf->event(dev, dev_ctx->context, de->event, de->param);
+
+out:
+        spin_unlock_irq(&priv->ctx_lock);
+
+        list_for_each_entry_safe(de, n, &temp, list) {
                 list_del(&de->list);
                 kfree(de);
         }
 }
 
-static void cleanup_delayed_evets(struct mlx5_priv *priv)
+/* accumulating events that can come after mlx5_ib calls to
+ * ib_register_device, till adding that interface to the events list.
+ */
+static void delayed_event_start(struct mlx5_priv *priv)
 {
-        struct mlx5_delayed_event *de;
-        struct mlx5_delayed_event *n;
-
         spin_lock_irq(&priv->ctx_lock);
-        priv->is_accum_events = false;
-        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list) {
-                list_del(&de->list);
-                kfree(de);
-        }
+        priv->is_accum_events = true;
         spin_unlock_irq(&priv->ctx_lock);
 }
 
@@ -122,11 +128,8 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 return;
 
         dev_ctx->intf = intf;
-        /* accumulating events that can come after mlx5_ib calls to
-         * ib_register_device, till adding that interface to the events list.
-         */
 
-        priv->is_accum_events = true;
+        delayed_event_start(priv);
 
         dev_ctx->context = intf->add(dev);
         set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
@@ -137,8 +140,6 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 spin_lock_irq(&priv->ctx_lock);
                 list_add_tail(&dev_ctx->list, &priv->ctx_list);
 
-                fire_delayed_event_locked(dev_ctx, dev, priv);
-
 #ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
                 if (dev_ctx->intf->pfault) {
                         if (priv->pfault) {
@@ -150,11 +151,12 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 }
 #endif
                 spin_unlock_irq(&priv->ctx_lock);
-        } else {
-                kfree(dev_ctx);
-                 /* delete all accumulated events */
-                cleanup_delayed_evets(priv);
         }
+
+        delayed_event_release(dev_ctx, priv);
+
+        if (!dev_ctx->context)
+                kfree(dev_ctx);
 }
 
 static struct mlx5_device_context *mlx5_get_device(struct mlx5_interface *intf,
@@ -205,17 +207,21 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv
         if (!dev_ctx)
                 return;
 
+        delayed_event_start(priv);
         if (intf->attach) {
                 if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state))
-                        return;
+                        goto out;
                 intf->attach(dev, dev_ctx->context);
                 set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
         } else {
                 if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
-                        return;
+                        goto out;
                 dev_ctx->context = intf->add(dev);
                 set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
         }
+
+out:
+        delayed_event_release(dev_ctx, priv);
 }
 
 void mlx5_attach_device(struct mlx5_core_dev *dev)
@@ -414,8 +420,14 @@ void mlx5_core_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
         if (priv->is_accum_events)
                 add_delayed_event(priv, dev, event, param);
 
+        /* After mlx5_detach_device, the dev_ctx->intf is still set and dev_ctx is
+         * still in priv->ctx_list. In this case, only notify the dev_ctx if its
+         * ADDED or ATTACHED bit are set.
+         */
         list_for_each_entry(dev_ctx, &priv->ctx_list, list)
-                if (dev_ctx->intf->event)
+                if (dev_ctx->intf->event &&
+                    (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state) ||
+                     test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state)))
                         dev_ctx->intf->event(dev, dev_ctx->context, event, param);
 
         spin_unlock_irqrestore(&priv->ctx_lock, flags);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
index 1e3a6c3e4132..80eef4163f52 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
@@ -139,7 +139,7 @@ TRACE_EVENT(mlx5_fs_del_fg,
         {MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO, "NEXT_PRIO"}
 
 TRACE_EVENT(mlx5_fs_set_fte,
-            TP_PROTO(const struct fs_fte *fte, bool new_fte),
+            TP_PROTO(const struct fs_fte *fte, int new_fte),
             TP_ARGS(fte, new_fte),
             TP_STRUCT__entry(
                 __field(const struct fs_fte *, fte)
@@ -149,7 +149,7 @@ TRACE_EVENT(mlx5_fs_set_fte,
                 __field(u32, action)
                 __field(u32, flow_tag)
                 __field(u8,  mask_enable)
-                __field(bool, new_fte)
+                __field(int, new_fte)
                 __array(u32, mask_outer, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_inner, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_misc, MLX5_ST_SZ_DW(fte_match_set_misc))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index c1d384fca4dc..51c4cc00a186 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -41,6 +41,11 @@
 #define MLX5E_CEE_STATE_UP    1
 #define MLX5E_CEE_STATE_DOWN  0
 
+enum {
+        MLX5E_VENDOR_TC_GROUP_NUM = 7,
+        MLX5E_LOWEST_PRIO_GROUP   = 0,
+};
+
 /* If dcbx mode is non-host set the dcbx mode to host.
  */
 static int mlx5e_dcbnl_set_dcbx_mode(struct mlx5e_priv *priv,
@@ -85,6 +90,9 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
+        u8 tc_group[IEEE_8021QAZ_MAX_TCS];
+        bool is_tc_group_6_exist = false;
+        bool is_zero_bw_ets_tc = false;
         int err = 0;
         int i;
 
@@ -96,37 +104,64 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
                 err = mlx5_query_port_prio_tc(mdev, i, &ets->prio_tc[i]);
                 if (err)
                         return err;
-        }
 
-        for (i = 0; i < ets->ets_cap; i++) {
+                err = mlx5_query_port_tc_group(mdev, i, &tc_group[i]);
+                if (err)
+                        return err;
+
                 err = mlx5_query_port_tc_bw_alloc(mdev, i, &ets->tc_tx_bw[i]);
                 if (err)
                         return err;
+
+                if (ets->tc_tx_bw[i] < MLX5E_MAX_BW_ALLOC &&
+                    tc_group[i] == (MLX5E_LOWEST_PRIO_GROUP + 1))
+                        is_zero_bw_ets_tc = true;
+
+                if (tc_group[i] == (MLX5E_VENDOR_TC_GROUP_NUM - 1))
+                        is_tc_group_6_exist = true;
+        }
+
+        /* Report 0% ets tc if exits*/
+        if (is_zero_bw_ets_tc) {
+                for (i = 0; i < ets->ets_cap; i++)
+                        if (tc_group[i] == MLX5E_LOWEST_PRIO_GROUP)
+                                ets->tc_tx_bw[i] = 0;
+        }
+
+        /* Update tc_tsa based on fw setting*/
+        for (i = 0; i < ets->ets_cap; i++) {
                 if (ets->tc_tx_bw[i] < MLX5E_MAX_BW_ALLOC)
                         priv->dcbx.tc_tsa[i] = IEEE_8021QAZ_TSA_ETS;
+                else if (tc_group[i] == MLX5E_VENDOR_TC_GROUP_NUM &&
+                         !is_tc_group_6_exist)
+                        priv->dcbx.tc_tsa[i] = IEEE_8021QAZ_TSA_VENDOR;
         }
-
         memcpy(ets->tc_tsa, priv->dcbx.tc_tsa, sizeof(ets->tc_tsa));
 
         return err;
 }
 
-enum {
-        MLX5E_VENDOR_TC_GROUP_NUM = 7,
-        MLX5E_ETS_TC_GROUP_NUM    = 0,
-};
-
 static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
 {
         bool any_tc_mapped_to_ets = false;
+        bool ets_zero_bw = false;
         int strict_group;
         int i;
 
-        for (i = 0; i <= max_tc; i++)
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+        for (i = 0; i <= max_tc; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
                         any_tc_mapped_to_ets = true;
+                        if (!ets->tc_tx_bw[i])
+                                ets_zero_bw = true;
+                }
+        }
 
-        strict_group = any_tc_mapped_to_ets ? 1 : 0;
+        /* strict group has higher priority than ets group */
+        strict_group = MLX5E_LOWEST_PRIO_GROUP;
+        if (any_tc_mapped_to_ets)
+                strict_group++;
+        if (ets_zero_bw)
+                strict_group++;
 
         for (i = 0; i <= max_tc; i++) {
                 switch (ets->tc_tsa[i]) {
@@ -137,7 +172,9 @@ static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
                         tc_group[i] = strict_group++;
                         break;
                 case IEEE_8021QAZ_TSA_ETS:
-                        tc_group[i] = MLX5E_ETS_TC_GROUP_NUM;
+                        tc_group[i] = MLX5E_LOWEST_PRIO_GROUP;
+                        if (ets->tc_tx_bw[i] && ets_zero_bw)
+                                tc_group[i] = MLX5E_LOWEST_PRIO_GROUP + 1;
                         break;
                 }
         }
@@ -146,9 +183,23 @@ static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
 static void mlx5e_build_tc_tx_bw(struct ieee_ets *ets, u8 *tc_tx_bw,
                                  u8 *tc_group, int max_tc)
 {
+        int bw_for_ets_zero_bw_tc = 0;
+        int last_ets_zero_bw_tc = -1;
+        int num_ets_zero_bw = 0;
         int i;
 
         for (i = 0; i <= max_tc; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS &&
+                    !ets->tc_tx_bw[i]) {
+                        num_ets_zero_bw++;
+                        last_ets_zero_bw_tc = i;
+                }
+        }
+
+        if (num_ets_zero_bw)
+                bw_for_ets_zero_bw_tc = MLX5E_MAX_BW_ALLOC / num_ets_zero_bw;
+
+        for (i = 0; i <= max_tc; i++) {
                 switch (ets->tc_tsa[i]) {
                 case IEEE_8021QAZ_TSA_VENDOR:
                         tc_tx_bw[i] = MLX5E_MAX_BW_ALLOC;
@@ -157,12 +208,26 @@ static void mlx5e_build_tc_tx_bw(struct ieee_ets *ets, u8 *tc_tx_bw,
                         tc_tx_bw[i] = MLX5E_MAX_BW_ALLOC;
                         break;
                 case IEEE_8021QAZ_TSA_ETS:
-                        tc_tx_bw[i] = ets->tc_tx_bw[i];
+                        tc_tx_bw[i] = ets->tc_tx_bw[i] ?
+                                      ets->tc_tx_bw[i] :
+                                      bw_for_ets_zero_bw_tc;
                         break;
                 }
         }
+
+        /* Make sure the total bw for ets zero bw group is 100% */
+        if (last_ets_zero_bw_tc != -1)
+                tc_tx_bw[last_ets_zero_bw_tc] +=
+                        MLX5E_MAX_BW_ALLOC % num_ets_zero_bw;
 }
 
+/* If there are ETS BW 0,
+ *   Set ETS group # to 1 for all ETS non zero BW tcs. Their sum must be 100%.
+ *   Set group #0 to all the ETS BW 0 tcs and
+ *     equally splits the 100% BW between them
+ *   Report both group #0 and #1 as ETS type.
+ *     All the tcs in group #0 will be reported with 0% BW.
+ */
 int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
@@ -188,7 +253,6 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
                 return err;
 
         memcpy(priv->dcbx.tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa));
-
         return err;
 }
 
@@ -209,17 +273,9 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         /* Validate Bandwidth Sum */
-        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i]) {
-                                netdev_err(netdev,
-                                           "Failed to validate ETS: BW 0 is illegal\n");
-                                return -EINVAL;
-                        }
-
+        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
                         bw_sum += ets->tc_tx_bw[i];
-                }
-        }
 
         if (bw_sum != 0 && bw_sum != 100) {
                 netdev_err(netdev,
@@ -533,8 +589,7 @@ static void mlx5e_dcbnl_getpgtccfgtx(struct net_device *netdev,
 static void mlx5e_dcbnl_getpgbwgcfgtx(struct net_device *netdev,
                                       int pgid, u8 *bw_pct)
 {
-        struct mlx5e_priv *priv = netdev_priv(netdev);
-        struct mlx5_core_dev *mdev = priv->mdev;
+        struct ieee_ets ets;
 
         if (pgid >= CEE_DCBX_MAX_PGS) {
                 netdev_err(netdev,
@@ -542,8 +597,8 @@ static void mlx5e_dcbnl_getpgbwgcfgtx(struct net_device *netdev,
                 return;
         }
 
-        if (mlx5_query_port_tc_bw_alloc(mdev, pgid, bw_pct))
-                *bw_pct = 0;
+        mlx5e_dcbnl_ieee_getets(netdev, &ets);
+        *bw_pct = ets.tc_tx_bw[pgid];
 }
 
 static void mlx5e_dcbnl_setpfccfg(struct net_device *netdev,
@@ -739,8 +794,6 @@ static void mlx5e_ets_init(struct mlx5e_priv *priv)
                 ets.prio_tc[i] = i;
         }
 
-        memcpy(priv->dcbx.tc_tsa, ets.tc_tsa, sizeof(ets.tc_tsa));
-
         /* tclass[prio=0]=1, tclass[prio=1]=0, tclass[prio=i]=i (for i>1) */
         ets.prio_tc[0] = 1;
         ets.prio_tc[1] = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index f11fd07ac4dd..850cdc980ab5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -291,7 +291,7 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = false;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_del_any_vid_rules(priv);
+        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
@@ -302,7 +302,7 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = true;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_add_any_vid_rules(priv);
+        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dfc29720ab77..cc11bbbd0309 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -184,7 +184,6 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
         struct mlx5e_sw_stats temp, *s = &temp;
         struct mlx5e_rq_stats *rq_stats;
         struct mlx5e_sq_stats *sq_stats;
-        u64 tx_offload_none = 0;
         int i, j;
 
         memset(s, 0, sizeof(*s));
@@ -199,6 +198,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                 s->rx_lro_bytes += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
                 s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                 s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_xdp_drop += rq_stats->xdp_drop;
                 s->rx_xdp_tx += rq_stats->xdp_tx;
@@ -229,14 +229,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_dropped     += sq_stats->dropped;
                         s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
-                        tx_offload_none         += sq_stats->csum_none;
+                        s->tx_csum_none         += sq_stats->csum_none;
+                        s->tx_csum_partial      += sq_stats->csum_partial;
                 }
         }
 
-        /* Update calculated offload counters */
-        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
-        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
-
         s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                 priv->stats.pport.phy_counters,
                                 counter_set.phys_layer_cntrs.link_down_events);
@@ -3333,8 +3330,8 @@ static int mlx5e_handle_feature(struct net_device *netdev,
 
         err = feature_handler(netdev, enable);
         if (err) {
-                netdev_err(netdev, "%s feature 0x%llx failed err %d\n",
-                           enable ? "Enable" : "Disable", feature, err);
+                netdev_err(netdev, "%s feature %pNF failed, err %d\n",
+                           enable ? "Enable" : "Disable", &feature, err);
                 return err;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f1dd638384d3..15a1687483cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -627,6 +627,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
 
         if (lro) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
+                rq->stats.csum_unnecessary++;
                 return;
         }
 
@@ -644,7 +645,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum_level = 1;
                         skb->encapsulation = 1;
                         rq->stats.csum_unnecessary_inner++;
+                        return;
                 }
+                rq->stats.csum_unnecessary++;
                 return;
         }
 csum_none:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 6d199ffb1c0b..f8637213afc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -68,6 +68,7 @@ struct mlx5e_sw_stats {
         u64 rx_xdp_drop;
         u64 rx_xdp_tx;
         u64 rx_xdp_tx_full;
+        u64 tx_csum_none;
         u64 tx_csum_partial;
         u64 tx_csum_partial_inner;
         u64 tx_queue_stopped;
@@ -108,6 +109,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx_full) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_none) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
@@ -339,6 +341,7 @@ struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
         u64 csum_complete;
+        u64 csum_unnecessary;
         u64 csum_unnecessary_inner;
         u64 csum_none;
         u64 lro_packets;
@@ -363,6 +366,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, xdp_drop) },
@@ -392,6 +396,7 @@ struct mlx5e_sq_stats {
         u64 tso_bytes;
         u64 tso_inner_packets;
         u64 tso_inner_bytes;
+        u64 csum_partial;
         u64 csum_partial_inner;
         u64 nop;
         /* less likely accessed in data path */
@@ -408,6 +413,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index da503e6411da..9ba1f72060aa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -78,9 +78,11 @@ struct mlx5e_tc_flow {
 };
 
 struct mlx5e_tc_flow_parse_attr {
+        struct ip_tunnel_info tun_info;
         struct mlx5_flow_spec spec;
         int num_mod_hdr_actions;
         void *mod_hdr_actions;
+        int mirred_ifindex;
 };
 
 enum {
@@ -322,6 +324,12 @@ static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
 static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                                struct mlx5e_tc_flow *flow);
 
+static int mlx5e_attach_encap(struct mlx5e_priv *priv,
+                              struct ip_tunnel_info *tun_info,
+                              struct net_device *mirred_dev,
+                              struct net_device **encap_dev,
+                              struct mlx5e_tc_flow *flow);
+
 static struct mlx5_flow_handle *
 mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                       struct mlx5e_tc_flow_parse_attr *parse_attr,
@@ -329,9 +337,27 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 {
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct mlx5_esw_flow_attr *attr = flow->esw_attr;
-        struct mlx5_flow_handle *rule;
+        struct net_device *out_dev, *encap_dev = NULL;
+        struct mlx5_flow_handle *rule = NULL;
+        struct mlx5e_rep_priv *rpriv;
+        struct mlx5e_priv *out_priv;
         int err;
 
+        if (attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP) {
+                out_dev = __dev_get_by_index(dev_net(priv->netdev),
+                                             attr->parse_attr->mirred_ifindex);
+                err = mlx5e_attach_encap(priv, &parse_attr->tun_info,
+                                         out_dev, &encap_dev, flow);
+                if (err) {
+                        rule = ERR_PTR(err);
+                        if (err != -EAGAIN)
+                                goto err_attach_encap;
+                }
+                out_priv = netdev_priv(encap_dev);
+                rpriv = out_priv->ppriv;
+                attr->out_rep = rpriv->rep;
+        }
+
         err = mlx5_eswitch_add_vlan_action(esw, attr);
         if (err) {
                 rule = ERR_PTR(err);
@@ -347,10 +373,14 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                 }
         }
 
-        rule = mlx5_eswitch_add_offloaded_rule(esw, &parse_attr->spec, attr);
-        if (IS_ERR(rule))
-                goto err_add_rule;
-
+        /* we get here if (1) there's no error (rule being null) or when
+         * (2) there's an encap action and we're on -EAGAIN (no valid neigh)
+         */
+        if (rule != ERR_PTR(-EAGAIN)) {
+                rule = mlx5_eswitch_add_offloaded_rule(esw, &parse_attr->spec, attr);
+                if (IS_ERR(rule))
+                        goto err_add_rule;
+        }
         return rule;
 
 err_add_rule:
@@ -361,6 +391,7 @@ err_mod_hdr:
 err_add_vlan:
         if (attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
                 mlx5e_detach_encap(priv, flow);
+err_attach_encap:
         return rule;
 }
 
@@ -389,6 +420,8 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
 void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
                               struct mlx5e_encap_entry *e)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        struct mlx5_esw_flow_attr *esw_attr;
         struct mlx5e_tc_flow *flow;
         int err;
 
@@ -404,10 +437,9 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
         mlx5e_rep_queue_neigh_stats_work(priv);
 
         list_for_each_entry(flow, &e->flows, encap) {
-                flow->esw_attr->encap_id = e->encap_id;
-                flow->rule = mlx5e_tc_add_fdb_flow(priv,
-                                                   flow->esw_attr->parse_attr,
-                                                   flow);
+                esw_attr = flow->esw_attr;
+                esw_attr->encap_id = e->encap_id;
+                flow->rule = mlx5_eswitch_add_offloaded_rule(esw, &esw_attr->parse_attr->spec, esw_attr);
                 if (IS_ERR(flow->rule)) {
                         err = PTR_ERR(flow->rule);
                         mlx5_core_warn(priv->mdev, "Failed to update cached encapsulation flow, %d\n",
@@ -421,15 +453,13 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
 void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
                               struct mlx5e_encap_entry *e)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct mlx5e_tc_flow *flow;
-        struct mlx5_fc *counter;
 
         list_for_each_entry(flow, &e->flows, encap) {
                 if (flow->flags & MLX5E_TC_FLOW_OFFLOADED) {
                         flow->flags &= ~MLX5E_TC_FLOW_OFFLOADED;
-                        counter = mlx5_flow_rule_counter(flow->rule);
-                        mlx5_del_flow_rules(flow->rule);
-                        mlx5_fc_destroy(priv->mdev, counter);
+                        mlx5_eswitch_del_offloaded_rule(esw, flow->rule, flow->esw_attr);
                 }
         }
 
@@ -1317,6 +1347,69 @@ static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 upda
         return true;
 }
 
+static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
+                                          struct tcf_exts *exts)
+{
+        const struct tc_action *a;
+        bool modify_ip_header;
+        LIST_HEAD(actions);
+        u8 htype, ip_proto;
+        void *headers_v;
+        u16 ethertype;
+        int nkeys, i;
+
+        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
+
+        /* for non-IP we only re-write MACs, so we're okay */
+        if (ethertype != ETH_P_IP && ethertype != ETH_P_IPV6)
+                goto out_ok;
+
+        modify_ip_header = false;
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
+                if (!is_tcf_pedit(a))
+                        continue;
+
+                nkeys = tcf_pedit_nkeys(a);
+                for (i = 0; i < nkeys; i++) {
+                        htype = tcf_pedit_htype(a, i);
+                        if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
+                            htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
+                                modify_ip_header = true;
+                                break;
+                        }
+                }
+        }
+
+        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
+        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
+                return false;
+        }
+
+out_ok:
+        return true;
+}
+
+static bool actions_match_supported(struct mlx5e_priv *priv,
+                                    struct tcf_exts *exts,
+                                    struct mlx5e_tc_flow_parse_attr *parse_attr,
+                                    struct mlx5e_tc_flow *flow)
+{
+        u32 actions;
+
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                actions = flow->esw_attr->action;
+        else
+                actions = flow->nic_attr->action;
+
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
+                return modify_header_match_supported(&parse_attr->spec, exts);
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1378,6 +1471,9 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 return -EINVAL;
         }
 
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return 0;
 }
 
@@ -1564,7 +1660,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
         fl4.flowi4_tos = tun_key->tos;
         fl4.daddr = tun_key->u.ipv4.dst;
@@ -1573,7 +1669,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev,
                                       &fl4, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1590,7 +1686,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1630,8 +1726,9 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1668,7 +1765,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
 
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label);
@@ -1678,7 +1775,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev,
                                       &fl6, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1695,7 +1792,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1736,8 +1833,9 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1791,6 +1889,7 @@ vxlan_encap_offload_err:
                 }
         }
 
+        /* must verify if encap is valid or not */
         if (found)
                 goto attach_flow;
 
@@ -1817,6 +1916,8 @@ attach_flow:
         *encap_dev = e->out_dev;
         if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                 attr->encap_id = e->encap_id;
+        else
+                err = -EAGAIN;
 
         return err;
 
@@ -1871,7 +1972,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
 
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
-                        struct net_device *out_dev, *encap_dev = NULL;
+                        struct net_device *out_dev;
                         struct mlx5e_priv *out_priv;
 
                         out_dev = __dev_get_by_index(dev_net(priv->netdev), ifindex);
@@ -1884,17 +1985,13 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 rpriv = out_priv->ppriv;
                                 attr->out_rep = rpriv->rep;
                         } else if (encap) {
-                                err = mlx5e_attach_encap(priv, info,
-                                                         out_dev, &encap_dev, flow);
-                                if (err && err != -EAGAIN)
-                                        return err;
+                                parse_attr->mirred_ifindex = ifindex;
+                                parse_attr->tun_info = *info;
+                                attr->parse_attr = parse_attr;
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_ENCAP |
                                         MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
                                         MLX5_FLOW_CONTEXT_ACTION_COUNT;
-                                out_priv = netdev_priv(encap_dev);
-                                rpriv = out_priv->ppriv;
-                                attr->out_rep = rpriv->rep;
-                                attr->parse_attr = parse_attr;
+                                /* attr->out_rep is resolved when we handle encap */
                         } else {
                                 pr_err("devices %s %s not on same switch HW, can't offload forwarding\n",
                                        priv->netdev->name, out_dev->name);
@@ -1934,6 +2031,10 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
 
                 return -EINVAL;
         }
+
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return err;
 }
 
@@ -1972,7 +2073,7 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
         if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 err = parse_tc_fdb_actions(priv, f->exts, parse_attr, flow);
                 if (err < 0)
-                        goto err_handle_encap_flow;
+                        goto err_free;
                 flow->rule = mlx5e_tc_add_fdb_flow(priv, parse_attr, flow);
         } else {
                 err = parse_tc_nic_actions(priv, f->exts, parse_attr, flow);
@@ -1983,10 +2084,13 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
 
         if (IS_ERR(flow->rule)) {
                 err = PTR_ERR(flow->rule);
-                goto err_free;
+                if (err != -EAGAIN)
+                        goto err_free;
         }
 
-        flow->flags |= MLX5E_TC_FLOW_OFFLOADED;
+        if (err != -EAGAIN)
+                flow->flags |= MLX5E_TC_FLOW_OFFLOADED;
+
         err = rhashtable_insert_fast(&tc->ht, &flow->node,
                                      tc->ht_params);
         if (err)
@@ -2000,16 +2104,6 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
 err_del_rule:
         mlx5e_tc_del_flow(priv, flow);
 
-err_handle_encap_flow:
-        if (err == -EAGAIN) {
-                err = rhashtable_insert_fast(&tc->ht, &flow->node,
-                                             tc->ht_params);
-                if (err)
-                        mlx5e_tc_del_flow(priv, flow);
-                else
-                        return 0;
-        }
-
 err_free:
         kvfree(parse_attr);
         kfree(flow);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index fee43e40fa16..1d6925d4369a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -193,6 +193,7 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, struct
                         sq->stats.csum_partial_inner++;
                 } else {
                         eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
+                        sq->stats.csum_partial++;
                 }
         } else
                 sq->stats.csum_none++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
index e37453d838db..c0fd2212e890 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
@@ -71,11 +71,11 @@ int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
         return 0;
 }
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps)
+int mlx5_fpga_caps(struct mlx5_core_dev *dev)
 {
         u32 in[MLX5_ST_SZ_DW(fpga_cap)] = {0};
 
-        return mlx5_core_access_reg(dev, in, sizeof(in), caps,
+        return mlx5_core_access_reg(dev, in, sizeof(in), dev->caps.fpga,
                                     MLX5_ST_SZ_BYTES(fpga_cap),
                                     MLX5_REG_FPGA_CAP, 0, 0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
index 94bdfd47c3f0..d05233c9b4f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
@@ -65,7 +65,7 @@ struct mlx5_fpga_qp_counters {
         u64 rx_total_drop;
 };
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps);
+int mlx5_fpga_caps(struct mlx5_core_dev *dev);
 int mlx5_fpga_query(struct mlx5_core_dev *dev, struct mlx5_fpga_query *query);
 int mlx5_fpga_ctrl_op(struct mlx5_core_dev *dev, u8 op);
 int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
index 9034e9960a76..dc8970346521 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
@@ -139,8 +139,7 @@ int mlx5_fpga_device_start(struct mlx5_core_dev *mdev)
         if (err)
                 goto out;
 
-        err = mlx5_fpga_caps(fdev->mdev,
-                             fdev->mdev->caps.hca_cur[MLX5_CAP_FPGA]);
+        err = mlx5_fpga_caps(fdev->mdev);
         if (err)
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index e0d0efd903bc..36ecc2b2e187 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -293,6 +293,9 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
         }
 
         if (fte->action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+                int max_list_size = BIT(MLX5_CAP_FLOWTABLE_TYPE(dev,
+                                        log_max_flow_counter,
+                                        ft->type));
                 int list_size = 0;
 
                 list_for_each_entry(dst, &fte->node.children, node.list) {
@@ -305,12 +308,17 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                         in_dests += MLX5_ST_SZ_BYTES(dest_format_struct);
                         list_size++;
                 }
+                if (list_size > max_list_size) {
+                        err = -EINVAL;
+                        goto err_out;
+                }
 
                 MLX5_SET(flow_context, in_flow_context, flow_counter_list_size,
                          list_size);
         }
 
         err = mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+err_out:
         kvfree(in);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 5509a752f98e..48dd78975062 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -52,6 +52,7 @@ enum fs_flow_table_type {
         FS_FT_FDB             = 0X4,
         FS_FT_SNIFFER_RX        = 0X5,
         FS_FT_SNIFFER_TX        = 0X6,
+        FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
 };
 
 enum fs_flow_table_op_mod {
@@ -260,4 +261,14 @@ void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
 #define fs_for_each_dst(pos, fte)                       \
         fs_list_for_each_entry(pos, &(fte)->node.children)
 
+#define MLX5_CAP_FLOWTABLE_TYPE(mdev, cap, type) (              \
+        (type == FS_FT_NIC_RX) ? MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) :         \
+        (type == FS_FT_ESW_EGRESS_ACL) ? MLX5_CAP_ESW_EGRESS_ACL(mdev, cap) :           \
+        (type == FS_FT_ESW_INGRESS_ACL) ? MLX5_CAP_ESW_INGRESS_ACL(mdev, cap) :         \
+        (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
+        (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
+        (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
+        (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+        )
+
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 8aea0a065e56..db86e1506c8b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -356,10 +356,11 @@ void mlx5_drain_health_wq(struct mlx5_core_dev *dev)
 void mlx5_drain_health_recovery(struct mlx5_core_dev *dev)
 {
         struct mlx5_core_health *health = &dev->priv.health;
+        unsigned long flags;
 
-        spin_lock(&health->wq_lock);
+        spin_lock_irqsave(&health->wq_lock, flags);
         set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
-        spin_unlock(&health->wq_lock);
+        spin_unlock_irqrestore(&health->wq_lock, flags);
         cancel_delayed_work_sync(&dev->priv.health.recover_work);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 85298051a3e4..145e392ab849 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)
 {
         struct mlx5e_priv          *priv    = mlx5i_epriv(netdev);
         const struct mlx5e_profile *profile = priv->profile;
+        struct mlx5_core_dev       *mdev    = priv->mdev;
 
         mlx5e_detach_netdev(priv);
         profile->cleanup(priv);
         destroy_workqueue(priv->wq);
         free_netdev(netdev);
 
-        mlx5e_destroy_mdev_resources(priv->mdev);
+        mlx5e_destroy_mdev_resources(mdev);
 }
 EXPORT_SYMBOL(mlx5_rdma_netdev_free);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index 1975d4388d4f..e07061f565d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -677,6 +677,27 @@ int mlx5_set_port_tc_group(struct mlx5_core_dev *mdev, u8 *tc_group)
 }
 EXPORT_SYMBOL_GPL(mlx5_set_port_tc_group);
 
+int mlx5_query_port_tc_group(struct mlx5_core_dev *mdev,
+                             u8 tc, u8 *tc_group)
+{
+        u32 out[MLX5_ST_SZ_DW(qetc_reg)];
+        void *ets_tcn_conf;
+        int err;
+
+        err = mlx5_query_port_qetcr_reg(mdev, out, sizeof(out));
+        if (err)
+                return err;
+
+        ets_tcn_conf = MLX5_ADDR_OF(qetc_reg, out,
+                                    tc_configuration[tc]);
+
+        *tc_group = MLX5_GET(ets_tcn_config_reg, ets_tcn_conf,
+                             group);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mlx5_query_port_tc_group);
+
 int mlx5_set_port_tc_bw_alloc(struct mlx5_core_dev *mdev, u8 *tc_bw)
 {
         u32 in[MLX5_ST_SZ_DW(qetc_reg)] = {0};
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index 6c48e9959b65..2a8b529ce6dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -109,7 +109,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                                 mlx5_core_warn(dev,
                                                "failed to restore VF %d settings, err %d\n",
                                                vf, err);
-                        continue;
+                                continue;
                         }
                 }
                 mlx5_core_dbg(dev, "successfully enabled VF* %d\n", vf);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 9d5e7cf288be..f3315bc874ad 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -96,6 +96,7 @@ struct mlxsw_core {
         const struct mlxsw_bus *bus;
         void *bus_priv;
         const struct mlxsw_bus_info *bus_info;
+        struct workqueue_struct *emad_wq;
         struct list_head rx_listener_list;
         struct list_head event_listener_list;
         struct {
@@ -465,7 +466,7 @@ static void mlxsw_emad_trans_timeout_schedule(struct mlxsw_reg_trans *trans)
 {
         unsigned long timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_MS);
 
-        mlxsw_core_schedule_dw(&trans->timeout_dw, timeout);
+        queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
 }
 
 static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,
@@ -587,12 +588,18 @@ static const struct mlxsw_listener mlxsw_emad_rx_listener =
 
 static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
 {
+        struct workqueue_struct *emad_wq;
         u64 tid;
         int err;
 
         if (!(mlxsw_core->bus->features & MLXSW_BUS_F_TXRX))
                 return 0;
 
+        emad_wq = alloc_workqueue("mlxsw_core_emad", WQ_MEM_RECLAIM, 0);
+        if (!emad_wq)
+                return -ENOMEM;
+        mlxsw_core->emad_wq = emad_wq;
+
         /* Set the upper 32 bits of the transaction ID field to a random
          * number. This allows us to discard EMADs addressed to other
          * devices.
@@ -619,6 +626,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
 err_emad_trap_set:
         mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
                                    mlxsw_core);
+        destroy_workqueue(mlxsw_core->emad_wq);
         return err;
 }
 
@@ -631,6 +639,7 @@ static void mlxsw_emad_fini(struct mlxsw_core *mlxsw_core)
         mlxsw_core->emad.use_emad = false;
         mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
                                    mlxsw_core);
+        destroy_workqueue(mlxsw_core->emad_wq);
 }
 
 static struct sk_buff *mlxsw_emad_alloc(const struct mlxsw_core *mlxsw_core,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
index 12c3a4449120..c0dcfa05b077 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
@@ -294,7 +294,7 @@ mlxsw_i2c_write(struct device *dev, size_t in_mbox_size, u8 *in_mbox, int num,
                 write_tran.len = MLXSW_I2C_ADDR_WIDTH + chunk_size;
                 mlxsw_i2c_set_slave_addr(tran_buf, off);
                 memcpy(&tran_buf[MLXSW_I2C_ADDR_BUF_SIZE], in_mbox +
-                       chunk_size * i, chunk_size);
+                       MLXSW_I2C_BLK_MAX * i, chunk_size);
 
                 j = 0;
                 end = jiffies + timeout;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index cc27c5de5a1d..5acfbe5b8b9d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -5827,6 +5827,29 @@ MLXSW_ITEM32(reg, mtmp, mtr, 0x08, 30, 1);
  */
 MLXSW_ITEM32(reg, mtmp, max_temperature, 0x08, 0, 16);
 
+/* reg_mtmp_tee
+ * Temperature Event Enable.
+ * 0 - Do not generate event
+ * 1 - Generate event
+ * 2 - Generate single event
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, tee, 0x0C, 30, 2);
+
+#define MLXSW_REG_MTMP_THRESH_HI 0x348  /* 105 Celsius */
+
+/* reg_mtmp_temperature_threshold_hi
+ * High threshold for Temperature Warning Event. In 0.125 Celsius.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, temperature_threshold_hi, 0x0C, 0, 16);
+
+/* reg_mtmp_temperature_threshold_lo
+ * Low threshold for Temperature Warning Event. In 0.125 Celsius.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, temperature_threshold_lo, 0x10, 0, 16);
+
 #define MLXSW_REG_MTMP_SENSOR_NAME_SIZE 8
 
 /* reg_mtmp_sensor_name
@@ -5843,6 +5866,8 @@ static inline void mlxsw_reg_mtmp_pack(char *payload, u8 sensor_index,
         mlxsw_reg_mtmp_sensor_index_set(payload, sensor_index);
         mlxsw_reg_mtmp_mte_set(payload, max_temp_enable);
         mlxsw_reg_mtmp_mtr_set(payload, max_temp_reset);
+        mlxsw_reg_mtmp_temperature_threshold_hi_set(payload,
+                                                    MLXSW_REG_MTMP_THRESH_HI);
 }
 
 static inline void mlxsw_reg_mtmp_unpack(char *payload, unsigned int *p_temp,
@@ -6401,6 +6426,36 @@ static inline void mlxsw_reg_mgpc_pack(char *payload, u32 counter_index,
         mlxsw_reg_mgpc_opcode_set(payload, opcode);
 }
 
+/* TIGCR - Tunneling IPinIP General Configuration Register
+ * -------------------------------------------------------
+ * The TIGCR register is used for setting up the IPinIP Tunnel configuration.
+ */
+#define MLXSW_REG_TIGCR_ID 0xA801
+#define MLXSW_REG_TIGCR_LEN 0x10
+
+MLXSW_REG_DEFINE(tigcr, MLXSW_REG_TIGCR_ID, MLXSW_REG_TIGCR_LEN);
+
+/* reg_tigcr_ipip_ttlc
+ * For IPinIP Tunnel encapsulation: whether to copy the ttl from the packet
+ * header.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, tigcr, ttlc, 0x04, 8, 1);
+
+/* reg_tigcr_ipip_ttl_uc
+ * The TTL for IPinIP Tunnel encapsulation of unicast packets if
+ * reg_tigcr_ipip_ttlc is unset.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, tigcr, ttl_uc, 0x04, 0, 8);
+
+static inline void mlxsw_reg_tigcr_pack(char *payload, bool ttlc, u8 ttl_uc)
+{
+        MLXSW_REG_ZERO(tigcr, payload);
+        mlxsw_reg_tigcr_ttlc_set(payload, ttlc);
+        mlxsw_reg_tigcr_ttl_uc_set(payload, ttl_uc);
+}
+
 /* SBPR - Shared Buffer Pools Register
  * -----------------------------------
  * The SBPR configures and retrieves the shared buffer pools and configuration.
@@ -6881,6 +6936,7 @@ static const struct mlxsw_reg_info *mlxsw_reg_infos[] = {
         MLXSW_REG(mcc),
         MLXSW_REG(mcda),
         MLXSW_REG(mgpc),
+        MLXSW_REG(tigcr),
         MLXSW_REG(sbpr),
         MLXSW_REG(sbcm),
         MLXSW_REG(sbpm),
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 2cfb3f5d092d..5189022a1c8c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -2723,6 +2723,7 @@ static void mlxsw_sp_nexthop_type_fini(struct mlxsw_sp *mlxsw_sp,
                 mlxsw_sp_nexthop_rif_fini(nh);
                 break;
         case MLXSW_SP_NEXTHOP_TYPE_IPIP:
+                mlxsw_sp_nexthop_rif_fini(nh);
                 mlxsw_sp_nexthop_ipip_fini(mlxsw_sp, nh);
                 break;
         }
@@ -2742,7 +2743,11 @@ static int mlxsw_sp_nexthop4_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV4)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -3500,20 +3505,6 @@ static int mlxsw_sp_fib_lpm_tree_link(struct mlxsw_sp *mlxsw_sp,
 static void mlxsw_sp_fib_lpm_tree_unlink(struct mlxsw_sp *mlxsw_sp,
                                          struct mlxsw_sp_fib *fib)
 {
-        struct mlxsw_sp_prefix_usage req_prefix_usage = {{ 0 } };
-        struct mlxsw_sp_lpm_tree *lpm_tree;
-
-        /* Aggregate prefix lengths across all virtual routers to make
-         * sure we only have used prefix lengths in the LPM tree.
-         */
-        mlxsw_sp_vrs_prefixes(mlxsw_sp, fib->proto, &req_prefix_usage);
-        lpm_tree = mlxsw_sp_lpm_tree_get(mlxsw_sp, &req_prefix_usage,
-                                         fib->proto);
-        if (IS_ERR(lpm_tree))
-                goto err_tree_get;
-        mlxsw_sp_vrs_lpm_tree_replace(mlxsw_sp, fib, lpm_tree);
-
-err_tree_get:
         if (!mlxsw_sp_prefix_usage_none(&fib->prefix_usage))
                 return;
         mlxsw_sp_vr_lpm_tree_unbind(mlxsw_sp, fib);
@@ -4009,7 +4000,11 @@ static int mlxsw_sp_nexthop6_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV6)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -5068,6 +5063,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
         vr = mlxsw_sp_vr_get(mlxsw_sp, tb_id ? : RT_TABLE_MAIN);
         if (IS_ERR(vr))
                 return ERR_CAST(vr);
+        vr->rif_count++;
 
         err = mlxsw_sp_rif_index_alloc(mlxsw_sp, &rif_index);
         if (err)
@@ -5099,7 +5095,6 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_counters_alloc(rif);
         mlxsw_sp->router->rifs[rif_index] = rif;
-        vr->rif_count++;
 
         return rif;
 
@@ -5110,6 +5105,7 @@ err_fid_get:
         kfree(rif);
 err_rif_alloc:
 err_rif_index_alloc:
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
         return ERR_PTR(err);
 }
@@ -5124,7 +5120,6 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
         mlxsw_sp_router_rif_gone_sync(mlxsw_sp, rif);
         vr = &mlxsw_sp->router->vrs[rif->vr_id];
 
-        vr->rif_count--;
         mlxsw_sp->router->rifs[rif->rif_index] = NULL;
         mlxsw_sp_rif_counters_free(rif);
         ops->deconfigure(rif);
@@ -5132,6 +5127,7 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
                 /* Loopback RIFs are not associated with a FID. */
                 mlxsw_sp_fid_put(fid);
         kfree(rif);
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
 }
 
@@ -5900,11 +5896,20 @@ static void mlxsw_sp_rifs_fini(struct mlxsw_sp *mlxsw_sp)
         kfree(mlxsw_sp->router->rifs);
 }
 
+static int
+mlxsw_sp_ipip_config_tigcr(struct mlxsw_sp *mlxsw_sp)
+{
+        char tigcr_pl[MLXSW_REG_TIGCR_LEN];
+
+        mlxsw_reg_tigcr_pack(tigcr_pl, true, 0);
+        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(tigcr), tigcr_pl);
+}
+
 static int mlxsw_sp_ipips_init(struct mlxsw_sp *mlxsw_sp)
 {
         mlxsw_sp->router->ipip_ops_arr = mlxsw_sp_ipip_ops_arr;
         INIT_LIST_HEAD(&mlxsw_sp->router->ipip_list);
-        return 0;
+        return mlxsw_sp_ipip_config_tigcr(mlxsw_sp);
 }
 
 static void mlxsw_sp_ipips_fini(struct mlxsw_sp *mlxsw_sp)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index db9750695dc7..8ea9320014ee 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -110,6 +110,8 @@ nfp_fl_output(struct nfp_fl_output *output, const struct tc_action *action,
          */
         if (!switchdev_port_same_parent_id(in_dev, out_dev))
                 return -EOPNOTSUPP;
+        if (!nfp_netdev_is_nfp_repr(out_dev))
+                return -EOPNOTSUPP;
 
         output->port = cpu_to_be32(nfp_repr_get_port_id(out_dev));
         if (!output->port)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 1c0187f0af51..e118b5f23996 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -1180,10 +1180,14 @@ static void *nfp_net_rx_alloc_one(struct nfp_net_dp *dp, dma_addr_t *dma_addr)
 {
         void *frag;
 
-        if (!dp->xdp_prog)
+        if (!dp->xdp_prog) {
                 frag = netdev_alloc_frag(dp->fl_bufsz);
-        else
-                frag = page_address(alloc_page(GFP_KERNEL | __GFP_COLD));
+        } else {
+                struct page *page;
+
+                page = alloc_page(GFP_KERNEL | __GFP_COLD);
+                frag = page ? page_address(page) : NULL;
+        }
         if (!frag) {
                 nn_dp_warn(dp, "Failed to alloc receive page frag\n");
                 return NULL;
@@ -1203,10 +1207,14 @@ static void *nfp_net_napi_alloc_one(struct nfp_net_dp *dp, dma_addr_t *dma_addr)
 {
         void *frag;
 
-        if (!dp->xdp_prog)
+        if (!dp->xdp_prog) {
                 frag = napi_alloc_frag(dp->fl_bufsz);
-        else
-                frag = page_address(alloc_page(GFP_ATOMIC | __GFP_COLD));
+        } else {
+                struct page *page;
+
+                page = alloc_page(GFP_ATOMIC | __GFP_COLD);
+                frag = page ? page_address(page) : NULL;
+        }
         if (!frag) {
                 nn_dp_warn(dp, "Failed to alloc receive page frag\n");
                 return NULL;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 07969f06df10..dc016dfec64d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -464,7 +464,7 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data)
 
                 do {
                         start = u64_stats_fetch_begin(&nn->r_vecs[i].rx_sync);
-                        *data++ = nn->r_vecs[i].rx_pkts;
+                        data[0] = nn->r_vecs[i].rx_pkts;
                         tmp[0] = nn->r_vecs[i].hw_csum_rx_ok;
                         tmp[1] = nn->r_vecs[i].hw_csum_rx_inner_ok;
                         tmp[2] = nn->r_vecs[i].hw_csum_rx_error;
@@ -472,14 +472,16 @@ static u64 *nfp_vnic_get_sw_stats(struct net_device *netdev, u64 *data)
 
                 do {
                         start = u64_stats_fetch_begin(&nn->r_vecs[i].tx_sync);
-                        *data++ = nn->r_vecs[i].tx_pkts;
-                        *data++ = nn->r_vecs[i].tx_busy;
+                        data[1] = nn->r_vecs[i].tx_pkts;
+                        data[2] = nn->r_vecs[i].tx_busy;
                         tmp[3] = nn->r_vecs[i].hw_csum_tx;
                         tmp[4] = nn->r_vecs[i].hw_csum_tx_inner;
                         tmp[5] = nn->r_vecs[i].tx_gather;
                         tmp[6] = nn->r_vecs[i].tx_lso;
                 } while (u64_stats_fetch_retry(&nn->r_vecs[i].tx_sync, start));
 
+                data += 3;
+
                 for (j = 0; j < NN_ET_RVEC_GATHER_STATS; j++)
                         gathered_stats[j] += tmp[j];
         }
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 0ea3ca09c689..3ed9033e56db 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -898,7 +898,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt,
 
                 curr_rxbuf->dma_addr =
                         dma_map_single(adpt->netdev->dev.parent, skb->data,
-                                       curr_rxbuf->length, DMA_FROM_DEVICE);
+                                       adpt->rxbuf_size, DMA_FROM_DEVICE);
+
                 ret = dma_mapping_error(adpt->netdev->dev.parent,
                                         curr_rxbuf->dma_addr);
                 if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 98f22551eb45..1e33aea59f50 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -51,10 +51,7 @@ struct rmnet_walk_data {
 
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
-        rx_handler_func_t *rx_handler;
-
-        rx_handler = rcu_dereference(real_dev->rx_handler);
-        return (rx_handler == rmnet_rx_handler);
+        return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
 }
 
 /* Needs rtnl lock */
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index e03fcf914690..a3c949ea7d1a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -8491,8 +8491,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 rtl8168_driver_start(tp);
         }
 
-        device_set_wakeup_enable(&pdev->dev, tp->features & RTL_FEATURE_WOL);
-
         if (pci_dev_run_wake(pdev))
                 pm_runtime_put_noidle(&pdev->dev);
 
diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h
index a63ef82e7c72..dfae3c9d57c6 100644
--- a/drivers/net/ethernet/rocker/rocker_tlv.h
+++ b/drivers/net/ethernet/rocker/rocker_tlv.h
@@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info)
 int rocker_tlv_put(struct rocker_desc_info *desc_info,
                    int attrtype, int attrlen, const void *data);
 
-static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info,
-                                    int attrtype, u8 value)
+static inline int
+rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value);
+        u8 tmp = value; /* work around GCC PR81715 */
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp);
 }
 
-static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info,
-                                     int attrtype, u16 value)
+static inline int
+rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp);
 }
 
-static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be16 value)
+static inline int
+rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp);
 }
 
-static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info,
-                                     int attrtype, u32 value)
+static inline int
+rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp);
 }
 
-static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be32 value)
+static inline int
+rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp);
 }
 
-static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info,
-                                     int attrtype, u64 value)
+static inline int
+rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value);
+        u64 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp);
 }
 
 static inline struct rocker_tlv *
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
index dd6a2f9791cc..3256e5cbad27 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
@@ -74,7 +74,7 @@ static int dwc_eth_dwmac_config_dt(struct platform_device *pdev,
                 plat_dat->axi->axi_wr_osr_lmt--;
         }
 
-        if (of_property_read_u32(np, "read,read-requests",
+        if (of_property_read_u32(np, "snps,read-requests",
                                  &plat_dat->axi->axi_rd_osr_lmt)) {
                 /**
                  * Since the register has a reset value of 1, if property
@@ -511,6 +511,7 @@ static struct platform_driver dwc_eth_dwmac_driver = {
         .remove = dwc_eth_dwmac_remove,
         .driver = {
                 .name           = "dwc-eth-dwmac",
+                .pm             = &stmmac_pltfr_pm_ops,
                 .of_match_table = dwc_eth_dwmac_match,
         },
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 99823f54696a..13133b30b575 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -83,6 +83,117 @@ struct rk_priv_data {
         (((tx) ? soc##_GMAC_TXCLK_DLY_ENABLE : soc##_GMAC_TXCLK_DLY_DISABLE) | \
          ((rx) ? soc##_GMAC_RXCLK_DLY_ENABLE : soc##_GMAC_RXCLK_DLY_DISABLE))
 
+#define RK3128_GRF_MAC_CON0     0x0168
+#define RK3128_GRF_MAC_CON1     0x016c
+
+/* RK3128_GRF_MAC_CON0 */
+#define RK3128_GMAC_TXCLK_DLY_ENABLE   GRF_BIT(14)
+#define RK3128_GMAC_TXCLK_DLY_DISABLE  GRF_CLR_BIT(14)
+#define RK3128_GMAC_RXCLK_DLY_ENABLE   GRF_BIT(15)
+#define RK3128_GMAC_RXCLK_DLY_DISABLE  GRF_CLR_BIT(15)
+#define RK3128_GMAC_CLK_RX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 7)
+#define RK3128_GMAC_CLK_TX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 0)
+
+/* RK3128_GRF_MAC_CON1 */
+#define RK3128_GMAC_PHY_INTF_SEL_RGMII  \
+                (GRF_BIT(6) | GRF_CLR_BIT(7) | GRF_CLR_BIT(8))
+#define RK3128_GMAC_PHY_INTF_SEL_RMII   \
+                (GRF_CLR_BIT(6) | GRF_CLR_BIT(7) | GRF_BIT(8))
+#define RK3128_GMAC_FLOW_CTRL          GRF_BIT(9)
+#define RK3128_GMAC_FLOW_CTRL_CLR      GRF_CLR_BIT(9)
+#define RK3128_GMAC_SPEED_10M          GRF_CLR_BIT(10)
+#define RK3128_GMAC_SPEED_100M         GRF_BIT(10)
+#define RK3128_GMAC_RMII_CLK_25M       GRF_BIT(11)
+#define RK3128_GMAC_RMII_CLK_2_5M      GRF_CLR_BIT(11)
+#define RK3128_GMAC_CLK_125M           (GRF_CLR_BIT(12) | GRF_CLR_BIT(13))
+#define RK3128_GMAC_CLK_25M            (GRF_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_CLK_2_5M           (GRF_CLR_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_RMII_MODE          GRF_BIT(14)
+#define RK3128_GMAC_RMII_MODE_CLR      GRF_CLR_BIT(14)
+
+static void rk3128_set_to_rgmii(struct rk_priv_data *bsp_priv,
+                                int tx_delay, int rx_delay)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RGMII |
+                     RK3128_GMAC_RMII_MODE_CLR);
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON0,
+                     DELAY_ENABLE(RK3128, tx_delay, rx_delay) |
+                     RK3128_GMAC_CLK_RX_DL_CFG(rx_delay) |
+                     RK3128_GMAC_CLK_TX_DL_CFG(tx_delay));
+}
+
+static void rk3128_set_to_rmii(struct rk_priv_data *bsp_priv)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RMII | RK3128_GMAC_RMII_MODE);
+}
+
+static void rk3128_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_2_5M);
+        else if (speed == 100)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_25M);
+        else if (speed == 1000)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_125M);
+        else
+                dev_err(dev, "unknown speed value for RGMII! speed=%d", speed);
+}
+
+static void rk3128_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_2_5M |
+                             RK3128_GMAC_SPEED_10M);
+        } else if (speed == 100) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_25M |
+                             RK3128_GMAC_SPEED_100M);
+        } else {
+                dev_err(dev, "unknown speed value for RMII! speed=%d", speed);
+        }
+}
+
+static const struct rk_gmac_ops rk3128_ops = {
+        .set_to_rgmii = rk3128_set_to_rgmii,
+        .set_to_rmii = rk3128_set_to_rmii,
+        .set_rgmii_speed = rk3128_set_rgmii_speed,
+        .set_rmii_speed = rk3128_set_rmii_speed,
+};
+
 #define RK3228_GRF_MAC_CON0     0x0900
 #define RK3228_GRF_MAC_CON1     0x0904
 
@@ -1313,6 +1424,7 @@ static int rk_gmac_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(rk_gmac_pm_ops, rk_gmac_suspend, rk_gmac_resume);
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {
+        { .compatible = "rockchip,rk3128-gmac", .data = &rk3128_ops },
         { .compatible = "rockchip,rk3228-gmac", .data = &rk3228_ops },
         { .compatible = "rockchip,rk3288-gmac", .data = &rk3288_ops },
         { .compatible = "rockchip,rk3328-gmac", .data = &rk3328_ops },
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index c4407e8e39a3..2f7d7ec59962 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -296,6 +296,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
 {
         void __iomem *ioaddr = hw->pcsr;
         unsigned int pmt = 0;
+        u32 config;
 
         if (mode & WAKE_MAGIC) {
                 pr_debug("GMAC: WOL Magic frame\n");
@@ -306,6 +307,12 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
                 pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
+        if (pmt) {
+                /* The receiver must be enabled for WOL before powering down */
+                config = readl(ioaddr + GMAC_CONFIG);
+                config |= GMAC_CONFIG_RE;
+                writel(config, ioaddr + GMAC_CONFIG);
+        }
         writel(pmt, ioaddr + GMAC_PMT);
 }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index e0ef02f9503b..4b286e27c4ca 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -275,7 +275,7 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
                                         goto exit;
                                 i++;
 
-                        } while ((ret == 1) || (i < 10));
+                        } while ((ret == 1) && (i < 10));
 
                         if (i == 10)
                                 ret = -EBUSY;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
index 67af0bdd7f10..7516ca210855 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c
@@ -34,7 +34,7 @@ int dwmac_dma_reset(void __iomem *ioaddr)
 
         err = readl_poll_timeout(ioaddr + DMA_BUS_MODE, value,
                                  !(value & DMA_BUS_MODE_SFT_RESET),
-                                 100000, 10000);
+                                 10000, 100000);
         if (err)
                 return -EBUSY;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 1763e48c84e2..16bd50929084 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -473,19 +473,18 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                                    struct dma_desc *np, struct sk_buff *skb)
 {
         struct skb_shared_hwtstamps *shhwtstamp = NULL;
+        struct dma_desc *desc = p;
         u64 ns;
 
         if (!priv->hwts_rx_en)
                 return;
+        /* For GMAC4, the valid timestamp is from CTX next desc. */
+        if (priv->plat->has_gmac4)
+                desc = np;
 
         /* Check if timestamp is available */
-        if (priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
-                /* For GMAC4, the valid timestamp is from CTX next desc. */
-                if (priv->plat->has_gmac4)
-                        ns = priv->hw->desc->get_timestamp(np, priv->adv_ts);
-                else
-                        ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
-
+        if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
+                ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
                 netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
                 memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
@@ -1800,12 +1799,13 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue)
 {
         struct stmmac_tx_queue *tx_q = &priv->tx_queue[queue];
         unsigned int bytes_compl = 0, pkts_compl = 0;
-        unsigned int entry = tx_q->dirty_tx;
+        unsigned int entry;
 
         netif_tx_lock(priv->dev);
 
         priv->xstats.tx_clean++;
 
+        entry = tx_q->dirty_tx;
         while (entry != tx_q->cur_tx) {
                 struct sk_buff *skb = tx_q->tx_skbuff[entry];
                 struct dma_desc *p;
@@ -3333,6 +3333,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                                  * them in stmmac_rx_refill() function so that
                                  * device can reuse it.
                                  */
+                                dev_kfree_skb_any(rx_q->rx_skbuff[entry]);
                                 rx_q->rx_skbuff[entry] = NULL;
                                 dma_unmap_single(priv->device,
                                                  rx_q->rx_skbuff_dma[entry],
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 8a280b48e3a9..6383695004a5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -150,6 +150,13 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
         plat->rx_queues_to_use = 1;
         plat->tx_queues_to_use = 1;
 
+        /* First Queue must always be in DCB mode. As MTL_QUEUE_DCB = 1 we need
+         * to always set this, otherwise Queue will be classified as AVB
+         * (because MTL_QUEUE_AVB = 0).
+         */
+        plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+        plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+
         rx_node = of_parse_phandle(pdev->dev.of_node, "snps,mtl-rx-config", 0);
         if (!rx_node)
                 return;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index f6404074b7b0..ed51018a813e 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -113,13 +113,7 @@ static void tunnel_id_to_vni(__be64 tun_id, __u8 *vni)
 
 static bool eq_tun_id_and_vni(u8 *tun_id, u8 *vni)
 {
-#ifdef __BIG_ENDIAN
-        return (vni[0] == tun_id[2]) &&
-               (vni[1] == tun_id[1]) &&
-               (vni[2] == tun_id[0]);
-#else
         return !memcmp(vni, &tun_id[5], 3);
-#endif
 }
 
 static sa_family_t geneve_get_sk_family(struct geneve_sock *gs)
diff --git a/drivers/net/ipvlan/ipvtap.c b/drivers/net/ipvlan/ipvtap.c
index 5dea2063dbc8..0bcc07f346c3 100644
--- a/drivers/net/ipvlan/ipvtap.c
+++ b/drivers/net/ipvlan/ipvtap.c
@@ -197,8 +197,8 @@ static int ipvtap_init(void)
 {
         int err;
 
-        err = tap_create_cdev(&ipvtap_cdev, &ipvtap_major, "ipvtap");
-
+        err = tap_create_cdev(&ipvtap_cdev, &ipvtap_major, "ipvtap",
+                              THIS_MODULE);
         if (err)
                 goto out1;
 
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 98e4deaa3a6a..5ab1b8849c30 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -742,6 +742,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
         sg_init_table(sg, ret);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
         if (unlikely(ret < 0)) {
+                aead_request_free(req);
                 macsec_txsa_put(tx_sa);
                 kfree_skb(skb);
                 return ERR_PTR(ret);
@@ -954,6 +955,7 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
         sg_init_table(sg, ret);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
         if (unlikely(ret < 0)) {
+                aead_request_free(req);
                 kfree_skb(skb);
                 return ERR_PTR(ret);
         }
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index c2d0ea2fb019..cba5cb3b849a 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -204,8 +204,8 @@ static int macvtap_init(void)
 {
         int err;
 
-        err = tap_create_cdev(&macvtap_cdev, &macvtap_major, "macvtap");
-
+        err = tap_create_cdev(&macvtap_cdev, &macvtap_major, "macvtap",
+                              THIS_MODULE);
         if (err)
                 goto out1;
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 15cbcdba618a..4d02b27df044 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -681,9 +681,11 @@ static int m88e1116r_config_init(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        err = m88e1121_config_aneg_rgmii_delays(phydev);
-        if (err < 0)
-                return err;
+        if (phy_interface_is_rgmii(phydev)) {
+                err = m88e1121_config_aneg_rgmii_delays(phydev);
+                if (err < 0)
+                        return err;
+        }
 
         err = genphy_soft_reset(phydev);
         if (err < 0)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index a404552555d4..e365866600ba 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -120,7 +120,7 @@ struct ppp {
         int             n_channels;     /* how many channels are attached 54 */
         spinlock_t      rlock;          /* lock for receive side 58 */
         spinlock_t      wlock;          /* lock for transmit side 5c */
-        int             *xmit_recursion __percpu; /* xmit recursion detect */
+        int __percpu    *xmit_recursion; /* xmit recursion detect */
         int             mru;            /* max receive unit 60 */
         unsigned int    flags;          /* control bits 64 */
         unsigned int    xstate;         /* transmit state bits 68 */
@@ -1339,7 +1339,17 @@ ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64)
 
 static int ppp_dev_init(struct net_device *dev)
 {
+        struct ppp *ppp;
+
         netdev_lockdep_set_classes(dev);
+
+        ppp = netdev_priv(dev);
+        /* Let the netdevice take a reference on the ppp file. This ensures
+         * that ppp_destroy_interface() won't run before the device gets
+         * unregistered.
+         */
+        atomic_inc(&ppp->file.refcnt);
+
         return 0;
 }
 
@@ -1362,6 +1372,15 @@ static void ppp_dev_uninit(struct net_device *dev)
         wake_up_interruptible(&ppp->file.rwait);
 }
 
+static void ppp_dev_priv_destructor(struct net_device *dev)
+{
+        struct ppp *ppp;
+
+        ppp = netdev_priv(dev);
+        if (atomic_dec_and_test(&ppp->file.refcnt))
+                ppp_destroy_interface(ppp);
+}
+
 static const struct net_device_ops ppp_netdev_ops = {
         .ndo_init        = ppp_dev_init,
         .ndo_uninit      = ppp_dev_uninit,
@@ -1387,6 +1406,7 @@ static void ppp_setup(struct net_device *dev)
         dev->tx_queue_len = 3;
         dev->type = ARPHRD_PPP;
         dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+        dev->priv_destructor = ppp_dev_priv_destructor;
         netif_keep_dst(dev);
 }
 
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 21b71ae947fd..6c0c84c33e1f 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -517,6 +517,10 @@ static int tap_open(struct inode *inode, struct file *file)
                                              &tap_proto, 0);
         if (!q)
                 goto err;
+        if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL)) {
+                sk_free(&q->sk);
+                goto err;
+        }
 
         RCU_INIT_POINTER(q->sock.wq, &q->wq);
         init_waitqueue_head(&q->wq.wait);
@@ -540,22 +544,18 @@ static int tap_open(struct inode *inode, struct file *file)
         if ((tap->dev->features & NETIF_F_HIGHDMA) && (tap->dev->features & NETIF_F_SG))
                 sock_set_flag(&q->sk, SOCK_ZEROCOPY);
 
-        err = -ENOMEM;
-        if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
-                goto err_array;
-
         err = tap_set_queue(tap, file, q);
-        if (err)
-                goto err_queue;
+        if (err) {
+                /* tap_sock_destruct() will take care of freeing skb_array */
+                goto err_put;
+        }
 
         dev_put(tap->dev);
 
         rtnl_unlock();
         return err;
 
-err_queue:
-        skb_array_cleanup(&q->skb_array);
-err_array:
+err_put:
         sock_put(&q->sk);
 err:
         if (tap)
@@ -1032,6 +1032,8 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
         case TUNSETSNDBUF:
                 if (get_user(s, sp))
                         return -EFAULT;
+                if (s <= 0)
+                        return -EINVAL;
 
                 q->sk.sk_sndbuf = s;
                 return 0;
@@ -1249,8 +1251,8 @@ static int tap_list_add(dev_t major, const char *device_name)
         return 0;
 }
 
-int tap_create_cdev(struct cdev *tap_cdev,
-                    dev_t *tap_major, const char *device_name)
+int tap_create_cdev(struct cdev *tap_cdev, dev_t *tap_major,
+                    const char *device_name, struct module *module)
 {
         int err;
 
@@ -1259,6 +1261,7 @@ int tap_create_cdev(struct cdev *tap_cdev,
                 goto out1;
 
         cdev_init(tap_cdev, &tap_fops);
+        tap_cdev->owner = module;
         err = cdev_add(tap_cdev, *tap_major, TAP_NUM_DEVS);
         if (err)
                 goto out2;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3c9985f29950..42bb820a56c9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1286,6 +1286,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
         buflen += SKB_DATA_ALIGN(len + pad);
         rcu_read_unlock();
 
+        alloc_frag->offset = ALIGN((u64)alloc_frag->offset, SMP_CACHE_BYTES);
         if (unlikely(!skb_page_frag_refill(buflen, alloc_frag, GFP_KERNEL)))
                 return ERR_PTR(-ENOMEM);
 
@@ -1496,11 +1497,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         switch (tun->flags & TUN_TYPE_MASK) {
         case IFF_TUN:
                 if (tun->flags & IFF_NO_PI) {
-                        switch (skb->data[0] & 0xf0) {
-                        case 0x40:
+                        u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+
+                        switch (ip_version) {
+                        case 4:
                                 pi.proto = htons(ETH_P_IP);
                                 break;
-                        case 0x60:
+                        case 6:
                                 pi.proto = htons(ETH_P_IPV6);
                                 break;
                         default:
@@ -2025,6 +2028,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (!dev)
                         return -ENOMEM;
+                err = dev_get_valid_name(net, dev, name);
+                if (err < 0)
+                        goto err_free_dev;
 
                 dev_net_set(dev, net);
                 dev->rtnl_link_ops = &tun_link_ops;
@@ -2423,6 +2429,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                         ret = -EFAULT;
                         break;
                 }
+                if (sndbuf <= 0) {
+                        ret = -EINVAL;
+                        break;
+                }
 
                 tun->sndbuf = sndbuf;
                 tun_set_sndbuf(tun);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 8ab281b478f2..3e7a3ac3a362 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -54,11 +54,19 @@ static int is_wireless_rndis(struct usb_interface_descriptor *desc)
                 desc->bInterfaceProtocol == 3);
 }
 
+static int is_novatel_rndis(struct usb_interface_descriptor *desc)
+{
+        return (desc->bInterfaceClass == USB_CLASS_MISC &&
+                desc->bInterfaceSubClass == 4 &&
+                desc->bInterfaceProtocol == 1);
+}
+
 #else
 
 #define is_rndis(desc)          0
 #define is_activesync(desc)     0
 #define is_wireless_rndis(desc) 0
+#define is_novatel_rndis(desc)  0
 
 #endif
 
@@ -150,7 +158,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
          */
         rndis = (is_rndis(&intf->cur_altsetting->desc) ||
                  is_activesync(&intf->cur_altsetting->desc) ||
-                 is_wireless_rndis(&intf->cur_altsetting->desc));
+                 is_wireless_rndis(&intf->cur_altsetting->desc) ||
+                 is_novatel_rndis(&intf->cur_altsetting->desc));
 
         memset(info, 0, sizeof(*info));
         info->control = intf;
@@ -547,9 +556,12 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define LINKSYS_VENDOR_ID       0x13b1
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
+#define UBLOX_VENDOR_ID         0x1546
+#define TPLINK_VENDOR_ID        0x2357
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -737,6 +749,15 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+#if IS_ENABLED(CONFIG_USB_RTL8152)
+/* Linksys USB3GIGV1 Ethernet Adapter */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LINKSYS_VENDOR_ID, 0x0041, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+#endif
+
 /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
 {
         USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
@@ -793,6 +814,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+        /* TP-LINK UE300 USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, 0x0601, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
@@ -844,12 +872,30 @@ static const struct usb_device_id	products[] = {
                         USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
         .driver_info = (kernel_ulong_t)&wwan_info,
 }, {
+        /* Huawei ME906 and ME909 */
+        USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x15c1, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         /* ZTE modules */
         USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, USB_CLASS_COMM,
                                       USB_CDC_SUBCLASS_ETHERNET,
                                       USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&zte_cdc_info,
 }, {
+        /* U-blox TOBY-L2 */
+        USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1143, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
+        /* U-blox SARA-U2 */
+        USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1104, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ceb78e2ea4f0..d51d9abf7986 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -613,7 +613,9 @@ enum rtl8152_flags {
 #define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_LINKSYS               0x13b1
 #define VENDOR_ID_NVIDIA                0x0955
+#define VENDOR_ID_TPLINK                0x2357
 
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -5316,7 +5318,9 @@ static const struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
         {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_TPLINK,  0x0601)},
         {}
 };
 
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a151f267aebb..b807c91abe1d 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -632,6 +632,10 @@ static const struct usb_device_id	products [] = {
         /* RNDIS for tethering */
         USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
         .driver_info = (unsigned long) &rndis_info,
+}, {
+        /* Novatel Verizon USB730L */
+        USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+        .driver_info = (unsigned long) &rndis_info,
 },
         { },            // END
 };
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 63f749078a1f..0e3f8ed84660 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -346,7 +346,6 @@ out:
 fail:
         dev_put(dev);
         free_netdev(ndev);
-        kfree(lapbeth);
         goto out;
 }
 
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index c9c711dcd0e6..a89b5685e68b 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -652,7 +652,7 @@ static int i2400m_download_chunk(struct i2400m *i2400m, const void *chunk,
         struct device *dev = i2400m_dev(i2400m);
         struct {
                 struct i2400m_bootrom_header cmd;
-                u8 cmd_payload[chunk_len];
+                u8 cmd_payload[];
         } __packed *buf;
         struct i2400m_bootrom_header ack;
 
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a3f5dc78353f..0aeeb233af78 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -550,6 +550,11 @@ static int ath10k_htt_rx_crypto_param_len(struct ath10k *ar,
                 return IEEE80211_TKIP_IV_LEN;
         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
                 return IEEE80211_CCMP_HDR_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2:
+                return IEEE80211_CCMP_256_HDR_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2:
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2:
+                return IEEE80211_GCMP_HDR_LEN;
         case HTT_RX_MPDU_ENCRYPT_WEP128:
         case HTT_RX_MPDU_ENCRYPT_WAPI:
                 break;
@@ -575,6 +580,11 @@ static int ath10k_htt_rx_crypto_tail_len(struct ath10k *ar,
                 return IEEE80211_TKIP_ICV_LEN;
         case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
                 return IEEE80211_CCMP_MIC_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2:
+                return IEEE80211_CCMP_256_MIC_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2:
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2:
+                return IEEE80211_GCMP_MIC_LEN;
         case HTT_RX_MPDU_ENCRYPT_WEP128:
         case HTT_RX_MPDU_ENCRYPT_WAPI:
                 break;
@@ -1051,9 +1061,21 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar,
         hdr = (void *)msdu->data;
 
         /* Tail */
-        if (status->flag & RX_FLAG_IV_STRIPPED)
+        if (status->flag & RX_FLAG_IV_STRIPPED) {
                 skb_trim(msdu, msdu->len -
                          ath10k_htt_rx_crypto_tail_len(ar, enctype));
+        } else {
+                /* MIC */
+                if ((status->flag & RX_FLAG_MIC_STRIPPED) &&
+                    enctype == HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2)
+                        skb_trim(msdu, msdu->len - 8);
+
+                /* ICV */
+                if (status->flag & RX_FLAG_ICV_STRIPPED &&
+                    enctype != HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2)
+                        skb_trim(msdu, msdu->len -
+                                 ath10k_htt_rx_crypto_tail_len(ar, enctype));
+        }
 
         /* MMIC */
         if ((status->flag & RX_FLAG_MMIC_STRIPPED) &&
@@ -1075,7 +1097,8 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar,
 static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
                                           struct sk_buff *msdu,
                                           struct ieee80211_rx_status *status,
-                                          const u8 first_hdr[64])
+                                          const u8 first_hdr[64],
+                                          enum htt_rx_mpdu_encrypt_type enctype)
 {
         struct ieee80211_hdr *hdr;
         struct htt_rx_desc *rxd;
@@ -1083,6 +1106,7 @@ static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
         u8 da[ETH_ALEN];
         u8 sa[ETH_ALEN];
         int l3_pad_bytes;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
 
         /* Delivered decapped frame:
          * [nwifi 802.11 header] <-- replaced with 802.11 hdr
@@ -1111,6 +1135,14 @@ static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
         /* push original 802.11 header */
         hdr = (struct ieee80211_hdr *)first_hdr;
         hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
+
         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
 
         /* original 802.11 header has a different DA and in
@@ -1171,6 +1203,7 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
         u8 sa[ETH_ALEN];
         int l3_pad_bytes;
         struct htt_rx_desc *rxd;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
 
         /* Delivered decapped frame:
          * [eth header] <-- replaced with 802.11 hdr & rfc1042/llc
@@ -1199,6 +1232,14 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
         /* push original 802.11 header */
         hdr = (struct ieee80211_hdr *)first_hdr;
         hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
+
         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
 
         /* original 802.11 header has a different DA and in
@@ -1212,12 +1253,14 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
 static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar,
                                          struct sk_buff *msdu,
                                          struct ieee80211_rx_status *status,
-                                         const u8 first_hdr[64])
+                                         const u8 first_hdr[64],
+                                         enum htt_rx_mpdu_encrypt_type enctype)
 {
         struct ieee80211_hdr *hdr;
         size_t hdr_len;
         int l3_pad_bytes;
         struct htt_rx_desc *rxd;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
 
         /* Delivered decapped frame:
          * [amsdu header] <-- replaced with 802.11 hdr
@@ -1233,6 +1276,14 @@ static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar,
 
         hdr = (struct ieee80211_hdr *)first_hdr;
         hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
+
         memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
 }
 
@@ -1267,13 +1318,15 @@ static void ath10k_htt_rx_h_undecap(struct ath10k *ar,
                                             is_decrypted);
                 break;
         case RX_MSDU_DECAP_NATIVE_WIFI:
-                ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr);
+                ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr,
+                                              enctype);
                 break;
         case RX_MSDU_DECAP_ETHERNET2_DIX:
                 ath10k_htt_rx_h_undecap_eth(ar, msdu, status, first_hdr, enctype);
                 break;
         case RX_MSDU_DECAP_8023_SNAP_LLC:
-                ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr);
+                ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr,
+                                             enctype);
                 break;
         }
 }
@@ -1316,7 +1369,8 @@ static void ath10k_htt_rx_h_csum_offload(struct sk_buff *msdu)
 
 static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                                  struct sk_buff_head *amsdu,
-                                 struct ieee80211_rx_status *status)
+                                 struct ieee80211_rx_status *status,
+                                 bool fill_crypt_header)
 {
         struct sk_buff *first;
         struct sk_buff *last;
@@ -1326,7 +1380,6 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
         enum htt_rx_mpdu_encrypt_type enctype;
         u8 first_hdr[64];
         u8 *qos;
-        size_t hdr_len;
         bool has_fcs_err;
         bool has_crypto_err;
         bool has_tkip_err;
@@ -1351,15 +1404,17 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
          * decapped header. It'll be used for undecapping of each MSDU.
          */
         hdr = (void *)rxd->rx_hdr_status;
-        hdr_len = ieee80211_hdrlen(hdr->frame_control);
-        memcpy(first_hdr, hdr, hdr_len);
+        memcpy(first_hdr, hdr, RX_HTT_HDR_STATUS_LEN);
 
         /* Each A-MSDU subframe will use the original header as the base and be
          * reported as a separate MSDU so strip the A-MSDU bit from QoS Ctl.
          */
         hdr = (void *)first_hdr;
-        qos = ieee80211_get_qos_ctl(hdr);
-        qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                qos = ieee80211_get_qos_ctl(hdr);
+                qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+        }
 
         /* Some attention flags are valid only in the last MSDU. */
         last = skb_peek_tail(amsdu);
@@ -1406,9 +1461,14 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                 status->flag |= RX_FLAG_DECRYPTED;
 
                 if (likely(!is_mgmt))
-                        status->flag |= RX_FLAG_IV_STRIPPED |
-                                        RX_FLAG_MMIC_STRIPPED;
-}
+                        status->flag |= RX_FLAG_MMIC_STRIPPED;
+
+                if (fill_crypt_header)
+                        status->flag |= RX_FLAG_MIC_STRIPPED |
+                                        RX_FLAG_ICV_STRIPPED;
+                else
+                        status->flag |= RX_FLAG_IV_STRIPPED;
+        }
 
         skb_queue_walk(amsdu, msdu) {
                 ath10k_htt_rx_h_csum_offload(msdu);
@@ -1424,6 +1484,9 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                 if (is_mgmt)
                         continue;
 
+                if (fill_crypt_header)
+                        continue;
+
                 hdr = (void *)msdu->data;
                 hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
         }
@@ -1434,6 +1497,9 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar,
                                     struct ieee80211_rx_status *status)
 {
         struct sk_buff *msdu;
+        struct sk_buff *first_subframe;
+
+        first_subframe = skb_peek(amsdu);
 
         while ((msdu = __skb_dequeue(amsdu))) {
                 /* Setup per-MSDU flags */
@@ -1442,6 +1508,13 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar,
                 else
                         status->flag |= RX_FLAG_AMSDU_MORE;
 
+                if (msdu == first_subframe) {
+                        first_subframe = NULL;
+                        status->flag &= ~RX_FLAG_ALLOW_SAME_PN;
+                } else {
+                        status->flag |= RX_FLAG_ALLOW_SAME_PN;
+                }
+
                 ath10k_process_rx(ar, status, msdu);
         }
 }
@@ -1584,7 +1657,7 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                 ath10k_htt_rx_h_unchain(ar, &amsdu);
 
         ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true);
         ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
         return num_msdus;
@@ -1745,8 +1818,7 @@ static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
 }
 
 static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
-                                       struct sk_buff_head *amsdu,
-                                       int budget_left)
+                                       struct sk_buff_head *amsdu)
 {
         struct sk_buff *msdu;
         struct htt_rx_desc *rxd;
@@ -1757,9 +1829,8 @@ static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
         if (WARN_ON(!skb_queue_empty(amsdu)))
                 return -EINVAL;
 
-        while ((msdu = __skb_dequeue(list)) && budget_left) {
+        while ((msdu = __skb_dequeue(list))) {
                 __skb_queue_tail(amsdu, msdu);
-                budget_left--;
 
                 rxd = (void *)msdu->data - sizeof(*rxd);
                 if (rxd->msdu_end.common.info0 &
@@ -1850,8 +1921,7 @@ static int ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
         return num_msdu;
 }
 
-static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
-                                    int budget_left)
+static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_htt *htt = &ar->htt;
         struct htt_resp *resp = (void *)skb->data;
@@ -1908,9 +1978,9 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
         if (offload)
                 num_msdus = ath10k_htt_rx_h_rx_offload(ar, &list);
 
-        while (!skb_queue_empty(&list) && budget_left) {
+        while (!skb_queue_empty(&list)) {
                 __skb_queue_head_init(&amsdu);
-                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu, budget_left);
+                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu);
                 switch (ret) {
                 case 0:
                         /* Note: The in-order indication may report interleaved
@@ -1920,10 +1990,9 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
                          * should still give an idea about rx rate to the user.
                          */
                         num_msdus += skb_queue_len(&amsdu);
-                        budget_left -= skb_queue_len(&amsdu);
                         ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id);
                         ath10k_htt_rx_h_filter(ar, &amsdu, status);
-                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status, false);
                         ath10k_htt_rx_h_deliver(ar, &amsdu, status);
                         break;
                 case -EAGAIN:
@@ -2563,8 +2632,7 @@ int ath10k_htt_txrx_compl_task(struct ath10k *ar, int budget)
                 }
 
                 spin_lock_bh(&htt->rx_ring.lock);
-                num_rx_msdus = ath10k_htt_rx_in_ord_ind(ar, skb,
-                                                        (budget - quota));
+                num_rx_msdus = ath10k_htt_rx_in_ord_ind(ar, skb);
                 spin_unlock_bh(&htt->rx_ring.lock);
                 if (num_rx_msdus < 0) {
                         resched_napi = true;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index bc1633945a56..195dafb98131 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3396,9 +3396,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
 MODULE_DEVICE_TABLE(pci, ath10k_pci_id_table);
 
-#ifdef CONFIG_PM
-
-static int ath10k_pci_pm_suspend(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_suspend(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3414,7 +3412,7 @@ static int ath10k_pci_pm_suspend(struct device *dev)
         return ret;
 }
 
-static int ath10k_pci_pm_resume(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_resume(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3433,7 +3431,6 @@ static int ath10k_pci_pm_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ath10k_pci_pm_ops,
                          ath10k_pci_pm_suspend,
                          ath10k_pci_pm_resume);
-#endif
 
 static struct pci_driver ath10k_pci_driver = {
         .name = "ath10k_pci",
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index c1022a1cf855..28da14398951 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -239,6 +239,9 @@ enum htt_rx_mpdu_encrypt_type {
         HTT_RX_MPDU_ENCRYPT_WAPI             = 5,
         HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2     = 6,
         HTT_RX_MPDU_ENCRYPT_NONE             = 7,
+        HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2  = 8,
+        HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2    = 9,
+        HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2 = 10,
 };
 
 #define RX_MPDU_START_INFO0_PEER_IDX_MASK     0x000007ff
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 35bd50bcbbd5..b83f01d6e3dd 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -812,7 +812,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
                         if (!sta) {
                                 wcn36xx_err("sta %pM is not found\n",
                                               bss_conf->bssid);
-                                rcu_read_unlock();
                                 goto out;
                         }
                         sta_priv = wcn36xx_sta_to_priv(sta);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab503ad..4157c90ad973 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 
         eth_broadcast_addr(params_le->bssid);
         params_le->bss_type = DOT11_BSSTYPE_ANY;
-        params_le->scan_type = 0;
+        params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
         params_le->channel_num = 0;
         params_le->nprobes = cpu_to_le32(-1);
         params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
         params_le->home_time = cpu_to_le32(-1);
         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 
-        /* if request is null exit so it will be all channel broadcast scan */
-        if (!request)
-                return;
-
         n_ssids = request->n_ssids;
         n_channels = request->n_channels;
+
         /* Copy channel array if applicable */
         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
                   n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
                         ptr += sizeof(ssid_le);
                 }
         } else {
-                brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
-                if ((request->ssids) && request->ssids->ssid_len) {
-                        brcmf_dbg(SCAN, "SSID %s len=%d\n",
-                                  params_le->ssid_le.SSID,
-                                  request->ssids->ssid_len);
-                        params_le->ssid_le.SSID_len =
-                                cpu_to_le32(request->ssids->ssid_len);
-                        memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
-                                request->ssids->ssid_len);
-                }
+                brcmf_dbg(SCAN, "Performing passive scan\n");
+                params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
         }
         /* Adding mask to channel numbers */
         params_le->channel_num =
@@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
         s32 status;
         struct brcmf_escan_result_le *escan_result_le;
+        u32 escan_buflen;
         struct brcmf_bss_info_le *bss_info_le;
         struct brcmf_bss_info_le *bss = NULL;
         u32 bi_length;
@@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
         if (status == BRCMF_E_STATUS_PARTIAL) {
                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
+                if (e->datalen < sizeof(*escan_result_le)) {
+                        brcmf_err("invalid event data length\n");
+                        goto exit;
+                }
                 escan_result_le = (struct brcmf_escan_result_le *) data;
                 if (!escan_result_le) {
                         brcmf_err("Invalid escan result (NULL pointer)\n");
                         goto exit;
                 }
+                escan_buflen = le32_to_cpu(escan_result_le->buflen);
+                if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+                    escan_buflen > e->datalen ||
+                    escan_buflen < sizeof(*escan_result_le)) {
+                        brcmf_err("Invalid escan buffer length: %d\n",
+                                  escan_buflen);
+                        goto exit;
+                }
                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                         brcmf_err("Invalid bss_count %d: ignoring\n",
                                   escan_result_le->bss_count);
@@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                 }
 
                 bi_length = le32_to_cpu(bss_info_le->length);
-                if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
-                                        WL_ESCAN_RESULTS_FIXED_SIZE)) {
-                        brcmf_err("Invalid bss_info length %d: ignoring\n",
+                if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+                        brcmf_err("Ignoring invalid bss_info length: %d\n",
                                   bi_length);
                         goto exit;
                 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index 4eb1e1ce9ace..ef72baf6dd96 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
         if (code != BRCMF_E_IF && !fweh->evt_handler[code])
                 return;
 
-        if (datalen > BRCMF_DCMD_MAXLEN)
+        if (datalen > BRCMF_DCMD_MAXLEN ||
+            datalen + sizeof(*event_packet) > packet_len)
                 return;
 
         if (in_interrupt())
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 8391989b1882..e0d22fedb2b4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -45,6 +45,11 @@
 #define BRCMF_SCAN_PARAMS_COUNT_MASK    0x0000ffff
 #define BRCMF_SCAN_PARAMS_NSSID_SHIFT   16
 
+/* scan type definitions */
+#define BRCMF_SCANTYPE_DEFAULT          0xFF
+#define BRCMF_SCANTYPE_ACTIVE           0
+#define BRCMF_SCANTYPE_PASSIVE          1
+
 #define BRCMF_WSEC_MAX_PSK_LEN          32
 #define BRCMF_WSEC_PASSPHRASE           BIT(0)
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index b3aab2fe96eb..ef685465f80a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -14764,8 +14764,8 @@ static void wlc_phy_ipa_restore_tx_digi_filts_nphy(struct brcms_phy *pi)
 }
 
 static void
-wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, u8 *events, u8 *dlys,
-                       u8 len)
+wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, const u8 *events,
+                       const u8 *dlys, u8 len)
 {
         u32 t1_offset, t2_offset;
         u8 ctr;
@@ -15240,16 +15240,16 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev5(struct brcms_phy *pi)
 static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
 {
         u16 currband;
-        s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
-        s8 *lna1_gain_db = NULL;
-        s8 *lna1_gain_db_2 = NULL;
-        s8 *lna2_gain_db = NULL;
-        s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 };
-        s8 *tia_gain_db;
-        s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
-        s8 *tia_gainbits;
-        u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
-        u16 *rfseq_init_gain;
+        static const s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
+        const s8 *lna1_gain_db = NULL;
+        const s8 *lna1_gain_db_2 = NULL;
+        const s8 *lna2_gain_db = NULL;
+        static const s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 };
+        const s8 *tia_gain_db;
+        static const s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
+        const s8 *tia_gainbits;
+        static const u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
+        const u16 *rfseq_init_gain;
         u16 init_gaincode;
         u16 clip1hi_gaincode;
         u16 clip1md_gaincode = 0;
@@ -15310,10 +15310,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
 
                         if ((freq <= 5080) || (freq == 5825)) {
 
-                                s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 };
-                                s8 lna1A_gain_db_2_rev7[] = {
-                                        11, 17, 22, 25};
-                                s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+                                static const s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 };
+                                static const s8 lna1A_gain_db_2_rev7[] = { 11, 17, 22, 25};
+                                static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
 
                                 crsminu_th = 0x3e;
                                 lna1_gain_db = lna1A_gain_db_rev7;
@@ -15321,10 +15320,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
                                 lna2_gain_db = lna2A_gain_db_rev7;
                         } else if ((freq >= 5500) && (freq <= 5700)) {
 
-                                s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 };
-                                s8 lna1A_gain_db_2_rev7[] = {
-                                        12, 18, 22, 26};
-                                s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 };
+                                static const s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 };
+                                static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26};
+                                static const s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 };
 
                                 crsminu_th = 0x45;
                                 clip1md_gaincode_B = 0x14;
@@ -15335,10 +15333,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
                                 lna2_gain_db = lna2A_gain_db_rev7;
                         } else {
 
-                                s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 };
-                                s8 lna1A_gain_db_2_rev7[] = {
-                                        12, 18, 22, 26};
-                                s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+                                static const s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 };
+                                static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26};
+                                static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
 
                                 crsminu_th = 0x41;
                                 lna1_gain_db = lna1A_gain_db_rev7;
@@ -15450,65 +15447,65 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
                 NPHY_RFSEQ_CMD_CLR_HIQ_DIS,
                 NPHY_RFSEQ_CMD_SET_HPF_BW
         };
-        u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
-        s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
-        s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
-        s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
-        s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
-        s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
-        s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
-        s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
-        s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
-        s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
-        s8 *lna1_gain_db = NULL;
-        s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
-        s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
-        s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
-        s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
-        s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
-        s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
-        s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
-        s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
-        s8 *lna2_gain_db = NULL;
-        s8 tiaG_gain_db[] = {
+        static const u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
+        static const s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
+        static const s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
+        static const s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
+        static const s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
+        static const s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
+        static const s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
+        static const s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
+        static const s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
+        static const s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
+        const s8 *lna1_gain_db = NULL;
+        static const s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
+        static const s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
+        static const s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
+        static const s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
+        static const s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
+        static const s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
+        static const s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
+        static const s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
+        const s8 *lna2_gain_db = NULL;
+        static const s8 tiaG_gain_db[] = {
                 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A };
-        s8 tiaA_gain_db[] = {
+        static const s8 tiaA_gain_db[] = {
                 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13 };
-        s8 tiaA_gain_db_rev4[] = {
+        static const s8 tiaA_gain_db_rev4[] = {
                 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-        s8 tiaA_gain_db_rev5[] = {
+        static const s8 tiaA_gain_db_rev5[] = {
                 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-        s8 tiaA_gain_db_rev6[] = {
+        static const s8 tiaA_gain_db_rev6[] = {
                 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-        s8 *tia_gain_db;
-        s8 tiaG_gainbits[] = {
+        const s8 *tia_gain_db;
+        static const s8 tiaG_gainbits[] = {
                 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03 };
-        s8 tiaA_gainbits[] = {
+        static const s8 tiaA_gainbits[] = {
                 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06 };
-        s8 tiaA_gainbits_rev4[] = {
+        static const s8 tiaA_gainbits_rev4[] = {
                 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-        s8 tiaA_gainbits_rev5[] = {
+        static const s8 tiaA_gainbits_rev5[] = {
                 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-        s8 tiaA_gainbits_rev6[] = {
+        static const s8 tiaA_gainbits_rev6[] = {
                 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-        s8 *tia_gainbits;
-        s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
-        s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
-        u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f };
-        u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f };
-        u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f };
-        u16 rfseqG_init_gain_rev5_elna[] = {
+        const s8 *tia_gainbits;
+        static const s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
+        static const s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
+        static const u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f };
+        static const u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f };
+        static const u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f };
+        static const u16 rfseqG_init_gain_rev5_elna[] = {
                 0x013f, 0x013f, 0x013f, 0x013f };
-        u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
-        u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
-        u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
-        u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f };
-        u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f };
-        u16 rfseqA_init_gain_rev4_elna[] = {
+        static const u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
+        static const u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
+        static const u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
+        static const u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f };
+        static const u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f };
+        static const u16 rfseqA_init_gain_rev4_elna[] = {
                 0x314f, 0x314f, 0x314f, 0x314f };
-        u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f };
-        u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
-        u16 *rfseq_init_gain;
+        static const u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f };
+        static const u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
+        const u16 *rfseq_init_gain;
         u16 initG_gaincode = 0x627e;
         u16 initG_gaincode_rev4 = 0x527e;
         u16 initG_gaincode_rev5 = 0x427e;
@@ -15538,10 +15535,10 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
         u16 clip1mdA_gaincode_rev6 = 0x2084;
         u16 clip1md_gaincode = 0;
         u16 clip1loG_gaincode = 0x0074;
-        u16 clip1loG_gaincode_rev5[] = {
+        static const u16 clip1loG_gaincode_rev5[] = {
                 0x0062, 0x0064, 0x006a, 0x106a, 0x106c, 0x1074, 0x107c, 0x207c
         };
-        u16 clip1loG_gaincode_rev6[] = {
+        static const u16 clip1loG_gaincode_rev6[] = {
                 0x106a, 0x106c, 0x1074, 0x107c, 0x007e, 0x107e, 0x207e, 0x307e
         };
         u16 clip1loG_gaincode_rev6_224B0 = 0x1074;
@@ -16066,7 +16063,7 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi)
 
 static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
 {
-        u8 rfseq_rx2tx_events[] = {
+        static const u8 rfseq_rx2tx_events[] = {
                 NPHY_RFSEQ_CMD_NOP,
                 NPHY_RFSEQ_CMD_RXG_FBW,
                 NPHY_RFSEQ_CMD_TR_SWITCH,
@@ -16076,7 +16073,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                 NPHY_RFSEQ_CMD_EXT_PA
         };
         u8 rfseq_rx2tx_dlys[] = { 8, 6, 6, 2, 4, 60, 1 };
-        u8 rfseq_tx2rx_events[] = {
+        static const u8 rfseq_tx2rx_events[] = {
                 NPHY_RFSEQ_CMD_NOP,
                 NPHY_RFSEQ_CMD_EXT_PA,
                 NPHY_RFSEQ_CMD_TX_GAIN,
@@ -16085,8 +16082,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                 NPHY_RFSEQ_CMD_RXG_FBW,
                 NPHY_RFSEQ_CMD_CLR_HIQ_DIS
         };
-        u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
-        u8 rfseq_tx2rx_events_rev3[] = {
+        static const u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
+        static const u8 rfseq_tx2rx_events_rev3[] = {
                 NPHY_REV3_RFSEQ_CMD_EXT_PA,
                 NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
                 NPHY_REV3_RFSEQ_CMD_TX_GAIN,
@@ -16096,7 +16093,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                 NPHY_REV3_RFSEQ_CMD_CLR_HIQ_DIS,
                 NPHY_REV3_RFSEQ_CMD_END
         };
-        u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
+        static const u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
         u8 rfseq_rx2tx_events_rev3[] = {
                 NPHY_REV3_RFSEQ_CMD_NOP,
                 NPHY_REV3_RFSEQ_CMD_RXG_FBW,
@@ -16110,7 +16107,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
         };
         u8 rfseq_rx2tx_dlys_rev3[] = { 8, 6, 6, 4, 4, 18, 42, 1, 1 };
 
-        u8 rfseq_rx2tx_events_rev3_ipa[] = {
+        static const u8 rfseq_rx2tx_events_rev3_ipa[] = {
                 NPHY_REV3_RFSEQ_CMD_NOP,
                 NPHY_REV3_RFSEQ_CMD_RXG_FBW,
                 NPHY_REV3_RFSEQ_CMD_TR_SWITCH,
@@ -16121,15 +16118,15 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
                 NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
                 NPHY_REV3_RFSEQ_CMD_END
         };
-        u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 };
-        u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
+        static const u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 };
+        static const u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
 
         s16 alpha0, alpha1, alpha2;
         s16 beta0, beta1, beta2;
         u32 leg_data_weights, ht_data_weights, nss1_data_weights,
             stbc_data_weights;
         u8 chan_freq_range = 0;
-        u16 dac_control = 0x0002;
+        static const u16 dac_control = 0x0002;
         u16 aux_adc_vmid_rev7_core0[] = { 0x8e, 0x96, 0x96, 0x96 };
         u16 aux_adc_vmid_rev7_core1[] = { 0x8f, 0x9f, 0x9f, 0x96 };
         u16 aux_adc_vmid_rev4[] = { 0xa2, 0xb4, 0xb4, 0x89 };
@@ -16139,8 +16136,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
         u16 aux_adc_gain_rev4[] = { 0x02, 0x02, 0x02, 0x00 };
         u16 aux_adc_gain_rev3[] = { 0x02, 0x02, 0x02, 0x00 };
         u16 *aux_adc_gain;
-        u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
-        u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
+        static const u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
+        static const u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
         s32 min_nvar_val = 0x18d;
         s32 min_nvar_offset_6mbps = 20;
         u8 pdetrange;
@@ -16151,9 +16148,9 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
         u16 rfseq_rx2tx_lpf_h_hpc_rev7 = 0x77;
         u16 rfseq_tx2rx_lpf_h_hpc_rev7 = 0x77;
         u16 rfseq_pktgn_lpf_h_hpc_rev7 = 0x77;
-        u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
-        u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
-        u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+        static const u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
+        static const u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+        static const u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
         u16 ipalvlshift_3p3_war_en = 0;
         u16 rccal_bcap_val, rccal_scap_val;
         u16 rccal_tx20_11b_bcap = 0;
@@ -24291,13 +24288,13 @@ static void wlc_phy_update_txcal_ladder_nphy(struct brcms_phy *pi, u16 core)
         u16 bbmult;
         u16 tblentry;
 
-        struct nphy_txiqcal_ladder ladder_lo[] = {
+        static const struct nphy_txiqcal_ladder ladder_lo[] = {
                 {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
                 {25, 0}, {25, 1}, {25, 2}, {25, 3}, {25, 4}, {25, 5},
                 {25, 6}, {25, 7}, {35, 7}, {50, 7}, {71, 7}, {100, 7}
         };
 
-        struct nphy_txiqcal_ladder ladder_iq[] = {
+        static const struct nphy_txiqcal_ladder ladder_iq[] = {
                 {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
                 {25, 0}, {35, 0}, {50, 0}, {71, 0}, {100, 0}, {100, 1},
                 {100, 2}, {100, 3}, {100, 4}, {100, 5}, {100, 6}, {100, 7}
@@ -25773,67 +25770,67 @@ wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi, struct nphy_txgains target_gain,
         u16 cal_gain[2];
         struct nphy_iqcal_params cal_params[2];
         u32 tbl_len;
-        void *tbl_ptr;
+        const void *tbl_ptr;
         bool ladder_updated[2];
         u8 mphase_cal_lastphase = 0;
         int bcmerror = 0;
         bool phyhang_avoid_state = false;
 
-        u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
+        static const u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
                 0x0300, 0x0500, 0x0700, 0x0900, 0x0d00, 0x1100, 0x1900, 0x1901,
                 0x1902,
                 0x1903, 0x1904, 0x1905, 0x1906, 0x1907, 0x2407, 0x3207, 0x4607,
                 0x6407
         };
 
-        u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
+        static const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
                 0x0200, 0x0300, 0x0600, 0x0900, 0x0d00, 0x1100, 0x1900, 0x2400,
                 0x3200,
                 0x4600, 0x6400, 0x6401, 0x6402, 0x6403, 0x6404, 0x6405, 0x6406,
                 0x6407
         };
 
-        u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
+        static const u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
                 0x0200, 0x0300, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1201,
                 0x1202,
                 0x1203, 0x1204, 0x1205, 0x1206, 0x1207, 0x1907, 0x2307, 0x3207,
                 0x4707
         };
 
-        u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
+        static const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
                 0x0100, 0x0200, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1900,
                 0x2300,
                 0x3200, 0x4700, 0x4701, 0x4702, 0x4703, 0x4704, 0x4705, 0x4706,
                 0x4707
         };
 
-        u16 tbl_tx_iqlo_cal_startcoefs[] = {
+        static const u16 tbl_tx_iqlo_cal_startcoefs[] = {
                 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                 0x0000
         };
 
-        u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
+        static const u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
                 0x8123, 0x8264, 0x8086, 0x8245, 0x8056,
                 0x9123, 0x9264, 0x9086, 0x9245, 0x9056
         };
 
-        u16 tbl_tx_iqlo_cal_cmds_recal[] = {
+        static const u16 tbl_tx_iqlo_cal_cmds_recal[] = {
                 0x8101, 0x8253, 0x8053, 0x8234, 0x8034,
                 0x9101, 0x9253, 0x9053, 0x9234, 0x9034
         };
 
-        u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
+        static const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
                 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                 0x0000
         };
 
-        u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
+        static const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
                 0x8434, 0x8334, 0x8084, 0x8267, 0x8056, 0x8234,
                 0x9434, 0x9334, 0x9084, 0x9267, 0x9056, 0x9234
         };
 
-        u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
+        static const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
                 0x8423, 0x8323, 0x8073, 0x8256, 0x8045, 0x8223,
                 0x9423, 0x9323, 0x9073, 0x9256, 0x9045, 0x9223
         };
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/7000.c b/drivers/net/wireless/intel/iwlwifi/cfg/7000.c
index 45e2efc70d19..ce741beec1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/7000.c
@@ -309,6 +309,7 @@ const struct iwl_cfg iwl3168_2ac_cfg = {
         .nvm_calib_ver = IWL3168_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
         .dccm_len = IWL7265_DCCM_LEN,
+        .nvm_type = IWL_NVM_SDP,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/8000.c b/drivers/net/wireless/intel/iwlwifi/cfg/8000.c
index 2e6c52664cee..c2a5936ccede 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/8000.c
@@ -164,7 +164,7 @@ static const struct iwl_tt_params iwl8000_tt_params = {
         .default_nvm_file_C_step = DEFAULT_NVM_FILE_FAMILY_8000C,       \
         .thermal_params = &iwl8000_tt_params,                           \
         .apmg_not_supported = true,                                     \
-        .ext_nvm = true,                                                \
+        .nvm_type = IWL_NVM_EXT,                                        \
         .dbgc_supported = true
 
 #define IWL_DEVICE_8000                                                 \
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index 2babe0a1f18b..e8b5ff42f5a8 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -148,7 +148,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
         .vht_mu_mimo_supported = true,                                  \
         .mac_addr_from_csr = true,                                      \
         .rf_id = true,                                                  \
-        .ext_nvm = true,                                                \
+        .nvm_type = IWL_NVM_EXT,                                        \
         .dbgc_supported = true
 
 const struct iwl_cfg iwl9160_2ac_cfg = {
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/a000.c b/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
index 76ba1f8bc72f..a440140ed8dd 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/a000.c
@@ -133,7 +133,7 @@ static const struct iwl_ht_params iwl_a000_ht_params = {
         .use_tfh = true,                                                \
         .rf_id = true,                                                  \
         .gen2 = true,                                                   \
-        .ext_nvm = true,                                                \
+        .nvm_type = IWL_NVM_EXT,                                        \
         .dbgc_supported = true
 
 const struct iwl_cfg iwla000_2ac_cfg_hr = {
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
index 00bc7a25dece..3fd07bc80f54 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
@@ -108,6 +108,7 @@ enum iwl_nvm_access_target {
  * @NVM_SECTION_TYPE_REGULATORY: regulatory section
  * @NVM_SECTION_TYPE_CALIBRATION: calibration section
  * @NVM_SECTION_TYPE_PRODUCTION: production section
+ * @NVM_SECTION_TYPE_REGULATORY_SDP: regulatory section used by 3168 series
  * @NVM_SECTION_TYPE_MAC_OVERRIDE: MAC override section
  * @NVM_SECTION_TYPE_PHY_SKU: PHY SKU section
  * @NVM_MAX_NUM_SECTIONS: number of sections
@@ -117,6 +118,7 @@ enum iwl_nvm_section_type {
         NVM_SECTION_TYPE_REGULATORY = 3,
         NVM_SECTION_TYPE_CALIBRATION = 4,
         NVM_SECTION_TYPE_PRODUCTION = 5,
+        NVM_SECTION_TYPE_REGULATORY_SDP = 8,
         NVM_SECTION_TYPE_MAC_OVERRIDE = 11,
         NVM_SECTION_TYPE_PHY_SKU = 12,
         NVM_MAX_NUM_SECTIONS = 13,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 6afc7a799892..f5dd7d83cd0a 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -1086,7 +1086,7 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
 
         if (fwrt->trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
                 /* stop recording */
-                iwl_set_bits_prph(fwrt->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+                iwl_fw_dbg_stop_recording(fwrt);
 
                 iwl_fw_error_dump(fwrt);
 
@@ -1104,10 +1104,7 @@ void iwl_fw_error_dump_wk(struct work_struct *work)
                 u32 in_sample = iwl_read_prph(fwrt->trans, DBGC_IN_SAMPLE);
                 u32 out_ctrl = iwl_read_prph(fwrt->trans, DBGC_OUT_CTRL);
 
-                /* stop recording */
-                iwl_write_prph(fwrt->trans, DBGC_IN_SAMPLE, 0);
-                udelay(100);
-                iwl_write_prph(fwrt->trans, DBGC_OUT_CTRL, 0);
+                iwl_fw_dbg_stop_recording(fwrt);
                 /* wait before we collect the data till the DBGC stop */
                 udelay(500);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 0f810ea89d31..9c889a32fe24 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -68,6 +68,8 @@
 #include <linux/workqueue.h>
 #include <net/cfg80211.h>
 #include "runtime.h"
+#include "iwl-prph.h"
+#include "iwl-io.h"
 #include "file.h"
 #include "error-dump.h"
 
@@ -194,8 +196,21 @@ _iwl_fw_dbg_trigger_simple_stop(struct iwl_fw_runtime *fwrt,
                                         iwl_fw_dbg_get_trigger((fwrt)->fw,\
                                                                (trig)))
 
+static inline void iwl_fw_dbg_stop_recording(struct iwl_fw_runtime *fwrt)
+{
+        if (fwrt->trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                iwl_set_bits_prph(fwrt->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+        } else {
+                iwl_write_prph(fwrt->trans, DBGC_IN_SAMPLE, 0);
+                udelay(100);
+                iwl_write_prph(fwrt->trans, DBGC_OUT_CTRL, 0);
+        }
+}
+
 static inline void iwl_fw_dump_conf_clear(struct iwl_fw_runtime *fwrt)
 {
+        iwl_fw_dbg_stop_recording(fwrt);
+
         fwrt->dump.conf = FW_DBG_INVALID;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index 3e057b539d5b..71cb1ecde0f7 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -108,6 +108,18 @@ enum iwl_led_mode {
         IWL_LED_DISABLE,
 };
 
+/**
+ * enum iwl_nvm_type - nvm formats
+ * @IWL_NVM: the regular format
+ * @IWL_NVM_EXT: extended NVM format
+ * @IWL_NVM_SDP: NVM format used by 3168 series
+ */
+enum iwl_nvm_type {
+        IWL_NVM,
+        IWL_NVM_EXT,
+        IWL_NVM_SDP,
+};
+
 /*
  * This is the threshold value of plcp error rate per 100mSecs.  It is
  * used to set and check for the validity of plcp_delta.
@@ -320,7 +332,7 @@ struct iwl_pwr_tx_backoff {
  * @integrated: discrete or integrated
  * @gen2: a000 and on transport operation
  * @cdb: CDB support
- * @ext_nvm: extended NVM format
+ * @nvm_type: see &enum iwl_nvm_type
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -342,6 +354,7 @@ struct iwl_cfg {
         const struct iwl_tt_params *thermal_params;
         enum iwl_device_family device_family;
         enum iwl_led_mode led_mode;
+        enum iwl_nvm_type nvm_type;
         u32 max_data_size;
         u32 max_inst_size;
         netdev_features_t features;
@@ -369,7 +382,6 @@ struct iwl_cfg {
             use_tfh:1,
             gen2:1,
             cdb:1,
-            ext_nvm:1,
             dbgc_supported:1;
         u8 valid_tx_ant;
         u8 valid_rx_ant;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 3014beef4873..c3a5d8ccc95e 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -77,7 +77,7 @@
 #include "iwl-csr.h"
 
 /* NVM offsets (in words) definitions */
-enum wkp_nvm_offsets {
+enum nvm_offsets {
         /* NVM HW-Section offset (in words) definitions */
         SUBSYSTEM_ID = 0x0A,
         HW_ADDR = 0x15,
@@ -92,7 +92,10 @@ enum wkp_nvm_offsets {
 
         /* NVM calibration section offset (in words) definitions */
         NVM_CALIB_SECTION = 0x2B8,
-        XTAL_CALIB = 0x316 - NVM_CALIB_SECTION
+        XTAL_CALIB = 0x316 - NVM_CALIB_SECTION,
+
+        /* NVM REGULATORY -Section offset (in words) definitions */
+        NVM_CHANNELS_SDP = 0,
 };
 
 enum ext_nvm_offsets {
@@ -206,8 +209,36 @@ enum iwl_nvm_channel_flags {
         NVM_CHANNEL_DC_HIGH             = BIT(12),
 };
 
+static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
+                                               int chan, u16 flags)
+{
 #define CHECK_AND_PRINT_I(x)    \
-        ((ch_flags & NVM_CHANNEL_##x) ? # x " " : "")
+        ((flags & NVM_CHANNEL_##x) ? " " #x : "")
+
+        if (!(flags & NVM_CHANNEL_VALID)) {
+                IWL_DEBUG_DEV(dev, level, "Ch. %d: 0x%x: No traffic\n",
+                              chan, flags);
+                return;
+        }
+
+        /* Note: already can print up to 101 characters, 110 is the limit! */
+        IWL_DEBUG_DEV(dev, level,
+                      "Ch. %d: 0x%x:%s%s%s%s%s%s%s%s%s%s%s%s\n",
+                      chan, flags,
+                      CHECK_AND_PRINT_I(VALID),
+                      CHECK_AND_PRINT_I(IBSS),
+                      CHECK_AND_PRINT_I(ACTIVE),
+                      CHECK_AND_PRINT_I(RADAR),
+                      CHECK_AND_PRINT_I(INDOOR_ONLY),
+                      CHECK_AND_PRINT_I(GO_CONCURRENT),
+                      CHECK_AND_PRINT_I(UNIFORM),
+                      CHECK_AND_PRINT_I(20MHZ),
+                      CHECK_AND_PRINT_I(40MHZ),
+                      CHECK_AND_PRINT_I(80MHZ),
+                      CHECK_AND_PRINT_I(160MHZ),
+                      CHECK_AND_PRINT_I(DC_HIGH));
+#undef CHECK_AND_PRINT_I
+}
 
 static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz,
                                  u16 nvm_flags, const struct iwl_cfg *cfg)
@@ -215,7 +246,7 @@ static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz,
         u32 flags = IEEE80211_CHAN_NO_HT40;
         u32 last_5ghz_ht = LAST_5GHZ_HT;
 
-        if (cfg->ext_nvm)
+        if (cfg->nvm_type == IWL_NVM_EXT)
                 last_5ghz_ht = LAST_5GHZ_HT_FAMILY_8000;
 
         if (!is_5ghz && (nvm_flags & NVM_CHANNEL_40MHZ)) {
@@ -268,7 +299,7 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
         int num_of_ch, num_2ghz_channels;
         const u8 *nvm_chan;
 
-        if (!cfg->ext_nvm) {
+        if (cfg->nvm_type != IWL_NVM_EXT) {
                 num_of_ch = IWL_NUM_CHANNELS;
                 nvm_chan = &iwl_nvm_channels[0];
                 num_2ghz_channels = NUM_2GHZ_CHANNELS;
@@ -302,12 +333,8 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                          * supported, hence we still want to add them to
                          * the list of supported channels to cfg80211.
                          */
-                        IWL_DEBUG_EEPROM(dev,
-                                         "Ch. %d Flags %x [%sGHz] - No traffic\n",
-                                         nvm_chan[ch_idx],
-                                         ch_flags,
-                                         (ch_idx >= num_2ghz_channels) ?
-                                         "5.2" : "2.4");
+                        iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
+                                                    nvm_chan[ch_idx], ch_flags);
                         continue;
                 }
 
@@ -337,27 +364,10 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                 else
                         channel->flags = 0;
 
-                IWL_DEBUG_EEPROM(dev,
-                                 "Ch. %d [%sGHz] flags 0x%x %s%s%s%s%s%s%s%s%s%s%s%s(%ddBm): Ad-Hoc %ssupported\n",
-                                 channel->hw_value,
-                                 is_5ghz ? "5.2" : "2.4",
-                                 ch_flags,
-                                 CHECK_AND_PRINT_I(VALID),
-                                 CHECK_AND_PRINT_I(IBSS),
-                                 CHECK_AND_PRINT_I(ACTIVE),
-                                 CHECK_AND_PRINT_I(RADAR),
-                                 CHECK_AND_PRINT_I(INDOOR_ONLY),
-                                 CHECK_AND_PRINT_I(GO_CONCURRENT),
-                                 CHECK_AND_PRINT_I(UNIFORM),
-                                 CHECK_AND_PRINT_I(20MHZ),
-                                 CHECK_AND_PRINT_I(40MHZ),
-                                 CHECK_AND_PRINT_I(80MHZ),
-                                 CHECK_AND_PRINT_I(160MHZ),
-                                 CHECK_AND_PRINT_I(DC_HIGH),
-                                 channel->max_power,
-                                 ((ch_flags & NVM_CHANNEL_IBSS) &&
-                                  !(ch_flags & NVM_CHANNEL_RADAR))
-                                        ? "" : "not ");
+                iwl_nvm_print_channel_flags(dev, IWL_DL_EEPROM,
+                                            channel->hw_value, ch_flags);
+                IWL_DEBUG_EEPROM(dev, "Ch. %d: %ddBm\n",
+                                 channel->hw_value, channel->max_power);
         }
 
         return n_channels;
@@ -484,7 +494,7 @@ IWL_EXPORT_SYMBOL(iwl_init_sbands);
 static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
                        const __le16 *phy_sku)
 {
-        if (!cfg->ext_nvm)
+        if (cfg->nvm_type != IWL_NVM_EXT)
                 return le16_to_cpup(nvm_sw + SKU);
 
         return le32_to_cpup((__le32 *)(phy_sku + SKU_FAMILY_8000));
@@ -492,7 +502,7 @@ static int iwl_get_sku(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
 
 static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
 {
-        if (!cfg->ext_nvm)
+        if (cfg->nvm_type != IWL_NVM_EXT)
                 return le16_to_cpup(nvm_sw + NVM_VERSION);
         else
                 return le32_to_cpup((__le32 *)(nvm_sw +
@@ -502,7 +512,7 @@ static int iwl_get_nvm_version(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
 static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
                              const __le16 *phy_sku)
 {
-        if (!cfg->ext_nvm)
+        if (cfg->nvm_type != IWL_NVM_EXT)
                 return le16_to_cpup(nvm_sw + RADIO_CFG);
 
         return le32_to_cpup((__le32 *)(phy_sku + RADIO_CFG_FAMILY_EXT_NVM));
@@ -513,7 +523,7 @@ static int iwl_get_n_hw_addrs(const struct iwl_cfg *cfg, const __le16 *nvm_sw)
 {
         int n_hw_addr;
 
-        if (!cfg->ext_nvm)
+        if (cfg->nvm_type != IWL_NVM_EXT)
                 return le16_to_cpup(nvm_sw + N_HW_ADDRS);
 
         n_hw_addr = le32_to_cpup((__le32 *)(nvm_sw + N_HW_ADDRS_FAMILY_8000));
@@ -525,7 +535,7 @@ static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
                               struct iwl_nvm_data *data,
                               u32 radio_cfg)
 {
-        if (!cfg->ext_nvm) {
+        if (cfg->nvm_type != IWL_NVM_EXT) {
                 data->radio_cfg_type = NVM_RF_CFG_TYPE_MSK(radio_cfg);
                 data->radio_cfg_step = NVM_RF_CFG_STEP_MSK(radio_cfg);
                 data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK(radio_cfg);
@@ -634,7 +644,7 @@ static int iwl_set_hw_address(struct iwl_trans *trans,
 {
         if (cfg->mac_addr_from_csr) {
                 iwl_set_hw_address_from_csr(trans, data);
-        } else if (!cfg->ext_nvm) {
+        } else if (cfg->nvm_type != IWL_NVM_EXT) {
                 const u8 *hw_addr = (const u8 *)(nvm_hw + HW_ADDR);
 
                 /* The byte order is little endian 16 bit, meaning 214365 */
@@ -706,7 +716,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         u16 lar_config;
         const __le16 *ch_section;
 
-        if (!cfg->ext_nvm)
+        if (cfg->nvm_type != IWL_NVM_EXT)
                 data = kzalloc(sizeof(*data) +
                                sizeof(struct ieee80211_channel) *
                                IWL_NUM_CHANNELS,
@@ -740,7 +750,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         data->n_hw_addrs = iwl_get_n_hw_addrs(cfg, nvm_sw);
 
-        if (!cfg->ext_nvm) {
+        if (cfg->nvm_type != IWL_NVM_EXT) {
                 /* Checking for required sections */
                 if (!nvm_calib) {
                         IWL_ERR(trans,
@@ -748,11 +758,15 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
                         kfree(data);
                         return NULL;
                 }
+
+                ch_section = cfg->nvm_type == IWL_NVM_SDP ?
+                             &regulatory[NVM_CHANNELS_SDP] :
+                             &nvm_sw[NVM_CHANNELS];
+
                 /* in family 8000 Xtal calibration values moved to OTP */
                 data->xtal_calib[0] = *(nvm_calib + XTAL_CALIB);
                 data->xtal_calib[1] = *(nvm_calib + XTAL_CALIB + 1);
                 lar_enabled = true;
-                ch_section = &nvm_sw[NVM_CHANNELS];
         } else {
                 u16 lar_offset = data->nvm_version < 0xE39 ?
                                  NVM_LAR_OFFSET_OLD :
@@ -786,7 +800,7 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
         u32 flags = NL80211_RRF_NO_HT40;
         u32 last_5ghz_ht = LAST_5GHZ_HT;
 
-        if (cfg->ext_nvm)
+        if (cfg->nvm_type == IWL_NVM_EXT)
                 last_5ghz_ht = LAST_5GHZ_HT_FAMILY_8000;
 
         if (ch_idx < NUM_2GHZ_CHANNELS &&
@@ -834,7 +848,7 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         int ch_idx;
         u16 ch_flags;
         u32 reg_rule_flags, prev_reg_rule_flags = 0;
-        const u8 *nvm_chan = cfg->ext_nvm ?
+        const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd;
         int size_of_regd;
@@ -843,7 +857,7 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
         int center_freq, prev_center_freq = 0;
         int valid_rules = 0;
         bool new_rule;
-        int max_num_ch = cfg->ext_nvm ?
+        int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
                          IWL_NUM_CHANNELS_EXT : IWL_NUM_CHANNELS;
 
         if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
@@ -873,12 +887,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 new_rule = false;
 
                 if (!(ch_flags & NVM_CHANNEL_VALID)) {
-                        IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                                      "Ch. %d Flags %x [%sGHz] - No traffic\n",
-                                      nvm_chan[ch_idx],
-                                      ch_flags,
-                                      (ch_idx >= NUM_2GHZ_CHANNELS) ?
-                                      "5.2" : "2.4");
+                        iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
+                                                    nvm_chan[ch_idx], ch_flags);
                         continue;
                 }
 
@@ -914,31 +924,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 prev_center_freq = center_freq;
                 prev_reg_rule_flags = reg_rule_flags;
 
-                IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s%s%s%s(0x%02x)\n",
-                              center_freq,
-                              band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
-                              CHECK_AND_PRINT_I(VALID),
-                              CHECK_AND_PRINT_I(IBSS),
-                              CHECK_AND_PRINT_I(ACTIVE),
-                              CHECK_AND_PRINT_I(RADAR),
-                              CHECK_AND_PRINT_I(INDOOR_ONLY),
-                              CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              CHECK_AND_PRINT_I(UNIFORM),
-                              CHECK_AND_PRINT_I(20MHZ),
-                              CHECK_AND_PRINT_I(40MHZ),
-                              CHECK_AND_PRINT_I(80MHZ),
-                              CHECK_AND_PRINT_I(160MHZ),
-                              CHECK_AND_PRINT_I(DC_HIGH),
-                              ch_flags);
-                IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] reg_flags 0x%x: %s\n",
-                              center_freq,
-                              band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
-                              reg_rule_flags,
-                              ((ch_flags & NVM_CHANNEL_ACTIVE) &&
-                               !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "Ad-Hoc" : "");
+                iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
+                                            nvm_chan[ch_idx], ch_flags);
         }
 
         regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 5de19ea10575..b205a7bfb828 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2167,7 +2167,7 @@ out:
          * 1. We are not using a unified image
          * 2. We are using a unified image but had an error while exiting D3
          */
-        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+        set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
         set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
         /*
          * When switching images we return 1, which causes mac80211
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 15f2d826bb4b..a9ac872226fd 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1077,6 +1077,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         mvm->vif_count = 0;
         mvm->rx_ba_sessions = 0;
         mvm->fwrt.dump.conf = FW_DBG_INVALID;
+        mvm->monitor_on = false;
 
         /* keep statistics ticking */
         iwl_mvm_accu_radio_stats(mvm);
@@ -1437,6 +1438,9 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 mvm->p2p_device_vif = vif;
         }
 
+        if (vif->type == NL80211_IFTYPE_MONITOR)
+                mvm->monitor_on = true;
+
         iwl_mvm_vif_dbgfs_register(mvm, vif);
         goto out_unlock;
 
@@ -1526,6 +1530,9 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
         iwl_mvm_power_update_mac(mvm);
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
+        if (vif->type == NL80211_IFTYPE_MONITOR)
+                mvm->monitor_on = false;
+
 out_release:
         mutex_unlock(&mvm->mutex);
 }
@@ -1546,6 +1553,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         struct iwl_mvm_mc_iter_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = MCAST_FILTER_CMD,
+                .flags = CMD_ASYNC,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
         int ret, len;
 
         /* if we don't have free ports, mcast frames will be dropped */
@@ -1560,7 +1572,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+        hcmd.len[0] = len;
+        hcmd.data[0] = cmd;
+
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
         if (ret)
                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1635,6 +1650,12 @@ static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
         if (!cmd)
                 goto out;
 
+        if (changed_flags & FIF_ALLMULTI)
+                cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
+
+        if (cmd->pass_all)
+                cmd->count = 0;
+
         iwl_mvm_recalc_multicast(mvm);
 out:
         mutex_unlock(&mvm->mutex);
@@ -2563,7 +2584,7 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
                          * queues, so we should never get a second deferred
                          * frame for the RA/TID.
                          */
-                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
+                        iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
                         ieee80211_free_txskb(mvm->hw, skb);
                 }
         }
@@ -3975,6 +3996,43 @@ out_unlock:
         return ret;
 }
 
+static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
+{
+        if (drop) {
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        /* TODO new tx api */
+                        WARN_ONCE(1,
+                                  "Need to implement flush TX queue\n");
+                else
+                        iwl_mvm_flush_tx_path(mvm,
+                                iwl_mvm_flushable_queues(mvm) & queues,
+                                0);
+        } else {
+                if (iwl_mvm_has_new_tx_api(mvm)) {
+                        struct ieee80211_sta *sta;
+                        int i;
+
+                        mutex_lock(&mvm->mutex);
+
+                        for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
+                                sta = rcu_dereference_protected(
+                                                mvm->fw_id_to_mac_id[i],
+                                                lockdep_is_held(&mvm->mutex));
+                                if (IS_ERR_OR_NULL(sta))
+                                        continue;
+
+                                iwl_mvm_wait_sta_queues_empty(mvm,
+                                                iwl_mvm_sta_from_mac80211(sta));
+                        }
+
+                        mutex_unlock(&mvm->mutex);
+                } else {
+                        iwl_trans_wait_tx_queues_empty(mvm->trans,
+                                                       queues);
+                }
+        }
+}
+
 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, u32 queues, bool drop)
 {
@@ -3985,7 +4043,12 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
         int i;
         u32 msk = 0;
 
-        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+        if (!vif) {
+                iwl_mvm_flush_no_vif(mvm, queues, drop);
+                return;
+        }
+
+        if (vif->type != NL80211_IFTYPE_STATION)
                 return;
 
         /* Make sure we're done with the deferred traffic before flushing */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 83303bac0e4b..949e63418299 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1015,6 +1015,9 @@ struct iwl_mvm {
         bool drop_bcn_ap_mode;
 
         struct delayed_work cs_tx_unblock_dwork;
+
+        /* does a monitor vif exist (only one can exist hence bool) */
+        bool monitor_on;
 #ifdef CONFIG_ACPI
         struct iwl_mvm_sar_profile sar_profiles[IWL_MVM_SAR_PROFILE_NUM];
         struct iwl_mvm_geo_profile geo_profiles[IWL_NUM_GEO_PROFILES];
@@ -1159,7 +1162,7 @@ static inline bool iwl_mvm_is_lar_supported(struct iwl_mvm *mvm)
          * Enable LAR only if it is supported by the FW (TLV) &&
          * enabled in the NVM
          */
-        if (mvm->cfg->ext_nvm)
+        if (mvm->cfg->nvm_type == IWL_NVM_EXT)
                 return nvm_lar && tlv_lar;
         else
                 return tlv_lar;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
index 422aa6be9932..fb25b6f29323 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
@@ -295,18 +295,24 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
         const __be16 *hw;
         const __le16 *sw, *calib, *regulatory, *mac_override, *phy_sku;
         bool lar_enabled;
+        int regulatory_type;
 
         /* Checking for required sections */
-        if (!mvm->trans->cfg->ext_nvm) {
+        if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
                 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
                     !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {
                         IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n");
                         return NULL;
                 }
         } else {
+                if (mvm->trans->cfg->nvm_type == IWL_NVM_SDP)
+                        regulatory_type = NVM_SECTION_TYPE_REGULATORY_SDP;
+                else
+                        regulatory_type = NVM_SECTION_TYPE_REGULATORY;
+
                 /* SW and REGULATORY sections are mandatory */
                 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
-                    !mvm->nvm_sections[NVM_SECTION_TYPE_REGULATORY].data) {
+                    !mvm->nvm_sections[regulatory_type].data) {
                         IWL_ERR(mvm,
                                 "Can't parse empty family 8000 OTP/NVM sections\n");
                         return NULL;
@@ -330,11 +336,14 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
         hw = (const __be16 *)sections[mvm->cfg->nvm_hw_section_num].data;
         sw = (const __le16 *)sections[NVM_SECTION_TYPE_SW].data;
         calib = (const __le16 *)sections[NVM_SECTION_TYPE_CALIBRATION].data;
-        regulatory = (const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY].data;
         mac_override =
                 (const __le16 *)sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data;
         phy_sku = (const __le16 *)sections[NVM_SECTION_TYPE_PHY_SKU].data;
 
+        regulatory = mvm->trans->cfg->nvm_type == IWL_NVM_SDP ?
+                (const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY_SDP].data :
+                (const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY].data;
+
         lar_enabled = !iwlwifi_mod_params.lar_disable &&
                       fw_has_capa(&mvm->fw->ucode_capa,
                                   IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
@@ -394,7 +403,7 @@ int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
         IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from external NVM\n");
 
         /* Maximal size depends on NVM version */
-        if (!mvm->trans->cfg->ext_nvm)
+        if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT)
                 max_section_size = IWL_MAX_NVM_SECTION_SIZE;
         else
                 max_section_size = IWL_MAX_EXT_NVM_SECTION_SIZE;
@@ -465,7 +474,7 @@ int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                         break;
                 }
 
-                if (!mvm->trans->cfg->ext_nvm) {
+                if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
                         section_size =
                                 2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
                         section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
@@ -740,7 +749,7 @@ int iwl_mvm_init_mcc(struct iwl_mvm *mvm)
         struct ieee80211_regdomain *regd;
         char mcc[3];
 
-        if (mvm->cfg->ext_nvm) {
+        if (mvm->cfg->nvm_type == IWL_NVM_EXT) {
                 tlv_lar = fw_has_capa(&mvm->fw->ucode_capa,
                                       IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
                 nvm_lar = mvm->nvm_data->lar_enabled;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index ba7bd049d3d4..0fe723ca844e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -661,7 +661,8 @@ static void rs_tl_turn_on_agg(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
             (lq_sta->tx_agg_tid_en & BIT(tid)) &&
             (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
                 IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
-                rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta);
+                if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
+                        tid_data->state = IWL_AGG_QUEUED;
         }
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 184c749766f2..2d14a58cbdd7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -244,7 +244,9 @@ static u32 iwl_mvm_set_mac80211_rx_flag(struct iwl_mvm *mvm,
                 return 0;
 
         default:
-                IWL_ERR(mvm, "Unhandled alg: 0x%x\n", rx_pkt_status);
+                /* Expected in monitor (not having the keys) */
+                if (!mvm->monitor_on)
+                        IWL_ERR(mvm, "Unhandled alg: 0x%x\n", rx_pkt_status);
         }
 
         return 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 67ffd9774712..248699c2c4bf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -277,7 +277,9 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                 stats->flag |= RX_FLAG_DECRYPTED;
                 return 0;
         default:
-                IWL_ERR(mvm, "Unhandled alg: 0x%x\n", status);
+                /* Expected in monitor (not having the keys) */
+                if (!mvm->monitor_on)
+                        IWL_ERR(mvm, "Unhandled alg: 0x%x\n", status);
         }
 
         return 0;
@@ -672,11 +674,12 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * If there was a significant jump in the nssn - adjust.
          * If the SN is smaller than the NSSN it might need to first go into
          * the reorder buffer, in which case we just release up to it and the
-         * rest of the function will take of storing it and releasing up to the
-         * nssn
+         * rest of the function will take care of storing it and releasing up to
+         * the nssn
          */
         if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
-                                buffer->buf_size)) {
+                                buffer->buf_size) ||
+            !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
                 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
 
                 iwl_mvm_release_frames(mvm, sta, napi, buffer, min_sn);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 50983615dce6..774122fed454 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -555,7 +555,7 @@ static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_ABORT_CMD,
         };
-        u32 status;
+        u32 status = CAN_ABORT_STATUS;
 
         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
         if (ret)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 411a2055dc45..c4a343534c5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1285,7 +1285,7 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_add_sta_cmd cmd;
         int ret;
-        u32 status;
+        u32 status = ADD_STA_SUCCESS;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -2385,8 +2385,10 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
                 return -EINVAL;
 
-        if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
-                IWL_ERR(mvm, "Start AGG when state is not IWL_AGG_OFF %d!\n",
+        if (mvmsta->tid_data[tid].state != IWL_AGG_QUEUED &&
+            mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
+                IWL_ERR(mvm,
+                        "Start AGG when state is not IWL_AGG_QUEUED or IWL_AGG_OFF %d!\n",
                         mvmsta->tid_data[tid].state);
                 return -ENXIO;
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index d13893806513..aedabe101cf0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -281,6 +281,7 @@ struct iwl_mvm_vif;
  * These states relate to a specific RA / TID.
  *
  * @IWL_AGG_OFF: aggregation is not used
+ * @IWL_AGG_QUEUED: aggregation start work has been queued
  * @IWL_AGG_STARTING: aggregation are starting (between start and oper)
  * @IWL_AGG_ON: aggregation session is up
  * @IWL_EMPTYING_HW_QUEUE_ADDBA: establishing a BA session - waiting for the
@@ -290,6 +291,7 @@ struct iwl_mvm_vif;
  */
 enum iwl_mvm_agg_state {
         IWL_AGG_OFF = 0,
+        IWL_AGG_QUEUED,
         IWL_AGG_STARTING,
         IWL_AGG_ON,
         IWL_EMPTYING_HW_QUEUE_ADDBA,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 8876c2abc440..1232f63278eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -529,6 +529,7 @@ int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 state)
 
         lockdep_assert_held(&mvm->mutex);
 
+        status = 0;
         ret = iwl_mvm_send_cmd_pdu_status(mvm, WIDE_ID(PHY_OPS_GROUP,
                                                        CTDP_CONFIG_CMD),
                                           sizeof(cmd), &cmd, &status);
@@ -630,7 +631,7 @@ static int iwl_mvm_tzone_get_temp(struct thermal_zone_device *device,
 
         if (!iwl_mvm_firmware_running(mvm) ||
             mvm->fwrt.cur_fw_img != IWL_UCODE_REGULAR) {
-                ret = -EIO;
+                ret = -ENODATA;
                 goto out;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 172b5e63d3fb..6f2e2af23219 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -564,8 +564,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 /*
-                 * Handle legacy hostapd as well, where station will be added
-                 * only just before sending the association response.
+                 * Non-bufferable frames use the broadcast station, thus they
+                 * use the probe queue.
                  * Also take care of the case where we send a deauth to a
                  * station that we don't have, or similarly an association
                  * response (with non-success status) for a station we can't
@@ -573,9 +573,9 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                  * Also, disassociate frames might happen, particular with
                  * reason 7 ("Class 3 frame received from nonassociated STA").
                  */
-                if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) ||
-                    ieee80211_is_deauth(fc) || ieee80211_is_assoc_resp(fc) ||
-                    ieee80211_is_disassoc(fc))
+                if (ieee80211_is_mgmt(fc) &&
+                    (!ieee80211_is_bufferable_mmpdu(fc) ||
+                     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
                         return mvm->probe_queue;
                 if (info->hw_queue == info->control.vif->cab_queue)
                         return mvmvif->cab_queue;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 856fa6e8327e..a450bc6bc774 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -115,6 +115,8 @@ int qtnf_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         vif = qtnf_netdev_get_priv(wdev->netdev);
 
+        qtnf_scan_done(vif->mac, true);
+
         if (qtnf_cmd_send_del_intf(vif))
                 pr_err("VIF%u.%u: failed to delete VIF\n", vif->mac->macid,
                        vif->vifid);
@@ -335,6 +337,8 @@ static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct qtnf_vif *vif = qtnf_netdev_get_priv(dev);
         int ret;
 
+        qtnf_scan_done(vif->mac, true);
+
         ret = qtnf_cmd_send_stop_ap(vif);
         if (ret) {
                 pr_err("VIF%u.%u: failed to stop AP operation in FW\n",
@@ -570,8 +574,6 @@ qtnf_del_station(struct wiphy *wiphy, struct net_device *dev,
             !qtnf_sta_list_lookup(&vif->sta_list, params->mac))
                 return 0;
 
-        qtnf_scan_done(vif->mac, true);
-
         ret = qtnf_cmd_send_del_sta(vif, params);
         if (ret)
                 pr_err("VIF%u.%u: failed to delete STA %pM\n",
@@ -1134,8 +1136,9 @@ void qtnf_virtual_intf_cleanup(struct net_device *ndev)
                 }
 
                 vif->sta_state = QTNF_STA_DISCONNECTED;
-                qtnf_scan_done(mac, true);
         }
+
+        qtnf_scan_done(mac, true);
 }
 
 void qtnf_cfg80211_vif_reset(struct qtnf_vif *vif)
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
index 6a4af52522b8..66db26613b1f 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
@@ -34,6 +34,9 @@ static inline void qtnf_scan_done(struct qtnf_wmac *mac, bool aborted)
                 .aborted = aborted,
         };
 
+        if (timer_pending(&mac->scan_timeout))
+                del_timer_sync(&mac->scan_timeout);
+
         mutex_lock(&mac->mac_lock);
 
         if (mac->scan_req) {
diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
index 0fc2814eafad..43d2e7fd6e02 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -345,8 +345,6 @@ qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,
                 return -EINVAL;
         }
 
-        if (timer_pending(&mac->scan_timeout))
-                del_timer_sync(&mac->scan_timeout);
         qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);
 
         return 0;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
index 502e72b7cdcc..69131965a298 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
@@ -661,14 +661,18 @@ static int qtnf_pcie_data_tx(struct qtnf_bus *bus, struct sk_buff *skb)
         struct qtnf_pcie_bus_priv *priv = (void *)get_bus_priv(bus);
         dma_addr_t txbd_paddr, skb_paddr;
         struct qtnf_tx_bd *txbd;
+        unsigned long flags;
         int len, i;
         u32 info;
         int ret = 0;
 
+        spin_lock_irqsave(&priv->tx0_lock, flags);
+
         if (!qtnf_tx_queue_ready(priv)) {
                 if (skb->dev)
                         netif_stop_queue(skb->dev);
 
+                spin_unlock_irqrestore(&priv->tx0_lock, flags);
                 return NETDEV_TX_BUSY;
         }
 
@@ -717,8 +721,10 @@ tx_done:
                 dev_kfree_skb_any(skb);
         }
 
-        qtnf_pcie_data_tx_reclaim(priv);
         priv->tx_done_count++;
+        spin_unlock_irqrestore(&priv->tx0_lock, flags);
+
+        qtnf_pcie_data_tx_reclaim(priv);
 
         return NETDEV_TX_OK;
 }
@@ -1247,6 +1253,7 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         strcpy(bus->fwname, QTN_PCI_PEARL_FW_NAME);
         init_completion(&bus->request_firmware_complete);
         mutex_init(&bus->bus_lock);
+        spin_lock_init(&pcie_priv->tx0_lock);
         spin_lock_init(&pcie_priv->irq_lock);
         spin_lock_init(&pcie_priv->tx_reclaim_lock);
 
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
index e76a23716ee0..86ac1ccedb52 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
@@ -34,6 +34,8 @@ struct qtnf_pcie_bus_priv {
 
         /* lock for tx reclaim operations */
         spinlock_t tx_reclaim_lock;
+        /* lock for tx0 operations */
+        spinlock_t tx0_lock;
         u8 msi_enabled;
         int mps;
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index 4f73012978e9..1d431d4bf6d2 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -1122,7 +1122,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr)
         }
         if (0 == tmp) {
                 read_addr = REG_DBI_RDATA + addr % 4;
-                ret = rtl_read_byte(rtlpriv, read_addr);
+                ret = rtl_read_word(rtlpriv, read_addr);
         }
         return ret;
 }
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index ee8ed9da00ad..4491ca5aee90 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -486,7 +486,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
 
         dev->tx_queue_len = XENVIF_QUEUE_LENGTH;
 
-        dev->min_mtu = 0;
+        dev->min_mtu = ETH_MIN_MTU;
         dev->max_mtu = ETH_MAX_MTU - VLAN_ETH_HLEN;
 
         /*
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 523387e71a80..8b8689c6d887 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1316,7 +1316,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
         netdev->features |= netdev->hw_features;
 
         netdev->ethtool_ops = &xennet_ethtool_ops;
-        netdev->min_mtu = 0;
+        netdev->min_mtu = ETH_MIN_MTU;
         netdev->max_mtu = XEN_NETIF_MAX_TX_SIZE;
         SET_NETDEV_DEV(netdev, &dev->dev);
 
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index acc816b67582..37f9039bb9ca 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -134,8 +134,6 @@ static inline bool nvme_req_needs_retry(struct request *req)
                 return false;
         if (nvme_req(req)->status & NVME_SC_DNR)
                 return false;
-        if (jiffies - req->start_time >= req->timeout)
-                return false;
         if (nvme_req(req)->retries >= nvme_max_retries)
                 return false;
         return true;
@@ -1251,6 +1249,7 @@ static int nvme_revalidate_disk(struct gendisk *disk)
                 goto out;
         }
 
+        __nvme_revalidate_disk(disk, id);
         nvme_report_ns_ids(ctrl, ns->ns_id, id, eui64, nguid, &uuid);
         if (!uuid_equal(&ns->uuid, &uuid) ||
             memcmp(&ns->nguid, &nguid, sizeof(ns->nguid)) ||
@@ -2138,7 +2137,7 @@ static umode_t nvme_ns_attrs_are_visible(struct kobject *kobj,
         struct nvme_ns *ns = nvme_get_ns_from_dev(dev);
 
         if (a == &dev_attr_uuid.attr) {
-                if (uuid_is_null(&ns->uuid) ||
+                if (uuid_is_null(&ns->uuid) &&
                     !memchr_inv(ns->nguid, 0, sizeof(ns->nguid)))
                         return 0;
         }
@@ -2590,7 +2589,7 @@ static void nvme_async_event_work(struct work_struct *work)
                 container_of(work, struct nvme_ctrl, async_event_work);
 
         spin_lock_irq(&ctrl->lock);
-        while (ctrl->event_limit > 0) {
+        while (ctrl->state == NVME_CTRL_LIVE && ctrl->event_limit > 0) {
                 int aer_idx = --ctrl->event_limit;
 
                 spin_unlock_irq(&ctrl->lock);
@@ -2677,7 +2676,8 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 /*FALLTHRU*/
         case NVME_SC_ABORT_REQ:
                 ++ctrl->event_limit;
-                queue_work(nvme_wq, &ctrl->async_event_work);
+                if (ctrl->state == NVME_CTRL_LIVE)
+                        queue_work(nvme_wq, &ctrl->async_event_work);
                 break;
         default:
                 break;
@@ -2692,7 +2692,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 nvme_queue_scan(ctrl);
                 break;
         case NVME_AER_NOTICE_FW_ACT_STARTING:
-                schedule_work(&ctrl->fw_act_work);
+                queue_work(nvme_wq, &ctrl->fw_act_work);
                 break;
         default:
                 dev_warn(ctrl->device, "async event result %08x\n", result);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 47307752dc65..555c976cc2ee 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -565,6 +565,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         opts->queue_size = NVMF_DEF_QUEUE_SIZE;
         opts->nr_io_queues = num_online_cpus();
         opts->reconnect_delay = NVMF_DEF_RECONNECT_DELAY;
+        opts->kato = NVME_DEFAULT_KATO;
 
         options = o = kstrdup(buf, GFP_KERNEL);
         if (!options)
@@ -655,21 +656,22 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                 goto out;
                         }
 
-                        if (opts->discovery_nqn) {
-                                pr_err("Discovery controllers cannot accept keep_alive_tmo != 0\n");
-                                ret = -EINVAL;
-                                goto out;
-                        }
-
                         if (token < 0) {
                                 pr_err("Invalid keep_alive_tmo %d\n", token);
                                 ret = -EINVAL;
                                 goto out;
-                        } else if (token == 0) {
+                        } else if (token == 0 && !opts->discovery_nqn) {
                                 /* Allowed for debug */
                                 pr_warn("keep_alive_tmo 0 won't execute keep alives!!!\n");
                         }
                         opts->kato = token;
+
+                        if (opts->discovery_nqn && opts->kato) {
+                                pr_err("Discovery controllers cannot accept KATO != 0\n");
+                                ret = -EINVAL;
+                                goto out;
+                        }
+
                         break;
                 case NVMF_OPT_CTRL_LOSS_TMO:
                         if (match_int(args, &token)) {
@@ -762,8 +764,6 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         uuid_copy(&opts->host->id, &hostid);
 
 out:
-        if (!opts->discovery_nqn && !opts->kato)
-                opts->kato = NVME_DEFAULT_KATO;
         kfree(options);
         return ret;
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index d2e882c0f496..be49d0f79381 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1376,7 +1376,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         if (atomic_read(&op->state) == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16((NVME_SC_ABORT_REQ | NVME_SC_DNR) << 1);
         else if (freq->status)
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
 
         /*
          * For the linux implementation, if we have an unsuccesful
@@ -1404,7 +1404,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                  */
                 if (freq->transferred_length !=
                         be32_to_cpu(op->cmd_iu.data_len)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result.u64 = 0;
@@ -1421,7 +1421,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                                         freq->transferred_length ||
                              op->rsp_iu.status_code ||
                              sqe->common.command_id != cqe->command_id)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result = cqe->result;
@@ -1429,7 +1429,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 break;
 
         default:
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                 goto done;
         }
 
@@ -1989,16 +1989,17 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
          * as well as those by FC-NVME spec.
          */
         WARN_ON_ONCE(sqe->common.metadata);
-        WARN_ON_ONCE(sqe->common.dptr.prp1);
-        WARN_ON_ONCE(sqe->common.dptr.prp2);
         sqe->common.flags |= NVME_CMD_SGL_METABUF;
 
         /*
-         * format SQE DPTR field per FC-NVME rules
-         *    type=data block descr; subtype=offset;
-         *    offset is currently 0.
+         * format SQE DPTR field per FC-NVME rules:
+         *    type=0x5     Transport SGL Data Block Descriptor
+         *    subtype=0xA  Transport-specific value
+         *    address=0
+         *    length=length of the data series
          */
-        sqe->rw.dptr.sgl.type = NVME_SGL_FMT_OFFSET;
+        sqe->rw.dptr.sgl.type = (NVME_TRANSPORT_SGL_DATA_DESC << 4) |
+                                        NVME_SGL_FMT_TRANSPORT_A;
         sqe->rw.dptr.sgl.length = cpu_to_le32(data_len);
         sqe->rw.dptr.sgl.addr = 0;
 
@@ -2544,10 +2545,10 @@ nvme_fc_delete_association(struct nvme_fc_ctrl *ctrl)
         nvme_fc_abort_aen_ops(ctrl);
 
         /* wait for all io that had to be aborted */
-        spin_lock_irqsave(&ctrl->lock, flags);
+        spin_lock_irq(&ctrl->lock);
         wait_event_lock_irq(ctrl->ioabort_wait, ctrl->iocnt == 0, ctrl->lock);
         ctrl->flags &= ~FCCTRL_TERMIO;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
+        spin_unlock_irq(&ctrl->lock);
 
         nvme_fc_term_aen_ops(ctrl);
 
@@ -2733,7 +2734,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 {
         struct nvme_fc_ctrl *ctrl;
         unsigned long flags;
-        int ret, idx;
+        int ret, idx, retry;
 
         if (!(rport->remoteport.port_role &
             (FC_PORT_ROLE_NVME_DISCOVERY | FC_PORT_ROLE_NVME_TARGET))) {
@@ -2759,6 +2760,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         ctrl->rport = rport;
         ctrl->dev = lport->dev;
         ctrl->cnum = idx;
+        init_waitqueue_head(&ctrl->ioabort_wait);
 
         get_device(ctrl->dev);
         kref_init(&ctrl->ref);
@@ -2824,9 +2826,37 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         list_add_tail(&ctrl->ctrl_list, &rport->ctrl_list);
         spin_unlock_irqrestore(&rport->lock, flags);
 
-        ret = nvme_fc_create_association(ctrl);
+        /*
+         * It's possible that transactions used to create the association
+         * may fail. Examples: CreateAssociation LS or CreateIOConnection
+         * LS gets dropped/corrupted/fails; or a frame gets dropped or a
+         * command times out for one of the actions to init the controller
+         * (Connect, Get/Set_Property, Set_Features, etc). Many of these
+         * transport errors (frame drop, LS failure) inherently must kill
+         * the association. The transport is coded so that any command used
+         * to create the association (prior to a LIVE state transition
+         * while NEW or RECONNECTING) will fail if it completes in error or
+         * times out.
+         *
+         * As such: as the connect request was mostly likely due to a
+         * udev event that discovered the remote port, meaning there is
+         * not an admin or script there to restart if the connect
+         * request fails, retry the initial connection creation up to
+         * three times before giving up and declaring failure.
+         */
+        for (retry = 0; retry < 3; retry++) {
+                ret = nvme_fc_create_association(ctrl);
+                if (!ret)
+                        break;
+        }
+
         if (ret) {
+                /* couldn't schedule retry - fail out */
+                dev_err(ctrl->ctrl.device,
+                        "NVME-FC{%d}: Connect retry failed\n", ctrl->cnum);
+
                 ctrl->ctrl.opts = NULL;
+
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
                 nvme_put_ctrl(&ctrl->ctrl);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4a2121335f48..3f5a04c586ce 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -24,6 +24,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/once.h>
 #include <linux/pci.h>
 #include <linux/poison.h>
 #include <linux/t10-pi.h>
@@ -93,7 +94,7 @@ struct nvme_dev {
         struct mutex shutdown_lock;
         bool subsystem;
         void __iomem *cmb;
-        dma_addr_t cmb_dma_addr;
+        pci_bus_addr_t cmb_bus_addr;
         u64 cmb_size;
         u32 cmbsz;
         u32 cmbloc;
@@ -540,6 +541,20 @@ static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
 }
 #endif
 
+static void nvme_print_sgl(struct scatterlist *sgl, int nents)
+{
+        int i;
+        struct scatterlist *sg;
+
+        for_each_sg(sgl, sg, nents, i) {
+                dma_addr_t phys = sg_phys(sg);
+                pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
+                        "dma_address:%pad dma_length:%d\n",
+                        i, &phys, sg->offset, sg->length, &sg_dma_address(sg),
+                        sg_dma_len(sg));
+        }
+}
+
 static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
 {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
@@ -622,19 +637,10 @@ static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
         return BLK_STS_OK;
 
  bad_sgl:
-        if (WARN_ONCE(1, "Invalid SGL for payload:%d nents:%d\n",
-                                blk_rq_payload_bytes(req), iod->nents)) {
-                for_each_sg(iod->sg, sg, iod->nents, i) {
-                        dma_addr_t phys = sg_phys(sg);
-                        pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
-                               "dma_address:%pad dma_length:%d\n", i, &phys,
-                                        sg->offset, sg->length,
-                                        &sg_dma_address(sg),
-                                        sg_dma_len(sg));
-                }
-        }
+        WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
+                        "Invalid SGL for payload:%d nents:%d\n",
+                        blk_rq_payload_bytes(req), iod->nents);
         return BLK_STS_IOERR;
-
 }
 
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
@@ -1220,7 +1226,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
         if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
                 unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
                                                       dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset;
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
                 nvmeq->sq_cmds_io = dev->cmb + offset;
         } else {
                 nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
@@ -1313,11 +1319,11 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         if (result < 0)
                 goto release_cq;
 
+        nvme_init_queue(nvmeq, qid);
         result = queue_request_irq(nvmeq);
         if (result < 0)
                 goto release_sq;
 
-        nvme_init_queue(nvmeq, qid);
         return result;
 
  release_sq:
@@ -1464,6 +1470,7 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)
                 return result;
 
         nvmeq->cq_vector = 0;
+        nvme_init_queue(nvmeq, 0);
         result = queue_request_irq(nvmeq);
         if (result) {
                 nvmeq->cq_vector = -1;
@@ -1520,7 +1527,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         resource_size_t bar_size;
         struct pci_dev *pdev = to_pci_dev(dev->dev);
         void __iomem *cmb;
-        dma_addr_t dma_addr;
+        int bar;
 
         dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
         if (!(NVME_CMB_SZ(dev->cmbsz)))
@@ -1533,7 +1540,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz));
         size = szu * NVME_CMB_SZ(dev->cmbsz);
         offset = szu * NVME_CMB_OFST(dev->cmbloc);
-        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc));
+        bar = NVME_CMB_BIR(dev->cmbloc);
+        bar_size = pci_resource_len(pdev, bar);
 
         if (offset > bar_size)
                 return NULL;
@@ -1546,12 +1554,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         if (size > bar_size - offset)
                 size = bar_size - offset;
 
-        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset;
-        cmb = ioremap_wc(dma_addr, size);
+        cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size);
         if (!cmb)
                 return NULL;
 
-        dev->cmb_dma_addr = dma_addr;
+        dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset;
         dev->cmb_size = size;
         return cmb;
 }
@@ -2156,7 +2163,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (result)
                 goto out;
 
-        nvme_init_queue(dev->queues[0], 0);
         result = nvme_alloc_admin_tags(dev);
         if (result)
                 goto out;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 58983000964b..0ebb539f3bd3 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -571,6 +571,12 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
         if (test_and_set_bit(NVME_RDMA_Q_DELETING, &queue->flags))
                 return;
 
+        if (nvme_rdma_queue_idx(queue) == 0) {
+                nvme_rdma_free_qe(queue->device->dev,
+                        &queue->ctrl->async_event_sqe,
+                        sizeof(struct nvme_command), DMA_TO_DEVICE);
+        }
+
         nvme_rdma_destroy_queue_ib(queue);
         rdma_destroy_id(queue->cm_id);
 }
@@ -739,8 +745,6 @@ out:
 static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
                 bool remove)
 {
-        nvme_rdma_free_qe(ctrl->queues[0].device->dev, &ctrl->async_event_sqe,
-                        sizeof(struct nvme_command), DMA_TO_DEVICE);
         nvme_rdma_stop_queue(&ctrl->queues[0]);
         if (remove) {
                 blk_cleanup_queue(ctrl->ctrl.admin_q);
@@ -765,8 +769,10 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
 
         if (new) {
                 ctrl->ctrl.admin_tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, true);
-                if (IS_ERR(ctrl->ctrl.admin_tagset))
+                if (IS_ERR(ctrl->ctrl.admin_tagset)) {
+                        error = PTR_ERR(ctrl->ctrl.admin_tagset);
                         goto out_free_queue;
+                }
 
                 ctrl->ctrl.admin_q = blk_mq_init_queue(&ctrl->admin_tag_set);
                 if (IS_ERR(ctrl->ctrl.admin_q)) {
@@ -846,8 +852,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
 
         if (new) {
                 ctrl->ctrl.tagset = nvme_rdma_alloc_tagset(&ctrl->ctrl, false);
-                if (IS_ERR(ctrl->ctrl.tagset))
+                if (IS_ERR(ctrl->ctrl.tagset)) {
+                        ret = PTR_ERR(ctrl->ctrl.tagset);
                         goto out_free_io_queues;
+                }
 
                 ctrl->ctrl.connect_q = blk_mq_init_queue(&ctrl->tag_set);
                 if (IS_ERR(ctrl->ctrl.connect_q)) {
@@ -942,7 +950,12 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
-        WARN_ON_ONCE(!changed);
+        if (!changed) {
+                /* state change failure is ok if we're in DELETING state */
+                WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
+                return;
+        }
+
         ctrl->ctrl.nr_reconnects = 0;
 
         nvme_start_ctrl(&ctrl->ctrl);
@@ -962,7 +975,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
 
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->ctrl.queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
@@ -1601,12 +1614,15 @@ nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue, struct request *rq)
                         /*
                          * reconnecting state means transport disruption, which
                          * can take a long time and even might fail permanently,
-                         * so we can't let incoming I/O be requeued forever.
-                         * fail it fast to allow upper layers a chance to
-                         * failover.
+                         * fail fast to give upper layers a chance to failover.
+                         * deleting state means that the ctrl will never accept
+                         * commands again, fail it permanently.
                          */
-                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING ||
+                            queue->ctrl->ctrl.state == NVME_CTRL_DELETING) {
+                                nvme_req(rq)->status = NVME_SC_ABORT_REQ;
                                 return BLK_STS_IOERR;
+                        }
                         return BLK_STS_RESOURCE; /* try again later */
                 }
         }
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 7c23eaf8e563..645ba7eee35d 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -387,13 +387,22 @@ struct nvmet_ns *nvmet_ns_alloc(struct nvmet_subsys *subsys, u32 nsid)
 
 static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
 {
+        u32 old_sqhd, new_sqhd;
+        u16 sqhd;
+
         if (status)
                 nvmet_set_status(req, status);
 
-        /* XXX: need to fill in something useful for sq_head */
-        req->rsp->sq_head = 0;
-        if (likely(req->sq)) /* may happen during early failure */
-                req->rsp->sq_id = cpu_to_le16(req->sq->qid);
+        if (req->sq->size) {
+                do {
+                        old_sqhd = req->sq->sqhd;
+                        new_sqhd = (old_sqhd + 1) % req->sq->size;
+                } while (cmpxchg(&req->sq->sqhd, old_sqhd, new_sqhd) !=
+                                        old_sqhd);
+        }
+        sqhd = req->sq->sqhd & 0x0000FFFF;
+        req->rsp->sq_head = cpu_to_le16(sqhd);
+        req->rsp->sq_id = cpu_to_le16(req->sq->qid);
         req->rsp->command_id = req->cmd->common.command_id;
 
         if (req->ns)
@@ -420,6 +429,7 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq,
 void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
                 u16 qid, u16 size)
 {
+        sq->sqhd = 0;
         sq->qid = qid;
         sq->size = size;
 
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 859a66725291..db3bf6b8bf9e 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -109,9 +109,14 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
                 pr_warn("queue already connected!\n");
                 return NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
         }
+        if (!sqsize) {
+                pr_warn("queue size zero!\n");
+                return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+        }
 
-        nvmet_cq_setup(ctrl, req->cq, qid, sqsize);
-        nvmet_sq_setup(ctrl, req->sq, qid, sqsize);
+        /* note: convert queue size from 0's-based value to 1's-based value */
+        nvmet_cq_setup(ctrl, req->cq, qid, sqsize + 1);
+        nvmet_sq_setup(ctrl, req->sq, qid, sqsize + 1);
         return 0;
 }
 
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 421e43bf1dd7..58e010bdda3e 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -148,7 +148,7 @@ struct nvmet_fc_tgt_assoc {
         u32                             a_id;
         struct nvmet_fc_tgtport         *tgtport;
         struct list_head                a_list;
-        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES];
+        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES + 1];
         struct kref                     ref;
 };
 
@@ -608,7 +608,7 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
         unsigned long flags;
         int ret;
 
-        if (qid >= NVMET_NR_QUEUES)
+        if (qid > NVMET_NR_QUEUES)
                 return NULL;
 
         queue = kzalloc((sizeof(*queue) +
@@ -783,6 +783,9 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
         u16 qid = nvmet_fc_getqueueid(connection_id);
         unsigned long flags;
 
+        if (qid > NVMET_NR_QUEUES)
+                return NULL;
+
         spin_lock_irqsave(&tgtport->lock, flags);
         list_for_each_entry(assoc, &tgtport->assoc_list, a_list) {
                 if (association_id == assoc->association_id) {
@@ -888,7 +891,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
         int i;
 
         spin_lock_irqsave(&tgtport->lock, flags);
-        for (i = NVMET_NR_QUEUES - 1; i >= 0; i--) {
+        for (i = NVMET_NR_QUEUES; i >= 0; i--) {
                 queue = assoc->queues[i];
                 if (queue) {
                         if (!nvmet_fc_tgt_q_get(queue))
@@ -1910,8 +1913,7 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                         spin_lock_irqsave(&fod->flock, flags);
                         fod->writedataactive = false;
                         spin_unlock_irqrestore(&fod->flock, flags);
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                 } else /* NVMET_FCOP_READDATA or NVMET_FCOP_READDATA_RSP */ {
                         fcpreq->fcp_error = ret;
                         fcpreq->transferred_length = 0;
@@ -1929,8 +1931,7 @@ __nvmet_fc_fod_op_abort(struct nvmet_fc_fcp_iod *fod, bool abort)
         /* if in the middle of an io and we need to tear down */
         if (abort) {
                 if (fcpreq->op == NVMET_FCOP_WRITEDATA) {
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return true;
                 }
 
@@ -1968,8 +1969,7 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
                         fod->abort = true;
                         spin_unlock(&fod->flock);
 
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return;
                 }
 
@@ -2533,13 +2533,17 @@ nvmet_fc_remove_port(struct nvmet_port *port)
 {
         struct nvmet_fc_tgtport *tgtport = port->priv;
         unsigned long flags;
+        bool matched = false;
 
         spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
         if (tgtport->port == port) {
-                nvmet_fc_tgtport_put(tgtport);
+                matched = true;
                 tgtport->port = NULL;
         }
         spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);
+
+        if (matched)
+                nvmet_fc_tgtport_put(tgtport);
 }
 
 static struct nvmet_fabrics_ops nvmet_fc_tgt_fcp_ops = {
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 1cb9847ec261..7b75d9de55ab 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -224,8 +224,6 @@ struct fcloop_nport {
         struct fcloop_lport *lport;
         struct list_head nport_list;
         struct kref ref;
-        struct completion rport_unreg_done;
-        struct completion tport_unreg_done;
         u64 node_name;
         u64 port_name;
         u32 port_role;
@@ -576,7 +574,7 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
         tfcp_req->aborted = true;
         spin_unlock(&tfcp_req->reqlock);
 
-        tfcp_req->status = NVME_SC_FC_TRANSPORT_ABORTED;
+        tfcp_req->status = NVME_SC_INTERNAL;
 
         /*
          * nothing more to do. If io wasn't active, the transport should
@@ -631,6 +629,32 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
 }
 
 static void
+fcloop_nport_free(struct kref *ref)
+{
+        struct fcloop_nport *nport =
+                container_of(ref, struct fcloop_nport, ref);
+        unsigned long flags;
+
+        spin_lock_irqsave(&fcloop_lock, flags);
+        list_del(&nport->nport_list);
+        spin_unlock_irqrestore(&fcloop_lock, flags);
+
+        kfree(nport);
+}
+
+static void
+fcloop_nport_put(struct fcloop_nport *nport)
+{
+        kref_put(&nport->ref, fcloop_nport_free);
+}
+
+static int
+fcloop_nport_get(struct fcloop_nport *nport)
+{
+        return kref_get_unless_zero(&nport->ref);
+}
+
+static void
 fcloop_localport_delete(struct nvme_fc_local_port *localport)
 {
         struct fcloop_lport *lport = localport->private;
@@ -644,8 +668,7 @@ fcloop_remoteport_delete(struct nvme_fc_remote_port *remoteport)
 {
         struct fcloop_rport *rport = remoteport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&rport->nport->rport_unreg_done);
+        fcloop_nport_put(rport->nport);
 }
 
 static void
@@ -653,8 +676,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
 {
         struct fcloop_tport *tport = targetport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&tport->nport->tport_unreg_done);
+        fcloop_nport_put(tport->nport);
 }
 
 #define FCLOOP_HW_QUEUES                4
@@ -722,6 +744,7 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr,
                 goto out_free_opts;
         }
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = opts->wwnn;
         pinfo.port_name = opts->wwpn;
         pinfo.port_role = opts->roles;
@@ -804,32 +827,6 @@ fcloop_delete_local_port(struct device *dev, struct device_attribute *attr,
         return ret ? ret : count;
 }
 
-static void
-fcloop_nport_free(struct kref *ref)
-{
-        struct fcloop_nport *nport =
-                container_of(ref, struct fcloop_nport, ref);
-        unsigned long flags;
-
-        spin_lock_irqsave(&fcloop_lock, flags);
-        list_del(&nport->nport_list);
-        spin_unlock_irqrestore(&fcloop_lock, flags);
-
-        kfree(nport);
-}
-
-static void
-fcloop_nport_put(struct fcloop_nport *nport)
-{
-        kref_put(&nport->ref, fcloop_nport_free);
-}
-
-static int
-fcloop_nport_get(struct fcloop_nport *nport)
-{
-        return kref_get_unless_zero(&nport->ref);
-}
-
 static struct fcloop_nport *
 fcloop_alloc_nport(const char *buf, size_t count, bool remoteport)
 {
@@ -938,6 +935,7 @@ fcloop_create_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -EIO;
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = nport->node_name;
         pinfo.port_name = nport->port_name;
         pinfo.port_role = nport->port_role;
@@ -979,24 +977,12 @@ __unlink_remote_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
+__remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
 {
-        int ret;
-
         if (!rport)
                 return -EALREADY;
 
-        init_completion(&nport->rport_unreg_done);
-
-        ret = nvme_fc_unregister_remoteport(rport->remoteport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->rport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvme_fc_unregister_remoteport(rport->remoteport);
 }
 
 static ssize_t
@@ -1029,7 +1015,7 @@ fcloop_delete_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_remoteport_unreg(nport, rport);
+        ret = __remoteport_unreg(nport, rport);
 
         return ret ? ret : count;
 }
@@ -1086,24 +1072,12 @@ __unlink_target_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
+__targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
 {
-        int ret;
-
         if (!tport)
                 return -EALREADY;
 
-        init_completion(&nport->tport_unreg_done);
-
-        ret = nvmet_fc_unregister_targetport(tport->targetport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->tport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvmet_fc_unregister_targetport(tport->targetport);
 }
 
 static ssize_t
@@ -1136,7 +1110,7 @@ fcloop_delete_target_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_targetport_unreg(nport, tport);
+        ret = __targetport_unreg(nport, tport);
 
         return ret ? ret : count;
 }
@@ -1223,11 +1197,11 @@ static void __exit fcloop_exit(void)
 
                 spin_unlock_irqrestore(&fcloop_lock, flags);
 
-                ret = __wait_targetport_unreg(nport, tport);
+                ret = __targetport_unreg(nport, tport);
                 if (ret)
                         pr_warn("%s: Failed deleting target port\n", __func__);
 
-                ret = __wait_remoteport_unreg(nport, rport);
+                ret = __remoteport_unreg(nport, rport);
                 if (ret)
                         pr_warn("%s: Failed deleting remote port\n", __func__);
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7d261ab894f4..87e429bfcd8a 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -74,6 +74,7 @@ struct nvmet_sq {
         struct percpu_ref       ref;
         u16                     qid;
         u16                     size;
+        u32                     sqhd;
         struct completion       free_done;
         struct completion       confirm_done;
 };
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index de54c7f5048a..d12e5de78e70 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -135,7 +135,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
 
         /* Stop the user from writing */
         if (pos >= nvmem->size)
-                return 0;
+                return -EFBIG;
 
         if (count < nvmem->word_size)
                 return -EINVAL;
@@ -789,6 +789,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
                 return ERR_PTR(-EINVAL);
 
         nvmem = __nvmem_device_get(nvmem_np, NULL, NULL);
+        of_node_put(nvmem_np);
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 260d33c0f26c..63897531cd75 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1781,8 +1781,12 @@ bool of_console_check(struct device_node *dn, char *name, int index)
 {
         if (!dn || dn != of_stdout || console_set_on_cmdline)
                 return false;
-        return !add_preferred_console(name, index,
-                                      kstrdup(of_stdout_options, GFP_KERNEL));
+
+        /*
+         * XXX: cast `options' to char pointer to suppress complication
+         * warnings: printk, UART and console drivers expect char pointer.
+         */
+        return !add_preferred_console(name, index, (char *)of_stdout_options);
 }
 EXPORT_SYMBOL_GPL(of_console_check);
 
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index d94dd8b77abd..98258583abb0 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -44,7 +44,7 @@ static int of_get_phy_id(struct device_node *device, u32 *phy_id)
         return -EINVAL;
 }
 
-static void of_mdiobus_register_phy(struct mii_bus *mdio,
+static int of_mdiobus_register_phy(struct mii_bus *mdio,
                                     struct device_node *child, u32 addr)
 {
         struct phy_device *phy;
@@ -60,9 +60,13 @@ static void of_mdiobus_register_phy(struct mii_bus *mdio,
         else
                 phy = get_phy_device(mdio, addr, is_c45);
         if (IS_ERR(phy))
-                return;
+                return PTR_ERR(phy);
 
-        rc = irq_of_parse_and_map(child, 0);
+        rc = of_irq_get(child, 0);
+        if (rc == -EPROBE_DEFER) {
+                phy_device_free(phy);
+                return rc;
+        }
         if (rc > 0) {
                 phy->irq = rc;
                 mdio->irq[addr] = rc;
@@ -84,22 +88,23 @@ static void of_mdiobus_register_phy(struct mii_bus *mdio,
         if (rc) {
                 phy_device_free(phy);
                 of_node_put(child);
-                return;
+                return rc;
         }
 
         dev_dbg(&mdio->dev, "registered phy %s at address %i\n",
                 child->name, addr);
+        return 0;
 }
 
-static void of_mdiobus_register_device(struct mii_bus *mdio,
-                                       struct device_node *child, u32 addr)
+static int of_mdiobus_register_device(struct mii_bus *mdio,
+                                      struct device_node *child, u32 addr)
 {
         struct mdio_device *mdiodev;
         int rc;
 
         mdiodev = mdio_device_create(mdio, addr);
         if (IS_ERR(mdiodev))
-                return;
+                return PTR_ERR(mdiodev);
 
         /* Associate the OF node with the device structure so it
          * can be looked up later.
@@ -112,11 +117,12 @@ static void of_mdiobus_register_device(struct mii_bus *mdio,
         if (rc) {
                 mdio_device_free(mdiodev);
                 of_node_put(child);
-                return;
+                return rc;
         }
 
         dev_dbg(&mdio->dev, "registered mdio device %s at address %i\n",
                 child->name, addr);
+        return 0;
 }
 
 /* The following is a list of PHY compatible strings which appear in
@@ -219,9 +225,11 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                 }
 
                 if (of_mdiobus_child_is_phy(child))
-                        of_mdiobus_register_phy(mdio, child, addr);
+                        rc = of_mdiobus_register_phy(mdio, child, addr);
                 else
-                        of_mdiobus_register_device(mdio, child, addr);
+                        rc = of_mdiobus_register_device(mdio, child, addr);
+                if (rc)
+                        goto unregister;
         }
 
         if (!scanphys)
@@ -242,12 +250,19 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                         dev_info(&mdio->dev, "scan phy %s at address %i\n",
                                  child->name, addr);
 
-                        if (of_mdiobus_child_is_phy(child))
-                                of_mdiobus_register_phy(mdio, child, addr);
+                        if (of_mdiobus_child_is_phy(child)) {
+                                rc = of_mdiobus_register_phy(mdio, child, addr);
+                                if (rc)
+                                        goto unregister;
+                        }
                 }
         }
 
         return 0;
+
+unregister:
+        mdiobus_unregister(mdio);
+        return rc;
 }
 EXPORT_SYMBOL(of_mdiobus_register);
 
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index d507c3569a88..32771c2ced7b 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -25,7 +25,7 @@
 #include <linux/sort.h>
 #include <linux/slab.h>
 
-#define MAX_RESERVED_REGIONS    16
+#define MAX_RESERVED_REGIONS    32
 static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
 static int reserved_mem_count;
 
diff --git a/drivers/of/property.c b/drivers/of/property.c
index fbb72116e9d4..264c355ba1ff 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -954,7 +954,7 @@ of_fwnode_graph_get_port_parent(struct fwnode_handle *fwnode)
         struct device_node *np;
 
         /* Get the parent of the port */
-        np = of_get_next_parent(to_of_node(fwnode));
+        np = of_get_parent(to_of_node(fwnode));
         if (!np)
                 return NULL;
 
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index 89f4e3d072d7..26ed0c08f209 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -935,6 +935,8 @@ static int advk_pcie_probe(struct platform_device *pdev)
         bridge->sysdata = pcie;
         bridge->busnr = 0;
         bridge->ops = &advk_pcie_ops;
+        bridge->map_irq = of_irq_parse_and_map_pci;
+        bridge->swizzle_irq = pci_common_swizzle;
 
         ret = pci_scan_root_bus_bridge(bridge);
         if (ret < 0) {
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 9c40da54f88a..1987fec1f126 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -233,6 +233,7 @@ struct tegra_msi {
         struct msi_controller chip;
         DECLARE_BITMAP(used, INT_PCI_MSI_NR);
         struct irq_domain *domain;
+        unsigned long pages;
         struct mutex lock;
         u64 phys;
         int irq;
@@ -1529,22 +1530,9 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)
                 goto err;
         }
 
-        /*
-         * The PCI host bridge on Tegra contains some logic that intercepts
-         * MSI writes, which means that the MSI target address doesn't have
-         * to point to actual physical memory. Rather than allocating one 4
-         * KiB page of system memory that's never used, we can simply pick
-         * an arbitrary address within an area reserved for system memory
-         * in the FPCI address map.
-         *
-         * However, in order to avoid confusion, we pick an address that
-         * doesn't map to physical memory. The FPCI address map reserves a
-         * 1012 GiB region for system memory and memory-mapped I/O. Since
-         * none of the Tegra SoCs that contain this PCI host bridge can
-         * address more than 16 GiB of system memory, the last 4 KiB of
-         * these 1012 GiB is a good candidate.
-         */
-        msi->phys = 0xfcfffff000;
+        /* setup AFI/FPCI range */
+        msi->pages = __get_free_pages(GFP_KERNEL, 0);
+        msi->phys = virt_to_phys((void *)msi->pages);
 
         afi_writel(pcie, msi->phys >> soc->msi_base_shift, AFI_MSI_FPCI_BAR_ST);
         afi_writel(pcie, msi->phys, AFI_MSI_AXI_BAR_ST);
@@ -1596,6 +1584,8 @@ static int tegra_pcie_disable_msi(struct tegra_pcie *pcie)
         afi_writel(pcie, 0, AFI_MSI_EN_VEC6);
         afi_writel(pcie, 0, AFI_MSI_EN_VEC7);
 
+        free_pages(msi->pages, 0);
+
         if (msi->irq > 0)
                 free_irq(msi->irq, pcie);
 
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 1eecfa301f7f..8e075ea2743e 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -686,7 +686,7 @@ static ssize_t driver_override_store(struct device *dev,
                                      const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
-        char *driver_override, *old = pdev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
         /* We need to keep extra room for a newline */
         if (count >= (PAGE_SIZE - 1))
@@ -700,12 +700,15 @@ static ssize_t driver_override_store(struct device *dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(dev);
+        old = pdev->driver_override;
         if (strlen(driver_override)) {
                 pdev->driver_override = driver_override;
         } else {
                 kfree(driver_override);
                 pdev->driver_override = NULL;
         }
+        device_unlock(dev);
 
         kfree(old);
 
@@ -716,8 +719,12 @@ static ssize_t driver_override_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
+        ssize_t len;
 
-        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_unlock(dev);
+        return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/phy/marvell/phy-mvebu-cp110-comphy.c b/drivers/phy/marvell/phy-mvebu-cp110-comphy.c
index 73ebad6634a7..89c887ea5557 100644
--- a/drivers/phy/marvell/phy-mvebu-cp110-comphy.c
+++ b/drivers/phy/marvell/phy-mvebu-cp110-comphy.c
@@ -111,6 +111,8 @@
 #define     MVEBU_COMPHY_CONF6_40B              BIT(18)
 #define MVEBU_COMPHY_SELECTOR                   0x1140
 #define     MVEBU_COMPHY_SELECTOR_PHY(n)        ((n) * 0x4)
+#define MVEBU_COMPHY_PIPE_SELECTOR              0x1144
+#define     MVEBU_COMPHY_PIPE_SELECTOR_PIPE(n)  ((n) * 0x4)
 
 #define MVEBU_COMPHY_LANES      6
 #define MVEBU_COMPHY_PORTS      3
@@ -468,13 +470,17 @@ static int mvebu_comphy_power_on(struct phy *phy)
 {
         struct mvebu_comphy_lane *lane = phy_get_drvdata(phy);
         struct mvebu_comphy_priv *priv = lane->priv;
-        int ret;
-        u32 mux, val;
+        int ret, mux;
+        u32 val;
 
         mux = mvebu_comphy_get_mux(lane->id, lane->port, lane->mode);
         if (mux < 0)
                 return -ENOTSUPP;
 
+        regmap_read(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, &val);
+        val &= ~(0xf << MVEBU_COMPHY_PIPE_SELECTOR_PIPE(lane->id));
+        regmap_write(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, val);
+
         regmap_read(priv->regmap, MVEBU_COMPHY_SELECTOR, &val);
         val &= ~(0xf << MVEBU_COMPHY_SELECTOR_PHY(lane->id));
         val |= mux << MVEBU_COMPHY_SELECTOR_PHY(lane->id);
@@ -526,6 +532,10 @@ static int mvebu_comphy_power_off(struct phy *phy)
         val &= ~(0xf << MVEBU_COMPHY_SELECTOR_PHY(lane->id));
         regmap_write(priv->regmap, MVEBU_COMPHY_SELECTOR, val);
 
+        regmap_read(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, &val);
+        val &= ~(0xf << MVEBU_COMPHY_PIPE_SELECTOR_PIPE(lane->id));
+        regmap_write(priv->regmap, MVEBU_COMPHY_PIPE_SELECTOR, val);
+
         return 0;
 }
 
@@ -576,8 +586,8 @@ static int mvebu_comphy_probe(struct platform_device *pdev)
                 return PTR_ERR(priv->regmap);
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         priv->base = devm_ioremap_resource(&pdev->dev, res);
-        if (!priv->base)
-                return -ENOMEM;
+        if (IS_ERR(priv->base))
+                return PTR_ERR(priv->base);
 
         for_each_available_child_of_node(pdev->dev.of_node, child) {
                 struct mvebu_comphy_lane *lane;
diff --git a/drivers/phy/mediatek/phy-mtk-tphy.c b/drivers/phy/mediatek/phy-mtk-tphy.c
index e3baad78521f..721a2a1c97ef 100644
--- a/drivers/phy/mediatek/phy-mtk-tphy.c
+++ b/drivers/phy/mediatek/phy-mtk-tphy.c
@@ -27,6 +27,7 @@
 /* banks shared by multiple phys */
 #define SSUSB_SIFSLV_V1_SPLLC           0x000   /* shared by u3 phys */
 #define SSUSB_SIFSLV_V1_U2FREQ          0x100   /* shared by u2 phys */
+#define SSUSB_SIFSLV_V1_CHIP            0x300   /* shared by u3 phys */
 /* u2 phy bank */
 #define SSUSB_SIFSLV_V1_U2PHY_COM       0x000
 /* u3/pcie/sata phy banks */
@@ -762,7 +763,7 @@ static void phy_v1_banks_init(struct mtk_tphy *tphy,
         case PHY_TYPE_USB3:
         case PHY_TYPE_PCIE:
                 u3_banks->spllc = tphy->sif_base + SSUSB_SIFSLV_V1_SPLLC;
-                u3_banks->chip = NULL;
+                u3_banks->chip = tphy->sif_base + SSUSB_SIFSLV_V1_CHIP;
                 u3_banks->phyd = instance->port_base + SSUSB_SIFSLV_V1_U3PHYD;
                 u3_banks->phya = instance->port_base + SSUSB_SIFSLV_V1_U3PHYA;
                 break;
diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
index 4d2c57f21d76..a958c9bced01 100644
--- a/drivers/phy/rockchip/phy-rockchip-typec.c
+++ b/drivers/phy/rockchip/phy-rockchip-typec.c
@@ -443,14 +443,34 @@ static inline int property_enable(struct rockchip_typec_phy *tcphy,
         return regmap_write(tcphy->grf_regs, reg->offset, val | mask);
 }
 
+static void tcphy_dp_aux_set_flip(struct rockchip_typec_phy *tcphy)
+{
+        u16 tx_ana_ctrl_reg_1;
+
+        /*
+         * Select the polarity of the xcvr:
+         * 1, Reverses the polarity (If TYPEC, Pulls ups aux_p and pull
+         * down aux_m)
+         * 0, Normal polarity (if TYPEC, pulls up aux_m and pulls down
+         * aux_p)
+         */
+        tx_ana_ctrl_reg_1 = readl(tcphy->base + TX_ANA_CTRL_REG_1);
+        if (!tcphy->flip)
+                tx_ana_ctrl_reg_1 |= BIT(12);
+        else
+                tx_ana_ctrl_reg_1 &= ~BIT(12);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
+}
+
 static void tcphy_dp_aux_calibration(struct rockchip_typec_phy *tcphy)
 {
+        u16 tx_ana_ctrl_reg_1;
         u16 rdata, rdata2, val;
 
         /* disable txda_cal_latch_en for rewrite the calibration values */
-        rdata = readl(tcphy->base + TX_ANA_CTRL_REG_1);
-        val = rdata & 0xdfff;
-        writel(val, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 = readl(tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 &= ~BIT(13);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
 
         /*
          * read a resistor calibration code from CMN_TXPUCAL_CTRL[6:0] and
@@ -472,9 +492,8 @@ static void tcphy_dp_aux_calibration(struct rockchip_typec_phy *tcphy)
          * Activate this signal for 1 clock cycle to sample new calibration
          * values.
          */
-        rdata = readl(tcphy->base + TX_ANA_CTRL_REG_1);
-        val = rdata | 0x2000;
-        writel(val, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |= BIT(13);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
         usleep_range(150, 200);
 
         /* set TX Voltage Level and TX Deemphasis to 0 */
@@ -482,8 +501,10 @@ static void tcphy_dp_aux_calibration(struct rockchip_typec_phy *tcphy)
         /* re-enable decap */
         writel(0x100, tcphy->base + TX_ANA_CTRL_REG_2);
         writel(0x300, tcphy->base + TX_ANA_CTRL_REG_2);
-        writel(0x2008, tcphy->base + TX_ANA_CTRL_REG_1);
-        writel(0x2018, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |= BIT(3);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |= BIT(4);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
 
         writel(0, tcphy->base + TX_ANA_CTRL_REG_5);
 
@@ -494,8 +515,10 @@ static void tcphy_dp_aux_calibration(struct rockchip_typec_phy *tcphy)
         writel(0x1001, tcphy->base + TX_ANA_CTRL_REG_4);
 
         /* re-enables Bandgap reference for LDO */
-        writel(0x2098, tcphy->base + TX_ANA_CTRL_REG_1);
-        writel(0x2198, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |= BIT(7);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |= BIT(8);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
 
         /*
          * re-enables the transmitter pre-driver, driver data selection MUX,
@@ -505,27 +528,26 @@ static void tcphy_dp_aux_calibration(struct rockchip_typec_phy *tcphy)
         writel(0x303, tcphy->base + TX_ANA_CTRL_REG_2);
 
         /*
-         * BIT 12: Controls auxda_polarity, which selects the polarity of the
-         * xcvr:
-         * 1, Reverses the polarity (If TYPEC, Pulls ups aux_p and pull
-         * down aux_m)
-         * 0, Normal polarity (if TYPE_C, pulls up aux_m and pulls down
-         * aux_p)
+         * Do some magic undocumented stuff, some of which appears to
+         * undo the "re-enables Bandgap reference for LDO" above.
          */
-        val = 0xa078;
-        if (!tcphy->flip)
-                val |= BIT(12);
-        writel(val, tcphy->base + TX_ANA_CTRL_REG_1);
+        tx_ana_ctrl_reg_1 |=  BIT(15);
+        tx_ana_ctrl_reg_1 &= ~BIT(8);
+        tx_ana_ctrl_reg_1 &= ~BIT(7);
+        tx_ana_ctrl_reg_1 |=  BIT(6);
+        tx_ana_ctrl_reg_1 |=  BIT(5);
+        writel(tx_ana_ctrl_reg_1, tcphy->base + TX_ANA_CTRL_REG_1);
 
         writel(0, tcphy->base + TX_ANA_CTRL_REG_3);
         writel(0, tcphy->base + TX_ANA_CTRL_REG_4);
         writel(0, tcphy->base + TX_ANA_CTRL_REG_5);
 
         /*
-         * Controls low_power_swing_en, set the voltage swing of the driver
-         * to 400mv. The values below are peak to peak (differential) values.
+         * Controls low_power_swing_en, don't set the voltage swing of the
+         * driver to 400mv. The values below are peak to peak (differential)
+         * values.
          */
-        writel(4, tcphy->base + TXDA_COEFF_CALC_CTRL);
+        writel(0, tcphy->base + TXDA_COEFF_CALC_CTRL);
         writel(0, tcphy->base + TXDA_CYA_AUXDA_CYA);
 
         /* Controls tx_high_z_tm_en */
@@ -555,6 +577,7 @@ static int tcphy_phy_init(struct rockchip_typec_phy *tcphy, u8 mode)
         reset_control_deassert(tcphy->tcphy_rst);
 
         property_enable(tcphy, &cfg->typec_conn_dir, tcphy->flip);
+        tcphy_dp_aux_set_flip(tcphy);
 
         tcphy_cfg_24m(tcphy);
 
@@ -685,8 +708,11 @@ static int rockchip_usb3_phy_power_on(struct phy *phy)
         if (tcphy->mode == new_mode)
                 goto unlock_ret;
 
-        if (tcphy->mode == MODE_DISCONNECT)
-                tcphy_phy_init(tcphy, new_mode);
+        if (tcphy->mode == MODE_DISCONNECT) {
+                ret = tcphy_phy_init(tcphy, new_mode);
+                if (ret)
+                        goto unlock_ret;
+        }
 
         /* wait TCPHY for pipe ready */
         for (timeout = 0; timeout < 100; timeout++) {
@@ -760,10 +786,12 @@ static int rockchip_dp_phy_power_on(struct phy *phy)
          */
         if (new_mode == MODE_DFP_DP && tcphy->mode != MODE_DISCONNECT) {
                 tcphy_phy_deinit(tcphy);
-                tcphy_phy_init(tcphy, new_mode);
+                ret = tcphy_phy_init(tcphy, new_mode);
         } else if (tcphy->mode == MODE_DISCONNECT) {
-                tcphy_phy_init(tcphy, new_mode);
+                ret = tcphy_phy_init(tcphy, new_mode);
         }
+        if (ret)
+                goto unlock_ret;
 
         ret = readx_poll_timeout(readl, tcphy->base + DP_MODE_CTL,
                                  val, val & DP_MODE_A2, 1000,
diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index 3cbcb2537657..4307bf0013e1 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -454,6 +454,8 @@ tegra_xusb_find_port_node(struct tegra_xusb_padctl *padctl, const char *type,
                 char *name;
 
                 name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
+                if (!name)
+                        return ERR_PTR(-ENOMEM);
                 np = of_find_node_by_name(np, name);
                 kfree(name);
         }
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index 1778cf4f81c7..82cd8b08d71f 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -100,6 +100,7 @@ config PINCTRL_AMD
         tristate "AMD GPIO pin control"
         depends on GPIOLIB
         select GPIOLIB_IRQCHIP
+        select PINMUX
         select PINCONF
         select GENERIC_PINCONF
         help
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 0944310225db..ff782445dfb7 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -373,16 +373,12 @@ static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc,
         unsigned long events;
         unsigned offset;
         unsigned gpio;
-        unsigned int type;
 
         events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
         events &= mask;
         events &= pc->enabled_irq_map[bank];
         for_each_set_bit(offset, &events, 32) {
                 gpio = (32 * bank) + offset;
-                /* FIXME: no clue why the code looks up the type here */
-                type = pc->irq_type[gpio];
-
                 generic_handle_irq(irq_linear_revmap(pc->gpio_chip.irqdomain,
                                                      gpio));
         }
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 04e929fd0ffe..fadbca907c7c 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1577,6 +1577,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         struct gpio_chip *chip = &pctrl->chip;
         bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
+        int irq_base;
 
         *chip = chv_gpio_chip;
 
@@ -1622,7 +1623,18 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
-        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+        if (!need_valid_mask) {
+                irq_base = devm_irq_alloc_descs(pctrl->dev, -1, 0,
+                                                chip->ngpio, NUMA_NO_NODE);
+                if (irq_base < 0) {
+                        dev_err(pctrl->dev, "Failed to allocate IRQ numbers\n");
+                        return irq_base;
+                }
+        } else {
+                irq_base = 0;
+        }
+
+        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, irq_base,
                                    handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 3f6b34febbf1..433af328d981 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -534,8 +534,16 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
                                 continue;
                         irq = irq_find_mapping(gc->irqdomain, irqnr + i);
                         generic_handle_irq(irq);
-                        /* Clear interrupt */
+
+                        /* Clear interrupt.
+                         * We must read the pin register again, in case the
+                         * value was changed while executing
+                         * generic_handle_irq() above.
+                         */
+                        raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+                        regval = readl(regs + i);
                         writel(regval, regs + i);
+                        raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
                         ret = IRQ_HANDLED;
                 }
         }
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index 3e40d4245512..9c950bbf07ba 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -407,10 +407,10 @@ static int mcp23s08_get(struct gpio_chip *chip, unsigned offset)
         ret = mcp_read(mcp, MCP_GPIO, &status);
         if (ret < 0)
                 status = 0;
-        else
+        else {
+                mcp->cached_gpio = status;
                 status = !!(status & (1 << offset));
-
-        mcp->cached_gpio = status;
+        }
 
         mutex_unlock(&mcp->lock);
         return status;
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 85de30f93a9c..56a8195096a2 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -254,10 +254,12 @@ static int bl_update_status(struct backlight_device *b)
 {
         struct acpi_device *device = bl_get_data(b);
 
-        if (b->props.power == FB_BLANK_POWERDOWN)
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
-        else
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        if (fext) {
+                if (b->props.power == FB_BLANK_POWERDOWN)
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
+                else
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        }
 
         return set_lcd_level(device, b->props.brightness);
 }
diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
index bb792a52248b..e03fa31446ca 100644
--- a/drivers/platform/x86/intel_pmc_ipc.c
+++ b/drivers/platform/x86/intel_pmc_ipc.c
@@ -33,6 +33,7 @@
 #include <linux/suspend.h>
 #include <linux/acpi.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
+#include <linux/spinlock.h>
 
 #include <asm/intel_pmc_ipc.h>
 
@@ -131,6 +132,7 @@ static struct intel_pmc_ipc_dev {
         /* gcr */
         void __iomem *gcr_mem_base;
         bool has_gcr_regs;
+        spinlock_t gcr_lock;
 
         /* punit */
         struct platform_device *punit_dev;
@@ -225,17 +227,17 @@ int intel_pmc_gcr_read(u32 offset, u32 *data)
 {
         int ret;
 
-        mutex_lock(&ipclock);
+        spin_lock(&ipcdev.gcr_lock);
 
         ret = is_gcr_valid(offset);
         if (ret < 0) {
-                mutex_unlock(&ipclock);
+                spin_unlock(&ipcdev.gcr_lock);
                 return ret;
         }
 
         *data = readl(ipcdev.gcr_mem_base + offset);
 
-        mutex_unlock(&ipclock);
+        spin_unlock(&ipcdev.gcr_lock);
 
         return 0;
 }
@@ -255,17 +257,17 @@ int intel_pmc_gcr_write(u32 offset, u32 data)
 {
         int ret;
 
-        mutex_lock(&ipclock);
+        spin_lock(&ipcdev.gcr_lock);
 
         ret = is_gcr_valid(offset);
         if (ret < 0) {
-                mutex_unlock(&ipclock);
+                spin_unlock(&ipcdev.gcr_lock);
                 return ret;
         }
 
         writel(data, ipcdev.gcr_mem_base + offset);
 
-        mutex_unlock(&ipclock);
+        spin_unlock(&ipcdev.gcr_lock);
 
         return 0;
 }
@@ -287,7 +289,7 @@ int intel_pmc_gcr_update(u32 offset, u32 mask, u32 val)
         u32 new_val;
         int ret = 0;
 
-        mutex_lock(&ipclock);
+        spin_lock(&ipcdev.gcr_lock);
 
         ret = is_gcr_valid(offset);
         if (ret < 0)
@@ -309,7 +311,7 @@ int intel_pmc_gcr_update(u32 offset, u32 mask, u32 val)
         }
 
 gcr_ipc_unlock:
-        mutex_unlock(&ipclock);
+        spin_unlock(&ipcdev.gcr_lock);
         return ret;
 }
 EXPORT_SYMBOL_GPL(intel_pmc_gcr_update);
@@ -480,52 +482,41 @@ static irqreturn_t ioc(int irq, void *dev_id)
 
 static int ipc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
-        resource_size_t pci_resource;
+        struct intel_pmc_ipc_dev *pmc = &ipcdev;
         int ret;
-        int len;
 
-        ipcdev.dev = &pci_dev_get(pdev)->dev;
-        ipcdev.irq_mode = IPC_TRIGGER_MODE_IRQ;
+        /* Only one PMC is supported */
+        if (pmc->dev)
+                return -EBUSY;
 
-        ret = pci_enable_device(pdev);
+        pmc->irq_mode = IPC_TRIGGER_MODE_IRQ;
+
+        spin_lock_init(&ipcdev.gcr_lock);
+
+        ret = pcim_enable_device(pdev);
         if (ret)
                 return ret;
 
-        ret = pci_request_regions(pdev, "intel_pmc_ipc");
+        ret = pcim_iomap_regions(pdev, 1 << 0, pci_name(pdev));
         if (ret)
                 return ret;
 
-        pci_resource = pci_resource_start(pdev, 0);
-        len = pci_resource_len(pdev, 0);
-        if (!pci_resource || !len) {
-                dev_err(&pdev->dev, "Failed to get resource\n");
-                return -ENOMEM;
-        }
+        init_completion(&pmc->cmd_complete);
 
-        init_completion(&ipcdev.cmd_complete);
+        pmc->ipc_base = pcim_iomap_table(pdev)[0];
 
-        if (request_irq(pdev->irq, ioc, 0, "intel_pmc_ipc", &ipcdev)) {
+        ret = devm_request_irq(&pdev->dev, pdev->irq, ioc, 0, "intel_pmc_ipc",
+                                pmc);
+        if (ret) {
                 dev_err(&pdev->dev, "Failed to request irq\n");
-                return -EBUSY;
+                return ret;
         }
 
-        ipcdev.ipc_base = ioremap_nocache(pci_resource, len);
-        if (!ipcdev.ipc_base) {
-                dev_err(&pdev->dev, "Failed to ioremap ipc base\n");
-                free_irq(pdev->irq, &ipcdev);
-                ret = -ENOMEM;
-        }
+        pmc->dev = &pdev->dev;
 
-        return ret;
-}
+        pci_set_drvdata(pdev, pmc);
 
-static void ipc_pci_remove(struct pci_dev *pdev)
-{
-        free_irq(pdev->irq, &ipcdev);
-        pci_release_regions(pdev);
-        pci_dev_put(pdev);
-        iounmap(ipcdev.ipc_base);
-        ipcdev.dev = NULL;
+        return 0;
 }
 
 static const struct pci_device_id ipc_pci_ids[] = {
@@ -540,7 +531,6 @@ static struct pci_driver ipc_pci_driver = {
         .name = "intel_pmc_ipc",
         .id_table = ipc_pci_ids,
         .probe = ipc_pci_probe,
-        .remove = ipc_pci_remove,
 };
 
 static ssize_t intel_pmc_ipc_simple_cmd_store(struct device *dev,
@@ -850,17 +840,12 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                 return -ENXIO;
         }
         size = PLAT_RESOURCE_IPC_SIZE + PLAT_RESOURCE_GCR_SIZE;
+        res->end = res->start + size - 1;
+
+        addr = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(addr))
+                return PTR_ERR(addr);
 
-        if (!request_mem_region(res->start, size, pdev->name)) {
-                dev_err(&pdev->dev, "Failed to request ipc resource\n");
-                return -EBUSY;
-        }
-        addr = ioremap_nocache(res->start, size);
-        if (!addr) {
-                dev_err(&pdev->dev, "I/O memory remapping failed\n");
-                release_mem_region(res->start, size);
-                return -ENOMEM;
-        }
         ipcdev.ipc_base = addr;
 
         ipcdev.gcr_mem_base = addr + PLAT_RESOURCE_GCR_OFFSET;
@@ -917,12 +902,12 @@ MODULE_DEVICE_TABLE(acpi, ipc_acpi_ids);
 
 static int ipc_plat_probe(struct platform_device *pdev)
 {
-        struct resource *res;
         int ret;
 
         ipcdev.dev = &pdev->dev;
         ipcdev.irq_mode = IPC_TRIGGER_MODE_IRQ;
         init_completion(&ipcdev.cmd_complete);
+        spin_lock_init(&ipcdev.gcr_lock);
 
         ipcdev.irq = platform_get_irq(pdev, 0);
         if (ipcdev.irq < 0) {
@@ -939,11 +924,11 @@ static int ipc_plat_probe(struct platform_device *pdev)
         ret = ipc_create_pmc_devices();
         if (ret) {
                 dev_err(&pdev->dev, "Failed to create pmc devices\n");
-                goto err_device;
+                return ret;
         }
 
-        if (request_irq(ipcdev.irq, ioc, IRQF_NO_SUSPEND,
-                        "intel_pmc_ipc", &ipcdev)) {
+        if (devm_request_irq(&pdev->dev, ipcdev.irq, ioc, IRQF_NO_SUSPEND,
+                             "intel_pmc_ipc", &ipcdev)) {
                 dev_err(&pdev->dev, "Failed to request irq\n");
                 ret = -EBUSY;
                 goto err_irq;
@@ -960,40 +945,22 @@ static int ipc_plat_probe(struct platform_device *pdev)
 
         return 0;
 err_sys:
-        free_irq(ipcdev.irq, &ipcdev);
+        devm_free_irq(&pdev->dev, ipcdev.irq, &ipcdev);
 err_irq:
         platform_device_unregister(ipcdev.tco_dev);
         platform_device_unregister(ipcdev.punit_dev);
         platform_device_unregister(ipcdev.telemetry_dev);
-err_device:
-        iounmap(ipcdev.ipc_base);
-        res = platform_get_resource(pdev, IORESOURCE_MEM,
-                                    PLAT_RESOURCE_IPC_INDEX);
-        if (res) {
-                release_mem_region(res->start,
-                                   PLAT_RESOURCE_IPC_SIZE +
-                                   PLAT_RESOURCE_GCR_SIZE);
-        }
+
         return ret;
 }
 
 static int ipc_plat_remove(struct platform_device *pdev)
 {
-        struct resource *res;
-
         sysfs_remove_group(&pdev->dev.kobj, &intel_ipc_group);
-        free_irq(ipcdev.irq, &ipcdev);
+        devm_free_irq(&pdev->dev, ipcdev.irq, &ipcdev);
         platform_device_unregister(ipcdev.tco_dev);
         platform_device_unregister(ipcdev.punit_dev);
         platform_device_unregister(ipcdev.telemetry_dev);
-        iounmap(ipcdev.ipc_base);
-        res = platform_get_resource(pdev, IORESOURCE_MEM,
-                                    PLAT_RESOURCE_IPC_INDEX);
-        if (res) {
-                release_mem_region(res->start,
-                                   PLAT_RESOURCE_IPC_SIZE +
-                                   PLAT_RESOURCE_GCR_SIZE);
-        }
         ipcdev.dev = NULL;
         return 0;
 }
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 315a4be8dc1e..9a68914100ad 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -51,6 +51,8 @@ module_param(mbox_sel, byte, S_IRUGO);
 MODULE_PARM_DESC(mbox_sel,
                  "RIO Messaging MBOX Selection Mask (default: 0x0f = all)");
 
+static DEFINE_SPINLOCK(tsi721_maint_lock);
+
 static void tsi721_omsg_handler(struct tsi721_device *priv, int ch);
 static void tsi721_imsg_handler(struct tsi721_device *priv, int ch);
 
@@ -124,12 +126,15 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
         void __iomem *regs = priv->regs + TSI721_DMAC_BASE(priv->mdma.ch_id);
         struct tsi721_dma_desc *bd_ptr;
         u32 rd_count, swr_ptr, ch_stat;
+        unsigned long flags;
         int i, err = 0;
         u32 op = do_wr ? MAINT_WR : MAINT_RD;
 
         if (offset > (RIO_MAINT_SPACE_SZ - len) || (len != sizeof(u32)))
                 return -EINVAL;
 
+        spin_lock_irqsave(&tsi721_maint_lock, flags);
+
         bd_ptr = priv->mdma.bd_base;
 
         rd_count = ioread32(regs + TSI721_DMAC_DRDCNT);
@@ -197,7 +202,9 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
          */
         swr_ptr = ioread32(regs + TSI721_DMAC_DSWP);
         iowrite32(swr_ptr, regs + TSI721_DMAC_DSRP);
+
 err_out:
+        spin_unlock_irqrestore(&tsi721_maint_lock, flags);
 
         return err;
 }
diff --git a/drivers/rapidio/rio-access.c b/drivers/rapidio/rio-access.c
index a3824baca2e5..3ee9af83b638 100644
--- a/drivers/rapidio/rio-access.c
+++ b/drivers/rapidio/rio-access.c
@@ -14,16 +14,8 @@
 #include <linux/module.h>
 
 /*
- * These interrupt-safe spinlocks protect all accesses to RIO
- * configuration space and doorbell access.
- */
-static DEFINE_SPINLOCK(rio_config_lock);
-static DEFINE_SPINLOCK(rio_doorbell_lock);
-
-/*
  *  Wrappers for all RIO configuration access functions.  They just check
- *  alignment, do locking and call the low-level functions pointed to
- *  by rio_mport->ops.
+ *  alignment and call the low-level functions pointed to by rio_mport->ops.
  */
 
 #define RIO_8_BAD 0
@@ -44,13 +36,10 @@ int __rio_local_read_config_##size \
         (struct rio_mport *mport, u32 offset, type *value)              \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->lcread(mport, mport->id, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -67,13 +56,8 @@ int __rio_local_read_config_##size \
 int __rio_local_write_config_##size \
         (struct rio_mport *mport, u32 offset, type value)               \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->lcwrite(mport, mport->id, offset, len, value);\
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->lcwrite(mport, mport->id, offset, len, value);\
 }
 
 RIO_LOP_READ(8, u8, 1)
@@ -104,13 +88,10 @@ int rio_mport_read_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type *value)     \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->cread(mport, mport->id, destid, hopcount, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -127,13 +108,9 @@ int rio_mport_read_config_##size \
 int rio_mport_write_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type value)      \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->cwrite(mport, mport->id, destid, hopcount, offset, len, value); \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->cwrite(mport, mport->id, destid, hopcount,   \
+                        offset, len, value);                            \
 }
 
 RIO_OP_READ(8, u8, 1)
@@ -162,14 +139,7 @@ EXPORT_SYMBOL_GPL(rio_mport_write_config_32);
  */
 int rio_mport_send_doorbell(struct rio_mport *mport, u16 destid, u16 data)
 {
-        int res;
-        unsigned long flags;
-
-        spin_lock_irqsave(&rio_doorbell_lock, flags);
-        res = mport->ops->dsend(mport, mport->id, destid, data);
-        spin_unlock_irqrestore(&rio_doorbell_lock, flags);
-
-        return res;
+        return mport->ops->dsend(mport, mport->id, destid, data);
 }
 
 EXPORT_SYMBOL_GPL(rio_mport_send_doorbell);
diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index d0e5d6ee882c..e2c1988cd7c0 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -523,7 +523,7 @@ int __init parse_cec_param(char *str)
         if (*str == '=')
                 str++;
 
-        if (!strncmp(str, "cec_disable", 7))
+        if (!strcmp(str, "cec_disable"))
                 ce_arr.disabled = 1;
         else
                 return 0;
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index f18b36dd57dd..376a99b7cf5d 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -590,7 +590,7 @@ static bool axp20x_is_polyphase_slave(struct axp20x_dev *axp20x, int id)
                 case AXP803_DCDC3:
                         return !!(reg & BIT(6));
                 case AXP803_DCDC6:
-                        return !!(reg & BIT(7));
+                        return !!(reg & BIT(5));
                 }
                 break;
 
diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c
index ef2be56460fe..790a4a73ea2c 100644
--- a/drivers/regulator/rn5t618-regulator.c
+++ b/drivers/regulator/rn5t618-regulator.c
@@ -29,7 +29,7 @@ static const struct regulator_ops rn5t618_reg_ops = {
 };
 
 #define REG(rid, ereg, emask, vreg, vmask, min, max, step)              \
-        [RN5T618_##rid] = {                                             \
+        {                                                               \
                 .name           = #rid,                                 \
                 .of_match       = of_match_ptr(#rid),                   \
                 .regulators_node = of_match_ptr("regulators"),          \
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index df63e44526ac..bf04479456a0 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -109,6 +109,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -120,6 +121,7 @@ config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         depends on QCOM_SMEM
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 612d91403341..633268e9d550 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -264,15 +264,14 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                 if (!(att->flags & ATT_OWN))
                         continue;
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap(&pdev->dev,
                                                      att->sa, att->size);
-                if (IS_ERR(priv->mem[b].cpu_addr)) {
+                if (!priv->mem[b].cpu_addr) {
                         dev_err(dev, "devm_ioremap_resource failed\n");
-                        err = PTR_ERR(priv->mem[b].cpu_addr);
-                        return err;
+                        return -ENOMEM;
                 }
                 priv->mem[b].sys_addr = att->sa;
                 priv->mem[b].size = att->size;
@@ -296,7 +295,7 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                         return err;
                 }
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap_resource(&pdev->dev, &res);
diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
index e0c393214264..e2baecbb9dd3 100644
--- a/drivers/reset/Kconfig
+++ b/drivers/reset/Kconfig
@@ -34,11 +34,12 @@ config RESET_BERLIN
         help
           This enables the reset controller driver for Marvell Berlin SoCs.
 
-config RESET_HSDK_V1
-        bool "HSDK v1 Reset Driver"
-        default n
+config RESET_HSDK
+        bool "Synopsys HSDK Reset Driver"
+        depends on HAS_IOMEM
+        depends on ARC_SOC_HSDK || COMPILE_TEST
         help
-          This enables the reset controller driver for HSDK v1.
+          This enables the reset controller driver for HSDK board.
 
 config RESET_IMX7
         bool "i.MX7 Reset Driver" if COMPILE_TEST
diff --git a/drivers/reset/Makefile b/drivers/reset/Makefile
index d368367110e5..af1c15c330b3 100644
--- a/drivers/reset/Makefile
+++ b/drivers/reset/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_RESET_A10SR) += reset-a10sr.o
 obj-$(CONFIG_RESET_ATH79) += reset-ath79.o
 obj-$(CONFIG_RESET_BERLIN) += reset-berlin.o
-obj-$(CONFIG_RESET_HSDK_V1) += reset-hsdk-v1.o
+obj-$(CONFIG_RESET_HSDK) += reset-hsdk.o
 obj-$(CONFIG_RESET_IMX7) += reset-imx7.o
 obj-$(CONFIG_RESET_LANTIQ) += reset-lantiq.o
 obj-$(CONFIG_RESET_LPC18XX) += reset-lpc18xx.o
diff --git a/drivers/reset/reset-hsdk-v1.c b/drivers/reset/reset-hsdk.c
index bca13e4bf622..8bce391c6943 100644
--- a/drivers/reset/reset-hsdk-v1.c
+++ b/drivers/reset/reset-hsdk.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2017 Synopsys.
  *
- * Synopsys HSDKv1 SDP reset driver.
+ * Synopsys HSDK Development platform reset driver.
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -18,9 +18,9 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 
-#define to_hsdkv1_rst(p)        container_of((p), struct hsdkv1_rst, rcdev)
+#define to_hsdk_rst(p)  container_of((p), struct hsdk_rst, rcdev)
 
-struct hsdkv1_rst {
+struct hsdk_rst {
         void __iomem                    *regs_ctl;
         void __iomem                    *regs_rst;
         spinlock_t                      lock;
@@ -49,12 +49,12 @@ static const u32 rst_map[] = {
 #define CGU_IP_SW_RESET_RESET           BIT(0)
 #define SW_RESET_TIMEOUT                10000
 
-static void hsdkv1_reset_config(struct hsdkv1_rst *rst, unsigned long id)
+static void hsdk_reset_config(struct hsdk_rst *rst, unsigned long id)
 {
         writel(rst_map[id], rst->regs_ctl + CGU_SYS_RST_CTRL);
 }
 
-static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
+static int hsdk_reset_do(struct hsdk_rst *rst)
 {
         u32 reg;
 
@@ -69,28 +69,28 @@ static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
                 !(reg & CGU_IP_SW_RESET_RESET), 5, SW_RESET_TIMEOUT);
 }
 
-static int hsdkv1_reset_reset(struct reset_controller_dev *rcdev,
+static int hsdk_reset_reset(struct reset_controller_dev *rcdev,
                               unsigned long id)
 {
-        struct hsdkv1_rst *rst = to_hsdkv1_rst(rcdev);
+        struct hsdk_rst *rst = to_hsdk_rst(rcdev);
         unsigned long flags;
         int ret;
 
         spin_lock_irqsave(&rst->lock, flags);
-        hsdkv1_reset_config(rst, id);
-        ret = hsdkv1_reset_do(rst);
+        hsdk_reset_config(rst, id);
+        ret = hsdk_reset_do(rst);
         spin_unlock_irqrestore(&rst->lock, flags);
 
         return ret;
 }
 
-static const struct reset_control_ops hsdkv1_reset_ops = {
-        .reset  = hsdkv1_reset_reset,
+static const struct reset_control_ops hsdk_reset_ops = {
+        .reset  = hsdk_reset_reset,
 };
 
-static int hsdkv1_reset_probe(struct platform_device *pdev)
+static int hsdk_reset_probe(struct platform_device *pdev)
 {
-        struct hsdkv1_rst *rst;
+        struct hsdk_rst *rst;
         struct resource *mem;
 
         rst = devm_kzalloc(&pdev->dev, sizeof(*rst), GFP_KERNEL);
@@ -110,7 +110,7 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         spin_lock_init(&rst->lock);
 
         rst->rcdev.owner = THIS_MODULE;
-        rst->rcdev.ops = &hsdkv1_reset_ops;
+        rst->rcdev.ops = &hsdk_reset_ops;
         rst->rcdev.of_node = pdev->dev.of_node;
         rst->rcdev.nr_resets = HSDK_MAX_RESETS;
         rst->rcdev.of_reset_n_cells = 1;
@@ -118,20 +118,20 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         return reset_controller_register(&rst->rcdev);
 }
 
-static const struct of_device_id hsdkv1_reset_dt_match[] = {
-        { .compatible = "snps,hsdk-v1.0-reset" },
+static const struct of_device_id hsdk_reset_dt_match[] = {
+        { .compatible = "snps,hsdk-reset" },
         { },
 };
 
-static struct platform_driver hsdkv1_reset_driver = {
-        .probe  = hsdkv1_reset_probe,
+static struct platform_driver hsdk_reset_driver = {
+        .probe  = hsdk_reset_probe,
         .driver = {
-                .name = "hsdk-v1.0-reset",
-                .of_match_table = hsdkv1_reset_dt_match,
+                .name = "hsdk-reset",
+                .of_match_table = hsdk_reset_dt_match,
         },
 };
-builtin_platform_driver(hsdkv1_reset_driver);
+builtin_platform_driver(hsdk_reset_driver);
 
 MODULE_AUTHOR("Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>");
-MODULE_DESCRIPTION("Synopsys HSDKv1 SDP reset driver");
+MODULE_DESCRIPTION("Synopsys HSDK SDP reset driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c
index c60904ff40b8..3907bbc9c6cf 100644
--- a/drivers/reset/reset-socfpga.c
+++ b/drivers/reset/reset-socfpga.c
@@ -40,8 +40,9 @@ static int socfpga_reset_assert(struct reset_controller_dev *rcdev,
         struct socfpga_reset_data *data = container_of(rcdev,
                                                      struct socfpga_reset_data,
                                                      rcdev);
-        int bank = id / BITS_PER_LONG;
-        int offset = id % BITS_PER_LONG;
+        int reg_width = sizeof(u32);
+        int bank = id / (reg_width * BITS_PER_BYTE);
+        int offset = id % (reg_width * BITS_PER_BYTE);
         unsigned long flags;
         u32 reg;
 
@@ -61,8 +62,9 @@ static int socfpga_reset_deassert(struct reset_controller_dev *rcdev,
                                                      struct socfpga_reset_data,
                                                      rcdev);
 
-        int bank = id / BITS_PER_LONG;
-        int offset = id % BITS_PER_LONG;
+        int reg_width = sizeof(u32);
+        int bank = id / (reg_width * BITS_PER_BYTE);
+        int offset = id % (reg_width * BITS_PER_BYTE);
         unsigned long flags;
         u32 reg;
 
@@ -81,8 +83,9 @@ static int socfpga_reset_status(struct reset_controller_dev *rcdev,
 {
         struct socfpga_reset_data *data = container_of(rcdev,
                                                 struct socfpga_reset_data, rcdev);
-        int bank = id / BITS_PER_LONG;
-        int offset = id % BITS_PER_LONG;
+        int reg_width = sizeof(u32);
+        int bank = id / (reg_width * BITS_PER_BYTE);
+        int offset = id % (reg_width * BITS_PER_BYTE);
         u32 reg;
 
         reg = readl(data->membase + (bank * BANK_INCREMENT));
@@ -132,7 +135,7 @@ static int socfpga_reset_probe(struct platform_device *pdev)
         spin_lock_init(&data->lock);
 
         data->rcdev.owner = THIS_MODULE;
-        data->rcdev.nr_resets = NR_BANKS * BITS_PER_LONG;
+        data->rcdev.nr_resets = NR_BANKS * (sizeof(u32) * BITS_PER_BYTE);
         data->rcdev.ops = &socfpga_reset_ops;
         data->rcdev.of_node = pdev->dev.of_node;
 
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 5a5e927ea50f..5dcc9bf1c5bc 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -635,19 +635,18 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         unsigned long flags;
 
         intent = kzalloc(sizeof(*intent), GFP_KERNEL);
-
         if (!intent)
                 return NULL;
 
         intent->data = kzalloc(size, GFP_KERNEL);
         if (!intent->data)
-                return NULL;
+                goto free_intent;
 
         spin_lock_irqsave(&channel->intent_lock, flags);
         ret = idr_alloc_cyclic(&channel->liids, intent, 1, -1, GFP_ATOMIC);
         if (ret < 0) {
                 spin_unlock_irqrestore(&channel->intent_lock, flags);
-                return NULL;
+                goto free_data;
         }
         spin_unlock_irqrestore(&channel->intent_lock, flags);
 
@@ -656,6 +655,12 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         intent->reuse = reuseable;
 
         return intent;
+
+free_data:
+        kfree(intent->data);
+free_intent:
+        kfree(intent);
+        return NULL;
 }
 
 static void qcom_glink_handle_rx_done(struct qcom_glink *glink,
@@ -1197,7 +1202,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
 
         ret = qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = wait_for_completion_timeout(&channel->intent_req_comp, 10 * HZ);
         if (!ret) {
@@ -1207,6 +1212,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
                 ret = channel->intent_req_result ? 0 : -ECANCELED;
         }
 
+unlock:
         mutex_unlock(&channel->intent_req_lock);
         return ret;
 }
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 82ac331d9125..84752152d41f 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -357,6 +357,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
 
         adapter->next_port_scan = jiffies;
 
+        adapter->erp_action.adapter = adapter;
+
         if (zfcp_qdio_setup(adapter))
                 goto failed;
 
@@ -513,6 +515,9 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn,
         port->dev.groups = zfcp_port_attr_groups;
         port->dev.release = zfcp_port_release;
 
+        port->erp_action.adapter = adapter;
+        port->erp_action.port = port;
+
         if (dev_set_name(&port->dev, "0x%016llx", (unsigned long long)wwpn)) {
                 kfree(port);
                 goto err_out;
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 37408f5f81ce..ec2532ee1822 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -193,9 +193,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
                 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE,
                                 &zfcp_sdev->status);
                 erp_action = &zfcp_sdev->erp_action;
-                memset(erp_action, 0, sizeof(struct zfcp_erp_action));
-                erp_action->port = port;
-                erp_action->sdev = sdev;
+                WARN_ON_ONCE(erp_action->port != port);
+                WARN_ON_ONCE(erp_action->sdev != sdev);
                 if (!(atomic_read(&zfcp_sdev->status) &
                       ZFCP_STATUS_COMMON_RUNNING))
                         act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
@@ -208,8 +207,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
                 zfcp_erp_action_dismiss_port(port);
                 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &port->status);
                 erp_action = &port->erp_action;
-                memset(erp_action, 0, sizeof(struct zfcp_erp_action));
-                erp_action->port = port;
+                WARN_ON_ONCE(erp_action->port != port);
+                WARN_ON_ONCE(erp_action->sdev != NULL);
                 if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_RUNNING))
                         act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
                 break;
@@ -219,7 +218,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
                 zfcp_erp_action_dismiss_adapter(adapter);
                 atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status);
                 erp_action = &adapter->erp_action;
-                memset(erp_action, 0, sizeof(struct zfcp_erp_action));
+                WARN_ON_ONCE(erp_action->port != NULL);
+                WARN_ON_ONCE(erp_action->sdev != NULL);
                 if (!(atomic_read(&adapter->status) &
                       ZFCP_STATUS_COMMON_RUNNING))
                         act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
@@ -229,7 +229,11 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
                 return NULL;
         }
 
-        erp_action->adapter = adapter;
+        WARN_ON_ONCE(erp_action->adapter != adapter);
+        memset(&erp_action->list, 0, sizeof(erp_action->list));
+        memset(&erp_action->timer, 0, sizeof(erp_action->timer));
+        erp_action->step = ZFCP_ERP_STEP_UNINITIALIZED;
+        erp_action->fsf_req_id = 0;
         erp_action->action = need;
         erp_action->status = act_status;
 
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index ec3ddd1d31d5..6cf8732627e0 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -115,10 +115,15 @@ static int zfcp_scsi_slave_alloc(struct scsi_device *sdev)
         struct zfcp_unit *unit;
         int npiv = adapter->connection_features & FSF_FEATURE_NPIV_MODE;
 
+        zfcp_sdev->erp_action.adapter = adapter;
+        zfcp_sdev->erp_action.sdev = sdev;
+
         port = zfcp_get_port_by_wwpn(adapter, rport->port_name);
         if (!port)
                 return -ENXIO;
 
+        zfcp_sdev->erp_action.port = port;
+
         unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev));
         if (unit)
                 put_device(&unit->dev);
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a64285ab0728..af3e4d3f9735 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -699,13 +699,13 @@ static void _aac_probe_container1(void * context, struct fib * fibptr)
         int status;
 
         dresp = (struct aac_mount *) fib_data(fibptr);
-        if (!(fibptr->dev->supplement_adapter_info.supported_options2 &
-            AAC_OPTION_VARIABLE_BLOCK_SIZE))
+        if (!aac_supports_2T(fibptr->dev)) {
                 dresp->mnt[0].capacityhigh = 0;
-        if ((le32_to_cpu(dresp->status) != ST_OK) ||
-            (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
-                _aac_probe_container2(context, fibptr);
-                return;
+                if ((le32_to_cpu(dresp->status) == ST_OK) &&
+                        (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
+                        _aac_probe_container2(context, fibptr);
+                        return;
+                }
         }
         scsicmd = (struct scsi_cmnd *) context;
 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 92fabf2b0c24..403a639574e5 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2701,6 +2701,11 @@ static inline int aac_is_src(struct aac_dev *dev)
         return 0;
 }
 
+static inline int aac_supports_2T(struct aac_dev *dev)
+{
+        return (dev->adapter_info.options & AAC_OPT_NEW_COMM_64);
+}
+
 char * get_container_type(unsigned type);
 extern int numacb;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 97d269f16888..1bc623ad3faf 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -302,9 +302,11 @@ int aac_send_shutdown(struct aac_dev * dev)
                 return -ENOMEM;
         aac_fib_init(fibctx);
 
-        mutex_lock(&dev->ioctl_mutex);
-        dev->adapter_shutdown = 1;
-        mutex_unlock(&dev->ioctl_mutex);
+        if (!dev->adapter_shutdown) {
+                mutex_lock(&dev->ioctl_mutex);
+                dev->adapter_shutdown = 1;
+                mutex_unlock(&dev->ioctl_mutex);
+        }
 
         cmd = (struct aac_close *) fib_data(fibctx);
         cmd->command = cpu_to_le32(VM_CloseAll);
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 87cc4a93e637..c9252b138c1f 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -1547,8 +1551,9 @@ static void __aac_shutdown(struct aac_dev * aac)
 {
         int i;
 
+        mutex_lock(&aac->ioctl_mutex);
         aac->adapter_shutdown = 1;
-        aac_send_shutdown(aac);
+        mutex_unlock(&aac->ioctl_mutex);
 
         if (aac->aif_thread) {
                 int i;
@@ -1561,7 +1566,11 @@ static void __aac_shutdown(struct aac_dev * aac)
                 }
                 kthread_stop(aac->thread);
         }
+
+        aac_send_shutdown(aac);
+
         aac_adapter_disable_int(aac);
+
         if (aac_is_src(aac)) {
                 if (aac->max_msix > 1) {
                         for (i = 0; i < aac->max_msix; i++) {
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 48c2b2b34b72..0c9361c87ec8 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -740,6 +740,8 @@ static void aac_send_iop_reset(struct aac_dev *dev)
         aac_set_intx_mode(dev);
 
         src_writel(dev, MUnit.IDR, IOP_SRC_RESET_MASK);
+
+        msleep(5000);
 }
 
 static void aac_send_hardware_soft_reset(struct aac_dev *dev)
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 9abe81021484..4ed3d26ffdde 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -4091,7 +4091,7 @@ static int hpsa_set_local_logical_count(struct ctlr_info *h,
         memset(id_ctlr, 0, sizeof(*id_ctlr));
         rc = hpsa_bmic_id_controller(h, id_ctlr, sizeof(*id_ctlr));
         if (!rc)
-                if (id_ctlr->configured_logical_drive_count < 256)
+                if (id_ctlr->configured_logical_drive_count < 255)
                         *nlocals = id_ctlr->configured_logical_drive_count;
                 else
                         *nlocals = le16_to_cpu(
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 785fb42f6650..2799a6b08f73 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3767,7 +3767,7 @@ static int ibmvscsis_write_pending(struct se_cmd *se_cmd)
          */
         if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) {
                 pr_err("write_pending failed since: %d\n", vscsi->flags);
-                return 0;
+                return -EIO;
         }
 
         rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 520325867e2b..31d31aad3de1 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -383,11 +383,11 @@ static void fc_rport_work(struct work_struct *work)
                                 fc_rport_enter_flogi(rdata);
                                 mutex_unlock(&rdata->rp_mutex);
                         } else {
+                                mutex_unlock(&rdata->rp_mutex);
                                 FC_RPORT_DBG(rdata, "work delete\n");
                                 mutex_lock(&lport->disc.disc_mutex);
                                 list_del_rcu(&rdata->peers);
                                 mutex_unlock(&lport->disc.disc_mutex);
-                                mutex_unlock(&rdata->rp_mutex);
                                 kref_put(&rdata->kref, fc_rport_destroy);
                         }
                 } else {
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index bd4605a34f54..f8dc1601efd5 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1728,7 +1728,7 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
 
         if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) {
                 reason = FAILURE_SESSION_IN_RECOVERY;
-                sc->result = DID_REQUEUE;
+                sc->result = DID_REQUEUE << 16;
                 goto fault;
         }
 
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
 /**
  * iscsi_session_teardown - destroy session, host, and cls_session
  * @cls_session: iscsi session
- *
- * The driver must have called iscsi_remove_session before
- * calling this.
  */
 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 
         iscsi_pool_free(&session->cmdpool);
 
+        iscsi_remove_session(cls_session);
+
         kfree(session->password);
         kfree(session->password_in);
         kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
         kfree(session->portal_type);
         kfree(session->discovery_parent_type);
 
-        iscsi_destroy_session(cls_session);
+        iscsi_free_session(cls_session);
+
         iscsi_host_dec_session_cnt(shost);
         module_put(owner);
 }
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7e7ae786121b..100bc4c8798d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6131,6 +6131,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                                 "Extents and RPI headers enabled.\n");
                 }
                 mempool_free(mboxq, phba->mbox_mem_pool);
+                rc = -EIO;
                 goto out_free_bsmbx;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 79ba3ce063a4..23bdb1ca106e 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -884,7 +884,7 @@ out_err:
                                          wcqe->total_data_placed);
                         nCmd->transferred_length = 0;
                         nCmd->rcv_rsplen = 0;
-                        nCmd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                        nCmd->status = NVME_SC_INTERNAL;
                 }
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 1f59e7a74c7b..6b33a1f24f56 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -180,7 +180,7 @@ static void qla_nvme_sp_done(void *ptr, int res)
                 goto rel;
 
         if (unlikely(res == QLA_FUNCTION_FAILED))
-                fd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                fd->status = NVME_SC_INTERNAL;
         else
                 fd->status = 0;
 
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5b2437a5ea44..3bd956d3bc5d 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3061,6 +3061,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
             host->max_cmd_len, host->max_channel, host->max_lun,
             host->transportt, sht->vendor_id);
 
+        INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
+
         /* Set up the irqs */
         ret = qla2x00_request_irqs(ha, rsp);
         if (ret)
@@ -3223,7 +3225,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          */
         qla2xxx_wake_dpc(base_vha);
 
-        INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
         INIT_WORK(&ha->board_disable, qla2x00_disable_board_on_pci_error);
 
         if (IS_QLA8031(ha) || IS_MCTP_CAPABLE(ha)) {
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 38942050b265..dab876c65473 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -580,7 +580,8 @@ int scsi_check_sense(struct scsi_cmnd *scmd)
                 if (sshdr.asc == 0x20 || /* Invalid command operation code */
                     sshdr.asc == 0x21 || /* Logical block address out of range */
                     sshdr.asc == 0x24 || /* Invalid field in cdb */
-                    sshdr.asc == 0x26) { /* Parameter value invalid */
+                    sshdr.asc == 0x26 || /* Parameter value invalid */
+                    sshdr.asc == 0x27) { /* Write protected */
                         set_host_byte(scmd, DID_TARGET_FAILURE);
                 }
                 return SUCCESS;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9cf6a80fe297..ad3ea24f0885 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1379,8 +1379,6 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
 
         ret = scsi_setup_cmnd(sdev, req);
 out:
-        if (ret != BLKPREP_OK)
-                cmd->flags &= ~SCMD_INITIALIZED;
         return scsi_prep_return(q, req, ret);
 }
 
@@ -1900,7 +1898,6 @@ static int scsi_mq_prep_fn(struct request *req)
         struct scsi_device *sdev = req->q->queuedata;
         struct Scsi_Host *shost = sdev->host;
         struct scatterlist *sg;
-        int ret;
 
         scsi_init_command(sdev, cmd);
 
@@ -1934,10 +1931,7 @@ static int scsi_mq_prep_fn(struct request *req)
 
         blk_mq_start_request(req);
 
-        ret = scsi_setup_cmnd(sdev, req);
-        if (ret != BLK_STS_OK)
-                cmd->flags &= ~SCMD_INITIALIZED;
-        return ret;
+        return scsi_setup_cmnd(sdev, req);
 }
 
 static void scsi_mq_done(struct scsi_cmnd *cmd)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index e7818afeda2b..15590a063ad9 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         if (*bflags & BLIST_NO_DIF)
                 sdev->no_dif = 1;
 
+        if (*bflags & BLIST_UNMAP_LIMIT_WS)
+                sdev->unmap_limit_for_ws = 1;
+
         sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
 
         if (*bflags & BLIST_TRY_VPD_PAGES)
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index bf53356f41f0..f796bd61f3f0 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1376,13 +1376,19 @@ static void __scsi_remove_target(struct scsi_target *starget)
         spin_lock_irqsave(shost->host_lock, flags);
  restart:
         list_for_each_entry(sdev, &shost->__devices, siblings) {
+                /*
+                 * We cannot call scsi_device_get() here, as
+                 * we might've been called from rmmod() causing
+                 * scsi_device_get() to fail the module_is_live()
+                 * check.
+                 */
                 if (sdev->channel != starget->channel ||
                     sdev->id != starget->id ||
-                    scsi_device_get(sdev))
+                    !get_device(&sdev->sdev_gendev))
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
                 scsi_remove_device(sdev);
-                scsi_device_put(sdev);
+                put_device(&sdev->sdev_gendev);
                 spin_lock_irqsave(shost->host_lock, flags);
                 goto restart;
         }
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index ba9d70f8a6a1..8c46a6d536af 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2739,7 +2739,8 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
 
         list_for_each_entry(rport, &fc_host->rports, peers) {
 
-                if ((rport->port_state == FC_PORTSTATE_BLOCKED) &&
+                if ((rport->port_state == FC_PORTSTATE_BLOCKED ||
+                     rport->port_state == FC_PORTSTATE_NOTPRESENT) &&
                         (rport->channel == channel)) {
 
                         switch (fc_host->tgtid_bind_type) {
@@ -2876,7 +2877,6 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                         memcpy(&rport->port_name, &ids->port_name,
                                 sizeof(rport->port_name));
                         rport->port_id = ids->port_id;
-                        rport->roles = ids->roles;
                         rport->port_state = FC_PORTSTATE_ONLINE;
                         rport->flags &= ~FC_RPORT_FAST_FAIL_TIMEDOUT;
 
@@ -2885,15 +2885,7 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                                                 fci->f->dd_fcrport_size);
                         spin_unlock_irqrestore(shost->host_lock, flags);
 
-                        if (ids->roles & FC_PORT_ROLE_FCP_TARGET) {
-                                scsi_target_unblock(&rport->dev, SDEV_RUNNING);
-
-                                /* initiate a scan of the target */
-                                spin_lock_irqsave(shost->host_lock, flags);
-                                rport->flags |= FC_RPORT_SCAN_PENDING;
-                                scsi_queue_work(shost, &rport->scan_work);
-                                spin_unlock_irqrestore(shost->host_lock, flags);
-                        }
+                        fc_remote_port_rolechg(rport, ids->roles);
                         return rport;
                 }
         }
@@ -3328,6 +3320,9 @@ int fc_block_scsi_eh(struct scsi_cmnd *cmnd)
 {
         struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
 
+        if (WARN_ON_ONCE(!rport))
+                return FAST_IO_FAIL;
+
         return fc_block_rport(rport);
 }
 EXPORT_SYMBOL(fc_block_scsi_eh);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8934f19bce8e..7404d26895f5 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2211,22 +2211,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 
 /**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
- *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
- */
-int iscsi_destroy_session(struct iscsi_cls_session *session)
-{
-        iscsi_remove_session(session);
-        ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
-        iscsi_free_session(session);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_session);
-
-/**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
  * @dd_size: private driver data size
@@ -3689,7 +3673,7 @@ iscsi_if_rx(struct sk_buff *skb)
                 uint32_t group;
 
                 nlh = nlmsg_hdr(skb);
-                if (nlh->nlmsg_len < sizeof(*nlh) ||
+                if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
                     skb->len < nlh->nlmsg_len) {
                         break;
                 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index fb9f8b5f4673..d175c5c5ccf8 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -715,13 +715,21 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
                 break;
 
         case SD_LBP_WS16:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS16_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
                 break;
 
         case SD_LBP_WS10:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS10_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
                 break;
 
         case SD_LBP_ZERO:
@@ -3099,8 +3107,6 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 sd_read_security(sdkp, buffer);
         }
 
-        sdkp->first_scan = 0;
-
         /*
          * We now have all cache related info, determine how we deal
          * with flush requests.
@@ -3115,7 +3121,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
 
         /*
-         * Use the device's preferred I/O size for reads and writes
+         * Determine the device's preferred I/O size for reads and writes
          * unless the reported value is unreasonably small, large, or
          * garbage.
          */
@@ -3129,8 +3135,19 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
                                       (sector_t)BLK_DEF_MAX_SECTORS);
 
-        /* Combine with controller limits */
-        q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+        /* Do not exceed controller limit */
+        rw_max = min(rw_max, queue_max_hw_sectors(q));
+
+        /*
+         * Only update max_sectors if previously unset or if the current value
+         * exceeds the capabilities of the hardware.
+         */
+        if (sdkp->first_scan ||
+            q->limits.max_sectors > q->limits.max_dev_sectors ||
+            q->limits.max_sectors > q->limits.max_hw_sectors)
+                q->limits.max_sectors = rw_max;
+
+        sdkp->first_scan = 0;
 
         set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
         sd_config_write_same(sdkp);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0419c2298eab..aa28874e8fb9 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -837,7 +837,7 @@ sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
 
         val = 0;
         list_for_each_entry(srp, &sfp->rq_list, entry) {
-                if (val > SG_MAX_QUEUE)
+                if (val >= SG_MAX_QUEUE)
                         break;
                 rinfo[val].req_state = srp->done + 1;
                 rinfo[val].problem =
diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
index 6c7d7a460689..568e1c65aa82 100644
--- a/drivers/spi/spi-armada-3700.c
+++ b/drivers/spi/spi-armada-3700.c
@@ -99,11 +99,6 @@
 /* A3700_SPI_IF_TIME_REG */
 #define A3700_SPI_CLK_CAPT_EDGE         BIT(7)
 
-/* Flags and macros for struct a3700_spi */
-#define A3700_INSTR_CNT                 1
-#define A3700_ADDR_CNT                  3
-#define A3700_DUMMY_CNT                 1
-
 struct a3700_spi {
         struct spi_master *master;
         void __iomem *base;
@@ -117,9 +112,6 @@ struct a3700_spi {
         u8 byte_len;
         u32 wait_mask;
         struct completion done;
-        u32 addr_cnt;
-        u32 instr_cnt;
-        size_t hdr_cnt;
 };
 
 static u32 spireg_read(struct a3700_spi *a3700_spi, u32 offset)
@@ -161,7 +153,7 @@ static void a3700_spi_deactivate_cs(struct a3700_spi *a3700_spi,
 }
 
 static int a3700_spi_pin_mode_set(struct a3700_spi *a3700_spi,
-                                  unsigned int pin_mode)
+                                  unsigned int pin_mode, bool receiving)
 {
         u32 val;
 
@@ -177,6 +169,9 @@ static int a3700_spi_pin_mode_set(struct a3700_spi *a3700_spi,
                 break;
         case SPI_NBITS_QUAD:
                 val |= A3700_SPI_DATA_PIN1;
+                /* RX during address reception uses 4-pin */
+                if (receiving)
+                        val |= A3700_SPI_ADDR_PIN;
                 break;
         default:
                 dev_err(&a3700_spi->master->dev, "wrong pin mode %u", pin_mode);
@@ -392,7 +387,8 @@ static bool a3700_spi_wait_completion(struct spi_device *spi)
 
         spireg_write(a3700_spi, A3700_SPI_INT_MASK_REG, 0);
 
-        return true;
+        /* Timeout was reached */
+        return false;
 }
 
 static bool a3700_spi_transfer_wait(struct spi_device *spi,
@@ -446,59 +442,43 @@ static void a3700_spi_set_cs(struct spi_device *spi, bool enable)
 
 static void a3700_spi_header_set(struct a3700_spi *a3700_spi)
 {
-        u32 instr_cnt = 0, addr_cnt = 0, dummy_cnt = 0;
+        unsigned int addr_cnt;
         u32 val = 0;
 
         /* Clear the header registers */
         spireg_write(a3700_spi, A3700_SPI_IF_INST_REG, 0);
         spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, 0);
         spireg_write(a3700_spi, A3700_SPI_IF_RMODE_REG, 0);
+        spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, 0);
 
         /* Set header counters */
         if (a3700_spi->tx_buf) {
-                if (a3700_spi->buf_len <= a3700_spi->instr_cnt) {
-                        instr_cnt = a3700_spi->buf_len;
-                } else if (a3700_spi->buf_len <= (a3700_spi->instr_cnt +
-                                                  a3700_spi->addr_cnt)) {
-                        instr_cnt = a3700_spi->instr_cnt;
-                        addr_cnt = a3700_spi->buf_len - instr_cnt;
-                } else if (a3700_spi->buf_len <= a3700_spi->hdr_cnt) {
-                        instr_cnt = a3700_spi->instr_cnt;
-                        addr_cnt = a3700_spi->addr_cnt;
-                        /* Need to handle the normal write case with 1 byte
-                         * data
-                         */
-                        if (!a3700_spi->tx_buf[instr_cnt + addr_cnt])
-                                dummy_cnt = a3700_spi->buf_len - instr_cnt -
-                                            addr_cnt;
+                /*
+                 * when tx data is not 4 bytes aligned, there will be unexpected
+                 * bytes out of SPI output register, since it always shifts out
+                 * as whole 4 bytes. This might cause incorrect transaction with
+                 * some devices. To avoid that, use SPI header count feature to
+                 * transfer up to 3 bytes of data first, and then make the rest
+                 * of data 4-byte aligned.
+                 */
+                addr_cnt = a3700_spi->buf_len % 4;
+                if (addr_cnt) {
+                        val = (addr_cnt & A3700_SPI_ADDR_CNT_MASK)
+                                << A3700_SPI_ADDR_CNT_BIT;
+                        spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, val);
+
+                        /* Update the buffer length to be transferred */
+                        a3700_spi->buf_len -= addr_cnt;
+
+                        /* transfer 1~3 bytes through address count */
+                        val = 0;
+                        while (addr_cnt--) {
+                                val = (val << 8) | a3700_spi->tx_buf[0];
+                                a3700_spi->tx_buf++;
+                        }
+                        spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, val);
                 }
-                val |= ((instr_cnt & A3700_SPI_INSTR_CNT_MASK)
-                        << A3700_SPI_INSTR_CNT_BIT);
-                val |= ((addr_cnt & A3700_SPI_ADDR_CNT_MASK)
-                        << A3700_SPI_ADDR_CNT_BIT);
-                val |= ((dummy_cnt & A3700_SPI_DUMMY_CNT_MASK)
-                        << A3700_SPI_DUMMY_CNT_BIT);
         }
-        spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, val);
-
-        /* Update the buffer length to be transferred */
-        a3700_spi->buf_len -= (instr_cnt + addr_cnt + dummy_cnt);
-
-        /* Set Instruction */
-        val = 0;
-        while (instr_cnt--) {
-                val = (val << 8) | a3700_spi->tx_buf[0];
-                a3700_spi->tx_buf++;
-        }
-        spireg_write(a3700_spi, A3700_SPI_IF_INST_REG, val);
-
-        /* Set Address */
-        val = 0;
-        while (addr_cnt--) {
-                val = (val << 8) | a3700_spi->tx_buf[0];
-                a3700_spi->tx_buf++;
-        }
-        spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, val);
 }
 
 static int a3700_is_wfifo_full(struct a3700_spi *a3700_spi)
@@ -512,35 +492,12 @@ static int a3700_is_wfifo_full(struct a3700_spi *a3700_spi)
 static int a3700_spi_fifo_write(struct a3700_spi *a3700_spi)
 {
         u32 val;
-        int i = 0;
 
         while (!a3700_is_wfifo_full(a3700_spi) && a3700_spi->buf_len) {
-                val = 0;
-                if (a3700_spi->buf_len >= 4) {
-                        val = cpu_to_le32(*(u32 *)a3700_spi->tx_buf);
-                        spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, val);
-
-                        a3700_spi->buf_len -= 4;
-                        a3700_spi->tx_buf += 4;
-                } else {
-                        /*
-                         * If the remained buffer length is less than 4-bytes,
-                         * we should pad the write buffer with all ones. So that
-                         * it avoids overwrite the unexpected bytes following
-                         * the last one.
-                         */
-                        val = GENMASK(31, 0);
-                        while (a3700_spi->buf_len) {
-                                val &= ~(0xff << (8 * i));
-                                val |= *a3700_spi->tx_buf++ << (8 * i);
-                                i++;
-                                a3700_spi->buf_len--;
-
-                                spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG,
-                                             val);
-                        }
-                        break;
-                }
+                val = cpu_to_le32(*(u32 *)a3700_spi->tx_buf);
+                spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, val);
+                a3700_spi->buf_len -= 4;
+                a3700_spi->tx_buf += 4;
         }
 
         return 0;
@@ -645,15 +602,18 @@ static int a3700_spi_transfer_one(struct spi_master *master,
         a3700_spi->rx_buf  = xfer->rx_buf;
         a3700_spi->buf_len = xfer->len;
 
-        /* SPI transfer headers */
-        a3700_spi_header_set(a3700_spi);
-
         if (xfer->tx_buf)
                 nbits = xfer->tx_nbits;
         else if (xfer->rx_buf)
                 nbits = xfer->rx_nbits;
 
-        a3700_spi_pin_mode_set(a3700_spi, nbits);
+        a3700_spi_pin_mode_set(a3700_spi, nbits, xfer->rx_buf ? true : false);
+
+        /* Flush the FIFOs */
+        a3700_spi_fifo_flush(a3700_spi);
+
+        /* Transfer first bytes of data when buffer is not 4-byte aligned */
+        a3700_spi_header_set(a3700_spi);
 
         if (xfer->rx_buf) {
                 /* Set read data length */
@@ -733,16 +693,11 @@ static int a3700_spi_transfer_one(struct spi_master *master,
                                 dev_err(&spi->dev, "wait wfifo empty timed out\n");
                                 return -ETIMEDOUT;
                         }
-                } else {
-                        /*
-                         * If the instruction in SPI_INSTR does not require data
-                         * to be written to the SPI device, wait until SPI_RDY
-                         * is 1 for the SPI interface to be in idle.
-                         */
-                        if (!a3700_spi_transfer_wait(spi, A3700_SPI_XFER_RDY)) {
-                                dev_err(&spi->dev, "wait xfer ready timed out\n");
-                                return -ETIMEDOUT;
-                        }
+                }
+
+                if (!a3700_spi_transfer_wait(spi, A3700_SPI_XFER_RDY)) {
+                        dev_err(&spi->dev, "wait xfer ready timed out\n");
+                        return -ETIMEDOUT;
                 }
 
                 val = spireg_read(a3700_spi, A3700_SPI_IF_CFG_REG);
@@ -834,10 +789,6 @@ static int a3700_spi_probe(struct platform_device *pdev)
         memset(spi, 0, sizeof(struct a3700_spi));
 
         spi->master = master;
-        spi->instr_cnt = A3700_INSTR_CNT;
-        spi->addr_cnt = A3700_ADDR_CNT;
-        spi->hdr_cnt = A3700_INSTR_CNT + A3700_ADDR_CNT +
-                       A3700_DUMMY_CNT;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         spi->base = devm_ioremap_resource(dev, res);
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index 6ef6c44f39f5..a172ab299e80 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1250,7 +1250,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
                         goto qspi_probe_err;
                 }
         } else {
-                goto qspi_probe_err;
+                goto qspi_resource_err;
         }
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
@@ -1272,7 +1272,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
                 qspi->base[CHIP_SELECT]  = devm_ioremap_resource(dev, res);
                 if (IS_ERR(qspi->base[CHIP_SELECT])) {
                         ret = PTR_ERR(qspi->base[CHIP_SELECT]);
-                        goto qspi_probe_err;
+                        goto qspi_resource_err;
                 }
         }
 
@@ -1280,7 +1280,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
                                 GFP_KERNEL);
         if (!qspi->dev_ids) {
                 ret = -ENOMEM;
-                goto qspi_probe_err;
+                goto qspi_resource_err;
         }
 
         for (val = 0; val < num_irqs; val++) {
@@ -1369,8 +1369,9 @@ qspi_reg_err:
         bcm_qspi_hw_uninit(qspi);
         clk_disable_unprepare(qspi->clk);
 qspi_probe_err:
-        spi_master_put(master);
         kfree(qspi->dev_ids);
+qspi_resource_err:
+        spi_master_put(master);
         return ret;
 }
 /* probe function to be called by SoC specific platform driver probe */
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 680cdf549506..ba9743fa2326 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -263,8 +263,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz)
          * no need to check it there.
          * However, we need to ensure the following calculations.
          */
-        if ((div < SPI_MBR_DIV_MIN) &&
-            (div > SPI_MBR_DIV_MAX))
+        if (div < SPI_MBR_DIV_MIN ||
+            div > SPI_MBR_DIV_MAX)
                 return -EINVAL;
 
         /* Determine the first power of 2 greater than or equal to div */
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 6e65524cbfd9..e8b5a5e21b2e 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -45,7 +45,6 @@
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/spi.h>
-#define SPI_DYN_FIRST_BUS_NUM 0
 
 static DEFINE_IDR(spi_master_idr);
 
@@ -2086,7 +2085,7 @@ int spi_register_controller(struct spi_controller *ctlr)
         struct device           *dev = ctlr->dev.parent;
         struct boardinfo        *bi;
         int                     status = -ENODEV;
-        int                     id;
+        int                     id, first_dynamic;
 
         if (!dev)
                 return -ENODEV;
@@ -2116,9 +2115,15 @@ int spi_register_controller(struct spi_controller *ctlr)
                 }
         }
         if (ctlr->bus_num < 0) {
+                first_dynamic = of_alias_get_highest_id("spi");
+                if (first_dynamic < 0)
+                        first_dynamic = 0;
+                else
+                        first_dynamic++;
+
                 mutex_lock(&board_lock);
-                id = idr_alloc(&spi_master_idr, ctlr, SPI_DYN_FIRST_BUS_NUM, 0,
-                               GFP_KERNEL);
+                id = idr_alloc(&spi_master_idr, ctlr, first_dynamic,
+                               0, GFP_KERNEL);
                 mutex_unlock(&board_lock);
                 if (WARN(id < 0, "couldn't get idr"))
                         return id;
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index d11c6de9c777..6150d2780e22 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_state *st,
         struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
         unsigned long long scale_uv;
         int i, ret, id;
-        u8 ones[6];
 
         /* reset the serial interface */
-        memset(&ones, 0xFF, 6);
-        ret = spi_write(st->sd.spi, &ones, 6);
+        ret = ad_sd_reset(&st->sd, 48);
         if (ret < 0)
                 goto out;
         usleep_range(500, 1000); /* Wait for at least 500us */
diff --git a/drivers/staging/iio/meter/ade7759.c b/drivers/staging/iio/meter/ade7759.c
index 1691760339da..02573c517d9d 100644
--- a/drivers/staging/iio/meter/ade7759.c
+++ b/drivers/staging/iio/meter/ade7759.c
@@ -172,7 +172,7 @@ static int ade7759_spi_read_reg_40(struct device *dev,
                                 reg_address);
                 goto error_ret;
         }
-        *val = ((u64)st->rx[1] << 32) | (st->rx[2] << 24) |
+        *val = ((u64)st->rx[1] << 32) | ((u64)st->rx[2] << 24) |
                 (st->rx[3] << 16) | (st->rx[4] << 8) | st->rx[5];
 
 error_ret:
diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
index d96f4512224f..b55e5ebba8b4 100644
--- a/drivers/staging/media/imx/imx-media-dev.c
+++ b/drivers/staging/media/imx/imx-media-dev.c
@@ -400,10 +400,10 @@ static int imx_media_create_pad_vdev_lists(struct imx_media_dev *imxmd)
                                         struct media_link, list);
                 ret = imx_media_add_vdev_to_pad(imxmd, vdev, link->source);
                 if (ret)
-                        break;
+                        return ret;
         }
 
-        return ret;
+        return 0;
 }
 
 /* async subdev complete notifier */
diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index 13eaf16ecd16..87595c594b12 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -496,8 +496,12 @@ static int spinand_program_page(struct spi_device *spi_nand,
         if (!wbuf)
                 return -ENOMEM;
 
-        enable_read_hw_ecc = 0;
-        spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        enable_read_hw_ecc = 1;
+        retval = spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        if (retval < 0) {
+                dev_err(&spi_nand->dev, "ecc error on read page!!!\n");
+                return retval;
+        }
 
         for (i = offset, j = 0; i < len; i++, j++)
                 wbuf[i] &= buf[j];
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index c4b1b218ea38..290b419aa9dd 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -570,12 +570,6 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
                 dev_dbg(&spi->dev, "set: DIO mapping");
         #endif
 
-        // check DIO number
-        if (DIONumber > 5) {
-                dev_dbg(&spi->dev, "set: illegal input param");
-                return -EINVAL;
-        }
-
         switch (DIONumber) {
         case 0: mask=MASK_DIO0; shift=SHIFT_DIO0; regaddr=REG_DIOMAPPING1; break;
         case 1: mask=MASK_DIO1; shift=SHIFT_DIO1; regaddr=REG_DIOMAPPING1; break;
@@ -583,6 +577,9 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
         case 3: mask=MASK_DIO3; shift=SHIFT_DIO3; regaddr=REG_DIOMAPPING1; break;
         case 4: mask=MASK_DIO4; shift=SHIFT_DIO4; regaddr=REG_DIOMAPPING2; break;
         case 5: mask=MASK_DIO5; shift=SHIFT_DIO5; regaddr=REG_DIOMAPPING2; break;
+        default:
+                dev_dbg(&spi->dev, "set: illegal input param");
+                return -EINVAL;
         }
 
         // read reg
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 6b778206a1a3..cb8a95aabd6c 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -119,9 +119,8 @@ void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
 
 void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
 {
-        rtw_free_mlme_priv_ie_data(pmlmepriv);
-
         if (pmlmepriv) {
+                rtw_free_mlme_priv_ie_data(pmlmepriv);
                 if (pmlmepriv->free_bss_buf) {
                         vfree(pmlmepriv->free_bss_buf);
                 }
diff --git a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
index 92277457aba4..ce1dd6f9036f 100644
--- a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
+++ b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
@@ -311,6 +311,8 @@ static ssize_t proc_set_cam(struct file *file, const char __user *buffer, size_t
 
                 if (num < 2)
                         return count;
+                if (id >= TOTAL_CAM_ENTRY)
+                        return -EINVAL;
 
                 if (strcmp("c", cmd) == 0) {
                         _clear_cam_entry(adapter, id);
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
index 5f84526cb5b5..edbf6af1c8b7 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
@@ -2901,11 +2901,11 @@ halmac_update_datapack_88xx(struct halmac_adapter *halmac_adapter,
         if (halmac_adapter->fw_version.h2c_version < 4)
                 return HALMAC_RET_FW_NO_SUPPORT;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s ==========>\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s <==========\n", __func__);
 
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index f33024e4d853..544f638ed3ef 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -1618,10 +1618,11 @@ halmac_send_h2c_set_pwr_mode_88xx(struct halmac_adapter *halmac_adapter,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = h2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -1713,10 +1714,11 @@ halmac_media_status_rpt_88xx(struct halmac_adapter *halmac_adapter, u8 op_mode,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_send_h2c_set_pwr_mode_88xx!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = H2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -2143,10 +2145,11 @@ halmac_func_ctrl_ch_switch_88xx(struct halmac_adapter *halmac_adapter,
         enum halmac_cmd_process_status *process_status =
                 &halmac_adapter->halmac_state.scan_state_set.process_status;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_ctrl_ch_switch!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         halmac_api = (struct halmac_api *)halmac_adapter->halmac_api;
 
         if (halmac_transition_scan_state_88xx(
@@ -2276,15 +2279,13 @@ enum halmac_ret_status halmac_send_h2c_update_bcn_parse_info_88xx(
 {
         u8 h2c_buff[HALMAC_H2C_CMD_SIZE_88XX] = {0};
         u16 h2c_seq_mum = 0;
-        void *driver_adapter = NULL;
+        void *driver_adapter = halmac_adapter->driver_adapter;
         struct halmac_h2c_header_info h2c_header_info;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         UPDATE_BEACON_PARSING_INFO_SET_FUNC_EN(h2c_buff, bcn_ie_info->func_en);
         UPDATE_BEACON_PARSING_INFO_SET_SIZE_TH(h2c_buff, bcn_ie_info->size_th);
         UPDATE_BEACON_PARSING_INFO_SET_TIMEOUT(h2c_buff, bcn_ie_info->timeout);
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 67956e24779c..56f7be6af1f6 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1376,6 +1376,8 @@ static void reset_highlight_buffers(struct vc_data *);
 
 static int read_all_key;
 
+static int in_keyboard_notifier;
+
 static void start_read_all_timer(struct vc_data *vc, int command);
 
 enum {
@@ -1408,7 +1410,10 @@ static void read_all_doc(struct vc_data *vc)
         cursor_track = read_all_mode;
         spk_reset_index_count(0);
         if (get_sentence_buf(vc, 0) == -1) {
-                kbd_fakekey2(vc, RA_DOWN_ARROW);
+                del_timer(&cursor_timer);
+                if (!in_keyboard_notifier)
+                        speakup_fake_down_arrow();
+                start_read_all_timer(vc, RA_DOWN_ARROW);
         } else {
                 say_sentence_num(0, 0);
                 synth_insert_next_index(0);
@@ -2212,8 +2217,10 @@ static int keyboard_notifier_call(struct notifier_block *nb,
         int ret = NOTIFY_OK;
         static int keycode;     /* to hold the current keycode */
 
+        in_keyboard_notifier = 1;
+
         if (vc->vc_mode == KD_GRAPHICS)
-                return ret;
+                goto out;
 
         /*
          * First, determine whether we are handling a fake keypress on
@@ -2225,7 +2232,7 @@ static int keyboard_notifier_call(struct notifier_block *nb,
          */
 
         if (speakup_fake_key_pressed())
-                return ret;
+                goto out;
 
         switch (code) {
         case KBD_KEYCODE:
@@ -2266,6 +2273,8 @@ static int keyboard_notifier_call(struct notifier_block *nb,
                         break;
                 }
         }
+out:
+        in_keyboard_notifier = 0;
         return ret;
 }
 
diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
index 74cce4f1a7bd..27ecf6fb49fd 100644
--- a/drivers/staging/unisys/visorbus/visorchipset.c
+++ b/drivers/staging/unisys/visorbus/visorchipset.c
@@ -1826,7 +1826,7 @@ static __init int visorutil_spar_detect(void)
         return 0;
 }
 
-static int init_unisys(void)
+static int __init init_unisys(void)
 {
         int result;
 
@@ -1841,7 +1841,7 @@ static int init_unisys(void)
         return 0;
 };
 
-static void exit_unisys(void)
+static void __exit exit_unisys(void)
 {
         acpi_bus_unregister_driver(&unisys_acpi_driver);
 }
diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
index 5f3d8f2339e3..4be864dbd41c 100644
--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
@@ -390,8 +390,7 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
                         __func__, instance);
                 instance->alsa_stream = alsa_stream;
                 alsa_stream->instance = instance;
-                ret = 0; // xxx todo -1;
-                goto err_free_mem;
+                return 0;
         }
 
         /* Initialize and create a VCHI connection */
@@ -401,16 +400,15 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
                         LOG_ERR("%s: failed to initialise VCHI instance (ret=%d)\n",
                                 __func__, ret);
 
-                        ret = -EIO;
-                        goto err_free_mem;
+                        return -EIO;
                 }
                 ret = vchi_connect(NULL, 0, vchi_instance);
                 if (ret) {
                         LOG_ERR("%s: failed to connect VCHI instance (ret=%d)\n",
                                 __func__, ret);
 
-                        ret = -EIO;
-                        goto err_free_mem;
+                        kfree(vchi_instance);
+                        return -EIO;
                 }
                 initted = 1;
         }
@@ -421,19 +419,16 @@ static int bcm2835_audio_open_connection(struct bcm2835_alsa_stream *alsa_stream
         if (IS_ERR(instance)) {
                 LOG_ERR("%s: failed to initialize audio service\n", __func__);
 
-                ret = PTR_ERR(instance);
-                goto err_free_mem;
+                /* vchi_instance is retained for use the next time. */
+                return PTR_ERR(instance);
         }
 
         instance->alsa_stream = alsa_stream;
         alsa_stream->instance = instance;
 
         LOG_DBG(" success !\n");
-        ret = 0;
-err_free_mem:
-        kfree(vchi_instance);
 
-        return ret;
+        return 0;
 }
 
 int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 0159ca4407d8..be08849175ea 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo,
                         if (head_bytes > actual)
                                 head_bytes = actual;
 
-                        memcpy((char *)page_address(pages[0]) +
+                        memcpy((char *)kmap(pages[0]) +
                                 pagelist->offset,
                                 fragments,
                                 head_bytes);
+                        kunmap(pages[0]);
                 }
                 if ((actual >= 0) && (head_bytes < actual) &&
                         (tail_bytes != 0)) {
-                        memcpy((char *)page_address(pages[num_pages - 1]) +
+                        memcpy((char *)kmap(pages[num_pages - 1]) +
                                 ((pagelist->offset + actual) &
                                 (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)),
                                 fragments + g_cache_line_size,
                                 tail_bytes);
+                        kunmap(pages[num_pages - 1]);
                 }
 
                 down(&g_free_fragments_mutex);
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 1c0c9553bc05..7dd38047ba23 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -246,11 +246,11 @@ struct mxser_port {
         unsigned char err_shadow;
 
         struct async_icount icount; /* kernel counters for 4 input interrupts */
-        int timeout;
+        unsigned int timeout;
 
         int read_status_mask;
         int ignore_status_mask;
-        int xmit_fifo_size;
+        unsigned int xmit_fifo_size;
         int xmit_head;
         int xmit_tail;
         int xmit_cnt;
@@ -572,8 +572,9 @@ static void mxser_dtr_rts(struct tty_port *port, int on)
 static int mxser_set_baud(struct tty_struct *tty, long newspd)
 {
         struct mxser_port *info = tty->driver_data;
-        int quot = 0, baud;
+        unsigned int quot = 0, baud;
         unsigned char cval;
+        u64 timeout;
 
         if (!info->ioaddr)
                 return -1;
@@ -594,8 +595,13 @@ static int mxser_set_baud(struct tty_struct *tty, long newspd)
                 quot = 0;
         }
 
-        info->timeout = ((info->xmit_fifo_size * HZ * 10 * quot) / info->baud_base);
-        info->timeout += HZ / 50;       /* Add .02 seconds of slop */
+        /*
+         * worst case (128 * 1000 * 10 * 18432) needs 35 bits, so divide in the
+         * u64 domain
+         */
+        timeout = (u64)info->xmit_fifo_size * HZ * 10 * quot;
+        do_div(timeout, info->baud_base);
+        info->timeout = timeout + HZ / 50; /* Add .02 seconds of slop */
 
         if (quot) {
                 info->MCR |= UART_MCR_DTR;
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 583c9a0c7ecc..8c48c3784831 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -507,9 +507,14 @@ static void bcm_uart_set_termios(struct uart_port *port,
 {
         unsigned int ctl, baud, quot, ier;
         unsigned long flags;
+        int tries;
 
         spin_lock_irqsave(&port->lock, flags);
 
+        /* Drain the hot tub fully before we power it off for the winter. */
+        for (tries = 3; !bcm_uart_tx_empty(port) && tries; tries--)
+                mdelay(10);
+
         /* disable uart while changing speed */
         bcm_uart_disable(port);
         bcm_uart_flush(port);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 849c1f9991ce..f0252184291e 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1276,7 +1276,6 @@ static void rx_dma_timer_init(struct lpuart_port *sport)
 static int lpuart_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned char temp;
 
@@ -1291,11 +1290,6 @@ static int lpuart_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                 UARTPFIFO_FIFOSIZE_MASK) + 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart_setup_watermark(sport);
@@ -1333,7 +1327,6 @@ static int lpuart_startup(struct uart_port *port)
 static int lpuart32_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned long temp;
 
@@ -1346,11 +1339,6 @@ static int lpuart32_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTFIFO_RXSIZE_OFF) &
                 UARTFIFO_FIFOSIZE_MASK) - 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart32_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart32_setup_watermark(sport);
@@ -1380,8 +1368,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
         spin_unlock_irqrestore(&port->lock, flags);
 
-        devm_free_irq(port->dev, port->irq, sport);
-
         if (sport->lpuart_dma_rx_use) {
                 del_timer_sync(&sport->lpuart_timer);
                 lpuart_dma_rx_free(&sport->port);
@@ -1400,7 +1386,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
 static void lpuart32_shutdown(struct uart_port *port)
 {
-        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
         unsigned long temp;
         unsigned long flags;
 
@@ -1413,8 +1398,6 @@ static void lpuart32_shutdown(struct uart_port *port)
         lpuart32_write(port, temp, UARTCTRL);
 
         spin_unlock_irqrestore(&port->lock, flags);
-
-        devm_free_irq(port->dev, port->irq, sport);
 }
 
 static void
@@ -2212,16 +2195,22 @@ static int lpuart_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, &sport->port);
 
-        if (lpuart_is_32(sport))
+        if (lpuart_is_32(sport)) {
                 lpuart_reg.cons = LPUART32_CONSOLE;
-        else
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0,
+                                        DRIVER_NAME, sport);
+        } else {
                 lpuart_reg.cons = LPUART_CONSOLE;
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0,
+                                        DRIVER_NAME, sport);
+        }
+
+        if (ret)
+                goto failed_irq_request;
 
         ret = uart_add_one_port(&lpuart_reg, &sport->port);
-        if (ret) {
-                clk_disable_unprepare(sport->clk);
-                return ret;
-        }
+        if (ret)
+                goto failed_attach_port;
 
         sport->dma_tx_chan = dma_request_slave_channel(sport->port.dev, "tx");
         if (!sport->dma_tx_chan)
@@ -2240,6 +2229,11 @@ static int lpuart_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+failed_attach_port:
+failed_irq_request:
+        clk_disable_unprepare(sport->clk);
+        return ret;
 }
 
 static int lpuart_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index cdd2f942317c..b9c7a904c1ea 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -889,7 +889,16 @@ static int sccnxp_probe(struct platform_device *pdev)
                         goto err_out;
                 uartclk = 0;
         } else {
-                clk_prepare_enable(clk);
+                ret = clk_prepare_enable(clk);
+                if (ret)
+                        goto err_out;
+
+                ret = devm_add_action_or_reset(&pdev->dev,
+                                (void(*)(void *))clk_disable_unprepare,
+                                clk);
+                if (ret)
+                        goto err_out;
+
                 uartclk = clk_get_rate(clk);
         }
 
@@ -988,7 +997,7 @@ static int sccnxp_probe(struct platform_device *pdev)
         uart_unregister_driver(&s->uart);
 err_out:
         if (!IS_ERR(s->regulator))
-                return regulator_disable(s->regulator);
+                regulator_disable(s->regulator);
 
         return ret;
 }
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 2fe216b276e2..84a8ac2a779f 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -694,10 +694,8 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         tty_set_termios_ldisc(tty, disc);
         retval = tty_ldisc_open(tty, tty->ldisc);
         if (retval) {
-                if (!WARN_ON(disc == N_TTY)) {
-                        tty_ldisc_put(tty->ldisc);
-                        tty->ldisc = NULL;
-                }
+                tty_ldisc_put(tty->ldisc);
+                tty->ldisc = NULL;
         }
         return retval;
 }
@@ -752,8 +750,9 @@ void tty_ldisc_hangup(struct tty_struct *tty, bool reinit)
 
         if (tty->ldisc) {
                 if (reinit) {
-                        if (tty_ldisc_reinit(tty, tty->termios.c_line) < 0)
-                                tty_ldisc_reinit(tty, N_TTY);
+                        if (tty_ldisc_reinit(tty, tty->termios.c_line) < 0 &&
+                            tty_ldisc_reinit(tty, N_TTY) < 0)
+                                WARN_ON(tty_ldisc_reinit(tty, N_NULL) < 0);
                 } else
                         tty_ldisc_kill(tty);
         }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 5e056064259c..18c923a4c16e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1832,6 +1832,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
         },
+        { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+        .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+        },
 
         { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
         .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 5aacea1978a5..3e865dbf878c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb)
         /*
          * only set a new error if there is no previous error.
          * Errors are only cleared during read/open
+         * Avoid propagating -EPIPE (stall) to userspace since it is
+         * better handled as an empty read
          */
-        if (desc->rerr  == 0)
+        if (desc->rerr == 0 && status != -EPIPE)
                 desc->rerr = status;
 
         if (length + desc->length > desc->wMaxCommand) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 4be52c602e9b..883549ee946c 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
                 } else if (header->bDescriptorType ==
                                 USB_DT_INTERFACE_ASSOCIATION) {
+                        struct usb_interface_assoc_descriptor *d;
+
+                        d = (struct usb_interface_assoc_descriptor *)header;
+                        if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+                                dev_warn(ddev,
+                                         "config %d has an invalid interface association descriptor of length %d, skipping\n",
+                                         cfgno, d->bLength);
+                                continue;
+                        }
+
                         if (iad_num == USB_MAXIADS) {
                                 dev_warn(ddev, "found more Interface "
                                                "Association Descriptors "
                                                "than allocated for in "
                                                "configuration %d\n", cfgno);
                         } else {
-                                config->intf_assoc[iad_num] =
-                                        (struct usb_interface_assoc_descriptor
-                                        *)header;
+                                config->intf_assoc[iad_num] = d;
                                 iad_num++;
                         }
 
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev)
                 }
 
                 if (dev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(100);
+                        msleep(200);
 
                 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                     bigbuffer, length);
@@ -952,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
         for (i = 0; i < num; i++) {
                 buffer += length;
                 cap = (struct usb_dev_cap_header *)buffer;
-                length = cap->bLength;
 
-                if (total_len < length)
+                if (total_len < sizeof(*cap) || total_len < cap->bLength) {
+                        dev->bos->desc->bNumDeviceCaps = i;
                         break;
+                }
+                length = cap->bLength;
                 total_len -= length;
 
                 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 318bb3b96687..e9326f31db8d 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644);
 MODULE_PARM_DESC(usbfs_memory_mb,
                 "maximum MB allowed for usbfs buffers (0 = no limit)");
 
+/* Hard limit, necessary to avoid arithmetic overflow */
+#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
+
 static atomic64_t usbfs_memory_usage;   /* Total memory currently allocated */
 
 /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                                 USBDEVFS_URB_ZERO_PACKET |
                                 USBDEVFS_URB_NO_INTERRUPT))
                 return -EINVAL;
+        if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
+                return -EINVAL;
         if (uurb->buffer_length > 0 && !uurb->buffer)
                 return -EINVAL;
         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 41eaf0b52518..e9ce6bb0b22d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2710,13 +2710,16 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
         if (!(portstatus & USB_PORT_STAT_CONNECTION))
                 return -ENOTCONN;
 
-        /* bomb out completely if the connection bounced.  A USB 3.0
-         * connection may bounce if multiple warm resets were issued,
+        /* Retry if connect change is set but status is still connected.
+         * A USB 3.0 connection may bounce if multiple warm resets were issued,
          * but the device may have successfully re-connected. Ignore it.
          */
         if (!hub_is_superspeed(hub->hdev) &&
-                        (portchange & USB_PORT_STAT_C_CONNECTION))
-                return -ENOTCONN;
+            (portchange & USB_PORT_STAT_C_CONNECTION)) {
+                usb_clear_port_feature(hub->hdev, port1,
+                                       USB_PORT_FEAT_C_CONNECTION);
+                return -EAGAIN;
+        }
 
         if (!(portstatus & USB_PORT_STAT_ENABLE))
                 return -EBUSY;
@@ -4838,7 +4841,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                         goto loop;
 
                 if (udev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(1000);
+                        msleep(2000);
 
                 /* consecutive bus-powered hubs aren't reliable; they can
                  * violate the voltage drop budget.  if the new child has
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4c38ea41ae96..371a07d874a3 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                         elength = 1;
                         goto next_desc;
                 }
+                if ((buflen < elength) || (elength < 3)) {
+                        dev_err(&intf->dev, "invalid descriptor buffer length\n");
+                        break;
+                }
                 if (buffer[1] != USB_DT_CS_INTERFACE) {
                         dev_err(&intf->dev, "skipping garbage\n");
                         goto next_desc;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 82806e311202..a6aaf2f193a4 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -221,6 +221,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Corsair Strafe RGB */
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
+        /* MIDI keyboard WORLDE MINI */
+        { USB_DEVICE(0x1c75, 0x0204), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* Acer C120 LED Projector */
         { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 4cef7d4f9cd0..a26d1fde0f5e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -177,6 +177,7 @@ static const struct of_device_id of_dwc3_simple_match[] = {
         { .compatible = "rockchip,rk3399-dwc3" },
         { .compatible = "xlnx,zynqmp-dwc3" },
         { .compatible = "cavium,octeon-7130-usb-uctl" },
+        { .compatible = "sprd,sc9860-dwc3" },
         { /* Sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 827e376bfa97..75e6cb044eb2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                 req->request.length, DWC3_TRBCTL_CONTROL_DATA,
                                 false);
+
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue];
+
                 ret = dwc3_ep0_start_trans(dep);
         }
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index dd74c99d6ce1..5d061b3d8224 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2026,6 +2026,8 @@ static DEVICE_ATTR_RO(suspended);
 static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
 {
         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_gadget_strings       *gstr = cdev->driver->strings[0];
+        struct usb_string               *dev_str = gstr->strings;
 
         /* composite_disconnect() must already have been called
          * by the underlying peripheral controller driver!
@@ -2045,6 +2047,9 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver)
 
         composite_dev_cleanup(cdev);
 
+        if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer)
+                dev_str[USB_GADGET_MANUFACTURER_IDX].s = "";
+
         kfree(cdev->def_manufacturer);
         kfree(cdev);
         set_gadget_data(gadget, NULL);
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index a22a892de7b7..aeb9f3c40521 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1143,11 +1143,12 @@ static struct configfs_attribute *interf_grp_attrs[] = {
         NULL
 };
 
-int usb_os_desc_prepare_interf_dir(struct config_group *parent,
-                                   int n_interf,
-                                   struct usb_os_desc **desc,
-                                   char **names,
-                                   struct module *owner)
+struct config_group *usb_os_desc_prepare_interf_dir(
+                struct config_group *parent,
+                int n_interf,
+                struct usb_os_desc **desc,
+                char **names,
+                struct module *owner)
 {
         struct config_group *os_desc_group;
         struct config_item_type *os_desc_type, *interface_type;
@@ -1159,7 +1160,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
 
         char *vlabuf = kzalloc(vla_group_size(data_chunk), GFP_KERNEL);
         if (!vlabuf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         os_desc_group = vla_ptr(vlabuf, data_chunk, os_desc_group);
         os_desc_type = vla_ptr(vlabuf, data_chunk, os_desc_type);
@@ -1184,7 +1185,7 @@ int usb_os_desc_prepare_interf_dir(struct config_group *parent,
                 configfs_add_default_group(&d->group, os_desc_group);
         }
 
-        return 0;
+        return os_desc_group;
 }
 EXPORT_SYMBOL(usb_os_desc_prepare_interf_dir);
 
diff --git a/drivers/usb/gadget/configfs.h b/drivers/usb/gadget/configfs.h
index 36c468c4f5e9..540d5e92ed22 100644
--- a/drivers/usb/gadget/configfs.h
+++ b/drivers/usb/gadget/configfs.h
@@ -5,11 +5,12 @@
 
 void unregister_gadget_item(struct config_item *item);
 
-int usb_os_desc_prepare_interf_dir(struct config_group *parent,
-                                   int n_interf,
-                                   struct usb_os_desc **desc,
-                                   char **names,
-                                   struct module *owner);
+struct config_group *usb_os_desc_prepare_interf_dir(
+                struct config_group *parent,
+                int n_interf,
+                struct usb_os_desc **desc,
+                char **names,
+                struct module *owner);
 
 static inline struct usb_os_desc *to_usb_os_desc(struct config_item *item)
 {
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 9990944a7245..8b342587f8ad 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -46,7 +46,8 @@
 static void ffs_data_get(struct ffs_data *ffs);
 static void ffs_data_put(struct ffs_data *ffs);
 /* Creates new ffs_data object. */
-static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
+static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
+        __attribute__((malloc));
 
 /* Opened counter handling. */
 static void ffs_data_opened(struct ffs_data *ffs);
@@ -780,11 +781,12 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
                                          struct usb_request *req)
 {
         struct ffs_io_data *io_data = req->context;
+        struct ffs_data *ffs = io_data->ffs;
 
         ENTER();
 
         INIT_WORK(&io_data->work, ffs_user_copy_worker);
-        schedule_work(&io_data->work);
+        queue_work(ffs->io_completion_wq, &io_data->work);
 }
 
 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
@@ -1500,7 +1502,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
         if (unlikely(ret < 0))
                 return ERR_PTR(ret);
 
-        ffs = ffs_data_new();
+        ffs = ffs_data_new(dev_name);
         if (unlikely(!ffs))
                 return ERR_PTR(-ENOMEM);
         ffs->file_perms = data.perms;
@@ -1610,6 +1612,7 @@ static void ffs_data_put(struct ffs_data *ffs)
                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
                        waitqueue_active(&ffs->ep0req_completion.wait) ||
                        waitqueue_active(&ffs->wait));
+                destroy_workqueue(ffs->io_completion_wq);
                 kfree(ffs->dev_name);
                 kfree(ffs);
         }
@@ -1642,7 +1645,7 @@ static void ffs_data_closed(struct ffs_data *ffs)
         ffs_data_put(ffs);
 }
 
-static struct ffs_data *ffs_data_new(void)
+static struct ffs_data *ffs_data_new(const char *dev_name)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
         if (unlikely(!ffs))
@@ -1650,6 +1653,12 @@ static struct ffs_data *ffs_data_new(void)
 
         ENTER();
 
+        ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
+        if (!ffs->io_completion_wq) {
+                kfree(ffs);
+                return NULL;
+        }
+
         refcount_set(&ffs->ref, 1);
         atomic_set(&ffs->opened, 0);
         ffs->state = FFS_READ_DESCRIPTORS;
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d6bd0244b008..5153e29870c3 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -307,8 +307,6 @@ struct fsg_common {
         struct completion       thread_notifier;
         struct task_struct      *thread_task;
 
-        /* Callback functions. */
-        const struct fsg_operations     *ops;
         /* Gadget's private data. */
         void                    *private_data;
 
@@ -2438,6 +2436,7 @@ static void handle_exception(struct fsg_common *common)
 static int fsg_main_thread(void *common_)
 {
         struct fsg_common       *common = common_;
+        int                     i;
 
         /*
          * Allow the thread to be killed by a signal, but set the signal mask
@@ -2476,21 +2475,16 @@ static int fsg_main_thread(void *common_)
         common->thread_task = NULL;
         spin_unlock_irq(&common->lock);
 
-        if (!common->ops || !common->ops->thread_exits
-         || common->ops->thread_exits(common) < 0) {
-                int i;
+        /* Eject media from all LUNs */
 
-                down_write(&common->filesem);
-                for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
-                        struct fsg_lun *curlun = common->luns[i];
-                        if (!curlun || !fsg_lun_is_open(curlun))
-                                continue;
+        down_write(&common->filesem);
+        for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
+                struct fsg_lun *curlun = common->luns[i];
 
+                if (curlun && fsg_lun_is_open(curlun))
                         fsg_lun_close(curlun);
-                        curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
-                }
-                up_write(&common->filesem);
         }
+        up_write(&common->filesem);
 
         /* Let fsg_unbind() know the thread has exited */
         complete_and_exit(&common->thread_notifier, 0);
@@ -2681,13 +2675,6 @@ void fsg_common_remove_luns(struct fsg_common *common)
 }
 EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops)
-{
-        common->ops = ops;
-}
-EXPORT_SYMBOL_GPL(fsg_common_set_ops);
-
 void fsg_common_free_buffers(struct fsg_common *common)
 {
         _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h
index d3902313b8ac..dc05ca0c4359 100644
--- a/drivers/usb/gadget/function/f_mass_storage.h
+++ b/drivers/usb/gadget/function/f_mass_storage.h
@@ -60,17 +60,6 @@ struct fsg_module_parameters {
 struct fsg_common;
 
 /* FSF callback functions */
-struct fsg_operations {
-        /*
-         * Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set).
-         */
-        int (*thread_exits)(struct fsg_common *common);
-};
-
 struct fsg_lun_opts {
         struct config_group group;
         struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun);
 
 void fsg_common_remove_luns(struct fsg_common *common);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops);
-
 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
                           unsigned int id, const char *name,
                           const char **name_pfx);
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 8df244fc9d80..ea0da35a44e2 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -555,6 +555,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         size_t                  size;   /* Amount of data in a TX request. */
         size_t                  bytes_copied = 0;
         struct usb_request      *req;
+        int                     value;
 
         DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
 
@@ -634,7 +635,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         return -EAGAIN;
                 }
 
-                if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
+                /* here, we unlock, and only unlock, to avoid deadlock. */
+                spin_unlock(&dev->lock);
+                value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
+                spin_lock(&dev->lock);
+                if (value) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
                         mutex_unlock(&dev->lock_printer_io);
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index e1d5853ef1e4..c7c5b3ce1d98 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -908,6 +908,7 @@ static void rndis_free_inst(struct usb_function_instance *f)
                         free_netdev(opts->net);
         }
 
+        kfree(opts->rndis_interf_group);        /* single VLA chunk */
         kfree(opts);
 }
 
@@ -916,6 +917,7 @@ static struct usb_function_instance *rndis_alloc_inst(void)
         struct f_rndis_opts *opts;
         struct usb_os_desc *descs[1];
         char *names[1];
+        struct config_group *rndis_interf_group;
 
         opts = kzalloc(sizeof(*opts), GFP_KERNEL);
         if (!opts)
@@ -940,8 +942,14 @@ static struct usb_function_instance *rndis_alloc_inst(void)
         names[0] = "rndis";
         config_group_init_type_name(&opts->func_inst.group, "",
                                     &rndis_func_type);
-        usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
-                                       names, THIS_MODULE);
+        rndis_interf_group =
+                usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
+                                               names, THIS_MODULE);
+        if (IS_ERR(rndis_interf_group)) {
+                rndis_free_inst(&opts->func_inst);
+                return ERR_CAST(rndis_interf_group);
+        }
+        opts->rndis_interf_group = rndis_interf_group;
 
         return &opts->func_inst;
 }
diff --git a/drivers/usb/gadget/function/u_fs.h b/drivers/usb/gadget/function/u_fs.h
index 540f1c48c1a8..79f70ebf85dc 100644
--- a/drivers/usb/gadget/function/u_fs.h
+++ b/drivers/usb/gadget/function/u_fs.h
@@ -279,6 +279,7 @@ struct ffs_data {
         }                               file_perms;
 
         struct eventfd_ctx *ffs_eventfd;
+        struct workqueue_struct *io_completion_wq;
         bool no_disconnect;
         struct work_struct reset_work;
 
diff --git a/drivers/usb/gadget/function/u_rndis.h b/drivers/usb/gadget/function/u_rndis.h
index a35ee3c2545d..efdb7ac381d9 100644
--- a/drivers/usb/gadget/function/u_rndis.h
+++ b/drivers/usb/gadget/function/u_rndis.h
@@ -26,6 +26,7 @@ struct f_rndis_opts {
         bool                            bound;
         bool                            borrowed_net;
 
+        struct config_group             *rndis_interf_group;
         struct usb_os_desc              rndis_os_desc;
         char                            rndis_ext_compat_id[16];
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 684900fcfe24..5c28bee327e1 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -28,7 +28,7 @@
 #include <linux/aio.h>
 #include <linux/uio.h>
 #include <linux/refcount.h>
-
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 
@@ -116,6 +116,7 @@ enum ep0_state {
 struct dev_data {
         spinlock_t                      lock;
         refcount_t                      count;
+        int                             udc_usage;
         enum ep0_state                  state;          /* P: lock */
         struct usb_gadgetfs_event       event [N_EVENT];
         unsigned                        ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                 INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
-        spin_unlock(&epdata->dev->lock);
 
         usb_ep_free_request(ep, req);
+        spin_unlock(&epdata->dev->lock);
         put_ep(epdata);
 }
 
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                         struct usb_request      *req = dev->req;
 
                         if ((retval = setup_req (ep, req, 0)) == 0) {
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 retval = usb_ep_queue (ep, req, GFP_KERNEL);
                                 spin_lock_irq (&dev->lock);
+                                --dev->udc_usage;
                         }
                         dev->state = STATE_DEV_CONNECTED;
 
@@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                                 retval = -EIO;
                         else {
                                 len = min (len, (size_t)dev->req->actual);
-// FIXME don't call this with the spinlock held ...
+                                ++dev->udc_usage;
+                                spin_unlock_irq(&dev->lock);
                                 if (copy_to_user (buf, dev->req->buf, len))
                                         retval = -EFAULT;
                                 else
                                         retval = len;
+                                spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 clean_req (dev->gadget->ep0, dev->req);
                                 /* NOTE userspace can't yet choose to stall */
                         }
@@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         retval = setup_req (dev->gadget->ep0, dev->req, len);
                         if (retval == 0) {
                                 dev->state = STATE_DEV_CONNECTED;
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 if (copy_from_user (dev->req->buf, buf, len))
                                         retval = -EFAULT;
@@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                                                 GFP_KERNEL);
                                 }
                                 spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 if (retval < 0) {
                                         clean_req (dev->gadget->ep0, dev->req);
                                 } else
@@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         struct usb_gadget       *gadget = dev->gadget;
         long ret = -ENOTTY;
 
-        if (gadget->ops->ioctl)
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_DEV_OPENED ||
+                        dev->state == STATE_DEV_UNBOUND) {
+                /* Not bound to a UDC */
+        } else if (gadget->ops->ioctl) {
+                ++dev->udc_usage;
+                spin_unlock_irq(&dev->lock);
+
                 ret = gadget->ops->ioctl (gadget, code, value);
 
+                spin_lock_irq(&dev->lock);
+                --dev->udc_usage;
+        }
+        spin_unlock_irq(&dev->lock);
+
         return ret;
 }
 
@@ -1463,10 +1483,12 @@ delegate:
                                 if (value < 0)
                                         break;
 
+                                ++dev->udc_usage;
                                 spin_unlock (&dev->lock);
                                 value = usb_ep_queue (gadget->ep0, dev->req,
                                                         GFP_KERNEL);
                                 spin_lock (&dev->lock);
+                                --dev->udc_usage;
                                 if (value < 0) {
                                         clean_req (gadget->ep0, dev->req);
                                         break;
@@ -1490,8 +1512,12 @@ delegate:
                 req->length = value;
                 req->zero = value < w_length;
 
+                ++dev->udc_usage;
                 spin_unlock (&dev->lock);
                 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+                spin_lock(&dev->lock);
+                --dev->udc_usage;
+                spin_unlock(&dev->lock);
                 if (value < 0) {
                         DBG (dev, "ep_queue --> %d\n", value);
                         req->status = 0;
@@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev)
                 /* break link to FS */
                 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
                 list_del_init (&ep->epfiles);
+                spin_unlock_irq (&dev->lock);
+
                 dentry = ep->dentry;
                 ep->dentry = NULL;
                 parent = d_inode(dentry->d_parent);
 
                 /* break link to controller */
+                mutex_lock(&ep->lock);
                 if (ep->state == STATE_EP_ENABLED)
                         (void) usb_ep_disable (ep->ep);
                 ep->state = STATE_EP_UNBOUND;
                 usb_ep_free_request (ep->ep, ep->req);
                 ep->ep = NULL;
+                mutex_unlock(&ep->lock);
+
                 wake_up (&ep->wait);
                 put_ep (ep);
 
-                spin_unlock_irq (&dev->lock);
-
                 /* break link to dcache */
                 inode_lock(parent);
                 d_delete (dentry);
@@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget)
 
         spin_lock_irq (&dev->lock);
         dev->state = STATE_DEV_UNBOUND;
+        while (dev->udc_usage > 0) {
+                spin_unlock_irq(&dev->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dev->lock);
+        }
         spin_unlock_irq (&dev->lock);
 
         destroy_ep_files (dev);
diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c
index e99ab57ee3e5..fcba59782f26 100644
--- a/drivers/usb/gadget/legacy/mass_storage.c
+++ b/drivers/usb/gadget/legacy/mass_storage.c
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
 
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
 
-static unsigned long msg_registered;
-static void msg_cleanup(void);
-
-static int msg_thread_exits(struct fsg_common *common)
-{
-        msg_cleanup();
-        return 0;
-}
-
 static int msg_do_config(struct usb_configuration *c)
 {
         struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = {
 
 static int msg_bind(struct usb_composite_dev *cdev)
 {
-        static const struct fsg_operations ops = {
-                .thread_exits = msg_thread_exits,
-        };
         struct fsg_opts *opts;
         struct fsg_config config;
         int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev)
         if (status)
                 goto fail;
 
-        fsg_common_set_ops(opts->common, &ops);
-
         status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
         if (status)
                 goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL");
 
 static int __init msg_init(void)
 {
-        int ret;
-
-        ret = usb_composite_probe(&msg_driver);
-        set_bit(0, &msg_registered);
-
-        return ret;
+        return usb_composite_probe(&msg_driver);
 }
 module_init(msg_init);
 
-static void msg_cleanup(void)
+static void __exit msg_cleanup(void)
 {
-        if (test_and_clear_bit(0, &msg_registered))
-                usb_composite_unregister(&msg_driver);
+        usb_composite_unregister(&msg_driver);
 }
 module_exit(msg_cleanup);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 7cd5c969fcbe..1e9567091d86 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -273,6 +273,7 @@ config USB_SNP_CORE
 config USB_SNP_UDC_PLAT
         tristate "Synopsys USB 2.0 Device controller"
         depends on USB_GADGET && OF && HAS_DMA
+        depends on EXTCON || EXTCON=n
         select USB_GADGET_DUALSPEED
         select USB_SNP_CORE
         default ARCH_BCM_IPROC
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 98d71400f8a1..a884c022df7a 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -29,6 +29,8 @@
 #include <linux/of_gpio.h>
 
 #include "atmel_usba_udc.h"
+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \
+                           | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)
 
 #ifdef CONFIG_USB_GADGET_DEBUG_FS
 #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev)
                                         IRQ_NOAUTOEN);
                         ret = devm_request_threaded_irq(&pdev->dev,
                                         gpio_to_irq(udc->vbus_pin), NULL,
-                                        usba_vbus_irq_thread, IRQF_ONESHOT,
+                                        usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS,
                                         "atmel_usba_udc", udc);
                         if (ret) {
                                 udc->vbus_pin = -ENODEV;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 75c51ca4ee0f..d41d07aae0ce 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1320,8 +1320,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
         udc->dev.driver = &driver->driver;
         udc->gadget->dev.driver = &driver->driver;
 
-        if (driver->max_speed < udc->gadget->max_speed)
-                usb_gadget_udc_set_speed(udc, driver->max_speed);
+        usb_gadget_udc_set_speed(udc, driver->max_speed);
 
         ret = driver->bind(udc->gadget, driver);
         if (ret)
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index a030d7923d7d..f04e91ef9e7c 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -237,6 +237,8 @@ struct dummy_hcd {
 
         struct usb_device               *udev;
         struct list_head                urbp_list;
+        struct urbp                     *next_frame_urbp;
+
         u32                             stream_en_ep;
         u8                              num_stream[30 / 2];
 
@@ -253,11 +255,13 @@ struct dummy {
          */
         struct dummy_ep                 ep[DUMMY_ENDPOINTS];
         int                             address;
+        int                             callback_usage;
         struct usb_gadget               gadget;
         struct usb_gadget_driver        *driver;
         struct dummy_request            fifo_req;
         u8                              fifo_buf[FIFO_SIZE];
         u16                             devstatus;
+        unsigned                        ints_enabled:1;
         unsigned                        udc_suspended:1;
         unsigned                        pullup:1;
 
@@ -375,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
                              USB_PORT_STAT_CONNECTION) == 0)
                                 dum_hcd->port_status |=
                                         (USB_PORT_STAT_C_CONNECTION << 16);
-                        if ((dum_hcd->port_status &
-                             USB_PORT_STAT_ENABLE) == 1 &&
-                                (dum_hcd->port_status &
-                                 USB_SS_PORT_LS_U0) == 1 &&
-                                dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
+                        if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
+                            (dum_hcd->port_status &
+                             USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
+                            dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
                                 dum_hcd->active = 1;
                 }
         } else {
@@ -416,6 +419,7 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
 static void set_link_state(struct dummy_hcd *dum_hcd)
 {
         struct dummy *dum = dum_hcd->dum;
+        unsigned int power_bit;
 
         dum_hcd->active = 0;
         if (dum->pullup)
@@ -426,32 +430,43 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                         return;
 
         set_link_state_by_speed(dum_hcd);
+        power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ?
+                        USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER);
 
         if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 ||
              dum_hcd->active)
                 dum_hcd->resuming = 0;
 
         /* Currently !connected or in reset */
-        if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 ||
+        if ((dum_hcd->port_status & power_bit) == 0 ||
                         (dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) {
-                unsigned disconnect = USB_PORT_STAT_CONNECTION &
+                unsigned int disconnect = power_bit &
                                 dum_hcd->old_status & (~dum_hcd->port_status);
-                unsigned reset = USB_PORT_STAT_RESET &
+                unsigned int reset = USB_PORT_STAT_RESET &
                                 (~dum_hcd->old_status) & dum_hcd->port_status;
 
                 /* Report reset and disconnect events to the driver */
-                if (dum->driver && (disconnect || reset)) {
+                if (dum->ints_enabled && (disconnect || reset)) {
                         stop_activity(dum);
+                        ++dum->callback_usage;
+                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
+                        spin_lock(&dum->lock);
+                        --dum->callback_usage;
                 }
-        } else if (dum_hcd->active != dum_hcd->old_active) {
+        } else if (dum_hcd->active != dum_hcd->old_active &&
+                        dum->ints_enabled) {
+                ++dum->callback_usage;
+                spin_unlock(&dum->lock);
                 if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
                 else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
+                spin_lock(&dum->lock);
+                --dum->callback_usage;
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -972,8 +987,11 @@ static int dummy_udc_start(struct usb_gadget *g,
          * can't enumerate without help from the driver we're binding.
          */
 
+        spin_lock_irq(&dum->lock);
         dum->devstatus = 0;
         dum->driver = driver;
+        dum->ints_enabled = 1;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
@@ -984,6 +1002,16 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy            *dum = dum_hcd->dum;
 
         spin_lock_irq(&dum->lock);
+        dum->ints_enabled = 0;
+        stop_activity(dum);
+
+        /* emulate synchronize_irq(): wait for callbacks to finish */
+        while (dum->callback_usage > 0) {
+                spin_unlock_irq(&dum->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dum->lock);
+        }
+
         dum->driver = NULL;
         spin_unlock_irq(&dum->lock);
 
@@ -1037,7 +1065,12 @@ static int dummy_udc_probe(struct platform_device *pdev)
         memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
-        dum->gadget.max_speed = USB_SPEED_SUPER;
+        if (mod_data.is_super_speed)
+                dum->gadget.max_speed = USB_SPEED_SUPER;
+        else if (mod_data.is_high_speed)
+                dum->gadget.max_speed = USB_SPEED_HIGH;
+        else
+                dum->gadget.max_speed = USB_SPEED_FULL;
 
         dum->gadget.dev.parent = &pdev->dev;
         init_dummy_udc_hw(dum);
@@ -1246,6 +1279,8 @@ static int dummy_urb_enqueue(
 
         list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
         urb->hcpriv = urbp;
+        if (!dum_hcd->next_frame_urbp)
+                dum_hcd->next_frame_urbp = urbp;
         if (usb_pipetype(urb->pipe) == PIPE_CONTROL)
                 urb->error_count = 1;           /* mark as a new urb */
 
@@ -1521,6 +1556,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address)
         if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
                         dum->ss_hcd : dum->hs_hcd)))
                 return NULL;
+        if (!dum->ints_enabled)
+                return NULL;
         if ((address & ~USB_DIR_IN) == 0)
                 return &dum->ep[0];
         for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1762,6 +1799,7 @@ static void dummy_timer(unsigned long _dum_hcd)
                 spin_unlock_irqrestore(&dum->lock, flags);
                 return;
         }
+        dum_hcd->next_frame_urbp = NULL;
 
         for (i = 0; i < DUMMY_ENDPOINTS; i++) {
                 if (!ep_info[i].name)
@@ -1778,6 +1816,10 @@ restart:
                 int                     type;
                 int                     status = -EINPROGRESS;
 
+                /* stop when we reach URBs queued after the timer interrupt */
+                if (urbp == dum_hcd->next_frame_urbp)
+                        break;
+
                 urb = urbp->urb;
                 if (urb->unlinked)
                         goto return_urb;
@@ -1857,10 +1899,12 @@ restart:
                          * until setup() returns; no reentrancy issues etc.
                          */
                         if (value > 0) {
+                                ++dum->callback_usage;
                                 spin_unlock(&dum->lock);
                                 value = dum->driver->setup(&dum->gadget,
                                                 &setup);
                                 spin_lock(&dum->lock);
+                                --dum->callback_usage;
 
                                 if (value >= 0) {
                                         /* no delays (max 64KB data stage) */
@@ -2561,8 +2605,6 @@ static struct hc_driver dummy_hcd = {
         .product_desc =         "Dummy host controller",
         .hcd_priv_size =        sizeof(struct dummy_hcd),
 
-        .flags =                HCD_USB3 | HCD_SHARED,
-
         .reset =                dummy_setup,
         .start =                dummy_start,
         .stop =                 dummy_stop,
@@ -2591,8 +2633,12 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
         dum = *((void **)dev_get_platdata(&pdev->dev));
 
-        if (!mod_data.is_super_speed)
+        if (mod_data.is_super_speed)
+                dummy_hcd.flags = HCD_USB3 | HCD_SHARED;
+        else if (mod_data.is_high_speed)
                 dummy_hcd.flags = HCD_USB2;
+        else
+                dummy_hcd.flags = HCD_USB11;
         hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
         if (!hs_hcd)
                 return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index df37c1e6e9d5..63a206122058 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1038,7 +1038,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                         usb3_ep->ep.maxpacket);
         u8 *buf = usb3_req->req.buf + usb3_req->req.actual;
         u32 tmp = 0;
-        bool is_last;
+        bool is_last = !len ? true : false;
 
         if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0)
                 return -EBUSY;
@@ -1059,7 +1059,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                 usb3_write(usb3, tmp, fifo_reg);
         }
 
-        is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
+        if (!is_last)
+                is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
         /* Send the data */
         usb3_set_px_con_send(usb3_ep, len, is_last);
 
@@ -1150,7 +1151,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep,
                 usb3_set_p0_con_for_ctrl_read_data(usb3);
         } else {
                 usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD);
-                usb3_set_p0_con_for_ctrl_write_data(usb3);
+                if (usb3_req->req.length)
+                        usb3_set_p0_con_for_ctrl_write_data(usb3);
         }
 
         usb3_p0_xfer(usb3_ep, usb3_req);
@@ -2053,7 +2055,16 @@ static u32 usb3_calc_ramarea(int ram_size)
 static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep,
                                 const struct usb_endpoint_descriptor *desc)
 {
-        return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc));
+        int i;
+        const u32 max_packet_array[] = {8, 16, 32, 64, 512};
+        u32 mpkt = PN_RAMMAP_MPKT(1024);
+
+        for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) {
+                if (usb_endpoint_maxp(desc) <= max_packet_array[i])
+                        mpkt = PN_RAMMAP_MPKT(max_packet_array[i]);
+        }
+
+        return usb3_ep->rammap_val | mpkt;
 }
 
 static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 658d9d1f9ea3..6dda3623a276 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev)
                 if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
                         return 0;
 
-                usleep_range(40, 60);
+                udelay(50);
         }
 
         dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports);
  *
  * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
  * It signals to the BIOS that the OS wants control of the host controller,
- * and then waits 5 seconds for the BIOS to hand over control.
+ * and then waits 1 second for the BIOS to hand over control.
  * If we timeout, assume the BIOS is broken and take control anyway.
  */
 static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
         if (val & XHCI_HC_BIOS_OWNED) {
                 writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
-                /* Wait for 5 seconds with 10 microsecond polling interval */
+                /* Wait for 1 second with 10 microsecond polling interval */
                 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
-                                0, 5000, 10);
+                                0, 1000000, 10);
 
                 /* Assume a buggy BIOS and take HC ownership anyway */
                 if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init:
          * operational or runtime registers.  Wait 5 seconds and no more.
          */
         timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
-                        5000, 10);
+                        5000000, 10);
         /* Assume a buggy HC and start HC initialization anyway */
         if (timeout) {
                 val = readl(op_reg_base + XHCI_STS_OFFSET);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index ad89a6d4111b..a2336deb5e36 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
 
         /* If PSI table exists, add the custom speed attributes from it */
         if (usb3_1 && xhci->usb3_rhub.psi_count) {
-                u32 ssp_cap_base, bm_attrib, psi;
+                u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
                 int offset;
 
                 ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
                 for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
                         psi = xhci->usb3_rhub.psi[i];
                         psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
+                        psi_exp = XHCI_EXT_PORT_PSIE(psi);
+                        psi_mant = XHCI_EXT_PORT_PSIM(psi);
+
+                        /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */
+                        for (; psi_exp < 3; psi_exp++)
+                                psi_mant /= 1000;
+                        if (psi_mant >= 10)
+                                psi |= BIT(14);
+
                         if ((psi & PLT_MASK) == PLT_SYM) {
                         /* Symmetric, create SSA RX and TX from one PSI entry */
                                 put_unaligned_le32(psi, &buf[offset]);
@@ -411,14 +420,25 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                                                      GFP_NOWAIT);
                         if (!command) {
                                 spin_unlock_irqrestore(&xhci->lock, flags);
-                                xhci_free_command(xhci, cmd);
-                                return -ENOMEM;
+                                ret = -ENOMEM;
+                                goto cmd_cleanup;
+                        }
+
+                        ret = xhci_queue_stop_endpoint(xhci, command, slot_id,
+                                                       i, suspend);
+                        if (ret) {
+                                spin_unlock_irqrestore(&xhci->lock, flags);
+                                xhci_free_command(xhci, command);
+                                goto cmd_cleanup;
                         }
-                        xhci_queue_stop_endpoint(xhci, command, slot_id, i,
-                                                 suspend);
                 }
         }
-        xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
+        ret = xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
+        if (ret) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                goto cmd_cleanup;
+        }
+
         xhci_ring_cmd_db(xhci);
         spin_unlock_irqrestore(&xhci->lock, flags);
 
@@ -430,6 +450,8 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                 xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
                 ret = -ETIME;
         }
+
+cmd_cleanup:
         xhci_free_command(xhci, cmd);
         return ret;
 }
@@ -1506,9 +1528,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                 t2 &= ~PORT_WKDISC_E;
                         }
-                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
-                            (hcd->speed < HCD_USB3))
-                                t2 &= ~PORT_WAKE_BITS;
                 } else
                         t2 &= ~PORT_WAKE_BITS;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8071c8fdd15e..76f392954733 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -54,11 +54,6 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
-
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 
 static const char hcd_name[] = "xhci_hcd";
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
-        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
-                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
-                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
-
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 163bafde709f..1cb6eaef4ae1 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -178,14 +178,18 @@ static int xhci_plat_probe(struct platform_device *pdev)
          * 2. xhci_plat is child of a device from firmware (dwc3-plat)
          * 3. xhci_plat is grandchild of a pci device (dwc3-pci)
          */
-        sysdev = &pdev->dev;
-        if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node)
-                sysdev = sysdev->parent;
+        for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) {
+                if (is_of_node(sysdev->fwnode) ||
+                        is_acpi_device_node(sysdev->fwnode))
+                        break;
 #ifdef CONFIG_PCI
-        else if (sysdev->parent && sysdev->parent->parent &&
-                 sysdev->parent->parent->bus == &pci_bus_type)
-                sysdev = sysdev->parent->parent;
+                else if (sysdev->bus == &pci_bus_type)
+                        break;
 #endif
+        }
+
+        if (!sysdev)
+                sysdev = &pdev->dev;
 
         /* Try to set 64-bit DMA first */
         if (WARN_ON(!sysdev->dma_mask))
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a9443651ce0f..82c746e2d85c 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1309,6 +1309,7 @@ static void xhci_complete_del_and_free_cmd(struct xhci_command *cmd, u32 status)
 void xhci_cleanup_command_queue(struct xhci_hcd *xhci)
 {
         struct xhci_command *cur_cmd, *tmp_cmd;
+        xhci->current_cmd = NULL;
         list_for_each_entry_safe(cur_cmd, tmp_cmd, &xhci->cmd_list, cmd_list)
                 xhci_complete_del_and_free_cmd(cur_cmd, COMP_COMMAND_ABORTED);
 }
@@ -2579,15 +2580,21 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                 (struct xhci_generic_trb *) ep_trb);
 
                 /*
-                 * No-op TRB should not trigger interrupts.
-                 * If ep_trb is a no-op TRB, it means the
-                 * corresponding TD has been cancelled. Just ignore
-                 * the TD.
+                 * No-op TRB could trigger interrupts in a case where
+                 * a URB was killed and a STALL_ERROR happens right
+                 * after the endpoint ring stopped. Reset the halted
+                 * endpoint. Otherwise, the endpoint remains stalled
+                 * indefinitely.
                  */
                 if (trb_is_noop(ep_trb)) {
-                        xhci_dbg(xhci,
-                                 "ep_trb is a no-op TRB. Skip it for slot %u ep %u\n",
-                                 slot_id, ep_index);
+                        if (trb_comp_code == COMP_STALL_ERROR ||
+                            xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
+                                                              trb_comp_code))
+                                xhci_cleanup_halted_endpoint(xhci, slot_id,
+                                                             ep_index,
+                                                             ep_ring->stream_id,
+                                                             td, ep_trb,
+                                                             EP_HARD_RESET);
                         goto cleanup;
                 }
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b2ff1ff1a02f..51535ba2bcd4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         if (xhci->quirks & XHCI_MTK_HOST) {
                 ret = xhci_mtk_add_ep_quirk(hcd, udev, ep);
                 if (ret < 0) {
-                        xhci_free_endpoint_ring(xhci, virt_dev, ep_index);
+                        xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring);
+                        virt_dev->eps[ep_index].new_ring = NULL;
                         return ret;
                 }
         }
@@ -4804,7 +4805,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                  */
                 hcd->has_tt = 1;
         } else {
-                if (xhci->sbrn == 0x31) {
+                /* Some 3.1 hosts return sbrn 0x30, can't rely on sbrn alone */
+                if (xhci->sbrn == 0x31 || xhci->usb3_rhub.min_rev >= 1) {
                         xhci_info(xhci, "Host supports USB 3.1 Enhanced SuperSpeed\n");
                         hcd->speed = HCD_USB31;
                         hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2abaa4d6d39d..2b48aa4f6b76 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -735,6 +735,8 @@ struct xhci_ep_ctx {
 #define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
+/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)   (((p) >> 24) & 0xff)
 
 /* ep_info2 bitmasks */
 /*
@@ -1681,7 +1683,7 @@ struct xhci_bus_state {
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
-        if (hcd->speed == HCD_USB3)
+        if (hcd->speed >= HCD_USB3)
                 return 0;
         else
                 return 1;
@@ -1826,7 +1828,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-#define XHCI_U2_DISABLE_WAKE    (1 << 27)
+/* Reserved. It was XHCI_U2_DISABLE_WAKE */
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 
         unsigned int            num_active_eps;
@@ -2540,8 +2542,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
         u8 lsa;
         u8 hid;
 
-        esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 |
-                EP_MAX_ESIT_PAYLOAD_LO(tx_info);
+        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
+                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
 
         ep_state = info & EP_STATE_MASK;
         max_pstr = info & EP_MAXPSTREAMS_MASK;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index eee82ca55b7b..b3fc602b2e24 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -202,12 +202,13 @@ found:
                         return tmp;
         }
 
-        if (in) {
+        if (in)
                 dev->in_pipe = usb_rcvbulkpipe(udev,
                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+        if (out)
                 dev->out_pipe = usb_sndbulkpipe(udev,
                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-        }
+
         if (iso_in) {
                 dev->iso_in = &iso_in->desc;
                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
@@ -1964,6 +1965,9 @@ test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param,
         int                     status = 0;
         struct urb              *urbs[param->sglen];
 
+        if (!param->sglen || param->iterations > UINT_MAX / param->sglen)
+                return -EINVAL;
+
         memset(&context, 0, sizeof(context));
         context.count = param->iterations * param->sglen;
         context.dev = dev;
@@ -2087,6 +2091,8 @@ usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
 
         if (param->iterations <= 0)
                 return -EINVAL;
+        if (param->sglen > MAX_SGLEN)
+                return -EINVAL;
         /*
          * Just a bunch of test cases that every HCD is expected to handle.
          *
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 029692053dd3..ff5a1a8989d5 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -906,7 +906,7 @@ b_host:
          */
         if (int_usb & MUSB_INTR_RESET) {
                 handled = IRQ_HANDLED;
-                if (devctl & MUSB_DEVCTL_HM) {
+                if (is_host_active(musb)) {
                         /*
                          * When BABBLE happens what we can depends on which
                          * platform MUSB is running, because some platforms
@@ -916,9 +916,7 @@ b_host:
                          * drop the session.
                          */
                         dev_err(musb->controller, "Babble\n");
-
-                        if (is_host_active(musb))
-                                musb_recover_from_babble(musb);
+                        musb_recover_from_babble(musb);
                 } else {
                         musb_dbg(musb, "BUS RESET as %s",
                                 usb_otg_state_string(musb->xceiv->otg->state));
@@ -1861,22 +1859,22 @@ static void musb_pm_runtime_check_session(struct musb *musb)
                 MUSB_DEVCTL_HR;
         switch (devctl & ~s) {
         case MUSB_QUIRK_B_INVALID_VBUS_91:
-                if (musb->quirk_retries--) {
+                if (musb->quirk_retries && !musb->flush_irq_work) {
                         musb_dbg(musb,
                                  "Poll devctl on invalid vbus, assume no session");
                         schedule_delayed_work(&musb->irq_work,
                                               msecs_to_jiffies(1000));
-
+                        musb->quirk_retries--;
                         return;
                 }
                 /* fall through */
         case MUSB_QUIRK_A_DISCONNECT_19:
-                if (musb->quirk_retries--) {
+                if (musb->quirk_retries && !musb->flush_irq_work) {
                         musb_dbg(musb,
                                  "Poll devctl on possible host mode disconnect");
                         schedule_delayed_work(&musb->irq_work,
                                               msecs_to_jiffies(1000));
-
+                        musb->quirk_retries--;
                         return;
                 }
                 if (!musb->session)
@@ -2681,8 +2679,15 @@ static int musb_suspend(struct device *dev)
 
         musb_platform_disable(musb);
         musb_disable_interrupts(musb);
+
+        musb->flush_irq_work = true;
+        while (flush_delayed_work(&musb->irq_work))
+                ;
+        musb->flush_irq_work = false;
+
         if (!(musb->io.quirks & MUSB_PRESERVE_SESSION))
                 musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+
         WARN_ON(!list_empty(&musb->pending_list));
 
         spin_lock_irqsave(&musb->lock, flags);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index c748f4ac1154..20f4614178d9 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -428,6 +428,8 @@ struct musb {
         unsigned                test_mode:1;
         unsigned                softconnect:1;
 
+        unsigned                flush_irq_work:1;
+
         u8                      address;
         u8                      test_mode_nr;
         u16                     ackpend;                /* ep0 */
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index ba255280a624..1ec0a4947b6b 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -26,15 +26,28 @@
 
 #define MUSB_DMA_NUM_CHANNELS 15
 
+#define DA8XX_USB_MODE          0x10
+#define DA8XX_USB_AUTOREQ       0x14
+#define DA8XX_USB_TEARDOWN      0x1c
+
+#define DA8XX_DMA_NUM_CHANNELS 4
+
 struct cppi41_dma_controller {
         struct dma_controller controller;
-        struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
-        struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS];
+        struct cppi41_dma_channel *rx_channel;
+        struct cppi41_dma_channel *tx_channel;
         struct hrtimer early_tx;
         struct list_head early_tx_list;
         u32 rx_mode;
         u32 tx_mode;
         u32 auto_req;
+
+        u32 tdown_reg;
+        u32 autoreq_reg;
+
+        void (*set_dma_mode)(struct cppi41_dma_channel *cppi41_channel,
+                             unsigned int mode);
+        u8 num_channels;
 };
 
 static void save_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
@@ -349,6 +362,32 @@ static void cppi41_set_dma_mode(struct cppi41_dma_channel *cppi41_channel,
         }
 }
 
+static void da8xx_set_dma_mode(struct cppi41_dma_channel *cppi41_channel,
+                unsigned int mode)
+{
+        struct cppi41_dma_controller *controller = cppi41_channel->controller;
+        struct musb *musb = controller->controller.musb;
+        unsigned int shift;
+        u32 port;
+        u32 new_mode;
+        u32 old_mode;
+
+        old_mode = controller->tx_mode;
+        port = cppi41_channel->port_num;
+
+        shift = (port - 1) * 4;
+        if (!cppi41_channel->is_tx)
+                shift += 16;
+        new_mode = old_mode & ~(3 << shift);
+        new_mode |= mode << shift;
+
+        if (new_mode == old_mode)
+                return;
+        controller->tx_mode = new_mode;
+        musb_writel(musb->ctrl_base, DA8XX_USB_MODE, new_mode);
+}
+
+
 static void cppi41_set_autoreq_mode(struct cppi41_dma_channel *cppi41_channel,
                 unsigned mode)
 {
@@ -364,8 +403,8 @@ static void cppi41_set_autoreq_mode(struct cppi41_dma_channel *cppi41_channel,
         if (new_mode == old_mode)
                 return;
         controller->auto_req = new_mode;
-        musb_writel(controller->controller.musb->ctrl_base, USB_CTRL_AUTOREQ,
-                    new_mode);
+        musb_writel(controller->controller.musb->ctrl_base,
+                    controller->autoreq_reg, new_mode);
 }
 
 static bool cppi41_configure_channel(struct dma_channel *channel,
@@ -373,6 +412,7 @@ static bool cppi41_configure_channel(struct dma_channel *channel,
                                 dma_addr_t dma_addr, u32 len)
 {
         struct cppi41_dma_channel *cppi41_channel = channel->private_data;
+        struct cppi41_dma_controller *controller = cppi41_channel->controller;
         struct dma_chan *dc = cppi41_channel->dc;
         struct dma_async_tx_descriptor *dma_desc;
         enum dma_transfer_direction direction;
@@ -398,7 +438,7 @@ static bool cppi41_configure_channel(struct dma_channel *channel,
                         musb_writel(musb->ctrl_base,
                                 RNDIS_REG(cppi41_channel->port_num), len);
                         /* gen rndis */
-                        cppi41_set_dma_mode(cppi41_channel,
+                        controller->set_dma_mode(cppi41_channel,
                                         EP_MODE_DMA_GEN_RNDIS);
 
                         /* auto req */
@@ -407,14 +447,15 @@ static bool cppi41_configure_channel(struct dma_channel *channel,
                 } else {
                         musb_writel(musb->ctrl_base,
                                         RNDIS_REG(cppi41_channel->port_num), 0);
-                        cppi41_set_dma_mode(cppi41_channel,
+                        controller->set_dma_mode(cppi41_channel,
                                         EP_MODE_DMA_TRANSPARENT);
                         cppi41_set_autoreq_mode(cppi41_channel,
                                         EP_MODE_AUTOREQ_NONE);
                 }
         } else {
                 /* fallback mode */
-                cppi41_set_dma_mode(cppi41_channel, EP_MODE_DMA_TRANSPARENT);
+                controller->set_dma_mode(cppi41_channel,
+                                EP_MODE_DMA_TRANSPARENT);
                 cppi41_set_autoreq_mode(cppi41_channel, EP_MODE_AUTOREQ_NONE);
                 len = min_t(u32, packet_sz, len);
         }
@@ -445,7 +486,7 @@ static struct dma_channel *cppi41_dma_channel_allocate(struct dma_controller *c,
         struct cppi41_dma_channel *cppi41_channel = NULL;
         u8 ch_num = hw_ep->epnum - 1;
 
-        if (ch_num >= MUSB_DMA_NUM_CHANNELS)
+        if (ch_num >= controller->num_channels)
                 return NULL;
 
         if (is_tx)
@@ -581,12 +622,13 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
 
         do {
                 if (is_tx)
-                        musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
+                        musb_writel(musb->ctrl_base, controller->tdown_reg,
+                                    tdbit);
                 ret = dmaengine_terminate_all(cppi41_channel->dc);
         } while (ret == -EAGAIN);
 
         if (is_tx) {
-                musb_writel(musb->ctrl_base, USB_TDOWN, tdbit);
+                musb_writel(musb->ctrl_base, controller->tdown_reg, tdbit);
 
                 csr = musb_readw(epio, MUSB_TXCSR);
                 if (csr & MUSB_TXCSR_TXPKTRDY) {
@@ -604,7 +646,7 @@ static void cppi41_release_all_dma_chans(struct cppi41_dma_controller *ctrl)
         struct dma_chan *dc;
         int i;
 
-        for (i = 0; i < MUSB_DMA_NUM_CHANNELS; i++) {
+        for (i = 0; i < ctrl->num_channels; i++) {
                 dc = ctrl->tx_channel[i].dc;
                 if (dc)
                         dma_release_channel(dc);
@@ -656,7 +698,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                         goto err;
 
                 ret = -EINVAL;
-                if (port > MUSB_DMA_NUM_CHANNELS || !port)
+                if (port > controller->num_channels || !port)
                         goto err;
                 if (is_tx)
                         cppi41_channel = &controller->tx_channel[port - 1];
@@ -697,6 +739,8 @@ void cppi41_dma_controller_destroy(struct dma_controller *c)
 
         hrtimer_cancel(&controller->early_tx);
         cppi41_dma_controller_stop(controller);
+        kfree(controller->rx_channel);
+        kfree(controller->tx_channel);
         kfree(controller);
 }
 EXPORT_SYMBOL_GPL(cppi41_dma_controller_destroy);
@@ -705,6 +749,7 @@ struct dma_controller *
 cppi41_dma_controller_create(struct musb *musb, void __iomem *base)
 {
         struct cppi41_dma_controller *controller;
+        int channel_size;
         int ret = 0;
 
         if (!musb->controller->parent->of_node) {
@@ -727,12 +772,37 @@ cppi41_dma_controller_create(struct musb *musb, void __iomem *base)
         controller->controller.is_compatible = cppi41_is_compatible;
         controller->controller.musb = musb;
 
+        if (musb->io.quirks & MUSB_DA8XX) {
+                controller->tdown_reg = DA8XX_USB_TEARDOWN;
+                controller->autoreq_reg = DA8XX_USB_AUTOREQ;
+                controller->set_dma_mode = da8xx_set_dma_mode;
+                controller->num_channels = DA8XX_DMA_NUM_CHANNELS;
+        } else {
+                controller->tdown_reg = USB_TDOWN;
+                controller->autoreq_reg = USB_CTRL_AUTOREQ;
+                controller->set_dma_mode = cppi41_set_dma_mode;
+                controller->num_channels = MUSB_DMA_NUM_CHANNELS;
+        }
+
+        channel_size = controller->num_channels *
+                        sizeof(struct cppi41_dma_channel);
+        controller->rx_channel = kzalloc(channel_size, GFP_KERNEL);
+        if (!controller->rx_channel)
+                goto rx_channel_alloc_fail;
+        controller->tx_channel = kzalloc(channel_size, GFP_KERNEL);
+        if (!controller->tx_channel)
+                goto tx_channel_alloc_fail;
+
         ret = cppi41_dma_controller_start(controller);
         if (ret)
                 goto plat_get_fail;
         return &controller->controller;
 
 plat_get_fail:
+        kfree(controller->tx_channel);
+tx_channel_alloc_fail:
+        kfree(controller->rx_channel);
+rx_channel_alloc_fail:
         kfree(controller);
 kzalloc_fail:
         if (ret == -EPROBE_DEFER)
diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
index c9a09b5bb6e5..dc353e24d53c 100644
--- a/drivers/usb/musb/sunxi.c
+++ b/drivers/usb/musb/sunxi.c
@@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb)
         if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
                 sunxi_sram_release(musb->controller->parent);
 
+        devm_usb_put_phy(glue->dev, glue->xceiv);
+
         return 0;
 }
 
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index 5fe4a5704bde..ccc2bf5274b4 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -329,6 +329,14 @@ static void utmi_phy_clk_disable(struct tegra_usb_phy *phy)
         unsigned long val;
         void __iomem *base = phy->regs;
 
+        /*
+         * The USB driver may have already initiated the phy clock
+         * disable so wait to see if the clock turns off and if not
+         * then proceed with gating the clock.
+         */
+        if (utmi_wait_register(base + USB_SUSP_CTRL, USB_PHY_CLK_VALID, 0) == 0)
+                return;
+
         if (phy->is_legacy_phy) {
                 val = readl(base + USB_SUSP_CTRL);
                 val |= USB_SUSP_SET;
@@ -351,6 +359,15 @@ static void utmi_phy_clk_enable(struct tegra_usb_phy *phy)
         unsigned long val;
         void __iomem *base = phy->regs;
 
+        /*
+         * The USB driver may have already initiated the phy clock
+         * enable so wait to see if the clock turns on and if not
+         * then proceed with ungating the clock.
+         */
+        if (utmi_wait_register(base + USB_SUSP_CTRL, USB_PHY_CLK_VALID,
+                               USB_PHY_CLK_VALID) == 0)
+                return;
+
         if (phy->is_legacy_phy) {
                 val = readl(base + USB_SUSP_CTRL);
                 val |= USB_SUSP_CLR;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d1af831f43eb..50285b01da92 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe,
                               struct usbhs_fifo *fifo)
 {
         struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+        int ret = 0;
 
-        if (!usbhs_pipe_is_dcp(pipe))
-                usbhsf_fifo_barrier(priv, fifo);
+        if (!usbhs_pipe_is_dcp(pipe)) {
+                /*
+                 * This driver checks the pipe condition first to avoid -EBUSY
+                 * from usbhsf_fifo_barrier() with about 10 msec delay in
+                 * the interrupt handler if the pipe is RX direction and empty.
+                 */
+                if (usbhs_pipe_is_dir_in(pipe))
+                        ret = usbhs_pipe_is_accessible(pipe);
+                if (!ret)
+                        ret = usbhsf_fifo_barrier(priv, fifo);
+        }
 
-        usbhs_write(priv, fifo->ctr, BCLR);
+        /*
+         * if non-DCP pipe, this driver should set BCLR when
+         * usbhsf_fifo_barrier() returns 0.
+         */
+        if (!ret)
+                usbhs_write(priv, fifo->ctr, BCLR);
 }
 
 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
@@ -842,9 +857,9 @@ static void xfer_work(struct work_struct *work)
                 fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
 
         usbhs_pipe_running(pipe, 1);
-        usbhsf_dma_start(pipe, fifo);
         usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
         dma_async_issue_pending(chan);
+        usbhsf_dma_start(pipe, fifo);
         usbhs_pipe_enable(pipe);
 
 xfer_work_end:
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index fdf89800ebc3..43a862a90a77 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -186,6 +186,7 @@ static int usb_console_setup(struct console *co, char *options)
         tty_kref_put(tty);
  reset_open_count:
         port->port.count = 0;
+        info->port = NULL;
         usb_autopm_put_interface(serial->interface);
  error_get_interface:
         usb_serial_put(serial);
@@ -265,7 +266,7 @@ static struct console usbcons = {
 
 void usb_serial_console_disconnect(struct usb_serial *serial)
 {
-        if (serial->port[0] == usbcons_info.port) {
+        if (serial->port[0] && serial->port[0] == usbcons_info.port) {
                 usb_serial_console_exit();
                 usb_serial_put(serial);
         }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 2d945c9f975c..412f812522ee 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+        { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */
         { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
         { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
         { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
@@ -352,6 +353,7 @@ static struct usb_serial_driver * const serial_drivers[] = {
 #define CP210X_PARTNUM_CP2104   0x04
 #define CP210X_PARTNUM_CP2105   0x05
 #define CP210X_PARTNUM_CP2108   0x08
+#define CP210X_PARTNUM_UNKNOWN  0xFF
 
 /* CP210X_GET_COMM_STATUS returns these 0x13 bytes */
 struct cp210x_comm_status {
@@ -1491,8 +1493,11 @@ static int cp210x_attach(struct usb_serial *serial)
         result = cp210x_read_vendor_block(serial, REQTYPE_DEVICE_TO_HOST,
                                           CP210X_GET_PARTNUM, &priv->partnum,
                                           sizeof(priv->partnum));
-        if (result < 0)
-                goto err_free_priv;
+        if (result < 0) {
+                dev_warn(&serial->interface->dev,
+                         "querying part number failed\n");
+                priv->partnum = CP210X_PARTNUM_UNKNOWN;
+        }
 
         usb_set_serial_data(serial, priv);
 
@@ -1505,10 +1510,6 @@ static int cp210x_attach(struct usb_serial *serial)
         }
 
         return 0;
-err_free_priv:
-        kfree(priv);
-
-        return result;
 }
 
 static void cp210x_disconnect(struct usb_serial *serial)
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1cec03799cdf..49d1b2d4606d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1015,6 +1015,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
         { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
+        { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 4fcf1cecb6d7..f9d15bd62785 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -610,6 +610,13 @@
 #define ADI_GNICEPLUS_PID       0xF001
 
 /*
+ * Cypress WICED USB UART
+ */
+#define CYPRESS_VID                     0x04B4
+#define CYPRESS_WICED_BT_USB_PID        0x009B
+#define CYPRESS_WICED_WL_USB_PID        0xF900
+
+/*
  * Microchip Technology, Inc.
  *
  * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
index cc84da8dbb84..14511d6a7d44 100644
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -45,6 +45,7 @@ struct metrousb_private {
 static const struct usb_device_id id_table[] = {
         { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
         { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
+        { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) },   /* MS7820 */
         { }, /* Terminating entry. */
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 54bfef13966a..ba672cf4e888 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -522,6 +522,7 @@ static void option_instat_callback(struct urb *urb);
 
 /* TP-LINK Incorporated products */
 #define TPLINK_VENDOR_ID                        0x2357
+#define TPLINK_PRODUCT_LTE                      0x000D
 #define TPLINK_PRODUCT_MA180                    0x0201
 
 /* Changhong products */
@@ -2011,6 +2012,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
         { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
         { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+        { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) },      /* TP-Link LTE Module */
         { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),                                 /* TP-Link MA260 */
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index ebc0beea69d6..eb9928963a53 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -174,6 +174,10 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x413c, 0x81b3)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
         {DEVICE_SWI(0x413c, 0x81b5)},   /* Dell Wireless 5811e QDL */
         {DEVICE_SWI(0x413c, 0x81b6)},   /* Dell Wireless 5811e QDL */
+        {DEVICE_SWI(0x413c, 0x81cf)},   /* Dell Wireless 5819 */
+        {DEVICE_SWI(0x413c, 0x81d0)},   /* Dell Wireless 5819 */
+        {DEVICE_SWI(0x413c, 0x81d1)},   /* Dell Wireless 5818 */
+        {DEVICE_SWI(0x413c, 0x81d2)},   /* Dell Wireless 5818 */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1a59f335b063..a3ccb899df60 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -834,13 +834,25 @@ Retry_Sense:
                         if (result == USB_STOR_TRANSPORT_GOOD) {
                                 srb->result = SAM_STAT_GOOD;
                                 srb->sense_buffer[0] = 0x0;
+                        }
+
+                        /*
+                         * ATA-passthru commands use sense data to report
+                         * the command completion status, and often devices
+                         * return Check Condition status when nothing is
+                         * wrong.
+                         */
+                        else if (srb->cmnd[0] == ATA_16 ||
+                                        srb->cmnd[0] == ATA_12) {
+                                /* leave the data alone */
+                        }
 
                         /*
                          * If there was a problem, report an unspecified
                          * hardware error to prevent the higher layers from
                          * entering an infinite retry loop.
                          */
-                        } else {
+                        else {
                                 srb->result = DID_ERROR << 16;
                                 if ((sshdr.response_code & 0x72) == 0x72)
                                         srb->sense_buffer[1] = HARDWARE_ERROR;
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index f58caa9e6a27..a155cd02bce2 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf)
                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 }
 
-static int uas_find_uas_alt_setting(struct usb_interface *intf)
+static struct usb_host_interface *uas_find_uas_alt_setting(
+                struct usb_interface *intf)
 {
         int i;
 
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf)
                 struct usb_host_interface *alt = &intf->altsetting[i];
 
                 if (uas_is_interface(alt))
-                        return alt->desc.bAlternateSetting;
+                        return alt;
         }
 
-        return -ENODEV;
+        return NULL;
 }
 
 static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf,
         struct usb_device *udev = interface_to_usbdev(intf);
         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
         unsigned long flags = id->driver_info;
-        int r, alt;
-
+        struct usb_host_interface *alt;
+        int r;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
+        if (!alt)
                 return 0;
 
-        r = uas_find_endpoints(&intf->altsetting[alt], eps);
+        r = uas_find_endpoints(alt, eps);
         if (r < 0)
                 return 0;
 
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index cfb1e3bbd434..63cf981ed81c 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 static int uas_switch_interface(struct usb_device *udev,
                                 struct usb_interface *intf)
 {
-        int alt;
+        struct usb_host_interface *alt;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
-                return alt;
+        if (!alt)
+                return -ENODEV;
 
-        return usb_set_interface(udev,
-                        intf->altsetting[0].desc.bInterfaceNumber, alt);
+        return usb_set_interface(udev, alt->desc.bInterfaceNumber,
+                        alt->desc.bAlternateSetting);
 }
 
 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 5a70c33ef0e0..eb06d88b41d6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_SANE_SENSE ),
 
+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
+                "Seagate",
+                "External",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT ),
+
 UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x9999,
                 "Maxtor",
                 "USB to SATA",
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 35a1e777b449..9a53912bdfe9 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface,
 
         if (iface->cur_altsetting->desc.bNumEndpoints < 1)
                 return -ENODEV;
+        if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
+                return -ENODEV;
 
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 01c20a260a8b..39dd4ef53c77 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -302,18 +302,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-        rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
-        if (rc->uwbd.task == NULL)
+        struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+        if (IS_ERR(task)) {
+                rc->uwbd.task = NULL;
                 printk(KERN_ERR "UWB: Cannot start management daemon; "
                        "UWB won't work\n");
-        else
+        } else {
+                rc->uwbd.task = task;
                 rc->uwbd.pid = rc->uwbd.task->pid;
+        }
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-        kthread_stop(rc->uwbd.task);
+        if (rc->uwbd.task)
+                kthread_stop(rc->uwbd.task);
         uwbd_flush(rc);
 }
 
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 82360594fa8e..57efbd3b053b 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -1024,6 +1024,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
         mutex_unlock(&priv->lock);
 
         if (use_ptemod) {
+                map->pages_vm_start = vma->vm_start;
                 err = apply_to_page_range(vma->vm_mm, vma->vm_start,
                                           vma->vm_end - vma->vm_start,
                                           find_grant_ptes, map);
@@ -1061,7 +1062,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                                             set_grant_ptes_as_special, NULL);
                 }
 #endif
-                map->pages_vm_start = vma->vm_start;
         }
 
         return 0;
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index e89136ab851e..b437fccd4e62 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -57,7 +57,7 @@ static int register_balloon(struct device *dev);
 static void watch_target(struct xenbus_watch *watch,
                          const char *path, const char *token)
 {
-        unsigned long long new_target;
+        unsigned long long new_target, static_max;
         int err;
         static bool watch_fired;
         static long target_diff;
@@ -72,13 +72,20 @@ static void watch_target(struct xenbus_watch *watch,
          * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
          */
         new_target >>= PAGE_SHIFT - 10;
-        if (watch_fired) {
-                balloon_set_new_target(new_target - target_diff);
-                return;
+
+        if (!watch_fired) {
+                watch_fired = true;
+                err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
+                                   &static_max);
+                if (err != 1)
+                        static_max = new_target;
+                else
+                        static_max >>= PAGE_SHIFT - 10;
+                target_diff = xen_pv_domain() ? 0
+                                : static_max - balloon_stats.target_pages;
         }
 
-        watch_fired = true;
-        target_diff = new_target - balloon_stats.target_pages;
+        balloon_set_new_target(new_target - target_diff);
 }
 static struct xenbus_watch target_watch = {
         .node = "memory/target",
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index 5fbfd9cfb6d6..5b3d57fc82d3 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -169,6 +169,9 @@ static int rom_write(struct pci_dev *dev, int offset, u32 value, void *data)
 static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
 {
         struct pci_bar_info *bar = data;
+        unsigned int pos = (offset - PCI_BASE_ADDRESS_0) / 4;
+        const struct resource *res = dev->resource;
+        u32 mask;
 
         if (unlikely(!bar)) {
                 pr_warn(DRV_NAME ": driver data not found for %s\n",
@@ -179,7 +182,13 @@ static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
         /* A write to obtain the length must happen as a 32-bit write.
          * This does not (yet) support writing individual bytes
          */
-        if (value == ~0)
+        if (res[pos].flags & IORESOURCE_IO)
+                mask = ~PCI_BASE_ADDRESS_IO_MASK;
+        else if (pos && (res[pos - 1].flags & IORESOURCE_MEM_64))
+                mask = 0;
+        else
+                mask = ~PCI_BASE_ADDRESS_MEM_MASK;
+        if ((value | mask) == ~0U)
                 bar->which = 1;
         else {
                 u32 tmpval;
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index adaf6f6dd858..e1cbdfdb7c68 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -310,9 +310,13 @@ static int v9fs_write_end(struct file *filp, struct address_space *mapping,
 
         p9_debug(P9_DEBUG_VFS, "filp %p, mapping %p\n", filp, mapping);
 
-        if (unlikely(copied < len && !PageUptodate(page))) {
-                copied = 0;
-                goto out;
+        if (!PageUptodate(page)) {
+                if (unlikely(copied < len)) {
+                        copied = 0;
+                        goto out;
+                } else if (len == PAGE_SIZE) {
+                        SetPageUptodate(page);
+                }
         }
         /*
          * No need to use i_size_read() here, the i_size
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index ce7181ea60fa..a7c5a9861bef 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -54,7 +54,7 @@ typedef struct {
         int size;                       /* size of magic/mask */
         char *magic;                    /* magic or filename extension */
         char *mask;                     /* mask, NULL for exact match */
-        char *interpreter;              /* filename of interpreter */
+        const char *interpreter;        /* filename of interpreter */
         char *name;
         struct dentry *dentry;
         struct file *interp_file;
@@ -131,27 +131,26 @@ static int load_misc_binary(struct linux_binprm *bprm)
 {
         Node *fmt;
         struct file *interp_file = NULL;
-        char iname[BINPRM_BUF_SIZE];
-        const char *iname_addr = iname;
         int retval;
         int fd_binary = -1;
 
         retval = -ENOEXEC;
         if (!enabled)
-                goto ret;
+                return retval;
 
         /* to keep locking time low, we copy the interpreter string */
         read_lock(&entries_lock);
         fmt = check_file(bprm);
         if (fmt)
-                strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
+                dget(fmt->dentry);
         read_unlock(&entries_lock);
         if (!fmt)
-                goto ret;
+                return retval;
 
         /* Need to be able to load the file after exec */
+        retval = -ENOENT;
         if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
-                return -ENOENT;
+                goto ret;
 
         if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
                 retval = remove_arg_zero(bprm);
@@ -195,22 +194,22 @@ static int load_misc_binary(struct linux_binprm *bprm)
         bprm->argc++;
 
         /* add the interp as argv[0] */
-        retval = copy_strings_kernel(1, &iname_addr, bprm);
+        retval = copy_strings_kernel(1, &fmt->interpreter, bprm);
         if (retval < 0)
                 goto error;
         bprm->argc++;
 
         /* Update interp in case binfmt_script needs it. */
-        retval = bprm_change_interp(iname, bprm);
+        retval = bprm_change_interp(fmt->interpreter, bprm);
         if (retval < 0)
                 goto error;
 
-        if (fmt->flags & MISC_FMT_OPEN_FILE && fmt->interp_file) {
+        if (fmt->flags & MISC_FMT_OPEN_FILE) {
                 interp_file = filp_clone_open(fmt->interp_file);
                 if (!IS_ERR(interp_file))
                         deny_write_access(interp_file);
         } else {
-                interp_file = open_exec(iname);
+                interp_file = open_exec(fmt->interpreter);
         }
         retval = PTR_ERR(interp_file);
         if (IS_ERR(interp_file))
@@ -238,6 +237,7 @@ static int load_misc_binary(struct linux_binprm *bprm)
                 goto error;
 
 ret:
+        dput(fmt->dentry);
         return retval;
 error:
         if (fd_binary > 0)
@@ -594,8 +594,13 @@ static struct inode *bm_get_inode(struct super_block *sb, int mode)
 
 static void bm_evict_inode(struct inode *inode)
 {
+        Node *e = inode->i_private;
+
+        if (e && e->flags & MISC_FMT_OPEN_FILE)
+                filp_close(e->interp_file, NULL);
+
         clear_inode(inode);
-        kfree(inode->i_private);
+        kfree(e);
 }
 
 static void kill_node(Node *e)
@@ -603,24 +608,14 @@ static void kill_node(Node *e)
         struct dentry *dentry;
 
         write_lock(&entries_lock);
-        dentry = e->dentry;
-        if (dentry) {
-                list_del_init(&e->list);
-                e->dentry = NULL;
-        }
+        list_del_init(&e->list);
         write_unlock(&entries_lock);
 
-        if ((e->flags & MISC_FMT_OPEN_FILE) && e->interp_file) {
-                filp_close(e->interp_file, NULL);
-                e->interp_file = NULL;
-        }
-
-        if (dentry) {
-                drop_nlink(d_inode(dentry));
-                d_drop(dentry);
-                dput(dentry);
-                simple_release_fs(&bm_mnt, &entry_count);
-        }
+        dentry = e->dentry;
+        drop_nlink(d_inode(dentry));
+        d_drop(dentry);
+        dput(dentry);
+        simple_release_fs(&bm_mnt, &entry_count);
 }
 
 /* /<entry> */
@@ -665,7 +660,8 @@ static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
                 root = file_inode(file)->i_sb->s_root;
                 inode_lock(d_inode(root));
 
-                kill_node(e);
+                if (!list_empty(&e->list))
+                        kill_node(e);
 
                 inode_unlock(d_inode(root));
                 break;
@@ -794,7 +790,7 @@ static ssize_t bm_status_write(struct file *file, const char __user *buffer,
                 inode_lock(d_inode(root));
 
                 while (!list_empty(&entries))
-                        kill_node(list_entry(entries.next, Node, list));
+                        kill_node(list_first_entry(&entries, Node, list));
 
                 inode_unlock(d_inode(root));
                 break;
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index afdf4e3cafc2..7cde3f46ad26 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -19,7 +19,6 @@ static int load_script(struct linux_binprm *bprm)
         const char *i_arg, *i_name;
         char *cp;
         struct file *file;
-        char interp[BINPRM_BUF_SIZE];
         int retval;
 
         if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
@@ -55,7 +54,7 @@ static int load_script(struct linux_binprm *bprm)
                         break;
         }
         for (cp = bprm->buf+2; (*cp == ' ') || (*cp == '\t'); cp++);
-        if (*cp == '\0') 
+        if (*cp == '\0')
                 return -ENOEXEC; /* No interpreter name found */
         i_name = cp;
         i_arg = NULL;
@@ -65,7 +64,6 @@ static int load_script(struct linux_binprm *bprm)
                 *cp++ = '\0';
         if (*cp)
                 i_arg = cp;
-        strcpy (interp, i_name);
         /*
          * OK, we've parsed out the interpreter name and
          * (optional) argument.
@@ -80,24 +78,27 @@ static int load_script(struct linux_binprm *bprm)
         if (retval)
                 return retval;
         retval = copy_strings_kernel(1, &bprm->interp, bprm);
-        if (retval < 0) return retval; 
+        if (retval < 0)
+                return retval;
         bprm->argc++;
         if (i_arg) {
                 retval = copy_strings_kernel(1, &i_arg, bprm);
-                if (retval < 0) return retval; 
+                if (retval < 0)
+                        return retval;
                 bprm->argc++;
         }
         retval = copy_strings_kernel(1, &i_name, bprm);
-        if (retval) return retval; 
+        if (retval)
+                return retval;
         bprm->argc++;
-        retval = bprm_change_interp(interp, bprm);
+        retval = bprm_change_interp(i_name, bprm);
         if (retval < 0)
                 return retval;
 
         /*
          * OK, now restart the process with the interpreter's dentry.
          */
-        file = open_exec(interp);
+        file = open_exec(i_name);
         if (IS_ERR(file))
                 return PTR_ERR(file);
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 93d088ffc05c..789f55e851ae 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -716,10 +716,12 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,
 
         set_page_writeback(page);
         result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, true);
-        if (result)
+        if (result) {
                 end_page_writeback(page);
-        else
+        } else {
+                clean_page_buffers(page);
                 unlock_page(page);
+        }
         blk_queue_exit(bdev->bd_queue);
         return result;
 }
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index b51d23f5cafa..280384bf34f1 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -107,7 +107,8 @@ static void end_compressed_bio_read(struct bio *bio)
         struct inode *inode;
         struct page *page;
         unsigned long index;
-        int ret;
+        unsigned int mirror = btrfs_io_bio(bio)->mirror_num;
+        int ret = 0;
 
         if (bio->bi_status)
                 cb->errors = 1;
@@ -118,6 +119,21 @@ static void end_compressed_bio_read(struct bio *bio)
         if (!refcount_dec_and_test(&cb->pending_bios))
                 goto out;
 
+        /*
+         * Record the correct mirror_num in cb->orig_bio so that
+         * read-repair can work properly.
+         */
+        ASSERT(btrfs_io_bio(cb->orig_bio));
+        btrfs_io_bio(cb->orig_bio)->mirror_num = mirror;
+        cb->mirror_num = mirror;
+
+        /*
+         * Some IO in this cb have failed, just skip checksum as there
+         * is no way it could be correct.
+         */
+        if (cb->errors == 1)
+                goto csum_failed;
+
         inode = cb->inode;
         ret = check_compressed_csum(BTRFS_I(inode), cb,
                                     (u64)bio->bi_iter.bi_sector << 9);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 5a8933da39a7..8fc690384c58 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -709,7 +709,6 @@ struct btrfs_delayed_root;
 #define BTRFS_FS_OPEN                           5
 #define BTRFS_FS_QUOTA_ENABLED                  6
 #define BTRFS_FS_QUOTA_ENABLING                 7
-#define BTRFS_FS_QUOTA_DISABLING                8
 #define BTRFS_FS_UPDATE_UUID_TREE_GEN           9
 #define BTRFS_FS_CREATING_FREE_SPACE_TREE       10
 #define BTRFS_FS_BTREE_ERR                      11
@@ -723,7 +722,7 @@ struct btrfs_delayed_root;
  * Indicate that a whole-filesystem exclusive operation is running
  * (device replace, resize, device add/delete, balance)
  */
-#define BTRFS_FS_EXCL_OP                        14
+#define BTRFS_FS_EXCL_OP                        16
 
 struct btrfs_fs_info {
         u8 fsid[BTRFS_FSID_SIZE];
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 487bbe4fb3c6..dfdab849037b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3643,7 +3643,14 @@ int write_all_supers(struct btrfs_fs_info *fs_info, int max_mirrors)
         u64 flags;
 
         do_barriers = !btrfs_test_opt(fs_info, NOBARRIER);
-        backup_super_roots(fs_info);
+
+        /*
+         * max_mirrors == 0 indicates we're from commit_transaction,
+         * not from fsync where the tree roots in fs_info have not
+         * been consistent on disk.
+         */
+        if (max_mirrors == 0)
+                backup_super_roots(fs_info);
 
         sb = fs_info->super_for_commit;
         dev_item = &sb->dev_item;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 3e5bb0cdd3cd..970190cd347e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2801,7 +2801,7 @@ static int submit_extent_page(unsigned int opf, struct extent_io_tree *tree,
                 }
         }
 
-        bio = btrfs_bio_alloc(bdev, sector << 9);
+        bio = btrfs_bio_alloc(bdev, (u64)sector << 9);
         bio_add_page(bio, page, page_size, offset);
         bio->bi_end_io = end_io_func;
         bio->bi_private = tree;
@@ -3471,8 +3471,7 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         unsigned int write_flags = 0;
         unsigned long nr_written = 0;
 
-        if (wbc->sync_mode == WB_SYNC_ALL)
-                write_flags = REQ_SYNC;
+        write_flags = wbc_to_write_flags(wbc);
 
         trace___extent_writepage(page, inode, wbc);
 
@@ -3718,7 +3717,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
         unsigned long i, num_pages;
         unsigned long bio_flags = 0;
         unsigned long start, end;
-        unsigned int write_flags = (epd->sync_io ? REQ_SYNC : 0) | REQ_META;
+        unsigned int write_flags = wbc_to_write_flags(wbc) | REQ_META;
         int ret = 0;
 
         clear_bit(EXTENT_BUFFER_WRITE_ERR, &eb->bflags);
@@ -4063,9 +4062,6 @@ static void flush_epd_write_bio(struct extent_page_data *epd)
         if (epd->bio) {
                 int ret;
 
-                bio_set_op_attrs(epd->bio, REQ_OP_WRITE,
-                                 epd->sync_io ? REQ_SYNC : 0);
-
                 ret = submit_one_bio(epd->bio, 0, epd->bio_flags);
                 BUG_ON(ret < 0); /* -ENOMEM */
                 epd->bio = NULL;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 128f3e58634f..d94e3f68b9b1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -135,6 +135,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
                                                  const u64 offset,
                                                  const u64 bytes)
 {
+        unsigned long index = offset >> PAGE_SHIFT;
+        unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                index++;
+                if (!page)
+                        continue;
+                ClearPagePrivate2(page);
+                put_page(page);
+        }
         return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
                                             bytes - PAGE_SIZE, false);
 }
@@ -8357,11 +8369,8 @@ static void btrfs_endio_direct_read(struct bio *bio)
         struct btrfs_io_bio *io_bio = btrfs_io_bio(bio);
         blk_status_t err = bio->bi_status;
 
-        if (dip->flags & BTRFS_DIO_ORIG_BIO_SUBMITTED) {
+        if (dip->flags & BTRFS_DIO_ORIG_BIO_SUBMITTED)
                 err = btrfs_subio_endio_read(inode, io_bio, err);
-                if (!err)
-                        bio->bi_status = 0;
-        }
 
         unlock_extent(&BTRFS_I(inode)->io_tree, dip->logical_offset,
                       dip->logical_offset + dip->bytes - 1);
@@ -8369,7 +8378,7 @@ static void btrfs_endio_direct_read(struct bio *bio)
 
         kfree(dip);
 
-        dio_bio->bi_status = bio->bi_status;
+        dio_bio->bi_status = err;
         dio_end_io(dio_bio);
 
         if (io_bio->end_io)
@@ -8387,6 +8396,7 @@ static void __endio_write_update_ordered(struct inode *inode,
         btrfs_work_func_t func;
         u64 ordered_offset = offset;
         u64 ordered_bytes = bytes;
+        u64 last_offset;
         int ret;
 
         if (btrfs_is_free_space_inode(BTRFS_I(inode))) {
@@ -8398,6 +8408,7 @@ static void __endio_write_update_ordered(struct inode *inode,
         }
 
 again:
+        last_offset = ordered_offset;
         ret = btrfs_dec_test_first_ordered_pending(inode, &ordered,
                                                    &ordered_offset,
                                                    ordered_bytes,
@@ -8409,6 +8420,12 @@ again:
         btrfs_queue_work(wq, &ordered->work);
 out_test:
         /*
+         * If btrfs_dec_test_ordered_pending does not find any ordered extent
+         * in the range, we can exit.
+         */
+        if (ordered_offset == last_offset)
+                return;
+        /*
          * our bio might span multiple ordered extents.  If we haven't
          * completed the accounting for the whole dio, go back and try again
          */
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index d6715c2bcdc4..6c7a49faf4e0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2773,9 +2773,9 @@ static long btrfs_ioctl_fs_info(struct btrfs_fs_info *fs_info,
         }
         mutex_unlock(&fs_devices->device_list_mutex);
 
-        fi_args->nodesize = fs_info->super_copy->nodesize;
-        fi_args->sectorsize = fs_info->super_copy->sectorsize;
-        fi_args->clone_alignment = fs_info->super_copy->sectorsize;
+        fi_args->nodesize = fs_info->nodesize;
+        fi_args->sectorsize = fs_info->sectorsize;
+        fi_args->clone_alignment = fs_info->sectorsize;
 
         if (copy_to_user(arg, fi_args, sizeof(*fi_args)))
                 ret = -EFAULT;
@@ -3032,7 +3032,7 @@ static int btrfs_cmp_data_prepare(struct inode *src, u64 loff,
 out:
         if (ret)
                 btrfs_cmp_data_free(cmp);
-        return 0;
+        return ret;
 }
 
 static int btrfs_cmp_data(u64 len, struct cmp_pages *cmp)
@@ -4061,6 +4061,10 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
                 ret = PTR_ERR(new_root);
                 goto out;
         }
+        if (!is_fstree(new_root->objectid)) {
+                ret = -ENOENT;
+                goto out;
+        }
 
         path = btrfs_alloc_path();
         if (!path) {
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5c8b61c86e61..e172d4843eae 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -807,7 +807,6 @@ static int btrfs_clean_quota_tree(struct btrfs_trans_handle *trans,
         }
         ret = 0;
 out:
-        set_bit(BTRFS_FS_QUOTA_DISABLING, &root->fs_info->flags);
         btrfs_free_path(path);
         return ret;
 }
@@ -953,7 +952,6 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
         if (!fs_info->quota_root)
                 goto out;
         clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
-        set_bit(BTRFS_FS_QUOTA_DISABLING, &fs_info->flags);
         btrfs_qgroup_wait_for_completion(fs_info, false);
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
@@ -1307,6 +1305,8 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans,
                 }
         }
         ret = del_qgroup_item(trans, quota_root, qgroupid);
+        if (ret && ret != -ENOENT)
+                goto out;
 
         while (!list_empty(&qgroup->groups)) {
                 list = list_first_entry(&qgroup->groups,
@@ -2086,8 +2086,6 @@ int btrfs_run_qgroups(struct btrfs_trans_handle *trans,
 
         if (test_and_clear_bit(BTRFS_FS_QUOTA_ENABLING, &fs_info->flags))
                 set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
-        if (test_and_clear_bit(BTRFS_FS_QUOTA_DISABLING, &fs_info->flags))
-                clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
 
         spin_lock(&fs_info->qgroup_lock);
         while (!list_empty(&fs_info->dirty_qgroups)) {
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 3a49a3c2fca4..9841faef08ea 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2400,11 +2400,11 @@ void free_reloc_roots(struct list_head *list)
         while (!list_empty(list)) {
                 reloc_root = list_entry(list->next, struct btrfs_root,
                                         root_list);
+                __del_reloc_root(reloc_root);
                 free_extent_buffer(reloc_root->node);
                 free_extent_buffer(reloc_root->commit_root);
                 reloc_root->node = NULL;
                 reloc_root->commit_root = NULL;
-                __del_reloc_root(reloc_root);
         }
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 32b043ef8ac9..8fd195cfe81b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -2630,7 +2630,7 @@ static int send_create_inode(struct send_ctx *sctx, u64 ino)
         } else {
                 btrfs_warn(sctx->send_root->fs_info, "unexpected inode type %o",
                                 (int)(mode & S_IFMT));
-                ret = -ENOTSUPP;
+                ret = -EOPNOTSUPP;
                 goto out;
         }
 
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 35a128acfbd1..161694b66038 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1135,7 +1135,7 @@ static int btrfs_fill_super(struct super_block *sb,
 #ifdef CONFIG_BTRFS_FS_POSIX_ACL
         sb->s_flags |= MS_POSIXACL;
 #endif
-        sb->s_flags |= MS_I_VERSION;
+        sb->s_flags |= SB_I_VERSION;
         sb->s_iflags |= SB_I_CGROUPWB;
 
         err = super_setup_bdi(sb);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index ad7f4bab640b..c800d067fcbf 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4181,6 +4181,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         struct extent_map *em, *n;
         struct list_head extents;
         struct extent_map_tree *tree = &inode->extent_tree;
+        u64 logged_start, logged_end;
         u64 test_gen;
         int ret = 0;
         int num = 0;
@@ -4190,10 +4191,11 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         down_write(&inode->dio_sem);
         write_lock(&tree->lock);
         test_gen = root->fs_info->last_trans_committed;
+        logged_start = start;
+        logged_end = end;
 
         list_for_each_entry_safe(em, n, &tree->modified_extents, list) {
                 list_del_init(&em->list);
-
                 /*
                  * Just an arbitrary number, this can be really CPU intensive
                  * once we start getting a lot of extents, and really once we
@@ -4208,6 +4210,12 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
 
                 if (em->generation <= test_gen)
                         continue;
+
+                if (em->start < logged_start)
+                        logged_start = em->start;
+                if ((em->start + em->len - 1) > logged_end)
+                        logged_end = em->start + em->len - 1;
+
                 /* Need a ref to keep it from getting evicted from cache */
                 refcount_inc(&em->refs);
                 set_bit(EXTENT_FLAG_LOGGING, &em->flags);
@@ -4216,7 +4224,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         }
 
         list_sort(NULL, &extents, extent_cmp);
-        btrfs_get_logged_extents(inode, logged_list, start, end);
+        btrfs_get_logged_extents(inode, logged_list, logged_start, logged_end);
         /*
          * Some ordered extents started by fsync might have completed
          * before we could collect them into the list logged_list, which
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0e8f16c305df..b39737568c22 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6166,7 +6166,7 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
         map_length = length;
 
         btrfs_bio_counter_inc_blocked(fs_info);
-        ret = __btrfs_map_block(fs_info, bio_op(bio), logical,
+        ret = __btrfs_map_block(fs_info, btrfs_op(bio), logical,
                                 &map_length, &bbio, mirror_num, 1);
         if (ret) {
                 btrfs_bio_counter_dec(fs_info);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 157fe59fbabe..1978a8cb1cb1 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1991,6 +1991,7 @@ static int try_flush_caps(struct inode *inode, u64 *ptid)
 retry:
         spin_lock(&ci->i_ceph_lock);
         if (ci->i_ceph_flags & CEPH_I_NOFLUSH) {
+                spin_unlock(&ci->i_ceph_lock);
                 dout("try_flush_caps skipping %p I_NOFLUSH set\n", inode);
                 goto out;
         }
@@ -2008,8 +2009,10 @@ retry:
                         mutex_lock(&session->s_mutex);
                         goto retry;
                 }
-                if (cap->session->s_state < CEPH_MDS_SESSION_OPEN)
+                if (cap->session->s_state < CEPH_MDS_SESSION_OPEN) {
+                        spin_unlock(&ci->i_ceph_lock);
                         goto out;
+                }
 
                 flushing = __mark_caps_flushing(inode, session, true,
                                                 &flush_tid, &oldest_flush_tid);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 84edfc60d87a..f23c820daaed 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -734,12 +734,13 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                         inode = req->r_inode;
                         ihold(inode);
                 } else {
-                        /* req->r_dentry is non-null for LSSNAP request.
-                         * fall-thru */
-                        WARN_ON_ONCE(!req->r_dentry);
+                        /* req->r_dentry is non-null for LSSNAP request */
+                        rcu_read_lock();
+                        inode = get_nonsnap_parent(req->r_dentry);
+                        rcu_read_unlock();
+                        dout("__choose_mds using snapdir's parent %p\n", inode);
                 }
-        }
-        if (!inode && req->r_dentry) {
+        } else if (req->r_dentry) {
                 /* ignore race with rename; old or new d_parent is okay */
                 struct dentry *parent;
                 struct inode *dir;
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 1ffc8b426c1c..7fc0b850c352 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -374,12 +374,10 @@ static int build_snap_context(struct ceph_snap_realm *realm,
              realm->ino, realm, snapc, snapc->seq,
              (unsigned int) snapc->num_snaps);
 
-        if (realm->cached_context) {
-                ceph_put_snap_context(realm->cached_context);
-                /* queue realm for cap_snap creation */
-                list_add_tail(&realm->dirty_item, dirty_realms);
-        }
+        ceph_put_snap_context(realm->cached_context);
         realm->cached_context = snapc;
+        /* queue realm for cap_snap creation */
+        list_add_tail(&realm->dirty_item, dirty_realms);
         return 0;
 
 fail:
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index f7243617316c..d5b2e12b5d02 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -5,9 +5,14 @@ config CIFS
         select CRYPTO
         select CRYPTO_MD4
         select CRYPTO_MD5
+        select CRYPTO_SHA256
+        select CRYPTO_CMAC
         select CRYPTO_HMAC
         select CRYPTO_ARC4
+        select CRYPTO_AEAD2
+        select CRYPTO_CCM
         select CRYPTO_ECB
+        select CRYPTO_AES
         select CRYPTO_DES
         help
           This is the client VFS module for the SMB3 family of NAS protocols,
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index de5b2e1fcce5..e185b2853eab 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -661,7 +661,9 @@ struct TCP_Server_Info {
 #endif
         unsigned int    max_read;
         unsigned int    max_write;
-        __u8            preauth_hash[512];
+#ifdef CONFIG_CIFS_SMB311
+        __u8    preauth_sha_hash[64]; /* save initital negprot hash */
+#endif /* 3.1.1 */
         struct delayed_work reconnect; /* reconnect workqueue job */
         struct mutex reconnect_mutex; /* prevent simultaneous reconnects */
         unsigned long echo_interval;
@@ -849,7 +851,9 @@ struct cifs_ses {
         __u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
         __u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE];
         __u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE];
-        __u8 preauth_hash[512];
+#ifdef CONFIG_CIFS_SMB311
+        __u8 preauth_sha_hash[64];
+#endif /* 3.1.1 */
 };
 
 static inline bool
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index e702d48bd023..81ba6e0d88d8 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -204,7 +204,8 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon)
         struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
         int i;
 
-        if (unlikely(direntry->d_name.len >
+        if (unlikely(tcon->fsAttrInfo.MaxPathNameComponentLength &&
+                     direntry->d_name.len >
                      le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength)))
                 return -ENAMETOOLONG;
 
@@ -520,7 +521,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
 
         rc = check_name(direntry, tcon);
         if (rc)
-                goto out_free_xid;
+                goto out;
 
         server = tcon->ses->server;
 
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index 7ca9808a0daa..62c88dfed57b 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -214,7 +214,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
         {STATUS_DATATYPE_MISALIGNMENT, -EIO, "STATUS_DATATYPE_MISALIGNMENT"},
         {STATUS_BREAKPOINT, -EIO, "STATUS_BREAKPOINT"},
         {STATUS_SINGLE_STEP, -EIO, "STATUS_SINGLE_STEP"},
-        {STATUS_BUFFER_OVERFLOW, -EIO, "STATUS_BUFFER_OVERFLOW"},
+        {STATUS_BUFFER_OVERFLOW, -E2BIG, "STATUS_BUFFER_OVERFLOW"},
         {STATUS_NO_MORE_FILES, -ENODATA, "STATUS_NO_MORE_FILES"},
         {STATUS_WAKE_SYSTEM_DEBUGGER, -EIO, "STATUS_WAKE_SYSTEM_DEBUGGER"},
         {STATUS_HANDLES_CLOSED, -EIO, "STATUS_HANDLES_CLOSED"},
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0dafdbae1f8c..bdb963d0ba32 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -522,6 +522,7 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
         struct cifs_open_parms oparms;
         struct cifs_fid fid;
         struct smb2_file_full_ea_info *smb2_data;
+        int ea_buf_size = SMB2_MIN_EA_BUF;
 
         utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);
         if (!utf16_path)
@@ -541,14 +542,32 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
                 return rc;
         }
 
-        smb2_data = kzalloc(SMB2_MAX_EA_BUF, GFP_KERNEL);
-        if (smb2_data == NULL) {
-                SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
-                return -ENOMEM;
+        while (1) {
+                smb2_data = kzalloc(ea_buf_size, GFP_KERNEL);
+                if (smb2_data == NULL) {
+                        SMB2_close(xid, tcon, fid.persistent_fid,
+                                   fid.volatile_fid);
+                        return -ENOMEM;
+                }
+
+                rc = SMB2_query_eas(xid, tcon, fid.persistent_fid,
+                                    fid.volatile_fid,
+                                    ea_buf_size, smb2_data);
+
+                if (rc != -E2BIG)
+                        break;
+
+                kfree(smb2_data);
+                ea_buf_size <<= 1;
+
+                if (ea_buf_size > SMB2_MAX_EA_BUF) {
+                        cifs_dbg(VFS, "EA size is too large\n");
+                        SMB2_close(xid, tcon, fid.persistent_fid,
+                                   fid.volatile_fid);
+                        return -ENOMEM;
+                }
         }
 
-        rc = SMB2_query_eas(xid, tcon, fid.persistent_fid, fid.volatile_fid,
-                            smb2_data);
         SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
 
         if (!rc)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 6f0e6343c15e..5331631386a2 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -648,7 +648,7 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 {
         int rc = 0;
         struct validate_negotiate_info_req vneg_inbuf;
-        struct validate_negotiate_info_rsp *pneg_rsp;
+        struct validate_negotiate_info_rsp *pneg_rsp = NULL;
         u32 rsplen;
         u32 inbuflen; /* max of 4 dialects */
 
@@ -727,8 +727,9 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
                          rsplen);
 
                 /* relax check since Mac returns max bufsize allowed on ioctl */
-                if (rsplen > CIFSMaxBufSize)
-                        return -EIO;
+                if ((rsplen > CIFSMaxBufSize)
+                     || (rsplen < sizeof(struct validate_negotiate_info_rsp)))
+                        goto err_rsp_free;
         }
 
         /* check validate negotiate info response matches what we got earlier */
@@ -747,10 +748,13 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 
         /* validate negotiate successful */
         cifs_dbg(FYI, "validate negotiate info successful\n");
+        kfree(pneg_rsp);
         return 0;
 
 vneg_out:
         cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
+err_rsp_free:
+        kfree(pneg_rsp);
         return -EIO;
 }
 
@@ -1255,7 +1259,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
         struct smb2_tree_connect_req *req;
         struct smb2_tree_connect_rsp *rsp = NULL;
         struct kvec iov[2];
-        struct kvec rsp_iov;
+        struct kvec rsp_iov = { NULL, 0 };
         int rc = 0;
         int resp_buftype;
         int unc_path_len;
@@ -1372,7 +1376,7 @@ tcon_exit:
         return rc;
 
 tcon_error_exit:
-        if (rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
+        if (rsp && rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
         }
         goto tcon_exit;
@@ -1975,6 +1979,9 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
         } else
                 iov[0].iov_len = get_rfc1002_length(req) + 4;
 
+        /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
+        if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
+                req->hdr.sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
 
         rc = SendReceive2(xid, ses, iov, n_iov, &resp_buftype, flags, &rsp_iov);
         cifs_small_buf_release(req);
@@ -2191,9 +2198,13 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
         req->PersistentFileId = persistent_fid;
         req->VolatileFileId = volatile_fid;
         req->AdditionalInformation = cpu_to_le32(additional_info);
-        /* 4 for rfc1002 length field and 1 for Buffer */
-        req->InputBufferOffset =
-                cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
+
+        /*
+         * We do not use the input buffer (do not send extra byte)
+         */
+        req->InputBufferOffset = 0;
+        inc_rfc1001_len(req, -1);
+
         req->OutputBufferLength = cpu_to_le32(output_len);
 
         iov[0].iov_base = (char *)req;
@@ -2233,12 +2244,12 @@ qinf_exit:
 }
 
 int SMB2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
-        u64 persistent_fid, u64 volatile_fid,
-        struct smb2_file_full_ea_info *data)
+                   u64 persistent_fid, u64 volatile_fid,
+                   int ea_buf_size, struct smb2_file_full_ea_info *data)
 {
         return query_info(xid, tcon, persistent_fid, volatile_fid,
                           FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 0,
-                          SMB2_MAX_EA_BUF,
+                          ea_buf_size,
                           sizeof(struct smb2_file_full_ea_info),
                           (void **)&data,
                           NULL);
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 6c9653a130c8..c2ec934be968 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -832,7 +832,7 @@ struct smb2_flush_rsp {
 /* Channel field for read and write: exactly one of following flags can be set*/
 #define SMB2_CHANNEL_NONE               0x00000000
 #define SMB2_CHANNEL_RDMA_V1            0x00000001 /* SMB3 or later */
-#define SMB2_CHANNEL_RDMA_V1_INVALIDATE 0x00000001 /* SMB3.02 or later */
+#define SMB2_CHANNEL_RDMA_V1_INVALIDATE 0x00000002 /* SMB3.02 or later */
 
 /* SMB2 read request without RFC1001 length at the beginning */
 struct smb2_read_plain_req {
@@ -1178,7 +1178,8 @@ struct smb2_file_link_info { /* encoding of request for level 11 */
         char   FileName[0];     /* Name to be assigned to new link */
 } __packed; /* level 11 Set */
 
-#define SMB2_MAX_EA_BUF 2048
+#define SMB2_MIN_EA_BUF  2048
+#define SMB2_MAX_EA_BUF 65536
 
 struct smb2_file_full_ea_info { /* encoding of response for level 15 */
         __le32 next_entry_offset;
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 003217099ef3..e9ab5227e7a8 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -134,6 +134,7 @@ extern int SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon,
                       u64 persistent_file_id, u64 volatile_file_id);
 extern int SMB2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
                           u64 persistent_file_id, u64 volatile_file_id,
+                          int ea_buf_size,
                           struct smb2_file_full_ea_info *data);
 extern int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
                            u64 persistent_file_id, u64 volatile_file_id,
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 67367cf1f8cd..99493946e2f9 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -390,6 +390,7 @@ generate_smb30signingkey(struct cifs_ses *ses)
         return generate_smb3signingkey(ses, &triplet);
 }
 
+#ifdef CONFIG_CIFS_SMB311
 int
 generate_smb311signingkey(struct cifs_ses *ses)
 
@@ -398,25 +399,26 @@ generate_smb311signingkey(struct cifs_ses *ses)
         struct derivation *d;
 
         d = &triplet.signing;
-        d->label.iov_base = "SMB2AESCMAC";
-        d->label.iov_len = 12;
-        d->context.iov_base = "SmbSign";
-        d->context.iov_len = 8;
+        d->label.iov_base = "SMBSigningKey";
+        d->label.iov_len = 14;
+        d->context.iov_base = ses->preauth_sha_hash;
+        d->context.iov_len = 64;
 
         d = &triplet.encryption;
-        d->label.iov_base = "SMB2AESCCM";
-        d->label.iov_len = 11;
-        d->context.iov_base = "ServerIn ";
-        d->context.iov_len = 10;
+        d->label.iov_base = "SMBC2SCipherKey";
+        d->label.iov_len = 16;
+        d->context.iov_base = ses->preauth_sha_hash;
+        d->context.iov_len = 64;
 
         d = &triplet.decryption;
-        d->label.iov_base = "SMB2AESCCM";
-        d->label.iov_len = 11;
-        d->context.iov_base = "ServerOut";
-        d->context.iov_len = 10;
+        d->label.iov_base = "SMBS2CCipherKey";
+        d->label.iov_len = 16;
+        d->context.iov_base = ses->preauth_sha_hash;
+        d->context.iov_len = 64;
 
         return generate_smb3signingkey(ses, &triplet);
 }
+#endif /* 311 */
 
 int
 smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index 018c588c7ac3..8e704d12a1cf 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -109,6 +109,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                 goto out;
         }
         ukp = user_key_payload_locked(keyring_key);
+        if (!ukp) {
+                /* key was revoked before we acquired its semaphore */
+                res = -EKEYREVOKED;
+                goto out;
+        }
         if (ukp->datalen != sizeof(struct fscrypt_key)) {
                 res = -EINVAL;
                 goto out;
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 5fa2211e49ae..b53e66d9abd7 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -45,6 +45,12 @@
 #define DIO_PAGES       64
 
 /*
+ * Flags for dio_complete()
+ */
+#define DIO_COMPLETE_ASYNC              0x01    /* This is async IO */
+#define DIO_COMPLETE_INVALIDATE         0x02    /* Can invalidate pages */
+
+/*
  * This code generally works in units of "dio_blocks".  A dio_block is
  * somewhere between the hard sector size and the filesystem block size.  it
  * is determined on a per-invocation basis.   When talking to the filesystem
@@ -225,10 +231,11 @@ static inline struct page *dio_get_page(struct dio *dio,
  * filesystems can use it to hold additional state between get_block calls and
  * dio_complete.
  */
-static ssize_t dio_complete(struct dio *dio, ssize_t ret, bool is_async)
+static ssize_t dio_complete(struct dio *dio, ssize_t ret, unsigned int flags)
 {
         loff_t offset = dio->iocb->ki_pos;
         ssize_t transferred = 0;
+        int err;
 
         /*
          * AIO submission can race with bio completion to get here while
@@ -259,18 +266,37 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, bool is_async)
                 ret = transferred;
 
         if (dio->end_io) {
-                int err;
-
                 // XXX: ki_pos??
                 err = dio->end_io(dio->iocb, offset, ret, dio->private);
                 if (err)
                         ret = err;
         }
 
+        /*
+         * Try again to invalidate clean pages which might have been cached by
+         * non-direct readahead, or faulted in by get_user_pages() if the source
+         * of the write was an mmap'ed region of the file we're writing.  Either
+         * one is a pretty crazy thing to do, so we don't support it 100%.  If
+         * this invalidation fails, tough, the write still worked...
+         *
+         * And this page cache invalidation has to be after dio->end_io(), as
+         * some filesystems convert unwritten extents to real allocations in
+         * end_io() when necessary, otherwise a racing buffer read would cache
+         * zeros from unwritten extents.
+         */
+        if (flags & DIO_COMPLETE_INVALIDATE &&
+            ret > 0 && dio->op == REQ_OP_WRITE &&
+            dio->inode->i_mapping->nrpages) {
+                err = invalidate_inode_pages2_range(dio->inode->i_mapping,
+                                        offset >> PAGE_SHIFT,
+                                        (offset + ret - 1) >> PAGE_SHIFT);
+                WARN_ON_ONCE(err);
+        }
+
         if (!(dio->flags & DIO_SKIP_DIO_COUNT))
                 inode_dio_end(dio->inode);
 
-        if (is_async) {
+        if (flags & DIO_COMPLETE_ASYNC) {
                 /*
                  * generic_write_sync expects ki_pos to have been updated
                  * already, but the submission path only does this for
@@ -291,7 +317,7 @@ static void dio_aio_complete_work(struct work_struct *work)
 {
         struct dio *dio = container_of(work, struct dio, complete_work);
 
-        dio_complete(dio, 0, true);
+        dio_complete(dio, 0, DIO_COMPLETE_ASYNC | DIO_COMPLETE_INVALIDATE);
 }
 
 static blk_status_t dio_bio_complete(struct dio *dio, struct bio *bio);
@@ -304,6 +330,7 @@ static void dio_bio_end_aio(struct bio *bio)
         struct dio *dio = bio->bi_private;
         unsigned long remaining;
         unsigned long flags;
+        bool defer_completion = false;
 
         /* cleanup the bio */
         dio_bio_complete(dio, bio);
@@ -315,12 +342,24 @@ static void dio_bio_end_aio(struct bio *bio)
         spin_unlock_irqrestore(&dio->bio_lock, flags);
 
         if (remaining == 0) {
-                if (dio->result && dio->defer_completion) {
+                /*
+                 * Defer completion when defer_completion is set or
+                 * when the inode has pages mapped and this is AIO write.
+                 * We need to invalidate those pages because there is a
+                 * chance they contain stale data in the case buffered IO
+                 * went in between AIO submission and completion into the
+                 * same region.
+                 */
+                if (dio->result)
+                        defer_completion = dio->defer_completion ||
+                                           (dio->op == REQ_OP_WRITE &&
+                                            dio->inode->i_mapping->nrpages);
+                if (defer_completion) {
                         INIT_WORK(&dio->complete_work, dio_aio_complete_work);
                         queue_work(dio->inode->i_sb->s_dio_done_wq,
                                    &dio->complete_work);
                 } else {
-                        dio_complete(dio, 0, true);
+                        dio_complete(dio, 0, DIO_COMPLETE_ASYNC);
                 }
         }
 }
@@ -838,7 +877,8 @@ out:
          */
         if (sdio->boundary) {
                 ret = dio_send_cur_page(dio, sdio, map_bh);
-                dio_bio_submit(dio, sdio);
+                if (sdio->bio)
+                        dio_bio_submit(dio, sdio);
                 put_page(sdio->cur_page);
                 sdio->cur_page = NULL;
         }
@@ -1210,10 +1250,19 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
          * For AIO O_(D)SYNC writes we need to defer completions to a workqueue
          * so that we can call ->fsync.
          */
-        if (dio->is_async && iov_iter_rw(iter) == WRITE &&
-            ((iocb->ki_filp->f_flags & O_DSYNC) ||
-             IS_SYNC(iocb->ki_filp->f_mapping->host))) {
-                retval = dio_set_defer_completion(dio);
+        if (dio->is_async && iov_iter_rw(iter) == WRITE) {
+                retval = 0;
+                if ((iocb->ki_filp->f_flags & O_DSYNC) ||
+                    IS_SYNC(iocb->ki_filp->f_mapping->host))
+                        retval = dio_set_defer_completion(dio);
+                else if (!dio->inode->i_sb->s_dio_done_wq) {
+                        /*
+                         * In case of AIO write racing with buffered read we
+                         * need to defer completion. We can't decide this now,
+                         * however the workqueue needs to be initialized here.
+                         */
+                        retval = sb_init_dio_done_wq(dio->inode->i_sb);
+                }
                 if (retval) {
                         /*
                          * We grab i_mutex only for reads so we don't have
@@ -1322,7 +1371,7 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
                 dio_await_completion(dio);
 
         if (drop_refcount(dio) == 0) {
-                retval = dio_complete(dio, retval, false);
+                retval = dio_complete(dio, retval, DIO_COMPLETE_INVALIDATE);
         } else
                 BUG_ON(retval != -EIOCBQUEUED);
 
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 9c351bf757b2..3fbc0ff79699 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -84,11 +84,16 @@ struct ecryptfs_page_crypt_context {
 static inline struct ecryptfs_auth_tok *
 ecryptfs_get_encrypted_key_payload_data(struct key *key)
 {
-        if (key->type == &key_type_encrypted)
-                return (struct ecryptfs_auth_tok *)
-                        (&((struct encrypted_key_payload *)key->payload.data[0])->payload_data);
-        else
+        struct encrypted_key_payload *payload;
+
+        if (key->type != &key_type_encrypted)
                 return NULL;
+
+        payload = key->payload.data[0];
+        if (!payload)
+                return ERR_PTR(-EKEYREVOKED);
+
+        return (struct ecryptfs_auth_tok *)payload->payload_data;
 }
 
 static inline struct key *ecryptfs_get_encrypted_key(char *sig)
@@ -114,12 +119,17 @@ static inline struct ecryptfs_auth_tok *
 ecryptfs_get_key_payload_data(struct key *key)
 {
         struct ecryptfs_auth_tok *auth_tok;
+        struct user_key_payload *ukp;
 
         auth_tok = ecryptfs_get_encrypted_key_payload_data(key);
-        if (!auth_tok)
-                return (struct ecryptfs_auth_tok *)user_key_payload_locked(key)->data;
-        else
+        if (auth_tok)
                 return auth_tok;
+
+        ukp = user_key_payload_locked(key);
+        if (!ukp)
+                return ERR_PTR(-EKEYREVOKED);
+
+        return (struct ecryptfs_auth_tok *)ukp->data;
 }
 
 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 3cf1546dca82..fa218cd64f74 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -459,7 +459,8 @@ out:
  * @auth_tok_key: key containing the authentication token
  * @auth_tok: authentication token
  *
- * Returns zero on valid auth tok; -EINVAL otherwise
+ * Returns zero on valid auth tok; -EINVAL if the payload is invalid; or
+ * -EKEYREVOKED if the key was revoked before we acquired its semaphore.
  */
 static int
 ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
@@ -468,6 +469,12 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
         int rc = 0;
 
         (*auth_tok) = ecryptfs_get_key_payload_data(auth_tok_key);
+        if (IS_ERR(*auth_tok)) {
+                rc = PTR_ERR(*auth_tok);
+                *auth_tok = NULL;
+                goto out;
+        }
+
         if (ecryptfs_verify_version((*auth_tok)->version)) {
                 printk(KERN_ERR "Data structure version mismatch. Userspace "
                        "tools must match eCryptfs kernel module with major "
diff --git a/fs/exec.c b/fs/exec.c
index ac34d9724684..3e14ba25f678 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1410,7 +1410,7 @@ static void free_bprm(struct linux_binprm *bprm)
         kfree(bprm);
 }
 
-int bprm_change_interp(char *interp, struct linux_binprm *bprm)
+int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
 {
         /* If a binfmt changed the interp, free it first. */
         if (bprm->interp != bprm->filename)
@@ -1802,6 +1802,7 @@ static int do_execveat_common(int fd, struct filename *filename,
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
+        membarrier_execve(current);
         acct_update_integrals(current);
         task_numa_free(current);
         free_bprm(bprm);
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b104096fce9e..b0915b734a38 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1677,7 +1677,7 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
                 sbi->s_mount_flags |= EXT4_MF_FS_ABORTED;
                 return 1;
         case Opt_i_version:
-                sb->s_flags |= MS_I_VERSION;
+                sb->s_flags |= SB_I_VERSION;
                 return 1;
         case Opt_lazytime:
                 sb->s_flags |= MS_LAZYTIME;
@@ -2060,7 +2060,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,
                 SEQ_OPTS_PRINT("min_batch_time=%u", sbi->s_min_batch_time);
         if (nodefs || sbi->s_max_batch_time != EXT4_DEF_MAX_BATCH_TIME)
                 SEQ_OPTS_PRINT("max_batch_time=%u", sbi->s_max_batch_time);
-        if (sb->s_flags & MS_I_VERSION)
+        if (sb->s_flags & SB_I_VERSION)
                 SEQ_OPTS_PUTS("i_version");
         if (nodefs || sbi->s_stripe)
                 SEQ_OPTS_PRINT("stripe=%lu", sbi->s_stripe);
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 9a7c90386947..4b4a72f392be 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2525,7 +2525,7 @@ void invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr);
 bool is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
 void refresh_sit_entry(struct f2fs_sb_info *sbi, block_t old, block_t new);
 void stop_discard_thread(struct f2fs_sb_info *sbi);
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi);
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount);
 void clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc);
 void release_discard_addrs(struct f2fs_sb_info *sbi);
 int npages_for_summary_flush(struct f2fs_sb_info *sbi, bool for_ra);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 621b9b3d320b..c695ff462ee6 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1210,11 +1210,11 @@ void stop_discard_thread(struct f2fs_sb_info *sbi)
 }
 
 /* This comes from f2fs_put_super and f2fs_trim_fs */
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi)
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount)
 {
         __issue_discard_cmd(sbi, false);
         __drop_discard_cmd(sbi);
-        __wait_discard_cmd(sbi, false);
+        __wait_discard_cmd(sbi, !umount);
 }
 
 static void mark_discard_range_all(struct f2fs_sb_info *sbi)
@@ -2244,7 +2244,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
         }
         /* It's time to issue all the filed discards */
         mark_discard_range_all(sbi);
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, false);
 out:
         range->len = F2FS_BLK_TO_BYTES(cpc.trimmed);
         return err;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 89f61eb3d167..933c3d529e65 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -801,7 +801,7 @@ static void f2fs_put_super(struct super_block *sb)
         }
 
         /* be sure to wait for any on-going discard commands */
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, true);
 
         if (f2fs_discard_en(sbi) && !sbi->discard_blks) {
                 struct cp_control cpc = {
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index b5ab06fabc60..0438d4cd91ef 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -331,6 +331,13 @@ static void fscache_objlist_config(struct fscache_objlist_data *data)
         rcu_read_lock();
 
         confkey = user_key_payload_rcu(key);
+        if (!confkey) {
+                /* key was revoked */
+                rcu_read_unlock();
+                key_put(key);
+                goto no_config;
+        }
+
         buf = confkey->data;
 
         for (len = confkey->datalen - 1; len >= 0; len--) {
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 622081b97426..24967382a7b1 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1308,7 +1308,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
                         */
                         over = !dir_emit(ctx, dirent->name, dirent->namelen,
                                        dirent->ino, dirent->type);
-                        ctx->pos = dirent->off;
+                        if (!over)
+                                ctx->pos = dirent->off;
                 }
 
                 buf += reclen;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 65c88379a3a1..94a745acaef8 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1059,7 +1059,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (sb->s_flags & MS_MANDLOCK)
                 goto err;
 
-        sb->s_flags &= ~(MS_NOSEC | MS_I_VERSION);
+        sb->s_flags &= ~(MS_NOSEC | SB_I_VERSION);
 
         if (!parse_fuse_opt(data, &d, is_bdev))
                 goto err;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 98e845b7841b..11066d8647d2 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1945,13 +1945,9 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct gfs2_glock_iter *gi = seq->private;
         loff_t n = *pos;
-        int ret;
-
-        if (gi->last_pos <= *pos)
-                n = (*pos - gi->last_pos);
 
-        ret = rhashtable_walk_start(&gi->hti);
-        if (ret)
+        rhashtable_walk_enter(&gl_hash_table, &gi->hti);
+        if (rhashtable_walk_start(&gi->hti) != 0)
                 return NULL;
 
         do {
@@ -1959,6 +1955,7 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
         } while (gi->gl && n--);
 
         gi->last_pos = *pos;
+
         return gi->gl;
 }
 
@@ -1970,6 +1967,7 @@ static void *gfs2_glock_seq_next(struct seq_file *seq, void *iter_ptr,
         (*pos)++;
         gi->last_pos = *pos;
         gfs2_glock_iter_next(gi);
+
         return gi->gl;
 }
 
@@ -1980,6 +1978,7 @@ static void gfs2_glock_seq_stop(struct seq_file *seq, void *iter_ptr)
 
         gi->gl = NULL;
         rhashtable_walk_stop(&gi->hti);
+        rhashtable_walk_exit(&gi->hti);
 }
 
 static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr)
@@ -2042,12 +2041,10 @@ static int __gfs2_glocks_open(struct inode *inode, struct file *file,
                 struct gfs2_glock_iter *gi = seq->private;
 
                 gi->sdp = inode->i_private;
-                gi->last_pos = 0;
                 seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN);
                 if (seq->buf)
                         seq->size = GFS2_SEQ_GOODSIZE;
                 gi->gl = NULL;
-                rhashtable_walk_enter(&gl_hash_table, &gi->hti);
         }
         return ret;
 }
@@ -2063,7 +2060,6 @@ static int gfs2_glocks_release(struct inode *inode, struct file *file)
         struct gfs2_glock_iter *gi = seq->private;
 
         gi->gl = NULL;
-        rhashtable_walk_exit(&gi->hti);
         return seq_release_private(inode, file);
 }
 
diff --git a/fs/iomap.c b/fs/iomap.c
index 269b24a01f32..d4801f8dd4fd 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -713,6 +713,8 @@ struct iomap_dio {
 static ssize_t iomap_dio_complete(struct iomap_dio *dio)
 {
         struct kiocb *iocb = dio->iocb;
+        struct inode *inode = file_inode(iocb->ki_filp);
+        loff_t offset = iocb->ki_pos;
         ssize_t ret;
 
         if (dio->end_io) {
@@ -726,12 +728,33 @@ static ssize_t iomap_dio_complete(struct iomap_dio *dio)
         if (likely(!ret)) {
                 ret = dio->size;
                 /* check for short read */
-                if (iocb->ki_pos + ret > dio->i_size &&
+                if (offset + ret > dio->i_size &&
                     !(dio->flags & IOMAP_DIO_WRITE))
-                        ret = dio->i_size - iocb->ki_pos;
+                        ret = dio->i_size - offset;
                 iocb->ki_pos += ret;
         }
 
+        /*
+         * Try again to invalidate clean pages which might have been cached by
+         * non-direct readahead, or faulted in by get_user_pages() if the source
+         * of the write was an mmap'ed region of the file we're writing.  Either
+         * one is a pretty crazy thing to do, so we don't support it 100%.  If
+         * this invalidation fails, tough, the write still worked...
+         *
+         * And this page cache invalidation has to be after dio->end_io(), as
+         * some filesystems convert unwritten extents to real allocations in
+         * end_io() when necessary, otherwise a racing buffer read would cache
+         * zeros from unwritten extents.
+         */
+        if (!dio->error &&
+            (dio->flags & IOMAP_DIO_WRITE) && inode->i_mapping->nrpages) {
+                int err;
+                err = invalidate_inode_pages2_range(inode->i_mapping,
+                                offset >> PAGE_SHIFT,
+                                (offset + dio->size - 1) >> PAGE_SHIFT);
+                WARN_ON_ONCE(err);
+        }
+
         inode_dio_end(file_inode(iocb->ki_filp));
         kfree(dio);
 
@@ -993,6 +1016,13 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         WARN_ON_ONCE(ret);
         ret = 0;
 
+        if (iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
+            !inode->i_sb->s_dio_done_wq) {
+                ret = sb_init_dio_done_wq(inode->i_sb);
+                if (ret < 0)
+                        goto out_free_dio;
+        }
+
         inode_dio_begin(inode);
 
         blk_start_plug(&plug);
@@ -1015,13 +1045,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (ret < 0)
                 iomap_dio_set_error(dio, ret);
 
-        if (ret >= 0 && iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
-                        !inode->i_sb->s_dio_done_wq) {
-                ret = sb_init_dio_done_wq(inode->i_sb);
-                if (ret < 0)
-                        iomap_dio_set_error(dio, ret);
-        }
-
         if (!atomic_dec_and_test(&dio->ref)) {
                 if (!is_sync_kiocb(iocb))
                         return -EIOCBQUEUED;
@@ -1042,19 +1065,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
 
         ret = iomap_dio_complete(dio);
 
-        /*
-         * Try again to invalidate clean pages which might have been cached by
-         * non-direct readahead, or faulted in by get_user_pages() if the source
-         * of the write was an mmap'ed region of the file we're writing.  Either
-         * one is a pretty crazy thing to do, so we don't support it 100%.  If
-         * this invalidation fails, tough, the write still worked...
-         */
-        if (iov_iter_rw(iter) == WRITE) {
-                int err = invalidate_inode_pages2_range(mapping,
-                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
-                WARN_ON_ONCE(err);
-        }
-
         return ret;
 
 out_free_dio:
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index db692f554158..447a24d77b89 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -514,9 +514,11 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
         if (sbi->s_fmode != ISOFS_INVALID_MODE)
                 seq_printf(m, ",fmode=%o", sbi->s_fmode);
 
+#ifdef CONFIG_JOLIET
         if (sbi->s_nls_iocharset &&
             strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
                 seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
+#endif
         return 0;
 }
 
diff --git a/fs/mpage.c b/fs/mpage.c
index 37bb77c1302c..c991faec70b9 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -468,6 +468,16 @@ static void clean_buffers(struct page *page, unsigned first_unmapped)
                 try_to_free_buffers(page);
 }
 
+/*
+ * For situations where we want to clean all buffers attached to a page.
+ * We don't need to calculate how many buffers are attached to the page,
+ * we just need to specify a number larger than the maximum number of buffers.
+ */
+void clean_page_buffers(struct page *page)
+{
+        clean_buffers(page, ~0U);
+}
+
 static int __mpage_writepage(struct page *page, struct writeback_control *wbc,
                       void *data)
 {
@@ -605,10 +615,8 @@ alloc_new:
         if (bio == NULL) {
                 if (first_unmapped == blocks_per_page) {
                         if (!bdev_write_page(bdev, blocks[0] << (blkbits - 9),
-                                                                page, wbc)) {
-                                clean_buffers(page, first_unmapped);
+                                                                page, wbc))
                                 goto out;
-                        }
                 }
                 bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
                                 BIO_MAX_PAGES, GFP_NOFS|__GFP_HIGH);
diff --git a/fs/namespace.c b/fs/namespace.c
index 54059b142d6b..d18deb4c410b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -468,7 +468,9 @@ static inline int may_write_real(struct file *file)
 
         /* File refers to upper, writable layer? */
         upperdentry = d_real(dentry, NULL, 0, D_REAL_UPPER);
-        if (upperdentry && file_inode(file) == d_inode(upperdentry))
+        if (upperdentry &&
+            (file_inode(file) == d_inode(upperdentry) ||
+             file_inode(file) == d_inode(dentry)))
                 return 0;
 
         /* Lower layer: can't write to real file, sorry... */
@@ -2823,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
                             SB_MANDLOCK |
                             SB_DIRSYNC |
                             SB_SILENT |
-                            SB_POSIXACL);
+                            SB_POSIXACL |
+                            SB_I_VERSION);
 
         if (flags & MS_REMOUNT)
                 retval = do_remount(&path, flags, sb_flags, mnt_flags,
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index efebe6cf4378..22880ef6d8dd 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -218,7 +218,6 @@ static void nfs_cb_idr_remove_locked(struct nfs_client *clp)
 static void pnfs_init_server(struct nfs_server *server)
 {
         rpc_init_wait_queue(&server->roc_rpcwaitq, "pNFS ROC");
-        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 }
 
 #else
@@ -888,6 +887,7 @@ struct nfs_server *nfs_alloc_server(void)
         ida_init(&server->openowner_id);
         ida_init(&server->lockowner_id);
         pnfs_init_server(server);
+        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 
         return server;
 }
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44c638b7876c..508126eb49f9 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -745,7 +745,8 @@ filelayout_free_lseg(struct pnfs_layout_segment *lseg)
         struct nfs4_filelayout_segment *fl = FILELAYOUT_LSEG(lseg);
 
         dprintk("--> %s\n", __func__);
-        nfs4_fl_put_deviceid(fl->dsaddr);
+        if (fl->dsaddr != NULL)
+                nfs4_fl_put_deviceid(fl->dsaddr);
         /* This assumes a single RW lseg */
         if (lseg->pls_range.iomode == IOMODE_RW) {
                 struct nfs4_filelayout *flo;
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index dd5d27da8c0c..30426c1a1bbd 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -274,7 +274,7 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
         ssize_t ret;
 
         ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
-        if (ret <= 0)
+        if (ret < 0)
                 return ERR_PTR(ret);
 
         rkey = request_key(&key_type_id_resolver, desc, "");
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6c61e2b99635..f90090e8c959 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8399,8 +8399,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 lo = NFS_I(inode)->layout;
                 /* If the open stateid was bad, then recover it. */
                 if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
-                    nfs4_stateid_match_other(&lgp->args.stateid,
-                                        &lgp->args.ctx->state->stateid)) {
+                    !nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         spin_unlock(&inode->i_lock);
                         exception->state = lgp->args.ctx->state;
                         exception->stateid = &lgp->args.stateid;
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 37c8af003275..14ed9791ec9c 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1842,8 +1842,8 @@ static void encode_create_session(struct xdr_stream *xdr,
          * Assumes OPEN is the biggest non-idempotent compound.
          * 2 is the verifier.
          */
-        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
-                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE + 2)
+                                * XDR_UNIT + RPC_MAX_AUTH_SIZE;
 
         encode_op_hdr(xdr, OP_CREATE_SESSION, decode_create_session_maxsz, hdr);
         p = reserve_space(xdr, 16 + 2*28 + 20 + clnt->cl_nodelen + 12);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3c69db7d4905..8487486ec496 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -927,6 +927,13 @@ nfsd4_secinfo_release(union nfsd4_op_u *u)
                 exp_put(u->secinfo.si_exp);
 }
 
+static void
+nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)
+{
+        if (u->secinfo_no_name.sin_exp)
+                exp_put(u->secinfo_no_name.sin_exp);
+}
+
 static __be32
 nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               union nfsd4_op_u *u)
@@ -2375,7 +2382,7 @@ static const struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_SECINFO_NO_NAME] = {
                 .op_func = nfsd4_secinfo_no_name,
-                .op_release = nfsd4_secinfo_release,
+                .op_release = nfsd4_secinfo_no_name_release,
                 .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_SECINFO_NO_NAME",
                 .op_rsize_bop = nfsd4_secinfo_rsize,
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index aad97b30d5e6..c441f9387a1b 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -561,10 +561,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
                 c->tmpfile = true;
                 err = ovl_copy_up_locked(c);
         } else {
-                err = -EIO;
-                if (lock_rename(c->workdir, c->destdir) != NULL) {
-                        pr_err("overlayfs: failed to lock workdir+upperdir\n");
-                } else {
+                err = ovl_lock_rename_workdir(c->workdir, c->destdir);
+                if (!err) {
                         err = ovl_copy_up_locked(c);
                         unlock_rename(c->workdir, c->destdir);
                 }
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 3309b1912241..cc961a3bd3bd 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -216,26 +216,6 @@ out_unlock:
         return err;
 }
 
-static int ovl_lock_rename_workdir(struct dentry *workdir,
-                                   struct dentry *upperdir)
-{
-        /* Workdir should not be the same as upperdir */
-        if (workdir == upperdir)
-                goto err;
-
-        /* Workdir should not be subdir of upperdir and vice versa */
-        if (lock_rename(workdir, upperdir) != NULL)
-                goto err_unlock;
-
-        return 0;
-
-err_unlock:
-        unlock_rename(workdir, upperdir);
-err:
-        pr_err("overlayfs: failed to lock workdir+upperdir\n");
-        return -EIO;
-}
-
 static struct dentry *ovl_clear_empty(struct dentry *dentry,
                                       struct list_head *list)
 {
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index a619addecafc..321511ed8c42 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -598,18 +598,30 @@ static bool ovl_verify_inode(struct inode *inode, struct dentry *lowerdentry,
         return true;
 }
 
-struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry)
+struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry,
+                            struct dentry *index)
 {
         struct dentry *lowerdentry = ovl_dentry_lower(dentry);
         struct inode *realinode = upperdentry ? d_inode(upperdentry) : NULL;
         struct inode *inode;
+        /* Already indexed or could be indexed on copy up? */
+        bool indexed = (index || (ovl_indexdir(dentry->d_sb) && !upperdentry));
+
+        if (WARN_ON(upperdentry && indexed && !lowerdentry))
+                return ERR_PTR(-EIO);
 
         if (!realinode)
                 realinode = d_inode(lowerdentry);
 
-        if (!S_ISDIR(realinode->i_mode) &&
-            (upperdentry || (lowerdentry && ovl_indexdir(dentry->d_sb)))) {
-                struct inode *key = d_inode(lowerdentry ?: upperdentry);
+        /*
+         * Copy up origin (lower) may exist for non-indexed upper, but we must
+         * not use lower as hash key in that case.
+         * Hash inodes that are or could be indexed by origin inode and
+         * non-indexed upper inodes that could be hard linked by upper inode.
+         */
+        if (!S_ISDIR(realinode->i_mode) && (upperdentry || indexed)) {
+                struct inode *key = d_inode(indexed ? lowerdentry :
+                                                      upperdentry);
                 unsigned int nlink;
 
                 inode = iget5_locked(dentry->d_sb, (unsigned long) key,
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index c3addd1114f1..a12dc10bf726 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -405,14 +405,13 @@ int ovl_verify_index(struct dentry *index, struct path *lowerstack,
          * be treated as stale (i.e. after unlink of the overlay inode).
          * We don't know the verification rules for directory and whiteout
          * index entries, because they have not been implemented yet, so return
-         * EROFS if those entries are found to avoid corrupting an index that
-         * was created by a newer kernel.
+         * EINVAL if those entries are found to abort the mount to avoid
+         * corrupting an index that was created by a newer kernel.
          */
-        err = -EROFS;
+        err = -EINVAL;
         if (d_is_dir(index) || ovl_is_whiteout(index))
                 goto fail;
 
-        err = -EINVAL;
         if (index->d_name.len < sizeof(struct ovl_fh)*2)
                 goto fail;
 
@@ -506,6 +505,11 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
 
         index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
         if (IS_ERR(index)) {
+                err = PTR_ERR(index);
+                if (err == -ENOENT) {
+                        index = NULL;
+                        goto out;
+                }
                 pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"
                                     "overlayfs: mount with '-o index=off' to disable inodes index.\n",
                                     d_inode(origin)->i_ino, name.len, name.name,
@@ -515,18 +519,9 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
 
         inode = d_inode(index);
         if (d_is_negative(index)) {
-                if (upper && d_inode(origin)->i_nlink > 1) {
-                        pr_warn_ratelimited("overlayfs: hard link with origin but no index (ino=%lu).\n",
-                                            d_inode(origin)->i_ino);
-                        goto fail;
-                }
-
-                dput(index);
-                index = NULL;
+                goto out_dput;
         } else if (upper && d_inode(upper) != inode) {
-                pr_warn_ratelimited("overlayfs: wrong index found (index=%pd2, ino=%lu, upper ino=%lu).\n",
-                                    index, inode->i_ino, d_inode(upper)->i_ino);
-                goto fail;
+                goto out_dput;
         } else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
                    ((inode->i_mode ^ d_inode(origin)->i_mode) & S_IFMT)) {
                 /*
@@ -546,6 +541,11 @@ out:
         kfree(name.name);
         return index;
 
+out_dput:
+        dput(index);
+        index = NULL;
+        goto out;
+
 fail:
         dput(index);
         index = ERR_PTR(-EIO);
@@ -634,6 +634,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                 }
 
                 if (d.redirect) {
+                        err = -ENOMEM;
                         upperredirect = kstrdup(d.redirect, GFP_KERNEL);
                         if (!upperredirect)
                                 goto out_put_upper;
@@ -708,7 +709,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                 upperdentry = dget(index);
 
         if (upperdentry || ctr) {
-                inode = ovl_get_inode(dentry, upperdentry);
+                inode = ovl_get_inode(dentry, upperdentry, index);
                 err = PTR_ERR(inode);
                 if (IS_ERR(inode))
                         goto out_free_oe;
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index d4e8c1a08fb0..d9a0edd4e57e 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -235,6 +235,7 @@ bool ovl_inuse_trylock(struct dentry *dentry);
 void ovl_inuse_unlock(struct dentry *dentry);
 int ovl_nlink_start(struct dentry *dentry, bool *locked);
 void ovl_nlink_end(struct dentry *dentry, bool locked);
+int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir);
 
 static inline bool ovl_is_impuredir(struct dentry *dentry)
 {
@@ -285,7 +286,8 @@ int ovl_update_time(struct inode *inode, struct timespec *ts, int flags);
 bool ovl_is_private_xattr(const char *name);
 
 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev);
-struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry);
+struct inode *ovl_get_inode(struct dentry *dentry, struct dentry *upperdentry,
+                            struct dentry *index);
 static inline void ovl_copyattr(struct inode *from, struct inode *to)
 {
         to->i_uid = from->i_uid;
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index 878a750986dd..25d9b5adcd42 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -37,6 +37,9 @@ struct ovl_fs {
         bool noxattr;
         /* sb common to all layers */
         struct super_block *same_sb;
+        /* Did we take the inuse lock? */
+        bool upperdir_locked;
+        bool workdir_locked;
 };
 
 /* private information held for every overlayfs dentry */
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 62e9b22a2077..698b74dd750e 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -988,6 +988,7 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                          struct path *lowerstack, unsigned int numlower)
 {
         int err;
+        struct dentry *index = NULL;
         struct inode *dir = dentry->d_inode;
         struct path path = { .mnt = mnt, .dentry = dentry };
         LIST_HEAD(list);
@@ -1007,8 +1008,6 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
 
         inode_lock_nested(dir, I_MUTEX_PARENT);
         list_for_each_entry(p, &list, l_node) {
-                struct dentry *index;
-
                 if (p->name[0] == '.') {
                         if (p->len == 1)
                                 continue;
@@ -1018,18 +1017,20 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                 index = lookup_one_len(p->name, dentry, p->len);
                 if (IS_ERR(index)) {
                         err = PTR_ERR(index);
+                        index = NULL;
                         break;
                 }
                 err = ovl_verify_index(index, lowerstack, numlower);
-                if (err) {
-                        if (err == -EROFS)
-                                break;
+                /* Cleanup stale and orphan index entries */
+                if (err && (err == -ESTALE || err == -ENOENT))
                         err = ovl_cleanup(dir, index);
-                        if (err)
-                                break;
-                }
+                if (err)
+                        break;
+
                 dput(index);
+                index = NULL;
         }
+        dput(index);
         inode_unlock(dir);
 out:
         ovl_cache_free(&list);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index fd5ea4facc62..f5738e96a052 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -174,6 +174,9 @@ static struct inode *ovl_alloc_inode(struct super_block *sb)
 {
         struct ovl_inode *oi = kmem_cache_alloc(ovl_inode_cachep, GFP_KERNEL);
 
+        if (!oi)
+                return NULL;
+
         oi->cache = NULL;
         oi->redirect = NULL;
         oi->version = 0;
@@ -211,9 +214,10 @@ static void ovl_put_super(struct super_block *sb)
 
         dput(ufs->indexdir);
         dput(ufs->workdir);
-        ovl_inuse_unlock(ufs->workbasedir);
+        if (ufs->workdir_locked)
+                ovl_inuse_unlock(ufs->workbasedir);
         dput(ufs->workbasedir);
-        if (ufs->upper_mnt)
+        if (ufs->upper_mnt && ufs->upperdir_locked)
                 ovl_inuse_unlock(ufs->upper_mnt->mnt_root);
         mntput(ufs->upper_mnt);
         for (i = 0; i < ufs->numlower; i++)
@@ -881,9 +885,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                         goto out_put_upperpath;
 
                 err = -EBUSY;
-                if (!ovl_inuse_trylock(upperpath.dentry)) {
-                        pr_err("overlayfs: upperdir is in-use by another mount\n");
+                if (ovl_inuse_trylock(upperpath.dentry)) {
+                        ufs->upperdir_locked = true;
+                } else if (ufs->config.index) {
+                        pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
                         goto out_put_upperpath;
+                } else {
+                        pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
                 }
 
                 err = ovl_mount_dir(ufs->config.workdir, &workpath);
@@ -901,9 +909,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 }
 
                 err = -EBUSY;
-                if (!ovl_inuse_trylock(workpath.dentry)) {
-                        pr_err("overlayfs: workdir is in-use by another mount\n");
+                if (ovl_inuse_trylock(workpath.dentry)) {
+                        ufs->workdir_locked = true;
+                } else if (ufs->config.index) {
+                        pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
                         goto out_put_workpath;
+                } else {
+                        pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
                 }
 
                 ufs->workbasedir = workpath.dentry;
@@ -1156,11 +1168,13 @@ out_put_lowerpath:
 out_free_lowertmp:
         kfree(lowertmp);
 out_unlock_workdentry:
-        ovl_inuse_unlock(workpath.dentry);
+        if (ufs->workdir_locked)
+                ovl_inuse_unlock(workpath.dentry);
 out_put_workpath:
         path_put(&workpath);
 out_unlock_upperdentry:
-        ovl_inuse_unlock(upperpath.dentry);
+        if (ufs->upperdir_locked)
+                ovl_inuse_unlock(upperpath.dentry);
 out_put_upperpath:
         path_put(&upperpath);
 out_free_config:
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 117794582f9f..b9b239fa5cfd 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -430,7 +430,7 @@ void ovl_inuse_unlock(struct dentry *dentry)
         }
 }
 
-/* Called must hold OVL_I(inode)->oi_lock */
+/* Caller must hold OVL_I(inode)->lock */
 static void ovl_cleanup_index(struct dentry *dentry)
 {
         struct inode *dir = ovl_indexdir(dentry->d_sb)->d_inode;
@@ -469,6 +469,9 @@ static void ovl_cleanup_index(struct dentry *dentry)
         err = PTR_ERR(index);
         if (!IS_ERR(index))
                 err = ovl_cleanup(dir, index);
+        else
+                index = NULL;
+
         inode_unlock(dir);
         if (err)
                 goto fail;
@@ -557,3 +560,22 @@ void ovl_nlink_end(struct dentry *dentry, bool locked)
                 mutex_unlock(&OVL_I(d_inode(dentry))->lock);
         }
 }
+
+int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir)
+{
+        /* Workdir should not be the same as upperdir */
+        if (workdir == upperdir)
+                goto err;
+
+        /* Workdir should not be subdir of upperdir and vice versa */
+        if (lock_rename(workdir, upperdir) != NULL)
+                goto err_unlock;
+
+        return 0;
+
+err_unlock:
+        unlock_rename(workdir, upperdir);
+err:
+        pr_err("overlayfs: failed to lock workdir+upperdir\n");
+        return -EIO;
+}
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 525157ca25cb..77a8eacbe032 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -119,30 +119,25 @@ static inline void task_name(struct seq_file *m, struct task_struct *p)
  * simple bit tests.
  */
 static const char * const task_state_array[] = {
-        "R (running)",          /*   0 */
-        "S (sleeping)",         /*   1 */
-        "D (disk sleep)",       /*   2 */
-        "T (stopped)",          /*   4 */
-        "t (tracing stop)",     /*   8 */
-        "X (dead)",             /*  16 */
-        "Z (zombie)",           /*  32 */
+
+        /* states in TASK_REPORT: */
+        "R (running)",          /* 0x00 */
+        "S (sleeping)",         /* 0x01 */
+        "D (disk sleep)",       /* 0x02 */
+        "T (stopped)",          /* 0x04 */
+        "t (tracing stop)",     /* 0x08 */
+        "X (dead)",             /* 0x10 */
+        "Z (zombie)",           /* 0x20 */
+        "P (parked)",           /* 0x40 */
+
+        /* states beyond TASK_REPORT: */
+        "I (idle)",             /* 0x80 */
 };
 
 static inline const char *get_task_state(struct task_struct *tsk)
 {
-        unsigned int state = (tsk->state | tsk->exit_state) & TASK_REPORT;
-
-        /*
-         * Parked tasks do not run; they sit in __kthread_parkme().
-         * Without this check, we would report them as running, which is
-         * clearly wrong, so we report them as sleeping instead.
-         */
-        if (tsk->state == TASK_PARKED)
-                state = TASK_INTERRUPTIBLE;
-
-        BUILD_BUG_ON(1 + ilog2(TASK_REPORT) != ARRAY_SIZE(task_state_array)-1);
-
-        return task_state_array[fls(state)];
+        BUILD_BUG_ON(1 + ilog2(TASK_REPORT_MAX) != ARRAY_SIZE(task_state_array));
+        return task_state_array[__get_task_state(tsk)];
 }
 
 static inline int get_task_umask(struct task_struct *tsk)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8381db9db6d9..52ad15192e72 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1297,21 +1297,18 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
         spin_lock(&dquot->dq_dqb_lock);
         if (!sb_has_quota_limits_enabled(sb, dquot->dq_id.type) ||
             test_bit(DQ_FAKE_B, &dquot->dq_flags))
-                goto add;
+                goto finish;
 
         tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace
                 + space + rsv_space;
 
-        if (flags & DQUOT_SPACE_NOFAIL)
-                goto add;
-
         if (dquot->dq_dqb.dqb_bhardlimit &&
             tspace > dquot->dq_dqb.dqb_bhardlimit &&
             !ignore_hardlimit(dquot)) {
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BHARDWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1322,7 +1319,7 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BSOFTLONGWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1338,13 +1335,21 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                          * be always printed
                          */
                         ret = -EDQUOT;
-                        goto out;
+                        goto finish;
                 }
         }
-add:
-        dquot->dq_dqb.dqb_rsvspace += rsv_space;
-        dquot->dq_dqb.dqb_curspace += space;
-out:
+finish:
+        /*
+         * We have to be careful and go through warning generation & grace time
+         * setting even if DQUOT_SPACE_NOFAIL is set. That's why we check it
+         * only here...
+         */
+        if (flags & DQUOT_SPACE_NOFAIL)
+                ret = 0;
+        if (!ret) {
+                dquot->dq_dqb.dqb_rsvspace += rsv_space;
+                dquot->dq_dqb.dqb_curspace += space;
+        }
         spin_unlock(&dquot->dq_dqb_lock);
         return ret;
 }
@@ -1980,7 +1985,9 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
                 ret = dquot_add_space(transfer_to[cnt], cur_space, rsv_space, 0,
                                       &warn_to[cnt]);
                 if (ret) {
+                        spin_lock(&transfer_to[cnt]->dq_dqb_lock);
                         dquot_decr_inodes(transfer_to[cnt], inode_usage);
+                        spin_unlock(&transfer_to[cnt]->dq_dqb_lock);
                         goto over_quota;
                 }
         }
diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
index c0187cda2c1e..a73e5b34db41 100644
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -328,12 +328,16 @@ static int v2_write_dquot(struct dquot *dquot)
         if (!dquot->dq_off) {
                 alloc = true;
                 down_write(&dqopt->dqio_sem);
+        } else {
+                down_read(&dqopt->dqio_sem);
         }
         ret = qtree_write_dquot(
                         sb_dqinfo(dquot->dq_sb, dquot->dq_id.type)->dqi_priv,
                         dquot);
         if (alloc)
                 up_write(&dqopt->dqio_sem);
+        else
+                up_read(&dqopt->dqio_sem);
         return ret;
 }
 
diff --git a/fs/read_write.c b/fs/read_write.c
index a2b9a47235c5..f0d4b16873e8 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -112,7 +112,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence,
                  * In the generic case the entire file is data, so as long as
                  * offset isn't at the end of the file then the offset is data.
                  */
-                if (offset >= eof)
+                if ((unsigned long long)offset >= eof)
                         return -ENXIO;
                 break;
         case SEEK_HOLE:
@@ -120,7 +120,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence,
                  * There is a virtual hole at the end of the file, so as long as
                  * offset isn't i_size or larger, return i_size.
                  */
-                if (offset >= eof)
+                if ((unsigned long long)offset >= eof)
                         return -ENXIO;
                 offset = eof;
                 break;
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ef4b48d1ea42..1c713fd5b3e6 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -588,6 +588,12 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                         break;
                 if (ACCESS_ONCE(ctx->released) ||
                     fatal_signal_pending(current)) {
+                        /*
+                         * &ewq->wq may be queued in fork_event, but
+                         * __remove_wait_queue ignores the head
+                         * parameter. It would be a problem if it
+                         * didn't.
+                         */
                         __remove_wait_queue(&ctx->event_wqh, &ewq->wq);
                         if (ewq->msg.event == UFFD_EVENT_FORK) {
                                 struct userfaultfd_ctx *new;
@@ -1061,6 +1067,12 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                                         (unsigned long)
                                         uwq->msg.arg.reserved.reserved1;
                                 list_move(&uwq->wq.entry, &fork_event);
+                                /*
+                                 * fork_nctx can be freed as soon as
+                                 * we drop the lock, unless we take a
+                                 * reference on it.
+                                 */
+                                userfaultfd_ctx_get(fork_nctx);
                                 spin_unlock(&ctx->event_wqh.lock);
                                 ret = 0;
                                 break;
@@ -1091,19 +1103,53 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
 
         if (!ret && msg->event == UFFD_EVENT_FORK) {
                 ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+                spin_lock(&ctx->event_wqh.lock);
+                if (!list_empty(&fork_event)) {
+                        /*
+                         * The fork thread didn't abort, so we can
+                         * drop the temporary refcount.
+                         */
+                        userfaultfd_ctx_put(fork_nctx);
+
+                        uwq = list_first_entry(&fork_event,
+                                               typeof(*uwq),
+                                               wq.entry);
+                        /*
+                         * If fork_event list wasn't empty and in turn
+                         * the event wasn't already released by fork
+                         * (the event is allocated on fork kernel
+                         * stack), put the event back to its place in
+                         * the event_wq. fork_event head will be freed
+                         * as soon as we return so the event cannot
+                         * stay queued there no matter the current
+                         * "ret" value.
+                         */
+                        list_del(&uwq->wq.entry);
+                        __add_wait_queue(&ctx->event_wqh, &uwq->wq);
 
-                if (!ret) {
-                        spin_lock(&ctx->event_wqh.lock);
-                        if (!list_empty(&fork_event)) {
-                                uwq = list_first_entry(&fork_event,
-                                                       typeof(*uwq),
-                                                       wq.entry);
-                                list_del(&uwq->wq.entry);
-                                __add_wait_queue(&ctx->event_wqh, &uwq->wq);
+                        /*
+                         * Leave the event in the waitqueue and report
+                         * error to userland if we failed to resolve
+                         * the userfault fork.
+                         */
+                        if (likely(!ret))
                                 userfaultfd_event_complete(ctx, uwq);
-                        }
-                        spin_unlock(&ctx->event_wqh.lock);
+                } else {
+                        /*
+                         * Here the fork thread aborted and the
+                         * refcount from the fork thread on fork_nctx
+                         * has already been released. We still hold
+                         * the reference we took before releasing the
+                         * lock above. If resolve_userfault_fork
+                         * failed we've to drop it because the
+                         * fork_nctx has to be freed in such case. If
+                         * it succeeded we'll hold it because the new
+                         * uffd references it.
+                         */
+                        if (ret)
+                                userfaultfd_ctx_put(fork_nctx);
                 }
+                spin_unlock(&ctx->event_wqh.lock);
         }
 
         return ret;
diff --git a/fs/xattr.c b/fs/xattr.c
index 4424f7fecf14..61cd28ba25f3 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -250,7 +250,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value,
         }
         memcpy(value, buffer, len);
 out:
-        security_release_secctx(buffer, len);
+        kfree(buffer);
 out_noalloc:
         return len;
 }
diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
index b008ff3250eb..df3e600835e8 100644
--- a/fs/xfs/libxfs/xfs_ag_resv.c
+++ b/fs/xfs/libxfs/xfs_ag_resv.c
@@ -156,7 +156,8 @@ __xfs_ag_resv_free(
         trace_xfs_ag_resv_free(pag, type, 0);
 
         resv = xfs_perag_resv(pag, type);
-        pag->pag_mount->m_ag_max_usable += resv->ar_asked;
+        if (pag->pag_agno == 0)
+                pag->pag_mount->m_ag_max_usable += resv->ar_asked;
         /*
          * AGFL blocks are always considered "free", so whatever
          * was reserved at mount time must be given back at umount.
@@ -216,7 +217,14 @@ __xfs_ag_resv_init(
                 return error;
         }
 
-        mp->m_ag_max_usable -= ask;
+        /*
+         * Reduce the maximum per-AG allocation length by however much we're
+         * trying to reserve for an AG.  Since this is a filesystem-wide
+         * counter, we only make the adjustment for AG 0.  This assumes that
+         * there aren't any AGs hungrier for per-AG reservation than AG 0.
+         */
+        if (pag->pag_agno == 0)
+                mp->m_ag_max_usable -= ask;
 
         resv = xfs_perag_resv(pag, type);
         resv->ar_asked = ask;
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 744dcaec34cc..f965ce832bc0 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small(
 
                                 bp = xfs_btree_get_bufs(args->mp, args->tp,
                                         args->agno, fbno, 0);
+                                if (!bp) {
+                                        error = -EFSCORRUPTED;
+                                        goto error0;
+                                }
                                 xfs_trans_binval(args->tp, bp);
                         }
                         args->len = 1;
@@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist(
                 if (error)
                         goto out_agbp_relse;
                 bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
+                if (!bp) {
+                        error = -EFSCORRUPTED;
+                        goto out_agbp_relse;
+                }
                 xfs_trans_binval(tp, bp);
         }
 
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 459f4b4f08fe..89263797cf32 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -49,7 +49,6 @@
 #include "xfs_rmap.h"
 #include "xfs_ag_resv.h"
 #include "xfs_refcount.h"
-#include "xfs_rmap_btree.h"
 #include "xfs_icache.h"
 
 
@@ -192,12 +191,8 @@ xfs_bmap_worst_indlen(
         int             maxrecs;        /* maximum record count at this level */
         xfs_mount_t     *mp;            /* mount structure */
         xfs_filblks_t   rval;           /* return value */
-        xfs_filblks_t   orig_len;
 
         mp = ip->i_mount;
-
-        /* Calculate the worst-case size of the bmbt. */
-        orig_len = len;
         maxrecs = mp->m_bmap_dmxr[0];
         for (level = 0, rval = 0;
              level < XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK);
@@ -205,20 +200,12 @@ xfs_bmap_worst_indlen(
                 len += maxrecs - 1;
                 do_div(len, maxrecs);
                 rval += len;
-                if (len == 1) {
-                        rval += XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
+                if (len == 1)
+                        return rval + XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
                                 level - 1;
-                        break;
-                }
                 if (level == 0)
                         maxrecs = mp->m_bmap_dmxr[1];
         }
-
-        /* Calculate the worst-case size of the rmapbt. */
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
-                rval += 1 + xfs_rmapbt_calc_size(mp, orig_len) +
-                                mp->m_rmap_maxlevels;
-
         return rval;
 }
 
@@ -1490,14 +1477,14 @@ xfs_bmap_isaeof(
         int                     is_empty;
         int                     error;
 
-        bma->aeof = 0;
+        bma->aeof = false;
         error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
                                      &is_empty);
         if (error)
                 return error;
 
         if (is_empty) {
-                bma->aeof = 1;
+                bma->aeof = true;
                 return 0;
         }
 
@@ -3865,6 +3852,17 @@ xfs_trim_extent(
         }
 }
 
+/* trim extent to within eof */
+void
+xfs_trim_extent_eof(
+        struct xfs_bmbt_irec    *irec,
+        struct xfs_inode        *ip)
+
+{
+        xfs_trim_extent(irec, 0, XFS_B_TO_FSB(ip->i_mount,
+                                              i_size_read(VFS_I(ip))));
+}
+
 /*
  * Trim the returned map to the required bounds
  */
diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
index 851982a5dfbc..502e0d8fb4ff 100644
--- a/fs/xfs/libxfs/xfs_bmap.h
+++ b/fs/xfs/libxfs/xfs_bmap.h
@@ -208,6 +208,7 @@ void	xfs_bmap_trace_exlist(struct xfs_inode *ip, xfs_extnum_t cnt,
 
 void    xfs_trim_extent(struct xfs_bmbt_irec *irec, xfs_fileoff_t bno,
                 xfs_filblks_t len);
+void    xfs_trim_extent_eof(struct xfs_bmbt_irec *, struct xfs_inode *);
 int     xfs_bmap_add_attrfork(struct xfs_inode *ip, int size, int rsvd);
 void    xfs_bmap_local_to_extents_empty(struct xfs_inode *ip, int whichfork);
 void    xfs_bmap_add_free(struct xfs_mount *mp, struct xfs_defer_ops *dfops,
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 988bb3f31446..dfd643909f85 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1962,7 +1962,7 @@ xfs_difree_inobt(
         if (!(mp->m_flags & XFS_MOUNT_IKEEP) &&
             rec.ir_free == XFS_INOBT_ALL_FREE &&
             mp->m_sb.sb_inopblock <= XFS_INODES_PER_CHUNK) {
-                xic->deleted = 1;
+                xic->deleted = true;
                 xic->first_ino = XFS_AGINO_TO_INO(mp, agno, rec.ir_startino);
                 xic->alloc = xfs_inobt_irec_to_allocmask(&rec);
 
@@ -1989,7 +1989,7 @@ xfs_difree_inobt(
 
                 xfs_difree_inode_chunk(mp, agno, &rec, dfops);
         } else {
-                xic->deleted = 0;
+                xic->deleted = false;
 
                 error = xfs_inobt_update(cur, &rec);
                 if (error) {
diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h
index 8372e9bcd7b6..71de185735e0 100644
--- a/fs/xfs/libxfs/xfs_log_format.h
+++ b/fs/xfs/libxfs/xfs_log_format.h
@@ -270,6 +270,7 @@ typedef struct xfs_inode_log_format {
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
+        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -280,29 +281,17 @@ typedef struct xfs_inode_log_format {
         int32_t                 ilf_boffset;    /* off of inode in buffer */
 } xfs_inode_log_format_t;
 
-typedef struct xfs_inode_log_format_32 {
-        uint16_t                ilf_type;       /* inode log item type */
-        uint16_t                ilf_size;       /* size of this item */
-        uint32_t                ilf_fields;     /* flags for fields logged */
-        uint16_t                ilf_asize;      /* size of attr d/ext/root */
-        uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint64_t                ilf_ino;        /* inode number */
-        union {
-                uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
-                uuid_t          ilfu_uuid;      /* mount point value */
-        } ilf_u;
-        int64_t                 ilf_blkno;      /* blkno of inode buffer */
-        int32_t                 ilf_len;        /* len of inode buffer */
-        int32_t                 ilf_boffset;    /* off of inode in buffer */
-} __attribute__((packed)) xfs_inode_log_format_32_t;
-
-typedef struct xfs_inode_log_format_64 {
+/*
+ * Old 32 bit systems will log in this format without the 64 bit
+ * alignment padding. Recovery will detect this and convert it to the
+ * correct format.
+ */
+struct xfs_inode_log_format_32 {
         uint16_t                ilf_type;       /* inode log item type */
         uint16_t                ilf_size;       /* size of this item */
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -311,7 +300,7 @@ typedef struct xfs_inode_log_format_64 {
         int64_t                 ilf_blkno;      /* blkno of inode buffer */
         int32_t                 ilf_len;        /* len of inode buffer */
         int32_t                 ilf_boffset;    /* off of inode in buffer */
-} xfs_inode_log_format_64_t;
+} __attribute__((packed));
 
 
 /*
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index 7034e17535de..3354140de07e 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -247,6 +247,8 @@ xfs_set_mode(struct inode *inode, umode_t mode)
 int
 xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
+        umode_t mode;
+        bool set_mode = false;
         int error = 0;
 
         if (!acl)
@@ -257,16 +259,24 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                 return error;
 
         if (type == ACL_TYPE_ACCESS) {
-                umode_t mode;
-
                 error = posix_acl_update_mode(inode, &mode, &acl);
                 if (error)
                         return error;
-                error = xfs_set_mode(inode, mode);
-                if (error)
-                        return error;
+                set_mode = true;
         }
 
  set_acl:
-        return __xfs_set_acl(inode, acl, type);
+        error =  __xfs_set_acl(inode, acl, type);
+        if (error)
+                return error;
+
+        /*
+         * We set the mode after successfully updating the ACL xattr because the
+         * xattr update can fail at ENOSPC and we don't want to change the mode
+         * if the ACL update hasn't been applied.
+         */
+        if (set_mode)
+                error = xfs_set_mode(inode, mode);
+
+        return error;
 }
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 29172609f2a3..a3eeaba156c5 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -343,7 +343,8 @@ xfs_end_io(
                 error = xfs_reflink_end_cow(ip, offset, size);
                 break;
         case XFS_IO_UNWRITTEN:
-                error = xfs_iomap_write_unwritten(ip, offset, size);
+                /* writeback should never update isize */
+                error = xfs_iomap_write_unwritten(ip, offset, size, false);
                 break;
         default:
                 ASSERT(!xfs_ioend_is_append(ioend) || ioend->io_append_trans);
@@ -445,6 +446,19 @@ xfs_imap_valid(
 {
         offset >>= inode->i_blkbits;
 
+        /*
+         * We have to make sure the cached mapping is within EOF to protect
+         * against eofblocks trimming on file release leaving us with a stale
+         * mapping. Otherwise, a page for a subsequent file extending buffered
+         * write could get picked up by this writeback cycle and written to the
+         * wrong blocks.
+         *
+         * Note that what we really want here is a generic mapping invalidation
+         * mechanism to protect us from arbitrary extent modifying contexts, not
+         * just eofblocks.
+         */
+        xfs_trim_extent_eof(imap, XFS_I(inode));
+
         return offset >= imap->br_startoff &&
                 offset < imap->br_startoff + imap->br_blockcount;
 }
@@ -734,6 +748,14 @@ xfs_vm_invalidatepage(
 {
         trace_xfs_invalidatepage(page->mapping->host, page, offset,
                                  length);
+
+        /*
+         * If we are invalidating the entire page, clear the dirty state from it
+         * so that we can check for attempts to release dirty cached pages in
+         * xfs_vm_releasepage().
+         */
+        if (offset == 0 && length >= PAGE_SIZE)
+                cancel_dirty_page(page);
         block_invalidatepage(page, offset, length);
 }
 
@@ -1189,25 +1211,27 @@ xfs_vm_releasepage(
          * mm accommodates an old ext3 case where clean pages might not have had
          * the dirty bit cleared. Thus, it can send actual dirty pages to
          * ->releasepage() via shrink_active_list(). Conversely,
-         * block_invalidatepage() can send pages that are still marked dirty
-         * but otherwise have invalidated buffers.
+         * block_invalidatepage() can send pages that are still marked dirty but
+         * otherwise have invalidated buffers.
          *
          * We want to release the latter to avoid unnecessary buildup of the
-         * LRU, skip the former and warn if we've left any lingering
-         * delalloc/unwritten buffers on clean pages. Skip pages with delalloc
-         * or unwritten buffers and warn if the page is not dirty. Otherwise
-         * try to release the buffers.
+         * LRU, so xfs_vm_invalidatepage() clears the page dirty flag on pages
+         * that are entirely invalidated and need to be released.  Hence the
+         * only time we should get dirty pages here is through
+         * shrink_active_list() and so we can simply skip those now.
+         *
+         * warn if we've left any lingering delalloc/unwritten buffers on clean
+         * or invalidated pages we are about to release.
          */
+        if (PageDirty(page))
+                return 0;
+
         xfs_count_page_state(page, &delalloc, &unwritten);
 
-        if (delalloc) {
-                WARN_ON_ONCE(!PageDirty(page));
+        if (WARN_ON_ONCE(delalloc))
                 return 0;
-        }
-        if (unwritten) {
-                WARN_ON_ONCE(!PageDirty(page));
+        if (WARN_ON_ONCE(unwritten))
                 return 0;
-        }
 
         return try_to_free_buffers(page);
 }
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index ebd66b19fbfc..e3a950ed35a8 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -302,6 +302,8 @@ xfs_attr3_node_inactive(
                                                  &bp, XFS_ATTR_FORK);
                         if (error)
                                 return error;
+                        node = bp->b_addr;
+                        btree = dp->d_ops->node_tree_p(node);
                         child_fsb = be32_to_cpu(btree[i + 1].before);
                         xfs_trans_brelse(*trans, bp);
                 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index cd9a5400ba4f..6503cfa44262 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -84,6 +84,7 @@ xfs_zero_extent(
                 GFP_NOFS, 0);
 }
 
+#ifdef CONFIG_XFS_RT
 int
 xfs_bmap_rtalloc(
         struct xfs_bmalloca     *ap)    /* bmap alloc argument struct */
@@ -190,6 +191,7 @@ xfs_bmap_rtalloc(
         }
         return 0;
 }
+#endif /* CONFIG_XFS_RT */
 
 /*
  * Check if the endoff is outside the last extent. If so the caller will grow
@@ -1459,7 +1461,19 @@ xfs_shift_file_space(
                 return error;
 
         /*
-         * The extent shiting code works on extent granularity. So, if
+         * Clean out anything hanging around in the cow fork now that
+         * we've flushed all the dirty data out to disk to avoid having
+         * CoW extents at the wrong offsets.
+         */
+        if (xfs_is_reflink_inode(ip)) {
+                error = xfs_reflink_cancel_cow_range(ip, offset, NULLFILEOFF,
+                                true);
+                if (error)
+                        return error;
+        }
+
+        /*
+         * The extent shifting code works on extent granularity. So, if
          * stop_fsb is not the starting block of extent, we need to split
          * the extent at stop_fsb.
          */
@@ -2110,11 +2124,31 @@ xfs_swap_extents(
                 ip->i_d.di_flags2 |= tip->i_d.di_flags2 & XFS_DIFLAG2_REFLINK;
                 tip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
                 tip->i_d.di_flags2 |= f & XFS_DIFLAG2_REFLINK;
+        }
+
+        /* Swap the cow forks. */
+        if (xfs_sb_version_hasreflink(&mp->m_sb)) {
+                xfs_extnum_t    extnum;
+
+                ASSERT(ip->i_cformat == XFS_DINODE_FMT_EXTENTS);
+                ASSERT(tip->i_cformat == XFS_DINODE_FMT_EXTENTS);
+
+                extnum = ip->i_cnextents;
+                ip->i_cnextents = tip->i_cnextents;
+                tip->i_cnextents = extnum;
+
                 cowfp = ip->i_cowfp;
                 ip->i_cowfp = tip->i_cowfp;
                 tip->i_cowfp = cowfp;
-                xfs_inode_set_cowblocks_tag(ip);
-                xfs_inode_set_cowblocks_tag(tip);
+
+                if (ip->i_cowfp && ip->i_cnextents)
+                        xfs_inode_set_cowblocks_tag(ip);
+                else
+                        xfs_inode_clear_cowblocks_tag(ip);
+                if (tip->i_cowfp && tip->i_cnextents)
+                        xfs_inode_set_cowblocks_tag(tip);
+                else
+                        xfs_inode_clear_cowblocks_tag(tip);
         }
 
         xfs_trans_log_inode(tp, ip,  src_log_flags);
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 0eaa81dc49be..7d330b3c77c3 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -28,7 +28,20 @@ struct xfs_mount;
 struct xfs_trans;
 struct xfs_bmalloca;
 
+#ifdef CONFIG_XFS_RT
 int     xfs_bmap_rtalloc(struct xfs_bmalloca *ap);
+#else /* !CONFIG_XFS_RT */
+/*
+ * Attempts to allocate RT extents when RT is disable indicates corruption and
+ * should trigger a shutdown.
+ */
+static inline int
+xfs_bmap_rtalloc(struct xfs_bmalloca *ap)
+{
+        return -EFSCORRUPTED;
+}
+#endif /* CONFIG_XFS_RT */
+
 int     xfs_bmap_eof(struct xfs_inode *ip, xfs_fileoff_t endoff,
                      int whichfork, int *eof);
 int     xfs_bmap_punch_delalloc_range(struct xfs_inode *ip,
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index da14658da310..2f97c12ca75e 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1258,8 +1258,6 @@ xfs_buf_ioapply_map(
         int             size;
         int             offset;
 
-        total_nr_pages = bp->b_page_count;
-
         /* skip the pages in the buffer before the start offset */
         page_index = 0;
         offset = *buf_offset;
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index bd786a9ac2c3..eaf86f55b7f2 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -347,7 +347,7 @@ xfs_verifier_error(
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
 
-        xfs_alert(mp, "Metadata %s detected at %pF, %s block 0x%llx",
+        xfs_alert(mp, "Metadata %s detected at %pS, %s block 0x%llx",
                   bp->b_error == -EFSBADCRC ? "CRC error" : "corruption",
                   __return_address, bp->b_ops->name, bp->b_bn);
 
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ebdd0bd2b261..6526ef0e2a23 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -58,7 +58,7 @@ xfs_zero_range(
         xfs_off_t               count,
         bool                    *did_zero)
 {
-        return iomap_zero_range(VFS_I(ip), pos, count, NULL, &xfs_iomap_ops);
+        return iomap_zero_range(VFS_I(ip), pos, count, did_zero, &xfs_iomap_ops);
 }
 
 int
@@ -237,11 +237,13 @@ xfs_file_dax_read(
         if (!count)
                 return 0; /* skip atime */
 
-        if (!xfs_ilock_nowait(ip, XFS_IOLOCK_SHARED)) {
-                if (iocb->ki_flags & IOCB_NOWAIT)
+        if (iocb->ki_flags & IOCB_NOWAIT) {
+                if (!xfs_ilock_nowait(ip, XFS_IOLOCK_SHARED))
                         return -EAGAIN;
+        } else {
                 xfs_ilock(ip, XFS_IOLOCK_SHARED);
         }
+
         ret = dax_iomap_rw(iocb, to, &xfs_iomap_ops);
         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
 
@@ -259,9 +261,10 @@ xfs_file_buffered_aio_read(
 
         trace_xfs_file_buffered_read(ip, iov_iter_count(to), iocb->ki_pos);
 
-        if (!xfs_ilock_nowait(ip, XFS_IOLOCK_SHARED)) {
-                if (iocb->ki_flags & IOCB_NOWAIT)
+        if (iocb->ki_flags & IOCB_NOWAIT) {
+                if (!xfs_ilock_nowait(ip, XFS_IOLOCK_SHARED))
                         return -EAGAIN;
+        } else {
                 xfs_ilock(ip, XFS_IOLOCK_SHARED);
         }
         ret = generic_file_read_iter(iocb, to);
@@ -377,8 +380,6 @@ restart:
          */
         spin_lock(&ip->i_flags_lock);
         if (iocb->ki_pos > i_size_read(inode)) {
-                bool    zero = false;
-
                 spin_unlock(&ip->i_flags_lock);
                 if (!drained_dio) {
                         if (*iolock == XFS_IOLOCK_SHARED) {
@@ -399,7 +400,7 @@ restart:
                         drained_dio = true;
                         goto restart;
                 }
-                error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), &zero);
+                error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
                 if (error)
                         return error;
         } else
@@ -436,7 +437,6 @@ xfs_dio_write_end_io(
         struct inode            *inode = file_inode(iocb->ki_filp);
         struct xfs_inode        *ip = XFS_I(inode);
         loff_t                  offset = iocb->ki_pos;
-        bool                    update_size = false;
         int                     error = 0;
 
         trace_xfs_end_io_direct_write(ip, offset, size);
@@ -447,6 +447,21 @@ xfs_dio_write_end_io(
         if (size <= 0)
                 return size;
 
+        if (flags & IOMAP_DIO_COW) {
+                error = xfs_reflink_end_cow(ip, offset, size);
+                if (error)
+                        return error;
+        }
+
+        /*
+         * Unwritten conversion updates the in-core isize after extent
+         * conversion but before updating the on-disk size. Updating isize any
+         * earlier allows a racing dio read to find unwritten extents before
+         * they are converted.
+         */
+        if (flags & IOMAP_DIO_UNWRITTEN)
+                return xfs_iomap_write_unwritten(ip, offset, size, true);
+
         /*
          * We need to update the in-core inode size here so that we don't end up
          * with the on-disk inode size being outside the in-core inode size. We
@@ -461,20 +476,11 @@ xfs_dio_write_end_io(
         spin_lock(&ip->i_flags_lock);
         if (offset + size > i_size_read(inode)) {
                 i_size_write(inode, offset + size);
-                update_size = true;
-        }
-        spin_unlock(&ip->i_flags_lock);
-
-        if (flags & IOMAP_DIO_COW) {
-                error = xfs_reflink_end_cow(ip, offset, size);
-                if (error)
-                        return error;
-        }
-
-        if (flags & IOMAP_DIO_UNWRITTEN)
-                error = xfs_iomap_write_unwritten(ip, offset, size);
-        else if (update_size)
+                spin_unlock(&ip->i_flags_lock);
                 error = xfs_setfilesize(ip, offset, size);
+        } else {
+                spin_unlock(&ip->i_flags_lock);
+        }
 
         return error;
 }
@@ -549,9 +555,10 @@ xfs_file_dio_aio_write(
                 iolock = XFS_IOLOCK_SHARED;
         }
 
-        if (!xfs_ilock_nowait(ip, iolock)) {
-                if (iocb->ki_flags & IOCB_NOWAIT)
+        if (iocb->ki_flags & IOCB_NOWAIT) {
+                if (!xfs_ilock_nowait(ip, iolock))
                         return -EAGAIN;
+        } else {
                 xfs_ilock(ip, iolock);
         }
 
@@ -603,9 +610,10 @@ xfs_file_dax_write(
         size_t                  count;
         loff_t                  pos;
 
-        if (!xfs_ilock_nowait(ip, iolock)) {
-                if (iocb->ki_flags & IOCB_NOWAIT)
+        if (iocb->ki_flags & IOCB_NOWAIT) {
+                if (!xfs_ilock_nowait(ip, iolock))
                         return -EAGAIN;
+        } else {
                 xfs_ilock(ip, iolock);
         }
 
@@ -761,7 +769,7 @@ xfs_file_fallocate(
         enum xfs_prealloc_flags flags = 0;
         uint                    iolock = XFS_IOLOCK_EXCL;
         loff_t                  new_size = 0;
-        bool                    do_file_insert = 0;
+        bool                    do_file_insert = false;
 
         if (!S_ISREG(inode->i_mode))
                 return -EINVAL;
@@ -822,7 +830,7 @@ xfs_file_fallocate(
                         error = -EINVAL;
                         goto out_unlock;
                 }
-                do_file_insert = 1;
+                do_file_insert = true;
         } else {
                 flags |= XFS_PREALLOC_SET;
 
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 814ed729881d..43cfc07996a4 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -367,29 +367,6 @@ xfs_getfsmap_datadev_helper(
         return xfs_getfsmap_helper(cur->bc_tp, info, rec, rec_daddr);
 }
 
-/* Transform a rtbitmap "record" into a fsmap */
-STATIC int
-xfs_getfsmap_rtdev_rtbitmap_helper(
-        struct xfs_trans                *tp,
-        struct xfs_rtalloc_rec          *rec,
-        void                            *priv)
-{
-        struct xfs_mount                *mp = tp->t_mountp;
-        struct xfs_getfsmap_info        *info = priv;
-        struct xfs_rmap_irec            irec;
-        xfs_daddr_t                     rec_daddr;
-
-        rec_daddr = XFS_FSB_TO_BB(mp, rec->ar_startblock);
-
-        irec.rm_startblock = rec->ar_startblock;
-        irec.rm_blockcount = rec->ar_blockcount;
-        irec.rm_owner = XFS_RMAP_OWN_NULL;      /* "free" */
-        irec.rm_offset = 0;
-        irec.rm_flags = 0;
-
-        return xfs_getfsmap_helper(tp, info, &irec, rec_daddr);
-}
-
 /* Transform a bnobt irec into a fsmap */
 STATIC int
 xfs_getfsmap_datadev_bnobt_helper(
@@ -475,6 +452,30 @@ xfs_getfsmap_logdev(
         return xfs_getfsmap_helper(tp, info, &rmap, 0);
 }
 
+#ifdef CONFIG_XFS_RT
+/* Transform a rtbitmap "record" into a fsmap */
+STATIC int
+xfs_getfsmap_rtdev_rtbitmap_helper(
+        struct xfs_trans                *tp,
+        struct xfs_rtalloc_rec          *rec,
+        void                            *priv)
+{
+        struct xfs_mount                *mp = tp->t_mountp;
+        struct xfs_getfsmap_info        *info = priv;
+        struct xfs_rmap_irec            irec;
+        xfs_daddr_t                     rec_daddr;
+
+        rec_daddr = XFS_FSB_TO_BB(mp, rec->ar_startblock);
+
+        irec.rm_startblock = rec->ar_startblock;
+        irec.rm_blockcount = rec->ar_blockcount;
+        irec.rm_owner = XFS_RMAP_OWN_NULL;      /* "free" */
+        irec.rm_offset = 0;
+        irec.rm_flags = 0;
+
+        return xfs_getfsmap_helper(tp, info, &irec, rec_daddr);
+}
+
 /* Execute a getfsmap query against the realtime device. */
 STATIC int
 __xfs_getfsmap_rtdev(
@@ -561,6 +562,7 @@ xfs_getfsmap_rtdev_rtbitmap(
         return __xfs_getfsmap_rtdev(tp, keys, xfs_getfsmap_rtdev_rtbitmap_query,
                         info);
 }
+#endif /* CONFIG_XFS_RT */
 
 /* Execute a getfsmap query against the regular data device. */
 STATIC int
@@ -795,7 +797,15 @@ xfs_getfsmap_check_keys(
         return false;
 }
 
+/*
+ * There are only two devices if we didn't configure RT devices at build time.
+ */
+#ifdef CONFIG_XFS_RT
 #define XFS_GETFSMAP_DEVS       3
+#else
+#define XFS_GETFSMAP_DEVS       2
+#endif /* CONFIG_XFS_RT */
+
 /*
  * Get filesystem's extents as described in head, and format for
  * output.  Calls formatter to fill the user's buffer until all
@@ -853,10 +863,12 @@ xfs_getfsmap(
                 handlers[1].dev = new_encode_dev(mp->m_logdev_targp->bt_dev);
                 handlers[1].fn = xfs_getfsmap_logdev;
         }
+#ifdef CONFIG_XFS_RT
         if (mp->m_rtdev_targp) {
                 handlers[2].dev = new_encode_dev(mp->m_rtdev_targp->bt_dev);
                 handlers[2].fn = xfs_getfsmap_rtdev_rtbitmap;
         }
+#endif /* CONFIG_XFS_RT */
 
         xfs_sort(handlers, XFS_GETFSMAP_DEVS, sizeof(struct xfs_getfsmap_dev),
                         xfs_getfsmap_dev_compare);
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 5599dda4727a..4ec5b7f45401 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1624,10 +1624,12 @@ xfs_itruncate_extents(
                 goto out;
 
         /*
-         * Clear the reflink flag if we truncated everything.
+         * Clear the reflink flag if there are no data fork blocks and
+         * there are no extents staged in the cow fork.
          */
-        if (ip->i_d.di_nblocks == 0 && xfs_is_reflink_inode(ip)) {
-                ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
+        if (xfs_is_reflink_inode(ip) && ip->i_cnextents == 0) {
+                if (ip->i_d.di_nblocks == 0)
+                        ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
                 xfs_inode_clear_cowblocks_tag(ip);
         }
 
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 6d0f74ec31e8..9bbc2d7cc8cb 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -364,6 +364,9 @@ xfs_inode_to_log_dinode(
         to->di_dmstate = from->di_dmstate;
         to->di_flags = from->di_flags;
 
+        /* log a dummy value to ensure log structure is fully initialised */
+        to->di_next_unlinked = NULLAGINO;
+
         if (from->di_version == 3) {
                 to->di_changecount = inode->i_version;
                 to->di_crtime.t_sec = from->di_crtime.t_sec;
@@ -404,6 +407,11 @@ xfs_inode_item_format_core(
  * the second with the on-disk inode structure, and a possible third and/or
  * fourth with the inode data/extents/b-tree root and inode attributes
  * data/extents/b-tree root.
+ *
+ * Note: Always use the 64 bit inode log format structure so we don't
+ * leave an uninitialised hole in the format item on 64 bit systems. Log
+ * recovery on 32 bit systems handles this just fine, so there's no reason
+ * for not using an initialising the properly padded structure all the time.
  */
 STATIC void
 xfs_inode_item_format(
@@ -412,8 +420,8 @@ xfs_inode_item_format(
 {
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
-        struct xfs_inode_log_format *ilf;
         struct xfs_log_iovec    *vecp = NULL;
+        struct xfs_inode_log_format *ilf;
 
         ASSERT(ip->i_d.di_version > 1);
 
@@ -425,7 +433,17 @@ xfs_inode_item_format(
         ilf->ilf_boffset = ip->i_imap.im_boffset;
         ilf->ilf_fields = XFS_ILOG_CORE;
         ilf->ilf_size = 2; /* format + core */
-        xlog_finish_iovec(lv, vecp, sizeof(struct xfs_inode_log_format));
+
+        /*
+         * make sure we don't leak uninitialised data into the log in the case
+         * when we don't log every field in the inode.
+         */
+        ilf->ilf_dsize = 0;
+        ilf->ilf_asize = 0;
+        ilf->ilf_pad = 0;
+        uuid_copy(&ilf->ilf_u.ilfu_uuid, &uuid_null);
+
+        xlog_finish_iovec(lv, vecp, sizeof(*ilf));
 
         xfs_inode_item_format_core(ip, lv, &vecp);
         xfs_inode_item_format_data_fork(iip, ilf, lv, &vecp);
@@ -745,7 +763,7 @@ xfs_iflush_done(
                  */
                 iip = INODE_ITEM(blip);
                 if ((iip->ili_logged && blip->li_lsn == iip->ili_flush_lsn) ||
-                    lip->li_flags & XFS_LI_FAILED)
+                    (blip->li_flags & XFS_LI_FAILED))
                         need_ail++;
 
                 blip = next;
@@ -855,44 +873,29 @@ xfs_istale_done(
 }
 
 /*
- * convert an xfs_inode_log_format struct from either 32 or 64 bit versions
- * (which can have different field alignments) to the native version
+ * convert an xfs_inode_log_format struct from the old 32 bit version
+ * (which can have different field alignments) to the native 64 bit version
  */
 int
 xfs_inode_item_format_convert(
-        xfs_log_iovec_t         *buf,
-        xfs_inode_log_format_t  *in_f)
+        struct xfs_log_iovec            *buf,
+        struct xfs_inode_log_format     *in_f)
 {
-        if (buf->i_len == sizeof(xfs_inode_log_format_32_t)) {
-                xfs_inode_log_format_32_t *in_f32 = buf->i_addr;
-
-                in_f->ilf_type = in_f32->ilf_type;
-                in_f->ilf_size = in_f32->ilf_size;
-                in_f->ilf_fields = in_f32->ilf_fields;
-                in_f->ilf_asize = in_f32->ilf_asize;
-                in_f->ilf_dsize = in_f32->ilf_dsize;
-                in_f->ilf_ino = in_f32->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f32->ilf_blkno;
-                in_f->ilf_len = in_f32->ilf_len;
-                in_f->ilf_boffset = in_f32->ilf_boffset;
-                return 0;
-        } else if (buf->i_len == sizeof(xfs_inode_log_format_64_t)){
-                xfs_inode_log_format_64_t *in_f64 = buf->i_addr;
-
-                in_f->ilf_type = in_f64->ilf_type;
-                in_f->ilf_size = in_f64->ilf_size;
-                in_f->ilf_fields = in_f64->ilf_fields;
-                in_f->ilf_asize = in_f64->ilf_asize;
-                in_f->ilf_dsize = in_f64->ilf_dsize;
-                in_f->ilf_ino = in_f64->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f64->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f64->ilf_blkno;
-                in_f->ilf_len = in_f64->ilf_len;
-                in_f->ilf_boffset = in_f64->ilf_boffset;
-                return 0;
-        }
-        return -EFSCORRUPTED;
+        struct xfs_inode_log_format_32  *in_f32 = buf->i_addr;
+
+        if (buf->i_len != sizeof(*in_f32))
+                return -EFSCORRUPTED;
+
+        in_f->ilf_type = in_f32->ilf_type;
+        in_f->ilf_size = in_f32->ilf_size;
+        in_f->ilf_fields = in_f32->ilf_fields;
+        in_f->ilf_asize = in_f32->ilf_asize;
+        in_f->ilf_dsize = in_f32->ilf_dsize;
+        in_f->ilf_ino = in_f32->ilf_ino;
+        /* copy biggest field of ilf_u */
+        uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
+        in_f->ilf_blkno = in_f32->ilf_blkno;
+        in_f->ilf_len = in_f32->ilf_len;
+        in_f->ilf_boffset = in_f32->ilf_boffset;
+        return 0;
 }
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 5049e8ab6e30..aa75389be8cf 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1088,6 +1088,7 @@ xfs_ioctl_setattr_dax_invalidate(
         int                     *join_flags)
 {
         struct inode            *inode = VFS_I(ip);
+        struct super_block      *sb = inode->i_sb;
         int                     error;
 
         *join_flags = 0;
@@ -1100,7 +1101,7 @@ xfs_ioctl_setattr_dax_invalidate(
         if (fa->fsx_xflags & FS_XFLAG_DAX) {
                 if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)))
                         return -EINVAL;
-                if (ip->i_mount->m_sb.sb_blocksize != PAGE_SIZE)
+                if (bdev_dax_supported(sb, sb->s_blocksize) < 0)
                         return -EINVAL;
         }
 
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index a1909bc064e9..f179bdf1644d 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -829,7 +829,8 @@ int
 xfs_iomap_write_unwritten(
         xfs_inode_t     *ip,
         xfs_off_t       offset,
-        xfs_off_t       count)
+        xfs_off_t       count,
+        bool            update_isize)
 {
         xfs_mount_t     *mp = ip->i_mount;
         xfs_fileoff_t   offset_fsb;
@@ -840,6 +841,7 @@ xfs_iomap_write_unwritten(
         xfs_trans_t     *tp;
         xfs_bmbt_irec_t imap;
         struct xfs_defer_ops dfops;
+        struct inode    *inode = VFS_I(ip);
         xfs_fsize_t     i_size;
         uint            resblks;
         int             error;
@@ -899,7 +901,8 @@ xfs_iomap_write_unwritten(
                 i_size = XFS_FSB_TO_B(mp, offset_fsb + count_fsb);
                 if (i_size > offset + count)
                         i_size = offset + count;
-
+                if (update_isize && i_size > i_size_read(inode))
+                        i_size_write(inode, i_size);
                 i_size = xfs_new_eof(ip, i_size);
                 if (i_size) {
                         ip->i_d.di_size = i_size;
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index 00db3ecea084..ee535065c5d0 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -27,7 +27,7 @@ int xfs_iomap_write_direct(struct xfs_inode *, xfs_off_t, size_t,
                         struct xfs_bmbt_irec *, int);
 int xfs_iomap_write_allocate(struct xfs_inode *, int, xfs_off_t,
                         struct xfs_bmbt_irec *);
-int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, xfs_off_t);
+int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, xfs_off_t, bool);
 
 void xfs_bmbt_to_iomap(struct xfs_inode *, struct iomap *,
                 struct xfs_bmbt_irec *);
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index c5107c7bc4bf..dc95a49d62e7 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2515,7 +2515,7 @@ next_lv:
                                 if (lv)
                                         vecp = lv->lv_iovecp;
                         }
-                        if (record_cnt == 0 && ordered == false) {
+                        if (record_cnt == 0 && !ordered) {
                                 if (!lv)
                                         return 0;
                                 break;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index ea7d4b4e50d0..e9727d0a541a 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -704,7 +704,7 @@ xfs_mountfs(
         xfs_set_maxicount(mp);
 
         /* enable fail_at_unmount as default */
-        mp->m_fail_unmount = 1;
+        mp->m_fail_unmount = true;
 
         error = xfs_sysfs_init(&mp->m_kobj, &xfs_mp_ktype, NULL, mp->m_fsname);
         if (error)
diff --git a/fs/xfs/xfs_ondisk.h b/fs/xfs/xfs_ondisk.h
index 0c381d71b242..0492436a053f 100644
--- a/fs/xfs/xfs_ondisk.h
+++ b/fs/xfs/xfs_ondisk.h
@@ -134,7 +134,7 @@ xfs_check_ondisk_structs(void)
         XFS_CHECK_STRUCT_SIZE(struct xfs_icreate_log,           28);
         XFS_CHECK_STRUCT_SIZE(struct xfs_ictimestamp,           8);
         XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_32,   52);
-        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_64,   56);
+        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format,      56);
         XFS_CHECK_STRUCT_SIZE(struct xfs_qoff_logformat,        20);
         XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header,          16);
 }
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index 2f2dc3c09ad0..4246876df7b7 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -274,7 +274,7 @@ xfs_fs_commit_blocks(
                                         (end - 1) >> PAGE_SHIFT);
                 WARN_ON_ONCE(error);
 
-                error = xfs_iomap_write_unwritten(ip, start, length);
+                error = xfs_iomap_write_unwritten(ip, start, length, false);
                 if (error)
                         goto out_drop_iolock;
         }
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 3246815c24d6..37e603bf1591 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -736,7 +736,13 @@ xfs_reflink_end_cow(
         /* If there is a hole at end_fsb - 1 go to the previous extent */
         if (!xfs_iext_lookup_extent(ip, ifp, end_fsb - 1, &idx, &got) ||
             got.br_startoff > end_fsb) {
-                ASSERT(idx > 0);
+                /*
+                 * In case of racing, overlapping AIO writes no COW extents
+                 * might be left by the time I/O completes for the loser of
+                 * the race.  In that case we are done.
+                 */
+                if (idx <= 0)
+                        goto out_cancel;
                 xfs_iext_get_extent(ifp, --idx, &got);
         }
 
@@ -809,6 +815,7 @@ next_extent:
 
 out_defer:
         xfs_defer_cancel(&dfops);
+out_cancel:
         xfs_trans_cancel(tp);
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out:
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index c996f4ae4a5f..f663022353c0 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1637,7 +1637,7 @@ xfs_fs_fill_super(
 
         /* version 5 superblocks support inode version counters. */
         if (XFS_SB_VERSION_NUM(&mp->m_sb) == XFS_SB_VERSION_5)
-                sb->s_flags |= MS_I_VERSION;
+                sb->s_flags |= SB_I_VERSION;
 
         if (mp->m_flags & XFS_MOUNT_DAX) {
                 xfs_warn(mp,
@@ -1654,6 +1654,16 @@ xfs_fs_fill_super(
                 "DAX and reflink have not been tested together!");
         }
 
+        if (mp->m_flags & XFS_MOUNT_DISCARD) {
+                struct request_queue *q = bdev_get_queue(sb->s_bdev);
+
+                if (!blk_queue_discard(q)) {
+                        xfs_warn(mp, "mounting with \"discard\" option, but "
+                                        "the device does not support discard");
+                        mp->m_flags &= ~XFS_MOUNT_DISCARD;
+                }
+        }
+
         if (xfs_sb_version_hasrmapbt(&mp->m_sb)) {
                 if (mp->m_sb.sb_rblocks) {
                         xfs_alert(mp,
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 0504ef8f3aa3..976f8ac26665 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -115,15 +115,35 @@ do {									\
         (__ret);                                                        \
 })
 
-#define this_cpu_generic_read(pcp)                                      \
+#define __this_cpu_generic_read_nopreempt(pcp)                          \
 ({                                                                      \
         typeof(pcp) __ret;                                              \
         preempt_disable_notrace();                                      \
-        __ret = raw_cpu_generic_read(pcp);                              \
+        __ret = READ_ONCE(*raw_cpu_ptr(&(pcp)));                        \
         preempt_enable_notrace();                                       \
         __ret;                                                          \
 })
 
+#define __this_cpu_generic_read_noirq(pcp)                              \
+({                                                                      \
+        typeof(pcp) __ret;                                              \
+        unsigned long __flags;                                          \
+        raw_local_irq_save(__flags);                                    \
+        __ret = raw_cpu_generic_read(pcp);                              \
+        raw_local_irq_restore(__flags);                                 \
+        __ret;                                                          \
+})
+
+#define this_cpu_generic_read(pcp)                                      \
+({                                                                      \
+        typeof(pcp) __ret;                                              \
+        if (__native_word(pcp))                                         \
+                __ret = __this_cpu_generic_read_nopreempt(pcp);         \
+        else                                                            \
+                __ret = __this_cpu_generic_read_noirq(pcp);             \
+        __ret;                                                          \
+})
+
 #define this_cpu_generic_to_op(pcp, val, op)                            \
 do {                                                                    \
         unsigned long __flags;                                          \
diff --git a/include/dt-bindings/reset/snps,hsdk-reset.h b/include/dt-bindings/reset/snps,hsdk-reset.h
new file mode 100644
index 000000000000..e1a643e4bc91
--- /dev/null
+++ b/include/dt-bindings/reset/snps,hsdk-reset.h
@@ -0,0 +1,17 @@
+/**
+ * This header provides index for the HSDK reset controller.
+ */
+#ifndef _DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK
+#define _DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK
+
+#define HSDK_APB_RESET  0
+#define HSDK_AXI_RESET  1
+#define HSDK_ETH_RESET  2
+#define HSDK_USB_RESET  3
+#define HSDK_SDIO_RESET 4
+#define HSDK_HDMI_RESET 5
+#define HSDK_GFX_RESET  6
+#define HSDK_DMAC_RESET 7
+#define HSDK_EBI_RESET  8
+
+#endif /*_DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK*/
diff --git a/include/dt-bindings/reset/snps,hsdk-v1-reset.h b/include/dt-bindings/reset/snps,hsdk-v1-reset.h
deleted file mode 100644
index d898c89b7123..000000000000
--- a/include/dt-bindings/reset/snps,hsdk-v1-reset.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * This header provides index for the HSDK v1 reset controller.
- */
-#ifndef _DT_BINDINGS_RESET_CONTROLLER_HSDK_V1
-#define _DT_BINDINGS_RESET_CONTROLLER_HSDK_V1
-
-#define HSDK_V1_APB_RESET       0
-#define HSDK_V1_AXI_RESET       1
-#define HSDK_V1_ETH_RESET       2
-#define HSDK_V1_USB_RESET       3
-#define HSDK_V1_SDIO_RESET      4
-#define HSDK_V1_HDMI_RESET      5
-#define HSDK_V1_GFX_RESET       6
-#define HSDK_V1_DMAC_RESET      7
-#define HSDK_V1_EBI_RESET       8
-
-#endif /*_DT_BINDINGS_RESET_CONTROLLER_HSDK_V1*/
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index fb44d6180ca0..18d05b5491f3 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -131,7 +131,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
                            int executable_stack);
 extern int transfer_args_to_stack(struct linux_binprm *bprm,
                                   unsigned long *sp_location);
-extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
+extern int bprm_change_interp(const char *interp, struct linux_binprm *bprm);
 extern int copy_strings_kernel(int argc, const char *const *argv,
                                struct linux_binprm *bprm);
 extern int prepare_bprm_creds(struct linux_binprm *bprm);
diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 8b9d6fff002d..f2deb71958b2 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -92,7 +92,7 @@
 /**
  * FIELD_GET() - extract a bitfield element
  * @_mask: shifted mask defining the field's length and position
- * @_reg:  32bit value of entire bitfield
+ * @_reg:  value of entire bitfield
  *
  * FIELD_GET() extracts the field specified by @_mask from the
  * bitfield passed in as @_reg by masking and shifting it down.
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 460294bb0fa5..02fa42d24b52 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -551,6 +551,7 @@ struct request_queue {
         int                     node;
 #ifdef CONFIG_BLK_DEV_IO_TRACE
         struct blk_trace        *blk_trace;
+        struct mutex            blk_trace_mutex;
 #endif
         /*
          * for flush operations
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8390859e79e7..f1af7d63d678 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -368,6 +368,11 @@ static inline void __bpf_prog_uncharge(struct user_struct *user, u32 pages)
 {
 }
 
+static inline int bpf_obj_get_user(const char __user *pathname)
+{
+        return -EOPNOTSUPP;
+}
+
 static inline struct net_device  *__dev_map_lookup_elem(struct bpf_map *map,
                                                        u32 key)
 {
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index c8dae555eccf..446b24cac67d 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -232,6 +232,7 @@ int generic_write_end(struct file *, struct address_space *,
                                 loff_t, unsigned, unsigned,
                                 struct page *, void *);
 void page_zero_new_buffers(struct page *page, unsigned from, unsigned to);
+void clean_page_buffers(struct page *page);
 int cont_write_begin(struct file *, struct address_space *, loff_t,
                         unsigned, unsigned, struct page **, void **,
                         get_block_t *, loff_t *);
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index f24bfb2b9a2d..6d508767e144 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -3,8 +3,27 @@
 
 #include <linux/types.h>
 
+/*
+ * CPU-up                       CPU-down
+ *
+ * BP           AP              BP              AP
+ *
+ * OFFLINE                      OFFLINE
+ *   |                            ^
+ *   v                            |
+ * BRINGUP_CPU->AP_OFFLINE      BRINGUP_CPU  <- AP_IDLE_DEAD (idle thread/play_dead)
+ *                |                             AP_OFFLINE
+ *                v (IRQ-off)     ,---------------^
+ *              AP_ONLNE          | (stop_machine)
+ *                |             TEARDOWN_CPU <- AP_ONLINE_IDLE
+ *                |                               ^
+ *                v                               |
+ *              AP_ACTIVE                       AP_ACTIVE
+ */
+
 enum cpuhp_state {
-        CPUHP_OFFLINE,
+        CPUHP_INVALID = -1,
+        CPUHP_OFFLINE = 0,
         CPUHP_CREATE_THREADS,
         CPUHP_PERF_PREPARE,
         CPUHP_PERF_X86_PREPARE,
diff --git a/include/linux/device.h b/include/linux/device.h
index 1d2607923a24..66fe271c2544 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -307,8 +307,6 @@ struct driver_attribute {
                          size_t count);
 };
 
-#define DRIVER_ATTR(_name, _mode, _show, _store) \
-        struct driver_attribute driver_attr_##_name = __ATTR(_name, _mode, _show, _store)
 #define DRIVER_ATTR_RW(_name) \
         struct driver_attribute driver_attr_##_name = __ATTR_RW(_name)
 #define DRIVER_ATTR_RO(_name) \
diff --git a/include/linux/filter.h b/include/linux/filter.h
index d29e58fde364..818a0b26249e 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -728,7 +728,7 @@ void xdp_do_flush_map(void);
 void bpf_warn_invalid_xdp_action(u32 act);
 void bpf_warn_invalid_xdp_redirect(u32 ifindex);
 
-struct sock *do_sk_redirect_map(void);
+struct sock *do_sk_redirect_map(struct sk_buff *skb);
 
 #ifdef CONFIG_BPF_JIT
 extern int bpf_jit_enable;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 339e73742e73..13dab191a23e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -403,7 +403,7 @@ struct address_space {
         unsigned long           flags;          /* error bits */
         spinlock_t              private_lock;   /* for use by the address_space */
         gfp_t                   gfp_mask;       /* implicit gfp mask for allocations */
-        struct list_head        private_list;   /* ditto */
+        struct list_head        private_list;   /* for use by the address_space */
         void                    *private_data;  /* ditto */
         errseq_t                wb_err;
 } __attribute__((aligned(sizeof(long)))) __randomize_layout;
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index c458d7b7ad19..6431087816ba 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1403,7 +1403,7 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
                                 const int *srv_version, int srv_vercnt,
                                 int *nego_fw_version, int *nego_srv_version);
 
-void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
+void hv_process_channel_removal(u32 relid);
 
 void vmbus_setevent(struct vmbus_channel *channel);
 /*
diff --git a/include/linux/if_tap.h b/include/linux/if_tap.h
index 4837157da0dc..9ae41cdd0d4c 100644
--- a/include/linux/if_tap.h
+++ b/include/linux/if_tap.h
@@ -73,8 +73,8 @@ void tap_del_queues(struct tap_dev *tap);
 int tap_get_minor(dev_t major, struct tap_dev *tap);
 void tap_free_minor(dev_t major, struct tap_dev *tap);
 int tap_queue_resize(struct tap_dev *tap);
-int tap_create_cdev(struct cdev *tap_cdev,
-                    dev_t *tap_major, const char *device_name);
+int tap_create_cdev(struct cdev *tap_cdev, dev_t *tap_major,
+                    const char *device_name, struct module *module);
 void tap_destroy_cdev(dev_t major, struct cdev *tap_cdev);
 
 #endif /*_LINUX_IF_TAP_H_*/
diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h
index 5ba430cc9a87..1fc7abd28b0b 100644
--- a/include/linux/iio/adc/ad_sigma_delta.h
+++ b/include/linux/iio/adc/ad_sigma_delta.h
@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
 int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
         unsigned int size, unsigned int *val);
 
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length);
+
 int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
         const struct iio_chan_spec *chan, int *val);
 int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta,
diff --git a/include/linux/input.h b/include/linux/input.h
index fb5e23c7ed98..7c7516eb7d76 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -234,6 +234,10 @@ struct input_dev {
 #error "SW_MAX and INPUT_DEVICE_ID_SW_MAX do not match"
 #endif
 
+#if INPUT_PROP_MAX != INPUT_DEVICE_ID_PROP_MAX
+#error "INPUT_PROP_MAX and INPUT_DEVICE_ID_PROP_MAX do not match"
+#endif
+
 #define INPUT_DEVICE_ID_MATCH_DEVICE \
         (INPUT_DEVICE_ID_MATCH_BUS | INPUT_DEVICE_ID_MATCH_VENDOR | INPUT_DEVICE_ID_MATCH_PRODUCT)
 #define INPUT_DEVICE_ID_MATCH_DEVICE_AND_VERSION \
@@ -469,6 +473,9 @@ int input_get_keycode(struct input_dev *dev, struct input_keymap_entry *ke);
 int input_set_keycode(struct input_dev *dev,
                       const struct input_keymap_entry *ke);
 
+bool input_match_device_id(const struct input_dev *dev,
+                           const struct input_device_id *id);
+
 void input_enable_softrepeat(struct input_dev *dev, int delay, int period);
 
 extern struct class input_class;
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index a7f2ac689d29..41b8c5757859 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -167,11 +167,11 @@ struct iommu_resv_region {
  * @map: map a physically contiguous memory region to an iommu domain
  * @unmap: unmap a physically contiguous memory region from an iommu domain
  * @map_sg: map a scatter-gather list of physically contiguous memory chunks
+ *          to an iommu domain
  * @flush_tlb_all: Synchronously flush all hardware TLBs for this domain
  * @tlb_range_add: Add a given iova range to the flush queue for this domain
  * @tlb_sync: Flush all queued ranges from the hardware TLBs and empty flush
  *            queue
- * to an iommu domain
  * @iova_to_phys: translate iova to physical address
  * @add_device: add device to iommu grouping
  * @remove_device: remove device from iommu grouping
diff --git a/include/linux/irq.h b/include/linux/irq.h
index d4728bf6a537..5ad10948ea95 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -1009,7 +1009,7 @@ void irq_gc_mask_clr_bit(struct irq_data *d);
 void irq_gc_unmask_enable_reg(struct irq_data *d);
 void irq_gc_ack_set_bit(struct irq_data *d);
 void irq_gc_ack_clr_bit(struct irq_data *d);
-void irq_gc_mask_disable_reg_and_ack(struct irq_data *d);
+void irq_gc_mask_disable_and_ack_set(struct irq_data *d);
 void irq_gc_eoi(struct irq_data *d);
 int irq_gc_set_wake(struct irq_data *d, unsigned int on);
 
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 1ea576c8126f..14b74f22d43c 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -372,6 +372,8 @@
 #define GITS_BASER_ENTRY_SIZE_SHIFT             (48)
 #define GITS_BASER_ENTRY_SIZE(r)        ((((r) >> GITS_BASER_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
 #define GITS_BASER_ENTRY_SIZE_MASK      GENMASK_ULL(52, 48)
+#define GITS_BASER_PHYS_52_to_48(phys)                                  \
+        (((phys) & GENMASK_ULL(47, 16)) | (((phys) >> 48) & 0xf) << 12)
 #define GITS_BASER_SHAREABILITY_SHIFT   (10)
 #define GITS_BASER_InnerShareable                                       \
         GIC_BASER_SHAREABILITY(GITS_BASER, InnerShareable)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 0ad4c3044cf9..91189bb0c818 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -44,6 +44,12 @@
 
 #define STACK_MAGIC     0xdeadbeef
 
+/**
+ * REPEAT_BYTE - repeat the value @x multiple times as an unsigned long value
+ * @x: value to repeat
+ *
+ * NOTE: @x is not checked for > 0xff; larger values produce odd results.
+ */
 #define REPEAT_BYTE(x)  ((~0ul / 0xff) * (x))
 
 /* @a is a power of 2 value */
@@ -57,6 +63,10 @@
 #define READ                    0
 #define WRITE                   1
 
+/**
+ * ARRAY_SIZE - get the number of elements in array @arr
+ * @arr: array to be sized
+ */
 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
 
 #define u64_to_user_ptr(x) (            \
@@ -76,7 +86,15 @@
 #define round_up(x, y) ((((x)-1) | __round_mask(x, y))+1)
 #define round_down(x, y) ((x) & ~__round_mask(x, y))
 
+/**
+ * FIELD_SIZEOF - get the size of a struct's field
+ * @t: the target struct
+ * @f: the target struct's field
+ * Return: the size of @f in the struct definition without having a
+ * declared instance of @t.
+ */
 #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
+
 #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
 
 #define DIV_ROUND_DOWN_ULL(ll, d) \
@@ -107,7 +125,7 @@
 /*
  * Divide positive or negative dividend by positive or negative divisor
  * and round to closest integer. Result is undefined for negative
- * divisors if he dividend variable type is unsigned and for negative
+ * divisors if the dividend variable type is unsigned and for negative
  * dividends if the divisor variable type is unsigned.
  */
 #define DIV_ROUND_CLOSEST(x, divisor)(                  \
@@ -247,13 +265,13 @@ extern int _cond_resched(void);
  * @ep_ro: right open interval endpoint
  *
  * Perform a "reciprocal multiplication" in order to "scale" a value into
- * range [0, ep_ro), where the upper interval endpoint is right-open.
+ * range [0, @ep_ro), where the upper interval endpoint is right-open.
  * This is useful, e.g. for accessing a index of an array containing
- * ep_ro elements, for example. Think of it as sort of modulus, only that
+ * @ep_ro elements, for example. Think of it as sort of modulus, only that
  * the result isn't that of modulo. ;) Note that if initial input is a
  * small value, then result will return 0.
  *
- * Return: a result based on val in interval [0, ep_ro).
+ * Return: a result based on @val in interval [0, @ep_ro).
  */
 static inline u32 reciprocal_scale(u32 val, u32 ep_ro)
 {
@@ -618,8 +636,8 @@ do {									\
  * trace_printk - printf formatting in the ftrace buffer
  * @fmt: the printf format for printing
  *
- * Note: __trace_printk is an internal function for trace_printk and
- *       the @ip is passed in via the trace_printk macro.
+ * Note: __trace_printk is an internal function for trace_printk() and
+ *       the @ip is passed in via the trace_printk() macro.
  *
  * This function allows a kernel developer to debug fast path sections
  * that printk is not appropriate for. By scattering in various
@@ -629,7 +647,7 @@ do {									\
  * This is intended as a debugging tool for the developer only.
  * Please refrain from leaving trace_printks scattered around in
  * your code. (Extra memory is used for special buffers that are
- * allocated when trace_printk() is used)
+ * allocated when trace_printk() is used.)
  *
  * A little optization trick is done here. If there's only one
  * argument, there's no need to scan the string for printf formats.
@@ -681,7 +699,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
  *       the @ip is passed in via the trace_puts macro.
  *
  * This is similar to trace_printk() but is made for those really fast
- * paths that a developer wants the least amount of "Heisenbug" affects,
+ * paths that a developer wants the least amount of "Heisenbug" effects,
  * where the processing of the print format is still too much.
  *
  * This function allows a kernel developer to debug fast path sections
@@ -692,7 +710,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
  * This is intended as a debugging tool for the developer only.
  * Please refrain from leaving trace_puts scattered around in
  * your code. (Extra memory is used for special buffers that are
- * allocated when trace_puts() is used)
+ * allocated when trace_puts() is used.)
  *
  * Returns: 0 if nothing was written, positive # if string was.
  *  (1 when __trace_bputs is used, strlen(str) when __trace_puts is used)
@@ -771,6 +789,12 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
         t2 min2 = (y);                                  \
         (void) (&min1 == &min2);                        \
         min1 < min2 ? min1 : min2; })
+
+/**
+ * min - return minimum of two values of the same or compatible types
+ * @x: first value
+ * @y: second value
+ */
 #define min(x, y)                                       \
         __min(typeof(x), typeof(y),                     \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
@@ -781,12 +805,31 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
         t2 max2 = (y);                                  \
         (void) (&max1 == &max2);                        \
         max1 > max2 ? max1 : max2; })
+
+/**
+ * max - return maximum of two values of the same or compatible types
+ * @x: first value
+ * @y: second value
+ */
 #define max(x, y)                                       \
         __max(typeof(x), typeof(y),                     \
               __UNIQUE_ID(max1_), __UNIQUE_ID(max2_),   \
               x, y)
 
+/**
+ * min3 - return minimum of three values
+ * @x: first value
+ * @y: second value
+ * @z: third value
+ */
 #define min3(x, y, z) min((typeof(x))min(x, y), z)
+
+/**
+ * max3 - return maximum of three values
+ * @x: first value
+ * @y: second value
+ * @z: third value
+ */
 #define max3(x, y, z) max((typeof(x))max(x, y), z)
 
 /**
@@ -805,8 +848,8 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @lo: lowest allowable value
  * @hi: highest allowable value
  *
- * This macro does strict typechecking of lo/hi to make sure they are of the
- * same type as val.  See the unnecessary pointer comparisons.
+ * This macro does strict typechecking of @lo/@hi to make sure they are of the
+ * same type as @val.  See the unnecessary pointer comparisons.
  */
 #define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi)
 
@@ -816,11 +859,24 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  *
  * Or not use min/max/clamp at all, of course.
  */
+
+/**
+ * min_t - return minimum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
 #define min_t(type, x, y)                               \
         __min(type, type,                               \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
               x, y)
 
+/**
+ * max_t - return maximum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
 #define max_t(type, x, y)                               \
         __max(type, type,                               \
               __UNIQUE_ID(min1_), __UNIQUE_ID(min2_),   \
@@ -834,7 +890,7 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of type
- * 'type' to make all the comparisons.
+ * @type to make all the comparisons.
  */
 #define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
 
@@ -845,15 +901,17 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
  * @hi: maximum allowable value
  *
  * This macro does no typechecking and uses temporary variables of whatever
- * type the input argument 'val' is.  This is useful when val is an unsigned
- * type and min and max are literals that will otherwise be assigned a signed
+ * type the input argument @val is.  This is useful when @val is an unsigned
+ * type and @lo and @hi are literals that will otherwise be assigned a signed
  * integer type.
  */
 #define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
 
 
-/*
- * swap - swap value of @a and @b
+/**
+ * swap - swap values of @a and @b
+ * @a: first value
+ * @b: second value
  */
 #define swap(a, b) \
         do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
diff --git a/include/linux/key.h b/include/linux/key.h
index 044114185120..8a15cabe928d 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -138,6 +138,11 @@ struct key_restriction {
         struct key_type *keytype;
 };
 
+enum key_state {
+        KEY_IS_UNINSTANTIATED,
+        KEY_IS_POSITIVE,                /* Positively instantiated */
+};
+
 /*****************************************************************************/
 /*
  * authentication token / access credential / keyring
@@ -169,6 +174,7 @@ struct key {
                                                  * - may not match RCU dereferenced payload
                                                  * - payload should contain own length
                                                  */
+        short                   state;          /* Key state (+) or rejection error (-) */
 
 #ifdef KEY_DEBUGGING
         unsigned                magic;
@@ -176,17 +182,16 @@ struct key {
 #endif
 
         unsigned long           flags;          /* status flags (change with bitops) */
-#define KEY_FLAG_INSTANTIATED   0       /* set if key has been instantiated */
-#define KEY_FLAG_DEAD           1       /* set if key type has been deleted */
-#define KEY_FLAG_REVOKED        2       /* set if key had been revoked */
-#define KEY_FLAG_IN_QUOTA       3       /* set if key consumes quota */
-#define KEY_FLAG_USER_CONSTRUCT 4       /* set if key is being constructed in userspace */
-#define KEY_FLAG_NEGATIVE       5       /* set if key is negative */
-#define KEY_FLAG_ROOT_CAN_CLEAR 6       /* set if key can be cleared by root without permission */
-#define KEY_FLAG_INVALIDATED    7       /* set if key has been invalidated */
-#define KEY_FLAG_BUILTIN        8       /* set if key is built in to the kernel */
-#define KEY_FLAG_ROOT_CAN_INVAL 9       /* set if key can be invalidated by root without permission */
-#define KEY_FLAG_KEEP           10      /* set if key should not be removed */
+#define KEY_FLAG_DEAD           0       /* set if key type has been deleted */
+#define KEY_FLAG_REVOKED        1       /* set if key had been revoked */
+#define KEY_FLAG_IN_QUOTA       2       /* set if key consumes quota */
+#define KEY_FLAG_USER_CONSTRUCT 3       /* set if key is being constructed in userspace */
+#define KEY_FLAG_ROOT_CAN_CLEAR 4       /* set if key can be cleared by root without permission */
+#define KEY_FLAG_INVALIDATED    5       /* set if key has been invalidated */
+#define KEY_FLAG_BUILTIN        6       /* set if key is built in to the kernel */
+#define KEY_FLAG_ROOT_CAN_INVAL 7       /* set if key can be invalidated by root without permission */
+#define KEY_FLAG_KEEP           8       /* set if key should not be removed */
+#define KEY_FLAG_UID_KEYRING    9       /* set if key is a user or user session keyring */
 
         /* the key type and key description string
          * - the desc is used to match a key against search criteria
@@ -212,7 +217,6 @@ struct key {
                         struct list_head name_link;
                         struct assoc_array keys;
                 };
-                int reject_error;
         };
 
         /* This is set on a keyring to restrict the addition of a link to a key
@@ -243,6 +247,7 @@ extern struct key *key_alloc(struct key_type *type,
 #define KEY_ALLOC_NOT_IN_QUOTA          0x0002  /* not in quota */
 #define KEY_ALLOC_BUILT_IN              0x0004  /* Key is built into kernel */
 #define KEY_ALLOC_BYPASS_RESTRICTION    0x0008  /* Override the check on restricted keyrings */
+#define KEY_ALLOC_UID_KEYRING           0x0010  /* allocating a user or user session keyring */
 
 extern void key_revoke(struct key *key);
 extern void key_invalidate(struct key *key);
@@ -351,17 +356,27 @@ extern void key_set_timeout(struct key *, unsigned);
 #define KEY_NEED_SETATTR 0x20   /* Require permission to change attributes */
 #define KEY_NEED_ALL    0x3f    /* All the above permissions */
 
+static inline short key_read_state(const struct key *key)
+{
+        /* Barrier versus mark_key_instantiated(). */
+        return smp_load_acquire(&key->state);
+}
+
 /**
- * key_is_instantiated - Determine if a key has been positively instantiated
+ * key_is_positive - Determine if a key has been positively instantiated
  * @key: The key to check.
  *
  * Return true if the specified key has been positively instantiated, false
  * otherwise.
  */
-static inline bool key_is_instantiated(const struct key *key)
+static inline bool key_is_positive(const struct key *key)
+{
+        return key_read_state(key) == KEY_IS_POSITIVE;
+}
+
+static inline bool key_is_negative(const struct key *key)
 {
-        return test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
-                !test_bit(KEY_FLAG_NEGATIVE, &key->flags);
+        return key_read_state(key) < 0;
 }
 
 #define dereference_key_rcu(KEY)                                        \
diff --git a/include/linux/mbus.h b/include/linux/mbus.h
index 0d3f14fd2621..4773145246ed 100644
--- a/include/linux/mbus.h
+++ b/include/linux/mbus.h
@@ -31,8 +31,8 @@ struct mbus_dram_target_info
         struct mbus_dram_window {
                 u8      cs_index;
                 u8      mbus_attr;
-                u32     base;
-                u32     size;
+                u64     base;
+                u64     size;
         } cs[4];
 };
 
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index eaf4ad209c8f..e32dbc4934db 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -980,7 +980,6 @@ enum mlx5_cap_type {
         MLX5_CAP_RESERVED,
         MLX5_CAP_VECTOR_CALC,
         MLX5_CAP_QOS,
-        MLX5_CAP_FPGA,
         /* NUM OF CAP Types */
         MLX5_CAP_NUM
 };
@@ -1110,10 +1109,10 @@ enum mlx5_mcam_feature_groups {
         MLX5_GET(mcam_reg, (mdev)->caps.mcam, mng_feature_cap_mask.enhanced_features.fld)
 
 #define MLX5_CAP_FPGA(mdev, cap) \
-        MLX5_GET(fpga_cap, (mdev)->caps.hca_cur[MLX5_CAP_FPGA], cap)
+        MLX5_GET(fpga_cap, (mdev)->caps.fpga, cap)
 
 #define MLX5_CAP64_FPGA(mdev, cap) \
-        MLX5_GET64(fpga_cap, (mdev)->caps.hca_cur[MLX5_CAP_FPGA], cap)
+        MLX5_GET64(fpga_cap, (mdev)->caps.fpga, cap)
 
 enum {
         MLX5_CMD_STAT_OK                        = 0x0,
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 02ff700e4f30..401c8972cc3a 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -774,6 +774,7 @@ struct mlx5_core_dev {
                 u32 hca_max[MLX5_CAP_NUM][MLX5_UN_SZ_DW(hca_cap_union)];
                 u32 pcam[MLX5_ST_SZ_DW(pcam_reg)];
                 u32 mcam[MLX5_ST_SZ_DW(mcam_reg)];
+                u32 fpga[MLX5_ST_SZ_DW(fpga_cap)];
         } caps;
         phys_addr_t             iseg_base;
         struct mlx5_init_seg __iomem *iseg;
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index a528b35a022e..69772347f866 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -327,7 +327,8 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
         u8         reserved_at_80[0x18];
         u8         log_max_destination[0x8];
 
-        u8         reserved_at_a0[0x18];
+        u8         log_max_flow_counter[0x8];
+        u8         reserved_at_a8[0x10];
         u8         log_max_flow[0x8];
 
         u8         reserved_at_c0[0x40];
diff --git a/include/linux/mlx5/port.h b/include/linux/mlx5/port.h
index c57d4b7de3a8..c59af8ab753a 100644
--- a/include/linux/mlx5/port.h
+++ b/include/linux/mlx5/port.h
@@ -157,6 +157,8 @@ int mlx5_set_port_prio_tc(struct mlx5_core_dev *mdev, u8 *prio_tc);
 int mlx5_query_port_prio_tc(struct mlx5_core_dev *mdev,
                             u8 prio, u8 *tc);
 int mlx5_set_port_tc_group(struct mlx5_core_dev *mdev, u8 *tc_group);
+int mlx5_query_port_tc_group(struct mlx5_core_dev *mdev,
+                             u8 tc, u8 *tc_group);
 int mlx5_set_port_tc_bw_alloc(struct mlx5_core_dev *mdev, u8 *tc_bw);
 int mlx5_query_port_tc_bw_alloc(struct mlx5_core_dev *mdev,
                                 u8 tc, u8 *bw_pct);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f8c10d336e42..065d99deb847 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -240,7 +240,7 @@ extern unsigned int kobjsize(const void *objp);
 
 #if defined(CONFIG_X86_INTEL_MPX)
 /* MPX specific bounds table or bounds directory */
-# define VM_MPX         VM_HIGH_ARCH_BIT_4
+# define VM_MPX         VM_HIGH_ARCH_4
 #else
 # define VM_MPX         VM_NONE
 #endif
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 46f4ecf5479a..1861ea8dba77 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -445,6 +445,9 @@ struct mm_struct {
         unsigned long flags; /* Must use atomic bitops to access the bits */
 
         struct core_state *core_state; /* coredumping support */
+#ifdef CONFIG_MEMBARRIER
+        atomic_t membarrier_state;
+#endif
 #ifdef CONFIG_AIO
         spinlock_t                      ioctx_lock;
         struct kioctx_table __rcu       *ioctx_table;
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index f3f2d07feb2a..9a43763a68ad 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -316,7 +316,7 @@ struct mmc_host {
 #define MMC_CAP_UHS_SDR50       (1 << 18)       /* Host supports UHS SDR50 mode */
 #define MMC_CAP_UHS_SDR104      (1 << 19)       /* Host supports UHS SDR104 mode */
 #define MMC_CAP_UHS_DDR50       (1 << 20)       /* Host supports UHS DDR50 mode */
-#define MMC_CAP_NO_BOUNCE_BUFF  (1 << 21)       /* Disable bounce buffers on host */
+/* (1 << 21) is free for reuse */
 #define MMC_CAP_DRIVER_TYPE_A   (1 << 23)       /* Host supports Driver Type A */
 #define MMC_CAP_DRIVER_TYPE_C   (1 << 24)       /* Host supports Driver Type C */
 #define MMC_CAP_DRIVER_TYPE_D   (1 << 25)       /* Host supports Driver Type D */
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index 7b2e31b1745a..6866e8126982 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -400,6 +400,11 @@ extern void mmu_notifier_synchronize(void);
 
 #else /* CONFIG_MMU_NOTIFIER */
 
+static inline int mm_has_notifiers(struct mm_struct *mm)
+{
+        return 0;
+}
+
 static inline void mmu_notifier_release(struct mm_struct *mm)
 {
 }
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 356a814e7c8e..c8f89417740b 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -1094,8 +1094,14 @@ static inline unsigned long early_pfn_to_nid(unsigned long pfn)
 #error Allocator MAX_ORDER exceeds SECTION_SIZE
 #endif
 
-#define pfn_to_section_nr(pfn) ((pfn) >> PFN_SECTION_SHIFT)
-#define section_nr_to_pfn(sec) ((sec) << PFN_SECTION_SHIFT)
+static inline unsigned long pfn_to_section_nr(unsigned long pfn)
+{
+        return pfn >> PFN_SECTION_SHIFT;
+}
+static inline unsigned long section_nr_to_pfn(unsigned long sec)
+{
+        return sec << PFN_SECTION_SHIFT;
+}
 
 #define SECTION_ALIGN_UP(pfn)   (((pfn) + PAGES_PER_SECTION - 1) & PAGE_SECTION_MASK)
 #define SECTION_ALIGN_DOWN(pfn) ((pfn) & PAGE_SECTION_MASK)
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 694cebb50f72..2657f9f51536 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -293,6 +293,7 @@ struct pcmcia_device_id {
 #define INPUT_DEVICE_ID_SND_MAX         0x07
 #define INPUT_DEVICE_ID_FF_MAX          0x7f
 #define INPUT_DEVICE_ID_SW_MAX          0x0f
+#define INPUT_DEVICE_ID_PROP_MAX        0x1f
 
 #define INPUT_DEVICE_ID_MATCH_BUS       1
 #define INPUT_DEVICE_ID_MATCH_VENDOR    2
@@ -308,6 +309,7 @@ struct pcmcia_device_id {
 #define INPUT_DEVICE_ID_MATCH_SNDBIT    0x0400
 #define INPUT_DEVICE_ID_MATCH_FFBIT     0x0800
 #define INPUT_DEVICE_ID_MATCH_SWBIT     0x1000
+#define INPUT_DEVICE_ID_MATCH_PROPBIT   0x2000
 
 struct input_device_id {
 
@@ -327,6 +329,7 @@ struct input_device_id {
         kernel_ulong_t sndbit[INPUT_DEVICE_ID_SND_MAX / BITS_PER_LONG + 1];
         kernel_ulong_t ffbit[INPUT_DEVICE_ID_FF_MAX / BITS_PER_LONG + 1];
         kernel_ulong_t swbit[INPUT_DEVICE_ID_SW_MAX / BITS_PER_LONG + 1];
+        kernel_ulong_t propbit[INPUT_DEVICE_ID_PROP_MAX / BITS_PER_LONG + 1];
 
         kernel_ulong_t driver_info;
 };
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f535779d9dc1..2eaac7d75af4 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3694,6 +3694,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
                                     unsigned char name_assign_type,
                                     void (*setup)(struct net_device *),
                                     unsigned int txqs, unsigned int rxqs);
+int dev_get_valid_name(struct net *net, struct net_device *dev,
+                       const char *name);
+
 #define alloc_netdev(sizeof_priv, name, name_assign_type, setup) \
         alloc_netdev_mqs(sizeof_priv, name, name_assign_type, setup, 1, 1)
 
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 2c2a5514b0df..528b24c78308 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -108,9 +108,10 @@ struct ebt_table {
 
 #define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
                      ~(__alignof__(struct _xt_align)-1))
-extern struct ebt_table *ebt_register_table(struct net *net,
-                                            const struct ebt_table *table,
-                                            const struct nf_hook_ops *);
+extern int ebt_register_table(struct net *net,
+                              const struct ebt_table *table,
+                              const struct nf_hook_ops *ops,
+                              struct ebt_table **res);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table,
                                  const struct nf_hook_ops *);
 extern unsigned int ebt_do_table(struct sk_buff *skb,
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index a36abe2da13e..27e249ed7c5c 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -12,11 +12,31 @@
 
 #ifdef CONFIG_LOCKUP_DETECTOR
 void lockup_detector_init(void);
+void lockup_detector_soft_poweroff(void);
+void lockup_detector_cleanup(void);
+bool is_hardlockup(void);
+
+extern int watchdog_user_enabled;
+extern int nmi_watchdog_user_enabled;
+extern int soft_watchdog_user_enabled;
+extern int watchdog_thresh;
+extern unsigned long watchdog_enabled;
+
+extern struct cpumask watchdog_cpumask;
+extern unsigned long *watchdog_cpumask_bits;
+#ifdef CONFIG_SMP
+extern int sysctl_softlockup_all_cpu_backtrace;
+extern int sysctl_hardlockup_all_cpu_backtrace;
 #else
-static inline void lockup_detector_init(void)
-{
-}
-#endif
+#define sysctl_softlockup_all_cpu_backtrace 0
+#define sysctl_hardlockup_all_cpu_backtrace 0
+#endif /* !CONFIG_SMP */
+
+#else /* CONFIG_LOCKUP_DETECTOR */
+static inline void lockup_detector_init(void) { }
+static inline void lockup_detector_soft_poweroff(void) { }
+static inline void lockup_detector_cleanup(void) { }
+#endif /* !CONFIG_LOCKUP_DETECTOR */
 
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
 extern void touch_softlockup_watchdog_sched(void);
@@ -24,29 +44,17 @@ extern void touch_softlockup_watchdog(void);
 extern void touch_softlockup_watchdog_sync(void);
 extern void touch_all_softlockup_watchdogs(void);
 extern unsigned int  softlockup_panic;
-extern int soft_watchdog_enabled;
-extern atomic_t watchdog_park_in_progress;
 #else
-static inline void touch_softlockup_watchdog_sched(void)
-{
-}
-static inline void touch_softlockup_watchdog(void)
-{
-}
-static inline void touch_softlockup_watchdog_sync(void)
-{
-}
-static inline void touch_all_softlockup_watchdogs(void)
-{
-}
+static inline void touch_softlockup_watchdog_sched(void) { }
+static inline void touch_softlockup_watchdog(void) { }
+static inline void touch_softlockup_watchdog_sync(void) { }
+static inline void touch_all_softlockup_watchdogs(void) { }
 #endif
 
 #ifdef CONFIG_DETECT_HUNG_TASK
 void reset_hung_task_detector(void);
 #else
-static inline void reset_hung_task_detector(void)
-{
-}
+static inline void reset_hung_task_detector(void) { }
 #endif
 
 /*
@@ -54,12 +62,12 @@ static inline void reset_hung_task_detector(void)
  * 'watchdog_enabled' variable. Each lockup detector has its dedicated bit -
  * bit 0 for the hard lockup detector and bit 1 for the soft lockup detector.
  *
- * 'watchdog_user_enabled', 'nmi_watchdog_enabled' and 'soft_watchdog_enabled'
- * are variables that are only used as an 'interface' between the parameters
- * in /proc/sys/kernel and the internal state bits in 'watchdog_enabled'. The
- * 'watchdog_thresh' variable is handled differently because its value is not
- * boolean, and the lockup detectors are 'suspended' while 'watchdog_thresh'
- * is equal zero.
+ * 'watchdog_user_enabled', 'nmi_watchdog_user_enabled' and
+ * 'soft_watchdog_user_enabled' are variables that are only used as an
+ * 'interface' between the parameters in /proc/sys/kernel and the internal
+ * state bits in 'watchdog_enabled'. The 'watchdog_thresh' variable is
+ * handled differently because its value is not boolean, and the lockup
+ * detectors are 'suspended' while 'watchdog_thresh' is equal zero.
  */
 #define NMI_WATCHDOG_ENABLED_BIT   0
 #define SOFT_WATCHDOG_ENABLED_BIT  1
@@ -73,17 +81,41 @@ extern unsigned int hardlockup_panic;
 static inline void hardlockup_detector_disable(void) {}
 #endif
 
+#if defined(CONFIG_HAVE_NMI_WATCHDOG) || defined(CONFIG_HARDLOCKUP_DETECTOR)
+# define NMI_WATCHDOG_SYSCTL_PERM       0644
+#else
+# define NMI_WATCHDOG_SYSCTL_PERM       0444
+#endif
+
 #if defined(CONFIG_HARDLOCKUP_DETECTOR_PERF)
 extern void arch_touch_nmi_watchdog(void);
+extern void hardlockup_detector_perf_stop(void);
+extern void hardlockup_detector_perf_restart(void);
+extern void hardlockup_detector_perf_disable(void);
+extern void hardlockup_detector_perf_enable(void);
+extern void hardlockup_detector_perf_cleanup(void);
+extern int hardlockup_detector_perf_init(void);
 #else
-#if !defined(CONFIG_HAVE_NMI_WATCHDOG)
+static inline void hardlockup_detector_perf_stop(void) { }
+static inline void hardlockup_detector_perf_restart(void) { }
+static inline void hardlockup_detector_perf_disable(void) { }
+static inline void hardlockup_detector_perf_enable(void) { }
+static inline void hardlockup_detector_perf_cleanup(void) { }
+# if !defined(CONFIG_HAVE_NMI_WATCHDOG)
+static inline int hardlockup_detector_perf_init(void) { return -ENODEV; }
 static inline void arch_touch_nmi_watchdog(void) {}
+# else
+static inline int hardlockup_detector_perf_init(void) { return 0; }
+# endif
 #endif
-#endif
+
+void watchdog_nmi_stop(void);
+void watchdog_nmi_start(void);
+int watchdog_nmi_probe(void);
 
 /**
  * touch_nmi_watchdog - restart NMI watchdog timeout.
- * 
+ *
  * If the architecture supports the NMI watchdog, touch_nmi_watchdog()
  * may be used to reset the timeout - for code which intentionally
  * disables interrupts for a long time. This call is stateless.
@@ -153,22 +185,6 @@ static inline bool trigger_single_cpu_backtrace(int cpu)
 u64 hw_nmi_get_sample_period(int watchdog_thresh);
 #endif
 
-#ifdef CONFIG_LOCKUP_DETECTOR
-extern int nmi_watchdog_enabled;
-extern int watchdog_user_enabled;
-extern int watchdog_thresh;
-extern unsigned long watchdog_enabled;
-extern struct cpumask watchdog_cpumask;
-extern unsigned long *watchdog_cpumask_bits;
-extern int __read_mostly watchdog_suspended;
-#ifdef CONFIG_SMP
-extern int sysctl_softlockup_all_cpu_backtrace;
-extern int sysctl_hardlockup_all_cpu_backtrace;
-#else
-#define sysctl_softlockup_all_cpu_backtrace 0
-#define sysctl_hardlockup_all_cpu_backtrace 0
-#endif
-
 #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
     defined(CONFIG_HARDLOCKUP_DETECTOR)
 void watchdog_update_hrtimer_threshold(u64 period);
@@ -176,7 +192,6 @@ void watchdog_update_hrtimer_threshold(u64 period);
 static inline void watchdog_update_hrtimer_threshold(u64 period) { }
 #endif
 
-extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
                          void __user *, size_t *, loff_t *);
@@ -188,18 +203,6 @@ extern int proc_watchdog_thresh(struct ctl_table *, int ,
                                 void __user *, size_t *, loff_t *);
 extern int proc_watchdog_cpumask(struct ctl_table *, int,
                                  void __user *, size_t *, loff_t *);
-extern int lockup_detector_suspend(void);
-extern void lockup_detector_resume(void);
-#else
-static inline int lockup_detector_suspend(void)
-{
-        return 0;
-}
-
-static inline void lockup_detector_resume(void)
-{
-}
-#endif
 
 #ifdef CONFIG_HAVE_ACPI_APEI_NMI
 #include <asm/nmi.h>
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 9c5cb4480806..a726f96010d5 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -346,11 +346,6 @@ struct nvme_fc_remote_port {
  *       indicating an FC transport Aborted status.
  *       Entrypoint is Mandatory.
  *
- * @defer_rcv:  Called by the transport to signal the LLLD that it has
- *       begun processing of a previously received NVME CMD IU. The LLDD
- *       is now free to re-use the rcv buffer associated with the
- *       nvmefc_tgt_fcp_req.
- *
  * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
  *       supports for cpu affinitization.
  *       Value is Mandatory. Must be at least 1.
@@ -806,11 +801,19 @@ struct nvmet_fc_target_port {
  *       outstanding operation (if there was one) to complete, then will
  *       call the fcp_req_release() callback to return the command's
  *       exchange context back to the LLDD.
+ *       Entrypoint is Mandatory.
  *
  * @fcp_req_release:  Called by the transport to return a nvmefc_tgt_fcp_req
  *       to the LLDD after all operations on the fcp operation are complete.
  *       This may be due to the command completing or upon completion of
  *       abort cleanup.
+ *       Entrypoint is Mandatory.
+ *
+ * @defer_rcv:  Called by the transport to signal the LLLD that it has
+ *       begun processing of a previously received NVME CMD IU. The LLDD
+ *       is now free to re-use the rcv buffer associated with the
+ *       nvmefc_tgt_fcp_req.
+ *       Entrypoint is Optional.
  *
  * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
  *       supports for cpu affinitization.
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index 87723c86f136..9310ce77d8e1 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -471,12 +471,14 @@ enum nvme_opcode {
  *
  * @NVME_SGL_FMT_ADDRESS:     absolute address of the data block
  * @NVME_SGL_FMT_OFFSET:      relative offset of the in-capsule data block
+ * @NVME_SGL_FMT_TRANSPORT_A: transport defined format, value 0xA
  * @NVME_SGL_FMT_INVALIDATE:  RDMA transport specific remote invalidation
  *                            request subtype
  */
 enum {
         NVME_SGL_FMT_ADDRESS            = 0x00,
         NVME_SGL_FMT_OFFSET             = 0x01,
+        NVME_SGL_FMT_TRANSPORT_A        = 0x0A,
         NVME_SGL_FMT_INVALIDATE         = 0x0f,
 };
 
@@ -490,12 +492,16 @@ enum {
  *
  * For struct nvme_keyed_sgl_desc:
  *   @NVME_KEY_SGL_FMT_DATA_DESC:       keyed data block descriptor
+ *
+ * Transport-specific SGL types:
+ *   @NVME_TRANSPORT_SGL_DATA_DESC:     Transport SGL data dlock descriptor
  */
 enum {
         NVME_SGL_FMT_DATA_DESC          = 0x00,
         NVME_SGL_FMT_SEG_DESC           = 0x02,
         NVME_SGL_FMT_LAST_SEG_DESC      = 0x03,
         NVME_KEY_SGL_FMT_DATA_DESC      = 0x04,
+        NVME_TRANSPORT_SGL_DATA_DESC    = 0x05,
 };
 
 struct nvme_sgl_desc {
@@ -1127,19 +1133,6 @@ enum {
         NVME_SC_UNWRITTEN_BLOCK         = 0x287,
 
         NVME_SC_DNR                     = 0x4000,
-
-
-        /*
-         * FC Transport-specific error status values for NVME commands
-         *
-         * Transport-specific status code values must be in the range 0xB0..0xBF
-         */
-
-        /* Generic FC failure - catchall */
-        NVME_SC_FC_TRANSPORT_ERROR      = 0x00B0,
-
-        /* I/O failure due to FC ABTS'd */
-        NVME_SC_FC_TRANSPORT_ABORTED    = 0x00B1,
 };
 
 struct nvme_completion {
diff --git a/include/linux/of.h b/include/linux/of.h
index cfc34117fc92..b240ed69dc96 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -734,6 +734,16 @@ static inline struct device_node *of_get_cpu_node(int cpu,
         return NULL;
 }
 
+static inline int of_n_addr_cells(struct device_node *np)
+{
+        return 0;
+
+}
+static inline int of_n_size_cells(struct device_node *np)
+{
+        return 0;
+}
+
 static inline int of_property_read_u64(const struct device_node *np,
                                        const char *propname, u64 *out_value)
 {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index f68c58a93dd0..f4f8ee5a7362 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1685,6 +1685,8 @@ static inline int pci_get_new_domain_nr(void) { return -ENOSYS; }
 
 #define dev_is_pci(d) (false)
 #define dev_is_pf(d) (false)
+static inline bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
+{ return false; }
 #endif /* CONFIG_PCI */
 
 /* Include architecture-dependent settings and functions */
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index b1fd8bf85fdc..2bea1d5e9930 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -276,7 +276,7 @@ static inline void list_splice_tail_init_rcu(struct list_head *list,
 #define list_entry_rcu(ptr, type, member) \
         container_of(lockless_dereference(ptr), type, member)
 
-/**
+/*
  * Where are list_empty_rcu() and list_first_entry_rcu()?
  *
  * Implementing those functions following their counterparts list_empty() and
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index de50d8a4cf41..1a9f70d44af9 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -523,7 +523,7 @@ static inline void rcu_preempt_sleep_check(void) { }
  * Return the value of the specified RCU-protected pointer, but omit
  * both the smp_read_barrier_depends() and the READ_ONCE().  This
  * is useful in cases where update-side locks prevent the value of the
- * pointer from changing.  Please note that this primitive does -not-
+ * pointer from changing.  Please note that this primitive does *not*
  * prevent the compiler from repeating this reference or combining it
  * with other references, so it should not be used without protection
  * of appropriate locks.
@@ -568,7 +568,7 @@ static inline void rcu_preempt_sleep_check(void) { }
  * is handed off from RCU to some other synchronization mechanism, for
  * example, reference counting or locking.  In C11, it would map to
  * kill_dependency().  It could be used as follows:
- *
+ * ``
  *      rcu_read_lock();
  *      p = rcu_dereference(gp);
  *      long_lived = is_long_lived(p);
@@ -579,6 +579,7 @@ static inline void rcu_preempt_sleep_check(void) { }
  *                      p = rcu_pointer_handoff(p);
  *      }
  *      rcu_read_unlock();
+ *``
  */
 #define rcu_pointer_handoff(p) (p)
 
@@ -778,18 +779,21 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 
 /**
  * RCU_INIT_POINTER() - initialize an RCU protected pointer
+ * @p: The pointer to be initialized.
+ * @v: The value to initialized the pointer to.
  *
  * Initialize an RCU-protected pointer in special cases where readers
  * do not need ordering constraints on the CPU or the compiler.  These
  * special cases are:
  *
- * 1.   This use of RCU_INIT_POINTER() is NULLing out the pointer -or-
+ * 1.   This use of RCU_INIT_POINTER() is NULLing out the pointer *or*
  * 2.   The caller has taken whatever steps are required to prevent
- *      RCU readers from concurrently accessing this pointer -or-
+ *      RCU readers from concurrently accessing this pointer *or*
  * 3.   The referenced data structure has already been exposed to
- *      readers either at compile time or via rcu_assign_pointer() -and-
- *      a.      You have not made -any- reader-visible changes to
- *              this structure since then -or-
+ *      readers either at compile time or via rcu_assign_pointer() *and*
+ *
+ *      a.      You have not made *any* reader-visible changes to
+ *              this structure since then *or*
  *      b.      It is OK for readers accessing this structure from its
  *              new location to see the old state of the structure.  (For
  *              example, the changes were to statistical counters or to
@@ -805,7 +809,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
  * by a single external-to-structure RCU-protected pointer, then you may
  * use RCU_INIT_POINTER() to initialize the internal RCU-protected
  * pointers, but you must use rcu_assign_pointer() to initialize the
- * external-to-structure pointer -after- you have completely initialized
+ * external-to-structure pointer *after* you have completely initialized
  * the reader-accessible portions of the linked structure.
  *
  * Note that unlike rcu_assign_pointer(), RCU_INIT_POINTER() provides no
@@ -819,6 +823,8 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 
 /**
  * RCU_POINTER_INITIALIZER() - statically initialize an RCU protected pointer
+ * @p: The pointer to be initialized.
+ * @v: The value to initialized the pointer to.
  *
  * GCC-style initialization for an RCU-protected pointer in a structure field.
  */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 92fb8dd5a9e4..26a7df4e558c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -65,25 +65,23 @@ struct task_group;
  */
 
 /* Used in tsk->state: */
-#define TASK_RUNNING                    0
-#define TASK_INTERRUPTIBLE              1
-#define TASK_UNINTERRUPTIBLE            2
-#define __TASK_STOPPED                  4
-#define __TASK_TRACED                   8
+#define TASK_RUNNING                    0x0000
+#define TASK_INTERRUPTIBLE              0x0001
+#define TASK_UNINTERRUPTIBLE            0x0002
+#define __TASK_STOPPED                  0x0004
+#define __TASK_TRACED                   0x0008
 /* Used in tsk->exit_state: */
-#define EXIT_DEAD                       16
-#define EXIT_ZOMBIE                     32
+#define EXIT_DEAD                       0x0010
+#define EXIT_ZOMBIE                     0x0020
 #define EXIT_TRACE                      (EXIT_ZOMBIE | EXIT_DEAD)
 /* Used in tsk->state again: */
-#define TASK_DEAD                       64
-#define TASK_WAKEKILL                   128
-#define TASK_WAKING                     256
-#define TASK_PARKED                     512
-#define TASK_NOLOAD                     1024
-#define TASK_NEW                        2048
-#define TASK_STATE_MAX                  4096
-
-#define TASK_STATE_TO_CHAR_STR          "RSDTtXZxKWPNn"
+#define TASK_PARKED                     0x0040
+#define TASK_DEAD                       0x0080
+#define TASK_WAKEKILL                   0x0100
+#define TASK_WAKING                     0x0200
+#define TASK_NOLOAD                     0x0400
+#define TASK_NEW                        0x0800
+#define TASK_STATE_MAX                  0x1000
 
 /* Convenience macros for the sake of set_current_state: */
 #define TASK_KILLABLE                   (TASK_WAKEKILL | TASK_UNINTERRUPTIBLE)
@@ -99,7 +97,8 @@ struct task_group;
 /* get_task_state(): */
 #define TASK_REPORT                     (TASK_RUNNING | TASK_INTERRUPTIBLE | \
                                          TASK_UNINTERRUPTIBLE | __TASK_STOPPED | \
-                                         __TASK_TRACED | EXIT_ZOMBIE | EXIT_DEAD)
+                                         __TASK_TRACED | EXIT_DEAD | EXIT_ZOMBIE | \
+                                         TASK_PARKED)
 
 #define task_is_traced(task)            ((task->state & __TASK_TRACED) != 0)
 
@@ -1243,17 +1242,34 @@ static inline pid_t task_pgrp_nr(struct task_struct *tsk)
         return task_pgrp_nr_ns(tsk, &init_pid_ns);
 }
 
-static inline char task_state_to_char(struct task_struct *task)
+#define TASK_REPORT_IDLE        (TASK_REPORT + 1)
+#define TASK_REPORT_MAX         (TASK_REPORT_IDLE << 1)
+
+static inline unsigned int __get_task_state(struct task_struct *tsk)
+{
+        unsigned int tsk_state = READ_ONCE(tsk->state);
+        unsigned int state = (tsk_state | tsk->exit_state) & TASK_REPORT;
+
+        BUILD_BUG_ON_NOT_POWER_OF_2(TASK_REPORT_MAX);
+
+        if (tsk_state == TASK_IDLE)
+                state = TASK_REPORT_IDLE;
+
+        return fls(state);
+}
+
+static inline char __task_state_to_char(unsigned int state)
 {
-        const char stat_nam[] = TASK_STATE_TO_CHAR_STR;
-        unsigned long state = task->state;
+        static const char state_char[] = "RSDTtXZPI";
 
-        state = state ? __ffs(state) + 1 : 0;
+        BUILD_BUG_ON(1 + ilog2(TASK_REPORT_MAX) != sizeof(state_char) - 1);
 
-        /* Make sure the string lines up properly with the number of task states: */
-        BUILD_BUG_ON(sizeof(TASK_STATE_TO_CHAR_STR)-1 != ilog2(TASK_STATE_MAX)+1);
+        return state_char[state];
+}
 
-        return state < sizeof(stat_nam) - 1 ? stat_nam[state] : '?';
+static inline char task_state_to_char(struct task_struct *tsk)
+{
+        return __task_state_to_char(__get_task_state(tsk));
 }
 
 /**
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index 3a19c253bdb1..ab9bf7b73954 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -84,6 +84,12 @@ static inline bool mmget_not_zero(struct mm_struct *mm)
 
 /* mmput gets rid of the mappings and all user-space */
 extern void mmput(struct mm_struct *);
+#ifdef CONFIG_MMU
+/* same as above but performs the slow path from the async context. Can
+ * be called from the atomic context as well
+ */
+void mmput_async(struct mm_struct *);
+#endif
 
 /* Grab a reference to a task's mm, if it is not already going away */
 extern struct mm_struct *get_task_mm(struct task_struct *task);
@@ -205,4 +211,20 @@ static inline void memalloc_noreclaim_restore(unsigned int flags)
         current->flags = (current->flags & ~PF_MEMALLOC) | flags;
 }
 
+#ifdef CONFIG_MEMBARRIER
+enum {
+        MEMBARRIER_STATE_PRIVATE_EXPEDITED_READY        = (1U << 0),
+        MEMBARRIER_STATE_SWITCH_MM                      = (1U << 1),
+};
+
+static inline void membarrier_execve(struct task_struct *t)
+{
+        atomic_set(&t->mm->membarrier_state, 0);
+}
+#else
+static inline void membarrier_execve(struct task_struct *t)
+{
+}
+#endif
+
 #endif /* _LINUX_SCHED_MM_H */
diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
index d7b6dab956ec..7d065abc7a47 100644
--- a/include/linux/sched/topology.h
+++ b/include/linux/sched/topology.h
@@ -71,14 +71,6 @@ struct sched_domain_shared {
         atomic_t        ref;
         atomic_t        nr_busy_cpus;
         int             has_idle_cores;
-
-        /*
-         * Some variables from the most recent sd_lb_stats for this domain,
-         * used by wake_affine().
-         */
-        unsigned long   nr_running;
-        unsigned long   load;
-        unsigned long   capacity;
 };
 
 struct sched_domain {
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index 82b171e1aa0b..da803dfc7a39 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -231,7 +231,7 @@ struct sctp_datahdr {
         __be32 tsn;
         __be16 stream;
         __be16 ssn;
-        __be32 ppid;
+        __u32 ppid;
         __u8  payload[0];
 };
 
@@ -716,28 +716,28 @@ struct sctp_reconf_chunk {
 
 struct sctp_strreset_outreq {
         struct sctp_paramhdr param_hdr;
-        __u32 request_seq;
-        __u32 response_seq;
-        __u32 send_reset_at_tsn;
-        __u16 list_of_streams[0];
+        __be32 request_seq;
+        __be32 response_seq;
+        __be32 send_reset_at_tsn;
+        __be16 list_of_streams[0];
 };
 
 struct sctp_strreset_inreq {
         struct sctp_paramhdr param_hdr;
-        __u32 request_seq;
-        __u16 list_of_streams[0];
+        __be32 request_seq;
+        __be16 list_of_streams[0];
 };
 
 struct sctp_strreset_tsnreq {
         struct sctp_paramhdr param_hdr;
-        __u32 request_seq;
+        __be32 request_seq;
 };
 
 struct sctp_strreset_addstrm {
         struct sctp_paramhdr param_hdr;
-        __u32 request_seq;
-        __u16 number_of_streams;
-        __u16 reserved;
+        __be32 request_seq;
+        __be16 number_of_streams;
+        __be16 reserved;
 };
 
 enum {
@@ -752,16 +752,16 @@ enum {
 
 struct sctp_strreset_resp {
         struct sctp_paramhdr param_hdr;
-        __u32 response_seq;
-        __u32 result;
+        __be32 response_seq;
+        __be32 result;
 };
 
 struct sctp_strreset_resptsn {
         struct sctp_paramhdr param_hdr;
-        __u32 response_seq;
-        __u32 result;
-        __u32 senders_next_tsn;
-        __u32 receivers_next_tsn;
+        __be32 response_seq;
+        __be32 result;
+        __be32 senders_next_tsn;
+        __be32 receivers_next_tsn;
 };
 
 #endif /* __LINUX_SCTP_H__ */
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index 12910cf19869..c149aa7bedf3 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -55,7 +55,7 @@ smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
 }
 
 void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread);
-int smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                         const struct cpumask *);
+void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
+                                          const struct cpumask *);
 
 #endif
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 39af9bc0f653..62be8966e837 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -78,6 +78,7 @@ void synchronize_srcu(struct srcu_struct *sp);
 
 /**
  * srcu_read_lock_held - might we be in SRCU read-side critical section?
+ * @sp: The srcu_struct structure to check
  *
  * If CONFIG_DEBUG_LOCK_ALLOC is selected, returns nonzero iff in an SRCU
  * read-side critical section.  In absence of CONFIG_DEBUG_LOCK_ALLOC,
diff --git a/include/linux/swait.h b/include/linux/swait.h
index 73e97a08d3d0..cf30f5022472 100644
--- a/include/linux/swait.h
+++ b/include/linux/swait.h
@@ -9,13 +9,16 @@
 /*
  * Simple wait queues
  *
- * While these are very similar to the other/complex wait queues (wait.h) the
- * most important difference is that the simple waitqueue allows for
- * deterministic behaviour -- IOW it has strictly bounded IRQ and lock hold
- * times.
+ * While these are very similar to regular wait queues (wait.h) the most
+ * important difference is that the simple waitqueue allows for deterministic
+ * behaviour -- IOW it has strictly bounded IRQ and lock hold times.
  *
- * In order to make this so, we had to drop a fair number of features of the
- * other waitqueue code; notably:
+ * Mainly, this is accomplished by two things. Firstly not allowing swake_up_all
+ * from IRQ disabled, and dropping the lock upon every wakeup, giving a higher
+ * priority task a chance to run.
+ *
+ * Secondly, we had to drop a fair number of features of the other waitqueue
+ * code; notably:
  *
  *  - mixing INTERRUPTIBLE and UNINTERRUPTIBLE sleeps on the same waitqueue;
  *    all wakeups are TASK_NORMAL in order to avoid O(n) lookups for the right
@@ -24,12 +27,14 @@
  *  - the exclusive mode; because this requires preserving the list order
  *    and this is hard.
  *
- *  - custom wake functions; because you cannot give any guarantees about
- *    random code.
- *
- * As a side effect of this; the data structures are slimmer.
+ *  - custom wake callback functions; because you cannot give any guarantees
+ *    about random code. This also allows swait to be used in RT, such that
+ *    raw spinlock can be used for the swait queue head.
  *
- * One would recommend using this wait queue where possible.
+ * As a side effect of these; the data structures are slimmer albeit more ad-hoc.
+ * For all the above, note that simple wait queues should _only_ be used under
+ * very specific realtime constraints -- it is best to stick with the regular
+ * wait queues in most cases.
  */
 
 struct task_struct;
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 905d769d8ddc..5f7eeab990fe 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -42,7 +42,7 @@ enum {
 #define THREAD_ALIGN    THREAD_SIZE
 #endif
 
-#ifdef CONFIG_DEBUG_STACK_USAGE
+#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
 # define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | \
                                  __GFP_ZERO)
 #else
diff --git a/include/linux/timer.h b/include/linux/timer.h
index e6789b8757d5..6383c528b148 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -168,6 +168,20 @@ static inline void init_timer_on_stack_key(struct timer_list *timer,
 #define setup_pinned_deferrable_timer_on_stack(timer, fn, data)         \
         __setup_timer_on_stack((timer), (fn), (data), TIMER_DEFERRABLE | TIMER_PINNED)
 
+#define TIMER_DATA_TYPE         unsigned long
+#define TIMER_FUNC_TYPE         void (*)(TIMER_DATA_TYPE)
+
+static inline void timer_setup(struct timer_list *timer,
+                               void (*callback)(struct timer_list *),
+                               unsigned int flags)
+{
+        __setup_timer(timer, (TIMER_FUNC_TYPE)callback,
+                      (TIMER_DATA_TYPE)timer, flags);
+}
+
+#define from_timer(var, callback_timer, timer_fieldname) \
+        container_of(callback_timer, typeof(*var), timer_fieldname)
+
 /**
  * timer_pending - is a timer pending?
  * @timer: the timer in question
diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
index 4e6131cd3f43..ac1a2317941e 100644
--- a/include/net/fq_impl.h
+++ b/include/net/fq_impl.h
@@ -146,6 +146,7 @@ static void fq_tin_enqueue(struct fq *fq,
                            fq_flow_get_default_t get_default_func)
 {
         struct fq_flow *flow;
+        bool oom;
 
         lockdep_assert_held(&fq->lock);
 
@@ -167,8 +168,8 @@ static void fq_tin_enqueue(struct fq *fq,
         }
 
         __skb_queue_tail(&flow->queue, skb);
-
-        if (fq->backlog > fq->limit || fq->memory_usage > fq->memory_limit) {
+        oom = (fq->memory_usage > fq->memory_limit);
+        while (fq->backlog > fq->limit || oom) {
                 flow = list_first_entry_or_null(&fq->backlogs,
                                                 struct fq_flow,
                                                 backlogchain);
@@ -183,8 +184,10 @@ static void fq_tin_enqueue(struct fq *fq,
 
                 flow->tin->overlimit++;
                 fq->overlimit++;
-                if (fq->memory_usage > fq->memory_limit)
+                if (oom) {
                         fq->overmemory++;
+                        oom = (fq->memory_usage > fq->memory_limit);
+                }
         }
 }
 
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index aa95053dfc78..db8162dd8c0b 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -96,7 +96,7 @@ struct inet_request_sock {
         kmemcheck_bitfield_end(flags);
         u32                     ir_mark;
         union {
-                struct ip_options_rcu   *opt;
+                struct ip_options_rcu __rcu     *ireq_opt;
 #if IS_ENABLED(CONFIG_IPV6)
                 struct {
                         struct ipv6_txoptions   *ipv6_opt;
@@ -132,6 +132,12 @@ static inline int inet_request_bound_dev_if(const struct sock *sk,
         return sk->sk_bound_dev_if;
 }
 
+static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq)
+{
+        return rcu_dereference_check(ireq->ireq_opt,
+                                     refcount_read(&ireq->req.rsk_refcnt) > 0);
+}
+
 struct inet_cork {
         unsigned int            flags;
         __be32                  addr;
diff --git a/include/net/netlink.h b/include/net/netlink.h
index e51cf5f81597..14c289393071 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -773,7 +773,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
  */
 static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
 {
-        return nla_put(skb, attrtype, sizeof(u8), &value);
+        /* temporary variables to work around GCC PR81715 with asan-stack=1 */
+        u8 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u8), &tmp);
 }
 
 /**
@@ -784,7 +787,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
  */
 static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
 {
-        return nla_put(skb, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u16), &tmp);
 }
 
 /**
@@ -795,7 +800,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
  */
 static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-        return nla_put(skb, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__be16), &tmp);
 }
 
 /**
@@ -806,7 +813,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-        return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+        __be16 tmp = value;
+
+        return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -817,7 +826,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
 {
-        return nla_put(skb, attrtype, sizeof(__le16), &value);
+        __le16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__le16), &tmp);
 }
 
 /**
@@ -828,7 +839,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
  */
 static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
 {
-        return nla_put(skb, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u32), &tmp);
 }
 
 /**
@@ -839,7 +852,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
  */
 static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-        return nla_put(skb, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__be32), &tmp);
 }
 
 /**
@@ -850,7 +865,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-        return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+        __be32 tmp = value;
+
+        return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -861,7 +878,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
 {
-        return nla_put(skb, attrtype, sizeof(__le32), &value);
+        __le32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__le32), &tmp);
 }
 
 /**
@@ -874,7 +893,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
 static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype,
                                     u64 value, int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr);
+        u64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr);
 }
 
 /**
@@ -887,7 +908,9 @@ static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype,
 static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value,
                                int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(__be64), &value, padattr);
+        __be64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(__be64), &tmp, padattr);
 }
 
 /**
@@ -900,7 +923,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value,
 static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value,
                                 int padattr)
 {
-        return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value,
+        __be64 tmp = value;
+
+        return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp,
                             padattr);
 }
 
@@ -914,7 +939,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value,
 static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value,
                                int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(__le64), &value, padattr);
+        __le64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(__le64), &tmp, padattr);
 }
 
 /**
@@ -925,7 +952,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value,
  */
 static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
 {
-        return nla_put(skb, attrtype, sizeof(s8), &value);
+        s8 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s8), &tmp);
 }
 
 /**
@@ -936,7 +965,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
  */
 static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
 {
-        return nla_put(skb, attrtype, sizeof(s16), &value);
+        s16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s16), &tmp);
 }
 
 /**
@@ -947,7 +978,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
  */
 static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
 {
-        return nla_put(skb, attrtype, sizeof(s32), &value);
+        s32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s32), &tmp);
 }
 
 /**
@@ -960,7 +993,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
 static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value,
                               int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(s64), &value, padattr);
+        s64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr);
 }
 
 /**
@@ -1010,7 +1045,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype,
 static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype,
                                   __be32 addr)
 {
-        return nla_put_be32(skb, attrtype, addr);
+        __be32 tmp = addr;
+
+        return nla_put_be32(skb, attrtype, tmp);
 }
 
 /**
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index e80edd8879ef..3009547f3c66 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -2,6 +2,7 @@
 #define __NET_PKT_CLS_H
 
 #include <linux/pkt_cls.h>
+#include <linux/workqueue.h>
 #include <net/sch_generic.h>
 #include <net/act_api.h>
 
@@ -17,6 +18,8 @@ struct tcf_walker {
 int register_tcf_proto_ops(struct tcf_proto_ops *ops);
 int unregister_tcf_proto_ops(struct tcf_proto_ops *ops);
 
+bool tcf_queue_work(struct work_struct *work);
+
 #ifdef CONFIG_NET_CLS
 struct tcf_chain *tcf_chain_get(struct tcf_block *block, u32 chain_index,
                                 bool create);
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 65ba335b0e7e..4fc75f7ae23b 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -39,8 +39,8 @@
 
 /* This is used to register protocols. */
 struct net_protocol {
-        void                    (*early_demux)(struct sk_buff *skb);
-        void                    (*early_demux_handler)(struct sk_buff *skb);
+        int                     (*early_demux)(struct sk_buff *skb);
+        int                     (*early_demux_handler)(struct sk_buff *skb);
         int                     (*handler)(struct sk_buff *skb);
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
         unsigned int            no_policy:1,
diff --git a/include/net/route.h b/include/net/route.h
index 57dfc6850d37..d538e6db1afe 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -175,7 +175,9 @@ static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4
         fl4->fl4_gre_key = gre_key;
         return ip_route_output_key(net, fl4);
 }
-
+int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                          u8 tos, struct net_device *dev,
+                          struct in_device *in_dev, u32 *itag);
 int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src,
                          u8 tos, struct net_device *devin);
 int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src,
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 135f5a2dd931..0dec8a23be57 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -10,6 +10,7 @@
 #include <linux/dynamic_queue_limits.h>
 #include <linux/list.h>
 #include <linux/refcount.h>
+#include <linux/workqueue.h>
 #include <net/gen_stats.h>
 #include <net/rtnetlink.h>
 
@@ -271,6 +272,7 @@ struct tcf_chain {
 
 struct tcf_block {
         struct list_head chain_list;
+        struct work_struct work;
 };
 
 static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 2db3d3a9ce1d..88233cf8b8d4 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -261,7 +261,7 @@ struct sctp_chunk *sctp_make_fwdtsn(const struct sctp_association *asoc,
                                     struct sctp_fwdtsn_skip *skiplist);
 struct sctp_chunk *sctp_make_auth(const struct sctp_association *asoc);
 struct sctp_chunk *sctp_make_strreset_req(const struct sctp_association *asoc,
-                                          __u16 stream_num, __u16 *stream_list,
+                                          __u16 stream_num, __be16 *stream_list,
                                           bool out, bool in);
 struct sctp_chunk *sctp_make_strreset_tsnreq(
                                         const struct sctp_association *asoc);
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index b8c86ec1a8f5..231dc42f1da6 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -130,7 +130,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
 
 struct sctp_ulpevent *sctp_ulpevent_make_stream_reset_event(
         const struct sctp_association *asoc, __u16 flags,
-        __u16 stream_num, __u16 *stream_list, gfp_t gfp);
+        __u16 stream_num, __be16 *stream_list, gfp_t gfp);
 
 struct sctp_ulpevent *sctp_ulpevent_make_assoc_reset_event(
         const struct sctp_association *asoc, __u16 flags,
diff --git a/include/net/strparser.h b/include/net/strparser.h
index 7dc131d62ad5..d96b59f45eba 100644
--- a/include/net/strparser.h
+++ b/include/net/strparser.h
@@ -74,10 +74,9 @@ struct strparser {
         u32 unrecov_intr : 1;
 
         struct sk_buff **skb_nextp;
-        struct timer_list msg_timer;
         struct sk_buff *skb_head;
         unsigned int need_bytes;
-        struct delayed_work delayed_work;
+        struct delayed_work msg_timer_work;
         struct work_struct work;
         struct strp_stats stats;
         struct strp_callbacks cb;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 3bc910a9bfc6..e6d0002a1b0b 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -345,7 +345,7 @@ void tcp_v4_err(struct sk_buff *skb, u32);
 
 void tcp_shutdown(struct sock *sk, int how);
 
-void tcp_v4_early_demux(struct sk_buff *skb);
+int tcp_v4_early_demux(struct sk_buff *skb);
 int tcp_v4_rcv(struct sk_buff *skb);
 
 int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
@@ -840,6 +840,12 @@ struct tcp_skb_cb {
                         struct inet6_skb_parm   h6;
 #endif
                 } header;       /* For incoming skbs */
+                struct {
+                        __u32 key;
+                        __u32 flags;
+                        struct bpf_map *map;
+                        void *data_end;
+                } bpf;
         };
 };
 
@@ -1765,12 +1771,12 @@ static inline void tcp_highest_sack_reset(struct sock *sk)
         tcp_sk(sk)->highest_sack = tcp_write_queue_head(sk);
 }
 
-/* Called when old skb is about to be deleted (to be combined with new skb) */
-static inline void tcp_highest_sack_combine(struct sock *sk,
+/* Called when old skb is about to be deleted and replaced by new skb */
+static inline void tcp_highest_sack_replace(struct sock *sk,
                                             struct sk_buff *old,
                                             struct sk_buff *new)
 {
-        if (tcp_sk(sk)->sacked_out && (old == tcp_sk(sk)->highest_sack))
+        if (old == tcp_highest_sack(sk))
                 tcp_sk(sk)->highest_sack = new;
 }
 
diff --git a/include/net/udp.h b/include/net/udp.h
index 12dfbfe2e2d7..6c759c8594e2 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -259,7 +259,7 @@ static inline struct sk_buff *skb_recv_udp(struct sock *sk, unsigned int flags,
         return __skb_recv_udp(sk, flags, noblock, &peeked, &off, err);
 }
 
-void udp_v4_early_demux(struct sk_buff *skb);
+int udp_v4_early_demux(struct sk_buff *skb);
 bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst);
 int udp_get_port(struct sock *sk, unsigned short snum,
                  int (*saddr_cmp)(const struct sock *,
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index bdb1279a415b..e8608b2dc844 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -285,7 +285,7 @@ enum ib_tm_cap_flags {
         IB_TM_CAP_RC                = 1 << 0,
 };
 
-struct ib_xrq_caps {
+struct ib_tm_caps {
         /* Max size of RNDV header */
         u32 max_rndv_hdr_size;
         /* Max number of entries in tag matching list */
@@ -358,7 +358,7 @@ struct ib_device_attr {
         struct ib_rss_caps      rss_caps;
         u32                     max_wq_type_rq;
         u32                     raw_packet_caps; /* Use ib_raw_packet_caps enum */
-        struct ib_xrq_caps      xrq_caps;
+        struct ib_tm_caps       tm_caps;
 };
 
 enum ib_mtu {
@@ -1739,7 +1739,7 @@ struct ib_mr {
         u32                lkey;
         u32                rkey;
         u64                iova;
-        u32                length;
+        u64                length;
         unsigned int       page_size;
         bool               need_inval;
         union {
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 82e93ee94708..67c5a9f223f7 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -192,6 +192,7 @@ struct scsi_device {
         unsigned no_dif:1;      /* T10 PI (DIF) should be disabled */
         unsigned broken_fua:1;          /* Don't set FUA bit */
         unsigned lun_in_cdb:1;          /* Store LUN bits in CDB[1] */
+        unsigned unmap_limit_for_ws:1;  /* Use the UNMAP limit for WRITE SAME */
 
         atomic_t disk_events_disable_depth; /* disable depth for disk events */
 
diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
index 9592570e092a..36b03013d629 100644
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -29,5 +29,6 @@
 #define BLIST_TRY_VPD_PAGES     0x10000000 /* Attempt to read VPD pages */
 #define BLIST_NO_RSOC           0x20000000 /* don't try to issue RSOC */
 #define BLIST_MAX_1024          0x40000000 /* maximum 1024 sector cdb length */
+#define BLIST_UNMAP_LIMIT_WS    0x80000000 /* Use UNMAP limit for WRITE SAME */
 
 #endif
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 6183d20a01fb..b266d2a3bcb1 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -434,7 +434,6 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
                                                 unsigned int target_id);
 extern void iscsi_remove_session(struct iscsi_cls_session *session);
 extern void iscsi_free_session(struct iscsi_cls_session *session);
-extern int iscsi_destroy_session(struct iscsi_cls_session *session);
 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
                                                 int dd_size, uint32_t cid);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
diff --git a/include/sound/control.h b/include/sound/control.h
index bd7246de58e7..a1f1152bc687 100644
--- a/include/sound/control.h
+++ b/include/sound/control.h
@@ -248,6 +248,9 @@ int snd_ctl_add_vmaster_hook(struct snd_kcontrol *kctl,
                              void *private_data);
 void snd_ctl_sync_vmaster(struct snd_kcontrol *kctl, bool hook_only);
 #define snd_ctl_sync_vmaster_hook(kctl) snd_ctl_sync_vmaster(kctl, true)
+int snd_ctl_apply_vmaster_slaves(struct snd_kcontrol *kctl,
+                                 int (*func)(struct snd_kcontrol *, void *),
+                                 void *arg);
 
 /*
  * Helper functions for jack-detection controls
diff --git a/include/sound/hda_verbs.h b/include/sound/hda_verbs.h
index d0509db6d0ec..f89cd5ee1c7a 100644
--- a/include/sound/hda_verbs.h
+++ b/include/sound/hda_verbs.h
@@ -95,6 +95,7 @@ enum {
 #define AC_VERB_SET_EAPD_BTLENABLE              0x70c
 #define AC_VERB_SET_DIGI_CONVERT_1              0x70d
 #define AC_VERB_SET_DIGI_CONVERT_2              0x70e
+#define AC_VERB_SET_DIGI_CONVERT_3              0x73e
 #define AC_VERB_SET_VOLUME_KNOB_CONTROL         0x70f
 #define AC_VERB_SET_GPIO_DATA                   0x715
 #define AC_VERB_SET_GPIO_MASK                   0x716
diff --git a/include/sound/seq_virmidi.h b/include/sound/seq_virmidi.h
index a03acd0d398a..695257ae64ac 100644
--- a/include/sound/seq_virmidi.h
+++ b/include/sound/seq_virmidi.h
@@ -60,6 +60,7 @@ struct snd_virmidi_dev {
         int port;                       /* created/attached port */
         unsigned int flags;             /* SNDRV_VIRMIDI_* */
         rwlock_t filelist_lock;
+        struct rw_semaphore filelist_sem;
         struct list_head filelist;
 };
 
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index ae1409ffe99a..3c8b7f625670 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -114,7 +114,10 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
          * Preemption ignores task state, therefore preempted tasks are always
          * RUNNING (we will not have dequeued if state != RUNNING).
          */
-        return preempt ? TASK_RUNNING | TASK_STATE_MAX : p->state;
+        if (preempt)
+                return TASK_STATE_MAX;
+
+        return __get_task_state(p);
 }
 #endif /* CREATE_TRACE_POINTS */
 
@@ -152,12 +155,14 @@ TRACE_EVENT(sched_switch,
 
         TP_printk("prev_comm=%s prev_pid=%d prev_prio=%d prev_state=%s%s ==> next_comm=%s next_pid=%d next_prio=%d",
                 __entry->prev_comm, __entry->prev_pid, __entry->prev_prio,
-                __entry->prev_state & (TASK_STATE_MAX-1) ?
-                  __print_flags(__entry->prev_state & (TASK_STATE_MAX-1), "|",
-                                { 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
-                                { 16, "Z" }, { 32, "X" }, { 64, "x" },
-                                { 128, "K" }, { 256, "W" }, { 512, "P" },
-                                { 1024, "N" }) : "R",
+
+                (__entry->prev_state & (TASK_REPORT_MAX - 1)) ?
+                  __print_flags(__entry->prev_state & (TASK_REPORT_MAX - 1), "|",
+                                { 0x01, "S" }, { 0x02, "D" }, { 0x04, "T" },
+                                { 0x08, "t" }, { 0x10, "X" }, { 0x20, "Z" },
+                                { 0x40, "P" }, { 0x80, "I" }) :
+                  "R",
+
                 __entry->prev_state & TASK_STATE_MAX ? "+" : "",
                 __entry->next_comm, __entry->next_pid, __entry->next_prio)
 );
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 43ab5c402f98..7bf4c750dd3a 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -312,7 +312,7 @@ union bpf_attr {
  *     jump into another BPF program
  *     @ctx: context pointer passed to next program
  *     @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY
- *     @index: index inside array that selects specific program to run
+ *     @index: 32-bit index inside array that selects specific program to run
  *     Return: 0 on success or negative error
  *
  * int bpf_clone_redirect(skb, ifindex, flags)
@@ -575,7 +575,7 @@ union bpf_attr {
  *     @map: pointer to sockmap
  *     @key: key to lookup sock in map
  *     @flags: reserved for future use
- *     Return: SK_REDIRECT
+ *     Return: SK_PASS
  *
  * int bpf_sock_map_update(skops, map, key, flags)
  *      @skops: pointer to bpf_sock_ops
@@ -786,9 +786,8 @@ struct xdp_md {
 };
 
 enum sk_action {
-        SK_ABORTED = 0,
-        SK_DROP,
-        SK_REDIRECT,
+        SK_DROP = 0,
+        SK_PASS,
 };
 
 #define BPF_TAG_SIZE    8
diff --git a/include/uapi/linux/dm-ioctl.h b/include/uapi/linux/dm-ioctl.h
index 412c06a624c8..ccaea525340b 100644
--- a/include/uapi/linux/dm-ioctl.h
+++ b/include/uapi/linux/dm-ioctl.h
@@ -269,9 +269,9 @@ enum {
 #define DM_DEV_SET_GEOMETRY     _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
 
 #define DM_VERSION_MAJOR        4
-#define DM_VERSION_MINOR        36
+#define DM_VERSION_MINOR        37
 #define DM_VERSION_PATCHLEVEL   0
-#define DM_VERSION_EXTRA        "-ioctl (2017-06-09)"
+#define DM_VERSION_EXTRA        "-ioctl (2017-09-20)"
 
 /* Status bits */
 #define DM_READONLY_FLAG        (1 << 0) /* In/Out */
diff --git a/include/uapi/linux/membarrier.h b/include/uapi/linux/membarrier.h
index 6d47b3249d8a..4e01ad7ffe98 100644
--- a/include/uapi/linux/membarrier.h
+++ b/include/uapi/linux/membarrier.h
@@ -52,21 +52,30 @@
  *                          (non-running threads are de facto in such a
  *                          state). This only covers threads from the
  *                          same processes as the caller thread. This
- *                          command returns 0. The "expedited" commands
- *                          complete faster than the non-expedited ones,
- *                          they never block, but have the downside of
- *                          causing extra overhead.
+ *                          command returns 0 on success. The
+ *                          "expedited" commands complete faster than
+ *                          the non-expedited ones, they never block,
+ *                          but have the downside of causing extra
+ *                          overhead. A process needs to register its
+ *                          intent to use the private expedited command
+ *                          prior to using it, otherwise this command
+ *                          returns -EPERM.
+ * @MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED:
+ *                          Register the process intent to use
+ *                          MEMBARRIER_CMD_PRIVATE_EXPEDITED. Always
+ *                          returns 0.
  *
  * Command to be passed to the membarrier system call. The commands need to
  * be a single bit each, except for MEMBARRIER_CMD_QUERY which is assigned to
  * the value 0.
  */
 enum membarrier_cmd {
-        MEMBARRIER_CMD_QUERY                    = 0,
-        MEMBARRIER_CMD_SHARED                   = (1 << 0),
+        MEMBARRIER_CMD_QUERY                            = 0,
+        MEMBARRIER_CMD_SHARED                           = (1 << 0),
         /* reserved for MEMBARRIER_CMD_SHARED_EXPEDITED (1 << 1) */
         /* reserved for MEMBARRIER_CMD_PRIVATE (1 << 2) */
-        MEMBARRIER_CMD_PRIVATE_EXPEDITED        = (1 << 3),
+        MEMBARRIER_CMD_PRIVATE_EXPEDITED                = (1 << 3),
+        MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED       = (1 << 4),
 };
 
 #endif /* _UAPI_LINUX_MEMBARRIER_H */
diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
index b97725af2ac0..da161b56c79e 100644
--- a/include/uapi/linux/netfilter/xt_bpf.h
+++ b/include/uapi/linux/netfilter/xt_bpf.h
@@ -23,6 +23,7 @@ enum xt_bpf_modes {
         XT_BPF_MODE_FD_PINNED,
         XT_BPF_MODE_FD_ELF,
 };
+#define XT_BPF_MODE_PATH_PINNED XT_BPF_MODE_FD_PINNED
 
 struct xt_bpf_info_v1 {
         __u16 mode;
diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
index 6217ff8500a1..84fc2914b7fb 100644
--- a/include/uapi/linux/sctp.h
+++ b/include/uapi/linux/sctp.h
@@ -376,7 +376,7 @@ struct sctp_remote_error {
         __u16 sre_type;
         __u16 sre_flags;
         __u32 sre_length;
-        __u16 sre_error;
+        __be16 sre_error;
         sctp_assoc_t sre_assoc_id;
         __u8 sre_data[0];
 };
diff --git a/include/uapi/linux/spi/spidev.h b/include/uapi/linux/spi/spidev.h
index dd5f21e75805..856de39d0b89 100644
--- a/include/uapi/linux/spi/spidev.h
+++ b/include/uapi/linux/spi/spidev.h
@@ -23,6 +23,7 @@
 #define SPIDEV_H
 
 #include <linux/types.h>
+#include <linux/ioctl.h>
 
 /* User space versions of kernel symbols for SPI clocking modes,
  * matching <linux/spi/spi.h>
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index ce1169af39d7..2a5d63040a0b 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor {
         __u8  iFunction;
 } __attribute__ ((packed));
 
+#define USB_DT_INTERFACE_ASSOCIATION_SIZE       8
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 9a0b6479fe0c..d4e0b53bfc75 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -261,7 +261,7 @@ struct ib_uverbs_ex_query_device_resp {
         struct ib_uverbs_rss_caps rss_caps;
         __u32  max_wq_type_rq;
         __u32 raw_packet_caps;
-        struct ib_uverbs_tm_caps xrq_caps;
+        struct ib_uverbs_tm_caps tm_caps;
 };
 
 struct ib_uverbs_query_port {
diff --git a/init/Kconfig b/init/Kconfig
index 78cb2461012e..3c1faaa2af4a 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1033,7 +1033,7 @@ endif
 
 choice
         prompt "Compiler optimization level"
-        default CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
+        default CC_OPTIMIZE_FOR_PERFORMANCE
 
 config CC_OPTIMIZE_FOR_PERFORMANCE
         bool "Optimize for performance"
diff --git a/ipc/shm.c b/ipc/shm.c
index 1e2b1692ba2c..badac463e2c8 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1154,7 +1154,7 @@ static int put_compat_shm_info(struct shm_info *ip,
         info.shm_swp = ip->shm_swp;
         info.swap_attempts = ip->swap_attempts;
         info.swap_successes = ip->swap_successes;
-        return copy_to_user(up, &info, sizeof(info));
+        return copy_to_user(uip, &info, sizeof(info));
 }
 
 static int copy_compat_shmid_to_user(void __user *buf, struct shmid64_ds *in,
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 98c0f00c3f5e..e2636737b69b 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -98,7 +98,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         array_size += (u64) attr->max_entries * elem_size * num_possible_cpus();
 
         if (array_size >= U32_MAX - PAGE_SIZE ||
-            elem_size > PCPU_MIN_UNIT_SIZE || bpf_array_alloc_percpu(array)) {
+            bpf_array_alloc_percpu(array)) {
                 bpf_map_area_free(array);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 917cc04a0a94..7b62df86be1d 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1022,7 +1022,7 @@ select_insn:
                 struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2;
                 struct bpf_array *array = container_of(map, struct bpf_array, map);
                 struct bpf_prog *prog;
-                u64 index = BPF_R3;
+                u32 index = BPF_R3;
 
                 if (unlikely(index >= array->map.max_entries))
                         goto out;
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index e093d9a2c4dd..e745d6a88224 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -69,7 +69,7 @@ static LIST_HEAD(dev_map_list);
 
 static u64 dev_map_bitmap_size(const union bpf_attr *attr)
 {
-        return BITS_TO_LONGS(attr->max_entries) * sizeof(unsigned long);
+        return BITS_TO_LONGS((u64) attr->max_entries) * sizeof(unsigned long);
 }
 
 static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
@@ -78,6 +78,9 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
         int err = -EINVAL;
         u64 cost;
 
+        if (!capable(CAP_NET_ADMIN))
+                return ERR_PTR(-EPERM);
+
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
             attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE)
@@ -111,8 +114,9 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
         err = -ENOMEM;
 
         /* A per cpu bitfield with a bit per possible net device */
-        dtab->flush_needed = __alloc_percpu(dev_map_bitmap_size(attr),
-                                            __alignof__(unsigned long));
+        dtab->flush_needed = __alloc_percpu_gfp(dev_map_bitmap_size(attr),
+                                                __alignof__(unsigned long),
+                                                GFP_KERNEL | __GFP_NOWARN);
         if (!dtab->flush_needed)
                 goto free_dtab;
 
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 431126f31ea3..6533f08d1238 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -317,10 +317,6 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                  */
                 goto free_htab;
 
-        if (percpu && round_up(htab->map.value_size, 8) > PCPU_MIN_UNIT_SIZE)
-                /* make sure the size for pcpu_alloc() is reasonable */
-                goto free_htab;
-
         htab->elem_size = sizeof(struct htab_elem) +
                           round_up(htab->map.key_size, 8);
         if (percpu)
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index e833ed914358..be1dde967208 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -363,6 +363,7 @@ out:
         putname(pname);
         return ret;
 }
+EXPORT_SYMBOL_GPL(bpf_obj_get_user);
 
 static void bpf_evict_inode(struct inode *inode)
 {
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 6424ce0e4969..dbd7b322a86b 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -39,6 +39,7 @@
 #include <linux/workqueue.h>
 #include <linux/list.h>
 #include <net/strparser.h>
+#include <net/tcp.h>
 
 struct bpf_stab {
         struct bpf_map map;
@@ -92,21 +93,45 @@ static inline struct smap_psock *smap_psock_sk(const struct sock *sk)
         return rcu_dereference_sk_user_data(sk);
 }
 
+/* compute the linear packet data range [data, data_end) for skb when
+ * sk_skb type programs are in use.
+ */
+static inline void bpf_compute_data_end_sk_skb(struct sk_buff *skb)
+{
+        TCP_SKB_CB(skb)->bpf.data_end = skb->data + skb_headlen(skb);
+}
+
+enum __sk_action {
+        __SK_DROP = 0,
+        __SK_PASS,
+        __SK_REDIRECT,
+};
+
 static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
 {
         struct bpf_prog *prog = READ_ONCE(psock->bpf_verdict);
         int rc;
 
         if (unlikely(!prog))
-                return SK_DROP;
+                return __SK_DROP;
 
         skb_orphan(skb);
+        /* We need to ensure that BPF metadata for maps is also cleared
+         * when we orphan the skb so that we don't have the possibility
+         * to reference a stale map.
+         */
+        TCP_SKB_CB(skb)->bpf.map = NULL;
         skb->sk = psock->sock;
-        bpf_compute_data_end(skb);
+        bpf_compute_data_end_sk_skb(skb);
+        preempt_disable();
         rc = (*prog->bpf_func)(skb, prog->insnsi);
+        preempt_enable();
         skb->sk = NULL;
 
-        return rc;
+        /* Moving return codes from UAPI namespace into internal namespace */
+        return rc == SK_PASS ?
+                (TCP_SKB_CB(skb)->bpf.map ? __SK_REDIRECT : __SK_PASS) :
+                __SK_DROP;
 }
 
 static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
@@ -114,17 +139,10 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
         struct sock *sk;
         int rc;
 
-        /* Because we use per cpu values to feed input from sock redirect
-         * in BPF program to do_sk_redirect_map() call we need to ensure we
-         * are not preempted. RCU read lock is not sufficient in this case
-         * with CONFIG_PREEMPT_RCU enabled so we must be explicit here.
-         */
-        preempt_disable();
         rc = smap_verdict_func(psock, skb);
         switch (rc) {
-        case SK_REDIRECT:
-                sk = do_sk_redirect_map();
-                preempt_enable();
+        case __SK_REDIRECT:
+                sk = do_sk_redirect_map(skb);
                 if (likely(sk)) {
                         struct smap_psock *peer = smap_psock_sk(sk);
 
@@ -139,10 +157,8 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
                         }
                 }
         /* Fall through and free skb otherwise */
-        case SK_DROP:
+        case __SK_DROP:
         default:
-                if (rc != SK_REDIRECT)
-                        preempt_enable();
                 kfree_skb(skb);
         }
 }
@@ -369,7 +385,7 @@ static int smap_parse_func_strparser(struct strparser *strp,
          * any socket yet.
          */
         skb->sk = psock->sock;
-        bpf_compute_data_end(skb);
+        bpf_compute_data_end_sk_skb(skb);
         rc = (*prog->bpf_func)(skb, prog->insnsi);
         skb->sk = NULL;
         rcu_read_unlock();
@@ -487,6 +503,9 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
         int err = -EINVAL;
         u64 cost;
 
+        if (!capable(CAP_NET_ADMIN))
+                return ERR_PTR(-EPERM);
+
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
             attr->value_size != 4 || attr->map_flags & ~BPF_F_NUMA_NODE)
@@ -840,6 +859,12 @@ static int sock_map_update_elem(struct bpf_map *map,
                 return -EINVAL;
         }
 
+        if (skops.sk->sk_type != SOCK_STREAM ||
+            skops.sk->sk_protocol != IPPROTO_TCP) {
+                fput(socket->file);
+                return -EOPNOTSUPP;
+        }
+
         err = sock_map_ctx_update_elem(&skops, map, key, flags);
         fput(socket->file);
         return err;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b914fbe1383e..c48ca2a34b5e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -653,6 +653,10 @@ static void mark_reg_read(const struct bpf_verifier_state *state, u32 regno)
 {
         struct bpf_verifier_state *parent = state->parent;
 
+        if (regno == BPF_REG_FP)
+                /* We don't need to worry about FP liveness because it's read-only */
+                return;
+
         while (parent) {
                 /* if read wasn't screened by an earlier write ... */
                 if (state->regs[regno].live & REG_LIVE_WRITTEN)
@@ -1112,7 +1116,12 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                 /* ctx accesses must be at a fixed offset, so that we can
                  * determine what type of data were returned.
                  */
-                if (!tnum_is_const(reg->var_off)) {
+                if (reg->off) {
+                        verbose("dereference of modified ctx ptr R%d off=%d+%d, ctx+const is allowed, ctx+const+const is not\n",
+                                regno, reg->off, off - reg->off);
+                        return -EACCES;
+                }
+                if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
                         char tn_buf[48];
 
                         tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
@@ -1120,7 +1129,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                                 tn_buf, off, size);
                         return -EACCES;
                 }
-                off += reg->var_off.value;
                 err = check_ctx_access(env, insn_idx, off, size, t, &reg_type);
                 if (!err && t == BPF_READ && value_regno >= 0) {
                         /* ctx access returns either a scalar, or a
@@ -2345,6 +2353,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                                  * copy register state to dest reg
                                  */
                                 regs[insn->dst_reg] = regs[insn->src_reg];
+                                regs[insn->dst_reg].live |= REG_LIVE_WRITTEN;
                         } else {
                                 /* R1 = (u32) R2 */
                                 if (is_pointer_value(env, insn->src_reg)) {
@@ -2421,12 +2430,15 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
 }
 
 static void find_good_pkt_pointers(struct bpf_verifier_state *state,
-                                   struct bpf_reg_state *dst_reg)
+                                   struct bpf_reg_state *dst_reg,
+                                   bool range_right_open)
 {
         struct bpf_reg_state *regs = state->regs, *reg;
+        u16 new_range;
         int i;
 
-        if (dst_reg->off < 0)
+        if (dst_reg->off < 0 ||
+            (dst_reg->off == 0 && range_right_open))
                 /* This doesn't give us any range */
                 return;
 
@@ -2437,9 +2449,13 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
                  */
                 return;
 
-        /* LLVM can generate four kind of checks:
+        new_range = dst_reg->off;
+        if (range_right_open)
+                new_range--;
+
+        /* Examples for register markings:
          *
-         * Type 1/2:
+         * pkt_data in dst register:
          *
          *   r2 = r3;
          *   r2 += 8;
@@ -2456,7 +2472,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
          *     r2=pkt(id=n,off=8,r=0)
          *     r3=pkt(id=n,off=0,r=0)
          *
-         * Type 3/4:
+         * pkt_data in src register:
          *
          *   r2 = r3;
          *   r2 += 8;
@@ -2474,7 +2490,9 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
          *     r3=pkt(id=n,off=0,r=0)
          *
          * Find register r3 and mark its range as r3=pkt(id=n,off=0,r=8)
-         * so that range of bytes [r3, r3 + 8) is safe to access.
+         * or r3=pkt(id=n,off=0,r=8-1), so that range of bytes [r3, r3 + 8)
+         * and [r3, r3 + 8-1) respectively is safe to access depending on
+         * the check.
          */
 
         /* If our ids match, then we must have the same max_value.  And we
@@ -2485,14 +2503,14 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
         for (i = 0; i < MAX_BPF_REG; i++)
                 if (regs[i].type == PTR_TO_PACKET && regs[i].id == dst_reg->id)
                         /* keep the maximum range already checked */
-                        regs[i].range = max_t(u16, regs[i].range, dst_reg->off);
+                        regs[i].range = max(regs[i].range, new_range);
 
         for (i = 0; i < MAX_BPF_STACK; i += BPF_REG_SIZE) {
                 if (state->stack_slot_type[i] != STACK_SPILL)
                         continue;
                 reg = &state->spilled_regs[i / BPF_REG_SIZE];
                 if (reg->type == PTR_TO_PACKET && reg->id == dst_reg->id)
-                        reg->range = max_t(u16, reg->range, dst_reg->off);
+                        reg->range = max(reg->range, new_range);
         }
 }
 
@@ -2856,19 +2874,43 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
         } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGT &&
                    dst_reg->type == PTR_TO_PACKET &&
                    regs[insn->src_reg].type == PTR_TO_PACKET_END) {
-                find_good_pkt_pointers(this_branch, dst_reg);
+                /* pkt_data' > pkt_end */
+                find_good_pkt_pointers(this_branch, dst_reg, false);
+        } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGT &&
+                   dst_reg->type == PTR_TO_PACKET_END &&
+                   regs[insn->src_reg].type == PTR_TO_PACKET) {
+                /* pkt_end > pkt_data' */
+                find_good_pkt_pointers(other_branch, &regs[insn->src_reg], true);
         } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JLT &&
                    dst_reg->type == PTR_TO_PACKET &&
                    regs[insn->src_reg].type == PTR_TO_PACKET_END) {
-                find_good_pkt_pointers(other_branch, dst_reg);
+                /* pkt_data' < pkt_end */
+                find_good_pkt_pointers(other_branch, dst_reg, true);
+        } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JLT &&
+                   dst_reg->type == PTR_TO_PACKET_END &&
+                   regs[insn->src_reg].type == PTR_TO_PACKET) {
+                /* pkt_end < pkt_data' */
+                find_good_pkt_pointers(this_branch, &regs[insn->src_reg], false);
+        } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGE &&
+                   dst_reg->type == PTR_TO_PACKET &&
+                   regs[insn->src_reg].type == PTR_TO_PACKET_END) {
+                /* pkt_data' >= pkt_end */
+                find_good_pkt_pointers(this_branch, dst_reg, true);
         } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGE &&
                    dst_reg->type == PTR_TO_PACKET_END &&
                    regs[insn->src_reg].type == PTR_TO_PACKET) {
-                find_good_pkt_pointers(other_branch, &regs[insn->src_reg]);
+                /* pkt_end >= pkt_data' */
+                find_good_pkt_pointers(other_branch, &regs[insn->src_reg], false);
+        } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JLE &&
+                   dst_reg->type == PTR_TO_PACKET &&
+                   regs[insn->src_reg].type == PTR_TO_PACKET_END) {
+                /* pkt_data' <= pkt_end */
+                find_good_pkt_pointers(other_branch, dst_reg, false);
         } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JLE &&
                    dst_reg->type == PTR_TO_PACKET_END &&
                    regs[insn->src_reg].type == PTR_TO_PACKET) {
-                find_good_pkt_pointers(this_branch, &regs[insn->src_reg]);
+                /* pkt_end <= pkt_data' */
+                find_good_pkt_pointers(this_branch, &regs[insn->src_reg], true);
         } else if (is_pointer_value(env, insn->dst_reg)) {
                 verbose("R%d pointer comparison prohibited\n", insn->dst_reg);
                 return -EACCES;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index d6551cd45238..44857278eb8a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2311,6 +2311,14 @@ out_release_tset:
                 list_del_init(&cset->mg_node);
         }
         spin_unlock_irq(&css_set_lock);
+
+        /*
+         * Re-initialize the cgroup_taskset structure in case it is reused
+         * again in another cgroup_migrate_add_task()/cgroup_migrate_execute()
+         * iteration.
+         */
+        tset->nr_tasks = 0;
+        tset->csets    = &tset->src_csets;
         return ret;
 }
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index acf5308fad51..04892a82f6ac 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -24,6 +24,7 @@
 #include <linux/lockdep.h>
 #include <linux/tick.h>
 #include <linux/irq.h>
+#include <linux/nmi.h>
 #include <linux/smpboot.h>
 #include <linux/relay.h>
 #include <linux/slab.h>
@@ -46,11 +47,13 @@
  * @bringup:    Single callback bringup or teardown selector
  * @cb_state:   The state for a single callback (install/uninstall)
  * @result:     Result of the operation
- * @done:       Signal completion to the issuer of the task
+ * @done_up:    Signal completion to the issuer of the task for cpu-up
+ * @done_down:  Signal completion to the issuer of the task for cpu-down
  */
 struct cpuhp_cpu_state {
         enum cpuhp_state        state;
         enum cpuhp_state        target;
+        enum cpuhp_state        fail;
 #ifdef CONFIG_SMP
         struct task_struct      *thread;
         bool                    should_run;
@@ -58,18 +61,39 @@ struct cpuhp_cpu_state {
         bool                    single;
         bool                    bringup;
         struct hlist_node       *node;
+        struct hlist_node       *last;
         enum cpuhp_state        cb_state;
         int                     result;
-        struct completion       done;
+        struct completion       done_up;
+        struct completion       done_down;
 #endif
 };
 
-static DEFINE_PER_CPU(struct cpuhp_cpu_state, cpuhp_state);
+static DEFINE_PER_CPU(struct cpuhp_cpu_state, cpuhp_state) = {
+        .fail = CPUHP_INVALID,
+};
 
 #if defined(CONFIG_LOCKDEP) && defined(CONFIG_SMP)
-static struct lock_class_key cpuhp_state_key;
-static struct lockdep_map cpuhp_state_lock_map =
-        STATIC_LOCKDEP_MAP_INIT("cpuhp_state", &cpuhp_state_key);
+static struct lockdep_map cpuhp_state_up_map =
+        STATIC_LOCKDEP_MAP_INIT("cpuhp_state-up", &cpuhp_state_up_map);
+static struct lockdep_map cpuhp_state_down_map =
+        STATIC_LOCKDEP_MAP_INIT("cpuhp_state-down", &cpuhp_state_down_map);
+
+
+static void inline cpuhp_lock_acquire(bool bringup)
+{
+        lock_map_acquire(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
+}
+
+static void inline cpuhp_lock_release(bool bringup)
+{
+        lock_map_release(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
+}
+#else
+
+static void inline cpuhp_lock_acquire(bool bringup) { }
+static void inline cpuhp_lock_release(bool bringup) { }
+
 #endif
 
 /**
@@ -123,13 +147,16 @@ static struct cpuhp_step *cpuhp_get_step(enum cpuhp_state state)
 /**
  * cpuhp_invoke_callback _ Invoke the callbacks for a given state
  * @cpu:        The cpu for which the callback should be invoked
- * @step:       The step in the state machine
+ * @state:      The state to do callbacks for
  * @bringup:    True if the bringup callback should be invoked
+ * @node:       For multi-instance, do a single entry callback for install/remove
+ * @lastp:      For multi-instance rollback, remember how far we got
  *
  * Called from cpu hotplug and from the state register machinery.
  */
 static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
-                                 bool bringup, struct hlist_node *node)
+                                 bool bringup, struct hlist_node *node,
+                                 struct hlist_node **lastp)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
         struct cpuhp_step *step = cpuhp_get_step(state);
@@ -137,7 +164,17 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
         int (*cb)(unsigned int cpu);
         int ret, cnt;
 
+        if (st->fail == state) {
+                st->fail = CPUHP_INVALID;
+
+                if (!(bringup ? step->startup.single : step->teardown.single))
+                        return 0;
+
+                return -EAGAIN;
+        }
+
         if (!step->multi_instance) {
+                WARN_ON_ONCE(lastp && *lastp);
                 cb = bringup ? step->startup.single : step->teardown.single;
                 if (!cb)
                         return 0;
@@ -152,6 +189,7 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
 
         /* Single invocation for instance add/remove */
         if (node) {
+                WARN_ON_ONCE(lastp && *lastp);
                 trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
                 ret = cbm(cpu, node);
                 trace_cpuhp_exit(cpu, st->state, state, ret);
@@ -161,13 +199,23 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
         /* State transition. Invoke on all instances */
         cnt = 0;
         hlist_for_each(node, &step->list) {
+                if (lastp && node == *lastp)
+                        break;
+
                 trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
                 ret = cbm(cpu, node);
                 trace_cpuhp_exit(cpu, st->state, state, ret);
-                if (ret)
-                        goto err;
+                if (ret) {
+                        if (!lastp)
+                                goto err;
+
+                        *lastp = node;
+                        return ret;
+                }
                 cnt++;
         }
+        if (lastp)
+                *lastp = NULL;
         return 0;
 err:
         /* Rollback the instances if one failed */
@@ -178,12 +226,39 @@ err:
         hlist_for_each(node, &step->list) {
                 if (!cnt--)
                         break;
-                cbm(cpu, node);
+
+                trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
+                ret = cbm(cpu, node);
+                trace_cpuhp_exit(cpu, st->state, state, ret);
+                /*
+                 * Rollback must not fail,
+                 */
+                WARN_ON_ONCE(ret);
         }
         return ret;
 }
 
 #ifdef CONFIG_SMP
+static inline void wait_for_ap_thread(struct cpuhp_cpu_state *st, bool bringup)
+{
+        struct completion *done = bringup ? &st->done_up : &st->done_down;
+        wait_for_completion(done);
+}
+
+static inline void complete_ap_thread(struct cpuhp_cpu_state *st, bool bringup)
+{
+        struct completion *done = bringup ? &st->done_up : &st->done_down;
+        complete(done);
+}
+
+/*
+ * The former STARTING/DYING states, ran with IRQs disabled and must not fail.
+ */
+static bool cpuhp_is_atomic_state(enum cpuhp_state state)
+{
+        return CPUHP_AP_IDLE_DEAD <= state && state < CPUHP_AP_ONLINE;
+}
+
 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
 static DEFINE_MUTEX(cpu_add_remove_lock);
 bool cpuhp_tasks_frozen;
@@ -271,14 +346,79 @@ void cpu_hotplug_enable(void)
 EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
 #endif  /* CONFIG_HOTPLUG_CPU */
 
-static void __cpuhp_kick_ap_work(struct cpuhp_cpu_state *st);
+static inline enum cpuhp_state
+cpuhp_set_state(struct cpuhp_cpu_state *st, enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state = st->state;
+
+        st->rollback = false;
+        st->last = NULL;
+
+        st->target = target;
+        st->single = false;
+        st->bringup = st->state < target;
+
+        return prev_state;
+}
+
+static inline void
+cpuhp_reset_state(struct cpuhp_cpu_state *st, enum cpuhp_state prev_state)
+{
+        st->rollback = true;
+
+        /*
+         * If we have st->last we need to undo partial multi_instance of this
+         * state first. Otherwise start undo at the previous state.
+         */
+        if (!st->last) {
+                if (st->bringup)
+                        st->state--;
+                else
+                        st->state++;
+        }
+
+        st->target = prev_state;
+        st->bringup = !st->bringup;
+}
+
+/* Regular hotplug invocation of the AP hotplug thread */
+static void __cpuhp_kick_ap(struct cpuhp_cpu_state *st)
+{
+        if (!st->single && st->state == st->target)
+                return;
+
+        st->result = 0;
+        /*
+         * Make sure the above stores are visible before should_run becomes
+         * true. Paired with the mb() above in cpuhp_thread_fun()
+         */
+        smp_mb();
+        st->should_run = true;
+        wake_up_process(st->thread);
+        wait_for_ap_thread(st, st->bringup);
+}
+
+static int cpuhp_kick_ap(struct cpuhp_cpu_state *st, enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state;
+        int ret;
+
+        prev_state = cpuhp_set_state(st, target);
+        __cpuhp_kick_ap(st);
+        if ((ret = st->result)) {
+                cpuhp_reset_state(st, prev_state);
+                __cpuhp_kick_ap(st);
+        }
+
+        return ret;
+}
 
 static int bringup_wait_for_ap(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
 
         /* Wait for the CPU to reach CPUHP_AP_ONLINE_IDLE */
-        wait_for_completion(&st->done);
+        wait_for_ap_thread(st, true);
         if (WARN_ON_ONCE((!cpu_online(cpu))))
                 return -ECANCELED;
 
@@ -286,12 +426,10 @@ static int bringup_wait_for_ap(unsigned int cpu)
         stop_machine_unpark(cpu);
         kthread_unpark(st->thread);
 
-        /* Should we go further up ? */
-        if (st->target > CPUHP_AP_ONLINE_IDLE) {
-                __cpuhp_kick_ap_work(st);
-                wait_for_completion(&st->done);
-        }
-        return st->result;
+        if (st->target <= CPUHP_AP_ONLINE_IDLE)
+                return 0;
+
+        return cpuhp_kick_ap(st, st->target);
 }
 
 static int bringup_cpu(unsigned int cpu)
@@ -317,32 +455,6 @@ static int bringup_cpu(unsigned int cpu)
 /*
  * Hotplug state machine related functions
  */
-static void undo_cpu_down(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        for (st->state++; st->state < st->target; st->state++) {
-                struct cpuhp_step *step = cpuhp_get_step(st->state);
-
-                if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, true, NULL);
-        }
-}
-
-static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
-                                enum cpuhp_state target)
-{
-        enum cpuhp_state prev_state = st->state;
-        int ret = 0;
-
-        for (; st->state > target; st->state--) {
-                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL);
-                if (ret) {
-                        st->target = prev_state;
-                        undo_cpu_down(cpu, st);
-                        break;
-                }
-        }
-        return ret;
-}
 
 static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
 {
@@ -350,7 +462,7 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
                 struct cpuhp_step *step = cpuhp_get_step(st->state);
 
                 if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, false, NULL);
+                        cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
         }
 }
 
@@ -362,7 +474,7 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
 
         while (st->state < target) {
                 st->state++;
-                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL);
+                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
                 if (ret) {
                         st->target = prev_state;
                         undo_cpu_up(cpu, st);
@@ -379,7 +491,8 @@ static void cpuhp_create(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
 
-        init_completion(&st->done);
+        init_completion(&st->done_up);
+        init_completion(&st->done_down);
 }
 
 static int cpuhp_should_run(unsigned int cpu)
@@ -389,69 +502,90 @@ static int cpuhp_should_run(unsigned int cpu)
         return st->should_run;
 }
 
-/* Execute the teardown callbacks. Used to be CPU_DOWN_PREPARE */
-static int cpuhp_ap_offline(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        enum cpuhp_state target = max((int)st->target, CPUHP_TEARDOWN_CPU);
-
-        return cpuhp_down_callbacks(cpu, st, target);
-}
-
-/* Execute the online startup callbacks. Used to be CPU_ONLINE */
-static int cpuhp_ap_online(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        return cpuhp_up_callbacks(cpu, st, st->target);
-}
-
 /*
  * Execute teardown/startup callbacks on the plugged cpu. Also used to invoke
  * callbacks when a state gets [un]installed at runtime.
+ *
+ * Each invocation of this function by the smpboot thread does a single AP
+ * state callback.
+ *
+ * It has 3 modes of operation:
+ *  - single: runs st->cb_state
+ *  - up:     runs ++st->state, while st->state < st->target
+ *  - down:   runs st->state--, while st->state > st->target
+ *
+ * When complete or on error, should_run is cleared and the completion is fired.
  */
 static void cpuhp_thread_fun(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = this_cpu_ptr(&cpuhp_state);
-        int ret = 0;
+        bool bringup = st->bringup;
+        enum cpuhp_state state;
 
         /*
-         * Paired with the mb() in cpuhp_kick_ap_work and
-         * cpuhp_invoke_ap_callback, so the work set is consistent visible.
+         * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
+         * that if we see ->should_run we also see the rest of the state.
          */
         smp_mb();
-        if (!st->should_run)
+
+        if (WARN_ON_ONCE(!st->should_run))
                 return;
 
-        st->should_run = false;
+        cpuhp_lock_acquire(bringup);
 
-        lock_map_acquire(&cpuhp_state_lock_map);
-        /* Single callback invocation for [un]install ? */
         if (st->single) {
-                if (st->cb_state < CPUHP_AP_ONLINE) {
-                        local_irq_disable();
-                        ret = cpuhp_invoke_callback(cpu, st->cb_state,
-                                                    st->bringup, st->node);
-                        local_irq_enable();
+                state = st->cb_state;
+                st->should_run = false;
+        } else {
+                if (bringup) {
+                        st->state++;
+                        state = st->state;
+                        st->should_run = (st->state < st->target);
+                        WARN_ON_ONCE(st->state > st->target);
                 } else {
-                        ret = cpuhp_invoke_callback(cpu, st->cb_state,
-                                                    st->bringup, st->node);
+                        state = st->state;
+                        st->state--;
+                        st->should_run = (st->state > st->target);
+                        WARN_ON_ONCE(st->state < st->target);
                 }
-        } else if (st->rollback) {
-                BUG_ON(st->state < CPUHP_AP_ONLINE_IDLE);
+        }
+
+        WARN_ON_ONCE(!cpuhp_is_ap_state(state));
 
-                undo_cpu_down(cpu, st);
-                st->rollback = false;
+        if (st->rollback) {
+                struct cpuhp_step *step = cpuhp_get_step(state);
+                if (step->skip_onerr)
+                        goto next;
+        }
+
+        if (cpuhp_is_atomic_state(state)) {
+                local_irq_disable();
+                st->result = cpuhp_invoke_callback(cpu, state, bringup, st->node, &st->last);
+                local_irq_enable();
+
+                /*
+                 * STARTING/DYING must not fail!
+                 */
+                WARN_ON_ONCE(st->result);
         } else {
-                /* Cannot happen .... */
-                BUG_ON(st->state < CPUHP_AP_ONLINE_IDLE);
-
-                /* Regular hotplug work */
-                if (st->state < st->target)
-                        ret = cpuhp_ap_online(cpu, st);
-                else if (st->state > st->target)
-                        ret = cpuhp_ap_offline(cpu, st);
+                st->result = cpuhp_invoke_callback(cpu, state, bringup, st->node, &st->last);
+        }
+
+        if (st->result) {
+                /*
+                 * If we fail on a rollback, we're up a creek without no
+                 * paddle, no way forward, no way back. We loose, thanks for
+                 * playing.
+                 */
+                WARN_ON_ONCE(st->rollback);
+                st->should_run = false;
         }
-        lock_map_release(&cpuhp_state_lock_map);
-        st->result = ret;
-        complete(&st->done);
+
+next:
+        cpuhp_lock_release(bringup);
+
+        if (!st->should_run)
+                complete_ap_thread(st, bringup);
 }
 
 /* Invoke a single callback on a remote cpu */
@@ -460,62 +594,69 @@ cpuhp_invoke_ap_callback(int cpu, enum cpuhp_state state, bool bringup,
                          struct hlist_node *node)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
+        int ret;
 
         if (!cpu_online(cpu))
                 return 0;
 
-        lock_map_acquire(&cpuhp_state_lock_map);
-        lock_map_release(&cpuhp_state_lock_map);
+        cpuhp_lock_acquire(false);
+        cpuhp_lock_release(false);
+
+        cpuhp_lock_acquire(true);
+        cpuhp_lock_release(true);
 
         /*
          * If we are up and running, use the hotplug thread. For early calls
          * we invoke the thread function directly.
          */
         if (!st->thread)
-                return cpuhp_invoke_callback(cpu, state, bringup, node);
+                return cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
 
+        st->rollback = false;
+        st->last = NULL;
+
+        st->node = node;
+        st->bringup = bringup;
         st->cb_state = state;
         st->single = true;
-        st->bringup = bringup;
-        st->node = node;
+
+        __cpuhp_kick_ap(st);
 
         /*
-         * Make sure the above stores are visible before should_run becomes
-         * true. Paired with the mb() above in cpuhp_thread_fun()
+         * If we failed and did a partial, do a rollback.
          */
-        smp_mb();
-        st->should_run = true;
-        wake_up_process(st->thread);
-        wait_for_completion(&st->done);
-        return st->result;
-}
+        if ((ret = st->result) && st->last) {
+                st->rollback = true;
+                st->bringup = !bringup;
+
+                __cpuhp_kick_ap(st);
+        }
 
-/* Regular hotplug invocation of the AP hotplug thread */
-static void __cpuhp_kick_ap_work(struct cpuhp_cpu_state *st)
-{
-        st->result = 0;
-        st->single = false;
         /*
-         * Make sure the above stores are visible before should_run becomes
-         * true. Paired with the mb() above in cpuhp_thread_fun()
+         * Clean up the leftovers so the next hotplug operation wont use stale
+         * data.
          */
-        smp_mb();
-        st->should_run = true;
-        wake_up_process(st->thread);
+        st->node = st->last = NULL;
+        return ret;
 }
 
 static int cpuhp_kick_ap_work(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
-        enum cpuhp_state state = st->state;
+        enum cpuhp_state prev_state = st->state;
+        int ret;
+
+        cpuhp_lock_acquire(false);
+        cpuhp_lock_release(false);
+
+        cpuhp_lock_acquire(true);
+        cpuhp_lock_release(true);
 
-        trace_cpuhp_enter(cpu, st->target, state, cpuhp_kick_ap_work);
-        lock_map_acquire(&cpuhp_state_lock_map);
-        lock_map_release(&cpuhp_state_lock_map);
-        __cpuhp_kick_ap_work(st);
-        wait_for_completion(&st->done);
-        trace_cpuhp_exit(cpu, st->state, state, st->result);
-        return st->result;
+        trace_cpuhp_enter(cpu, st->target, prev_state, cpuhp_kick_ap_work);
+        ret = cpuhp_kick_ap(st, st->target);
+        trace_cpuhp_exit(cpu, st->state, prev_state, ret);
+
+        return ret;
 }
 
 static struct smp_hotplug_thread cpuhp_threads = {
@@ -581,6 +722,7 @@ static int take_cpu_down(void *_param)
         struct cpuhp_cpu_state *st = this_cpu_ptr(&cpuhp_state);
         enum cpuhp_state target = max((int)st->target, CPUHP_AP_OFFLINE);
         int err, cpu = smp_processor_id();
+        int ret;
 
         /* Ensure this CPU doesn't handle any more interrupts. */
         err = __cpu_disable();
@@ -594,8 +736,13 @@ static int take_cpu_down(void *_param)
         WARN_ON(st->state != CPUHP_TEARDOWN_CPU);
         st->state--;
         /* Invoke the former CPU_DYING callbacks */
-        for (; st->state > target; st->state--)
-                cpuhp_invoke_callback(cpu, st->state, false, NULL);
+        for (; st->state > target; st->state--) {
+                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
+                /*
+                 * DYING must not fail!
+                 */
+                WARN_ON_ONCE(ret);
+        }
 
         /* Give up timekeeping duties */
         tick_handover_do_timer();
@@ -639,7 +786,7 @@ static int takedown_cpu(unsigned int cpu)
          *
          * Wait for the stop thread to go away.
          */
-        wait_for_completion(&st->done);
+        wait_for_ap_thread(st, false);
         BUG_ON(st->state != CPUHP_AP_IDLE_DEAD);
 
         /* Interrupts are moved away from the dying cpu, reenable alloc/free */
@@ -658,7 +805,7 @@ static void cpuhp_complete_idle_dead(void *arg)
 {
         struct cpuhp_cpu_state *st = arg;
 
-        complete(&st->done);
+        complete_ap_thread(st, false);
 }
 
 void cpuhp_report_idle_dead(void)
@@ -676,11 +823,32 @@ void cpuhp_report_idle_dead(void)
                                  cpuhp_complete_idle_dead, st, 0);
 }
 
-#else
-#define takedown_cpu            NULL
-#endif
+static void undo_cpu_down(unsigned int cpu, struct cpuhp_cpu_state *st)
+{
+        for (st->state++; st->state < st->target; st->state++) {
+                struct cpuhp_step *step = cpuhp_get_step(st->state);
 
-#ifdef CONFIG_HOTPLUG_CPU
+                if (!step->skip_onerr)
+                        cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
+        }
+}
+
+static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
+                                enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state = st->state;
+        int ret = 0;
+
+        for (; st->state > target; st->state--) {
+                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
+                if (ret) {
+                        st->target = prev_state;
+                        undo_cpu_down(cpu, st);
+                        break;
+                }
+        }
+        return ret;
+}
 
 /* Requires cpu_add_remove_lock to be held */
 static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
@@ -699,13 +867,13 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
 
         cpuhp_tasks_frozen = tasks_frozen;
 
-        prev_state = st->state;
-        st->target = target;
+        prev_state = cpuhp_set_state(st, target);
         /*
          * If the current CPU state is in the range of the AP hotplug thread,
          * then we need to kick the thread.
          */
         if (st->state > CPUHP_TEARDOWN_CPU) {
+                st->target = max((int)target, CPUHP_TEARDOWN_CPU);
                 ret = cpuhp_kick_ap_work(cpu);
                 /*
                  * The AP side has done the error rollback already. Just
@@ -720,6 +888,8 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
                  */
                 if (st->state > CPUHP_TEARDOWN_CPU)
                         goto out;
+
+                st->target = target;
         }
         /*
          * The AP brought itself down to CPUHP_TEARDOWN_CPU. So we need
@@ -727,13 +897,17 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
          */
         ret = cpuhp_down_callbacks(cpu, st, target);
         if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) {
-                st->target = prev_state;
-                st->rollback = true;
-                cpuhp_kick_ap_work(cpu);
+                cpuhp_reset_state(st, prev_state);
+                __cpuhp_kick_ap(st);
         }
 
 out:
         cpus_write_unlock();
+        /*
+         * Do post unplug cleanup. This is still protected against
+         * concurrent CPU hotplug via cpu_add_remove_lock.
+         */
+        lockup_detector_cleanup();
         return ret;
 }
 
@@ -754,11 +928,15 @@ out:
         cpu_maps_update_done();
         return err;
 }
+
 int cpu_down(unsigned int cpu)
 {
         return do_cpu_down(cpu, CPUHP_OFFLINE);
 }
 EXPORT_SYMBOL(cpu_down);
+
+#else
+#define takedown_cpu            NULL
 #endif /*CONFIG_HOTPLUG_CPU*/
 
 /**
@@ -772,11 +950,16 @@ void notify_cpu_starting(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
         enum cpuhp_state target = min((int)st->target, CPUHP_AP_ONLINE);
+        int ret;
 
         rcu_cpu_starting(cpu);  /* Enables RCU usage on this CPU. */
         while (st->state < target) {
                 st->state++;
-                cpuhp_invoke_callback(cpu, st->state, true, NULL);
+                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
+                /*
+                 * STARTING must not fail!
+                 */
+                WARN_ON_ONCE(ret);
         }
 }
 
@@ -794,7 +977,7 @@ void cpuhp_online_idle(enum cpuhp_state state)
                 return;
 
         st->state = CPUHP_AP_ONLINE_IDLE;
-        complete(&st->done);
+        complete_ap_thread(st, true);
 }
 
 /* Requires cpu_add_remove_lock to be held */
@@ -829,7 +1012,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
 
         cpuhp_tasks_frozen = tasks_frozen;
 
-        st->target = target;
+        cpuhp_set_state(st, target);
         /*
          * If the current CPU state is in the range of the AP hotplug thread,
          * then we need to kick the thread once more.
@@ -1296,6 +1479,10 @@ static int cpuhp_issue_call(int cpu, enum cpuhp_state state, bool bringup,
         struct cpuhp_step *sp = cpuhp_get_step(state);
         int ret;
 
+        /*
+         * If there's nothing to do, we done.
+         * Relies on the union for multi_instance.
+         */
         if ((bringup && !sp->startup.single) ||
             (!bringup && !sp->teardown.single))
                 return 0;
@@ -1307,9 +1494,9 @@ static int cpuhp_issue_call(int cpu, enum cpuhp_state state, bool bringup,
         if (cpuhp_is_ap_state(state))
                 ret = cpuhp_invoke_ap_callback(cpu, state, bringup, node);
         else
-                ret = cpuhp_invoke_callback(cpu, state, bringup, node);
+                ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
 #else
-        ret = cpuhp_invoke_callback(cpu, state, bringup, node);
+        ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
 #endif
         BUG_ON(ret && !bringup);
         return ret;
@@ -1641,9 +1828,55 @@ static ssize_t show_cpuhp_target(struct device *dev,
 }
 static DEVICE_ATTR(target, 0644, show_cpuhp_target, write_cpuhp_target);
 
+
+static ssize_t write_cpuhp_fail(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, dev->id);
+        struct cpuhp_step *sp;
+        int fail, ret;
+
+        ret = kstrtoint(buf, 10, &fail);
+        if (ret)
+                return ret;
+
+        /*
+         * Cannot fail STARTING/DYING callbacks.
+         */
+        if (cpuhp_is_atomic_state(fail))
+                return -EINVAL;
+
+        /*
+         * Cannot fail anything that doesn't have callbacks.
+         */
+        mutex_lock(&cpuhp_state_mutex);
+        sp = cpuhp_get_step(fail);
+        if (!sp->startup.single && !sp->teardown.single)
+                ret = -EINVAL;
+        mutex_unlock(&cpuhp_state_mutex);
+        if (ret)
+                return ret;
+
+        st->fail = fail;
+
+        return count;
+}
+
+static ssize_t show_cpuhp_fail(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, dev->id);
+
+        return sprintf(buf, "%d\n", st->fail);
+}
+
+static DEVICE_ATTR(fail, 0644, show_cpuhp_fail, write_cpuhp_fail);
+
 static struct attribute *cpuhp_cpu_attrs[] = {
         &dev_attr_state.attr,
         &dev_attr_target.attr,
+        &dev_attr_fail.attr,
         NULL
 };
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6bc21e202ae4..9d93db81fa36 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -662,7 +662,7 @@ static inline void update_cgrp_time_from_event(struct perf_event *event)
         /*
          * Do not update time when cgroup is not active
          */
-        if (cgrp == event->cgrp)
+       if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup))
                 __update_cgrp_time(event->cgrp);
 }
 
@@ -8955,6 +8955,14 @@ static struct perf_cpu_context __percpu *find_pmu_context(int ctxn)
 
 static void free_pmu_context(struct pmu *pmu)
 {
+        /*
+         * Static contexts such as perf_sw_context have a global lifetime
+         * and may be shared between different PMUs. Avoid freeing them
+         * when a single PMU is going away.
+         */
+        if (pmu->task_ctx_nr > perf_invalid_context)
+                return;
+
         mutex_lock(&pmus_lock);
         free_percpu(pmu->pmu_cpu_context);
         mutex_unlock(&pmus_lock);
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index af71a84e12ee..f684d8e5fa2b 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -412,6 +412,19 @@ err:
         return NULL;
 }
 
+static bool __always_inline rb_need_aux_wakeup(struct ring_buffer *rb)
+{
+        if (rb->aux_overwrite)
+                return false;
+
+        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
+                return true;
+        }
+
+        return false;
+}
+
 /*
  * Commit the data written by hardware into the ring buffer by adjusting
  * aux_head and posting a PERF_RECORD_AUX into the perf buffer. It is the
@@ -451,10 +464,8 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
         }
 
         rb->user_page->aux_head = rb->aux_head;
-        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+        if (rb_need_aux_wakeup(rb))
                 wakeup = true;
-                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
-        }
 
         if (wakeup) {
                 if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
@@ -484,9 +495,8 @@ int perf_aux_output_skip(struct perf_output_handle *handle, unsigned long size)
         rb->aux_head += size;
 
         rb->user_page->aux_head = rb->aux_head;
-        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+        if (rb_need_aux_wakeup(rb)) {
                 perf_output_wakeup(handle);
-                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
                 handle->wakeup = rb->aux_wakeup + rb->aux_watermark;
         }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 3481ababd06a..f6cad39f35df 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1600,18 +1600,19 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
         struct waitid_info info = {.status = 0};
         long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
         int signo = 0;
+
         if (err > 0) {
                 signo = SIGCHLD;
                 err = 0;
-        }
-
-        if (!err) {
                 if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
                         return -EFAULT;
         }
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                return -EFAULT;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1723,21 +1724,23 @@ COMPAT_SYSCALL_DEFINE5(waitid,
         if (err > 0) {
                 signo = SIGCHLD;
                 err = 0;
-        }
-
-        if (!err && uru) {
-                /* kernel_waitid() overwrites everything in ru */
-                if (COMPAT_USE_64BIT_TIME)
-                        err = copy_to_user(uru, &ru, sizeof(ru));
-                else
-                        err = put_compat_rusage(&ru, uru);
-                if (err)
-                        return -EFAULT;
+                if (uru) {
+                        /* kernel_waitid() overwrites everything in ru */
+                        if (COMPAT_USE_64BIT_TIME)
+                                err = copy_to_user(uru, &ru, sizeof(ru));
+                        else
+                                err = put_compat_rusage(&ru, uru);
+                        if (err)
+                                return -EFAULT;
+                }
         }
 
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                return -EFAULT;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
diff --git a/kernel/extable.c b/kernel/extable.c
index 38c2412401a1..9aa1cc41ecf7 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -102,15 +102,7 @@ int core_kernel_data(unsigned long addr)
 
 int __kernel_text_address(unsigned long addr)
 {
-        if (core_kernel_text(addr))
-                return 1;
-        if (is_module_text_address(addr))
-                return 1;
-        if (is_ftrace_trampoline(addr))
-                return 1;
-        if (is_kprobe_optinsn_slot(addr) || is_kprobe_insn_slot(addr))
-                return 1;
-        if (is_bpf_text_address(addr))
+        if (kernel_text_address(addr))
                 return 1;
         /*
          * There might be init symbols in saved stacktraces.
@@ -127,17 +119,42 @@ int __kernel_text_address(unsigned long addr)
 
 int kernel_text_address(unsigned long addr)
 {
+        bool no_rcu;
+        int ret = 1;
+
         if (core_kernel_text(addr))
                 return 1;
+
+        /*
+         * If a stack dump happens while RCU is not watching, then
+         * RCU needs to be notified that it requires to start
+         * watching again. This can happen either by tracing that
+         * triggers a stack trace, or a WARN() that happens during
+         * coming back from idle, or cpu on or offlining.
+         *
+         * is_module_text_address() as well as the kprobe slots
+         * and is_bpf_text_address() require RCU to be watching.
+         */
+        no_rcu = !rcu_is_watching();
+
+        /* Treat this like an NMI as it can happen anywhere */
+        if (no_rcu)
+                rcu_nmi_enter();
+
         if (is_module_text_address(addr))
-                return 1;
+                goto out;
         if (is_ftrace_trampoline(addr))
-                return 1;
+                goto out;
         if (is_kprobe_optinsn_slot(addr) || is_kprobe_insn_slot(addr))
-                return 1;
+                goto out;
         if (is_bpf_text_address(addr))
-                return 1;
-        return 0;
+                goto out;
+        ret = 0;
+out:
+        if (no_rcu)
+                rcu_nmi_exit();
+
+        return ret;
 }
 
 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 10646182440f..07cc743698d3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -215,6 +215,10 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
                 if (!s)
                         continue;
 
+#ifdef CONFIG_DEBUG_KMEMLEAK
+                /* Clear stale pointers from reused stack. */
+                memset(s->addr, 0, THREAD_SIZE);
+#endif
                 tsk->stack_vm_area = s;
                 return s->addr;
         }
@@ -946,6 +950,24 @@ void mmput(struct mm_struct *mm)
 }
 EXPORT_SYMBOL_GPL(mmput);
 
+#ifdef CONFIG_MMU
+static void mmput_async_fn(struct work_struct *work)
+{
+        struct mm_struct *mm = container_of(work, struct mm_struct,
+                                            async_put_work);
+
+        __mmput(mm);
+}
+
+void mmput_async(struct mm_struct *mm)
+{
+        if (atomic_dec_and_test(&mm->mm_users)) {
+                INIT_WORK(&mm->async_put_work, mmput_async_fn);
+                schedule_work(&mm->async_put_work);
+        }
+}
+#endif
+
 /**
  * set_mm_exe_file - change a reference to the mm's executable file
  *
diff --git a/kernel/futex.c b/kernel/futex.c
index 3d38eaf05492..0518a0bfc746 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -821,8 +821,6 @@ static void get_pi_state(struct futex_pi_state *pi_state)
 /*
  * Drops a reference to the pi_state object and frees or caches it
  * when the last reference is gone.
- *
- * Must be called with the hb lock held.
  */
 static void put_pi_state(struct futex_pi_state *pi_state)
 {
@@ -837,16 +835,22 @@ static void put_pi_state(struct futex_pi_state *pi_state)
          * and has cleaned up the pi_state already
          */
         if (pi_state->owner) {
-                raw_spin_lock_irq(&pi_state->owner->pi_lock);
-                list_del_init(&pi_state->list);
-                raw_spin_unlock_irq(&pi_state->owner->pi_lock);
+                struct task_struct *owner;
 
-                rt_mutex_proxy_unlock(&pi_state->pi_mutex, pi_state->owner);
+                raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+                owner = pi_state->owner;
+                if (owner) {
+                        raw_spin_lock(&owner->pi_lock);
+                        list_del_init(&pi_state->list);
+                        raw_spin_unlock(&owner->pi_lock);
+                }
+                rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
+                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
         }
 
-        if (current->pi_state_cache)
+        if (current->pi_state_cache) {
                 kfree(pi_state);
-        else {
+        } else {
                 /*
                  * pi_state->list is already empty.
                  * clear pi_state->owner.
@@ -907,13 +911,14 @@ void exit_pi_state_list(struct task_struct *curr)
                 raw_spin_unlock_irq(&curr->pi_lock);
 
                 spin_lock(&hb->lock);
-
-                raw_spin_lock_irq(&curr->pi_lock);
+                raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+                raw_spin_lock(&curr->pi_lock);
                 /*
                  * We dropped the pi-lock, so re-check whether this
                  * task still owns the PI-state:
                  */
                 if (head->next != next) {
+                        raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
                         spin_unlock(&hb->lock);
                         continue;
                 }
@@ -922,9 +927,10 @@ void exit_pi_state_list(struct task_struct *curr)
                 WARN_ON(list_empty(&pi_state->list));
                 list_del_init(&pi_state->list);
                 pi_state->owner = NULL;
-                raw_spin_unlock_irq(&curr->pi_lock);
+                raw_spin_unlock(&curr->pi_lock);
 
                 get_pi_state(pi_state);
+                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
 
                 rt_mutex_futex_unlock(&pi_state->pi_mutex);
@@ -1208,6 +1214,10 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 
         WARN_ON(!list_empty(&pi_state->list));
         list_add(&pi_state->list, &p->pi_state_list);
+        /*
+         * Assignment without holding pi_state->pi_mutex.wait_lock is safe
+         * because there is no concurrency as the object is not published yet.
+         */
         pi_state->owner = p;
         raw_spin_unlock_irq(&p->pi_lock);
 
@@ -2878,6 +2888,7 @@ retry:
                 raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
 
+                /* drops pi_state->pi_mutex.wait_lock */
                 ret = wake_futex_pi(uaddr, uval, pi_state);
 
                 put_pi_state(pi_state);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 6fc89fd93824..5a2ef92c2782 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -265,8 +265,8 @@ int irq_startup(struct irq_desc *desc, bool resend, bool force)
                         irq_setup_affinity(desc);
                         break;
                 case IRQ_STARTUP_MANAGED:
+                        irq_do_set_affinity(d, aff, false);
                         ret = __irq_startup(desc);
-                        irq_set_affinity_locked(d, aff, false);
                         break;
                 case IRQ_STARTUP_ABORT:
                         return 0;
diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
index 638eb9c83d9f..9eb09aef0313 100644
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -18,8 +18,34 @@
 static inline bool irq_needs_fixup(struct irq_data *d)
 {
         const struct cpumask *m = irq_data_get_effective_affinity_mask(d);
+        unsigned int cpu = smp_processor_id();
 
-        return cpumask_test_cpu(smp_processor_id(), m);
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        /*
+         * The cpumask_empty() check is a workaround for interrupt chips,
+         * which do not implement effective affinity, but the architecture has
+         * enabled the config switch. Use the general affinity mask instead.
+         */
+        if (cpumask_empty(m))
+                m = irq_data_get_affinity_mask(d);
+
+        /*
+         * Sanity check. If the mask is not empty when excluding the outgoing
+         * CPU then it must contain at least one online CPU. The outgoing CPU
+         * has been removed from the online mask already.
+         */
+        if (cpumask_any_but(m, cpu) < nr_cpu_ids &&
+            cpumask_any_and(m, cpu_online_mask) >= nr_cpu_ids) {
+                /*
+                 * If this happens then there was a missed IRQ fixup at some
+                 * point. Warn about it and enforce fixup.
+                 */
+                pr_warn("Eff. affinity %*pbl of IRQ %u contains only offline CPUs after offlining CPU %u\n",
+                        cpumask_pr_args(m), d->irq, cpu);
+                return true;
+        }
+#endif
+        return cpumask_test_cpu(cpu, m);
 }
 
 static bool migrate_one_irq(struct irq_desc *desc)
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index f7086b78ad6e..c26c5bb6b491 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -135,17 +135,26 @@ void irq_gc_ack_clr_bit(struct irq_data *d)
 }
 
 /**
- * irq_gc_mask_disable_reg_and_ack - Mask and ack pending interrupt
+ * irq_gc_mask_disable_and_ack_set - Mask and ack pending interrupt
  * @d: irq_data
+ *
+ * This generic implementation of the irq_mask_ack method is for chips
+ * with separate enable/disable registers instead of a single mask
+ * register and where a pending interrupt is acknowledged by setting a
+ * bit.
+ *
+ * Note: This is the only permutation currently used.  Similar generic
+ * functions should be added here if other permutations are required.
  */
-void irq_gc_mask_disable_reg_and_ack(struct irq_data *d)
+void irq_gc_mask_disable_and_ack_set(struct irq_data *d)
 {
         struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
         struct irq_chip_type *ct = irq_data_get_chip_type(d);
         u32 mask = d->mask;
 
         irq_gc_lock(gc);
-        irq_reg_writel(gc, mask, ct->regs.mask);
+        irq_reg_writel(gc, mask, ct->regs.disable);
+        *ct->mask_cache &= ~mask;
         irq_reg_writel(gc, mask, ct->regs.ack);
         irq_gc_unlock(gc);
 }
@@ -322,7 +331,6 @@ int __irq_alloc_domain_generic_chips(struct irq_domain *d, int irqs_per_chip,
                 /* Calc pointer to the next generic chip */
                 tmp += sizeof(*gc) + num_ct * sizeof(struct irq_chip_type);
         }
-        d->name = name;
         return 0;
 }
 EXPORT_SYMBOL_GPL(__irq_alloc_domain_generic_chips);
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e84b7056bb08..ac4644e92b49 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -945,7 +945,7 @@ static int virq_debug_show(struct seq_file *m, void *private)
         struct irq_desc *desc;
         struct irq_domain *domain;
         struct radix_tree_iter iter;
-        void **slot;
+        void __rcu **slot;
         int i;
 
         seq_printf(m, " %-16s  %-6s  %-10s  %-10s  %s\n",
@@ -1453,7 +1453,7 @@ out_free_desc:
 /* The irq_data was moved, fix the revmap to refer to the new location */
 static void irq_domain_fix_revmap(struct irq_data *d)
 {
-        void **slot;
+        void __rcu **slot;
 
         if (d->hwirq < d->domain->revmap_size)
                 return; /* Not using radix tree. */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 573dc52b0806..4bff6a10ae8e 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -168,6 +168,19 @@ void irq_set_thread_affinity(struct irq_desc *desc)
                         set_bit(IRQTF_AFFINITY, &action->thread_flags);
 }
 
+static void irq_validate_effective_affinity(struct irq_data *data)
+{
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        const struct cpumask *m = irq_data_get_effective_affinity_mask(data);
+        struct irq_chip *chip = irq_data_get_irq_chip(data);
+
+        if (!cpumask_empty(m))
+                return;
+        pr_warn_once("irq_chip %s did not update eff. affinity mask of irq %u\n",
+                     chip->name, data->irq);
+#endif
+}
+
 int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
                         bool force)
 {
@@ -175,12 +188,16 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
         struct irq_chip *chip = irq_data_get_irq_chip(data);
         int ret;
 
+        if (!chip || !chip->irq_set_affinity)
+                return -EINVAL;
+
         ret = chip->irq_set_affinity(data, mask, force);
         switch (ret) {
         case IRQ_SET_MASK_OK:
         case IRQ_SET_MASK_OK_DONE:
                 cpumask_copy(desc->irq_common_data.affinity, mask);
         case IRQ_SET_MASK_OK_NOCOPY:
+                irq_validate_effective_affinity(data);
                 irq_set_thread_affinity(desc);
                 ret = 0;
         }
@@ -1643,6 +1660,10 @@ const void *free_irq(unsigned int irq, void *dev_id)
 #endif
 
         action = __free_irq(irq, dev_id);
+
+        if (!action)
+                return NULL;
+
         devname = action->name;
         kfree(action);
         return devname;
diff --git a/kernel/kcmp.c b/kernel/kcmp.c
index ea34ed8bb952..055bb2962a0b 100644
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -131,7 +131,7 @@ static int kcmp_epoll_target(struct task_struct *task1,
         if (filp_epoll) {
                 filp_tgt = get_epoll_tfile_raw_ptr(filp_epoll, slot.tfd, slot.toff);
                 fput(filp_epoll);
-        } else
+        }
 
         if (IS_ERR(filp_tgt))
                 return PTR_ERR(filp_tgt);
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index b9628e43c78f..bf8c8fd72589 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -830,6 +830,41 @@ int klp_register_patch(struct klp_patch *patch)
 }
 EXPORT_SYMBOL_GPL(klp_register_patch);
 
+/*
+ * Remove parts of patches that touch a given kernel module. The list of
+ * patches processed might be limited. When limit is NULL, all patches
+ * will be handled.
+ */
+static void klp_cleanup_module_patches_limited(struct module *mod,
+                                               struct klp_patch *limit)
+{
+        struct klp_patch *patch;
+        struct klp_object *obj;
+
+        list_for_each_entry(patch, &klp_patches, list) {
+                if (patch == limit)
+                        break;
+
+                klp_for_each_object(patch, obj) {
+                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
+                                continue;
+
+                        /*
+                         * Only unpatch the module if the patch is enabled or
+                         * is in transition.
+                         */
+                        if (patch->enabled || patch == klp_transition_patch) {
+                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
+                                          patch->mod->name, obj->mod->name);
+                                klp_unpatch_object(obj);
+                        }
+
+                        klp_free_object_loaded(obj);
+                        break;
+                }
+        }
+}
+
 int klp_module_coming(struct module *mod)
 {
         int ret;
@@ -894,7 +929,7 @@ err:
         pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
                 patch->mod->name, obj->mod->name, obj->mod->name);
         mod->klp_alive = false;
-        klp_free_object_loaded(obj);
+        klp_cleanup_module_patches_limited(mod, patch);
         mutex_unlock(&klp_mutex);
 
         return ret;
@@ -902,9 +937,6 @@ err:
 
 void klp_module_going(struct module *mod)
 {
-        struct klp_patch *patch;
-        struct klp_object *obj;
-
         if (WARN_ON(mod->state != MODULE_STATE_GOING &&
                     mod->state != MODULE_STATE_COMING))
                 return;
@@ -917,25 +949,7 @@ void klp_module_going(struct module *mod)
          */
         mod->klp_alive = false;
 
-        list_for_each_entry(patch, &klp_patches, list) {
-                klp_for_each_object(patch, obj) {
-                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
-                                continue;
-
-                        /*
-                         * Only unpatch the module if the patch is enabled or
-                         * is in transition.
-                         */
-                        if (patch->enabled || patch == klp_transition_patch) {
-                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
-                                          patch->mod->name, obj->mod->name);
-                                klp_unpatch_object(obj);
-                        }
-
-                        klp_free_object_loaded(obj);
-                        break;
-                }
-        }
+        klp_cleanup_module_patches_limited(mod, NULL);
 
         mutex_unlock(&klp_mutex);
 }
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 44c8d0d17170..e36e652d996f 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -1873,10 +1873,10 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                struct held_lock *next, int distance, struct stack_trace *trace,
                int (*save)(struct stack_trace *trace))
 {
+        struct lock_list *uninitialized_var(target_entry);
         struct lock_list *entry;
-        int ret;
         struct lock_list this;
-        struct lock_list *uninitialized_var(target_entry);
+        int ret;
 
         /*
          * Prove that the new <prev> -> <next> dependency would not
@@ -1890,8 +1890,17 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
         this.class = hlock_class(next);
         this.parent = NULL;
         ret = check_noncircular(&this, hlock_class(prev), &target_entry);
-        if (unlikely(!ret))
+        if (unlikely(!ret)) {
+                if (!trace->entries) {
+                        /*
+                         * If @save fails here, the printing might trigger
+                         * a WARN but because of the !nr_entries it should
+                         * not do bad things.
+                         */
+                        save(trace);
+                }
                 return print_circular_bug(&this, target_entry, next, prev, trace);
+        }
         else if (unlikely(ret < 0))
                 return print_bfs_bug(ret);
 
@@ -1938,7 +1947,7 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                 return print_bfs_bug(ret);
 
 
-        if (save && !save(trace))
+        if (!trace->entries && !save(trace))
                 return 0;
 
         /*
@@ -1958,20 +1967,6 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
         if (!ret)
                 return 0;
 
-        /*
-         * Debugging printouts:
-         */
-        if (verbose(hlock_class(prev)) || verbose(hlock_class(next))) {
-                graph_unlock();
-                printk("\n new dependency: ");
-                print_lock_name(hlock_class(prev));
-                printk(KERN_CONT " => ");
-                print_lock_name(hlock_class(next));
-                printk(KERN_CONT "\n");
-                dump_stack();
-                if (!graph_lock())
-                        return 0;
-        }
         return 2;
 }
 
@@ -1986,8 +1981,12 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
 {
         int depth = curr->lockdep_depth;
         struct held_lock *hlock;
-        struct stack_trace trace;
-        int (*save)(struct stack_trace *trace) = save_trace;
+        struct stack_trace trace = {
+                .nr_entries = 0,
+                .max_entries = 0,
+                .entries = NULL,
+                .skip = 0,
+        };
 
         /*
          * Debugging checks.
@@ -2018,18 +2017,11 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
                          */
                         if (hlock->read != 2 && hlock->check) {
                                 int ret = check_prev_add(curr, hlock, next,
-                                                         distance, &trace, save);
+                                                         distance, &trace, save_trace);
                                 if (!ret)
                                         return 0;
 
                                 /*
-                                 * Stop saving stack_trace if save_trace() was
-                                 * called at least once:
-                                 */
-                                if (save && ret == 2)
-                                        save = NULL;
-
-                                /*
                                  * Stop after the first non-trylock entry,
                                  * as non-trylock entries have added their
                                  * own direct dependencies already, so this
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 02f660666ab8..1fefe6dcafd7 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -613,6 +613,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem)
         DEFINE_WAKE_Q(wake_q);
 
         /*
+        * __rwsem_down_write_failed_common(sem)
+        *   rwsem_optimistic_spin(sem)
+        *     osq_unlock(sem->osq)
+        *   ...
+        *   atomic_long_add_return(&sem->count)
+        *
+        *      - VS -
+        *
+        *              __up_write()
+        *                if (atomic_long_sub_return_release(&sem->count) < 0)
+        *                  rwsem_wake(sem)
+        *                    osq_is_locked(&sem->osq)
+        *
+        * And __up_write() must observe !osq_is_locked() when it observes the
+        * atomic_long_add_return() in order to not miss a wakeup.
+        *
+        * This boils down to:
+        *
+        * [S.rel] X = 1                [RmW] r0 = (Y += 0)
+        *         MB                         RMB
+        * [RmW]   Y += 1               [L]   r1 = X
+        *
+        * exists (r0=1 /\ r1=0)
+        */
+        smp_rmb();
+
+        /*
          * If a spinner is present, it is not necessary to do the wakeup.
          * Try to do wakeup only if the trylock succeeds to minimize
          * spinlock contention which may introduce too much delay in the
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 6bcbfbf1a8fd..403ab9cdb949 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -350,7 +350,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         pgprot_t pgprot = PAGE_KERNEL;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
-        int error, nid, is_ram;
+        int error, nid, is_ram, i = 0;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
@@ -448,6 +448,8 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
                 list_del(&page->lru);
                 page->pgmap = pgmap;
                 percpu_ref_get(ref);
+                if (!(++i % 1024))
+                        cond_resched();
         }
         devres_add(dev, page_map);
         return __va(res->start);
diff --git a/kernel/params.c b/kernel/params.c
index 60b2d8101355..cc9108c2a1fd 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -224,7 +224,7 @@ char *parse_args(const char *doing,
         }                                                               \
         int param_get_##name(char *buffer, const struct kernel_param *kp) \
         {                                                               \
-                return scnprintf(buffer, PAGE_SIZE, format,             \
+                return scnprintf(buffer, PAGE_SIZE, format "\n",        \
                                 *((type *)kp->arg));                    \
         }                                                               \
         const struct kernel_param_ops param_ops_##name = {                      \
@@ -236,14 +236,14 @@ char *parse_args(const char *doing,
         EXPORT_SYMBOL(param_ops_##name)
 
 
-STANDARD_PARAM_DEF(byte, unsigned char, "%hhu", kstrtou8);
-STANDARD_PARAM_DEF(short, short, "%hi", kstrtos16);
-STANDARD_PARAM_DEF(ushort, unsigned short, "%hu", kstrtou16);
-STANDARD_PARAM_DEF(int, int, "%i", kstrtoint);
-STANDARD_PARAM_DEF(uint, unsigned int, "%u", kstrtouint);
-STANDARD_PARAM_DEF(long, long, "%li", kstrtol);
-STANDARD_PARAM_DEF(ulong, unsigned long, "%lu", kstrtoul);
-STANDARD_PARAM_DEF(ullong, unsigned long long, "%llu", kstrtoull);
+STANDARD_PARAM_DEF(byte,        unsigned char,          "%hhu", kstrtou8);
+STANDARD_PARAM_DEF(short,       short,                  "%hi",  kstrtos16);
+STANDARD_PARAM_DEF(ushort,      unsigned short,         "%hu",  kstrtou16);
+STANDARD_PARAM_DEF(int,         int,                    "%i",   kstrtoint);
+STANDARD_PARAM_DEF(uint,        unsigned int,           "%u",   kstrtouint);
+STANDARD_PARAM_DEF(long,        long,                   "%li",  kstrtol);
+STANDARD_PARAM_DEF(ulong,       unsigned long,          "%lu",  kstrtoul);
+STANDARD_PARAM_DEF(ullong,      unsigned long long,     "%llu", kstrtoull);
 
 int param_set_charp(const char *val, const struct kernel_param *kp)
 {
@@ -270,7 +270,7 @@ EXPORT_SYMBOL(param_set_charp);
 
 int param_get_charp(char *buffer, const struct kernel_param *kp)
 {
-        return scnprintf(buffer, PAGE_SIZE, "%s", *((char **)kp->arg));
+        return scnprintf(buffer, PAGE_SIZE, "%s\n", *((char **)kp->arg));
 }
 EXPORT_SYMBOL(param_get_charp);
 
@@ -301,7 +301,7 @@ EXPORT_SYMBOL(param_set_bool);
 int param_get_bool(char *buffer, const struct kernel_param *kp)
 {
         /* Y and N chosen as being relatively non-coder friendly */
-        return sprintf(buffer, "%c", *(bool *)kp->arg ? 'Y' : 'N');
+        return sprintf(buffer, "%c\n", *(bool *)kp->arg ? 'Y' : 'N');
 }
 EXPORT_SYMBOL(param_get_bool);
 
@@ -360,7 +360,7 @@ EXPORT_SYMBOL(param_set_invbool);
 
 int param_get_invbool(char *buffer, const struct kernel_param *kp)
 {
-        return sprintf(buffer, "%c", (*(bool *)kp->arg) ? 'N' : 'Y');
+        return sprintf(buffer, "%c\n", (*(bool *)kp->arg) ? 'N' : 'Y');
 }
 EXPORT_SYMBOL(param_get_invbool);
 
@@ -460,8 +460,9 @@ static int param_array_get(char *buffer, const struct kernel_param *kp)
         struct kernel_param p = *kp;
 
         for (i = off = 0; i < (arr->num ? *arr->num : arr->max); i++) {
+                /* Replace \n with comma */
                 if (i)
-                        buffer[off++] = ',';
+                        buffer[off - 1] = ',';
                 p.arg = arr->elem + arr->elemsize * i;
                 check_kparam_locked(p.mod);
                 ret = arr->ops->get(buffer + off, &p);
@@ -507,7 +508,7 @@ EXPORT_SYMBOL(param_set_copystring);
 int param_get_string(char *buffer, const struct kernel_param *kp)
 {
         const struct kparam_string *kps = kp->str;
-        return strlcpy(buffer, kps->string, kps->maxlen);
+        return scnprintf(buffer, PAGE_SIZE, "%s\n", kps->string);
 }
 EXPORT_SYMBOL(param_get_string);
 
@@ -549,10 +550,6 @@ static ssize_t param_attr_show(struct module_attribute *mattr,
         kernel_param_lock(mk->mod);
         count = attribute->param->ops->get(buf, attribute->param);
         kernel_param_unlock(mk->mod);
-        if (count > 0) {
-                strcat(buf, "\n");
-                ++count;
-        }
         return count;
 }
 
@@ -600,7 +597,7 @@ EXPORT_SYMBOL(kernel_param_unlock);
 /*
  * add_sysfs_param - add a parameter to sysfs
  * @mk: struct module_kobject
- * @kparam: the actual parameter definition to add to sysfs
+ * @kp: the actual parameter definition to add to sysfs
  * @name: name of parameter
  *
  * Create a kobject if for a (per-module) parameter if mp NULL, and
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 3e2b4f519009..ccd2d20e6b06 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -120,22 +120,26 @@ static void s2idle_loop(void)
                  * frozen processes + suspended devices + idle processors.
                  * Thus s2idle_enter() should be called right after
                  * all devices have been suspended.
+                 *
+                 * Wakeups during the noirq suspend of devices may be spurious,
+                 * so prevent them from terminating the loop right away.
                  */
                 error = dpm_noirq_suspend_devices(PMSG_SUSPEND);
                 if (!error)
                         s2idle_enter();
+                else if (error == -EBUSY && pm_wakeup_pending())
+                        error = 0;
 
-                dpm_noirq_resume_devices(PMSG_RESUME);
-                if (error && (error != -EBUSY || !pm_wakeup_pending())) {
-                        dpm_noirq_end();
-                        break;
-                }
-
-                if (s2idle_ops && s2idle_ops->wake)
+                if (!error && s2idle_ops && s2idle_ops->wake)
                         s2idle_ops->wake();
 
+                dpm_noirq_resume_devices(PMSG_RESUME);
+
                 dpm_noirq_end();
 
+                if (error)
+                        break;
+
                 if (s2idle_ops && s2idle_ops->sync)
                         s2idle_ops->sync();
 
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 729a8706751d..6d5880089ff6 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -854,7 +854,7 @@ void __call_srcu(struct srcu_struct *sp, struct rcu_head *rhp,
 /**
  * call_srcu() - Queue a callback for invocation after an SRCU grace period
  * @sp: srcu_struct in queue the callback
- * @head: structure to be used for queueing the SRCU callback.
+ * @rhp: structure to be used for queueing the SRCU callback.
  * @func: function to be invoked after the SRCU grace period
  *
  * The callback function will be invoked some time after a full SRCU
diff --git a/kernel/rcu/sync.c b/kernel/rcu/sync.c
index 50d1861f7759..3f943efcf61c 100644
--- a/kernel/rcu/sync.c
+++ b/kernel/rcu/sync.c
@@ -85,6 +85,9 @@ void rcu_sync_init(struct rcu_sync *rsp, enum rcu_sync_type type)
 }
 
 /**
+ * rcu_sync_enter_start - Force readers onto slow path for multiple updates
+ * @rsp: Pointer to rcu_sync structure to use for synchronization
+ *
  * Must be called after rcu_sync_init() and before first use.
  *
  * Ensures rcu_sync_is_idle() returns false and rcu_sync_{enter,exit}()
@@ -142,7 +145,7 @@ void rcu_sync_enter(struct rcu_sync *rsp)
 
 /**
  * rcu_sync_func() - Callback function managing reader access to fastpath
- * @rsp: Pointer to rcu_sync structure to use for synchronization
+ * @rhp: Pointer to rcu_head in rcu_sync structure to use for synchronization
  *
  * This function is passed to one of the call_rcu() functions by
  * rcu_sync_exit(), so that it is invoked after a grace period following the
@@ -158,9 +161,9 @@ void rcu_sync_enter(struct rcu_sync *rsp)
  * rcu_sync_exit().  Otherwise, set all state back to idle so that readers
  * can again use their fastpaths.
  */
-static void rcu_sync_func(struct rcu_head *rcu)
+static void rcu_sync_func(struct rcu_head *rhp)
 {
-        struct rcu_sync *rsp = container_of(rcu, struct rcu_sync, cb_head);
+        struct rcu_sync *rsp = container_of(rhp, struct rcu_sync, cb_head);
         unsigned long flags;
 
         BUG_ON(rsp->gp_state != GP_PASSED);
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 1250e4bd4b85..3e3650e94ae6 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -882,6 +882,11 @@ void rcu_irq_exit(void)
 
         RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_exit() invoked with irqs enabled!!!");
         rdtp = this_cpu_ptr(&rcu_dynticks);
+
+        /* Page faults can happen in NMI handlers, so check... */
+        if (rdtp->dynticks_nmi_nesting)
+                return;
+
         WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
                      rdtp->dynticks_nesting < 1);
         if (rdtp->dynticks_nesting <= 1) {
@@ -1015,6 +1020,11 @@ void rcu_irq_enter(void)
 
         RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_enter() invoked with irqs enabled!!!");
         rdtp = this_cpu_ptr(&rcu_dynticks);
+
+        /* Page faults can happen in NMI handlers, so check... */
+        if (rdtp->dynticks_nmi_nesting)
+                return;
+
         oldval = rdtp->dynticks_nesting;
         rdtp->dynticks_nesting++;
         WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
@@ -3087,9 +3097,10 @@ __call_rcu(struct rcu_head *head, rcu_callback_t func,
  * read-side critical sections have completed. call_rcu_sched() assumes
  * that the read-side critical sections end on enabling of preemption
  * or on voluntary preemption.
- * RCU read-side critical sections are delimited by :
- *  - rcu_read_lock_sched() and rcu_read_unlock_sched(), OR
- *  - anything that disables preemption.
+ * RCU read-side critical sections are delimited by:
+ *
+ * - rcu_read_lock_sched() and rcu_read_unlock_sched(), OR
+ * - anything that disables preemption.
  *
  *  These may be nested.
  *
@@ -3114,11 +3125,12 @@ EXPORT_SYMBOL_GPL(call_rcu_sched);
  * handler. This means that read-side critical sections in process
  * context must not be interrupted by softirqs. This interface is to be
  * used when most of the read-side critical sections are in softirq context.
- * RCU read-side critical sections are delimited by :
- *  - rcu_read_lock() and  rcu_read_unlock(), if in interrupt context.
- *  OR
- *  - rcu_read_lock_bh() and rcu_read_unlock_bh(), if in process context.
- *  These may be nested.
+ * RCU read-side critical sections are delimited by:
+ *
+ * - rcu_read_lock() and  rcu_read_unlock(), if in interrupt context, OR
+ * - rcu_read_lock_bh() and rcu_read_unlock_bh(), if in process context.
+ *
+ * These may be nested.
  *
  * See the description of call_rcu() for more detailed information on
  * memory ordering guarantees.
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 18a6966567da..d17c5da523a0 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5166,6 +5166,28 @@ void sched_show_task(struct task_struct *p)
         put_task_stack(p);
 }
 
+static inline bool
+state_filter_match(unsigned long state_filter, struct task_struct *p)
+{
+        /* no filter, everything matches */
+        if (!state_filter)
+                return true;
+
+        /* filter, but doesn't match */
+        if (!(p->state & state_filter))
+                return false;
+
+        /*
+         * When looking for TASK_UNINTERRUPTIBLE skip TASK_IDLE (allows
+         * TASK_KILLABLE).
+         */
+        if (state_filter == TASK_UNINTERRUPTIBLE && p->state == TASK_IDLE)
+                return false;
+
+        return true;
+}
+
+
 void show_state_filter(unsigned long state_filter)
 {
         struct task_struct *g, *p;
@@ -5188,7 +5210,7 @@ void show_state_filter(unsigned long state_filter)
                  */
                 touch_nmi_watchdog();
                 touch_all_softlockup_watchdogs();
-                if (!state_filter || (p->state & state_filter))
+                if (state_filter_match(state_filter, p))
                         sched_show_task(p);
         }
 
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 01217fb5a5de..2f93e4a2d9f6 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -466,8 +466,6 @@ static char *task_group_path(struct task_group *tg)
 }
 #endif
 
-static const char stat_nam[] = TASK_STATE_TO_CHAR_STR;
-
 static void
 print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
 {
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 70ba32e08a23..d3f3094856fe 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5356,91 +5356,62 @@ static int wake_wide(struct task_struct *p)
         return 1;
 }
 
-struct llc_stats {
-        unsigned long   nr_running;
-        unsigned long   load;
-        unsigned long   capacity;
-        int             has_capacity;
-};
+/*
+ * The purpose of wake_affine() is to quickly determine on which CPU we can run
+ * soonest. For the purpose of speed we only consider the waking and previous
+ * CPU.
+ *
+ * wake_affine_idle() - only considers 'now', it check if the waking CPU is (or
+ *                      will be) idle.
+ *
+ * wake_affine_weight() - considers the weight to reflect the average
+ *                        scheduling latency of the CPUs. This seems to work
+ *                        for the overloaded case.
+ */
 
-static bool get_llc_stats(struct llc_stats *stats, int cpu)
+static bool
+wake_affine_idle(struct sched_domain *sd, struct task_struct *p,
+                 int this_cpu, int prev_cpu, int sync)
 {
-        struct sched_domain_shared *sds = rcu_dereference(per_cpu(sd_llc_shared, cpu));
-
-        if (!sds)
-                return false;
+        if (idle_cpu(this_cpu))
+                return true;
 
-        stats->nr_running       = READ_ONCE(sds->nr_running);
-        stats->load             = READ_ONCE(sds->load);
-        stats->capacity         = READ_ONCE(sds->capacity);
-        stats->has_capacity     = stats->nr_running < per_cpu(sd_llc_size, cpu);
+        if (sync && cpu_rq(this_cpu)->nr_running == 1)
+                return true;
 
-        return true;
+        return false;
 }
 
-/*
- * Can a task be moved from prev_cpu to this_cpu without causing a load
- * imbalance that would trigger the load balancer?
- *
- * Since we're running on 'stale' values, we might in fact create an imbalance
- * but recomputing these values is expensive, as that'd mean iteration 2 cache
- * domains worth of CPUs.
- */
 static bool
-wake_affine_llc(struct sched_domain *sd, struct task_struct *p,
-                int this_cpu, int prev_cpu, int sync)
+wake_affine_weight(struct sched_domain *sd, struct task_struct *p,
+                   int this_cpu, int prev_cpu, int sync)
 {
-        struct llc_stats prev_stats, this_stats;
         s64 this_eff_load, prev_eff_load;
         unsigned long task_load;
 
-        if (!get_llc_stats(&prev_stats, prev_cpu) ||
-            !get_llc_stats(&this_stats, this_cpu))
-                return false;
+        this_eff_load = target_load(this_cpu, sd->wake_idx);
+        prev_eff_load = source_load(prev_cpu, sd->wake_idx);
 
-        /*
-         * If sync wakeup then subtract the (maximum possible)
-         * effect of the currently running task from the load
-         * of the current LLC.
-         */
         if (sync) {
                 unsigned long current_load = task_h_load(current);
 
-                /* in this case load hits 0 and this LLC is considered 'idle' */
-                if (current_load > this_stats.load)
+                if (current_load > this_eff_load)
                         return true;
 
-                this_stats.load -= current_load;
+                this_eff_load -= current_load;
         }
 
-        /*
-         * The has_capacity stuff is not SMT aware, but by trying to balance
-         * the nr_running on both ends we try and fill the domain at equal
-         * rates, thereby first consuming cores before siblings.
-         */
-
-        /* if the old cache has capacity, stay there */
-        if (prev_stats.has_capacity && prev_stats.nr_running < this_stats.nr_running+1)
-                return false;
-
-        /* if this cache has capacity, come here */
-        if (this_stats.has_capacity && this_stats.nr_running+1 < prev_stats.nr_running)
-                return true;
-
-        /*
-         * Check to see if we can move the load without causing too much
-         * imbalance.
-         */
         task_load = task_h_load(p);
 
-        this_eff_load = 100;
-        this_eff_load *= prev_stats.capacity;
-
-        prev_eff_load = 100 + (sd->imbalance_pct - 100) / 2;
-        prev_eff_load *= this_stats.capacity;
+        this_eff_load += task_load;
+        if (sched_feat(WA_BIAS))
+                this_eff_load *= 100;
+        this_eff_load *= capacity_of(prev_cpu);
 
-        this_eff_load *= this_stats.load + task_load;
-        prev_eff_load *= prev_stats.load - task_load;
+        prev_eff_load -= task_load;
+        if (sched_feat(WA_BIAS))
+                prev_eff_load *= 100 + (sd->imbalance_pct - 100) / 2;
+        prev_eff_load *= capacity_of(this_cpu);
 
         return this_eff_load <= prev_eff_load;
 }
@@ -5449,22 +5420,13 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
                        int prev_cpu, int sync)
 {
         int this_cpu = smp_processor_id();
-        bool affine;
+        bool affine = false;
 
-        /*
-         * Default to no affine wakeups; wake_affine() should not effect a task
-         * placement the load-balancer feels inclined to undo. The conservative
-         * option is therefore to not move tasks when they wake up.
-         */
-        affine = false;
+        if (sched_feat(WA_IDLE) && !affine)
+                affine = wake_affine_idle(sd, p, this_cpu, prev_cpu, sync);
 
-        /*
-         * If the wakeup is across cache domains, try to evaluate if movement
-         * makes sense, otherwise rely on select_idle_siblings() to do
-         * placement inside the cache domain.
-         */
-        if (!cpus_share_cache(prev_cpu, this_cpu))
-                affine = wake_affine_llc(sd, p, this_cpu, prev_cpu, sync);
+        if (sched_feat(WA_WEIGHT) && !affine)
+                affine = wake_affine_weight(sd, p, this_cpu, prev_cpu, sync);
 
         schedstat_inc(p->se.statistics.nr_wakeups_affine_attempts);
         if (affine) {
@@ -7600,7 +7562,6 @@ static inline enum fbq_type fbq_classify_rq(struct rq *rq)
  */
 static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sds)
 {
-        struct sched_domain_shared *shared = env->sd->shared;
         struct sched_domain *child = env->sd->child;
         struct sched_group *sg = env->sd->groups;
         struct sg_lb_stats *local = &sds->local_stat;
@@ -7672,22 +7633,6 @@ next_group:
                 if (env->dst_rq->rd->overload != overload)
                         env->dst_rq->rd->overload = overload;
         }
-
-        if (!shared)
-                return;
-
-        /*
-         * Since these are sums over groups they can contain some CPUs
-         * multiple times for the NUMA domains.
-         *
-         * Currently only wake_affine_llc() and find_busiest_group()
-         * uses these numbers, only the last is affected by this problem.
-         *
-         * XXX fix that.
-         */
-        WRITE_ONCE(shared->nr_running,  sds->total_running);
-        WRITE_ONCE(shared->load,        sds->total_load);
-        WRITE_ONCE(shared->capacity,    sds->total_capacity);
 }
 
 /**
@@ -8098,6 +8043,13 @@ static int should_we_balance(struct lb_env *env)
         int cpu, balance_cpu = -1;
 
         /*
+         * Ensure the balancing environment is consistent; can happen
+         * when the softirq triggers 'during' hotplug.
+         */
+        if (!cpumask_test_cpu(env->dst_cpu, env->cpus))
+                return 0;
+
+        /*
          * In the newly idle case, we will allow all the cpu's
          * to do the newly idle load balance.
          */
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index d3fb15555291..319ed0e8a347 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -81,3 +81,6 @@ SCHED_FEAT(RT_RUNTIME_SHARE, true)
 SCHED_FEAT(LB_MIN, false)
 SCHED_FEAT(ATTACH_AGE_LOAD, true)
 
+SCHED_FEAT(WA_IDLE, true)
+SCHED_FEAT(WA_WEIGHT, true)
+SCHED_FEAT(WA_BIAS, true)
diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index a92fddc22747..dd7908743dab 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -18,6 +18,7 @@
 #include <linux/membarrier.h>
 #include <linux/tick.h>
 #include <linux/cpumask.h>
+#include <linux/atomic.h>
 
 #include "sched.h"      /* for cpu_rq(). */
 
@@ -26,21 +27,26 @@
  * except MEMBARRIER_CMD_QUERY.
  */
 #define MEMBARRIER_CMD_BITMASK  \
-        (MEMBARRIER_CMD_SHARED | MEMBARRIER_CMD_PRIVATE_EXPEDITED)
+        (MEMBARRIER_CMD_SHARED | MEMBARRIER_CMD_PRIVATE_EXPEDITED       \
+        | MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED)
 
 static void ipi_mb(void *info)
 {
         smp_mb();       /* IPIs should be serializing but paranoid. */
 }
 
-static void membarrier_private_expedited(void)
+static int membarrier_private_expedited(void)
 {
         int cpu;
         bool fallback = false;
         cpumask_var_t tmpmask;
 
+        if (!(atomic_read(&current->mm->membarrier_state)
+                        & MEMBARRIER_STATE_PRIVATE_EXPEDITED_READY))
+                return -EPERM;
+
         if (num_online_cpus() == 1)
-                return;
+                return 0;
 
         /*
          * Matches memory barriers around rq->curr modification in
@@ -94,6 +100,24 @@ static void membarrier_private_expedited(void)
          * rq->curr modification in scheduler.
          */
         smp_mb();       /* exit from system call is not a mb */
+        return 0;
+}
+
+static void membarrier_register_private_expedited(void)
+{
+        struct task_struct *p = current;
+        struct mm_struct *mm = p->mm;
+
+        /*
+         * We need to consider threads belonging to different thread
+         * groups, which use the same mm. (CLONE_VM but not
+         * CLONE_THREAD).
+         */
+        if (atomic_read(&mm->membarrier_state)
+                        & MEMBARRIER_STATE_PRIVATE_EXPEDITED_READY)
+                return;
+        atomic_or(MEMBARRIER_STATE_PRIVATE_EXPEDITED_READY,
+                        &mm->membarrier_state);
 }
 
 /**
@@ -144,7 +168,9 @@ SYSCALL_DEFINE2(membarrier, int, cmd, int, flags)
                         synchronize_sched();
                 return 0;
         case MEMBARRIER_CMD_PRIVATE_EXPEDITED:
-                membarrier_private_expedited();
+                return membarrier_private_expedited();
+        case MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED:
+                membarrier_register_private_expedited();
                 return 0;
         default:
                 return -EINVAL;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index c24579dfa7a1..0ae832e13b97 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -473,14 +473,19 @@ static long seccomp_attach_filter(unsigned int flags,
         return 0;
 }
 
+static void __get_seccomp_filter(struct seccomp_filter *filter)
+{
+        /* Reference count is bounded by the number of total processes. */
+        refcount_inc(&filter->usage);
+}
+
 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
 void get_seccomp_filter(struct task_struct *tsk)
 {
         struct seccomp_filter *orig = tsk->seccomp.filter;
         if (!orig)
                 return;
-        /* Reference count is bounded by the number of total processes. */
-        refcount_inc(&orig->usage);
+        __get_seccomp_filter(orig);
 }
 
 static inline void seccomp_filter_free(struct seccomp_filter *filter)
@@ -491,10 +496,8 @@ static inline void seccomp_filter_free(struct seccomp_filter *filter)
         }
 }
 
-/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
-void put_seccomp_filter(struct task_struct *tsk)
+static void __put_seccomp_filter(struct seccomp_filter *orig)
 {
-        struct seccomp_filter *orig = tsk->seccomp.filter;
         /* Clean up single-reference branches iteratively. */
         while (orig && refcount_dec_and_test(&orig->usage)) {
                 struct seccomp_filter *freeme = orig;
@@ -503,6 +506,12 @@ void put_seccomp_filter(struct task_struct *tsk)
         }
 }
 
+/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
+void put_seccomp_filter(struct task_struct *tsk)
+{
+        __put_seccomp_filter(tsk->seccomp.filter);
+}
+
 static void seccomp_init_siginfo(siginfo_t *info, int syscall, int reason)
 {
         memset(info, 0, sizeof(*info));
@@ -1025,13 +1034,13 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
         if (!data)
                 goto out;
 
-        get_seccomp_filter(task);
+        __get_seccomp_filter(filter);
         spin_unlock_irq(&task->sighand->siglock);
 
         if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
                 ret = -EFAULT;
 
-        put_seccomp_filter(task);
+        __put_seccomp_filter(filter);
         return ret;
 
 out:
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 1d71c051a951..5043e7433f4b 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -344,39 +344,30 @@ EXPORT_SYMBOL_GPL(smpboot_unregister_percpu_thread);
  * by the client, but only by calling this function.
  * This function can only be called on a registered smp_hotplug_thread.
  */
-int smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                         const struct cpumask *new)
+void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
+                                          const struct cpumask *new)
 {
         struct cpumask *old = plug_thread->cpumask;
-        cpumask_var_t tmp;
+        static struct cpumask tmp;
         unsigned int cpu;
 
-        if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
-                return -ENOMEM;
-
-        get_online_cpus();
+        lockdep_assert_cpus_held();
         mutex_lock(&smpboot_threads_lock);
 
         /* Park threads that were exclusively enabled on the old mask. */
-        cpumask_andnot(tmp, old, new);
-        for_each_cpu_and(cpu, tmp, cpu_online_mask)
+        cpumask_andnot(&tmp, old, new);
+        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
                 smpboot_park_thread(plug_thread, cpu);
 
         /* Unpark threads that are exclusively enabled on the new mask. */
-        cpumask_andnot(tmp, new, old);
-        for_each_cpu_and(cpu, tmp, cpu_online_mask)
+        cpumask_andnot(&tmp, new, old);
+        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
                 smpboot_unpark_thread(plug_thread, cpu);
 
         cpumask_copy(old, new);
 
         mutex_unlock(&smpboot_threads_lock);
-        put_online_cpus();
-
-        free_cpumask_var(tmp);
-
-        return 0;
 }
-EXPORT_SYMBOL_GPL(smpboot_update_cpumask_percpu_thread);
 
 static DEFINE_PER_CPU(atomic_t, cpu_hotplug_state) = ATOMIC_INIT(CPU_POST_DEAD);
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6648fbbb8157..d9c31bc2eaea 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -367,7 +367,8 @@ static struct ctl_table kern_table[] = {
                 .data           = &sysctl_sched_time_avg,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
 #ifdef CONFIG_SCHEDSTATS
         {
@@ -871,9 +872,9 @@ static struct ctl_table kern_table[] = {
 #if defined(CONFIG_LOCKUP_DETECTOR)
         {
                 .procname       = "watchdog",
-                .data           = &watchdog_user_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
                 .proc_handler   = proc_watchdog,
                 .extra1         = &zero,
                 .extra2         = &one,
@@ -889,16 +890,12 @@ static struct ctl_table kern_table[] = {
         },
         {
                 .procname       = "nmi_watchdog",
-                .data           = &nmi_watchdog_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &nmi_watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = NMI_WATCHDOG_SYSCTL_PERM,
                 .proc_handler   = proc_nmi_watchdog,
                 .extra1         = &zero,
-#if defined(CONFIG_HAVE_NMI_WATCHDOG) || defined(CONFIG_HARDLOCKUP_DETECTOR)
                 .extra2         = &one,
-#else
-                .extra2         = &zero,
-#endif
         },
         {
                 .procname       = "watchdog_cpumask",
@@ -910,9 +907,9 @@ static struct ctl_table kern_table[] = {
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
         {
                 .procname       = "soft_watchdog",
-                .data           = &soft_watchdog_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &soft_watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
                 .proc_handler   = proc_soft_watchdog,
                 .extra1         = &zero,
                 .extra2         = &one,
@@ -2187,8 +2184,6 @@ static int do_proc_douintvec_conv(unsigned long *lvalp,
         if (write) {
                 if (*lvalp > UINT_MAX)
                         return -EINVAL;
-                if (*lvalp > UINT_MAX)
-                        return -EINVAL;
                 *valp = *lvalp;
         } else {
                 unsigned int val = *valp;
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 2a685b45b73b..45a3928544ce 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -648,6 +648,12 @@ int blk_trace_startstop(struct request_queue *q, int start)
 }
 EXPORT_SYMBOL_GPL(blk_trace_startstop);
 
+/*
+ * When reading or writing the blktrace sysfs files, the references to the
+ * opened sysfs or device files should prevent the underlying block device
+ * from being removed. So no further delete protection is really needed.
+ */
+
 /**
  * blk_trace_ioctl: - handle the ioctls associated with tracing
  * @bdev:       the block device
@@ -665,7 +671,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
         if (!q)
                 return -ENXIO;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         switch (cmd) {
         case BLKTRACESETUP:
@@ -691,7 +697,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
                 break;
         }
 
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
         return ret;
 }
 
@@ -1727,7 +1733,7 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
         if (q == NULL)
                 goto out_bdput;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         if (attr == &dev_attr_enable) {
                 ret = sprintf(buf, "%u\n", !!q->blk_trace);
@@ -1746,7 +1752,7 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
                 ret = sprintf(buf, "%llu\n", q->blk_trace->end_lba);
 
 out_unlock_bdev:
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
 out_bdput:
         bdput(bdev);
 out:
@@ -1788,7 +1794,7 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
         if (q == NULL)
                 goto out_bdput;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         if (attr == &dev_attr_enable) {
                 if (value)
@@ -1814,7 +1820,7 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
         }
 
 out_unlock_bdev:
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
 out_bdput:
         bdput(bdev);
 out:
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6abfafd7f173..8319e09e15b9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4954,9 +4954,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata;
 static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata;
 static int ftrace_graph_set_hash(struct ftrace_hash *hash, char *buffer);
 
-static unsigned long save_global_trampoline;
-static unsigned long save_global_flags;
-
 static int __init set_graph_function(char *str)
 {
         strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE);
@@ -6808,17 +6805,6 @@ void unregister_ftrace_graph(void)
         unregister_pm_notifier(&ftrace_suspend_notifier);
         unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
 
-#ifdef CONFIG_DYNAMIC_FTRACE
-        /*
-         * Function graph does not allocate the trampoline, but
-         * other global_ops do. We need to reset the ALLOC_TRAMP flag
-         * if one was used.
-         */
-        global_ops.trampoline = save_global_trampoline;
-        if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP)
-                global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
-#endif
-
  out:
         mutex_unlock(&ftrace_lock);
 }
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index bac629af2285..c738e764e2a5 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -656,15 +656,6 @@ int trace_print_lat_context(struct trace_iterator *iter)
         return !trace_seq_has_overflowed(s);
 }
 
-static const char state_to_char[] = TASK_STATE_TO_CHAR_STR;
-
-static int task_state_char(unsigned long state)
-{
-        int bit = state ? __ffs(state) + 1 : 0;
-
-        return bit < sizeof(state_to_char) - 1 ? state_to_char[bit] : '?';
-}
-
 /**
  * ftrace_find_event - find a registered event
  * @type: the type of event to look for
@@ -930,8 +921,8 @@ static enum print_line_t trace_ctxwake_print(struct trace_iterator *iter,
 
         trace_assign_type(field, iter->ent);
 
-        T = task_state_char(field->next_state);
-        S = task_state_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
+        S = __task_state_to_char(field->prev_state);
         trace_find_cmdline(field->next_pid, comm);
         trace_seq_printf(&iter->seq,
                          " %5d:%3d:%c %s [%03d] %5d:%3d:%c %s\n",
@@ -966,8 +957,8 @@ static int trace_ctxwake_raw(struct trace_iterator *iter, char S)
         trace_assign_type(field, iter->ent);
 
         if (!S)
-                S = task_state_char(field->prev_state);
-        T = task_state_char(field->next_state);
+                S = __task_state_to_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
         trace_seq_printf(&iter->seq, "%d %d %c %d %d %d %c\n",
                          field->prev_pid,
                          field->prev_prio,
@@ -1002,8 +993,8 @@ static int trace_ctxwake_hex(struct trace_iterator *iter, char S)
         trace_assign_type(field, iter->ent);
 
         if (!S)
-                S = task_state_char(field->prev_state);
-        T = task_state_char(field->next_state);
+                S = __task_state_to_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
 
         SEQ_PUT_HEX_FIELD(s, field->prev_pid);
         SEQ_PUT_HEX_FIELD(s, field->prev_prio);
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index ddec53b67646..0c331978b1a6 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -397,10 +397,10 @@ tracing_sched_switch_trace(struct trace_array *tr,
         entry   = ring_buffer_event_data(event);
         entry->prev_pid                 = prev->pid;
         entry->prev_prio                = prev->prio;
-        entry->prev_state               = prev->state;
+        entry->prev_state               = __get_task_state(prev);
         entry->next_pid                 = next->pid;
         entry->next_prio                = next->prio;
-        entry->next_state               = next->state;
+        entry->next_state               = __get_task_state(next);
         entry->next_cpu = task_cpu(next);
 
         if (!call_filter_check_discard(call, entry, buffer, event))
@@ -425,10 +425,10 @@ tracing_sched_wakeup_trace(struct trace_array *tr,
         entry   = ring_buffer_event_data(event);
         entry->prev_pid                 = curr->pid;
         entry->prev_prio                = curr->prio;
-        entry->prev_state               = curr->state;
+        entry->prev_state               = __get_task_state(curr);
         entry->next_pid                 = wakee->pid;
         entry->next_prio                = wakee->prio;
-        entry->next_state               = wakee->state;
+        entry->next_state               = __get_task_state(wakee);
         entry->next_cpu                 = task_cpu(wakee);
 
         if (!call_filter_check_discard(call, entry, buffer, event))
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index a4df67cbc711..49cb41412eec 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -96,23 +96,9 @@ check_stack(unsigned long ip, unsigned long *stack)
         if (in_nmi())
                 return;
 
-        /*
-         * There's a slight chance that we are tracing inside the
-         * RCU infrastructure, and rcu_irq_enter() will not work
-         * as expected.
-         */
-        if (unlikely(rcu_irq_enter_disabled()))
-                return;
-
         local_irq_save(flags);
         arch_spin_lock(&stack_trace_max_lock);
 
-        /*
-         * RCU may not be watching, make it see us.
-         * The stack trace code uses rcu_sched.
-         */
-        rcu_irq_enter();
-
         /* In case another CPU set the tracer_frame on us */
         if (unlikely(!frame_size))
                 this_size -= tracer_frame;
@@ -205,7 +191,6 @@ check_stack(unsigned long ip, unsigned long *stack)
         }
 
  out:
-        rcu_irq_exit();
         arch_spin_unlock(&stack_trace_max_lock);
         local_irq_restore(flags);
 }
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index f5d52024f6b7..6bcb854909c0 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -29,20 +29,29 @@
 #include <linux/kvm_para.h>
 #include <linux/kthread.h>
 
-/* Watchdog configuration */
-static DEFINE_MUTEX(watchdog_proc_mutex);
-
-int __read_mostly nmi_watchdog_enabled;
+static DEFINE_MUTEX(watchdog_mutex);
 
 #if defined(CONFIG_HARDLOCKUP_DETECTOR) || defined(CONFIG_HAVE_NMI_WATCHDOG)
-unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED |
-                                                NMI_WATCHDOG_ENABLED;
+# define WATCHDOG_DEFAULT       (SOFT_WATCHDOG_ENABLED | NMI_WATCHDOG_ENABLED)
+# define NMI_WATCHDOG_DEFAULT   1
 #else
-unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED;
+# define WATCHDOG_DEFAULT       (SOFT_WATCHDOG_ENABLED)
+# define NMI_WATCHDOG_DEFAULT   0
 #endif
 
+unsigned long __read_mostly watchdog_enabled;
+int __read_mostly watchdog_user_enabled = 1;
+int __read_mostly nmi_watchdog_user_enabled = NMI_WATCHDOG_DEFAULT;
+int __read_mostly soft_watchdog_user_enabled = 1;
+int __read_mostly watchdog_thresh = 10;
+int __read_mostly nmi_watchdog_available;
+
+struct cpumask watchdog_allowed_mask __read_mostly;
+
+struct cpumask watchdog_cpumask __read_mostly;
+unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
+
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
-/* boot commands */
 /*
  * Should we panic when a soft-lockup or hard-lockup occurs:
  */
@@ -56,9 +65,9 @@ unsigned int __read_mostly hardlockup_panic =
  * kernel command line parameters are parsed, because otherwise it is not
  * possible to override this in hardlockup_panic_setup().
  */
-void hardlockup_detector_disable(void)
+void __init hardlockup_detector_disable(void)
 {
-        watchdog_enabled &= ~NMI_WATCHDOG_ENABLED;
+        nmi_watchdog_user_enabled = 0;
 }
 
 static int __init hardlockup_panic_setup(char *str)
@@ -68,48 +77,24 @@ static int __init hardlockup_panic_setup(char *str)
         else if (!strncmp(str, "nopanic", 7))
                 hardlockup_panic = 0;
         else if (!strncmp(str, "0", 1))
-                watchdog_enabled &= ~NMI_WATCHDOG_ENABLED;
+                nmi_watchdog_user_enabled = 0;
         else if (!strncmp(str, "1", 1))
-                watchdog_enabled |= NMI_WATCHDOG_ENABLED;
+                nmi_watchdog_user_enabled = 1;
         return 1;
 }
 __setup("nmi_watchdog=", hardlockup_panic_setup);
 
-#endif
-
-#ifdef CONFIG_SOFTLOCKUP_DETECTOR
-int __read_mostly soft_watchdog_enabled;
-#endif
-
-int __read_mostly watchdog_user_enabled;
-int __read_mostly watchdog_thresh = 10;
-
-#ifdef CONFIG_SMP
-int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+# ifdef CONFIG_SMP
 int __read_mostly sysctl_hardlockup_all_cpu_backtrace;
-#endif
-struct cpumask watchdog_cpumask __read_mostly;
-unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
 
-/*
- * The 'watchdog_running' variable is set to 1 when the watchdog threads
- * are registered/started and is set to 0 when the watchdog threads are
- * unregistered/stopped, so it is an indicator whether the threads exist.
- */
-static int __read_mostly watchdog_running;
-/*
- * If a subsystem has a need to deactivate the watchdog temporarily, it
- * can use the suspend/resume interface to achieve this. The content of
- * the 'watchdog_suspended' variable reflects this state. Existing threads
- * are parked/unparked by the lockup_detector_{suspend|resume} functions
- * (see comment blocks pertaining to those functions for further details).
- *
- * 'watchdog_suspended' also prevents threads from being registered/started
- * or unregistered/stopped via parameters in /proc/sys/kernel, so the state
- * of 'watchdog_running' cannot change while the watchdog is deactivated
- * temporarily (see related code in 'proc' handlers).
- */
-int __read_mostly watchdog_suspended;
+static int __init hardlockup_all_cpu_backtrace_setup(char *str)
+{
+        sysctl_hardlockup_all_cpu_backtrace = !!simple_strtol(str, NULL, 0);
+        return 1;
+}
+__setup("hardlockup_all_cpu_backtrace=", hardlockup_all_cpu_backtrace_setup);
+# endif /* CONFIG_SMP */
+#endif /* CONFIG_HARDLOCKUP_DETECTOR */
 
 /*
  * These functions can be overridden if an architecture implements its
@@ -121,36 +106,68 @@ int __read_mostly watchdog_suspended;
  */
 int __weak watchdog_nmi_enable(unsigned int cpu)
 {
+        hardlockup_detector_perf_enable();
         return 0;
 }
+
 void __weak watchdog_nmi_disable(unsigned int cpu)
 {
+        hardlockup_detector_perf_disable();
 }
 
-/*
- * watchdog_nmi_reconfigure can be implemented to be notified after any
- * watchdog configuration change. The arch hardlockup watchdog should
- * respond to the following variables:
- * - nmi_watchdog_enabled
+/* Return 0, if a NMI watchdog is available. Error code otherwise */
+int __weak __init watchdog_nmi_probe(void)
+{
+        return hardlockup_detector_perf_init();
+}
+
+/**
+ * watchdog_nmi_stop - Stop the watchdog for reconfiguration
+ *
+ * The reconfiguration steps are:
+ * watchdog_nmi_stop();
+ * update_variables();
+ * watchdog_nmi_start();
+ */
+void __weak watchdog_nmi_stop(void) { }
+
+/**
+ * watchdog_nmi_start - Start the watchdog after reconfiguration
+ *
+ * Counterpart to watchdog_nmi_stop().
+ *
+ * The following variables have been updated in update_variables() and
+ * contain the currently valid configuration:
+ * - watchdog_enabled
  * - watchdog_thresh
  * - watchdog_cpumask
- * - sysctl_hardlockup_all_cpu_backtrace
- * - hardlockup_panic
- * - watchdog_suspended
  */
-void __weak watchdog_nmi_reconfigure(void)
+void __weak watchdog_nmi_start(void) { }
+
+/**
+ * lockup_detector_update_enable - Update the sysctl enable bit
+ *
+ * Caller needs to make sure that the NMI/perf watchdogs are off, so this
+ * can't race with watchdog_nmi_disable().
+ */
+static void lockup_detector_update_enable(void)
 {
+        watchdog_enabled = 0;
+        if (!watchdog_user_enabled)
+                return;
+        if (nmi_watchdog_available && nmi_watchdog_user_enabled)
+                watchdog_enabled |= NMI_WATCHDOG_ENABLED;
+        if (soft_watchdog_user_enabled)
+                watchdog_enabled |= SOFT_WATCHDOG_ENABLED;
 }
 
-
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
 
-/* Helper for online, unparked cpus. */
-#define for_each_watchdog_cpu(cpu) \
-        for_each_cpu_and((cpu), cpu_online_mask, &watchdog_cpumask)
-
-atomic_t watchdog_park_in_progress = ATOMIC_INIT(0);
+/* Global variables, exported for sysctl */
+unsigned int __read_mostly softlockup_panic =
+                        CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
 
+static bool softlockup_threads_initialized __read_mostly;
 static u64 __read_mostly sample_period;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
@@ -164,50 +181,40 @@ static DEFINE_PER_CPU(struct task_struct *, softlockup_task_ptr_saved);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static unsigned long soft_lockup_nmi_warn;
 
-unsigned int __read_mostly softlockup_panic =
-                        CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
-
 static int __init softlockup_panic_setup(char *str)
 {
         softlockup_panic = simple_strtoul(str, NULL, 0);
-
         return 1;
 }
 __setup("softlockup_panic=", softlockup_panic_setup);
 
 static int __init nowatchdog_setup(char *str)
 {
-        watchdog_enabled = 0;
+        watchdog_user_enabled = 0;
         return 1;
 }
 __setup("nowatchdog", nowatchdog_setup);
 
 static int __init nosoftlockup_setup(char *str)
 {
-        watchdog_enabled &= ~SOFT_WATCHDOG_ENABLED;
+        soft_watchdog_user_enabled = 0;
         return 1;
 }
 __setup("nosoftlockup", nosoftlockup_setup);
 
 #ifdef CONFIG_SMP
+int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+
 static int __init softlockup_all_cpu_backtrace_setup(char *str)
 {
-        sysctl_softlockup_all_cpu_backtrace =
-                !!simple_strtol(str, NULL, 0);
+        sysctl_softlockup_all_cpu_backtrace = !!simple_strtol(str, NULL, 0);
         return 1;
 }
 __setup("softlockup_all_cpu_backtrace=", softlockup_all_cpu_backtrace_setup);
-#ifdef CONFIG_HARDLOCKUP_DETECTOR
-static int __init hardlockup_all_cpu_backtrace_setup(char *str)
-{
-        sysctl_hardlockup_all_cpu_backtrace =
-                !!simple_strtol(str, NULL, 0);
-        return 1;
-}
-__setup("hardlockup_all_cpu_backtrace=", hardlockup_all_cpu_backtrace_setup);
-#endif
 #endif
 
+static void __lockup_detector_cleanup(void);
+
 /*
  * Hard-lockup warnings should be triggered after just a few seconds. Soft-
  * lockups can have false positives under extreme conditions. So we generally
@@ -278,11 +285,15 @@ void touch_all_softlockup_watchdogs(void)
         int cpu;
 
         /*
-         * this is done lockless
-         * do we care if a 0 races with a timestamp?
-         * all it means is the softlock check starts one cycle later
+         * watchdog_mutex cannpt be taken here, as this might be called
+         * from (soft)interrupt context, so the access to
+         * watchdog_allowed_cpumask might race with a concurrent update.
+         *
+         * The watchdog time stamp can race against a concurrent real
+         * update as well, the only side effect might be a cycle delay for
+         * the softlockup check.
          */
-        for_each_watchdog_cpu(cpu)
+        for_each_cpu(cpu, &watchdog_allowed_mask)
                 per_cpu(watchdog_touch_ts, cpu) = 0;
         wq_watchdog_touch(-1);
 }
@@ -322,9 +333,6 @@ static void watchdog_interrupt_count(void)
         __this_cpu_inc(hrtimer_interrupts);
 }
 
-static int watchdog_enable_all_cpus(void);
-static void watchdog_disable_all_cpus(void);
-
 /* watchdog kicker functions */
 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 {
@@ -333,7 +341,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         int duration;
         int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
 
-        if (atomic_read(&watchdog_park_in_progress) != 0)
+        if (!watchdog_enabled)
                 return HRTIMER_NORESTART;
 
         /* kick the hardlockup detector */
@@ -447,32 +455,38 @@ static void watchdog_set_prio(unsigned int policy, unsigned int prio)
 
 static void watchdog_enable(unsigned int cpu)
 {
-        struct hrtimer *hrtimer = raw_cpu_ptr(&watchdog_hrtimer);
+        struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
 
-        /* kick off the timer for the hardlockup detector */
+        /*
+         * Start the timer first to prevent the NMI watchdog triggering
+         * before the timer has a chance to fire.
+         */
         hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         hrtimer->function = watchdog_timer_fn;
-
-        /* Enable the perf event */
-        watchdog_nmi_enable(cpu);
-
-        /* done here because hrtimer_start can only pin to smp_processor_id() */
         hrtimer_start(hrtimer, ns_to_ktime(sample_period),
                       HRTIMER_MODE_REL_PINNED);
 
-        /* initialize timestamp */
-        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
+        /* Initialize timestamp */
         __touch_watchdog();
+        /* Enable the perf event */
+        if (watchdog_enabled & NMI_WATCHDOG_ENABLED)
+                watchdog_nmi_enable(cpu);
+
+        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
 }
 
 static void watchdog_disable(unsigned int cpu)
 {
-        struct hrtimer *hrtimer = raw_cpu_ptr(&watchdog_hrtimer);
+        struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
 
         watchdog_set_prio(SCHED_NORMAL, 0);
-        hrtimer_cancel(hrtimer);
-        /* disable the perf event */
+        /*
+         * Disable the perf event first. That prevents that a large delay
+         * between disabling the timer and disabling the perf event causes
+         * the perf NMI to detect a false positive.
+         */
         watchdog_nmi_disable(cpu);
+        hrtimer_cancel(hrtimer);
 }
 
 static void watchdog_cleanup(unsigned int cpu, bool online)
@@ -499,21 +513,6 @@ static void watchdog(unsigned int cpu)
         __this_cpu_write(soft_lockup_hrtimer_cnt,
                          __this_cpu_read(hrtimer_interrupts));
         __touch_watchdog();
-
-        /*
-         * watchdog_nmi_enable() clears the NMI_WATCHDOG_ENABLED bit in the
-         * failure path. Check for failures that can occur asynchronously -
-         * for example, when CPUs are on-lined - and shut down the hardware
-         * perf event on each CPU accordingly.
-         *
-         * The only non-obvious place this bit can be cleared is through
-         * watchdog_nmi_enable(), so a pr_info() is placed there.  Placing a
-         * pr_info here would be too noisy as it would result in a message
-         * every few seconds if the hardlockup was disabled but the softlockup
-         * enabled.
-         */
-        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
-                watchdog_nmi_disable(cpu);
 }
 
 static struct smp_hotplug_thread watchdog_threads = {
@@ -527,295 +526,174 @@ static struct smp_hotplug_thread watchdog_threads = {
         .unpark                 = watchdog_enable,
 };
 
-/*
- * park all watchdog threads that are specified in 'watchdog_cpumask'
- *
- * This function returns an error if kthread_park() of a watchdog thread
- * fails. In this situation, the watchdog threads of some CPUs can already
- * be parked and the watchdog threads of other CPUs can still be runnable.
- * Callers are expected to handle this special condition as appropriate in
- * their context.
- *
- * This function may only be called in a context that is protected against
- * races with CPU hotplug - for example, via get_online_cpus().
- */
-static int watchdog_park_threads(void)
+static void softlockup_update_smpboot_threads(void)
 {
-        int cpu, ret = 0;
+        lockdep_assert_held(&watchdog_mutex);
 
-        atomic_set(&watchdog_park_in_progress, 1);
+        if (!softlockup_threads_initialized)
+                return;
 
-        for_each_watchdog_cpu(cpu) {
-                ret = kthread_park(per_cpu(softlockup_watchdog, cpu));
-                if (ret)
-                        break;
-        }
-
-        atomic_set(&watchdog_park_in_progress, 0);
-
-        return ret;
+        smpboot_update_cpumask_percpu_thread(&watchdog_threads,
+                                             &watchdog_allowed_mask);
 }
 
-/*
- * unpark all watchdog threads that are specified in 'watchdog_cpumask'
- *
- * This function may only be called in a context that is protected against
- * races with CPU hotplug - for example, via get_online_cpus().
- */
-static void watchdog_unpark_threads(void)
+/* Temporarily park all watchdog threads */
+static void softlockup_park_all_threads(void)
 {
-        int cpu;
-
-        for_each_watchdog_cpu(cpu)
-                kthread_unpark(per_cpu(softlockup_watchdog, cpu));
+        cpumask_clear(&watchdog_allowed_mask);
+        softlockup_update_smpboot_threads();
 }
 
-static int update_watchdog_all_cpus(void)
+/* Unpark enabled threads */
+static void softlockup_unpark_threads(void)
 {
-        int ret;
-
-        ret = watchdog_park_threads();
-        if (ret)
-                return ret;
-
-        watchdog_unpark_threads();
-
-        return 0;
+        cpumask_copy(&watchdog_allowed_mask, &watchdog_cpumask);
+        softlockup_update_smpboot_threads();
 }
 
-static int watchdog_enable_all_cpus(void)
+static void lockup_detector_reconfigure(void)
 {
-        int err = 0;
-
-        if (!watchdog_running) {
-                err = smpboot_register_percpu_thread_cpumask(&watchdog_threads,
-                                                             &watchdog_cpumask);
-                if (err)
-                        pr_err("Failed to create watchdog threads, disabled\n");
-                else
-                        watchdog_running = 1;
-        } else {
-                /*
-                 * Enable/disable the lockup detectors or
-                 * change the sample period 'on the fly'.
-                 */
-                err = update_watchdog_all_cpus();
-
-                if (err) {
-                        watchdog_disable_all_cpus();
-                        pr_err("Failed to update lockup detectors, disabled\n");
-                }
-        }
-
-        if (err)
-                watchdog_enabled = 0;
-
-        return err;
+        cpus_read_lock();
+        watchdog_nmi_stop();
+        softlockup_park_all_threads();
+        set_sample_period();
+        lockup_detector_update_enable();
+        if (watchdog_enabled && watchdog_thresh)
+                softlockup_unpark_threads();
+        watchdog_nmi_start();
+        cpus_read_unlock();
+        /*
+         * Must be called outside the cpus locked section to prevent
+         * recursive locking in the perf code.
+         */
+        __lockup_detector_cleanup();
 }
 
-static void watchdog_disable_all_cpus(void)
+/*
+ * Create the watchdog thread infrastructure and configure the detector(s).
+ *
+ * The threads are not unparked as watchdog_allowed_mask is empty.  When
+ * the threads are sucessfully initialized, take the proper locks and
+ * unpark the threads in the watchdog_cpumask if the watchdog is enabled.
+ */
+static __init void lockup_detector_setup(void)
 {
-        if (watchdog_running) {
-                watchdog_running = 0;
-                smpboot_unregister_percpu_thread(&watchdog_threads);
-        }
-}
+        int ret;
 
-#ifdef CONFIG_SYSCTL
-static int watchdog_update_cpus(void)
-{
-        return smpboot_update_cpumask_percpu_thread(
-                    &watchdog_threads, &watchdog_cpumask);
-}
-#endif
+        /*
+         * If sysctl is off and watchdog got disabled on the command line,
+         * nothing to do here.
+         */
+        lockup_detector_update_enable();
 
-#else /* SOFTLOCKUP */
-static int watchdog_park_threads(void)
-{
-        return 0;
-}
+        if (!IS_ENABLED(CONFIG_SYSCTL) &&
+            !(watchdog_enabled && watchdog_thresh))
+                return;
 
-static void watchdog_unpark_threads(void)
-{
-}
+        ret = smpboot_register_percpu_thread_cpumask(&watchdog_threads,
+                                                     &watchdog_allowed_mask);
+        if (ret) {
+                pr_err("Failed to initialize soft lockup detector threads\n");
+                return;
+        }
 
-static int watchdog_enable_all_cpus(void)
-{
-        return 0;
+        mutex_lock(&watchdog_mutex);
+        softlockup_threads_initialized = true;
+        lockup_detector_reconfigure();
+        mutex_unlock(&watchdog_mutex);
 }
 
-static void watchdog_disable_all_cpus(void)
+#else /* CONFIG_SOFTLOCKUP_DETECTOR */
+static inline int watchdog_park_threads(void) { return 0; }
+static inline void watchdog_unpark_threads(void) { }
+static inline int watchdog_enable_all_cpus(void) { return 0; }
+static inline void watchdog_disable_all_cpus(void) { }
+static void lockup_detector_reconfigure(void)
 {
+        cpus_read_lock();
+        watchdog_nmi_stop();
+        lockup_detector_update_enable();
+        watchdog_nmi_start();
+        cpus_read_unlock();
 }
-
-#ifdef CONFIG_SYSCTL
-static int watchdog_update_cpus(void)
+static inline void lockup_detector_setup(void)
 {
-        return 0;
+        lockup_detector_reconfigure();
 }
-#endif
+#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
 
-static void set_sample_period(void)
+static void __lockup_detector_cleanup(void)
 {
+        lockdep_assert_held(&watchdog_mutex);
+        hardlockup_detector_perf_cleanup();
 }
-#endif /* SOFTLOCKUP */
 
-/*
- * Suspend the hard and soft lockup detector by parking the watchdog threads.
+/**
+ * lockup_detector_cleanup - Cleanup after cpu hotplug or sysctl changes
+ *
+ * Caller must not hold the cpu hotplug rwsem.
  */
-int lockup_detector_suspend(void)
+void lockup_detector_cleanup(void)
 {
-        int ret = 0;
-
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
-        /*
-         * Multiple suspend requests can be active in parallel (counted by
-         * the 'watchdog_suspended' variable). If the watchdog threads are
-         * running, the first caller takes care that they will be parked.
-         * The state of 'watchdog_running' cannot change while a suspend
-         * request is active (see related code in 'proc' handlers).
-         */
-        if (watchdog_running && !watchdog_suspended)
-                ret = watchdog_park_threads();
-
-        if (ret == 0)
-                watchdog_suspended++;
-        else {
-                watchdog_disable_all_cpus();
-                pr_err("Failed to suspend lockup detectors, disabled\n");
-                watchdog_enabled = 0;
-        }
-
-        watchdog_nmi_reconfigure();
-
-        mutex_unlock(&watchdog_proc_mutex);
-
-        return ret;
+        mutex_lock(&watchdog_mutex);
+        __lockup_detector_cleanup();
+        mutex_unlock(&watchdog_mutex);
 }
 
-/*
- * Resume the hard and soft lockup detector by unparking the watchdog threads.
+/**
+ * lockup_detector_soft_poweroff - Interface to stop lockup detector(s)
+ *
+ * Special interface for parisc. It prevents lockup detector warnings from
+ * the default pm_poweroff() function which busy loops forever.
  */
-void lockup_detector_resume(void)
+void lockup_detector_soft_poweroff(void)
 {
-        mutex_lock(&watchdog_proc_mutex);
-
-        watchdog_suspended--;
-        /*
-         * The watchdog threads are unparked if they were previously running
-         * and if there is no more active suspend request.
-         */
-        if (watchdog_running && !watchdog_suspended)
-                watchdog_unpark_threads();
-
-        watchdog_nmi_reconfigure();
-
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        watchdog_enabled = 0;
 }
 
 #ifdef CONFIG_SYSCTL
 
-/*
- * Update the run state of the lockup detectors.
- */
-static int proc_watchdog_update(void)
+/* Propagate any changes to the watchdog threads */
+static void proc_watchdog_update(void)
 {
-        int err = 0;
-
-        /*
-         * Watchdog threads won't be started if they are already active.
-         * The 'watchdog_running' variable in watchdog_*_all_cpus() takes
-         * care of this. If those threads are already active, the sample
-         * period will be updated and the lockup detectors will be enabled
-         * or disabled 'on the fly'.
-         */
-        if (watchdog_enabled && watchdog_thresh)
-                err = watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
-
-        watchdog_nmi_reconfigure();
-
-        return err;
-
+        /* Remove impossible cpus to keep sysctl output clean. */
+        cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask);
+        lockup_detector_reconfigure();
 }
 
 /*
  * common function for watchdog, nmi_watchdog and soft_watchdog parameter
  *
- * caller             | table->data points to | 'which' contains the flag(s)
- * -------------------|-----------------------|-----------------------------
- * proc_watchdog      | watchdog_user_enabled | NMI_WATCHDOG_ENABLED or'ed
- *                    |                       | with SOFT_WATCHDOG_ENABLED
- * -------------------|-----------------------|-----------------------------
- * proc_nmi_watchdog  | nmi_watchdog_enabled  | NMI_WATCHDOG_ENABLED
- * -------------------|-----------------------|-----------------------------
- * proc_soft_watchdog | soft_watchdog_enabled | SOFT_WATCHDOG_ENABLED
+ * caller             | table->data points to      | 'which'
+ * -------------------|----------------------------|--------------------------
+ * proc_watchdog      | watchdog_user_enabled      | NMI_WATCHDOG_ENABLED |
+ *                    |                            | SOFT_WATCHDOG_ENABLED
+ * -------------------|----------------------------|--------------------------
+ * proc_nmi_watchdog  | nmi_watchdog_user_enabled  | NMI_WATCHDOG_ENABLED
+ * -------------------|----------------------------|--------------------------
+ * proc_soft_watchdog | soft_watchdog_user_enabled | SOFT_WATCHDOG_ENABLED
  */
 static int proc_watchdog_common(int which, struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int err, old, new;
-        int *watchdog_param = (int *)table->data;
+        int err, old, *param = table->data;
 
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
+        mutex_lock(&watchdog_mutex);
 
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
-
-        /*
-         * If the parameter is being read return the state of the corresponding
-         * bit(s) in 'watchdog_enabled', else update 'watchdog_enabled' and the
-         * run state of the lockup detectors.
-         */
         if (!write) {
-                *watchdog_param = (watchdog_enabled & which) != 0;
+                /*
+                 * On read synchronize the userspace interface. This is a
+                 * racy snapshot.
+                 */
+                *param = (watchdog_enabled & which) != 0;
                 err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
         } else {
+                old = READ_ONCE(*param);
                 err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-                if (err)
-                        goto out;
-
-                /*
-                 * There is a race window between fetching the current value
-                 * from 'watchdog_enabled' and storing the new value. During
-                 * this race window, watchdog_nmi_enable() can sneak in and
-                 * clear the NMI_WATCHDOG_ENABLED bit in 'watchdog_enabled'.
-                 * The 'cmpxchg' detects this race and the loop retries.
-                 */
-                do {
-                        old = watchdog_enabled;
-                        /*
-                         * If the parameter value is not zero set the
-                         * corresponding bit(s), else clear it(them).
-                         */
-                        if (*watchdog_param)
-                                new = old | which;
-                        else
-                                new = old & ~which;
-                } while (cmpxchg(&watchdog_enabled, old, new) != old);
-
-                /*
-                 * Update the run state of the lockup detectors. There is _no_
-                 * need to check the value returned by proc_watchdog_update()
-                 * and to restore the previous value of 'watchdog_enabled' as
-                 * both lockup detectors are disabled if proc_watchdog_update()
-                 * returns an error.
-                 */
-                if (old == new)
-                        goto out;
-
-                err = proc_watchdog_update();
+                if (!err && old != READ_ONCE(*param))
+                        proc_watchdog_update();
         }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
 
@@ -835,6 +713,8 @@ int proc_watchdog(struct ctl_table *table, int write,
 int proc_nmi_watchdog(struct ctl_table *table, int write,
                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
+        if (!nmi_watchdog_available && write)
+                return -ENOTSUPP;
         return proc_watchdog_common(NMI_WATCHDOG_ENABLED,
                                     table, write, buffer, lenp, ppos);
 }
@@ -855,39 +735,17 @@ int proc_soft_watchdog(struct ctl_table *table, int write,
 int proc_watchdog_thresh(struct ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int err, old, new;
-
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
+        int err, old;
 
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
+        mutex_lock(&watchdog_mutex);
 
-        old = ACCESS_ONCE(watchdog_thresh);
+        old = READ_ONCE(watchdog_thresh);
         err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 
-        if (err || !write)
-                goto out;
-
-        /*
-         * Update the sample period. Restore on failure.
-         */
-        new = ACCESS_ONCE(watchdog_thresh);
-        if (old == new)
-                goto out;
+        if (!err && write && old != READ_ONCE(watchdog_thresh))
+                proc_watchdog_update();
 
-        set_sample_period();
-        err = proc_watchdog_update();
-        if (err) {
-                watchdog_thresh = old;
-                set_sample_period();
-        }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
 
@@ -902,45 +760,19 @@ int proc_watchdog_cpumask(struct ctl_table *table, int write,
 {
         int err;
 
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
-
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
+        mutex_lock(&watchdog_mutex);
 
         err = proc_do_large_bitmap(table, write, buffer, lenp, ppos);
-        if (!err && write) {
-                /* Remove impossible cpus to keep sysctl output cleaner. */
-                cpumask_and(&watchdog_cpumask, &watchdog_cpumask,
-                            cpu_possible_mask);
-
-                if (watchdog_running) {
-                        /*
-                         * Failure would be due to being unable to allocate
-                         * a temporary cpumask, so we are likely not in a
-                         * position to do much else to make things better.
-                         */
-                        if (watchdog_update_cpus() != 0)
-                                pr_err("cpumask update failed\n");
-                }
+        if (!err && write)
+                proc_watchdog_update();
 
-                watchdog_nmi_reconfigure();
-        }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
-
 #endif /* CONFIG_SYSCTL */
 
 void __init lockup_detector_init(void)
 {
-        set_sample_period();
-
 #ifdef CONFIG_NO_HZ_FULL
         if (tick_nohz_full_enabled()) {
                 pr_info("Disabling watchdog on nohz_full cores by default\n");
@@ -951,6 +783,7 @@ void __init lockup_detector_init(void)
         cpumask_copy(&watchdog_cpumask, cpu_possible_mask);
 #endif
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
+        if (!watchdog_nmi_probe())
+                nmi_watchdog_available = true;
+        lockup_detector_setup();
 }
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 3a09ea1b1d3d..71a62ceacdc8 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -21,8 +21,10 @@
 static DEFINE_PER_CPU(bool, hard_watchdog_warn);
 static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
+static struct cpumask dead_events_mask;
 
 static unsigned long hardlockup_allcpu_dumped;
+static unsigned int watchdog_cpus;
 
 void arch_touch_nmi_watchdog(void)
 {
@@ -103,15 +105,12 @@ static struct perf_event_attr wd_hw_attr = {
 
 /* Callback function for perf event subsystem */
 static void watchdog_overflow_callback(struct perf_event *event,
-                 struct perf_sample_data *data,
-                 struct pt_regs *regs)
+                                       struct perf_sample_data *data,
+                                       struct pt_regs *regs)
 {
         /* Ensure the watchdog never gets throttled */
         event->hw.interrupts = 0;
 
-        if (atomic_read(&watchdog_park_in_progress) != 0)
-                return;
-
         if (__this_cpu_read(watchdog_nmi_touch) == true) {
                 __this_cpu_write(watchdog_nmi_touch, false);
                 return;
@@ -160,104 +159,131 @@ static void watchdog_overflow_callback(struct perf_event *event,
         return;
 }
 
-/*
- * People like the simple clean cpu node info on boot.
- * Reduce the watchdog noise by only printing messages
- * that are different from what cpu0 displayed.
- */
-static unsigned long firstcpu_err;
-static atomic_t watchdog_cpus;
-
-int watchdog_nmi_enable(unsigned int cpu)
+static int hardlockup_detector_event_create(void)
 {
+        unsigned int cpu = smp_processor_id();
         struct perf_event_attr *wd_attr;
-        struct perf_event *event = per_cpu(watchdog_ev, cpu);
-        int firstcpu = 0;
-
-        /* nothing to do if the hard lockup detector is disabled */
-        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
-                goto out;
-
-        /* is it already setup and enabled? */
-        if (event && event->state > PERF_EVENT_STATE_OFF)
-                goto out;
-
-        /* it is setup but not enabled */
-        if (event != NULL)
-                goto out_enable;
-
-        if (atomic_inc_return(&watchdog_cpus) == 1)
-                firstcpu = 1;
+        struct perf_event *evt;
 
         wd_attr = &wd_hw_attr;
         wd_attr->sample_period = hw_nmi_get_sample_period(watchdog_thresh);
 
         /* Try to register using hardware perf events */
-        event = perf_event_create_kernel_counter(wd_attr, cpu, NULL, watchdog_overflow_callback, NULL);
+        evt = perf_event_create_kernel_counter(wd_attr, cpu, NULL,
+                                               watchdog_overflow_callback, NULL);
+        if (IS_ERR(evt)) {
+                pr_info("Perf event create on CPU %d failed with %ld\n", cpu,
+                        PTR_ERR(evt));
+                return PTR_ERR(evt);
+        }
+        this_cpu_write(watchdog_ev, evt);
+        return 0;
+}
 
-        /* save the first cpu's error for future comparision */
-        if (firstcpu && IS_ERR(event))
-                firstcpu_err = PTR_ERR(event);
+/**
+ * hardlockup_detector_perf_enable - Enable the local event
+ */
+void hardlockup_detector_perf_enable(void)
+{
+        if (hardlockup_detector_event_create())
+                return;
 
-        if (!IS_ERR(event)) {
-                /* only print for the first cpu initialized */
-                if (firstcpu || firstcpu_err)
-                        pr_info("enabled on all CPUs, permanently consumes one hw-PMU counter.\n");
-                goto out_save;
-        }
+        if (!watchdog_cpus++)
+                pr_info("Enabled. Permanently consumes one hw-PMU counter.\n");
 
-        /*
-         * Disable the hard lockup detector if _any_ CPU fails to set up
-         * set up the hardware perf event. The watchdog() function checks
-         * the NMI_WATCHDOG_ENABLED bit periodically.
-         *
-         * The barriers are for syncing up watchdog_enabled across all the
-         * cpus, as clear_bit() does not use barriers.
-         */
-        smp_mb__before_atomic();
-        clear_bit(NMI_WATCHDOG_ENABLED_BIT, &watchdog_enabled);
-        smp_mb__after_atomic();
-
-        /* skip displaying the same error again */
-        if (!firstcpu && (PTR_ERR(event) == firstcpu_err))
-                return PTR_ERR(event);
-
-        /* vary the KERN level based on the returned errno */
-        if (PTR_ERR(event) == -EOPNOTSUPP)
-                pr_info("disabled (cpu%i): not supported (no LAPIC?)\n", cpu);
-        else if (PTR_ERR(event) == -ENOENT)
-                pr_warn("disabled (cpu%i): hardware events not enabled\n",
-                         cpu);
-        else
-                pr_err("disabled (cpu%i): unable to create perf event: %ld\n",
-                        cpu, PTR_ERR(event));
-
-        pr_info("Shutting down hard lockup detector on all cpus\n");
-
-        return PTR_ERR(event);
-
-        /* success path */
-out_save:
-        per_cpu(watchdog_ev, cpu) = event;
-out_enable:
-        perf_event_enable(per_cpu(watchdog_ev, cpu));
-out:
-        return 0;
+        perf_event_enable(this_cpu_read(watchdog_ev));
 }
 
-void watchdog_nmi_disable(unsigned int cpu)
+/**
+ * hardlockup_detector_perf_disable - Disable the local event
+ */
+void hardlockup_detector_perf_disable(void)
 {
-        struct perf_event *event = per_cpu(watchdog_ev, cpu);
+        struct perf_event *event = this_cpu_read(watchdog_ev);
 
         if (event) {
                 perf_event_disable(event);
+                cpumask_set_cpu(smp_processor_id(), &dead_events_mask);
+                watchdog_cpus--;
+        }
+}
+
+/**
+ * hardlockup_detector_perf_cleanup - Cleanup disabled events and destroy them
+ *
+ * Called from lockup_detector_cleanup(). Serialized by the caller.
+ */
+void hardlockup_detector_perf_cleanup(void)
+{
+        int cpu;
+
+        for_each_cpu(cpu, &dead_events_mask) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                /*
+                 * Required because for_each_cpu() reports  unconditionally
+                 * CPU0 as set on UP kernels. Sigh.
+                 */
+                if (event)
+                        perf_event_release_kernel(event);
                 per_cpu(watchdog_ev, cpu) = NULL;
+        }
+        cpumask_clear(&dead_events_mask);
+}
+
+/**
+ * hardlockup_detector_perf_stop - Globally stop watchdog events
+ *
+ * Special interface for x86 to handle the perf HT bug.
+ */
+void __init hardlockup_detector_perf_stop(void)
+{
+        int cpu;
+
+        lockdep_assert_cpus_held();
+
+        for_each_online_cpu(cpu) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                if (event)
+                        perf_event_disable(event);
+        }
+}
 
-                /* should be in cleanup, but blocks oprofile */
-                perf_event_release_kernel(event);
+/**
+ * hardlockup_detector_perf_restart - Globally restart watchdog events
+ *
+ * Special interface for x86 to handle the perf HT bug.
+ */
+void __init hardlockup_detector_perf_restart(void)
+{
+        int cpu;
+
+        lockdep_assert_cpus_held();
+
+        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
+                return;
+
+        for_each_online_cpu(cpu) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                if (event)
+                        perf_event_enable(event);
+        }
+}
+
+/**
+ * hardlockup_detector_perf_init - Probe whether NMI event is available at all
+ */
+int __init hardlockup_detector_perf_init(void)
+{
+        int ret = hardlockup_detector_event_create();
 
-                /* watchdog_nmi_enable() expects this to be zero initially. */
-                if (atomic_dec_and_test(&watchdog_cpus))
-                        firstcpu_err = 0;
+        if (ret) {
+                pr_info("Perf NMI watchdog permanently disabled\n");
+        } else {
+                perf_event_release_kernel(this_cpu_read(watchdog_ev));
+                this_cpu_write(watchdog_ev, NULL);
         }
+        return ret;
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 64d0edf428f8..a2dccfe1acec 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -68,6 +68,7 @@ enum {
          * attach_mutex to avoid changing binding state while
          * worker_attach_to_pool() is in progress.
          */
+        POOL_MANAGER_ACTIVE     = 1 << 0,       /* being managed */
         POOL_DISASSOCIATED      = 1 << 2,       /* cpu can't serve workers */
 
         /* worker flags */
@@ -165,7 +166,6 @@ struct worker_pool {
                                                 /* L: hash of busy workers */
 
         /* see manage_workers() for details on the two manager mutexes */
-        struct mutex            manager_arb;    /* manager arbitration */
         struct worker           *manager;       /* L: purely informational */
         struct mutex            attach_mutex;   /* attach/detach exclusion */
         struct list_head        workers;        /* A: attached workers */
@@ -299,6 +299,7 @@ static struct workqueue_attrs *wq_update_unbound_numa_attrs_buf;
 
 static DEFINE_MUTEX(wq_pool_mutex);     /* protects pools and workqueues list */
 static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */
+static DECLARE_WAIT_QUEUE_HEAD(wq_manager_wait); /* wait for manager to go away */
 
 static LIST_HEAD(workqueues);           /* PR: list of all workqueues */
 static bool workqueue_freezing;         /* PL: have wqs started freezing? */
@@ -801,7 +802,7 @@ static bool need_to_create_worker(struct worker_pool *pool)
 /* Do we have too many workers and should some go away? */
 static bool too_many_workers(struct worker_pool *pool)
 {
-        bool managing = mutex_is_locked(&pool->manager_arb);
+        bool managing = pool->flags & POOL_MANAGER_ACTIVE;
         int nr_idle = pool->nr_idle + managing; /* manager is considered idle */
         int nr_busy = pool->nr_workers - nr_idle;
 
@@ -1980,24 +1981,17 @@ static bool manage_workers(struct worker *worker)
 {
         struct worker_pool *pool = worker->pool;
 
-        /*
-         * Anyone who successfully grabs manager_arb wins the arbitration
-         * and becomes the manager.  mutex_trylock() on pool->manager_arb
-         * failure while holding pool->lock reliably indicates that someone
-         * else is managing the pool and the worker which failed trylock
-         * can proceed to executing work items.  This means that anyone
-         * grabbing manager_arb is responsible for actually performing
-         * manager duties.  If manager_arb is grabbed and released without
-         * actual management, the pool may stall indefinitely.
-         */
-        if (!mutex_trylock(&pool->manager_arb))
+        if (pool->flags & POOL_MANAGER_ACTIVE)
                 return false;
+
+        pool->flags |= POOL_MANAGER_ACTIVE;
         pool->manager = worker;
 
         maybe_create_worker(pool);
 
         pool->manager = NULL;
-        mutex_unlock(&pool->manager_arb);
+        pool->flags &= ~POOL_MANAGER_ACTIVE;
+        wake_up(&wq_manager_wait);
         return true;
 }
 
@@ -3248,7 +3242,6 @@ static int init_worker_pool(struct worker_pool *pool)
         setup_timer(&pool->mayday_timer, pool_mayday_timeout,
                     (unsigned long)pool);
 
-        mutex_init(&pool->manager_arb);
         mutex_init(&pool->attach_mutex);
         INIT_LIST_HEAD(&pool->workers);
 
@@ -3318,13 +3311,15 @@ static void put_unbound_pool(struct worker_pool *pool)
         hash_del(&pool->hash_node);
 
         /*
-         * Become the manager and destroy all workers.  Grabbing
-         * manager_arb prevents @pool's workers from blocking on
-         * attach_mutex.
+         * Become the manager and destroy all workers.  This prevents
+         * @pool's workers from blocking on attach_mutex.  We're the last
+         * manager and @pool gets freed with the flag set.
          */
-        mutex_lock(&pool->manager_arb);
-
         spin_lock_irq(&pool->lock);
+        wait_event_lock_irq(wq_manager_wait,
+                            !(pool->flags & POOL_MANAGER_ACTIVE), pool->lock);
+        pool->flags |= POOL_MANAGER_ACTIVE;
+
         while ((worker = first_idle_worker(pool)))
                 destroy_worker(worker);
         WARN_ON(pool->nr_workers || pool->nr_idle);
@@ -3338,8 +3333,6 @@ static void put_unbound_pool(struct worker_pool *pool)
         if (pool->detach_completion)
                 wait_for_completion(pool->detach_completion);
 
-        mutex_unlock(&pool->manager_arb);
-
         /* shut down the timers */
         del_timer_sync(&pool->idle_timer);
         del_timer_sync(&pool->mayday_timer);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2689b7c50c52..dfdad67d8f6c 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1092,8 +1092,8 @@ config PROVE_LOCKING
         select DEBUG_MUTEXES
         select DEBUG_RT_MUTEXES if RT_MUTEXES
         select DEBUG_LOCK_ALLOC
-        select LOCKDEP_CROSSRELEASE
-        select LOCKDEP_COMPLETIONS
+        select LOCKDEP_CROSSRELEASE if BROKEN
+        select LOCKDEP_COMPLETIONS if BROKEN
         select TRACE_IRQFLAGS
         default n
         help
@@ -1590,6 +1590,54 @@ config LATENCYTOP
 
 source kernel/trace/Kconfig
 
+config PROVIDE_OHCI1394_DMA_INIT
+        bool "Remote debugging over FireWire early on boot"
+        depends on PCI && X86
+        help
+          If you want to debug problems which hang or crash the kernel early
+          on boot and the crashing machine has a FireWire port, you can use
+          this feature to remotely access the memory of the crashed machine
+          over FireWire. This employs remote DMA as part of the OHCI1394
+          specification which is now the standard for FireWire controllers.
+
+          With remote DMA, you can monitor the printk buffer remotely using
+          firescope and access all memory below 4GB using fireproxy from gdb.
+          Even controlling a kernel debugger is possible using remote DMA.
+
+          Usage:
+
+          If ohci1394_dma=early is used as boot parameter, it will initialize
+          all OHCI1394 controllers which are found in the PCI config space.
+
+          As all changes to the FireWire bus such as enabling and disabling
+          devices cause a bus reset and thereby disable remote DMA for all
+          devices, be sure to have the cable plugged and FireWire enabled on
+          the debugging host before booting the debug target for debugging.
+
+          This code (~1k) is freed after boot. By then, the firewire stack
+          in charge of the OHCI-1394 controllers should be used instead.
+
+          See Documentation/debugging-via-ohci1394.txt for more information.
+
+config DMA_API_DEBUG
+        bool "Enable debugging of DMA-API usage"
+        depends on HAVE_DMA_API_DEBUG
+        help
+          Enable this option to debug the use of the DMA API by device drivers.
+          With this option you will be able to detect common bugs in device
+          drivers like double-freeing of DMA mappings or freeing mappings that
+          were never allocated.
+
+          This also attempts to catch cases where a page owned by DMA is
+          accessed by the cpu in a way that could cause data corruption.  For
+          example, this enables cow_user_page() to check that the source page is
+          not undergoing DMA.
+
+          This option causes a performance degradation.  Use only if you want to
+          debug device drivers and dma interactions.
+
+          If unsure, say N.
+
 menu "Runtime Testing"
 
 config LKDTM
@@ -1749,56 +1797,6 @@ config TEST_PARMAN
 
           If unsure, say N.
 
-endmenu # runtime tests
-
-config PROVIDE_OHCI1394_DMA_INIT
-        bool "Remote debugging over FireWire early on boot"
-        depends on PCI && X86
-        help
-          If you want to debug problems which hang or crash the kernel early
-          on boot and the crashing machine has a FireWire port, you can use
-          this feature to remotely access the memory of the crashed machine
-          over FireWire. This employs remote DMA as part of the OHCI1394
-          specification which is now the standard for FireWire controllers.
-
-          With remote DMA, you can monitor the printk buffer remotely using
-          firescope and access all memory below 4GB using fireproxy from gdb.
-          Even controlling a kernel debugger is possible using remote DMA.
-
-          Usage:
-
-          If ohci1394_dma=early is used as boot parameter, it will initialize
-          all OHCI1394 controllers which are found in the PCI config space.
-
-          As all changes to the FireWire bus such as enabling and disabling
-          devices cause a bus reset and thereby disable remote DMA for all
-          devices, be sure to have the cable plugged and FireWire enabled on
-          the debugging host before booting the debug target for debugging.
-
-          This code (~1k) is freed after boot. By then, the firewire stack
-          in charge of the OHCI-1394 controllers should be used instead.
-
-          See Documentation/debugging-via-ohci1394.txt for more information.
-
-config DMA_API_DEBUG
-        bool "Enable debugging of DMA-API usage"
-        depends on HAVE_DMA_API_DEBUG
-        help
-          Enable this option to debug the use of the DMA API by device drivers.
-          With this option you will be able to detect common bugs in device
-          drivers like double-freeing of DMA mappings or freeing mappings that
-          were never allocated.
-
-          This also attempts to catch cases where a page owned by DMA is
-          accessed by the cpu in a way that could cause data corruption.  For
-          example, this enables cow_user_page() to check that the source page is
-          not undergoing DMA.
-
-          This option causes a performance degradation.  Use only if you want to
-          debug device drivers and dma interactions.
-
-          If unsure, say N.
-
 config TEST_LKM
         tristate "Test module loading with 'hello world' module"
         default n
@@ -1873,18 +1871,6 @@ config TEST_UDELAY
 
           If unsure, say N.
 
-config MEMTEST
-        bool "Memtest"
-        depends on HAVE_MEMBLOCK
-        ---help---
-          This option adds a kernel parameter 'memtest', which allows memtest
-          to be set.
-                memtest=0, mean disabled; -- default
-                memtest=1, mean do 1 test pattern;
-                ...
-                memtest=17, mean do 17 test patterns.
-          If you are unsure how to answer this question, answer N.
-
 config TEST_STATIC_KEYS
         tristate "Test static keys"
         default n
@@ -1894,16 +1880,6 @@ config TEST_STATIC_KEYS
 
           If unsure, say N.
 
-config BUG_ON_DATA_CORRUPTION
-        bool "Trigger a BUG when data corruption is detected"
-        select DEBUG_LIST
-        help
-          Select this option if the kernel should BUG when it encounters
-          data corruption in kernel memory structures when they get checked
-          for validity.
-
-          If unsure, say N.
-
 config TEST_KMOD
         tristate "kmod stress tester"
         default n
@@ -1941,6 +1917,29 @@ config TEST_DEBUG_VIRTUAL
 
           If unsure, say N.
 
+endmenu # runtime tests
+
+config MEMTEST
+        bool "Memtest"
+        depends on HAVE_MEMBLOCK
+        ---help---
+          This option adds a kernel parameter 'memtest', which allows memtest
+          to be set.
+                memtest=0, mean disabled; -- default
+                memtest=1, mean do 1 test pattern;
+                ...
+                memtest=17, mean do 17 test patterns.
+          If you are unsure how to answer this question, answer N.
+
+config BUG_ON_DATA_CORRUPTION
+        bool "Trigger a BUG when data corruption is detected"
+        select DEBUG_LIST
+        help
+          Select this option if the kernel should BUG when it encounters
+          data corruption in kernel memory structures when they get checked
+          for validity.
+
+          If unsure, say N.
 
 source "samples/Kconfig"
 
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 155c55d8db5f..4e53be8bc590 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -598,21 +598,31 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
                 if ((edit->segment_cache[ASSOC_ARRAY_FAN_OUT] ^ base_seg) == 0)
                         goto all_leaves_cluster_together;
 
-                /* Otherwise we can just insert a new node ahead of the old
-                 * one.
+                /* Otherwise all the old leaves cluster in the same slot, but
+                 * the new leaf wants to go into a different slot - so we
+                 * create a new node (n0) to hold the new leaf and a pointer to
+                 * a new node (n1) holding all the old leaves.
+                 *
+                 * This can be done by falling through to the node splitting
+                 * path.
                  */
-                goto present_leaves_cluster_but_not_new_leaf;
+                pr_devel("present leaves cluster but not new leaf\n");
         }
 
 split_node:
         pr_devel("split node\n");
 
-        /* We need to split the current node; we know that the node doesn't
-         * simply contain a full set of leaves that cluster together (it
-         * contains meta pointers and/or non-clustering leaves).
+        /* We need to split the current node.  The node must contain anything
+         * from a single leaf (in the one leaf case, this leaf will cluster
+         * with the new leaf) and the rest meta-pointers, to all leaves, some
+         * of which may cluster.
+         *
+         * It won't contain the case in which all the current leaves plus the
+         * new leaves want to cluster in the same slot.
          *
          * We need to expel at least two leaves out of a set consisting of the
-         * leaves in the node and the new leaf.
+         * leaves in the node and the new leaf.  The current meta pointers can
+         * just be copied as they shouldn't cluster with any of the leaves.
          *
          * We need a new node (n0) to replace the current one and a new node to
          * take the expelled nodes (n1).
@@ -717,33 +727,6 @@ found_slot_for_multiple_occupancy:
         pr_devel("<--%s() = ok [split node]\n", __func__);
         return true;
 
-present_leaves_cluster_but_not_new_leaf:
-        /* All the old leaves cluster in the same slot, but the new leaf wants
-         * to go into a different slot, so we create a new node to hold the new
-         * leaf and a pointer to a new node holding all the old leaves.
-         */
-        pr_devel("present leaves cluster but not new leaf\n");
-
-        new_n0->back_pointer = node->back_pointer;
-        new_n0->parent_slot = node->parent_slot;
-        new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch;
-        new_n1->back_pointer = assoc_array_node_to_ptr(new_n0);
-        new_n1->parent_slot = edit->segment_cache[0];
-        new_n1->nr_leaves_on_branch = node->nr_leaves_on_branch;
-        edit->adjust_count_on = new_n0;
-
-        for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++)
-                new_n1->slots[i] = node->slots[i];
-
-        new_n0->slots[edit->segment_cache[0]] = assoc_array_node_to_ptr(new_n0);
-        edit->leaf_p = &new_n0->slots[edit->segment_cache[ASSOC_ARRAY_FAN_OUT]];
-
-        edit->set[0].ptr = &assoc_array_ptr_to_node(node->back_pointer)->slots[node->parent_slot];
-        edit->set[0].to = assoc_array_node_to_ptr(new_n0);
-        edit->excised_meta[0] = assoc_array_node_to_ptr(node);
-        pr_devel("<--%s() = ok [insert node before]\n", __func__);
-        return true;
-
 all_leaves_cluster_together:
         /* All the leaves, new and old, want to cluster together in this node
          * in the same slot, so we have to replace this node with a shortcut to
diff --git a/lib/digsig.c b/lib/digsig.c
index 03d7c63837ae..6ba6fcd92dd1 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
         down_read(&key->sem);
         ukp = user_key_payload_locked(key);
 
+        if (!ukp) {
+                /* key was revoked before we acquired its semaphore */
+                err = -EKEYREVOKED;
+                goto err1;
+        }
+
         if (ukp->datalen < sizeof(*pkh))
                 goto err1;
 
diff --git a/lib/idr.c b/lib/idr.c
index f9adf4805fd7..edd9b2be1651 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -146,8 +146,8 @@ EXPORT_SYMBOL(idr_get_next_ext);
  * idr_alloc() and idr_remove() (as long as the ID being removed is not
  * the one being replaced!).
  *
- * Returns: 0 on success.  %-ENOENT indicates that @id was not found.
- * %-EINVAL indicates that @id or @ptr were not valid.
+ * Returns: the old value on success.  %-ENOENT indicates that @id was not
+ * found.  %-EINVAL indicates that @id or @ptr were not valid.
  */
 void *idr_replace(struct idr *idr, void *ptr, int id)
 {
diff --git a/lib/ioremap.c b/lib/ioremap.c
index 4bb30206b942..c835f9080c43 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -161,6 +161,7 @@ int ioremap_page_range(unsigned long addr,
         unsigned long next;
         int err;
 
+        might_sleep();
         BUG_ON(addr >= end);
 
         start = addr;
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index e590523ea476..f237a09a5862 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -294,6 +294,26 @@ static void cleanup_uevent_env(struct subprocess_info *info)
 }
 #endif
 
+static void zap_modalias_env(struct kobj_uevent_env *env)
+{
+        static const char modalias_prefix[] = "MODALIAS=";
+        int i;
+
+        for (i = 0; i < env->envp_idx;) {
+                if (strncmp(env->envp[i], modalias_prefix,
+                            sizeof(modalias_prefix) - 1)) {
+                        i++;
+                        continue;
+                }
+
+                if (i != env->envp_idx - 1)
+                        memmove(&env->envp[i], &env->envp[i + 1],
+                                sizeof(env->envp[i]) * env->envp_idx - 1);
+
+                env->envp_idx--;
+        }
+}
+
 /**
  * kobject_uevent_env - send an uevent with environmental data
  *
@@ -409,16 +429,29 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
                 }
         }
 
-        /*
-         * Mark "add" and "remove" events in the object to ensure proper
-         * events to userspace during automatic cleanup. If the object did
-         * send an "add" event, "remove" will automatically generated by
-         * the core, if not already done by the caller.
-         */
-        if (action == KOBJ_ADD)
+        switch (action) {
+        case KOBJ_ADD:
+                /*
+                 * Mark "add" event so we can make sure we deliver "remove"
+                 * event to userspace during automatic cleanup. If
+                 * the object did send an "add" event, "remove" will
+                 * automatically generated by the core, if not already done
+                 * by the caller.
+                 */
                 kobj->state_add_uevent_sent = 1;
-        else if (action == KOBJ_REMOVE)
+                break;
+
+        case KOBJ_REMOVE:
                 kobj->state_remove_uevent_sent = 1;
+                break;
+
+        case KOBJ_UNBIND:
+                zap_modalias_env(env);
+                break;
+
+        default:
+                break;
+        }
 
         mutex_lock(&uevent_sock_mutex);
         /* we will send an event, so request a new sequence number */
diff --git a/lib/locking-selftest.c b/lib/locking-selftest.c
index cd0b5c964bd0..2b827b8a1d8c 100644
--- a/lib/locking-selftest.c
+++ b/lib/locking-selftest.c
@@ -2031,11 +2031,13 @@ void locking_selftest(void)
         print_testname("mixed read-lock/lock-write ABBA");
         pr_cont("             |");
         dotest(rlock_ABBA1, FAILURE, LOCKTYPE_RWLOCK);
+#ifdef CONFIG_PROVE_LOCKING
         /*
          * Lockdep does indeed fail here, but there's nothing we can do about
          * that now.  Don't kill lockdep for it.
          */
         unexpected_testcase_failures--;
+#endif
 
         pr_cont("             |");
         dotest(rwsem_ABBA1, FAILURE, LOCKTYPE_RWSEM);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index bd3574312b82..141734d255e4 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -85,8 +85,8 @@ static FORCE_INLINE int LZ4_decompress_generic(
         const BYTE * const lowLimit = lowPrefix - dictSize;
 
         const BYTE * const dictEnd = (const BYTE *)dictStart + dictSize;
-        const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
-        const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
+        static const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
+        static const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
 
         const int safeDecode = (endOnInput == endOnInputSize);
         const int checkOffset = ((safeDecode) && (dictSize < (int)(64 * KB)));
diff --git a/lib/ratelimit.c b/lib/ratelimit.c
index 08f8043cac61..d01f47135239 100644
--- a/lib/ratelimit.c
+++ b/lib/ratelimit.c
@@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
         if (time_is_before_jiffies(rs->begin + rs->interval)) {
                 if (rs->missed) {
                         if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
-                                pr_warn("%s: %d callbacks suppressed\n", func, rs->missed);
+                                printk_deferred(KERN_WARNING
+                                                "%s: %d callbacks suppressed\n",
+                                                func, rs->missed);
                                 rs->missed = 0;
                         }
                 }
diff --git a/lib/ts_fsm.c b/lib/ts_fsm.c
index 5696a35184e4..69557c74ef9f 100644
--- a/lib/ts_fsm.c
+++ b/lib/ts_fsm.c
@@ -11,7 +11,7 @@
  * ==========================================================================
  *
  *   A finite state machine consists of n states (struct ts_fsm_token)
- *   representing the pattern as a finite automation. The data is read
+ *   representing the pattern as a finite automaton. The data is read
  *   sequentially on an octet basis. Every state token specifies the number
  *   of recurrences and the type of value accepted which can be either a
  *   specific character or ctype based set of characters. The available
diff --git a/lib/ts_kmp.c b/lib/ts_kmp.c
index 632f783e65f1..ffbe66cbb0ed 100644
--- a/lib/ts_kmp.c
+++ b/lib/ts_kmp.c
@@ -27,7 +27,7 @@
  *
  *   [1] Cormen, Leiserson, Rivest, Stein
  *       Introdcution to Algorithms, 2nd Edition, MIT Press
- *   [2] See finite automation theory
+ *   [2] See finite automaton theory
  */
 
 #include <linux/module.h>
diff --git a/mm/cma.c b/mm/cma.c
index c0da318c020e..022e52bd8370 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -460,7 +460,7 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
 
         trace_cma_alloc(pfn, page, count, align);
 
-        if (ret) {
+        if (ret && !(gfp_mask & __GFP_NOWARN)) {
                 pr_info("%s: alloc failed, req-size: %zu pages, ret: %d\n",
                         __func__, count, ret);
                 cma_debug_show_areas(cma);
diff --git a/mm/compaction.c b/mm/compaction.c
index fb548e4c7bd4..03d31a875341 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1999,17 +1999,14 @@ void wakeup_kcompactd(pg_data_t *pgdat, int order, int classzone_idx)
         if (pgdat->kcompactd_max_order < order)
                 pgdat->kcompactd_max_order = order;
 
-        /*
-         * Pairs with implicit barrier in wait_event_freezable()
-         * such that wakeups are not missed in the lockless
-         * waitqueue_active() call.
-         */
-        smp_acquire__after_ctrl_dep();
-
         if (pgdat->kcompactd_classzone_idx > classzone_idx)
                 pgdat->kcompactd_classzone_idx = classzone_idx;
 
-        if (!waitqueue_active(&pgdat->kcompactd_wait))
+        /*
+         * Pairs with implicit barrier in wait_event_freezable()
+         * such that wakeups are not missed.
+         */
+        if (!wq_has_sleeper(&pgdat->kcompactd_wait))
                 return;
 
         if (!kcompactd_node_suitable(pgdat))
diff --git a/mm/filemap.c b/mm/filemap.c
index 870971e20967..594d73fef8b4 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -620,6 +620,14 @@ int file_check_and_advance_wb_err(struct file *file)
                 trace_file_check_and_advance_wb_err(file, old);
                 spin_unlock(&file->f_lock);
         }
+
+        /*
+         * We're mostly using this function as a drop in replacement for
+         * filemap_check_errors. Clear AS_EIO/AS_ENOSPC to emulate the effect
+         * that the legacy code would have had on these flags.
+         */
+        clear_bit(AS_EIO, &mapping->flags);
+        clear_bit(AS_ENOSPC, &mapping->flags);
         return err;
 }
 EXPORT_SYMBOL(file_check_and_advance_wb_err);
@@ -2926,9 +2934,15 @@ generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from)
          * we're writing.  Either one is a pretty crazy thing to do,
          * so we don't support it 100%.  If this invalidation
          * fails, tough, the write still worked...
+         *
+         * Most of the time we do not need this since dio_complete() will do
+         * the invalidation for us. However there are some file systems that
+         * do not end up with dio_complete() being called, so let's not break
+         * them by removing it completely
          */
-        invalidate_inode_pages2_range(mapping,
-                                pos >> PAGE_SHIFT, end);
+        if (mapping->nrpages)
+                invalidate_inode_pages2_range(mapping,
+                                        pos >> PAGE_SHIFT, end);
 
         if (written > 0) {
                 pos += written;
diff --git a/mm/ksm.c b/mm/ksm.c
index 15dd7415f7b3..6cb60f46cce5 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1990,6 +1990,7 @@ static void stable_tree_append(struct rmap_item *rmap_item,
  */
 static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
 {
+        struct mm_struct *mm = rmap_item->mm;
         struct rmap_item *tree_rmap_item;
         struct page *tree_page = NULL;
         struct stable_node *stable_node;
@@ -2062,9 +2063,11 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
         if (ksm_use_zero_pages && (checksum == zero_checksum)) {
                 struct vm_area_struct *vma;
 
-                vma = find_mergeable_vma(rmap_item->mm, rmap_item->address);
+                down_read(&mm->mmap_sem);
+                vma = find_mergeable_vma(mm, rmap_item->address);
                 err = try_to_merge_one_page(vma, page,
                                             ZERO_PAGE(rmap_item->address));
+                up_read(&mm->mmap_sem);
                 /*
                  * In case of failure, the page was not really empty, so we
                  * need to continue. Otherwise we're done.
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 7a40fa2be858..f141f0c80ff3 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -325,12 +325,12 @@ static int memcg_init_list_lru_node(struct list_lru_node *nlru)
 {
         int size = memcg_nr_cache_ids;
 
-        nlru->memcg_lrus = kmalloc(size * sizeof(void *), GFP_KERNEL);
+        nlru->memcg_lrus = kvmalloc(size * sizeof(void *), GFP_KERNEL);
         if (!nlru->memcg_lrus)
                 return -ENOMEM;
 
         if (__memcg_init_list_lru_node(nlru->memcg_lrus, 0, size)) {
-                kfree(nlru->memcg_lrus);
+                kvfree(nlru->memcg_lrus);
                 return -ENOMEM;
         }
 
@@ -340,7 +340,7 @@ static int memcg_init_list_lru_node(struct list_lru_node *nlru)
 static void memcg_destroy_list_lru_node(struct list_lru_node *nlru)
 {
         __memcg_destroy_list_lru_node(nlru->memcg_lrus, 0, memcg_nr_cache_ids);
-        kfree(nlru->memcg_lrus);
+        kvfree(nlru->memcg_lrus);
 }
 
 static int memcg_update_list_lru_node(struct list_lru_node *nlru,
@@ -351,12 +351,12 @@ static int memcg_update_list_lru_node(struct list_lru_node *nlru,
         BUG_ON(old_size > new_size);
 
         old = nlru->memcg_lrus;
-        new = kmalloc(new_size * sizeof(void *), GFP_KERNEL);
+        new = kvmalloc(new_size * sizeof(void *), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
         if (__memcg_init_list_lru_node(new, old_size, new_size)) {
-                kfree(new);
+                kvfree(new);
                 return -ENOMEM;
         }
 
@@ -373,7 +373,7 @@ static int memcg_update_list_lru_node(struct list_lru_node *nlru,
         nlru->memcg_lrus = new;
         spin_unlock_irq(&nlru->lock);
 
-        kfree(old);
+        kvfree(old);
         return 0;
 }
 
diff --git a/mm/madvise.c b/mm/madvise.c
index 21261ff0466f..fd70d6aabc3e 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -625,18 +625,26 @@ static int madvise_inject_error(int behavior,
 {
         struct page *page;
         struct zone *zone;
+        unsigned int order;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        for (; start < end; start += PAGE_SIZE <<
-                                compound_order(compound_head(page))) {
+
+        for (; start < end; start += PAGE_SIZE << order) {
                 int ret;
 
                 ret = get_user_pages_fast(start, 1, 0, &page);
                 if (ret != 1)
                         return ret;
 
+                /*
+                 * When soft offlining hugepages, after migrating the page
+                 * we dissolve it, therefore in the second loop "page" will
+                 * no longer be a compound page, and order will be 0.
+                 */
+                order = compound_order(compound_head(page));
+
                 if (PageHWPoison(page)) {
                         put_page(page);
                         continue;
@@ -749,6 +757,9 @@ madvise_behavior_valid(int behavior)
  *  MADV_DONTFORK - omit this area from child's address space when forking:
  *              typically, to avoid COWing pages pinned by get_user_pages().
  *  MADV_DOFORK - cancel MADV_DONTFORK: no longer omit this area when forking.
+ *  MADV_WIPEONFORK - present the child process with zero-filled memory in this
+ *              range after a fork.
+ *  MADV_KEEPONFORK - undo the effect of MADV_WIPEONFORK
  *  MADV_HWPOISON - trigger memory error handler as if the given memory range
  *              were corrupted by unrecoverable hardware memory failure.
  *  MADV_SOFT_OFFLINE - try to soft-offline the given range of memory.
@@ -769,7 +780,9 @@ madvise_behavior_valid(int behavior)
  *  zero    - success
  *  -EINVAL - start + len < 0, start is not page-aligned,
  *              "behavior" is not a valid value, or application
- *              is attempting to release locked or shared pages.
+ *              is attempting to release locked or shared pages,
+ *              or the specified address range includes file, Huge TLB,
+ *              MAP_SHARED or VMPFNMAP range.
  *  -ENOMEM - addresses in the specified range are not currently
  *              mapped, or are outside the AS of the process.
  *  -EIO    - an I/O error occurred while paging in data.
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 15af3da5af02..661f046ad318 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1777,6 +1777,10 @@ static void drain_local_stock(struct work_struct *dummy)
         struct memcg_stock_pcp *stock;
         unsigned long flags;
 
+        /*
+         * The only protection from memory hotplug vs. drain_stock races is
+         * that we always operate on local CPU stock here with IRQ disabled
+         */
         local_irq_save(flags);
 
         stock = this_cpu_ptr(&memcg_stock);
@@ -1821,27 +1825,33 @@ static void drain_all_stock(struct mem_cgroup *root_memcg)
         /* If someone's already draining, avoid adding running more workers. */
         if (!mutex_trylock(&percpu_charge_mutex))
                 return;
-        /* Notify other cpus that system-wide "drain" is running */
-        get_online_cpus();
+        /*
+         * Notify other cpus that system-wide "drain" is running
+         * We do not care about races with the cpu hotplug because cpu down
+         * as well as workers from this path always operate on the local
+         * per-cpu data. CPU up doesn't touch memcg_stock at all.
+         */
         curcpu = get_cpu();
         for_each_online_cpu(cpu) {
                 struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
                 struct mem_cgroup *memcg;
 
                 memcg = stock->cached;
-                if (!memcg || !stock->nr_pages)
+                if (!memcg || !stock->nr_pages || !css_tryget(&memcg->css))
                         continue;
-                if (!mem_cgroup_is_descendant(memcg, root_memcg))
+                if (!mem_cgroup_is_descendant(memcg, root_memcg)) {
+                        css_put(&memcg->css);
                         continue;
+                }
                 if (!test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) {
                         if (cpu == curcpu)
                                 drain_local_stock(&stock->work);
                         else
                                 schedule_work_on(cpu, &stock->work);
                 }
+                css_put(&memcg->css);
         }
         put_cpu();
-        put_online_cpus();
         mutex_unlock(&percpu_charge_mutex);
 }
 
@@ -5648,7 +5658,8 @@ static void uncharge_batch(const struct uncharge_gather *ug)
 static void uncharge_page(struct page *page, struct uncharge_gather *ug)
 {
         VM_BUG_ON_PAGE(PageLRU(page), page);
-        VM_BUG_ON_PAGE(!PageHWPoison(page) && page_count(page), page);
+        VM_BUG_ON_PAGE(page_count(page) && !is_zone_device_page(page) &&
+                        !PageHWPoison(page) , page);
 
         if (!page->mem_cgroup)
                 return;
@@ -5817,21 +5828,6 @@ void mem_cgroup_sk_alloc(struct sock *sk)
         if (!mem_cgroup_sockets_enabled)
                 return;
 
-        /*
-         * Socket cloning can throw us here with sk_memcg already
-         * filled. It won't however, necessarily happen from
-         * process context. So the test for root memcg given
-         * the current task's memcg won't help us in this case.
-         *
-         * Respecting the original socket's memcg is a better
-         * decision in this case.
-         */
-        if (sk->sk_memcg) {
-                BUG_ON(mem_cgroup_is_root(sk->sk_memcg));
-                css_get(&sk->sk_memcg->css);
-                return;
-        }
-
         rcu_read_lock();
         memcg = mem_cgroup_from_task(current);
         if (memcg == root_mem_cgroup)
diff --git a/mm/memory.c b/mm/memory.c
index ec4e15494901..a728bed16c20 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -845,7 +845,7 @@ struct page *_vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                  * vm_normal_page() so that we do not have to special case all
                  * call site of vm_normal_page().
                  */
-                if (likely(pfn < highest_memmap_pfn)) {
+                if (likely(pfn <= highest_memmap_pfn)) {
                         struct page *page = pfn_to_page(pfn);
 
                         if (is_device_public_page(page)) {
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index e882cb6da994..d4b5f29906b9 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -328,6 +328,7 @@ int __ref __add_pages(int nid, unsigned long phys_start_pfn,
                 if (err && (err != -EEXIST))
                         break;
                 err = 0;
+                cond_resched();
         }
         vmemmap_populate_print_last();
 out:
@@ -337,7 +338,7 @@ EXPORT_SYMBOL_GPL(__add_pages);
 
 #ifdef CONFIG_MEMORY_HOTREMOVE
 /* find the smallest valid pfn in the range [start_pfn, end_pfn) */
-static int find_smallest_section_pfn(int nid, struct zone *zone,
+static unsigned long find_smallest_section_pfn(int nid, struct zone *zone,
                                      unsigned long start_pfn,
                                      unsigned long end_pfn)
 {
@@ -362,7 +363,7 @@ static int find_smallest_section_pfn(int nid, struct zone *zone,
 }
 
 /* find the biggest valid pfn in the range [start_pfn, end_pfn). */
-static int find_biggest_section_pfn(int nid, struct zone *zone,
+static unsigned long find_biggest_section_pfn(int nid, struct zone *zone,
                                     unsigned long start_pfn,
                                     unsigned long end_pfn)
 {
@@ -550,7 +551,7 @@ static int __remove_section(struct zone *zone, struct mem_section *ms,
                 return ret;
 
         scn_nr = __section_nr(ms);
-        start_pfn = section_nr_to_pfn(scn_nr);
+        start_pfn = section_nr_to_pfn((unsigned long)scn_nr);
         __remove_zone(zone, start_pfn);
 
         sparse_remove_one_section(zone, ms, map_offset);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 006ba625c0b8..a2af6d58a68f 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1920,8 +1920,11 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
         struct page *page;
 
         page = __alloc_pages(gfp, order, nid);
-        if (page && page_to_nid(page) == nid)
-                inc_zone_page_state(page, NUMA_INTERLEAVE_HIT);
+        if (page && page_to_nid(page) == nid) {
+                preempt_disable();
+                __inc_numa_state(page_zone(page), NUMA_INTERLEAVE_HIT);
+                preempt_enable();
+        }
         return page;
 }
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 6954c1435833..e00814ca390e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2146,8 +2146,9 @@ static int migrate_vma_collect_hole(unsigned long start,
         unsigned long addr;
 
         for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
-                migrate->src[migrate->npages++] = MIGRATE_PFN_MIGRATE;
+                migrate->src[migrate->npages] = MIGRATE_PFN_MIGRATE;
                 migrate->dst[migrate->npages] = 0;
+                migrate->npages++;
                 migrate->cpages++;
         }
 
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 99736e026712..dee0f75c3013 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -40,6 +40,7 @@
 #include <linux/ratelimit.h>
 #include <linux/kthread.h>
 #include <linux/init.h>
+#include <linux/mmu_notifier.h>
 
 #include <asm/tlb.h>
 #include "internal.h"
@@ -495,6 +496,21 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
         }
 
         /*
+         * If the mm has notifiers then we would need to invalidate them around
+         * unmap_page_range and that is risky because notifiers can sleep and
+         * what they do is basically undeterministic.  So let's have a short
+         * sleep to give the oom victim some more time.
+         * TODO: we really want to get rid of this ugly hack and make sure that
+         * notifiers cannot block for unbounded amount of time and add
+         * mmu_notifier_invalidate_range_{start,end} around unmap_page_range
+         */
+        if (mm_has_notifiers(mm)) {
+                up_read(&mm->mmap_sem);
+                schedule_timeout_idle(HZ);
+                goto unlock_oom;
+        }
+
+        /*
          * MMF_OOM_SKIP is set by exit_mmap when the OOM reaper can't
          * work on the mm anymore. The check for MMF_OOM_SKIP must run
          * under mmap_sem for reading because it serializes against the
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c841af88836a..77e4d3c5c57b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1190,7 +1190,7 @@ static void __meminit __init_single_pfn(unsigned long pfn, unsigned long zone,
 }
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
-static void init_reserved_page(unsigned long pfn)
+static void __meminit init_reserved_page(unsigned long pfn)
 {
         pg_data_t *pgdat;
         int nid, zid;
@@ -5367,6 +5367,7 @@ not_early:
 
                         __init_single_page(page, pfn, zone, nid);
                         set_pageblock_migratetype(page, MIGRATE_MOVABLE);
+                        cond_resched();
                 } else {
                         __init_single_pfn(pfn, zone, nid);
                 }
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index 6a03946469a9..53afbb919a1c 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -6,17 +6,6 @@
 
 #include "internal.h"
 
-static inline bool check_pmd(struct page_vma_mapped_walk *pvmw)
-{
-        pmd_t pmde;
-        /*
-         * Make sure we don't re-load pmd between present and !trans_huge check.
-         * We need a consistent view.
-         */
-        pmde = READ_ONCE(*pvmw->pmd);
-        return pmd_present(pmde) && !pmd_trans_huge(pmde);
-}
-
 static inline bool not_found(struct page_vma_mapped_walk *pvmw)
 {
         page_vma_mapped_walk_done(pvmw);
@@ -116,6 +105,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
         pgd_t *pgd;
         p4d_t *p4d;
         pud_t *pud;
+        pmd_t pmde;
 
         /* The only possible pmd mapping has been handled on last iteration */
         if (pvmw->pmd && !pvmw->pte)
@@ -148,7 +138,13 @@ restart:
         if (!pud_present(*pud))
                 return false;
         pvmw->pmd = pmd_offset(pud, pvmw->address);
-        if (pmd_trans_huge(*pvmw->pmd) || is_pmd_migration_entry(*pvmw->pmd)) {
+        /*
+         * Make sure the pmd value isn't cached in a register by the
+         * compiler and used as a stale value after we've observed a
+         * subsequent update.
+         */
+        pmde = READ_ONCE(*pvmw->pmd);
+        if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) {
                 pvmw->ptl = pmd_lock(mm, pvmw->pmd);
                 if (likely(pmd_trans_huge(*pvmw->pmd))) {
                         if (pvmw->flags & PVMW_MIGRATION)
@@ -167,17 +163,15 @@ restart:
                                                 return not_found(pvmw);
                                         return true;
                                 }
-                        } else
-                                WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
+                        }
                         return not_found(pvmw);
                 } else {
                         /* THP pmd was split under us: handle on pte level */
                         spin_unlock(pvmw->ptl);
                         pvmw->ptl = NULL;
                 }
-        } else {
-                if (!check_pmd(pvmw))
-                        return false;
+        } else if (!pmd_present(pmde)) {
+                return false;
         }
         if (!map_pte(pvmw))
                 goto next_pte;
diff --git a/mm/percpu-stats.c b/mm/percpu-stats.c
index 6142484e88f7..7a58460bfd27 100644
--- a/mm/percpu-stats.c
+++ b/mm/percpu-stats.c
@@ -73,7 +73,7 @@ static void chunk_map_stats(struct seq_file *m, struct pcpu_chunk *chunk,
                      last_alloc + 1 : 0;
 
         as_len = 0;
-        start = chunk->start_offset;
+        start = chunk->start_offset / PCPU_MIN_ALLOC_SIZE;
 
         /*
          * If a bit is set in the allocation map, the bound_map identifies
diff --git a/mm/percpu.c b/mm/percpu.c
index 59d44d61f5f1..a0e0c82c1e4c 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -353,6 +353,8 @@ static void pcpu_next_md_free_region(struct pcpu_chunk *chunk, int *bit_off,
                                         block->contig_hint_start);
                         return;
                 }
+                /* reset to satisfy the second predicate above */
+                block_off = 0;
 
                 *bits = block->right_free;
                 *bit_off = (i + 1) * PCPU_BITMAP_BLOCK_BITS - block->right_free;
@@ -407,6 +409,8 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits,
                         *bit_off = pcpu_block_off_to_off(i, block->first_free);
                         return;
                 }
+                /* reset to satisfy the second predicate above */
+                block_off = 0;
 
                 *bit_off = ALIGN(PCPU_BITMAP_BLOCK_BITS - block->right_free,
                                  align);
@@ -1325,7 +1329,9 @@ static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
  * @gfp: allocation flags
  *
  * Allocate percpu area of @size bytes aligned at @align.  If @gfp doesn't
- * contain %GFP_KERNEL, the allocation is atomic.
+ * contain %GFP_KERNEL, the allocation is atomic. If @gfp has __GFP_NOWARN
+ * then no warning will be triggered on invalid or failed allocation
+ * requests.
  *
  * RETURNS:
  * Percpu pointer to the allocated area on success, NULL on failure.
@@ -1333,10 +1339,11 @@ static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
 static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
                                  gfp_t gfp)
 {
+        bool is_atomic = (gfp & GFP_KERNEL) != GFP_KERNEL;
+        bool do_warn = !(gfp & __GFP_NOWARN);
         static int warn_limit = 10;
         struct pcpu_chunk *chunk;
         const char *err;
-        bool is_atomic = (gfp & GFP_KERNEL) != GFP_KERNEL;
         int slot, off, cpu, ret;
         unsigned long flags;
         void __percpu *ptr;
@@ -1357,7 +1364,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
 
         if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
                      !is_power_of_2(align))) {
-                WARN(true, "illegal size (%zu) or align (%zu) for percpu allocation\n",
+                WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
                      size, align);
                 return NULL;
         }
@@ -1478,7 +1485,7 @@ fail_unlock:
 fail:
         trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
 
-        if (!is_atomic && warn_limit) {
+        if (!is_atomic && do_warn && warn_limit) {
                 pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
                         size, align, is_atomic, err);
                 dump_stack();
@@ -1503,7 +1510,9 @@ fail:
  *
  * Allocate zero-filled percpu area of @size bytes aligned at @align.  If
  * @gfp doesn't contain %GFP_KERNEL, the allocation doesn't block and can
- * be called from any context but is a lot more likely to fail.
+ * be called from any context but is a lot more likely to fail. If @gfp
+ * has __GFP_NOWARN then no warning will be triggered on invalid or failed
+ * allocation requests.
  *
  * RETURNS:
  * Percpu pointer to the allocated area on success, NULL on failure.
diff --git a/mm/rodata_test.c b/mm/rodata_test.c
index 6bb4deb12e78..d908c8769b48 100644
--- a/mm/rodata_test.c
+++ b/mm/rodata_test.c
@@ -14,7 +14,7 @@
 #include <linux/uaccess.h>
 #include <asm/sections.h>
 
-const int rodata_test_data = 0xC3;
+static const int rodata_test_data = 0xC3;
 
 void rodata_test(void)
 {
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 904a83be82de..80164599ca5d 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -165,9 +165,9 @@ static int init_memcg_params(struct kmem_cache *s,
         if (!memcg_nr_cache_ids)
                 return 0;
 
-        arr = kzalloc(sizeof(struct memcg_cache_array) +
-                      memcg_nr_cache_ids * sizeof(void *),
-                      GFP_KERNEL);
+        arr = kvzalloc(sizeof(struct memcg_cache_array) +
+                       memcg_nr_cache_ids * sizeof(void *),
+                       GFP_KERNEL);
         if (!arr)
                 return -ENOMEM;
 
@@ -178,15 +178,23 @@ static int init_memcg_params(struct kmem_cache *s,
 static void destroy_memcg_params(struct kmem_cache *s)
 {
         if (is_root_cache(s))
-                kfree(rcu_access_pointer(s->memcg_params.memcg_caches));
+                kvfree(rcu_access_pointer(s->memcg_params.memcg_caches));
+}
+
+static void free_memcg_params(struct rcu_head *rcu)
+{
+        struct memcg_cache_array *old;
+
+        old = container_of(rcu, struct memcg_cache_array, rcu);
+        kvfree(old);
 }
 
 static int update_memcg_params(struct kmem_cache *s, int new_array_size)
 {
         struct memcg_cache_array *old, *new;
 
-        new = kzalloc(sizeof(struct memcg_cache_array) +
-                      new_array_size * sizeof(void *), GFP_KERNEL);
+        new = kvzalloc(sizeof(struct memcg_cache_array) +
+                       new_array_size * sizeof(void *), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
@@ -198,7 +206,7 @@ static int update_memcg_params(struct kmem_cache *s, int new_array_size)
 
         rcu_assign_pointer(s->memcg_params.memcg_caches, new);
         if (old)
-                kfree_rcu(old, rcu);
+                call_rcu(&old->rcu, free_memcg_params);
         return 0;
 }
 
diff --git a/mm/swap.c b/mm/swap.c
index 9295ae960d66..a77d68f2c1b6 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -575,7 +575,7 @@ static void lru_lazyfree_fn(struct page *page, struct lruvec *lruvec,
                             void *arg)
 {
         if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) &&
-            !PageUnevictable(page)) {
+            !PageSwapCache(page) && !PageUnevictable(page)) {
                 bool active = PageActive(page);
 
                 del_page_from_lru_list(page, lruvec,
@@ -665,7 +665,7 @@ void deactivate_file_page(struct page *page)
 void mark_page_lazyfree(struct page *page)
 {
         if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) &&
-            !PageUnevictable(page)) {
+            !PageSwapCache(page) && !PageUnevictable(page)) {
                 struct pagevec *pvec = &get_cpu_var(lru_lazyfree_pvecs);
 
                 get_page(page);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 71ce2d1ccbf7..05b6803f0cce 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -39,10 +39,6 @@ struct address_space *swapper_spaces[MAX_SWAPFILES];
 static unsigned int nr_swapper_spaces[MAX_SWAPFILES];
 bool swap_vma_readahead = true;
 
-#define SWAP_RA_MAX_ORDER_DEFAULT       3
-
-static int swap_ra_max_order = SWAP_RA_MAX_ORDER_DEFAULT;
-
 #define SWAP_RA_WIN_SHIFT       (PAGE_SHIFT / 2)
 #define SWAP_RA_HITS_MASK       ((1UL << SWAP_RA_WIN_SHIFT) - 1)
 #define SWAP_RA_HITS_MAX        SWAP_RA_HITS_MASK
@@ -242,6 +238,17 @@ int add_to_swap(struct page *page)
                  * clear SWAP_HAS_CACHE flag.
                  */
                 goto fail;
+        /*
+         * Normally the page will be dirtied in unmap because its pte should be
+         * dirty. A special case is MADV_FREE page. The page'e pte could have
+         * dirty bit cleared but the page's SwapBacked bit is still set because
+         * clearing the dirty bit and SwapBacked bit has no lock protected. For
+         * such page, unmap will not set dirty bit for it, so page reclaim will
+         * not write the page out. This can cause data corruption when the page
+         * is swap in later. Always setting the dirty bit for the page solves
+         * the problem.
+         */
+        set_page_dirty(page);
 
         return 1;
 
@@ -653,6 +660,13 @@ struct page *swap_readahead_detect(struct vm_fault *vmf,
         pte_t *tpte;
 #endif
 
+        max_win = 1 << min_t(unsigned int, READ_ONCE(page_cluster),
+                             SWAP_RA_ORDER_CEILING);
+        if (max_win == 1) {
+                swap_ra->win = 1;
+                return NULL;
+        }
+
         faddr = vmf->address;
         entry = pte_to_swp_entry(vmf->orig_pte);
         if ((unlikely(non_swap_entry(entry))))
@@ -661,12 +675,6 @@ struct page *swap_readahead_detect(struct vm_fault *vmf,
         if (page)
                 return page;
 
-        max_win = 1 << READ_ONCE(swap_ra_max_order);
-        if (max_win == 1) {
-                swap_ra->win = 1;
-                return NULL;
-        }
-
         fpfn = PFN_DOWN(faddr);
         swap_ra_info = GET_SWAP_RA_VAL(vma);
         pfn = PFN_DOWN(SWAP_RA_ADDR(swap_ra_info));
@@ -775,32 +783,8 @@ static struct kobj_attribute vma_ra_enabled_attr =
         __ATTR(vma_ra_enabled, 0644, vma_ra_enabled_show,
                vma_ra_enabled_store);
 
-static ssize_t vma_ra_max_order_show(struct kobject *kobj,
-                                     struct kobj_attribute *attr, char *buf)
-{
-        return sprintf(buf, "%d\n", swap_ra_max_order);
-}
-static ssize_t vma_ra_max_order_store(struct kobject *kobj,
-                                      struct kobj_attribute *attr,
-                                      const char *buf, size_t count)
-{
-        int err, v;
-
-        err = kstrtoint(buf, 10, &v);
-        if (err || v > SWAP_RA_ORDER_CEILING || v <= 0)
-                return -EINVAL;
-
-        swap_ra_max_order = v;
-
-        return count;
-}
-static struct kobj_attribute vma_ra_max_order_attr =
-        __ATTR(vma_ra_max_order, 0644, vma_ra_max_order_show,
-               vma_ra_max_order_store);
-
 static struct attribute *swap_attrs[] = {
         &vma_ra_enabled_attr.attr,
-        &vma_ra_max_order_attr.attr,
         NULL,
 };
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8a43db6284eb..673942094328 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1695,11 +1695,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         for (i = 0; i < area->nr_pages; i++) {
                 struct page *page;
 
-                if (fatal_signal_pending(current)) {
-                        area->nr_pages = i;
-                        goto fail_no_warn;
-                }
-
                 if (node == NUMA_NO_NODE)
                         page = alloc_page(alloc_mask|highmem_mask);
                 else
@@ -1723,7 +1718,6 @@ fail:
         warn_alloc(gfp_mask, NULL,
                           "vmalloc: allocation failure, allocated %ld of %ld bytes",
                           (area->nr_pages*PAGE_SIZE), area->size);
-fail_no_warn:
         vfree(area->addr);
         return NULL;
 }
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 486550df32be..b2ba2ba585f3 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -250,6 +250,7 @@ static void __release_z3fold_page(struct z3fold_header *zhdr, bool locked)
 
         WARN_ON(!list_empty(&zhdr->buddy));
         set_bit(PAGE_STALE, &page->private);
+        clear_bit(NEEDS_COMPACTING, &page->private);
         spin_lock(&pool->lock);
         if (!list_empty(&page->lru))
                 list_del(&page->lru);
@@ -303,7 +304,6 @@ static void free_pages_work(struct work_struct *w)
                 list_del(&zhdr->buddy);
                 if (WARN_ON(!test_bit(PAGE_STALE, &page->private)))
                         continue;
-                clear_bit(NEEDS_COMPACTING, &page->private);
                 spin_unlock(&pool->stale_lock);
                 cancel_work_sync(&zhdr->work);
                 free_z3fold_page(page);
@@ -624,10 +624,8 @@ lookup:
          * stale pages list. cancel_work_sync() can sleep so we must make
          * sure it won't be called in case we're in atomic context.
          */
-        if (zhdr && (can_sleep || !work_pending(&zhdr->work) ||
-            !unlikely(work_busy(&zhdr->work)))) {
+        if (zhdr && (can_sleep || !work_pending(&zhdr->work))) {
                 list_del(&zhdr->buddy);
-                clear_bit(NEEDS_COMPACTING, &page->private);
                 spin_unlock(&pool->stale_lock);
                 if (can_sleep)
                         cancel_work_sync(&zhdr->work);
@@ -875,16 +873,18 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
                                 goto next;
                 }
 next:
+                spin_lock(&pool->lock);
                 if (test_bit(PAGE_HEADLESS, &page->private)) {
                         if (ret == 0) {
+                                spin_unlock(&pool->lock);
                                 free_z3fold_page(page);
                                 return 0;
                         }
                 } else if (kref_put(&zhdr->refcount, release_z3fold_page)) {
                         atomic64_dec(&pool->pages_nr);
+                        spin_unlock(&pool->lock);
                         return 0;
                 }
-                spin_lock(&pool->lock);
 
                 /*
                  * Add to the beginning of LRU.
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e2ed69850489..0bc31de9071a 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -21,6 +21,12 @@ bool vlan_do_receive(struct sk_buff **skbp)
         if (unlikely(!skb))
                 return false;
 
+        if (unlikely(!(vlan_dev->flags & IFF_UP))) {
+                kfree_skb(skb);
+                *skbp = NULL;
+                return false;
+        }
+
         skb->dev = vlan_dev;
         if (unlikely(skb->pkt_type == PACKET_OTHERHOST)) {
                 /* Our lower layer thinks this is not local, let's make sure.
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index c18115d22f00..db82a40875e8 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -126,14 +126,4 @@ config BT_DEBUGFS
           Provide extensive information about internal Bluetooth states
           in debugfs.
 
-config BT_LEGACY_IOCTL
-        bool "Enable legacy ioctl interfaces"
-        depends on BT && BT_BREDR
-        default y
-        help
-          Enable support for legacy ioctl interfaces.  This is only needed
-          for old and deprecated applications using direct ioctl calls for
-          controller management.  Since Linux 3.4 all configuration and
-          setup is done via mgmt interface and this is no longer needed.
-
 source "drivers/bluetooth/Kconfig"
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 0bad296fe0af..65d734c165bd 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -878,7 +878,6 @@ static int hci_sock_release(struct socket *sock)
         return 0;
 }
 
-#ifdef CONFIG_BT_LEGACY_IOCTL
 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 {
         bdaddr_t bdaddr;
@@ -1050,7 +1049,6 @@ done:
         release_sock(sk);
         return err;
 }
-#endif
 
 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
                          int addr_len)
@@ -1971,11 +1969,7 @@ static const struct proto_ops hci_sock_ops = {
         .getname        = hci_sock_getname,
         .sendmsg        = hci_sock_sendmsg,
         .recvmsg        = hci_sock_recvmsg,
-#ifdef CONFIG_BT_LEGACY_IOCTL
         .ioctl          = hci_sock_ioctl,
-#else
-        .ioctl          = sock_no_ioctl,
-#endif
         .poll           = datagram_poll,
         .listen         = sock_no_listen,
         .shutdown       = sock_no_shutdown,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 3bc890716c89..de2152730809 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -573,7 +573,7 @@ static int br_process_vlan_info(struct net_bridge *br,
                 }
                 *vinfo_last = NULL;
 
-                return 0;
+                return err;
         }
 
         return br_vlan_info(br, p, cmd, vinfo_curr);
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index 2585b100ebbb..276b60262981 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -65,8 +65,8 @@ static int ebt_broute(struct sk_buff *skb)
 
 static int __net_init broute_net_init(struct net *net)
 {
-        net->xt.broute_table = ebt_register_table(net, &broute_table, NULL);
-        return PTR_ERR_OR_ZERO(net->xt.broute_table);
+        return ebt_register_table(net, &broute_table, NULL,
+                                  &net->xt.broute_table);
 }
 
 static void __net_exit broute_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 45a00dbdbcad..c41da5fac84f 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_filter[] = {
 
 static int __net_init frame_filter_net_init(struct net *net)
 {
-        net->xt.frame_filter = ebt_register_table(net, &frame_filter, ebt_ops_filter);
-        return PTR_ERR_OR_ZERO(net->xt.frame_filter);
+        return ebt_register_table(net, &frame_filter, ebt_ops_filter,
+                                  &net->xt.frame_filter);
 }
 
 static void __net_exit frame_filter_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 57cd5bb154e7..08df7406ecb3 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_nat[] = {
 
 static int __net_init frame_nat_net_init(struct net *net)
 {
-        net->xt.frame_nat = ebt_register_table(net, &frame_nat, ebt_ops_nat);
-        return PTR_ERR_OR_ZERO(net->xt.frame_nat);
+        return ebt_register_table(net, &frame_nat, ebt_ops_nat,
+                                  &net->xt.frame_nat);
 }
 
 static void __net_exit frame_nat_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 83951f978445..3b3dcf719e07 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1169,9 +1169,8 @@ static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
         kfree(table);
 }
 
-struct ebt_table *
-ebt_register_table(struct net *net, const struct ebt_table *input_table,
-                   const struct nf_hook_ops *ops)
+int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+                       const struct nf_hook_ops *ops, struct ebt_table **res)
 {
         struct ebt_table_info *newinfo;
         struct ebt_table *t, *table;
@@ -1183,7 +1182,7 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table,
             repl->entries == NULL || repl->entries_size == 0 ||
             repl->counters != NULL || input_table->private != NULL) {
                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
-                return ERR_PTR(-EINVAL);
+                return -EINVAL;
         }
 
         /* Don't add one table to multiple lists. */
@@ -1252,16 +1251,18 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table,
         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
         mutex_unlock(&ebt_mutex);
 
+        WRITE_ONCE(*res, table);
+
         if (!ops)
-                return table;
+                return 0;
 
         ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
         if (ret) {
                 __ebt_unregister_table(net, table);
-                return ERR_PTR(ret);
+                *res = NULL;
         }
 
-        return table;
+        return ret;
 free_unlock:
         mutex_unlock(&ebt_mutex);
 free_chainstack:
@@ -1276,7 +1277,7 @@ free_newinfo:
 free_table:
         kfree(table);
 out:
-        return ERR_PTR(ret);
+        return ret;
 }
 
 void ebt_unregister_table(struct net *net, struct ebt_table *table,
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 88edac0f3e36..ecd5c703d11e 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -78,7 +78,7 @@ MODULE_PARM_DESC(stats_timer, "enable timer for statistics (default:on)");
 static struct kmem_cache *rcv_cache __read_mostly;
 
 /* table of registered CAN protocols */
-static const struct can_proto *proto_tab[CAN_NPROTO] __read_mostly;
+static const struct can_proto __rcu *proto_tab[CAN_NPROTO] __read_mostly;
 static DEFINE_MUTEX(proto_tab_lock);
 
 static atomic_t skbcounter = ATOMIC_INIT(0);
@@ -788,7 +788,7 @@ int can_proto_register(const struct can_proto *cp)
 
         mutex_lock(&proto_tab_lock);
 
-        if (proto_tab[proto]) {
+        if (rcu_access_pointer(proto_tab[proto])) {
                 pr_err("can: protocol %d already registered\n", proto);
                 err = -EBUSY;
         } else
@@ -812,7 +812,7 @@ void can_proto_unregister(const struct can_proto *cp)
         int proto = cp->protocol;
 
         mutex_lock(&proto_tab_lock);
-        BUG_ON(proto_tab[proto] != cp);
+        BUG_ON(rcu_access_pointer(proto_tab[proto]) != cp);
         RCU_INIT_POINTER(proto_tab[proto], NULL);
         mutex_unlock(&proto_tab_lock);
 
@@ -875,9 +875,14 @@ static int can_pernet_init(struct net *net)
         spin_lock_init(&net->can.can_rcvlists_lock);
         net->can.can_rx_alldev_list =
                 kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
-
+        if (!net->can.can_rx_alldev_list)
+                goto out;
         net->can.can_stats = kzalloc(sizeof(struct s_stats), GFP_KERNEL);
+        if (!net->can.can_stats)
+                goto out_free_alldev_list;
         net->can.can_pstats = kzalloc(sizeof(struct s_pstats), GFP_KERNEL);
+        if (!net->can.can_pstats)
+                goto out_free_can_stats;
 
         if (IS_ENABLED(CONFIG_PROC_FS)) {
                 /* the statistics are updated every second (timer triggered) */
@@ -892,6 +897,13 @@ static int can_pernet_init(struct net *net)
         }
 
         return 0;
+
+ out_free_can_stats:
+        kfree(net->can.can_stats);
+ out_free_alldev_list:
+        kfree(net->can.can_rx_alldev_list);
+ out:
+        return -ENOMEM;
 }
 
 static void can_pernet_exit(struct net *net)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 47a8748d953a..13690334efa3 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1493,13 +1493,14 @@ static int bcm_init(struct sock *sk)
 static int bcm_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct net *net = sock_net(sk);
+        struct net *net;
         struct bcm_sock *bo;
         struct bcm_op *op, *next;
 
-        if (sk == NULL)
+        if (!sk)
                 return 0;
 
+        net = sock_net(sk);
         bo = bcm_sk(sk);
 
         /* remove bcm_ops, timer, rx_unregister(), etc. */
diff --git a/net/core/dev.c b/net/core/dev.c
index 588b473194a8..11596a302a26 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1147,9 +1147,8 @@ static int dev_alloc_name_ns(struct net *net,
         return ret;
 }
 
-static int dev_get_valid_name(struct net *net,
-                              struct net_device *dev,
-                              const char *name)
+int dev_get_valid_name(struct net *net, struct net_device *dev,
+                       const char *name)
 {
         BUG_ON(!net);
 
@@ -1165,6 +1164,7 @@ static int dev_get_valid_name(struct net *net,
 
         return 0;
 }
+EXPORT_SYMBOL(dev_get_valid_name);
 
 /**
  *      dev_change_name - change name of a device
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 709a4e6fb447..f9c7a88cd981 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -303,7 +303,18 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
         case SIOCSIFTXQLEN:
                 if (ifr->ifr_qlen < 0)
                         return -EINVAL;
-                dev->tx_queue_len = ifr->ifr_qlen;
+                if (dev->tx_queue_len ^ ifr->ifr_qlen) {
+                        unsigned int orig_len = dev->tx_queue_len;
+
+                        dev->tx_queue_len = ifr->ifr_qlen;
+                        err = call_netdevice_notifiers(
+                                        NETDEV_CHANGE_TX_QUEUE_LEN, dev);
+                        err = notifier_to_errno(err);
+                        if (err) {
+                                dev->tx_queue_len = orig_len;
+                                return err;
+                        }
+                }
                 return 0;
 
         case SIOCSIFNAME:
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 3228411ada0f..9a9a3d77e327 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -436,7 +436,7 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32,
 EXPORT_SYMBOL(ethtool_convert_link_mode_to_legacy_u32);
 
 /* return false if legacy contained non-0 deprecated fields
- * transceiver/maxtxpkt/maxrxpkt. rest of ksettings always updated
+ * maxtxpkt/maxrxpkt. rest of ksettings always updated
  */
 static bool
 convert_legacy_settings_to_link_ksettings(
@@ -451,8 +451,7 @@ convert_legacy_settings_to_link_ksettings(
          * deprecated legacy fields, and they should not use
          * %ETHTOOL_GLINKSETTINGS/%ETHTOOL_SLINKSETTINGS
          */
-        if (legacy_settings->transceiver ||
-            legacy_settings->maxtxpkt ||
+        if (legacy_settings->maxtxpkt ||
             legacy_settings->maxrxpkt)
                 retval = false;
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 82edad58d066..6ae94f825f72 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -989,10 +989,14 @@ static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 
 bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 {
-        bool ret = __sk_filter_charge(sk, fp);
-        if (ret)
-                refcount_inc(&fp->refcnt);
-        return ret;
+        if (!refcount_inc_not_zero(&fp->refcnt))
+                return false;
+
+        if (!__sk_filter_charge(sk, fp)) {
+                sk_filter_release(fp);
+                return false;
+        }
+        return true;
 }
 
 static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
@@ -1835,31 +1839,32 @@ static const struct bpf_func_proto bpf_redirect_proto = {
         .arg2_type      = ARG_ANYTHING,
 };
 
-BPF_CALL_3(bpf_sk_redirect_map, struct bpf_map *, map, u32, key, u64, flags)
+BPF_CALL_4(bpf_sk_redirect_map, struct sk_buff *, skb,
+           struct bpf_map *, map, u32, key, u64, flags)
 {
-        struct redirect_info *ri = this_cpu_ptr(&redirect_info);
+        struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
 
+        /* If user passes invalid input drop the packet. */
         if (unlikely(flags))
-                return SK_ABORTED;
+                return SK_DROP;
 
-        ri->ifindex = key;
-        ri->flags = flags;
-        ri->map = map;
+        tcb->bpf.key = key;
+        tcb->bpf.flags = flags;
+        tcb->bpf.map = map;
 
-        return SK_REDIRECT;
+        return SK_PASS;
 }
 
-struct sock *do_sk_redirect_map(void)
+struct sock *do_sk_redirect_map(struct sk_buff *skb)
 {
-        struct redirect_info *ri = this_cpu_ptr(&redirect_info);
+        struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
         struct sock *sk = NULL;
 
-        if (ri->map) {
-                sk = __sock_map_lookup_elem(ri->map, ri->ifindex);
+        if (tcb->bpf.map) {
+                sk = __sock_map_lookup_elem(tcb->bpf.map, tcb->bpf.key);
 
-                ri->ifindex = 0;
-                ri->map = NULL;
-                /* we do not clear flags for future lookup */
+                tcb->bpf.key = 0;
+                tcb->bpf.map = NULL;
         }
 
         return sk;
@@ -1869,9 +1874,10 @@ static const struct bpf_func_proto bpf_sk_redirect_map_proto = {
         .func           = bpf_sk_redirect_map,
         .gpl_only       = false,
         .ret_type       = RET_INTEGER,
-        .arg1_type      = ARG_CONST_MAP_PTR,
-        .arg2_type      = ARG_ANYTHING,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_CONST_MAP_PTR,
         .arg3_type      = ARG_ANYTHING,
+        .arg4_type      = ARG_ANYTHING,
 };
 
 BPF_CALL_1(bpf_get_cgroup_classid, const struct sk_buff *, skb)
@@ -3679,7 +3685,6 @@ static bool sk_skb_is_valid_access(int off, int size,
 {
         if (type == BPF_WRITE) {
                 switch (off) {
-                case bpf_ctx_range(struct __sk_buff, mark):
                 case bpf_ctx_range(struct __sk_buff, tc_index):
                 case bpf_ctx_range(struct __sk_buff, priority):
                         break;
@@ -3689,6 +3694,7 @@ static bool sk_skb_is_valid_access(int off, int size,
         }
 
         switch (off) {
+        case bpf_ctx_range(struct __sk_buff, mark):
         case bpf_ctx_range(struct __sk_buff, tc_classid):
                 return false;
         case bpf_ctx_range(struct __sk_buff, data):
@@ -4238,6 +4244,31 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
         return insn - insn_buf;
 }
 
+static u32 sk_skb_convert_ctx_access(enum bpf_access_type type,
+                                     const struct bpf_insn *si,
+                                     struct bpf_insn *insn_buf,
+                                     struct bpf_prog *prog, u32 *target_size)
+{
+        struct bpf_insn *insn = insn_buf;
+        int off;
+
+        switch (si->off) {
+        case offsetof(struct __sk_buff, data_end):
+                off  = si->off;
+                off -= offsetof(struct __sk_buff, data_end);
+                off += offsetof(struct sk_buff, cb);
+                off += offsetof(struct tcp_skb_cb, bpf.data_end);
+                *insn++ = BPF_LDX_MEM(BPF_SIZEOF(void *), si->dst_reg,
+                                      si->src_reg, off);
+                break;
+        default:
+                return bpf_convert_ctx_access(type, si, insn_buf, prog,
+                                              target_size);
+        }
+
+        return insn - insn_buf;
+}
+
 const struct bpf_verifier_ops sk_filter_prog_ops = {
         .get_func_proto         = sk_filter_func_proto,
         .is_valid_access        = sk_filter_is_valid_access,
@@ -4296,7 +4327,7 @@ const struct bpf_verifier_ops sock_ops_prog_ops = {
 const struct bpf_verifier_ops sk_skb_prog_ops = {
         .get_func_proto         = sk_skb_func_proto,
         .is_valid_access        = sk_skb_is_valid_access,
-        .convert_ctx_access     = bpf_convert_ctx_access,
+        .convert_ctx_access     = sk_skb_convert_ctx_access,
         .gen_prologue           = sk_skb_prologue,
 };
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a78fd61da0ec..5ace48926b19 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1483,7 +1483,10 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
         [IFLA_NET_NS_FD]        = { .type = NLA_U32 },
-        [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
+        /* IFLA_IFALIAS is a string, but policy is set to NLA_BINARY to
+         * allow 0-length string (needed to remove an alias).
+         */
+        [IFLA_IFALIAS]          = { .type = NLA_BINARY, .len = IFALIASZ - 1 },
         [IFLA_VFINFO_LIST]      = {. type = NLA_NESTED },
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
@@ -2093,7 +2096,7 @@ static int do_setlink(const struct sk_buff *skb,
                                 dev->tx_queue_len = orig_len;
                                 goto errout;
                         }
-                        status |= DO_SETLINK_NOTIFY;
+                        status |= DO_SETLINK_MODIFIED;
                 }
         }
 
@@ -2248,7 +2251,7 @@ static int do_setlink(const struct sk_buff *skb,
 
 errout:
         if (status & DO_SETLINK_MODIFIED) {
-                if (status & DO_SETLINK_NOTIFY)
+                if ((status & DO_SETLINK_NOTIFY) == DO_SETLINK_NOTIFY)
                         netdev_state_change(dev);
 
                 if (err < 0)
@@ -3854,6 +3857,9 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev,
                 return -EMSGSIZE;
 
         ifsm = nlmsg_data(nlh);
+        ifsm->family = PF_UNSPEC;
+        ifsm->pad1 = 0;
+        ifsm->pad2 = 0;
         ifsm->ifindex = dev->ifindex;
         ifsm->filter_mask = filter_mask;
 
@@ -4276,13 +4282,17 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
 
         switch (event) {
         case NETDEV_REBOOT:
+        case NETDEV_CHANGEMTU:
         case NETDEV_CHANGEADDR:
         case NETDEV_CHANGENAME:
         case NETDEV_FEAT_CHANGE:
         case NETDEV_BONDING_FAILOVER:
+        case NETDEV_POST_TYPE_CHANGE:
         case NETDEV_NOTIFY_PEERS:
+        case NETDEV_CHANGEUPPER:
         case NETDEV_RESEND_IGMP:
         case NETDEV_CHANGEINFODATA:
+        case NETDEV_CHANGE_TX_QUEUE_LEN:
                 rtmsg_ifinfo_event(RTM_NEWLINK, dev, 0, rtnl_get_event(event),
                                    GFP_KERNEL);
                 break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 16982de649b9..24656076906d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1124,9 +1124,13 @@ int skb_zerocopy_iter_stream(struct sock *sk, struct sk_buff *skb,
 
         err = __zerocopy_sg_from_iter(sk, skb, &msg->msg_iter, len);
         if (err == -EFAULT || (err == -EMSGSIZE && skb->len == orig_len)) {
+                struct sock *save_sk = skb->sk;
+
                 /* Streams do not free skb on error. Reset to prev state. */
                 msg->msg_iter = orig_iter;
+                skb->sk = sk;
                 ___pskb_trim(skb, orig_len);
+                skb->sk = save_sk;
                 return err;
         }
 
@@ -1896,7 +1900,7 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
         }
 
         /* If we need update frag list, we are in troubles.
-         * Certainly, it possible to add an offset to skb data,
+         * Certainly, it is possible to add an offset to skb data,
          * but taking into account that pulling is expected to
          * be very rare operation, it is worth to fight against
          * further bloating skb head and crucify ourselves here instead.
diff --git a/net/core/sock.c b/net/core/sock.c
index 9b7b6bbb2a23..415f441c63b9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1654,6 +1654,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
 
                 sock_copy(newsk, sk);
 
+                newsk->sk_prot_creator = sk->sk_prot;
+
                 /* SANITY */
                 if (likely(newsk->sk_net_refcnt))
                         get_net(sock_net(newsk));
@@ -1675,20 +1677,28 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 newsk->sk_dst_pending_confirm = 0;
                 newsk->sk_wmem_queued   = 0;
                 newsk->sk_forward_alloc = 0;
+
+                /* sk->sk_memcg will be populated at accept() time */
+                newsk->sk_memcg = NULL;
+
                 atomic_set(&newsk->sk_drops, 0);
                 newsk->sk_send_head     = NULL;
                 newsk->sk_userlocks     = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
                 atomic_set(&newsk->sk_zckey, 0);
 
                 sock_reset_flag(newsk, SOCK_DONE);
+                cgroup_sk_alloc(&newsk->sk_cgrp_data);
 
-                filter = rcu_dereference_protected(newsk->sk_filter, 1);
+                rcu_read_lock();
+                filter = rcu_dereference(sk->sk_filter);
                 if (filter != NULL)
                         /* though it's an empty new sock, the charging may fail
                          * if sysctl_optmem_max was changed between creation of
                          * original socket and cloning
                          */
                         is_charged = sk_filter_charge(newsk, filter);
+                RCU_INIT_POINTER(newsk->sk_filter, filter);
+                rcu_read_unlock();
 
                 if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
                         /* We need to make sure that we don't uncharge the new
@@ -1709,9 +1719,6 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 newsk->sk_incoming_cpu = raw_smp_processor_id();
                 atomic64_set(&newsk->sk_cookie, 0);
 
-                mem_cgroup_sk_alloc(newsk);
-                cgroup_sk_alloc(&newsk->sk_cgrp_data);
-
                 /*
                  * Before updating sk_refcnt, we must commit prior changes to memory
                  * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
index eed1ebf7f29d..b1e0dbea1e8c 100644
--- a/net/core/sock_reuseport.c
+++ b/net/core/sock_reuseport.c
@@ -36,9 +36,14 @@ int reuseport_alloc(struct sock *sk)
          * soft irq of receive path or setsockopt from process context
          */
         spin_lock_bh(&reuseport_lock);
-        WARN_ONCE(rcu_dereference_protected(sk->sk_reuseport_cb,
-                                            lockdep_is_held(&reuseport_lock)),
-                  "multiple allocations for the same socket");
+
+        /* Allocation attempts can occur concurrently via the setsockopt path
+         * and the bind/hash path.  Nothing to do when we lose the race.
+         */
+        if (rcu_dereference_protected(sk->sk_reuseport_cb,
+                                      lockdep_is_held(&reuseport_lock)))
+                goto out;
+
         reuse = __reuseport_alloc(INIT_SOCKS);
         if (!reuse) {
                 spin_unlock_bh(&reuseport_lock);
@@ -49,6 +54,7 @@ int reuseport_alloc(struct sock *sk)
         reuse->num_socks = 1;
         rcu_assign_pointer(sk->sk_reuseport_cb, reuse);
 
+out:
         spin_unlock_bh(&reuseport_lock);
 
         return 0;
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 001c08696334..e65fcb45c3f6 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -414,8 +414,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
         sk_daddr_set(newsk, ireq->ir_rmt_addr);
         sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
         newinet->inet_saddr     = ireq->ir_loc_addr;
-        newinet->inet_opt       = ireq->opt;
-        ireq->opt          = NULL;
+        RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt));
         newinet->mc_index  = inet_iif(skb);
         newinet->mc_ttl    = ip_hdr(skb)->ttl;
         newinet->inet_id   = jiffies;
@@ -430,7 +429,10 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
         if (__inet_inherit_port(sk, newsk) < 0)
                 goto put_and_exit;
         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
-
+        if (*own_req)
+                ireq->ireq_opt = NULL;
+        else
+                newinet->inet_opt = NULL;
         return newsk;
 
 exit_overflow:
@@ -441,6 +443,7 @@ exit:
         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return NULL;
 put_and_exit:
+        newinet->inet_opt = NULL;
         inet_csk_prepare_forced_close(newsk);
         dccp_done(newsk);
         goto exit;
@@ -492,7 +495,7 @@ static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req
                                                               ireq->ir_rmt_addr);
                 err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
                                             ireq->ir_rmt_addr,
-                                            ireq->opt);
+                                            ireq_opt_deref(ireq));
                 err = net_xmit_eval(err);
         }
 
@@ -548,7 +551,7 @@ out:
 static void dccp_v4_reqsk_destructor(struct request_sock *req)
 {
         dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
-        kfree(inet_rsk(req)->opt);
+        kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1));
 }
 
 void dccp_syn_ack_timeout(const struct request_sock *req)
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 8737412c7b27..e1d4d898a007 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -224,7 +224,7 @@ static int dns_resolver_match_preparse(struct key_match_data *match_data)
 static void dns_resolver_describe(const struct key *key, struct seq_file *m)
 {
         seq_puts(m, key->description);
-        if (key_is_instantiated(key)) {
+        if (key_is_positive(key)) {
                 int err = PTR_ERR(key->payload.data[dns_key_error]);
 
                 if (err)
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 873af0108e24..045d8a176279 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -496,14 +496,15 @@ static int dsa_cpu_parse(struct dsa_port *port, u32 index,
                 if (!ethernet)
                         return -EINVAL;
                 ethernet_dev = of_find_net_device_by_node(ethernet);
+                if (!ethernet_dev)
+                        return -EPROBE_DEFER;
         } else {
                 ethernet_dev = dsa_dev_to_net_device(ds->cd->netdev[index]);
+                if (!ethernet_dev)
+                        return -EPROBE_DEFER;
                 dev_put(ethernet_dev);
         }
 
-        if (!ethernet_dev)
-                return -EPROBE_DEFER;
-
         if (!dst->cpu_dp) {
                 dst->cpu_dp = port;
                 dst->cpu_dp->netdev = ethernet_dev;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 2afa99506f8b..865e29e62bad 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1301,28 +1301,33 @@ int dsa_slave_create(struct dsa_port *port, const char *name)
         p->old_duplex = -1;
 
         port->netdev = slave_dev;
-        ret = register_netdev(slave_dev);
-        if (ret) {
-                netdev_err(master, "error %d registering interface %s\n",
-                           ret, slave_dev->name);
-                port->netdev = NULL;
-                free_percpu(p->stats64);
-                free_netdev(slave_dev);
-                return ret;
-        }
 
         netif_carrier_off(slave_dev);
 
         ret = dsa_slave_phy_setup(p, slave_dev);
         if (ret) {
                 netdev_err(master, "error %d setting up slave phy\n", ret);
-                unregister_netdev(slave_dev);
-                free_percpu(p->stats64);
-                free_netdev(slave_dev);
-                return ret;
+                goto out_free;
+        }
+
+        ret = register_netdev(slave_dev);
+        if (ret) {
+                netdev_err(master, "error %d registering interface %s\n",
+                           ret, slave_dev->name);
+                goto out_phy;
         }
 
         return 0;
+
+out_phy:
+        phy_disconnect(p->phy);
+        if (of_phy_is_fixed_link(p->dp->dn))
+                of_phy_deregister_fixed_link(p->dp->dn);
+out_free:
+        free_percpu(p->stats64);
+        free_netdev(slave_dev);
+        port->netdev = NULL;
+        return ret;
 }
 
 void dsa_slave_destroy(struct net_device *slave_dev)
diff --git a/net/ife/ife.c b/net/ife/ife.c
index f360341c72eb..7d1ec76e7f43 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -137,6 +137,6 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
 EXPORT_SYMBOL_GPL(ife_tlv_meta_encode);
 
 MODULE_AUTHOR("Jamal Hadi Salim <jhs@mojatatu.com>");
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("Inter-FE LFB action");
 MODULE_LICENSE("GPL");
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 91a2557942fa..f48fe6fc7e8c 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -70,11 +70,9 @@ config IP_MULTIPLE_TABLES
           address into account. Furthermore, the TOS (Type-Of-Service) field
           of the packet can be used for routing decisions as well.
 
-          If you are interested in this, please see the preliminary
-          documentation at <http://www.compendium.com.ar/policy-routing.txt>
-          and <ftp://post.tepkom.ru/pub/vol2/Linux/docs/advanced-routing.tex>.
-          You will need supporting software from
-          <ftp://ftp.tux.org/pub/net/ip-routing/>.
+          If you need more information, see the Linux Advanced
+          Routing and Traffic Control documentation at
+          <http://lartc.org/howto/lartc.rpdb.html>
 
           If unsure, say N.
 
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 2ae8f54cb321..82178cc69c96 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1951,7 +1951,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
         buf = NULL;
 
         req_inet = inet_rsk(req);
-        opt = xchg(&req_inet->opt, opt);
+        opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
         if (opt)
                 kfree_rcu(opt, rcu);
 
@@ -1973,11 +1973,13 @@ req_setattr_failure:
  * values on failure.
  *
  */
-static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
+static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
 {
+        struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1);
         int hdr_delta = 0;
-        struct ip_options_rcu *opt = *opt_ptr;
 
+        if (!opt || opt->opt.cipso == 0)
+                return 0;
         if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
                 u8 cipso_len;
                 u8 cipso_off;
@@ -2039,14 +2041,10 @@ static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
  */
 void cipso_v4_sock_delattr(struct sock *sk)
 {
-        int hdr_delta;
-        struct ip_options_rcu *opt;
         struct inet_sock *sk_inet;
+        int hdr_delta;
 
         sk_inet = inet_sk(sk);
-        opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
-        if (!opt || opt->opt.cipso == 0)
-                return;
 
         hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
         if (sk_inet->is_icsk && hdr_delta > 0) {
@@ -2066,15 +2064,7 @@ void cipso_v4_sock_delattr(struct sock *sk)
  */
 void cipso_v4_req_delattr(struct request_sock *req)
 {
-        struct ip_options_rcu *opt;
-        struct inet_request_sock *req_inet;
-
-        req_inet = inet_rsk(req);
-        opt = req_inet->opt;
-        if (!opt || opt->opt.cipso == 0)
-                return;
-
-        cipso_v4_delopt(&req_inet->opt);
+        cipso_v4_delopt(&inet_rsk(req)->ireq_opt);
 }
 
 /**
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 416bb304a281..1859c473b21a 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -86,7 +86,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                 greh = (struct gre_base_hdr *)skb_transport_header(skb);
                 pcsum = (__sum16 *)(greh + 1);
 
-                if (gso_partial) {
+                if (gso_partial && skb_is_gso(skb)) {
                         unsigned int partial_adj;
 
                         /* Adjust checksum to account for the fact that
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index c039c937ba90..b47a59cb3573 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -475,6 +475,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
                 }
                 spin_unlock_bh(&queue->fastopenq.lock);
         }
+        mem_cgroup_sk_alloc(newsk);
 out:
         release_sock(sk);
         if (req)
@@ -539,9 +540,11 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct net *net = read_pnet(&ireq->ireq_net);
-        struct ip_options_rcu *opt = ireq->opt;
+        struct ip_options_rcu *opt;
         struct rtable *rt;
 
+        opt = ireq_opt_deref(ireq);
+
         flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                            sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -575,10 +578,9 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
         struct flowi4 *fl4;
         struct rtable *rt;
 
+        opt = rcu_dereference(ireq->ireq_opt);
         fl4 = &newinet->cork.fl.u.ip4;
 
-        rcu_read_lock();
-        opt = rcu_dereference(newinet->inet_opt);
         flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
                            sk->sk_protocol, inet_sk_flowi_flags(sk),
@@ -591,13 +593,11 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
                 goto no_route;
         if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
                 goto route_err;
-        rcu_read_unlock();
         return &rt->dst;
 
 route_err:
         ip_rt_put(rt);
 no_route:
-        rcu_read_unlock();
         __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
         return NULL;
 }
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 597bb4cfe805..e7d15fb0d94d 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -456,10 +456,7 @@ static int inet_reuseport_add_sock(struct sock *sk,
                         return reuseport_add_sock(sk, sk2);
         }
 
-        /* Initial allocation may have already happened via setsockopt */
-        if (!rcu_access_pointer(sk->sk_reuseport_cb))
-                return reuseport_alloc(sk);
-        return 0;
+        return reuseport_alloc(sk);
 }
 
 int __inet_hash(struct sock *sk, struct sock *osk)
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index e7eb590c86ce..b20c8ac64081 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -128,9 +128,9 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
                         break;
                 }
                 if (cmp == -1)
-                        pp = &(*pp)->rb_left;
+                        pp = &next->rb_left;
                 else
-                        pp = &(*pp)->rb_right;
+                        pp = &next->rb_right;
         }
         *parent_p = parent;
         *pp_p = pp;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 0162fb955b33..467e44d7587d 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         struct ip_tunnel *tunnel;
         struct erspanhdr *ershdr;
         const struct iphdr *iph;
-        __be32 session_id;
         __be32 index;
         int len;
 
@@ -275,8 +274,7 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         /* The original GRE header does not have key field,
          * Use ERSPAN 10-bit session ID as key.
          */
-        session_id = cpu_to_be32(ntohs(ershdr->session_id));
-        tpi->key = session_id;
+        tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
         index = ershdr->md.index;
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                   tpi->flags | TUNNEL_KEY,
@@ -733,7 +731,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
         if (skb_cow_head(skb, dev->needed_headroom))
                 goto free_skb;
 
-        if (skb->len > dev->mtu) {
+        if (skb->len - dev->hard_header_len > dev->mtu) {
                 pskb_trim(skb, dev->mtu);
                 truncate = true;
         }
@@ -1223,6 +1221,7 @@ static int gre_tap_init(struct net_device *dev)
 {
         __gre_tunnel_init(dev);
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 
         return ip_tunnel_init(dev);
 }
@@ -1246,13 +1245,16 @@ static int erspan_tunnel_init(struct net_device *dev)
 
         tunnel->tun_hlen = 8;
         tunnel->parms.iph.protocol = IPPROTO_GRE;
-        t_hlen = tunnel->hlen + sizeof(struct iphdr) + sizeof(struct erspanhdr);
+        tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
+                       sizeof(struct erspanhdr);
+        t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
         dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4;
         dev->mtu = ETH_DATA_LEN - t_hlen - 4;
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
         dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 
         return ip_tunnel_init(dev);
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index fa2dc8f692c6..57fc13c6ab2b 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -311,9 +311,10 @@ drop:
 static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
-        struct rtable *rt;
+        int (*edemux)(struct sk_buff *skb);
         struct net_device *dev = skb->dev;
-        void (*edemux)(struct sk_buff *skb);
+        struct rtable *rt;
+        int err;
 
         /* if ingress device is enslaved to an L3 master device pass the
          * skb to its handler for processing
@@ -331,7 +332,9 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 
                 ipprot = rcu_dereference(inet_protos[protocol]);
                 if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) {
-                        edemux(skb);
+                        err = edemux(skb);
+                        if (unlikely(err))
+                                goto drop_error;
                         /* must reload iph, skb->head might have changed */
                         iph = ip_hdr(skb);
                 }
@@ -342,13 +345,10 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
          *      how the packet travels inside Linux networking.
          */
         if (!skb_valid_dst(skb)) {
-                int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                               iph->tos, dev);
-                if (unlikely(err)) {
-                        if (err == -EXDEV)
-                                __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
-                        goto drop;
-                }
+                err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                           iph->tos, dev);
+                if (unlikely(err))
+                        goto drop_error;
         }
 
 #ifdef CONFIG_IP_ROUTE_CLASSID
@@ -399,6 +399,11 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 drop:
         kfree_skb(skb);
         return NET_RX_DROP;
+
+drop_error:
+        if (err == -EXDEV)
+                __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
+        goto drop;
 }
 
 /*
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 5ed63d250950..89453cf62158 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
         struct ip_tunnel_parm *parms = &tunnel->parms;
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;        /* Device to other host */
+        int pkt_len = skb->len;
         int err;
         int mtu;
 
@@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 
         err = dst_output(tunnel->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0)
-                err = skb->len;
+                err = pkt_len;
         iptunnel_xmit_stats(dev, err);
         return NETDEV_TX_OK;
 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index fb1ad22b5e29..cdd627355ed1 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -128,43 +128,68 @@ static struct rtnl_link_ops ipip_link_ops __read_mostly;
 
 static int ipip_err(struct sk_buff *skb, u32 info)
 {
-
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
+        /* All the routers (except for Linux) return only
+         * 8 bytes of packet payload. It means, that precise relaying of
+         * ICMP in the real Internet is absolutely infeasible.
+         */
         struct net *net = dev_net(skb->dev);
         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
         const struct iphdr *iph = (const struct iphdr *)skb->data;
-        struct ip_tunnel *t;
-        int err;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
+        struct ip_tunnel *t;
+        int err = 0;
+
+        switch (type) {
+        case ICMP_DEST_UNREACH:
+                switch (code) {
+                case ICMP_SR_FAILED:
+                        /* Impossible event. */
+                        goto out;
+                default:
+                        /* All others are translated to HOST_UNREACH.
+                         * rfc2003 contains "deep thoughts" about NET_UNREACH,
+                         * I believe they are just ether pollution. --ANK
+                         */
+                        break;
+                }
+                break;
+
+        case ICMP_TIME_EXCEEDED:
+                if (code != ICMP_EXC_TTL)
+                        goto out;
+                break;
+
+        case ICMP_REDIRECT:
+                break;
+
+        default:
+                goto out;
+        }
 
-        err = -ENOENT;
         t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                              iph->daddr, iph->saddr, 0);
-        if (!t)
+        if (!t) {
+                err = -ENOENT;
                 goto out;
+        }
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->parms.link, 0, iph->protocol, 0);
-                err = 0;
+                ipv4_update_pmtu(skb, net, info, t->parms.link, 0,
+                                 iph->protocol, 0);
                 goto out;
         }
 
         if (type == ICMP_REDIRECT) {
-                ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
-                              iph->protocol, 0);
-                err = 0;
+                ipv4_redirect(skb, net, t->parms.link, 0, iph->protocol, 0);
                 goto out;
         }
 
-        if (t->parms.iph.daddr == 0)
+        if (t->parms.iph.daddr == 0) {
+                err = -ENOENT;
                 goto out;
+        }
 
-        err = 0;
         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
                 goto out;
 
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 811689e523c3..f75fc6b53115 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -330,7 +330,8 @@ static unsigned int ipv4_synproxy_hook(void *priv,
         if (synproxy == NULL)
                 return NF_ACCEPT;
 
-        if (nf_is_loopback_packet(skb))
+        if (nf_is_loopback_packet(skb) ||
+            ip_hdr(skb)->protocol != IPPROTO_TCP)
                 return NF_ACCEPT;
 
         thoff = ip_hdrlen(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 94d4cd2d5ea4..3d9f1c2f81c5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1520,43 +1520,56 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
 EXPORT_SYMBOL(rt_dst_alloc);
 
 /* called in rcu_read_lock() section */
-static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-                                u8 tos, struct net_device *dev, int our)
+int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                          u8 tos, struct net_device *dev,
+                          struct in_device *in_dev, u32 *itag)
 {
-        struct rtable *rth;
-        struct in_device *in_dev = __in_dev_get_rcu(dev);
-        unsigned int flags = RTCF_MULTICAST;
-        u32 itag = 0;
         int err;
 
         /* Primary sanity checks. */
-
         if (!in_dev)
                 return -EINVAL;
 
         if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
             skb->protocol != htons(ETH_P_IP))
-                goto e_inval;
+                return -EINVAL;
 
         if (ipv4_is_loopback(saddr) && !IN_DEV_ROUTE_LOCALNET(in_dev))
-                goto e_inval;
+                return -EINVAL;
 
         if (ipv4_is_zeronet(saddr)) {
                 if (!ipv4_is_local_multicast(daddr))
-                        goto e_inval;
+                        return -EINVAL;
         } else {
                 err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
-                                          in_dev, &itag);
+                                          in_dev, itag);
                 if (err < 0)
-                        goto e_err;
+                        return err;
         }
+        return 0;
+}
+
+/* called in rcu_read_lock() section */
+static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                             u8 tos, struct net_device *dev, int our)
+{
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
+        unsigned int flags = RTCF_MULTICAST;
+        struct rtable *rth;
+        u32 itag = 0;
+        int err;
+
+        err = ip_mc_validate_source(skb, daddr, saddr, tos, dev, in_dev, &itag);
+        if (err)
+                return err;
+
         if (our)
                 flags |= RTCF_LOCAL;
 
         rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
         if (!rth)
-                goto e_nobufs;
+                return -ENOBUFS;
 
 #ifdef CONFIG_IP_ROUTE_CLASSID
         rth->dst.tclassid = itag;
@@ -1572,13 +1585,6 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         skb_dst_set(skb, &rth->dst);
         return 0;
-
-e_nobufs:
-        return -ENOBUFS;
-e_inval:
-        return -EINVAL;
-e_err:
-        return err;
 }
 
 
@@ -2507,7 +2513,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
         struct rtable *ort = (struct rtable *) dst_orig;
         struct rtable *rt;
 
-        rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
+        rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_DEAD, 0);
         if (rt) {
                 struct dst_entry *new = &rt->dst;
 
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b1bb1b3a1082..77cf32a80952 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -355,7 +355,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
          */
-        ireq->opt = tcp_v4_save_options(sock_net(sk), skb);
+        RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(sock_net(sk), skb));
 
         if (security_inet_conn_request(sk, skb, req)) {
                 reqsk_free(req);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c5d7656beeee..7eec3383702b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6196,7 +6196,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
                 struct inet_request_sock *ireq = inet_rsk(req);
 
                 kmemcheck_annotate_bitfield(ireq, flags);
-                ireq->opt = NULL;
+                ireq->ireq_opt = NULL;
 #if IS_ENABLED(CONFIG_IPV6)
                 ireq->pktopts = NULL;
 #endif
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d9416b5162bc..5b027c69cbc5 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -877,7 +877,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
 
                 err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
                                             ireq->ir_rmt_addr,
-                                            ireq->opt);
+                                            ireq_opt_deref(ireq));
                 err = net_xmit_eval(err);
         }
 
@@ -889,7 +889,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
  */
 static void tcp_v4_reqsk_destructor(struct request_sock *req)
 {
-        kfree(inet_rsk(req)->opt);
+        kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1));
 }
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1265,10 +1265,11 @@ static void tcp_v4_init_req(struct request_sock *req,
                             struct sk_buff *skb)
 {
         struct inet_request_sock *ireq = inet_rsk(req);
+        struct net *net = sock_net(sk_listener);
 
         sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
         sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
-        ireq->opt = tcp_v4_save_options(sock_net(sk_listener), skb);
+        RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(net, skb));
 }
 
 static struct dst_entry *tcp_v4_route_req(const struct sock *sk,
@@ -1355,10 +1356,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
         sk_daddr_set(newsk, ireq->ir_rmt_addr);
         sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
         newsk->sk_bound_dev_if = ireq->ir_iif;
-        newinet->inet_saddr           = ireq->ir_loc_addr;
-        inet_opt              = ireq->opt;
-        rcu_assign_pointer(newinet->inet_opt, inet_opt);
-        ireq->opt             = NULL;
+        newinet->inet_saddr   = ireq->ir_loc_addr;
+        inet_opt              = rcu_dereference(ireq->ireq_opt);
+        RCU_INIT_POINTER(newinet->inet_opt, inet_opt);
         newinet->mc_index     = inet_iif(skb);
         newinet->mc_ttl       = ip_hdr(skb)->ttl;
         newinet->rcv_tos      = ip_hdr(skb)->tos;
@@ -1403,9 +1403,12 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
         if (__inet_inherit_port(sk, newsk) < 0)
                 goto put_and_exit;
         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
-        if (*own_req)
+        if (likely(*own_req)) {
                 tcp_move_syn(newtp, req);
-
+                ireq->ireq_opt = NULL;
+        } else {
+                newinet->inet_opt = NULL;
+        }
         return newsk;
 
 exit_overflow:
@@ -1416,6 +1419,7 @@ exit:
         tcp_listendrop(sk);
         return NULL;
 put_and_exit:
+        newinet->inet_opt = NULL;
         inet_csk_prepare_forced_close(newsk);
         tcp_done(newsk);
         goto exit;
@@ -1503,23 +1507,23 @@ csum_err:
 }
 EXPORT_SYMBOL(tcp_v4_do_rcv);
 
-void tcp_v4_early_demux(struct sk_buff *skb)
+int tcp_v4_early_demux(struct sk_buff *skb)
 {
         const struct iphdr *iph;
         const struct tcphdr *th;
         struct sock *sk;
 
         if (skb->pkt_type != PACKET_HOST)
-                return;
+                return 0;
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
-                return;
+                return 0;
 
         iph = ip_hdr(skb);
         th = tcp_hdr(skb);
 
         if (th->doff < sizeof(struct tcphdr) / 4)
-                return;
+                return 0;
 
         sk = __inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
                                        iph->saddr, th->source,
@@ -1538,6 +1542,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
+        return 0;
 }
 
 bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 0bc9e46a5369..823003eef3a2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -739,8 +739,10 @@ static void tcp_tsq_handler(struct sock *sk)
                 struct tcp_sock *tp = tcp_sk(sk);
 
                 if (tp->lost_out > tp->retrans_out &&
-                    tp->snd_cwnd > tcp_packets_in_flight(tp))
+                    tp->snd_cwnd > tcp_packets_in_flight(tp)) {
+                        tcp_mstamp_refresh(tp);
                         tcp_xmit_retransmit_queue(sk);
+                }
 
                 tcp_write_xmit(sk, tcp_current_mss(sk), tp->nonagle,
                                0, GFP_ATOMIC);
@@ -2060,6 +2062,7 @@ static int tcp_mtu_probe(struct sock *sk)
         nskb->ip_summed = skb->ip_summed;
 
         tcp_insert_write_queue_before(nskb, skb, sk);
+        tcp_highest_sack_replace(sk, skb, nskb);
 
         len = 0;
         tcp_for_write_queue_from_safe(skb, next, sk) {
@@ -2237,6 +2240,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 
         sent_pkts = 0;
 
+        tcp_mstamp_refresh(tp);
         if (!push_one) {
                 /* Do MTU probing. */
                 result = tcp_mtu_probe(sk);
@@ -2248,7 +2252,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
         }
 
         max_segs = tcp_tso_segs(sk, mss_now);
-        tcp_mstamp_refresh(tp);
         while ((skb = tcp_send_head(sk))) {
                 unsigned int limit;
 
@@ -2663,7 +2666,7 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
                 else if (!skb_shift(skb, next_skb, next_skb_size))
                         return false;
         }
-        tcp_highest_sack_combine(sk, next_skb, skb);
+        tcp_highest_sack_replace(sk, next_skb, skb);
 
         tcp_unlink_write_queue(next_skb, sk);
 
@@ -2841,8 +2844,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
                 nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
                 err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
                              -ENOBUFS;
-                if (!err)
+                if (!err) {
                         skb->skb_mstamp = tp->tcp_mstamp;
+                        tcp_rate_skb_sent(sk, skb);
+                }
         } else {
                 err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ef29df8648e4..ebfbccae62fd 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -231,10 +231,7 @@ static int udp_reuseport_add_sock(struct sock *sk, struct udp_hslot *hslot)
                 }
         }
 
-        /* Initial allocation may have already happened via setsockopt */
-        if (!rcu_access_pointer(sk->sk_reuseport_cb))
-                return reuseport_alloc(sk);
-        return 0;
+        return reuseport_alloc(sk);
 }
 
 /**
@@ -1061,7 +1058,7 @@ back_from_confirm:
                 /* ... which is an evident application bug. --ANK */
                 release_sock(sk);
 
-                net_dbg_ratelimited("cork app bug 2\n");
+                net_dbg_ratelimited("socket already corked\n");
                 err = -EINVAL;
                 goto out;
         }
@@ -1144,7 +1141,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
         if (unlikely(!up->pending)) {
                 release_sock(sk);
 
-                net_dbg_ratelimited("udp cork app bug 3\n");
+                net_dbg_ratelimited("cork failed\n");
                 return -EINVAL;
         }
 
@@ -2221,9 +2218,10 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
         return NULL;
 }
 
-void udp_v4_early_demux(struct sk_buff *skb)
+int udp_v4_early_demux(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb->dev);
+        struct in_device *in_dev = NULL;
         const struct iphdr *iph;
         const struct udphdr *uh;
         struct sock *sk = NULL;
@@ -2234,25 +2232,21 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
         /* validate the packet */
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
-                return;
+                return 0;
 
         iph = ip_hdr(skb);
         uh = udp_hdr(skb);
 
-        if (skb->pkt_type == PACKET_BROADCAST ||
-            skb->pkt_type == PACKET_MULTICAST) {
-                struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+        if (skb->pkt_type == PACKET_MULTICAST) {
+                in_dev = __in_dev_get_rcu(skb->dev);
 
                 if (!in_dev)
-                        return;
+                        return 0;
 
-                /* we are supposed to accept bcast packets */
-                if (skb->pkt_type == PACKET_MULTICAST) {
-                        ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-                                               iph->protocol);
-                        if (!ours)
-                                return;
-                }
+                ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+                                       iph->protocol);
+                if (!ours)
+                        return 0;
 
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
                                                    uh->source, iph->saddr,
@@ -2263,7 +2257,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
         }
 
         if (!sk || !refcount_inc_not_zero(&sk->sk_refcnt))
-                return;
+                return 0;
 
         skb->sk = sk;
         skb->destructor = sock_efree;
@@ -2272,12 +2266,23 @@ void udp_v4_early_demux(struct sk_buff *skb)
         if (dst)
                 dst = dst_check(dst, 0);
         if (dst) {
+                u32 itag = 0;
+
                 /* set noref for now.
                  * any place which wants to hold dst has to call
                  * dst_hold_safe()
                  */
                 skb_dst_set_noref(skb, dst);
+
+                /* for unconnected multicast sockets we need to validate
+                 * the source on each packet
+                 */
+                if (!inet_sk(sk)->inet_daddr && in_dev)
+                        return ip_mc_validate_source(skb, iph->daddr,
+                                                     iph->saddr, iph->tos,
+                                                     skb->dev, in_dev, &itag);
         }
+        return 0;
 }
 
 int udp_rcv(struct sk_buff *skb)
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 97658bfc1b58..e360d55be555 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -120,7 +120,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
                  * will be using a length value equal to only one MSS sized
                  * segment instead of the entire frame.
                  */
-                if (gso_partial) {
+                if (gso_partial && skb_is_gso(skb)) {
                         uh->len = htons(skb_shinfo(skb)->gso_size +
                                         SKB_GSO_CB(skb)->data_offset +
                                         skb->head - (unsigned char *)uh);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 96861c702c06..8a1c846d3df9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3335,6 +3335,7 @@ static void addrconf_permanent_addr(struct net_device *dev)
                 if ((ifp->flags & IFA_F_PERMANENT) &&
                     fixup_permanent_addr(idev, ifp) < 0) {
                         write_unlock_bh(&idev->lock);
+                        in6_ifa_hold(ifp);
                         ipv6_del_addr(ifp);
                         write_lock_bh(&idev->lock);
 
@@ -3820,8 +3821,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
                 goto out;
 
         if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
-            dev_net(dev)->ipv6.devconf_all->accept_dad < 1 ||
-            idev->cnf.accept_dad < 1 ||
+            (dev_net(dev)->ipv6.devconf_all->accept_dad < 1 &&
+             idev->cnf.accept_dad < 1) ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
                 bump_id = ifp->flags & IFA_F_TENTATIVE;
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 8081bafe441b..15535ee327c5 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -315,6 +315,7 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space,
         }
         opt_space->dst1opt = fopt->dst1opt;
         opt_space->opt_flen = fopt->opt_flen;
+        opt_space->tot_len = fopt->tot_len;
         return opt_space;
 }
 EXPORT_SYMBOL_GPL(fl6_merge_options);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 20f66f4c9460..59c121b932ac 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -408,13 +408,16 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         case ICMPV6_DEST_UNREACH:
                 net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
                                     t->parms.name);
-                break;
+                if (code != ICMPV6_PORT_UNREACH)
+                        break;
+                return;
         case ICMPV6_TIME_EXCEED:
                 if (code == ICMPV6_EXC_HOPLIMIT) {
                         net_dbg_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
                                             t->parms.name);
+                        break;
                 }
-                break;
+                return;
         case ICMPV6_PARAMPROB:
                 teli = 0;
                 if (code == ICMPV6_HDR_FIELD)
@@ -430,7 +433,7 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         net_dbg_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
                                             t->parms.name);
                 }
-                break;
+                return;
         case ICMPV6_PKT_TOOBIG:
                 mtu = be32_to_cpu(info) - offset - t->tun_hlen;
                 if (t->dev->type == ARPHRD_ETHER)
@@ -438,7 +441,7 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (mtu < IPV6_MIN_MTU)
                         mtu = IPV6_MIN_MTU;
                 t->dev->mtu = mtu;
-                break;
+                return;
         }
 
         if (time_before(jiffies, t->err_time + IP6TUNNEL_ERR_TIMEO))
@@ -500,8 +503,8 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
                                __u32 *pmtu, __be16 proto)
 {
         struct ip6_tnl *tunnel = netdev_priv(dev);
-        __be16 protocol = (dev->type == ARPHRD_ETHER) ?
-                          htons(ETH_P_TEB) : proto;
+        struct dst_entry *dst = skb_dst(skb);
+        __be16 protocol;
 
         if (dev->type == ARPHRD_ETHER)
                 IPCB(skb)->flags = 0;
@@ -515,9 +518,14 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
                 tunnel->o_seqno++;
 
         /* Push GRE header. */
+        protocol = (dev->type == ARPHRD_ETHER) ? htons(ETH_P_TEB) : proto;
         gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags,
                          protocol, tunnel->parms.o_key, htonl(tunnel->o_seqno));
 
+        /* TooBig packet may have updated dst->dev's mtu */
+        if (dst && dst_mtu(dst) > dst->dev->mtu)
+                dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu);
+
         return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu,
                             NEXTHDR_GRE);
 }
@@ -1311,6 +1319,7 @@ static void ip6gre_tap_setup(struct net_device *dev)
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 }
 
 static bool ip6gre_netlink_encap_parms(struct nlattr *data[],
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index cdb3728faca7..4a87f9428ca5 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -105,7 +105,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
         for (skb = segs; skb; skb = skb->next) {
                 ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
-                if (gso_partial)
+                if (gso_partial && skb_is_gso(skb))
                         payload_len = skb_shinfo(skb)->gso_size +
                                       SKB_GSO_CB(skb)->data_offset +
                                       skb->head - (unsigned char *)(ipv6h + 1);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 43ca864327c7..5110a418cc4d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1161,11 +1161,11 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
                 if (WARN_ON(v6_cork->opt))
                         return -EINVAL;
 
-                v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
+                v6_cork->opt = kzalloc(sizeof(*opt), sk->sk_allocation);
                 if (unlikely(!v6_cork->opt))
                         return -ENOBUFS;
 
-                v6_cork->opt->tot_len = opt->tot_len;
+                v6_cork->opt->tot_len = sizeof(*opt);
                 v6_cork->opt->opt_flen = opt->opt_flen;
                 v6_cork->opt->opt_nflen = opt->opt_nflen;
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index f2f21c24915f..a1c24443cd9e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1043,6 +1043,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
         struct dst_entry *dst = NULL, *ndst = NULL;
         struct net_device *tdev;
         int mtu;
+        unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0;
         unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen;
         unsigned int max_headroom = psh_hlen;
         bool use_cache = false;
@@ -1124,7 +1125,7 @@ route_lookup:
                                      t->parms.name);
                 goto tx_err_dst_release;
         }
-        mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen;
+        mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen;
         if (encap_limit >= 0) {
                 max_headroom += 8;
                 mtu -= 8;
@@ -1133,7 +1134,7 @@ route_lookup:
                 mtu = IPV6_MIN_MTU;
         if (skb_dst(skb) && !t->parms.collect_md)
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-        if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) {
+        if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
                 *pmtu = mtu;
                 err = -EMSGSIZE;
                 goto tx_err_dst_release;
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 79444a4bfd6d..bcdc2d557de1 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;
         struct xfrm_state *x;
+        int pkt_len = skb->len;
         int err = -1;
         int mtu;
 
@@ -502,7 +503,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
 
                 u64_stats_update_begin(&tstats->syncp);
-                tstats->tx_bytes += skb->len;
+                tstats->tx_bytes += pkt_len;
                 tstats->tx_packets++;
                 u64_stats_update_end(&tstats->syncp);
         } else {
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index a5cd43d75393..437af8c95277 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -353,7 +353,7 @@ static unsigned int ipv6_synproxy_hook(void *priv,
         nexthdr = ipv6_hdr(skb)->nexthdr;
         thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
                                  &frag_off);
-        if (thoff < 0)
+        if (thoff < 0 || nexthdr != IPPROTO_TCP)
                 return NF_ACCEPT;
 
         th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 26cc9f483b6d..a96d5b385d8f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1325,7 +1325,7 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
         struct dst_entry *new = NULL;
 
         rt = dst_alloc(&ip6_dst_blackhole_ops, loopback_dev, 1,
-                       DST_OBSOLETE_NONE, 0);
+                       DST_OBSOLETE_DEAD, 0);
         if (rt) {
                 rt6_info_init(rt);
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ee485df73ccd..02d61101b108 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1314,6 +1314,9 @@ again:
 
                         hlist_del_init(&session->hlist);
 
+                        if (test_and_set_bit(0, &session->dead))
+                                goto again;
+
                         if (session->ref != NULL)
                                 (*session->ref)(session);
 
@@ -1685,14 +1688,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
 
 /* This function is used by the netlink TUNNEL_DELETE command.
  */
-int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        l2tp_tunnel_inc_refcount(tunnel);
-        if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
-                l2tp_tunnel_dec_refcount(tunnel);
-                return 1;
+        if (!test_and_set_bit(0, &tunnel->dead)) {
+                l2tp_tunnel_inc_refcount(tunnel);
+                queue_work(l2tp_wq, &tunnel->del_work);
         }
-        return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
@@ -1750,6 +1751,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+        if (test_and_set_bit(0, &session->dead))
+                return 0;
+
         if (session->ref)
                 (*session->ref)(session);
         __l2tp_session_unhash(session);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a305e0c5925a..67c79d9b5c6c 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -76,6 +76,7 @@ struct l2tp_session_cfg {
 struct l2tp_session {
         int                     magic;          /* should be
                                                  * L2TP_SESSION_MAGIC */
+        long                    dead;
 
         struct l2tp_tunnel      *tunnel;        /* back pointer to tunnel
                                                  * context */
@@ -160,6 +161,9 @@ struct l2tp_tunnel_cfg {
 
 struct l2tp_tunnel {
         int                     magic;          /* Should be L2TP_TUNNEL_MAGIC */
+
+        unsigned long           dead;
+
         struct rcu_head rcu;
         rwlock_t                hlist_lock;     /* protect session_hlist */
         bool                    acpt_newsess;   /* Indicates whether this
@@ -254,7 +258,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
                        u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
                        struct l2tp_tunnel **tunnelp);
 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
-int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
 struct l2tp_session *l2tp_session_create(int priv_size,
                                          struct l2tp_tunnel *tunnel,
                                          u32 session_id, u32 peer_session_id,
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 87da9ef61860..014a7bc2a872 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -44,7 +44,6 @@ struct l2tp_eth {
         struct net_device       *dev;
         struct sock             *tunnel_sock;
         struct l2tp_session     *session;
-        struct list_head        list;
         atomic_long_t           tx_bytes;
         atomic_long_t           tx_packets;
         atomic_long_t           tx_dropped;
@@ -58,17 +57,6 @@ struct l2tp_eth_sess {
         struct net_device       *dev;
 };
 
-/* per-net private data for this module */
-static unsigned int l2tp_eth_net_id;
-struct l2tp_eth_net {
-        struct list_head l2tp_eth_dev_list;
-        spinlock_t l2tp_eth_lock;
-};
-
-static inline struct l2tp_eth_net *l2tp_eth_pernet(struct net *net)
-{
-        return net_generic(net, l2tp_eth_net_id);
-}
 
 static int l2tp_eth_dev_init(struct net_device *dev)
 {
@@ -84,12 +72,6 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 
 static void l2tp_eth_dev_uninit(struct net_device *dev)
 {
-        struct l2tp_eth *priv = netdev_priv(dev);
-        struct l2tp_eth_net *pn = l2tp_eth_pernet(dev_net(dev));
-
-        spin_lock(&pn->l2tp_eth_lock);
-        list_del_init(&priv->list);
-        spin_unlock(&pn->l2tp_eth_lock);
         dev_put(dev);
 }
 
@@ -273,7 +255,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         struct l2tp_eth *priv;
         struct l2tp_eth_sess *spriv;
         int rc;
-        struct l2tp_eth_net *pn;
 
         if (cfg->ifname) {
                 strlcpy(name, cfg->ifname, IFNAMSIZ);
@@ -305,7 +286,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         priv = netdev_priv(dev);
         priv->dev = dev;
         priv->session = session;
-        INIT_LIST_HEAD(&priv->list);
 
         priv->tunnel_sock = tunnel->sock;
         session->recv_skb = l2tp_eth_dev_recv;
@@ -326,10 +306,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
         dev_hold(dev);
-        pn = l2tp_eth_pernet(dev_net(dev));
-        spin_lock(&pn->l2tp_eth_lock);
-        list_add(&priv->list, &pn->l2tp_eth_dev_list);
-        spin_unlock(&pn->l2tp_eth_lock);
 
         return 0;
 
@@ -342,22 +318,6 @@ out:
         return rc;
 }
 
-static __net_init int l2tp_eth_init_net(struct net *net)
-{
-        struct l2tp_eth_net *pn = net_generic(net, l2tp_eth_net_id);
-
-        INIT_LIST_HEAD(&pn->l2tp_eth_dev_list);
-        spin_lock_init(&pn->l2tp_eth_lock);
-
-        return 0;
-}
-
-static struct pernet_operations l2tp_eth_net_ops = {
-        .init = l2tp_eth_init_net,
-        .id   = &l2tp_eth_net_id,
-        .size = sizeof(struct l2tp_eth_net),
-};
-
 
 static const struct l2tp_nl_cmd_ops l2tp_eth_nl_cmd_ops = {
         .session_create = l2tp_eth_create,
@@ -371,25 +331,18 @@ static int __init l2tp_eth_init(void)
 
         err = l2tp_nl_register_ops(L2TP_PWTYPE_ETH, &l2tp_eth_nl_cmd_ops);
         if (err)
-                goto out;
-
-        err = register_pernet_device(&l2tp_eth_net_ops);
-        if (err)
-                goto out_unreg;
+                goto err;
 
         pr_info("L2TP ethernet pseudowire support (L2TPv3)\n");
 
         return 0;
 
-out_unreg:
-        l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
-out:
+err:
         return err;
 }
 
 static void __exit l2tp_eth_exit(void)
 {
-        unregister_pernet_device(&l2tp_eth_net_ops);
         l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
 }
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 50e3ee9a9d61..0c2738349442 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -437,11 +437,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-        if (sock) {
+        if (sock)
                 inet_shutdown(sock, SEND_SHUTDOWN);
-                /* Don't let the session go away before our socket does */
-                l2tp_session_inc_refcount(session);
-        }
+
+        /* Don't let the session go away before our socket does */
+        l2tp_session_inc_refcount(session);
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -584,6 +584,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         u32 tunnel_id, peer_tunnel_id;
         u32 session_id, peer_session_id;
         bool drop_refcnt = false;
+        bool drop_tunnel = false;
         int ver = 2;
         int fd;
 
@@ -652,7 +653,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (tunnel_id == 0)
                 goto end;
 
-        tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
+        tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id);
+        if (tunnel)
+                drop_tunnel = true;
 
         /* Special case: create tunnel context if session_id and
          * peer_session_id is 0. Otherwise look up tunnel using supplied
@@ -781,6 +784,8 @@ out_no_ppp:
 end:
         if (drop_refcnt)
                 l2tp_session_dec_refcount(session);
+        if (drop_tunnel)
+                l2tp_tunnel_dec_refcount(tunnel);
         release_sock(sk);
 
         return error;
@@ -988,6 +993,9 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session,
                  session->name, cmd, arg);
 
         sk = ps->sock;
+        if (!sk)
+                return -EBADR;
+
         sock_hold(sk);
 
         switch (cmd) {
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index a354f1939e49..fb15d3b97cb2 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2727,12 +2727,6 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
         if (!ieee80211_sdata_running(sdata))
                 return -ENETDOWN;
 
-        if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
-                ret = drv_set_bitrate_mask(local, sdata, mask);
-                if (ret)
-                        return ret;
-        }
-
         /*
          * If active validate the setting and reject it if it doesn't leave
          * at least one basic rate usable, since we really have to be able
@@ -2748,6 +2742,12 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
                         return -EINVAL;
         }
 
+        if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
+                ret = drv_set_bitrate_mask(local, sdata, mask);
+                if (ret)
+                        return ret;
+        }
+
         for (i = 0; i < NUM_NL80211_BANDS; i++) {
                 struct ieee80211_supported_band *sband = wiphy->bands[i];
                 int j;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index a98fc2b5e0dc..938049395f90 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -4,7 +4,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007-2008  Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2013-2014  Intel Mobile Communications GmbH
- * Copyright 2015       Intel Deutschland GmbH
+ * Copyright 2015-2017  Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -19,6 +19,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <net/mac80211.h>
+#include <crypto/algapi.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -609,6 +610,39 @@ void ieee80211_key_free_unused(struct ieee80211_key *key)
         ieee80211_key_free_common(key);
 }
 
+static bool ieee80211_key_identical(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_key *old,
+                                    struct ieee80211_key *new)
+{
+        u8 tkip_old[WLAN_KEY_LEN_TKIP], tkip_new[WLAN_KEY_LEN_TKIP];
+        u8 *tk_old, *tk_new;
+
+        if (!old || new->conf.keylen != old->conf.keylen)
+                return false;
+
+        tk_old = old->conf.key;
+        tk_new = new->conf.key;
+
+        /*
+         * In station mode, don't compare the TX MIC key, as it's never used
+         * and offloaded rekeying may not care to send it to the host. This
+         * is the case in iwlwifi, for example.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            new->conf.cipher == WLAN_CIPHER_SUITE_TKIP &&
+            new->conf.keylen == WLAN_KEY_LEN_TKIP &&
+            !(new->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                memcpy(tkip_old, tk_old, WLAN_KEY_LEN_TKIP);
+                memcpy(tkip_new, tk_new, WLAN_KEY_LEN_TKIP);
+                memset(tkip_old + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+                memset(tkip_new + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8);
+                tk_old = tkip_old;
+                tk_new = tkip_new;
+        }
+
+        return !crypto_memneq(tk_old, tk_new, new->conf.keylen);
+}
+
 int ieee80211_key_link(struct ieee80211_key *key,
                        struct ieee80211_sub_if_data *sdata,
                        struct sta_info *sta)
@@ -620,9 +654,6 @@ int ieee80211_key_link(struct ieee80211_key *key,
 
         pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
         idx = key->conf.keyidx;
-        key->local = sdata->local;
-        key->sdata = sdata;
-        key->sta = sta;
 
         mutex_lock(&sdata->local->key_mtx);
 
@@ -633,6 +664,20 @@ int ieee80211_key_link(struct ieee80211_key *key,
         else
                 old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
+        /*
+         * Silently accept key re-installation without really installing the
+         * new version of the key to avoid nonce reuse or replay issues.
+         */
+        if (ieee80211_key_identical(sdata, old_key, key)) {
+                ieee80211_key_free_unused(key);
+                ret = 0;
+                goto out;
+        }
+
+        key->local = sdata->local;
+        key->sdata = sdata;
+        key->sta = sta;
+
         increment_tailroom_need_count(sdata);
 
         ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
@@ -648,6 +693,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
                 ret = 0;
         }
 
+ out:
         mutex_unlock(&sdata->local->key_mtx);
 
         return ret;
diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
index af3d636534ef..d30f7bd741d0 100644
--- a/net/ncsi/internal.h
+++ b/net/ncsi/internal.h
@@ -286,6 +286,7 @@ struct ncsi_dev_priv {
         struct work_struct  work;            /* For channel management     */
         struct packet_type  ptype;           /* NCSI packet Rx handler     */
         struct list_head    node;            /* Form NCSI device list      */
+#define NCSI_MAX_VLAN_VIDS      15
         struct list_head    vlan_vids;       /* List of active VLAN IDs */
 };
 
diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index 6898e7229285..f135938bf781 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -187,7 +187,7 @@ static struct ncsi_aen_handler {
 } ncsi_aen_handlers[] = {
         { NCSI_PKT_AEN_LSC,    12, ncsi_aen_handler_lsc    },
         { NCSI_PKT_AEN_CR,      4, ncsi_aen_handler_cr     },
-        { NCSI_PKT_AEN_HNCDSC,  4, ncsi_aen_handler_hncdsc }
+        { NCSI_PKT_AEN_HNCDSC,  8, ncsi_aen_handler_hncdsc }
 };
 
 int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct sk_buff *skb)
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 3fd3c39e6278..28c42b22b748 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -189,6 +189,7 @@ static void ncsi_channel_monitor(unsigned long data)
         struct ncsi_channel *nc = (struct ncsi_channel *)data;
         struct ncsi_package *np = nc->package;
         struct ncsi_dev_priv *ndp = np->ndp;
+        struct ncsi_channel_mode *ncm;
         struct ncsi_cmd_arg nca;
         bool enabled, chained;
         unsigned int monitor_state;
@@ -202,11 +203,15 @@ static void ncsi_channel_monitor(unsigned long data)
         monitor_state = nc->monitor.state;
         spin_unlock_irqrestore(&nc->lock, flags);
 
-        if (!enabled || chained)
+        if (!enabled || chained) {
+                ncsi_stop_channel_monitor(nc);
                 return;
+        }
         if (state != NCSI_CHANNEL_INACTIVE &&
-            state != NCSI_CHANNEL_ACTIVE)
+            state != NCSI_CHANNEL_ACTIVE) {
+                ncsi_stop_channel_monitor(nc);
                 return;
+        }
 
         switch (monitor_state) {
         case NCSI_CHANNEL_MONITOR_START:
@@ -217,28 +222,28 @@ static void ncsi_channel_monitor(unsigned long data)
                 nca.type = NCSI_PKT_CMD_GLS;
                 nca.req_flags = 0;
                 ret = ncsi_xmit_cmd(&nca);
-                if (ret) {
+                if (ret)
                         netdev_err(ndp->ndev.dev, "Error %d sending GLS\n",
                                    ret);
-                        return;
-                }
-
                 break;
         case NCSI_CHANNEL_MONITOR_WAIT ... NCSI_CHANNEL_MONITOR_WAIT_MAX:
                 break;
         default:
-                if (!(ndp->flags & NCSI_DEV_HWA) &&
-                    state == NCSI_CHANNEL_ACTIVE) {
+                if (!(ndp->flags & NCSI_DEV_HWA)) {
                         ncsi_report_link(ndp, true);
                         ndp->flags |= NCSI_DEV_RESHUFFLE;
                 }
 
+                ncsi_stop_channel_monitor(nc);
+
+                ncm = &nc->modes[NCSI_MODE_LINK];
                 spin_lock_irqsave(&nc->lock, flags);
                 nc->state = NCSI_CHANNEL_INVISIBLE;
+                ncm->data[2] &= ~0x1;
                 spin_unlock_irqrestore(&nc->lock, flags);
 
                 spin_lock_irqsave(&ndp->lock, flags);
-                nc->state = NCSI_CHANNEL_INACTIVE;
+                nc->state = NCSI_CHANNEL_ACTIVE;
                 list_add_tail_rcu(&nc->link, &ndp->channel_queue);
                 spin_unlock_irqrestore(&ndp->lock, flags);
                 ncsi_process_next_channel(ndp);
@@ -732,6 +737,10 @@ static int set_one_vid(struct ncsi_dev_priv *ndp, struct ncsi_channel *nc,
         if (index < 0) {
                 netdev_err(ndp->ndev.dev,
                            "Failed to add new VLAN tag, error %d\n", index);
+                if (index == -ENOSPC)
+                        netdev_err(ndp->ndev.dev,
+                                   "Channel %u already has all VLAN filters set\n",
+                                   nc->id);
                 return -1;
         }
 
@@ -998,12 +1007,15 @@ static bool ncsi_check_hwa(struct ncsi_dev_priv *ndp)
         struct ncsi_package *np;
         struct ncsi_channel *nc;
         unsigned int cap;
+        bool has_channel = false;
 
         /* The hardware arbitration is disabled if any one channel
          * doesn't support explicitly.
          */
         NCSI_FOR_EACH_PACKAGE(ndp, np) {
                 NCSI_FOR_EACH_CHANNEL(np, nc) {
+                        has_channel = true;
+
                         cap = nc->caps[NCSI_CAP_GENERIC].cap;
                         if (!(cap & NCSI_CAP_GENERIC_HWA) ||
                             (cap & NCSI_CAP_GENERIC_HWA_MASK) !=
@@ -1014,8 +1026,13 @@ static bool ncsi_check_hwa(struct ncsi_dev_priv *ndp)
                 }
         }
 
-        ndp->flags |= NCSI_DEV_HWA;
-        return true;
+        if (has_channel) {
+                ndp->flags |= NCSI_DEV_HWA;
+                return true;
+        }
+
+        ndp->flags &= ~NCSI_DEV_HWA;
+        return false;
 }
 
 static int ncsi_enable_hwa(struct ncsi_dev_priv *ndp)
@@ -1403,7 +1420,6 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
 
 int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
-        struct ncsi_channel_filter *ncf;
         struct ncsi_dev_priv *ndp;
         unsigned int n_vids = 0;
         struct vlan_vid *vlan;
@@ -1420,7 +1436,6 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
         }
 
         ndp = TO_NCSI_DEV_PRIV(nd);
-        ncf = ndp->hot_channel->filters[NCSI_FILTER_VLAN];
 
         /* Add the VLAN id to our internal list */
         list_for_each_entry_rcu(vlan, &ndp->vlan_vids, list) {
@@ -1431,12 +1446,11 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
                         return 0;
                 }
         }
-
-        if (n_vids >= ncf->total) {
-                netdev_info(dev,
-                            "NCSI Channel supports up to %u VLAN tags but %u are already set\n",
-                            ncf->total, n_vids);
-                return -EINVAL;
+        if (n_vids >= NCSI_MAX_VLAN_VIDS) {
+                netdev_warn(dev,
+                            "tried to add vlan id %u but NCSI max already registered (%u)\n",
+                            vid, NCSI_MAX_VLAN_VIDS);
+                return -ENOSPC;
         }
 
         vlan = kzalloc(sizeof(*vlan), GFP_KERNEL);
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 265b9a892d41..927dad4759d1 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -959,7 +959,7 @@ static struct ncsi_rsp_handler {
         { NCSI_PKT_RSP_EGMF,    4, ncsi_rsp_handler_egmf    },
         { NCSI_PKT_RSP_DGMF,    4, ncsi_rsp_handler_dgmf    },
         { NCSI_PKT_RSP_SNFC,    4, ncsi_rsp_handler_snfc    },
-        { NCSI_PKT_RSP_GVI,    36, ncsi_rsp_handler_gvi     },
+        { NCSI_PKT_RSP_GVI,    40, ncsi_rsp_handler_gvi     },
         { NCSI_PKT_RSP_GC,     32, ncsi_rsp_handler_gc      },
         { NCSI_PKT_RSP_GP,     -1, ncsi_rsp_handler_gp      },
         { NCSI_PKT_RSP_GCPS,  172, ncsi_rsp_handler_gcps    },
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e495b5e484b1..cf84f7b37cd9 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1191,14 +1191,17 @@ static int ip_set_swap(struct net *net, struct sock *ctnl, struct sk_buff *skb,
               from->family == to->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
-        if (from->ref_netlink || to->ref_netlink)
+        write_lock_bh(&ip_set_ref_lock);
+
+        if (from->ref_netlink || to->ref_netlink) {
+                write_unlock_bh(&ip_set_ref_lock);
                 return -EBUSY;
+        }
 
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
 
-        write_lock_bh(&ip_set_ref_lock);
         swap(from->ref, to->ref);
         ip_set(inst, from_id) = to;
         ip_set(inst, to_id) = from;
@@ -2072,25 +2075,28 @@ static struct pernet_operations ip_set_net_ops = {
 static int __init
 ip_set_init(void)
 {
-        int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
+        int ret = register_pernet_subsys(&ip_set_net_ops);
+
+        if (ret) {
+                pr_err("ip_set: cannot register pernet_subsys.\n");
+                return ret;
+        }
 
+        ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
         if (ret != 0) {
                 pr_err("ip_set: cannot register with nfnetlink.\n");
+                unregister_pernet_subsys(&ip_set_net_ops);
                 return ret;
         }
+
         ret = nf_register_sockopt(&so_set);
         if (ret != 0) {
                 pr_err("SO_SET registry failed: %d\n", ret);
                 nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+                unregister_pernet_subsys(&ip_set_net_ops);
                 return ret;
         }
-        ret = register_pernet_subsys(&ip_set_net_ops);
-        if (ret) {
-                pr_err("ip_set: cannot register pernet_subsys.\n");
-                nf_unregister_sockopt(&so_set);
-                nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
-                return ret;
-        }
+
         pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
         return 0;
 }
@@ -2098,9 +2104,10 @@ ip_set_init(void)
 static void __exit
 ip_set_fini(void)
 {
-        unregister_pernet_subsys(&ip_set_net_ops);
         nf_unregister_sockopt(&so_set);
         nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+
+        unregister_pernet_subsys(&ip_set_net_ops);
         pr_debug("these are the famous last words\n");
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 20bfbd315f61..613eb212cb48 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -123,13 +123,12 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
                 return ret;
 
         ip &= ip_set_hostmask(h->netmask);
+        e.ip = htonl(ip);
+        if (e.ip == 0)
+                return -IPSET_ERR_HASH_ELEM;
 
-        if (adt == IPSET_TEST) {
-                e.ip = htonl(ip);
-                if (e.ip == 0)
-                        return -IPSET_ERR_HASH_ELEM;
+        if (adt == IPSET_TEST)
                 return adtfn(set, &e, &ext, &ext, flags);
-        }
 
         ip_to = ip;
         if (tb[IPSET_ATTR_IP_TO]) {
@@ -148,17 +147,20 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
 
-        if (retried)
+        if (retried) {
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip += hosts) {
                 e.ip = htonl(ip);
-                if (e.ip == 0)
-                        return -IPSET_ERR_HASH_ELEM;
+        }
+        for (; ip <= ip_to;) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-
                 if (ret && !ip_set_eexist(ret, flags))
                         return ret;
 
+                ip += hosts;
+                e.ip = htonl(ip);
+                if (e.ip == 0)
+                        return 0;
+
                 ret = 0;
         }
         return ret;
diff --git a/net/netfilter/ipset/ip_set_hash_ipmark.c b/net/netfilter/ipset/ip_set_hash_ipmark.c
index b64cf14e8352..f3ba8348cf9d 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmark.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmark.c
@@ -149,7 +149,7 @@ hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 e.ip = htonl(ip);
                 ret = adtfn(set, &e, &ext, &ext, flags);
 
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index f438740e6c6a..ddb8039ec1d2 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -178,7 +178,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
                 for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 6215fb898c50..a7f4d7a85420 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -185,7 +185,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
                 for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5ab1b99a53c2..a2f19b9906e9 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -271,7 +271,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 e.ip = htonl(ip);
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
@@ -281,7 +281,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                               ip == ntohl(h->next.ip) &&
                               p == ntohs(h->next.port)
                                 ? ntohl(h->next.ip2) : ip2_from;
-                        while (!after(ip2, ip2_to)) {
+                        while (ip2 <= ip2_to) {
                                 e.ip2 = htonl(ip2);
                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
                                                                 &cidr);
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 5d9e895452e7..1c67a1761e45 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -193,7 +193,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
         }
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
                 ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 44cf11939c91..d417074f1c1a 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -255,7 +255,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
                 ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index db614e13b193..7f9ae2e9645b 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -250,13 +250,13 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (retried)
                 ip = ntohl(h->next.ip[0]);
 
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip[0] = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
                 ip2 = (retried &&
                        ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
                                                    : ip2_from;
-                while (!after(ip2, ip2_to)) {
+                while (ip2 <= ip2_to) {
                         e.ip[1] = htonl(ip2);
                         last2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
                         ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 54b64b6cd0cd..e6ef382febe4 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -241,7 +241,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &cidr);
                 e.cidr = cidr - 1;
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index aff846960ac4..8602f2595a1a 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -291,7 +291,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (retried)
                 ip = ntohl(h->next.ip[0]);
 
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip[0] = htonl(ip);
                 ip_last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
                 p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
@@ -301,7 +301,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                         ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
                                p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
                                                          : ip2_from;
-                        while (!after(ip2, ip2_to)) {
+                        while (ip2 <= ip2_to) {
                                 e.ip[1] = htonl(ip2);
                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
                                                                 &e.cidr[1]);
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 90d396814798..4527921b1c3a 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -921,6 +921,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
 {
         struct sk_buff *new_skb = NULL;
         struct iphdr *old_iph = NULL;
+        __u8 old_dsfield;
 #ifdef CONFIG_IP_VS_IPV6
         struct ipv6hdr *old_ipv6h = NULL;
 #endif
@@ -945,7 +946,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
                         *payload_len =
                                 ntohs(old_ipv6h->payload_len) +
                                 sizeof(*old_ipv6h);
-                *dsfield = ipv6_get_dsfield(old_ipv6h);
+                old_dsfield = ipv6_get_dsfield(old_ipv6h);
                 *ttl = old_ipv6h->hop_limit;
                 if (df)
                         *df = 0;
@@ -960,12 +961,15 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
 
                 /* fix old IP header checksum */
                 ip_send_check(old_iph);
-                *dsfield = ipv4_get_dsfield(old_iph);
+                old_dsfield = ipv4_get_dsfield(old_iph);
                 *ttl = old_iph->ttl;
                 if (payload_len)
                         *payload_len = ntohs(old_iph->tot_len);
         }
 
+        /* Implement full-functionality option for ECN encapsulation */
+        *dsfield = INET_ECN_encapsulate(old_dsfield, old_dsfield);
+
         return skb;
 error:
         kfree_skb(skb);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 929927171426..64e1ee091225 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1048,7 +1048,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
                         goto nla_put_failure;
 
-                if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
+                if (basechain->stats && nft_dump_stats(skb, basechain->stats))
                         goto nla_put_failure;
         }
 
@@ -1487,8 +1487,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
 
                 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
                                                 genmask);
-                if (IS_ERR(chain2))
-                        return PTR_ERR(chain2);
+                if (!IS_ERR(chain2))
+                        return -EEXIST;
         }
 
         if (nla[NFTA_CHAIN_COUNTERS]) {
@@ -2741,8 +2741,10 @@ cont:
         list_for_each_entry(i, &ctx->table->sets, list) {
                 if (!nft_is_active_next(ctx->net, i))
                         continue;
-                if (!strcmp(set->name, i->name))
+                if (!strcmp(set->name, i->name)) {
+                        kfree(set->name);
                         return -ENFILE;
+                }
         }
         return 0;
 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index c83a3b5e1c6c..d8571f414208 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -892,7 +892,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                 if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
                         return ERR_PTR(-EFAULT);
 
-                strlcpy(info->name, compat_tmp.name, sizeof(info->name));
+                memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
                 info->num_counters = compat_tmp.num_counters;
                 user += sizeof(compat_tmp);
         } else
@@ -905,9 +905,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                 if (copy_from_user(info, user, sizeof(*info)) != 0)
                         return ERR_PTR(-EFAULT);
 
-                info->name[sizeof(info->name) - 1] = '\0';
                 user += sizeof(*info);
         }
+        info->name[sizeof(info->name) - 1] = '\0';
 
         size = sizeof(struct xt_counters);
         size *= info->num_counters;
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 38986a95216c..29123934887b 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/syscalls.h>
 #include <linux/skbuff.h>
 #include <linux/filter.h>
 #include <linux/bpf.h>
@@ -49,6 +50,22 @@ static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret)
         return 0;
 }
 
+static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
+{
+        mm_segment_t oldfs = get_fs();
+        int retval, fd;
+
+        set_fs(KERNEL_DS);
+        fd = bpf_obj_get_user(path);
+        set_fs(oldfs);
+        if (fd < 0)
+                return fd;
+
+        retval = __bpf_mt_check_fd(fd, ret);
+        sys_close(fd);
+        return retval;
+}
+
 static int bpf_mt_check(const struct xt_mtchk_param *par)
 {
         struct xt_bpf_info *info = par->matchinfo;
@@ -66,9 +83,10 @@ static int bpf_mt_check_v1(const struct xt_mtchk_param *par)
                 return __bpf_mt_check_bytecode(info->bpf_program,
                                                info->bpf_program_num_elem,
                                                &info->filter);
-        else if (info->mode == XT_BPF_MODE_FD_PINNED ||
-                 info->mode == XT_BPF_MODE_FD_ELF)
+        else if (info->mode == XT_BPF_MODE_FD_ELF)
                 return __bpf_mt_check_fd(info->fd, &info->filter);
+        else if (info->mode == XT_BPF_MODE_PATH_PINNED)
+                return __bpf_mt_check_path(info->path, &info->filter);
         else
                 return -EINVAL;
 }
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index e75ef39669c5..575d2153e3b8 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -76,7 +76,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                         transparent = nf_sk_is_transparent(sk);
 
                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
-                    transparent)
+                    transparent && sk_fullsock(sk))
                         pskb->mark = sk->sk_mark;
 
                 if (sk != skb->sk)
@@ -133,7 +133,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
                         transparent = nf_sk_is_transparent(sk);
 
                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
-                    transparent)
+                    transparent && sk_fullsock(sk))
                         pskb->mark = sk->sk_mark;
 
                 if (sk != skb->sk)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 327807731b44..b93148e8e9fb 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2266,14 +2266,18 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         cb->min_dump_alloc = control->min_dump_alloc;
         cb->skb = skb;
 
+        if (cb->start) {
+                ret = cb->start(cb);
+                if (ret)
+                        goto error_unlock;
+        }
+
         nlk->cb_running = true;
 
         mutex_unlock(nlk->cb_mutex);
 
-        if (cb->start)
-                cb->start(cb);
-
         ret = netlink_dump(sk);
+
         sock_put(sk);
 
         if (ret)
@@ -2303,6 +2307,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
         size_t tlvlen = 0;
         struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
         unsigned int flags = 0;
+        bool nlk_has_extack = nlk->flags & NETLINK_F_EXT_ACK;
 
         /* Error messages get the original request appened, unless the user
          * requests to cap the error message, and get extra error data if
@@ -2313,7 +2318,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
                         payload += nlmsg_len(nlh);
                 else
                         flags |= NLM_F_CAPPED;
-                if (nlk->flags & NETLINK_F_EXT_ACK && extack) {
+                if (nlk_has_extack && extack) {
                         if (extack->_msg)
                                 tlvlen += nla_total_size(strlen(extack->_msg) + 1);
                         if (extack->bad_attr)
@@ -2322,8 +2327,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
         } else {
                 flags |= NLM_F_CAPPED;
 
-                if (nlk->flags & NETLINK_F_EXT_ACK &&
-                    extack && extack->cookie_len)
+                if (nlk_has_extack && extack && extack->cookie_len)
                         tlvlen += nla_total_size(extack->cookie_len);
         }
 
@@ -2351,7 +2355,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
         errmsg->error = err;
         memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
 
-        if (nlk->flags & NETLINK_F_EXT_ACK && extack) {
+        if (nlk_has_extack && extack) {
                 if (err) {
                         if (extack->_msg)
                                 WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d288f52c53f7..2986941164b1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1769,7 +1769,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 
 out:
         if (err && rollover) {
-                kfree(rollover);
+                kfree_rcu(rollover, rcu);
                 po->rollover = NULL;
         }
         mutex_unlock(&fanout_mutex);
@@ -1796,8 +1796,10 @@ static struct packet_fanout *fanout_release(struct sock *sk)
                 else
                         f = NULL;
 
-                if (po->rollover)
+                if (po->rollover) {
                         kfree_rcu(po->rollover, rcu);
+                        po->rollover = NULL;
+                }
         }
         mutex_unlock(&fanout_mutex);
 
@@ -2840,6 +2842,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         struct virtio_net_hdr vnet_hdr = { 0 };
         int offset = 0;
         struct packet_sock *po = pkt_sk(sk);
+        bool has_vnet_hdr = false;
         int hlen, tlen, linear;
         int extra_len = 0;
 
@@ -2883,6 +2886,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 err = packet_snd_vnet_parse(msg, &len, &vnet_hdr);
                 if (err)
                         goto out_unlock;
+                has_vnet_hdr = true;
         }
 
         if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
@@ -2941,7 +2945,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->priority = sk->sk_priority;
         skb->mark = sockc.mark;
 
-        if (po->has_vnet_hdr) {
+        if (has_vnet_hdr) {
                 err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
                 if (err)
                         goto out_free;
@@ -3069,13 +3073,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
         int ret = 0;
         bool unlisted = false;
 
-        if (po->fanout)
-                return -EINVAL;
-
         lock_sock(sk);
         spin_lock(&po->bind_lock);
         rcu_read_lock();
 
+        if (po->fanout) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         if (name) {
                 dev = dev_get_by_name_rcu(sock_net(sk), name);
                 if (!dev) {
@@ -3847,6 +3853,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
         void *data = &val;
         union tpacket_stats_u st;
         struct tpacket_rollover_stats rstats;
+        struct packet_rollover *rollover;
 
         if (level != SOL_PACKET)
                 return -ENOPROTOOPT;
@@ -3925,13 +3932,18 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                        0);
                 break;
         case PACKET_ROLLOVER_STATS:
-                if (!po->rollover)
+                rcu_read_lock();
+                rollover = rcu_dereference(po->rollover);
+                if (rollover) {
+                        rstats.tp_all = atomic_long_read(&rollover->num);
+                        rstats.tp_huge = atomic_long_read(&rollover->num_huge);
+                        rstats.tp_failed = atomic_long_read(&rollover->num_failed);
+                        data = &rstats;
+                        lv = sizeof(rstats);
+                }
+                rcu_read_unlock();
+                if (!rollover)
                         return -EINVAL;
-                rstats.tp_all = atomic_long_read(&po->rollover->num);
-                rstats.tp_huge = atomic_long_read(&po->rollover->num_huge);
-                rstats.tp_failed = atomic_long_read(&po->rollover->num_failed);
-                data = &rstats;
-                lv = sizeof(rstats);
                 break;
         case PACKET_TX_HAS_OFF:
                 val = po->tp_tx_has_off;
diff --git a/net/psample/psample.c b/net/psample/psample.c
index 3a6ad0f438dc..64f95624f219 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -296,6 +296,6 @@ static void __exit psample_module_exit(void)
 module_init(psample_module_init);
 module_exit(psample_module_exit);
 
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("netlink channel for packet sampling");
 MODULE_LICENSE("GPL v2");
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 6ab39dbcca01..8557a1cae041 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -661,13 +661,15 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
                         }
                 }
 
-                rds_ib_set_wr_signal_state(ic, send, 0);
+                rds_ib_set_wr_signal_state(ic, send, false);
 
                 /*
                  * Always signal the last one if we're stopping due to flow control.
                  */
-                if (ic->i_flowctl && flow_controlled && i == (work_alloc-1))
-                        send->s_wr.send_flags |= IB_SEND_SIGNALED | IB_SEND_SOLICITED;
+                if (ic->i_flowctl && flow_controlled && i == (work_alloc - 1)) {
+                        rds_ib_set_wr_signal_state(ic, send, true);
+                        send->s_wr.send_flags |= IB_SEND_SOLICITED;
+                }
 
                 if (send->s_wr.send_flags & IB_SEND_SIGNALED)
                         nr_sig++;
@@ -705,11 +707,8 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
         if (scat == &rm->data.op_sg[rm->data.op_count]) {
                 prev->s_op = ic->i_data_op;
                 prev->s_wr.send_flags |= IB_SEND_SOLICITED;
-                if (!(prev->s_wr.send_flags & IB_SEND_SIGNALED)) {
-                        ic->i_unsignaled_wrs = rds_ib_sysctl_max_unsig_wrs;
-                        prev->s_wr.send_flags |= IB_SEND_SIGNALED;
-                        nr_sig++;
-                }
+                if (!(prev->s_wr.send_flags & IB_SEND_SIGNALED))
+                        nr_sig += rds_ib_set_wr_signal_state(ic, prev, true);
                 ic->i_data_op = NULL;
         }
 
@@ -792,6 +791,7 @@ int rds_ib_xmit_atomic(struct rds_connection *conn, struct rm_atomic_op *op)
                 send->s_atomic_wr.compare_add_mask = op->op_m_fadd.nocarry_mask;
                 send->s_atomic_wr.swap_mask = 0;
         }
+        send->s_wr.send_flags = 0;
         nr_sig = rds_ib_set_wr_signal_state(ic, send, op->op_notify);
         send->s_atomic_wr.wr.num_sge = 1;
         send->s_atomic_wr.wr.next = NULL;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index fb17552fd292..4b0a8288c98a 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -308,10 +308,11 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
         call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len,
                                      gfp);
         /* The socket has been unlocked. */
-        if (!IS_ERR(call))
+        if (!IS_ERR(call)) {
                 call->notify_rx = notify_rx;
+                mutex_unlock(&call->user_mutex);
+        }
 
-        mutex_unlock(&call->user_mutex);
         _leave(" = %p", call);
         return call;
 }
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index ec986ae52808..8b5abcd2f32f 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -264,12 +264,13 @@ static int __init sample_init_module(void)
 
 static void __exit sample_cleanup_module(void)
 {
+        rcu_barrier();
         tcf_unregister_action(&act_sample_ops, &sample_net_ops);
 }
 
 module_init(sample_init_module);
 module_exit(sample_cleanup_module);
 
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("Packet sampling action");
 MODULE_LICENSE("GPL v2");
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 0b2219adf520..b2d310745487 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -77,6 +77,8 @@ out:
 }
 EXPORT_SYMBOL(register_tcf_proto_ops);
 
+static struct workqueue_struct *tc_filter_wq;
+
 int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
 {
         struct tcf_proto_ops *t;
@@ -86,6 +88,7 @@ int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
          * tcf_proto_ops's destroy() handler.
          */
         rcu_barrier();
+        flush_workqueue(tc_filter_wq);
 
         write_lock(&cls_mod_lock);
         list_for_each_entry(t, &tcf_proto_base, head) {
@@ -100,6 +103,12 @@ int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
 }
 EXPORT_SYMBOL(unregister_tcf_proto_ops);
 
+bool tcf_queue_work(struct work_struct *work)
+{
+        return queue_work(tc_filter_wq, work);
+}
+EXPORT_SYMBOL(tcf_queue_work);
+
 /* Select new prio value from the range, managed by kernel. */
 
 static inline u32 tcf_auto_prio(struct tcf_proto *tp)
@@ -266,6 +275,23 @@ err_chain_create:
 }
 EXPORT_SYMBOL(tcf_block_get);
 
+static void tcf_block_put_final(struct work_struct *work)
+{
+        struct tcf_block *block = container_of(work, struct tcf_block, work);
+        struct tcf_chain *chain, *tmp;
+
+        rtnl_lock();
+        /* Only chain 0 should be still here. */
+        list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
+                tcf_chain_put(chain);
+        rtnl_unlock();
+        kfree(block);
+}
+
+/* XXX: Standalone actions are not allowed to jump to any chain, and bound
+ * actions should be all removed after flushing. However, filters are now
+ * destroyed in tc filter workqueue with RTNL lock, they can not race here.
+ */
 void tcf_block_put(struct tcf_block *block)
 {
         struct tcf_chain *chain, *tmp;
@@ -273,32 +299,15 @@ void tcf_block_put(struct tcf_block *block)
         if (!block)
                 return;
 
-        /* XXX: Standalone actions are not allowed to jump to any chain, and
-         * bound actions should be all removed after flushing. However,
-         * filters are destroyed in RCU callbacks, we have to hold the chains
-         * first, otherwise we would always race with RCU callbacks on this list
-         * without proper locking.
-         */
-
-        /* Wait for existing RCU callbacks to cool down. */
-        rcu_barrier();
-
-        /* Hold a refcnt for all chains, except 0, in case they are gone. */
-        list_for_each_entry(chain, &block->chain_list, list)
-                if (chain->index)
-                        tcf_chain_hold(chain);
-
-        /* No race on the list, because no chain could be destroyed. */
-        list_for_each_entry(chain, &block->chain_list, list)
+        list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
                 tcf_chain_flush(chain);
 
-        /* Wait for RCU callbacks to release the reference count. */
+        INIT_WORK(&block->work, tcf_block_put_final);
+        /* Wait for RCU callbacks to release the reference count and make
+         * sure their works have been queued before this.
+         */
         rcu_barrier();
-
-        /* At this point, all the chains should have refcnt == 1. */
-        list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
-                tcf_chain_put(chain);
-        kfree(block);
+        tcf_queue_work(&block->work);
 }
 EXPORT_SYMBOL(tcf_block_put);
 
@@ -879,6 +888,7 @@ void tcf_exts_destroy(struct tcf_exts *exts)
 #ifdef CONFIG_NET_CLS_ACT
         LIST_HEAD(actions);
 
+        ASSERT_RTNL();
         tcf_exts_to_list(exts, &actions);
         tcf_action_destroy(&actions, TCA_ACT_UNBIND);
         kfree(exts->actions);
@@ -1030,6 +1040,10 @@ EXPORT_SYMBOL(tcf_exts_get_dev);
 
 static int __init tc_filter_init(void)
 {
+        tc_filter_wq = alloc_ordered_workqueue("tc_filter_workqueue", 0);
+        if (!tc_filter_wq)
+                return -ENOMEM;
+
         rtnl_register(PF_UNSPEC, RTM_NEWTFILTER, tc_ctl_tfilter, NULL, 0);
         rtnl_register(PF_UNSPEC, RTM_DELTFILTER, tc_ctl_tfilter, NULL, 0);
         rtnl_register(PF_UNSPEC, RTM_GETTFILTER, tc_ctl_tfilter,
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index d89ebafd2239..f177649a2419 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -34,7 +34,10 @@ struct basic_filter {
         struct tcf_result       res;
         struct tcf_proto        *tp;
         struct list_head        link;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 static int basic_classify(struct sk_buff *skb, const struct tcf_proto *tp,
@@ -82,15 +85,26 @@ static int basic_init(struct tcf_proto *tp)
         return 0;
 }
 
-static void basic_delete_filter(struct rcu_head *head)
+static void basic_delete_filter_work(struct work_struct *work)
 {
-        struct basic_filter *f = container_of(head, struct basic_filter, rcu);
+        struct basic_filter *f = container_of(work, struct basic_filter, work);
 
+        rtnl_lock();
         tcf_exts_destroy(&f->exts);
         tcf_em_tree_destroy(&f->ematches);
+        rtnl_unlock();
+
         kfree(f);
 }
 
+static void basic_delete_filter(struct rcu_head *head)
+{
+        struct basic_filter *f = container_of(head, struct basic_filter, rcu);
+
+        INIT_WORK(&f->work, basic_delete_filter_work);
+        tcf_queue_work(&f->work);
+}
+
 static void basic_destroy(struct tcf_proto *tp)
 {
         struct basic_head *head = rtnl_dereference(tp->root);
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 520c5027646a..037a3ae86829 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -49,7 +49,10 @@ struct cls_bpf_prog {
         struct sock_filter *bpf_ops;
         const char *bpf_name;
         struct tcf_proto *tp;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 static const struct nla_policy bpf_policy[TCA_BPF_MAX + 1] = {
@@ -257,9 +260,21 @@ static void __cls_bpf_delete_prog(struct cls_bpf_prog *prog)
         kfree(prog);
 }
 
+static void cls_bpf_delete_prog_work(struct work_struct *work)
+{
+        struct cls_bpf_prog *prog = container_of(work, struct cls_bpf_prog, work);
+
+        rtnl_lock();
+        __cls_bpf_delete_prog(prog);
+        rtnl_unlock();
+}
+
 static void cls_bpf_delete_prog_rcu(struct rcu_head *rcu)
 {
-        __cls_bpf_delete_prog(container_of(rcu, struct cls_bpf_prog, rcu));
+        struct cls_bpf_prog *prog = container_of(rcu, struct cls_bpf_prog, rcu);
+
+        INIT_WORK(&prog->work, cls_bpf_delete_prog_work);
+        tcf_queue_work(&prog->work);
 }
 
 static void __cls_bpf_delete(struct tcf_proto *tp, struct cls_bpf_prog *prog)
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index d48452f87975..a97e069bee89 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -23,7 +23,10 @@ struct cls_cgroup_head {
         struct tcf_exts         exts;
         struct tcf_ematch_tree  ematches;
         struct tcf_proto        *tp;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 static int cls_cgroup_classify(struct sk_buff *skb, const struct tcf_proto *tp,
@@ -57,15 +60,26 @@ static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = {
         [TCA_CGROUP_EMATCHES]   = { .type = NLA_NESTED },
 };
 
+static void cls_cgroup_destroy_work(struct work_struct *work)
+{
+        struct cls_cgroup_head *head = container_of(work,
+                                                    struct cls_cgroup_head,
+                                                    work);
+        rtnl_lock();
+        tcf_exts_destroy(&head->exts);
+        tcf_em_tree_destroy(&head->ematches);
+        kfree(head);
+        rtnl_unlock();
+}
+
 static void cls_cgroup_destroy_rcu(struct rcu_head *root)
 {
         struct cls_cgroup_head *head = container_of(root,
                                                     struct cls_cgroup_head,
                                                     rcu);
 
-        tcf_exts_destroy(&head->exts);
-        tcf_em_tree_destroy(&head->ematches);
-        kfree(head);
+        INIT_WORK(&head->work, cls_cgroup_destroy_work);
+        tcf_queue_work(&head->work);
 }
 
 static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 2a3a60ec5b86..67f3a2af6aab 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -57,7 +57,10 @@ struct flow_filter {
         u32                     divisor;
         u32                     baseclass;
         u32                     hashrnd;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 static inline u32 addr_fold(void *addr)
@@ -369,14 +372,24 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
         [TCA_FLOW_PERTURB]      = { .type = NLA_U32 },
 };
 
-static void flow_destroy_filter(struct rcu_head *head)
+static void flow_destroy_filter_work(struct work_struct *work)
 {
-        struct flow_filter *f = container_of(head, struct flow_filter, rcu);
+        struct flow_filter *f = container_of(work, struct flow_filter, work);
 
+        rtnl_lock();
         del_timer_sync(&f->perturb_timer);
         tcf_exts_destroy(&f->exts);
         tcf_em_tree_destroy(&f->ematches);
         kfree(f);
+        rtnl_unlock();
+}
+
+static void flow_destroy_filter(struct rcu_head *head)
+{
+        struct flow_filter *f = container_of(head, struct flow_filter, rcu);
+
+        INIT_WORK(&f->work, flow_destroy_filter_work);
+        tcf_queue_work(&f->work);
 }
 
 static int flow_change(struct net *net, struct sk_buff *in_skb,
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d230cb4c8094..5b5722c8b32c 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -87,7 +87,10 @@ struct cls_fl_filter {
         struct list_head list;
         u32 handle;
         u32 flags;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
         struct net_device *hw_dev;
 };
 
@@ -215,12 +218,22 @@ static int fl_init(struct tcf_proto *tp)
         return 0;
 }
 
-static void fl_destroy_filter(struct rcu_head *head)
+static void fl_destroy_filter_work(struct work_struct *work)
 {
-        struct cls_fl_filter *f = container_of(head, struct cls_fl_filter, rcu);
+        struct cls_fl_filter *f = container_of(work, struct cls_fl_filter, work);
 
+        rtnl_lock();
         tcf_exts_destroy(&f->exts);
         kfree(f);
+        rtnl_unlock();
+}
+
+static void fl_destroy_filter(struct rcu_head *head)
+{
+        struct cls_fl_filter *f = container_of(head, struct cls_fl_filter, rcu);
+
+        INIT_WORK(&f->work, fl_destroy_filter_work);
+        tcf_queue_work(&f->work);
 }
 
 static void fl_hw_destroy_filter(struct tcf_proto *tp, struct cls_fl_filter *f)
@@ -234,6 +247,7 @@ static void fl_hw_destroy_filter(struct tcf_proto *tp, struct cls_fl_filter *f)
         tc_cls_common_offload_init(&cls_flower.common, tp);
         cls_flower.command = TC_CLSFLOWER_DESTROY;
         cls_flower.cookie = (unsigned long) f;
+        cls_flower.egress_dev = f->hw_dev != tp->q->dev_queue->dev;
 
         dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSFLOWER, &cls_flower);
 }
@@ -289,6 +303,7 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         cls_flower.command = TC_CLSFLOWER_STATS;
         cls_flower.cookie = (unsigned long) f;
         cls_flower.exts = &f->exts;
+        cls_flower.egress_dev = f->hw_dev != tp->q->dev_queue->dev;
 
         dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_CLSFLOWER,
                                       &cls_flower);
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 941245ad07fd..99183b8621ec 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -46,7 +46,10 @@ struct fw_filter {
 #endif /* CONFIG_NET_CLS_IND */
         struct tcf_exts         exts;
         struct tcf_proto        *tp;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 static u32 fw_hash(u32 handle)
@@ -119,12 +122,22 @@ static int fw_init(struct tcf_proto *tp)
         return 0;
 }
 
-static void fw_delete_filter(struct rcu_head *head)
+static void fw_delete_filter_work(struct work_struct *work)
 {
-        struct fw_filter *f = container_of(head, struct fw_filter, rcu);
+        struct fw_filter *f = container_of(work, struct fw_filter, work);
 
+        rtnl_lock();
         tcf_exts_destroy(&f->exts);
         kfree(f);
+        rtnl_unlock();
+}
+
+static void fw_delete_filter(struct rcu_head *head)
+{
+        struct fw_filter *f = container_of(head, struct fw_filter, rcu);
+
+        INIT_WORK(&f->work, fw_delete_filter_work);
+        tcf_queue_work(&f->work);
 }
 
 static void fw_destroy(struct tcf_proto *tp)
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index eeac606c95ab..c33f711b9019 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -21,7 +21,10 @@ struct cls_mall_head {
         struct tcf_result res;
         u32 handle;
         u32 flags;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
@@ -41,13 +44,23 @@ static int mall_init(struct tcf_proto *tp)
         return 0;
 }
 
+static void mall_destroy_work(struct work_struct *work)
+{
+        struct cls_mall_head *head = container_of(work, struct cls_mall_head,
+                                                  work);
+        rtnl_lock();
+        tcf_exts_destroy(&head->exts);
+        kfree(head);
+        rtnl_unlock();
+}
+
 static void mall_destroy_rcu(struct rcu_head *rcu)
 {
         struct cls_mall_head *head = container_of(rcu, struct cls_mall_head,
                                                   rcu);
 
-        tcf_exts_destroy(&head->exts);
-        kfree(head);
+        INIT_WORK(&head->work, mall_destroy_work);
+        tcf_queue_work(&head->work);
 }
 
 static int mall_replace_hw_filter(struct tcf_proto *tp,
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 9ddde65915d2..4b14ccd8b8f2 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -57,7 +57,10 @@ struct route4_filter {
         u32                     handle;
         struct route4_bucket    *bkt;
         struct tcf_proto        *tp;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 #define ROUTE4_FAILURE ((struct route4_filter *)(-1L))
@@ -254,12 +257,22 @@ static int route4_init(struct tcf_proto *tp)
         return 0;
 }
 
-static void route4_delete_filter(struct rcu_head *head)
+static void route4_delete_filter_work(struct work_struct *work)
 {
-        struct route4_filter *f = container_of(head, struct route4_filter, rcu);
+        struct route4_filter *f = container_of(work, struct route4_filter, work);
 
+        rtnl_lock();
         tcf_exts_destroy(&f->exts);
         kfree(f);
+        rtnl_unlock();
+}
+
+static void route4_delete_filter(struct rcu_head *head)
+{
+        struct route4_filter *f = container_of(head, struct route4_filter, rcu);
+
+        INIT_WORK(&f->work, route4_delete_filter_work);
+        tcf_queue_work(&f->work);
 }
 
 static void route4_destroy(struct tcf_proto *tp)
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index b1f6ed48bc72..bdbc541787f8 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -97,7 +97,10 @@ struct rsvp_filter {
 
         u32                             handle;
         struct rsvp_session             *sess;
-        struct rcu_head                 rcu;
+        union {
+                struct work_struct              work;
+                struct rcu_head                 rcu;
+        };
 };
 
 static inline unsigned int hash_dst(__be32 *dst, u8 protocol, u8 tunnelid)
@@ -282,12 +285,22 @@ static int rsvp_init(struct tcf_proto *tp)
         return -ENOBUFS;
 }
 
-static void rsvp_delete_filter_rcu(struct rcu_head *head)
+static void rsvp_delete_filter_work(struct work_struct *work)
 {
-        struct rsvp_filter *f = container_of(head, struct rsvp_filter, rcu);
+        struct rsvp_filter *f = container_of(work, struct rsvp_filter, work);
 
+        rtnl_lock();
         tcf_exts_destroy(&f->exts);
         kfree(f);
+        rtnl_unlock();
+}
+
+static void rsvp_delete_filter_rcu(struct rcu_head *head)
+{
+        struct rsvp_filter *f = container_of(head, struct rsvp_filter, rcu);
+
+        INIT_WORK(&f->work, rsvp_delete_filter_work);
+        tcf_queue_work(&f->work);
 }
 
 static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 14a7e08b2fa9..beaa95e09c25 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -27,14 +27,20 @@
 struct tcindex_filter_result {
         struct tcf_exts         exts;
         struct tcf_result       res;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
 };
 
 struct tcindex_filter {
         u16 key;
         struct tcindex_filter_result result;
         struct tcindex_filter __rcu *next;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 
@@ -133,12 +139,34 @@ static int tcindex_init(struct tcf_proto *tp)
         return 0;
 }
 
+static void tcindex_destroy_rexts_work(struct work_struct *work)
+{
+        struct tcindex_filter_result *r;
+
+        r = container_of(work, struct tcindex_filter_result, work);
+        rtnl_lock();
+        tcf_exts_destroy(&r->exts);
+        rtnl_unlock();
+}
+
 static void tcindex_destroy_rexts(struct rcu_head *head)
 {
         struct tcindex_filter_result *r;
 
         r = container_of(head, struct tcindex_filter_result, rcu);
-        tcf_exts_destroy(&r->exts);
+        INIT_WORK(&r->work, tcindex_destroy_rexts_work);
+        tcf_queue_work(&r->work);
+}
+
+static void tcindex_destroy_fexts_work(struct work_struct *work)
+{
+        struct tcindex_filter *f = container_of(work, struct tcindex_filter,
+                                                work);
+
+        rtnl_lock();
+        tcf_exts_destroy(&f->result.exts);
+        kfree(f);
+        rtnl_unlock();
 }
 
 static void tcindex_destroy_fexts(struct rcu_head *head)
@@ -146,8 +174,8 @@ static void tcindex_destroy_fexts(struct rcu_head *head)
         struct tcindex_filter *f = container_of(head, struct tcindex_filter,
                                                 rcu);
 
-        tcf_exts_destroy(&f->result.exts);
-        kfree(f);
+        INIT_WORK(&f->work, tcindex_destroy_fexts_work);
+        tcf_queue_work(&f->work);
 }
 
 static int tcindex_delete(struct tcf_proto *tp, void *arg, bool *last)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 10b8d851fc6b..dadd1b344497 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -68,7 +68,10 @@ struct tc_u_knode {
         u32 __percpu            *pcpu_success;
 #endif
         struct tcf_proto        *tp;
-        struct rcu_head         rcu;
+        union {
+                struct work_struct      work;
+                struct rcu_head         rcu;
+        };
         /* The 'sel' field MUST be the last field in structure to allow for
          * tc_u32_keys allocated at end of structure.
          */
@@ -418,11 +421,21 @@ static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n,
  * this the u32_delete_key_rcu variant does not free the percpu
  * statistics.
  */
+static void u32_delete_key_work(struct work_struct *work)
+{
+        struct tc_u_knode *key = container_of(work, struct tc_u_knode, work);
+
+        rtnl_lock();
+        u32_destroy_key(key->tp, key, false);
+        rtnl_unlock();
+}
+
 static void u32_delete_key_rcu(struct rcu_head *rcu)
 {
         struct tc_u_knode *key = container_of(rcu, struct tc_u_knode, rcu);
 
-        u32_destroy_key(key->tp, key, false);
+        INIT_WORK(&key->work, u32_delete_key_work);
+        tcf_queue_work(&key->work);
 }
 
 /* u32_delete_key_freepf_rcu is the rcu callback variant
@@ -432,11 +445,21 @@ static void u32_delete_key_rcu(struct rcu_head *rcu)
  * for the variant that should be used with keys return from
  * u32_init_knode()
  */
+static void u32_delete_key_freepf_work(struct work_struct *work)
+{
+        struct tc_u_knode *key = container_of(work, struct tc_u_knode, work);
+
+        rtnl_lock();
+        u32_destroy_key(key->tp, key, true);
+        rtnl_unlock();
+}
+
 static void u32_delete_key_freepf_rcu(struct rcu_head *rcu)
 {
         struct tc_u_knode *key = container_of(rcu, struct tc_u_knode, rcu);
 
-        u32_destroy_key(key->tp, key, true);
+        INIT_WORK(&key->work, u32_delete_key_freepf_work);
+        tcf_queue_work(&key->work);
 }
 
 static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode *key)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c6deb74e3d2f..22bc6fc48311 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -301,6 +301,8 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
         struct Qdisc *q;
 
+        if (!handle)
+                return NULL;
         q = qdisc_match_from_root(dev->qdisc, handle);
         if (q)
                 goto out;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 92a07141fd07..621b5ca3fd1c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -421,7 +421,7 @@ void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t,
 {
         struct dst_entry *dst;
 
-        if (!t)
+        if (sock_owned_by_user(sk) || !t)
                 return;
         dst = sctp_transport_dst_check(t);
         if (dst)
@@ -794,7 +794,7 @@ hit:
 struct sctp_hash_cmp_arg {
         const union sctp_addr   *paddr;
         const struct net        *net;
-        u16                     lport;
+        __be16                  lport;
 };
 
 static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
@@ -820,37 +820,37 @@ out:
         return err;
 }
 
-static inline u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
+static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
 {
         const struct sctp_transport *t = data;
         const union sctp_addr *paddr = &t->ipaddr;
         const struct net *net = sock_net(t->asoc->base.sk);
-        u16 lport = htons(t->asoc->base.bind_addr.port);
-        u32 addr;
+        __be16 lport = htons(t->asoc->base.bind_addr.port);
+        __u32 addr;
 
         if (paddr->sa.sa_family == AF_INET6)
                 addr = jhash(&paddr->v6.sin6_addr, 16, seed);
         else
-                addr = paddr->v4.sin_addr.s_addr;
+                addr = (__force __u32)paddr->v4.sin_addr.s_addr;
 
-        return  jhash_3words(addr, ((__u32)paddr->v4.sin_port) << 16 |
+        return  jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 |
                              (__force __u32)lport, net_hash_mix(net), seed);
 }
 
-static inline u32 sctp_hash_key(const void *data, u32 len, u32 seed)
+static inline __u32 sctp_hash_key(const void *data, u32 len, u32 seed)
 {
         const struct sctp_hash_cmp_arg *x = data;
         const union sctp_addr *paddr = x->paddr;
         const struct net *net = x->net;
-        u16 lport = x->lport;
-        u32 addr;
+        __be16 lport = x->lport;
+        __u32 addr;
 
         if (paddr->sa.sa_family == AF_INET6)
                 addr = jhash(&paddr->v6.sin6_addr, 16, seed);
         else
-                addr = paddr->v4.sin_addr.s_addr;
+                addr = (__force __u32)paddr->v4.sin_addr.s_addr;
 
-        return  jhash_3words(addr, ((__u32)paddr->v4.sin_port) << 16 |
+        return  jhash_3words(addr, ((__force __u32)paddr->v4.sin_port) << 16 |
                              (__force __u32)lport, net_hash_mix(net), seed);
 }
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 51c488769590..a6dfa86c0201 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -738,7 +738,7 @@ static int sctp_v6_skb_iif(const struct sk_buff *skb)
 /* Was this packet marked by Explicit Congestion Notification? */
 static int sctp_v6_is_ce(const struct sk_buff *skb)
 {
-        return *((__u32 *)(ipv6_hdr(skb))) & htonl(1 << 20);
+        return *((__u32 *)(ipv6_hdr(skb))) & (__force __u32)htonl(1 << 20);
 }
 
 /* Dump the v6 addr to the seq file. */
@@ -882,8 +882,10 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
                         net = sock_net(&opt->inet.sk);
                         rcu_read_lock();
                         dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
-                        if (!dev ||
-                            !ipv6_chk_addr(net, &addr->v6.sin6_addr, dev, 0)) {
+                        if (!dev || !(opt->inet.freebind ||
+                                      net->ipv6.sysctl.ip_nonlocal_bind ||
+                                      ipv6_chk_addr(net, &addr->v6.sin6_addr,
+                                                    dev, 0))) {
                                 rcu_read_unlock();
                                 return 0;
                         }
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 22ed01a76b19..a72a7d925d46 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -463,6 +463,7 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
                 .r = r,
                 .net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
         };
+        int pos = cb->args[2];
 
         /* eps hashtable dumps
          * args:
@@ -493,7 +494,8 @@ skip:
                 goto done;
 
         sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump,
-                                net, (int *)&cb->args[2], &commp);
+                                net, &pos, &commp);
+        cb->args[2] = pos;
 
 done:
         cb->args[1] = cb->args[4];
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index ca8f196b6c6c..514465b03829 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2854,7 +2854,7 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
                 addr_param_len = af->to_addr_param(addr, &addr_param);
                 param.param_hdr.type = flags;
                 param.param_hdr.length = htons(paramlen + addr_param_len);
-                param.crr_id = i;
+                param.crr_id = htonl(i);
 
                 sctp_addto_chunk(retval, paramlen, &param);
                 sctp_addto_chunk(retval, addr_param_len, &addr_param);
@@ -2867,7 +2867,7 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
                 addr_param_len = af->to_addr_param(addr, &addr_param);
                 param.param_hdr.type = SCTP_PARAM_DEL_IP;
                 param.param_hdr.length = htons(paramlen + addr_param_len);
-                param.crr_id = i;
+                param.crr_id = htonl(i);
 
                 sctp_addto_chunk(retval, paramlen, &param);
                 sctp_addto_chunk(retval, addr_param_len, &addr_param);
@@ -3591,7 +3591,7 @@ static struct sctp_chunk *sctp_make_reconf(const struct sctp_association *asoc,
  */
 struct sctp_chunk *sctp_make_strreset_req(
                                         const struct sctp_association *asoc,
-                                        __u16 stream_num, __u16 *stream_list,
+                                        __u16 stream_num, __be16 *stream_list,
                                         bool out, bool in)
 {
         struct sctp_strreset_outreq outreq;
@@ -3788,7 +3788,8 @@ bool sctp_verify_reconf(const struct sctp_association *asoc,
 {
         struct sctp_reconf_chunk *hdr;
         union sctp_params param;
-        __u16 last = 0, cnt = 0;
+        __be16 last = 0;
+        __u16 cnt = 0;
 
         hdr = (struct sctp_reconf_chunk *)chunk->chunk_hdr;
         sctp_walk_params(param, hdr, params) {
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index e6a2974e020e..e2d9a4b49c9c 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1607,12 +1607,12 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
                         break;
 
                 case SCTP_CMD_INIT_FAILED:
-                        sctp_cmd_init_failed(commands, asoc, cmd->obj.err);
+                        sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
                         break;
 
                 case SCTP_CMD_ASSOC_FAILED:
                         sctp_cmd_assoc_failed(commands, asoc, event_type,
-                                              subtype, chunk, cmd->obj.err);
+                                              subtype, chunk, cmd->obj.u32);
                         break;
 
                 case SCTP_CMD_INIT_COUNTER_INC:
@@ -1680,8 +1680,8 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
                 case SCTP_CMD_PROCESS_CTSN:
                         /* Dummy up a SACK for processing. */
                         sackh.cum_tsn_ack = cmd->obj.be32;
-                        sackh.a_rwnd = asoc->peer.rwnd +
-                                        asoc->outqueue.outstanding_bytes;
+                        sackh.a_rwnd = htonl(asoc->peer.rwnd +
+                                             asoc->outqueue.outstanding_bytes);
                         sackh.num_gap_ack_blocks = 0;
                         sackh.num_dup_tsns = 0;
                         chunk->subh.sack_hdr = &sackh;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d4730ada7f32..6f45d1713452 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -170,6 +170,36 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
         sk_mem_charge(sk, chunk->skb->truesize);
 }
 
+static void sctp_clear_owner_w(struct sctp_chunk *chunk)
+{
+        skb_orphan(chunk->skb);
+}
+
+static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
+                                       void (*cb)(struct sctp_chunk *))
+
+{
+        struct sctp_outq *q = &asoc->outqueue;
+        struct sctp_transport *t;
+        struct sctp_chunk *chunk;
+
+        list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
+                list_for_each_entry(chunk, &t->transmitted, transmitted_list)
+                        cb(chunk);
+
+        list_for_each_entry(chunk, &q->retransmit, list)
+                cb(chunk);
+
+        list_for_each_entry(chunk, &q->sacked, list)
+                cb(chunk);
+
+        list_for_each_entry(chunk, &q->abandoned, list)
+                cb(chunk);
+
+        list_for_each_entry(chunk, &q->out_chunk_list, list)
+                cb(chunk);
+}
+
 /* Verify that this is a valid address. */
 static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
                                    int len)
@@ -4906,6 +4936,10 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
         struct socket *sock;
         int err = 0;
 
+        /* Do not peel off from one netns to another one. */
+        if (!net_eq(current->nsproxy->net_ns, sock_net(sk)))
+                return -EINVAL;
+
         if (!asoc)
                 return -EINVAL;
 
@@ -8208,7 +8242,9 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
          * paths won't try to lock it and then oldsk.
          */
         lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
+        sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
         sctp_assoc_migrate(assoc, newsk);
+        sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
 
         /* If the association on the newsk is already closed before accept()
          * is called, set RCV_SHUTDOWN flag.
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 63ea15503714..fa8371ff05c4 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -118,6 +118,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
         __u16 i, str_nums, *str_list;
         struct sctp_chunk *chunk;
         int retval = -EINVAL;
+        __be16 *nstr_list;
         bool out, in;
 
         if (!asoc->peer.reconf_capable ||
@@ -148,13 +149,18 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
                         if (str_list[i] >= stream->incnt)
                                 goto out;
 
+        nstr_list = kcalloc(str_nums, sizeof(__be16), GFP_KERNEL);
+        if (!nstr_list) {
+                retval = -ENOMEM;
+                goto out;
+        }
+
         for (i = 0; i < str_nums; i++)
-                str_list[i] = htons(str_list[i]);
+                nstr_list[i] = htons(str_list[i]);
 
-        chunk = sctp_make_strreset_req(asoc, str_nums, str_list, out, in);
+        chunk = sctp_make_strreset_req(asoc, str_nums, nstr_list, out, in);
 
-        for (i = 0; i < str_nums; i++)
-                str_list[i] = ntohs(str_list[i]);
+        kfree(nstr_list);
 
         if (!chunk) {
                 retval = -ENOMEM;
@@ -305,7 +311,7 @@ out:
 }
 
 static struct sctp_paramhdr *sctp_chunk_lookup_strreset_param(
-                        struct sctp_association *asoc, __u32 resp_seq,
+                        struct sctp_association *asoc, __be32 resp_seq,
                         __be16 type)
 {
         struct sctp_chunk *chunk = asoc->strreset_chunk;
@@ -345,8 +351,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
 {
         struct sctp_strreset_outreq *outreq = param.v;
         struct sctp_stream *stream = &asoc->stream;
-        __u16 i, nums, flags = 0, *str_p = NULL;
         __u32 result = SCTP_STRRESET_DENIED;
+        __u16 i, nums, flags = 0;
+        __be16 *str_p = NULL;
         __u32 request_seq;
 
         request_seq = ntohl(outreq->request_seq);
@@ -439,8 +446,9 @@ struct sctp_chunk *sctp_process_strreset_inreq(
         struct sctp_stream *stream = &asoc->stream;
         __u32 result = SCTP_STRRESET_DENIED;
         struct sctp_chunk *chunk = NULL;
-        __u16 i, nums, *str_p;
         __u32 request_seq;
+        __u16 i, nums;
+        __be16 *str_p;
 
         request_seq = ntohl(inreq->request_seq);
         if (TSN_lt(asoc->strreset_inseq, request_seq) ||
@@ -769,7 +777,7 @@ struct sctp_chunk *sctp_process_strreset_resp(
 
         if (req->type == SCTP_PARAM_RESET_OUT_REQUEST) {
                 struct sctp_strreset_outreq *outreq;
-                __u16 *str_p;
+                __be16 *str_p;
 
                 outreq = (struct sctp_strreset_outreq *)req;
                 str_p = outreq->list_of_streams;
@@ -794,7 +802,7 @@ struct sctp_chunk *sctp_process_strreset_resp(
                         nums, str_p, GFP_ATOMIC);
         } else if (req->type == SCTP_PARAM_RESET_IN_REQUEST) {
                 struct sctp_strreset_inreq *inreq;
-                __u16 *str_p;
+                __be16 *str_p;
 
                 /* if the result is performed, it's impossible for inreq */
                 if (result == SCTP_STRRESET_PERFORMED)
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 67abc0194f30..5447228bf1a0 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -847,7 +847,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
 
 struct sctp_ulpevent *sctp_ulpevent_make_stream_reset_event(
         const struct sctp_association *asoc, __u16 flags, __u16 stream_num,
-        __u16 *stream_list, gfp_t gfp)
+        __be16 *stream_list, gfp_t gfp)
 {
         struct sctp_stream_reset_event *sreset;
         struct sctp_ulpevent *event;
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index d4ea46a5f233..c5fda15ba319 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -49,7 +49,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
 {
         /* Unrecoverable error in receive */
 
-        del_timer(&strp->msg_timer);
+        cancel_delayed_work(&strp->msg_timer_work);
 
         if (strp->stopped)
                 return;
@@ -68,7 +68,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
 static void strp_start_timer(struct strparser *strp, long timeo)
 {
         if (timeo)
-                mod_timer(&strp->msg_timer, timeo);
+                mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo);
 }
 
 /* Lower lock held */
@@ -319,7 +319,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                 eaten += (cand_len - extra);
 
                 /* Hurray, we have a new message! */
-                del_timer(&strp->msg_timer);
+                cancel_delayed_work(&strp->msg_timer_work);
                 strp->skb_head = NULL;
                 STRP_STATS_INCR(strp->stats.msgs);
 
@@ -450,9 +450,10 @@ static void strp_work(struct work_struct *w)
         do_strp_work(container_of(w, struct strparser, work));
 }
 
-static void strp_msg_timeout(unsigned long arg)
+static void strp_msg_timeout(struct work_struct *w)
 {
-        struct strparser *strp = (struct strparser *)arg;
+        struct strparser *strp = container_of(w, struct strparser,
+                                              msg_timer_work.work);
 
         /* Message assembly timed out */
         STRP_STATS_INCR(strp->stats.msg_timeouts);
@@ -505,9 +506,7 @@ int strp_init(struct strparser *strp, struct sock *sk,
         strp->cb.read_sock_done = cb->read_sock_done ? : default_read_sock_done;
         strp->cb.abort_parser = cb->abort_parser ? : strp_abort_strp;
 
-        setup_timer(&strp->msg_timer, strp_msg_timeout,
-                    (unsigned long)strp);
-
+        INIT_DELAYED_WORK(&strp->msg_timer_work, strp_msg_timeout);
         INIT_WORK(&strp->work, strp_work);
 
         return 0;
@@ -532,7 +531,7 @@ void strp_done(struct strparser *strp)
 {
         WARN_ON(!strp->stopped);
 
-        del_timer_sync(&strp->msg_timer);
+        cancel_delayed_work_sync(&strp->msg_timer_work);
         cancel_work_sync(&strp->work);
 
         if (strp->skb_head) {
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e741ec2b4d8e..898485e3ece4 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1333,7 +1333,7 @@ void xprt_release(struct rpc_task *task)
                 rpc_count_iostats(task, task->tk_client->cl_metrics);
         spin_lock(&xprt->recv_lock);
         if (!list_empty(&req->rq_list)) {
-                list_del(&req->rq_list);
+                list_del_init(&req->rq_list);
                 xprt_wait_on_pinned_rqst(req);
         }
         spin_unlock(&xprt->recv_lock);
@@ -1445,6 +1445,23 @@ out:
         return xprt;
 }
 
+static void xprt_destroy_cb(struct work_struct *work)
+{
+        struct rpc_xprt *xprt =
+                container_of(work, struct rpc_xprt, task_cleanup);
+
+        rpc_xprt_debugfs_unregister(xprt);
+        rpc_destroy_wait_queue(&xprt->binding);
+        rpc_destroy_wait_queue(&xprt->pending);
+        rpc_destroy_wait_queue(&xprt->sending);
+        rpc_destroy_wait_queue(&xprt->backlog);
+        kfree(xprt->servername);
+        /*
+         * Tear down transport state and free the rpc_xprt
+         */
+        xprt->ops->destroy(xprt);
+}
+
 /**
  * xprt_destroy - destroy an RPC transport, killing off all requests.
  * @xprt: transport to destroy
@@ -1454,22 +1471,19 @@ static void xprt_destroy(struct rpc_xprt *xprt)
 {
         dprintk("RPC:       destroying transport %p\n", xprt);
 
-        /* Exclude transport connect/disconnect handlers */
+        /*
+         * Exclude transport connect/disconnect handlers and autoclose
+         */
         wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE);
 
         del_timer_sync(&xprt->timer);
 
-        rpc_xprt_debugfs_unregister(xprt);
-        rpc_destroy_wait_queue(&xprt->binding);
-        rpc_destroy_wait_queue(&xprt->pending);
-        rpc_destroy_wait_queue(&xprt->sending);
-        rpc_destroy_wait_queue(&xprt->backlog);
-        cancel_work_sync(&xprt->task_cleanup);
-        kfree(xprt->servername);
         /*
-         * Tear down transport state and free the rpc_xprt
+         * Destroy sockets etc from the system workqueue so they can
+         * safely flush receive work running on rpciod.
          */
-        xprt->ops->destroy(xprt);
+        INIT_WORK(&xprt->task_cleanup, xprt_destroy_cb);
+        schedule_work(&xprt->task_cleanup);
 }
 
 static void xprt_destroy_kref(struct kref *kref)
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index 5a936a6a31a3..df062e086bdb 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -401,7 +401,7 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
         if (unlikely(n != mw->mw_nents))
                 goto out_mapmr_err;
 
-        dprintk("RPC:       %s: Using frmr %p to map %u segments (%u bytes)\n",
+        dprintk("RPC:       %s: Using frmr %p to map %u segments (%llu bytes)\n",
                 __func__, frmr, mw->mw_nents, mr->length);
 
         key = (u8)(mr->rkey & 0x000000FF);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9b5de31aa429..c1841f234a71 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2203,7 +2203,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
         struct sock_xprt *transport =
                 container_of(work, struct sock_xprt, connect_worker.work);
         struct rpc_xprt *xprt = &transport->xprt;
-        struct socket *sock = transport->sock;
+        struct socket *sock;
         int status = -EIO;
 
         sock = xs_create_sock(xprt, transport,
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 7d99029df342..a140dd4a84af 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -233,7 +233,7 @@ static int tipc_bcast_xmit(struct net *net, struct sk_buff_head *pkts,
         struct sk_buff_head xmitq;
         int rc = 0;
 
-        __skb_queue_head_init(&xmitq);
+        skb_queue_head_init(&xmitq);
         tipc_bcast_lock(net);
         if (tipc_link_bc_peers(l))
                 rc = tipc_link_xmit(l, pkts, &xmitq);
@@ -263,7 +263,7 @@ static int tipc_rcast_xmit(struct net *net, struct sk_buff_head *pkts,
         u32 dst, selector;
 
         selector = msg_link_selector(buf_msg(skb_peek(pkts)));
-        __skb_queue_head_init(&_pkts);
+        skb_queue_head_init(&_pkts);
 
         list_for_each_entry_safe(n, tmp, &dests->list, list) {
                 dst = n->value;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 6ef379f004ac..17146c16ee2d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -551,7 +551,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
                 return false;
         if (msg_errcode(msg))
                 return false;
-        *err = -TIPC_ERR_NO_NAME;
+        *err = TIPC_ERR_NO_NAME;
         if (skb_linearize(skb))
                 return false;
         msg = buf_msg(skb);
@@ -568,6 +568,14 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
         msg_set_destnode(msg, dnode);
         msg_set_destport(msg, dport);
         *err = TIPC_OK;
+
+        if (!skb_cloned(skb))
+                return true;
+
+        /* Unclone buffer in case it was bundled */
+        if (pskb_expand_head(skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
+                return false;
+
         return true;
 }
 
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 4d9679701a6d..384c84e83462 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -257,6 +257,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb,
         err = -ENOENT;
         if (sk == NULL)
                 goto out_nosk;
+        if (!net_eq(sock_net(sk), net))
+                goto out;
 
         err = sock_diag_check_cookie(sk, req->udiag_cookie);
         if (err)
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 14ed5a344cdf..e21991fe883a 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -310,11 +310,15 @@ static void hvs_close_connection(struct vmbus_channel *chan)
         struct sock *sk = get_per_channel_state(chan);
         struct vsock_sock *vsk = vsock_sk(sk);
 
+        lock_sock(sk);
+
         sk->sk_state = SS_UNCONNECTED;
         sock_set_flag(sk, SOCK_DONE);
         vsk->peer_shutdown |= SEND_SHUTDOWN | RCV_SHUTDOWN;
 
         sk->sk_state_change(sk);
+
+        release_sock(sk);
 }
 
 static void hvs_open_connection(struct vmbus_channel *chan)
@@ -344,6 +348,8 @@ static void hvs_open_connection(struct vmbus_channel *chan)
         if (!sk)
                 return;
 
+        lock_sock(sk);
+
         if ((conn_from_host && sk->sk_state != VSOCK_SS_LISTEN) ||
             (!conn_from_host && sk->sk_state != SS_CONNECTING))
                 goto out;
@@ -395,9 +401,7 @@ static void hvs_open_connection(struct vmbus_channel *chan)
 
                 vsock_insert_connected(vnew);
 
-                lock_sock(sk);
                 vsock_enqueue_accept(sk, new);
-                release_sock(sk);
         } else {
                 sk->sk_state = SS_CONNECTED;
                 sk->sk_socket->state = SS_CONNECTED;
@@ -410,6 +414,8 @@ static void hvs_open_connection(struct vmbus_channel *chan)
 out:
         /* Release refcnt obtained when we called vsock_find_bound_socket() */
         sock_put(sk);
+
+        release_sock(sk);
 }
 
 static u32 hvs_get_local_cid(void)
@@ -476,13 +482,21 @@ out:
 
 static void hvs_release(struct vsock_sock *vsk)
 {
+        struct sock *sk = sk_vsock(vsk);
         struct hvsock *hvs = vsk->trans;
-        struct vmbus_channel *chan = hvs->chan;
+        struct vmbus_channel *chan;
 
+        lock_sock(sk);
+
+        sk->sk_state = SS_DISCONNECTING;
+        vsock_remove_sock(vsk);
+
+        release_sock(sk);
+
+        chan = hvs->chan;
         if (chan)
                 hvs_shutdown(vsk, RCV_SHUTDOWN | SEND_SHUTDOWN);
 
-        vsock_remove_sock(vsk);
 }
 
 static void hvs_destruct(struct vsock_sock *vsk)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 690874293cfc..d396cb61a280 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 };
 
+/* policy for packet pattern attributes */
+static const struct nla_policy
+nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
+        [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
+        [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
+        [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
+};
+
 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                                      struct netlink_callback *cb,
                                      struct cfg80211_registered_device **rdev,
@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                         u8 *mask_pat;
 
                         nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                         NULL, info->extack);
+                                         nl80211_packet_pattern_policy,
+                                         info->extack);
                         err = -EINVAL;
                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
                             !pat_tb[NL80211_PKTPAT_PATTERN])
@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                             rem) {
                 u8 *mask_pat;
 
-                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL);
+                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                                 nl80211_packet_pattern_policy, NULL);
                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
                     !pat_tb[NL80211_PKTPAT_PATTERN])
                         return -EINVAL;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 0a49b88070d0..b6533ecbf5b1 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -522,11 +522,6 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
                 return -EOPNOTSUPP;
 
         if (wdev->current_bss) {
-                if (!prev_bssid)
-                        return -EALREADY;
-                if (prev_bssid &&
-                    !ether_addr_equal(prev_bssid, wdev->current_bss->pub.bssid))
-                        return -ENOTCONN;
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
@@ -1063,11 +1058,35 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         ASSERT_WDEV_LOCK(wdev);
 
-        if (WARN_ON(wdev->connect_keys)) {
-                kzfree(wdev->connect_keys);
-                wdev->connect_keys = NULL;
+        /*
+         * If we have an ssid_len, we're trying to connect or are
+         * already connected, so reject a new SSID unless it's the
+         * same (which is the case for re-association.)
+         */
+        if (wdev->ssid_len &&
+            (wdev->ssid_len != connect->ssid_len ||
+             memcmp(wdev->ssid, connect->ssid, wdev->ssid_len)))
+                return -EALREADY;
+
+        /*
+         * If connected, reject (re-)association unless prev_bssid
+         * matches the current BSSID.
+         */
+        if (wdev->current_bss) {
+                if (!prev_bssid)
+                        return -EALREADY;
+                if (!ether_addr_equal(prev_bssid, wdev->current_bss->pub.bssid))
+                        return -ENOTCONN;
         }
 
+        /*
+         * Reject if we're in the process of connecting with WEP,
+         * this case isn't very interesting and trying to handle
+         * it would make the code much more complex.
+         */
+        if (wdev->connect_keys)
+                return -EINPROGRESS;
+
         cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
                                   rdev->wiphy.ht_capa_mod_mask);
 
@@ -1118,7 +1137,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         if (err) {
                 wdev->connect_keys = NULL;
-                wdev->ssid_len = 0;
+                /*
+                 * This could be reassoc getting refused, don't clear
+                 * ssid_len in that case.
+                 */
+                if (!wdev->current_bss)
+                        wdev->ssid_len = 0;
                 return err;
         }
 
@@ -1145,6 +1169,14 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
         else if (wdev->ssid_len)
                 err = rdev_disconnect(rdev, dev, reason);
 
+        /*
+         * Clear ssid_len unless we actually were fully connected,
+         * in which case cfg80211_disconnected() will take care of
+         * this later.
+         */
+        if (!wdev->current_bss)
+                wdev->ssid_len = 0;
+
         return err;
 }
 
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index acf00104ef31..30e5746085b8 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
         }
 
         if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) {
+                xso->dev = NULL;
                 dev_put(dev);
                 return 0;
         }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 2515cd2bc5db..8ac9d32fb79d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -429,7 +429,8 @@ resume:
         nf_reset(skb);
 
         if (decaps) {
-                skb->sp->olen = 0;
+                if (skb->sp)
+                        skb->sp->olen = 0;
                 skb_dst_drop(skb);
                 gro_cells_receive(&gro_cells, skb);
                 return 0;
@@ -440,7 +441,8 @@ resume:
 
                 err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro || async);
                 if (xfrm_gro) {
-                        skb->sp->olen = 0;
+                        if (skb->sp)
+                                skb->sp->olen = 0;
                         skb_dst_drop(skb);
                         gro_cells_receive(&gro_cells, skb);
                         return err;
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 31a2e6d34dba..73ad8c8ef344 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -105,6 +105,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                 if (xfrm_offload(skb)) {
                         x->type_offload->encap(x, skb);
                 } else {
+                        /* Inner headers are invalid now. */
+                        skb->encapsulation = 0;
+
                         err = x->type->output(x, skb);
                         if (err == -EINPROGRESS)
                                 goto out;
@@ -208,7 +211,6 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
         int err;
 
         secpath_reset(skb);
-        skb->encapsulation = 0;
 
         if (xfrm_dev_offload_ok(skb, x)) {
                 struct sec_path *sp;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index f06253969972..8cafb3c0a4ac 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1573,6 +1573,14 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                         goto put_states;
                 }
 
+                if (!dst_prev)
+                        dst0 = dst1;
+                else
+                        /* Ref count is taken during xfrm_alloc_dst()
+                         * No need to do dst_clone() on dst1
+                         */
+                        dst_prev->child = dst1;
+
                 if (xfrm[i]->sel.family == AF_UNSPEC) {
                         inner_mode = xfrm_ip2inner_mode(xfrm[i],
                                                         xfrm_af2proto(family));
@@ -1584,14 +1592,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 } else
                         inner_mode = xfrm[i]->inner_mode;
 
-                if (!dst_prev)
-                        dst0 = dst1;
-                else
-                        /* Ref count is taken during xfrm_alloc_dst()
-                         * No need to do dst_clone() on dst1
-                         */
-                        dst_prev->child = dst1;
-
                 xdst->route = dst;
                 dst_copy_metrics(dst1, dst);
 
@@ -2076,7 +2076,6 @@ make_dummy_bundle:
         xdst->num_xfrms = num_xfrms;
         memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
 
-        dst_hold(&xdst->u.dst);
         return xdst;
 
 inc_error:
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 0dab1cd79ce4..1f5cee2269af 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -732,12 +732,12 @@ restart:
                         }
                 }
         }
+out:
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         if (cnt) {
                 err = 0;
                 xfrm_policy_cache_flush();
         }
-out:
-        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_flush);
@@ -2069,6 +2069,7 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
         if (err >= 0) {
                 xfrm_sk_policy_insert(sk, err, pol);
                 xfrm_pol_put(pol);
+                __sk_dst_reset(sk);
                 err = 0;
         }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2bfbd9121e3b..e44a0fed48dd 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -657,6 +657,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
+                xfrm_dev_state_delete(x);
                 __xfrm_state_put(x);
                 goto out;
         }
@@ -1692,32 +1693,34 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
 
 static int xfrm_dump_policy_done(struct netlink_callback *cb)
 {
-        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
         struct net *net = sock_net(cb->skb->sk);
 
         xfrm_policy_walk_done(walk, net);
         return 0;
 }
 
+static int xfrm_dump_policy_start(struct netlink_callback *cb)
+{
+        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
+
+        BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));
+
+        xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
+        return 0;
+}
+
 static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
         struct xfrm_dump_info info;
 
-        BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
-                     sizeof(cb->args) - sizeof(cb->args[0]));
-
         info.in_skb = cb->skb;
         info.out_skb = skb;
         info.nlmsg_seq = cb->nlh->nlmsg_seq;
         info.nlmsg_flags = NLM_F_MULTI;
 
-        if (!cb->args[0]) {
-                cb->args[0] = 1;
-                xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
-        }
-
         (void) xfrm_policy_walk(net, walk, dump_one_policy, &info);
 
         return skb->len;
@@ -2473,6 +2476,7 @@ static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
 
 static const struct xfrm_link {
         int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **);
+        int (*start)(struct netlink_callback *);
         int (*dump)(struct sk_buff *, struct netlink_callback *);
         int (*done)(struct netlink_callback *);
         const struct nla_policy *nla_pol;
@@ -2486,6 +2490,7 @@ static const struct xfrm_link {
         [XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
         [XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
         [XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
+                                                   .start = xfrm_dump_policy_start,
                                                    .dump = xfrm_dump_policy,
                                                    .done = xfrm_dump_policy_done },
         [XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
@@ -2538,6 +2543,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
 
                 {
                         struct netlink_dump_control c = {
+                                .start = link->start,
                                 .dump = link->dump,
                                 .done = link->done,
                         };
diff --git a/samples/sockmap/sockmap_kern.c b/samples/sockmap/sockmap_kern.c
index f9b38ef82dc2..52b0053274f4 100644
--- a/samples/sockmap/sockmap_kern.c
+++ b/samples/sockmap/sockmap_kern.c
@@ -62,7 +62,7 @@ int bpf_prog2(struct __sk_buff *skb)
                 ret = 1;
 
         bpf_printk("sockmap: %d -> %d @ %d\n", lport, bpf_ntohl(rport), ret);
-        return bpf_sk_redirect_map(&sock_map, ret, 0);
+        return bpf_sk_redirect_map(skb, &sock_map, ret, 0);
 }
 
 SEC("sockops")
diff --git a/samples/trace_events/trace-events-sample.c b/samples/trace_events/trace-events-sample.c
index bc7fcf010a5b..5522692100ba 100644
--- a/samples/trace_events/trace-events-sample.c
+++ b/samples/trace_events/trace-events-sample.c
@@ -78,29 +78,37 @@ static int simple_thread_fn(void *arg)
 }
 
 static DEFINE_MUTEX(thread_mutex);
+static int simple_thread_cnt;
 
 int foo_bar_reg(void)
 {
+        mutex_lock(&thread_mutex);
+        if (simple_thread_cnt++)
+                goto out;
+
         pr_info("Starting thread for foo_bar_fn\n");
         /*
          * We shouldn't be able to start a trace when the module is
          * unloading (there's other locks to prevent that). But
          * for consistency sake, we still take the thread_mutex.
          */
-        mutex_lock(&thread_mutex);
         simple_tsk_fn = kthread_run(simple_thread_fn, NULL, "event-sample-fn");
+ out:
         mutex_unlock(&thread_mutex);
         return 0;
 }
 
 void foo_bar_unreg(void)
 {
-        pr_info("Killing thread for foo_bar_fn\n");
-        /* protect against module unloading */
         mutex_lock(&thread_mutex);
+        if (--simple_thread_cnt)
+                goto out;
+
+        pr_info("Killing thread for foo_bar_fn\n");
         if (simple_tsk_fn)
                 kthread_stop(simple_tsk_fn);
         simple_tsk_fn = NULL;
+ out:
         mutex_unlock(&thread_mutex);
 }
 
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 2e3a10e79ca9..061d0c3a420a 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -265,6 +265,8 @@ objtool_args += --no-fp
 endif
 ifdef CONFIG_GCOV_KERNEL
 objtool_args += --no-unreachable
+else
+objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
 endif
 
 # 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 16923ba4b5b1..756d14f0d763 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -97,7 +97,6 @@ vmlinux.o: FORCE
         $(call cmd,kernel-mod)
 
 # Declare generated files as targets for modpost
-$(symverfile):         __modpost ;
 $(modules:.ko=.mod.c): __modpost ;
 
 
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index dd2c262aebbf..8b80bac055e4 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -6390,7 +6390,7 @@ sub process {
                 exit(0);
         }
 
-        if (!$is_patch && $file !~ /cover-letter\.patch$/) {
+        if (!$is_patch && $filename !~ /cover-letter\.patch$/) {
                 ERROR("NOT_UNIFIED_DIFF",
                       "Does not appear to be a unified-diff format patch\n");
         }
diff --git a/scripts/faddr2line b/scripts/faddr2line
index 29df825d375c..2f6ce802397d 100755
--- a/scripts/faddr2line
+++ b/scripts/faddr2line
@@ -103,11 +103,12 @@ __faddr2line() {
 
         # Go through each of the object's symbols which match the func name.
         # In rare cases there might be duplicates.
+        file_end=$(size -Ax $objfile | awk '$1 == ".text" {print $2}')
         while read symbol; do
                 local fields=($symbol)
                 local sym_base=0x${fields[0]}
                 local sym_type=${fields[1]}
-                local sym_end=0x${fields[3]}
+                local sym_end=${fields[3]}
 
                 # calculate the size
                 local sym_size=$(($sym_end - $sym_base))
@@ -157,7 +158,7 @@ __faddr2line() {
                 addr2line -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;"
                 DONE=1
 
-        done < <(nm -n $objfile | awk -v fn=$func '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, $1 }')
+        done < <(nm -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }')
 }
 
 [[ $# -lt 2 ]] && usage
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 5d554419170b..9ee9bf7fd1a2 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -158,7 +158,7 @@ static int read_symbol(FILE *in, struct sym_entry *s)
         else if (str[0] == '$')
                 return -1;
         /* exclude debugging symbols */
-        else if (stype == 'N')
+        else if (stype == 'N' || stype == 'n')
                 return -1;
 
         /* include the type field in the symbol name, so that it gets
diff --git a/scripts/spelling.txt b/scripts/spelling.txt
index 400ef35169c5..aa0cc49ad1ad 100644
--- a/scripts/spelling.txt
+++ b/scripts/spelling.txt
@@ -53,6 +53,7 @@ acumulator||accumulator
 adapater||adapter
 addional||additional
 additionaly||additionally
+additonal||additional
 addres||address
 adddress||address
 addreses||addresses
@@ -67,6 +68,8 @@ adviced||advised
 afecting||affecting
 againt||against
 agaist||against
+aggreataon||aggregation
+aggreation||aggregation
 albumns||albums
 alegorical||allegorical
 algined||aligned
@@ -80,6 +83,8 @@ aligment||alignment
 alignement||alignment
 allign||align
 alligned||aligned
+alllocate||allocate
+alloated||allocated
 allocatote||allocate
 allocatrd||allocated
 allocte||allocate
@@ -171,6 +176,7 @@ availale||available
 availavility||availability
 availble||available
 availiable||available
+availible||available
 avalable||available
 avaliable||available
 aysnc||async
@@ -203,6 +209,7 @@ broadcat||broadcast
 cacluated||calculated
 caculation||calculation
 calender||calendar
+calescing||coalescing
 calle||called
 callibration||calibration
 calucate||calculate
@@ -210,6 +217,7 @@ calulate||calculate
 cancelation||cancellation
 cancle||cancel
 capabilites||capabilities
+capabilty||capability
 capabitilies||capabilities
 capatibilities||capabilities
 capapbilities||capabilities
@@ -302,6 +310,7 @@ containts||contains
 contaisn||contains
 contant||contact
 contence||contents
+continious||continuous
 continous||continuous
 continously||continuously
 continueing||continuing
@@ -393,6 +402,7 @@ differrence||difference
 diffrent||different
 diffrentiate||differentiate
 difinition||definition
+dimesions||dimensions
 diplay||display
 direectly||directly
 disassocation||disassociation
@@ -449,6 +459,7 @@ equiped||equipped
 equivelant||equivalent
 equivilant||equivalent
 eror||error
+errorr||error
 estbalishment||establishment
 etsablishment||establishment
 etsbalishment||establishment
@@ -481,6 +492,7 @@ failied||failed
 faillure||failure
 failue||failure
 failuer||failure
+failng||failing
 faireness||fairness
 falied||failed
 faliure||failure
@@ -493,6 +505,7 @@ fetaure||feature
 fetaures||features
 fileystem||filesystem
 fimware||firmware
+firware||firmware
 finanize||finalize
 findn||find
 finilizes||finalizes
@@ -502,6 +515,7 @@ folloing||following
 followign||following
 followings||following
 follwing||following
+fonud||found
 forseeable||foreseeable
 forse||force
 fortan||fortran
@@ -532,6 +546,7 @@ grabing||grabbing
 grahical||graphical
 grahpical||graphical
 grapic||graphic
+grranted||granted
 guage||gauge
 guarenteed||guaranteed
 guarentee||guarantee
@@ -543,6 +558,7 @@ happend||happened
 harware||hardware
 heirarchically||hierarchically
 helpfull||helpful
+hybernate||hibernate
 hierachy||hierarchy
 hierarchie||hierarchy
 howver||however
@@ -565,16 +581,19 @@ implemenation||implementation
 implementaiton||implementation
 implementated||implemented
 implemention||implementation
+implementd||implemented
 implemetation||implementation
 implemntation||implementation
 implentation||implementation
 implmentation||implementation
 implmenting||implementing
+incative||inactive
 incomming||incoming
 incompatabilities||incompatibilities
 incompatable||incompatible
 inconsistant||inconsistent
 increas||increase
+incremeted||incremented
 incrment||increment
 indendation||indentation
 indended||intended
@@ -619,6 +638,7 @@ interger||integer
 intermittant||intermittent
 internel||internal
 interoprability||interoperability
+interuupt||interrupt
 interrface||interface
 interrrupt||interrupt
 interrup||interrupt
@@ -638,8 +658,10 @@ intrrupt||interrupt
 intterrupt||interrupt
 intuative||intuitive
 invaid||invalid
+invald||invalid
 invalde||invalid
 invalide||invalid
+invalidiate||invalidate
 invalud||invalid
 invididual||individual
 invokation||invocation
@@ -713,6 +735,7 @@ misformed||malformed
 mispelled||misspelled
 mispelt||misspelt
 mising||missing
+mismactch||mismatch
 missmanaged||mismanaged
 missmatch||mismatch
 miximum||maximum
@@ -731,6 +754,7 @@ multidimensionnal||multidimensional
 multple||multiple
 mumber||number
 muticast||multicast
+mutilcast||multicast
 mutiple||multiple
 mutli||multi
 nams||names
@@ -834,6 +858,7 @@ posible||possible
 positon||position
 possibilites||possibilities
 powerfull||powerful
+preample||preamble
 preapre||prepare
 preceeded||preceded
 preceeding||preceding
@@ -1059,6 +1084,7 @@ sturcture||structure
 subdirectoires||subdirectories
 suble||subtle
 substract||subtract
+submition||submission
 succesfully||successfully
 succesful||successful
 successed||succeeded
@@ -1078,6 +1104,7 @@ suppoted||supported
 suppported||supported
 suppport||support
 supress||suppress
+surpressed||suppressed
 surpresses||suppresses
 susbsystem||subsystem
 suspeneded||suspended
@@ -1091,6 +1118,7 @@ swithced||switched
 swithcing||switching
 swithed||switched
 swithing||switching
+swtich||switch
 symetric||symmetric
 synax||syntax
 synchonized||synchronized
@@ -1111,7 +1139,9 @@ therfore||therefore
 thier||their
 threds||threads
 threshhold||threshold
+thresold||threshold
 throught||through
+troughput||throughput
 thses||these
 tiggered||triggered
 tipically||typically
@@ -1120,6 +1150,7 @@ tmis||this
 torerable||tolerable
 tramsmitted||transmitted
 tramsmit||transmit
+tranasction||transaction
 tranfer||transfer
 transciever||transceiver
 transferd||transferred
@@ -1133,6 +1164,7 @@ trasmission||transmission
 treshold||threshold
 trigerring||triggering
 trun||turn
+tunning||tuning
 ture||true
 tyep||type
 udpate||update
@@ -1199,6 +1231,7 @@ visiters||visitors
 vitual||virtual
 wakeus||wakeups
 wating||waiting
+wiat||wait
 wether||whether
 whataver||whatever
 whcih||which
diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
index d5b291e94264..9cdec70d72b8 100644
--- a/security/apparmor/.gitignore
+++ b/security/apparmor/.gitignore
@@ -1,6 +1,5 @@
 #
 # Generated include files
 #
-net_names.h
 capability_names.h
 rlim_names.h
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index dafdd387d42b..81a34426d024 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -4,44 +4,11 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
 
 apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
               path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
-              resource.o secid.o file.o policy_ns.o label.o mount.o net.o
+              resource.o secid.o file.o policy_ns.o label.o mount.o
 apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o
 
-clean-files := capability_names.h rlim_names.h net_names.h
+clean-files := capability_names.h rlim_names.h
 
-# Build a lower case string table of address family names
-# Transform lines from
-#    #define AF_LOCAL           1       /* POSIX name for AF_UNIX       */
-#    #define AF_INET            2       /* Internet IP Protocol         */
-# to
-#    [1] = "local",
-#    [2] = "inet",
-#
-# and build the securityfs entries for the mapping.
-# Transforms lines from
-#    #define AF_INET            2       /* Internet IP Protocol         */
-# to
-#    #define AA_SFS_AF_MASK "local inet"
-quiet_cmd_make-af = GEN     $@
-cmd_make-af = echo "static const char *address_family_names[] = {" > $@ ;\
-        sed $< >>$@ -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
-         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
-        echo "};" >> $@ ;\
-        printf '%s' '\#define AA_SFS_AF_MASK "' >> $@ ;\
-        sed -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
-         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/\L\1/p'\
-         $< | tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
-
-# Build a lower case string table of sock type names
-# Transform lines from
-#    SOCK_STREAM        = 1,
-# to
-#    [1] = "stream",
-quiet_cmd_make-sock = GEN     $@
-cmd_make-sock = echo "static const char *sock_type_names[] = {" >> $@ ;\
-        sed $^ >>$@ -r -n \
-        -e 's/^\tSOCK_([A-Z0-9_]+)[\t]+=[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
-        echo "};" >> $@
 
 # Build a lower case string table of capability names
 # Transforms lines from
@@ -94,7 +61,6 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \
             tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
 
 $(obj)/capability.o : $(obj)/capability_names.h
-$(obj)/net.o : $(obj)/net_names.h
 $(obj)/resource.o : $(obj)/rlim_names.h
 $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
                             $(src)/Makefile
@@ -102,8 +68,3 @@ $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
 $(obj)/rlim_names.h : $(srctree)/include/uapi/asm-generic/resource.h \
                       $(src)/Makefile
         $(call cmd,make-rlim)
-$(obj)/net_names.h : $(srctree)/include/linux/socket.h \
-                     $(srctree)/include/linux/net.h \
-                     $(src)/Makefile
-        $(call cmd,make-af)
-        $(call cmd,make-sock)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 518d5928661b..caaf51dda648 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2202,7 +2202,6 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
         AA_SFS_DIR("policy",                    aa_sfs_entry_policy),
         AA_SFS_DIR("domain",                    aa_sfs_entry_domain),
         AA_SFS_DIR("file",                      aa_sfs_entry_file),
-        AA_SFS_DIR("network",                   aa_sfs_entry_network),
         AA_SFS_DIR("mount",                     aa_sfs_entry_mount),
         AA_SFS_DIR("namespaces",                aa_sfs_entry_ns),
         AA_SFS_FILE_U64("capability",           VFS_CAP_FLAGS_MASK),
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index db80221891c6..3382518b87fa 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -21,7 +21,6 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/match.h"
-#include "include/net.h"
 #include "include/path.h"
 #include "include/policy.h"
 #include "include/label.h"
@@ -567,32 +566,6 @@ static int __file_path_perm(const char *op, struct aa_label *label,
         return error;
 }
 
-static int __file_sock_perm(const char *op, struct aa_label *label,
-                            struct aa_label *flabel, struct file *file,
-                            u32 request, u32 denied)
-{
-        struct socket *sock = (struct socket *) file->private_data;
-        int error;
-
-        AA_BUG(!sock);
-
-        /* revalidation due to label out of date. No revocation at this time */
-        if (!denied && aa_label_is_subset(flabel, label))
-                return 0;
-
-        /* TODO: improve to skip profiles cached in flabel */
-        error = aa_sock_file_perm(label, op, request, sock);
-        if (denied) {
-                /* TODO: improve to skip profiles checked above */
-                /* check every profile in file label to is cached */
-                last_error(error, aa_sock_file_perm(flabel, op, request, sock));
-        }
-        if (!error)
-                update_file_ctx(file_ctx(file), label, request);
-
-        return error;
-}
-
 /**
  * aa_file_perm - do permission revalidation check & audit for @file
  * @op: operation being checked
@@ -637,9 +610,6 @@ int aa_file_perm(const char *op, struct aa_label *label, struct file *file,
                 error = __file_path_perm(op, label, flabel, file, request,
                                          denied);
 
-        else if (S_ISSOCK(file_inode(file)->i_mode))
-                error = __file_sock_perm(op, label, flabel, file, request,
-                                         denied);
 done:
         rcu_read_unlock();
 
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index ff4316e1068d..620e81169659 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -121,29 +121,21 @@ struct apparmor_audit_data {
                 /* these entries require a custom callback fn */
                 struct {
                         struct aa_label *peer;
-                        union {
-                                struct {
-                                        kuid_t ouid;
-                                        const char *target;
-                                } fs;
-                                struct {
-                                        int type, protocol;
-                                        struct sock *peer_sk;
-                                        void *addr;
-                                        int addrlen;
-                                } net;
-                                int signal;
-                                struct {
-                                        int rlim;
-                                        unsigned long max;
-                                } rlim;
-                        };
+                        struct {
+                                const char *target;
+                                kuid_t ouid;
+                        } fs;
                 };
                 struct {
                         struct aa_profile *profile;
                         const char *ns;
                         long pos;
                 } iface;
+                int signal;
+                struct {
+                        int rlim;
+                        unsigned long max;
+                } rlim;
                 struct {
                         const char *src_name;
                         const char *type;
diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
deleted file mode 100644
index 140c8efcf364..000000000000
--- a/security/apparmor/include/net.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * AppArmor security module
- *
- * This file contains AppArmor network mediation definitions.
- *
- * Copyright (C) 1998-2008 Novell/SUSE
- * Copyright 2009-2017 Canonical Ltd.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation, version 2 of the
- * License.
- */
-
-#ifndef __AA_NET_H
-#define __AA_NET_H
-
-#include <net/sock.h>
-#include <linux/path.h>
-
-#include "apparmorfs.h"
-#include "label.h"
-#include "perms.h"
-#include "policy.h"
-
-#define AA_MAY_SEND             AA_MAY_WRITE
-#define AA_MAY_RECEIVE          AA_MAY_READ
-
-#define AA_MAY_SHUTDOWN         AA_MAY_DELETE
-
-#define AA_MAY_CONNECT          AA_MAY_OPEN
-#define AA_MAY_ACCEPT           0x00100000
-
-#define AA_MAY_BIND             0x00200000
-#define AA_MAY_LISTEN           0x00400000
-
-#define AA_MAY_SETOPT           0x01000000
-#define AA_MAY_GETOPT           0x02000000
-
-#define NET_PERMS_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
-                        AA_MAY_SHUTDOWN | AA_MAY_BIND | AA_MAY_LISTEN |   \
-                        AA_MAY_CONNECT | AA_MAY_ACCEPT | AA_MAY_SETATTR | \
-                        AA_MAY_GETATTR | AA_MAY_SETOPT | AA_MAY_GETOPT)
-
-#define NET_FS_PERMS (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
-                      AA_MAY_SHUTDOWN | AA_MAY_CONNECT | AA_MAY_RENAME |\
-                      AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_CHMOD |  \
-                      AA_MAY_CHOWN | AA_MAY_CHGRP | AA_MAY_LOCK |       \
-                      AA_MAY_MPROT)
-
-#define NET_PEER_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CONNECT |  \
-                       AA_MAY_ACCEPT)
-struct aa_sk_ctx {
-        struct aa_label *label;
-        struct aa_label *peer;
-        struct path path;
-};
-
-#define SK_CTX(X) ((X)->sk_security)
-#define SOCK_ctx(X) SOCK_INODE(X)->i_security
-#define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P)                           \
-        struct lsm_network_audit NAME ## _net = { .sk = (SK),             \
-                                                  .family = (F)};         \
-        DEFINE_AUDIT_DATA(NAME,                                           \
-                          ((SK) && (F) != AF_UNIX) ? LSM_AUDIT_DATA_NET : \
-                                                     LSM_AUDIT_DATA_NONE, \
-                          OP);                                            \
-        NAME.u.net = &(NAME ## _net);                                     \
-        aad(&NAME)->net.type = (T);                                       \
-        aad(&NAME)->net.protocol = (P)
-
-#define DEFINE_AUDIT_SK(NAME, OP, SK)                                   \
-        DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type,  \
-                         (SK)->sk_protocol)
-
-/* struct aa_net - network confinement data
- * @allow: basic network families permissions
- * @audit: which network permissions to force audit
- * @quiet: which network permissions to quiet rejects
- */
-struct aa_net {
-        u16 allow[AF_MAX];
-        u16 audit[AF_MAX];
-        u16 quiet[AF_MAX];
-};
-
-
-extern struct aa_sfs_entry aa_sfs_entry_network[];
-
-void audit_net_cb(struct audit_buffer *ab, void *va);
-int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
-                       u32 request, u16 family, int type);
-int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
-               int type, int protocol);
-static inline int aa_profile_af_sk_perm(struct aa_profile *profile,
-                                        struct common_audit_data *sa,
-                                        u32 request,
-                                        struct sock *sk)
-{
-        return aa_profile_af_perm(profile, sa, request, sk->sk_family,
-                                  sk->sk_type);
-}
-int aa_sk_perm(const char *op, u32 request, struct sock *sk);
-
-int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
-                      struct socket *sock);
-
-
-static inline void aa_free_net_rules(struct aa_net *new)
-{
-        /* NOP */
-}
-
-#endif /* __AA_NET_H */
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index af04d5a7d73d..2b27bb79aec4 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -135,10 +135,9 @@ extern struct aa_perms allperms;
 
 
 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
-void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
-                         u32 mask);
+void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask);
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char * const *names, u32 namesmask);
+                        u32 chrsmask, const char **names, u32 namesmask);
 void aa_apply_modes_to_perms(struct aa_profile *profile,
                              struct aa_perms *perms);
 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 4364088a0b9e..17fe41a9cac3 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -30,7 +30,6 @@
 #include "file.h"
 #include "lib.h"
 #include "label.h"
-#include "net.h"
 #include "perms.h"
 #include "resource.h"
 
@@ -112,7 +111,6 @@ struct aa_data {
  * @policy: general match rules governing policy
  * @file: The set of rules governing basic file access and domain transitions
  * @caps: capabilities for the profile
- * @net: network controls for the profile
  * @rlimits: rlimits for the profile
  *
  * @dents: dentries for the profiles file entries in apparmorfs
@@ -150,7 +148,6 @@ struct aa_profile {
         struct aa_policydb policy;
         struct aa_file_rules file;
         struct aa_caps caps;
-        struct aa_net net;
         struct aa_rlimit rlimits;
 
         struct aa_loaddata *rawdata;
@@ -223,16 +220,6 @@ static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile *profile,
         return 0;
 }
 
-static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
-                                               u16 AF) {
-        unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
-        u16 be_af = cpu_to_be16(AF);
-
-        if (!state)
-                return 0;
-        return aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2);
-}
-
 /**
  * aa_get_profile - increment refcount on profile @p
  * @p: profile  (MAYBE NULL)
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 8818621b5d95..08ca26bcca77 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -211,8 +211,7 @@ void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask)
         *str = '\0';
 }
 
-void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
-                         u32 mask)
+void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask)
 {
         const char *fmt = "%s";
         unsigned int i, perm = 1;
@@ -230,7 +229,7 @@ void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
 }
 
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char * const *names, u32 namesmask)
+                        u32 chrsmask, const char **names, u32 namesmask)
 {
         char str[33];
 
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 72b915dfcaf7..1346ee5be04f 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -33,7 +33,6 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/ipc.h"
-#include "include/net.h"
 #include "include/path.h"
 #include "include/label.h"
 #include "include/policy.h"
@@ -737,368 +736,6 @@ static int apparmor_task_kill(struct task_struct *target, struct siginfo *info,
         return error;
 }
 
-/**
- * apparmor_sk_alloc_security - allocate and attach the sk_security field
- */
-static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
-{
-        struct aa_sk_ctx *ctx;
-
-        ctx = kzalloc(sizeof(*ctx), flags);
-        if (!ctx)
-                return -ENOMEM;
-
-        SK_CTX(sk) = ctx;
-
-        return 0;
-}
-
-/**
- * apparmor_sk_free_security - free the sk_security field
- */
-static void apparmor_sk_free_security(struct sock *sk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-
-        SK_CTX(sk) = NULL;
-        aa_put_label(ctx->label);
-        aa_put_label(ctx->peer);
-        path_put(&ctx->path);
-        kfree(ctx);
-}
-
-/**
- * apparmor_clone_security - clone the sk_security field
- */
-static void apparmor_sk_clone_security(const struct sock *sk,
-                                       struct sock *newsk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-        struct aa_sk_ctx *new = SK_CTX(newsk);
-
-        new->label = aa_get_label(ctx->label);
-        new->peer = aa_get_label(ctx->peer);
-        new->path = ctx->path;
-        path_get(&new->path);
-}
-
-static int aa_sock_create_perm(struct aa_label *label, int family, int type,
-                               int protocol)
-{
-        AA_BUG(!label);
-        AA_BUG(in_interrupt());
-
-        return aa_af_perm(label, OP_CREATE, AA_MAY_CREATE, family, type,
-                          protocol);
-}
-
-
-/**
- * apparmor_socket_create - check perms before creating a new socket
- */
-static int apparmor_socket_create(int family, int type, int protocol, int kern)
-{
-        struct aa_label *label;
-        int error = 0;
-
-        label = begin_current_label_crit_section();
-        if (!(kern || unconfined(label)))
-                error = aa_sock_create_perm(label, family, type, protocol);
-        end_current_label_crit_section(label);
-
-        return error;
-}
-
-/**
- * apparmor_socket_post_create - setup the per-socket security struct
- *
- * Note:
- * -   kernel sockets currently labeled unconfined but we may want to
- *     move to a special kernel label
- * -   socket may not have sk here if created with sock_create_lite or
- *     sock_alloc. These should be accept cases which will be handled in
- *     sock_graft.
- */
-static int apparmor_socket_post_create(struct socket *sock, int family,
-                                       int type, int protocol, int kern)
-{
-        struct aa_label *label;
-
-        if (kern) {
-                struct aa_ns *ns = aa_get_current_ns();
-
-                label = aa_get_label(ns_unconfined(ns));
-                aa_put_ns(ns);
-        } else
-                label = aa_get_current_label();
-
-        if (sock->sk) {
-                struct aa_sk_ctx *ctx = SK_CTX(sock->sk);
-
-                aa_put_label(ctx->label);
-                ctx->label = aa_get_label(label);
-        }
-        aa_put_label(label);
-
-        return 0;
-}
-
-/**
- * apparmor_socket_bind - check perms before bind addr to socket
- */
-static int apparmor_socket_bind(struct socket *sock,
-                                struct sockaddr *address, int addrlen)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!address);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk);
-}
-
-/**
- * apparmor_socket_connect - check perms before connecting @sock to @address
- */
-static int apparmor_socket_connect(struct socket *sock,
-                                   struct sockaddr *address, int addrlen)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!address);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
-}
-
-/**
- * apparmor_socket_list - check perms before allowing listen
- */
-static int apparmor_socket_listen(struct socket *sock, int backlog)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk);
-}
-
-/**
- * apparmor_socket_accept - check perms before accepting a new connection.
- *
- * Note: while @newsock is created and has some information, the accept
- *       has not been done.
- */
-static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!newsock);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk);
-}
-
-static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock,
-                            struct msghdr *msg, int size)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!msg);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(op, request, sock->sk);
-}
-
-/**
- * apparmor_socket_sendmsg - check perms before sending msg to another socket
- */
-static int apparmor_socket_sendmsg(struct socket *sock,
-                                   struct msghdr *msg, int size)
-{
-        return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
-}
-
-/**
- * apparmor_socket_recvmsg - check perms before receiving a message
- */
-static int apparmor_socket_recvmsg(struct socket *sock,
-                                   struct msghdr *msg, int size, int flags)
-{
-        return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size);
-}
-
-/* revaliation, get/set attr, shutdown */
-static int aa_sock_perm(const char *op, u32 request, struct socket *sock)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(op, request, sock->sk);
-}
-
-/**
- * apparmor_socket_getsockname - check perms before getting the local address
- */
-static int apparmor_socket_getsockname(struct socket *sock)
-{
-        return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock);
-}
-
-/**
- * apparmor_socket_getpeername - check perms before getting remote address
- */
-static int apparmor_socket_getpeername(struct socket *sock)
-{
-        return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock);
-}
-
-/* revaliation, get/set attr, opt */
-static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock,
-                            int level, int optname)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-
-        return aa_sk_perm(op, request, sock->sk);
-}
-
-/**
- * apparmor_getsockopt - check perms before getting socket options
- */
-static int apparmor_socket_getsockopt(struct socket *sock, int level,
-                                      int optname)
-{
-        return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock,
-                                level, optname);
-}
-
-/**
- * apparmor_setsockopt - check perms before setting socket options
- */
-static int apparmor_socket_setsockopt(struct socket *sock, int level,
-                                      int optname)
-{
-        return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock,
-                                level, optname);
-}
-
-/**
- * apparmor_socket_shutdown - check perms before shutting down @sock conn
- */
-static int apparmor_socket_shutdown(struct socket *sock, int how)
-{
-        return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock);
-}
-
-/**
- * apparmor_socket_sock_recv_skb - check perms before associating skb to sk
- *
- * Note: can not sleep may be called with locks held
- *
- * dont want protocol specific in __skb_recv_datagram()
- * to deny an incoming connection  socket_sock_rcv_skb()
- */
-static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
-{
-        return 0;
-}
-
-
-static struct aa_label *sk_peer_label(struct sock *sk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-
-        if (ctx->peer)
-                return ctx->peer;
-
-        return ERR_PTR(-ENOPROTOOPT);
-}
-
-/**
- * apparmor_socket_getpeersec_stream - get security context of peer
- *
- * Note: for tcp only valid if using ipsec or cipso on lan
- */
-static int apparmor_socket_getpeersec_stream(struct socket *sock,
-                                             char __user *optval,
-                                             int __user *optlen,
-                                             unsigned int len)
-{
-        char *name;
-        int slen, error = 0;
-        struct aa_label *label;
-        struct aa_label *peer;
-
-        label = begin_current_label_crit_section();
-        peer = sk_peer_label(sock->sk);
-        if (IS_ERR(peer)) {
-                error = PTR_ERR(peer);
-                goto done;
-        }
-        slen = aa_label_asxprint(&name, labels_ns(label), peer,
-                                 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
-                                 FLAG_HIDDEN_UNCONFINED, GFP_KERNEL);
-        /* don't include terminating \0 in slen, it breaks some apps */
-        if (slen < 0) {
-                error = -ENOMEM;
-        } else {
-                if (slen > len) {
-                        error = -ERANGE;
-                } else if (copy_to_user(optval, name, slen)) {
-                        error = -EFAULT;
-                        goto out;
-                }
-                if (put_user(slen, optlen))
-                        error = -EFAULT;
-out:
-                kfree(name);
-
-        }
-
-done:
-        end_current_label_crit_section(label);
-
-        return error;
-}
-
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-                                            struct sk_buff *skb, u32 *secid)
-
-{
-        /* TODO: requires secid support */
-        return -ENOPROTOOPT;
-}
-
-/**
- * apparmor_sock_graft - Initialize newly created socket
- * @sk: child sock
- * @parent: parent socket
- *
- * Note: could set off of SOCK_CTX(parent) but need to track inode and we can
- *       just set sk security information off of current creating process label
- *       Labeling of sk for accept case - probably should be sock based
- *       instead of task, because of the case where an implicitly labeled
- *       socket is shared by different tasks.
- */
-static void apparmor_sock_graft(struct sock *sk, struct socket *parent)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-
-        if (!ctx->label)
-                ctx->label = aa_get_current_label();
-}
-
 static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
         LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
@@ -1133,30 +770,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
         LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
 
-        LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
-        LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
-        LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
-
-        LSM_HOOK_INIT(socket_create, apparmor_socket_create),
-        LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
-        LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
-        LSM_HOOK_INIT(socket_connect, apparmor_socket_connect),
-        LSM_HOOK_INIT(socket_listen, apparmor_socket_listen),
-        LSM_HOOK_INIT(socket_accept, apparmor_socket_accept),
-        LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg),
-        LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg),
-        LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname),
-        LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername),
-        LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
-        LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
-        LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
-        LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
-        LSM_HOOK_INIT(socket_getpeersec_stream,
-                      apparmor_socket_getpeersec_stream),
-        LSM_HOOK_INIT(socket_getpeersec_dgram,
-                      apparmor_socket_getpeersec_dgram),
-        LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
-
         LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
         LSM_HOOK_INIT(cred_free, apparmor_cred_free),
         LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
deleted file mode 100644
index 33d54435f8d6..000000000000
--- a/security/apparmor/net.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * AppArmor security module
- *
- * This file contains AppArmor network mediation
- *
- * Copyright (C) 1998-2008 Novell/SUSE
- * Copyright 2009-2017 Canonical Ltd.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation, version 2 of the
- * License.
- */
-
-#include "include/apparmor.h"
-#include "include/audit.h"
-#include "include/context.h"
-#include "include/label.h"
-#include "include/net.h"
-#include "include/policy.h"
-
-#include "net_names.h"
-
-
-struct aa_sfs_entry aa_sfs_entry_network[] = {
-        AA_SFS_FILE_STRING("af_mask",   AA_SFS_AF_MASK),
-        { }
-};
-
-static const char * const net_mask_names[] = {
-        "unknown",
-        "send",
-        "receive",
-        "unknown",
-
-        "create",
-        "shutdown",
-        "connect",
-        "unknown",
-
-        "setattr",
-        "getattr",
-        "setcred",
-        "getcred",
-
-        "chmod",
-        "chown",
-        "chgrp",
-        "lock",
-
-        "mmap",
-        "mprot",
-        "unknown",
-        "unknown",
-
-        "accept",
-        "bind",
-        "listen",
-        "unknown",
-
-        "setopt",
-        "getopt",
-        "unknown",
-        "unknown",
-
-        "unknown",
-        "unknown",
-        "unknown",
-        "unknown",
-};
-
-
-/* audit callback for net specific fields */
-void audit_net_cb(struct audit_buffer *ab, void *va)
-{
-        struct common_audit_data *sa = va;
-
-        audit_log_format(ab, " family=");
-        if (address_family_names[sa->u.net->family])
-                audit_log_string(ab, address_family_names[sa->u.net->family]);
-        else
-                audit_log_format(ab, "\"unknown(%d)\"", sa->u.net->family);
-        audit_log_format(ab, " sock_type=");
-        if (sock_type_names[aad(sa)->net.type])
-                audit_log_string(ab, sock_type_names[aad(sa)->net.type]);
-        else
-                audit_log_format(ab, "\"unknown(%d)\"", aad(sa)->net.type);
-        audit_log_format(ab, " protocol=%d", aad(sa)->net.protocol);
-
-        if (aad(sa)->request & NET_PERMS_MASK) {
-                audit_log_format(ab, " requested_mask=");
-                aa_audit_perm_mask(ab, aad(sa)->request, NULL, 0,
-                                   net_mask_names, NET_PERMS_MASK);
-
-                if (aad(sa)->denied & NET_PERMS_MASK) {
-                        audit_log_format(ab, " denied_mask=");
-                        aa_audit_perm_mask(ab, aad(sa)->denied, NULL, 0,
-                                           net_mask_names, NET_PERMS_MASK);
-                }
-        }
-        if (aad(sa)->peer) {
-                audit_log_format(ab, " peer=");
-                aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
-                                FLAGS_NONE, GFP_ATOMIC);
-        }
-}
-
-
-/* Generic af perm */
-int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
-                       u32 request, u16 family, int type)
-{
-        struct aa_perms perms = { };
-
-        AA_BUG(family >= AF_MAX);
-        AA_BUG(type < 0 || type >= SOCK_MAX);
-
-        if (profile_unconfined(profile))
-                return 0;
-
-        perms.allow = (profile->net.allow[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        perms.audit = (profile->net.audit[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        perms.quiet = (profile->net.quiet[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        aa_apply_modes_to_perms(profile, &perms);
-
-        return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
-}
-
-int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
-               int type, int protocol)
-{
-        struct aa_profile *profile;
-        DEFINE_AUDIT_NET(sa, op, NULL, family, type, protocol);
-
-        return fn_for_each_confined(label, profile,
-                        aa_profile_af_perm(profile, &sa, request, family,
-                                           type));
-}
-
-static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
-                            struct sock *sk)
-{
-        struct aa_profile *profile;
-        DEFINE_AUDIT_SK(sa, op, sk);
-
-        AA_BUG(!label);
-        AA_BUG(!sk);
-
-        if (unconfined(label))
-                return 0;
-
-        return fn_for_each_confined(label, profile,
-                        aa_profile_af_sk_perm(profile, &sa, request, sk));
-}
-
-int aa_sk_perm(const char *op, u32 request, struct sock *sk)
-{
-        struct aa_label *label;
-        int error;
-
-        AA_BUG(!sk);
-        AA_BUG(in_interrupt());
-
-        /* TODO: switch to begin_current_label ???? */
-        label = begin_current_label_crit_section();
-        error = aa_label_sk_perm(label, op, request, sk);
-        end_current_label_crit_section(label);
-
-        return error;
-}
-
-
-int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
-                      struct socket *sock)
-{
-        AA_BUG(!label);
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-
-        return aa_label_sk_perm(label, op, request, sock->sk);
-}
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 5a2aec358322..4ede87c30f8b 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -275,19 +275,6 @@ fail:
         return 0;
 }
 
-static bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
-{
-        if (unpack_nameX(e, AA_U16, name)) {
-                if (!inbounds(e, sizeof(u16)))
-                        return 0;
-                if (data)
-                        *data = le16_to_cpu(get_unaligned((__le16 *) e->pos));
-                e->pos += sizeof(u16);
-                return 1;
-        }
-        return 0;
-}
-
 static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 {
         if (unpack_nameX(e, AA_U32, name)) {
@@ -597,7 +584,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         struct aa_profile *profile = NULL;
         const char *tmpname, *tmpns = NULL, *name = NULL;
         const char *info = "failed to unpack profile";
-        size_t size = 0, ns_len;
+        size_t ns_len;
         struct rhashtable_params params = { 0 };
         char *key = NULL;
         struct aa_data *data;
@@ -730,38 +717,6 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                 goto fail;
         }
 
-        size = unpack_array(e, "net_allowed_af");
-        if (size) {
-
-                for (i = 0; i < size; i++) {
-                        /* discard extraneous rules that this kernel will
-                         * never request
-                         */
-                        if (i >= AF_MAX) {
-                                u16 tmp;
-
-                                if (!unpack_u16(e, &tmp, NULL) ||
-                                    !unpack_u16(e, &tmp, NULL) ||
-                                    !unpack_u16(e, &tmp, NULL))
-                                        goto fail;
-                                continue;
-                        }
-                        if (!unpack_u16(e, &profile->net.allow[i], NULL))
-                                goto fail;
-                        if (!unpack_u16(e, &profile->net.audit[i], NULL))
-                                goto fail;
-                        if (!unpack_u16(e, &profile->net.quiet[i], NULL))
-                                goto fail;
-                }
-                if (!unpack_nameX(e, AA_ARRAYEND, NULL))
-                        goto fail;
-        }
-        if (VERSION_LT(e->version, v7)) {
-                /* pre v7 policy always allowed these */
-                profile->net.allow[AF_UNIX] = 0xffff;
-                profile->net.allow[AF_NETLINK] = 0xffff;
-        }
-
         if (unpack_nameX(e, AA_STRUCT, "policydb")) {
                 /* generic policy dfa - optional and may be NULL */
                 info = "failed to unpack policydb";
diff --git a/security/commoncap.c b/security/commoncap.c
index c25e0d27537f..fc46f5b85251 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -585,13 +585,14 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
         struct vfs_ns_cap_data data, *nscaps = &data;
         struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
         kuid_t rootkuid;
-        struct user_namespace *fs_ns = inode->i_sb->s_user_ns;
+        struct user_namespace *fs_ns;
 
         memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
 
         if (!inode)
                 return -ENODATA;
 
+        fs_ns = inode->i_sb->s_user_ns;
         size = __vfs_getxattr((struct dentry *)dentry, inode,
                               XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ);
         if (size == -ENODATA || size == -EOPNOTSUPP)
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index a7a23b5541f8..6462e6654ccf 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -45,10 +45,9 @@ config BIG_KEYS
         bool "Large payload keys"
         depends on KEYS
         depends on TMPFS
-        depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
+        select CRYPTO
         select CRYPTO_AES
-        select CRYPTO_ECB
-        select CRYPTO_RNG
+        select CRYPTO_GCM
         help
           This option provides support for holding large keys within the kernel
           (for example Kerberos ticket caches).  The data may be stored out to
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 6acb00f6f22c..929e14978c42 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -1,5 +1,6 @@
 /* Large capacity key type
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
@@ -16,10 +17,10 @@
 #include <linux/shmem_fs.h>
 #include <linux/err.h>
 #include <linux/scatterlist.h>
+#include <linux/random.h>
 #include <keys/user-type.h>
 #include <keys/big_key-type.h>
-#include <crypto/rng.h>
-#include <crypto/skcipher.h>
+#include <crypto/aead.h>
 
 /*
  * Layout of key payload words.
@@ -49,7 +50,12 @@ enum big_key_op {
 /*
  * Key size for big_key data encryption
  */
-#define ENC_KEY_SIZE    16
+#define ENC_KEY_SIZE 32
+
+/*
+ * Authentication tag length
+ */
+#define ENC_AUTHTAG_SIZE 16
 
 /*
  * big_key defined keys take an arbitrary string as the description and an
@@ -64,57 +70,62 @@ struct key_type key_type_big_key = {
         .destroy                = big_key_destroy,
         .describe               = big_key_describe,
         .read                   = big_key_read,
+        /* no ->update(); don't add it without changing big_key_crypt() nonce */
 };
 
 /*
- * Crypto names for big_key data encryption
+ * Crypto names for big_key data authenticated encryption
  */
-static const char big_key_rng_name[] = "stdrng";
-static const char big_key_alg_name[] = "ecb(aes)";
+static const char big_key_alg_name[] = "gcm(aes)";
 
 /*
- * Crypto algorithms for big_key data encryption
+ * Crypto algorithms for big_key data authenticated encryption
  */
-static struct crypto_rng *big_key_rng;
-static struct crypto_skcipher *big_key_skcipher;
+static struct crypto_aead *big_key_aead;
 
 /*
- * Generate random key to encrypt big_key data
+ * Since changing the key affects the entire object, we need a mutex.
  */
-static inline int big_key_gen_enckey(u8 *key)
-{
-        return crypto_rng_get_bytes(big_key_rng, key, ENC_KEY_SIZE);
-}
+static DEFINE_MUTEX(big_key_aead_lock);
 
 /*
  * Encrypt/decrypt big_key data
  */
 static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key)
 {
-        int ret = -EINVAL;
+        int ret;
         struct scatterlist sgio;
-        SKCIPHER_REQUEST_ON_STACK(req, big_key_skcipher);
-
-        if (crypto_skcipher_setkey(big_key_skcipher, key, ENC_KEY_SIZE)) {
+        struct aead_request *aead_req;
+        /* We always use a zero nonce. The reason we can get away with this is
+         * because we're using a different randomly generated key for every
+         * different encryption. Notably, too, key_type_big_key doesn't define
+         * an .update function, so there's no chance we'll wind up reusing the
+         * key to encrypt updated data. Simply put: one key, one encryption.
+         */
+        u8 zero_nonce[crypto_aead_ivsize(big_key_aead)];
+
+        aead_req = aead_request_alloc(big_key_aead, GFP_KERNEL);
+        if (!aead_req)
+                return -ENOMEM;
+
+        memset(zero_nonce, 0, sizeof(zero_nonce));
+        sg_init_one(&sgio, data, datalen + (op == BIG_KEY_ENC ? ENC_AUTHTAG_SIZE : 0));
+        aead_request_set_crypt(aead_req, &sgio, &sgio, datalen, zero_nonce);
+        aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
+        aead_request_set_ad(aead_req, 0);
+
+        mutex_lock(&big_key_aead_lock);
+        if (crypto_aead_setkey(big_key_aead, key, ENC_KEY_SIZE)) {
                 ret = -EAGAIN;
                 goto error;
         }
-
-        skcipher_request_set_tfm(req, big_key_skcipher);
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
-                                      NULL, NULL);
-
-        sg_init_one(&sgio, data, datalen);
-        skcipher_request_set_crypt(req, &sgio, &sgio, datalen, NULL);
-
         if (op == BIG_KEY_ENC)
-                ret = crypto_skcipher_encrypt(req);
+                ret = crypto_aead_encrypt(aead_req);
         else
-                ret = crypto_skcipher_decrypt(req);
-
-        skcipher_request_zero(req);
-
+                ret = crypto_aead_decrypt(aead_req);
 error:
+        mutex_unlock(&big_key_aead_lock);
+        aead_request_free(aead_req);
         return ret;
 }
 
@@ -146,16 +157,13 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                  *
                  * File content is stored encrypted with randomly generated key.
                  */
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
-                /* prepare aligned data to encrypt */
                 data = kmalloc(enclen, GFP_KERNEL);
                 if (!data)
                         return -ENOMEM;
-
                 memcpy(data, prep->data, datalen);
-                memset(data + datalen, 0x00, enclen - datalen);
 
                 /* generate random key */
                 enckey = kmalloc(ENC_KEY_SIZE, GFP_KERNEL);
@@ -163,13 +171,12 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                         ret = -ENOMEM;
                         goto error;
                 }
-
-                ret = big_key_gen_enckey(enckey);
-                if (ret)
+                ret = get_random_bytes_wait(enckey, ENC_KEY_SIZE);
+                if (unlikely(ret))
                         goto err_enckey;
 
                 /* encrypt aligned data */
-                ret = big_key_crypt(BIG_KEY_ENC, data, enclen, enckey);
+                ret = big_key_crypt(BIG_KEY_ENC, data, datalen, enckey);
                 if (ret)
                         goto err_enckey;
 
@@ -195,7 +202,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                 *path = file->f_path;
                 path_get(path);
                 fput(file);
-                kfree(data);
+                kzfree(data);
         } else {
                 /* Just store the data in a buffer */
                 void *data = kmalloc(datalen, GFP_KERNEL);
@@ -211,9 +218,9 @@ int big_key_preparse(struct key_preparsed_payload *prep)
 err_fput:
         fput(file);
 err_enckey:
-        kfree(enckey);
+        kzfree(enckey);
 error:
-        kfree(data);
+        kzfree(data);
         return ret;
 }
 
@@ -227,7 +234,7 @@ void big_key_free_preparse(struct key_preparsed_payload *prep)
 
                 path_put(path);
         }
-        kfree(prep->payload.data[big_key_data]);
+        kzfree(prep->payload.data[big_key_data]);
 }
 
 /*
@@ -240,7 +247,7 @@ void big_key_revoke(struct key *key)
 
         /* clear the quota */
         key_payload_reserve(key, 0);
-        if (key_is_instantiated(key) &&
+        if (key_is_positive(key) &&
             (size_t)key->payload.data[big_key_len] > BIG_KEY_FILE_THRESHOLD)
                 vfs_truncate(path, 0);
 }
@@ -259,7 +266,7 @@ void big_key_destroy(struct key *key)
                 path->mnt = NULL;
                 path->dentry = NULL;
         }
-        kfree(key->payload.data[big_key_data]);
+        kzfree(key->payload.data[big_key_data]);
         key->payload.data[big_key_data] = NULL;
 }
 
@@ -272,7 +279,7 @@ void big_key_describe(const struct key *key, struct seq_file *m)
 
         seq_puts(m, key->description);
 
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                 seq_printf(m, ": %zu [%s]",
                            datalen,
                            datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff");
@@ -295,7 +302,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
                 struct file *file;
                 u8 *data;
                 u8 *enckey = (u8 *)key->payload.data[big_key_data];
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
                 data = kmalloc(enclen, GFP_KERNEL);
@@ -328,7 +335,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
 err_fput:
                 fput(file);
 error:
-                kfree(data);
+                kzfree(data);
         } else {
                 ret = datalen;
                 if (copy_to_user(buffer, key->payload.data[big_key_data],
@@ -344,47 +351,31 @@ error:
  */
 static int __init big_key_init(void)
 {
-        struct crypto_skcipher *cipher;
-        struct crypto_rng *rng;
         int ret;
 
-        rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-        if (IS_ERR(rng)) {
-                pr_err("Can't alloc rng: %ld\n", PTR_ERR(rng));
-                return PTR_ERR(rng);
-        }
-
-        big_key_rng = rng;
-
-        /* seed RNG */
-        ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
-        if (ret) {
-                pr_err("Can't reset rng: %d\n", ret);
-                goto error_rng;
-        }
-
         /* init block cipher */
-        cipher = crypto_alloc_skcipher(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(cipher)) {
-                ret = PTR_ERR(cipher);
+        big_key_aead = crypto_alloc_aead(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(big_key_aead)) {
+                ret = PTR_ERR(big_key_aead);
                 pr_err("Can't alloc crypto: %d\n", ret);
-                goto error_rng;
+                return ret;
+        }
+        ret = crypto_aead_setauthsize(big_key_aead, ENC_AUTHTAG_SIZE);
+        if (ret < 0) {
+                pr_err("Can't set crypto auth tag len: %d\n", ret);
+                goto free_aead;
         }
-
-        big_key_skcipher = cipher;
 
         ret = register_key_type(&key_type_big_key);
         if (ret < 0) {
                 pr_err("Can't register type: %d\n", ret);
-                goto error_cipher;
+                goto free_aead;
         }
 
         return 0;
 
-error_cipher:
-        crypto_free_skcipher(big_key_skcipher);
-error_rng:
-        crypto_free_rng(big_key_rng);
+free_aead:
+        crypto_free_aead(big_key_aead);
         return ret;
 }
 
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 69855ba0d3b3..d92cbf9687c3 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -309,6 +309,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
 
         down_read(&ukey->sem);
         upayload = user_key_payload_locked(ukey);
+        if (!upayload) {
+                /* key was revoked before we acquired its semaphore */
+                up_read(&ukey->sem);
+                key_put(ukey);
+                ukey = ERR_PTR(-EKEYREVOKED);
+                goto error;
+        }
         *master_key = upayload->data;
         *master_keylen = upayload->datalen;
 error:
@@ -847,7 +854,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
         size_t datalen = prep->datalen;
         int ret = 0;
 
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_negative(key))
                 return -ENOKEY;
         if (datalen <= 0 || datalen > 32767 || !prep->data)
                 return -EINVAL;
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 87cb260e4890..f01d48cb3de1 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -129,15 +129,15 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
         while (!list_empty(keys)) {
                 struct key *key =
                         list_entry(keys->next, struct key, graveyard_link);
+                short state = key->state;
+
                 list_del(&key->graveyard_link);
 
                 kdebug("- %u", key->serial);
                 key_check(key);
 
                 /* Throw away the key data if the key is instantiated */
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
-                    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
-                    key->type->destroy)
+                if (state == KEY_IS_POSITIVE && key->type->destroy)
                         key->type->destroy(key);
 
                 security_key_free(key);
@@ -151,7 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                 }
 
                 atomic_dec(&key->user->nkeys);
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+                if (state != KEY_IS_UNINSTANTIATED)
                         atomic_dec(&key->user->nikeys);
 
                 key_user_put(key->user);
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 1c02c6547038..503adbae7b0d 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -141,7 +141,7 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx);
 extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx);
 
-extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
+extern struct key *find_keyring_by_name(const char *name, bool uid_keyring);
 
 extern int install_user_keyrings(void);
 extern int install_thread_keyring_to_cred(struct cred *);
diff --git a/security/keys/key.c b/security/keys/key.c
index 83da68d98b40..83bf4b4afd49 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -54,10 +54,10 @@ void __key_check(const struct key *key)
 struct key_user *key_user_lookup(kuid_t uid)
 {
         struct key_user *candidate = NULL, *user;
-        struct rb_node *parent = NULL;
-        struct rb_node **p;
+        struct rb_node *parent, **p;
 
 try_again:
+        parent = NULL;
         p = &key_user_tree.rb_node;
         spin_lock(&key_user_lock);
 
@@ -302,6 +302,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
         if (flags & KEY_ALLOC_BUILT_IN)
                 key->flags |= 1 << KEY_FLAG_BUILTIN;
+        if (flags & KEY_ALLOC_UID_KEYRING)
+                key->flags |= 1 << KEY_FLAG_UID_KEYRING;
 
 #ifdef KEY_DEBUGGING
         key->magic = KEY_DEBUG_MAGIC;
@@ -400,6 +402,18 @@ int key_payload_reserve(struct key *key, size_t datalen)
 EXPORT_SYMBOL(key_payload_reserve);
 
 /*
+ * Change the key state to being instantiated.
+ */
+static void mark_key_instantiated(struct key *key, int reject_error)
+{
+        /* Commit the payload before setting the state; barrier versus
+         * key_read_state().
+         */
+        smp_store_release(&key->state,
+                          (reject_error < 0) ? reject_error : KEY_IS_POSITIVE);
+}
+
+/*
  * Instantiate a key and link it into the target keyring atomically.  Must be
  * called with the target keyring's semaphore writelocked.  The target key's
  * semaphore need not be locked as instantiation is serialised by
@@ -422,14 +436,14 @@ static int __key_instantiate_and_link(struct key *key,
         mutex_lock(&key_construction_mutex);
 
         /* can't instantiate twice */
-        if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+        if (key->state == KEY_IS_UNINSTANTIATED) {
                 /* instantiate the key */
                 ret = key->type->instantiate(key, prep);
 
                 if (ret == 0) {
                         /* mark the key as being instantiated */
                         atomic_inc(&key->user->nikeys);
-                        set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
+                        mark_key_instantiated(key, 0);
 
                         if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
                                 awaken = 1;
@@ -575,13 +589,10 @@ int key_reject_and_link(struct key *key,
         mutex_lock(&key_construction_mutex);
 
         /* can't instantiate twice */
-        if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+        if (key->state == KEY_IS_UNINSTANTIATED) {
                 /* mark the key as being negatively instantiated */
                 atomic_inc(&key->user->nikeys);
-                key->reject_error = -error;
-                smp_wmb();
-                set_bit(KEY_FLAG_NEGATIVE, &key->flags);
-                set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
+                mark_key_instantiated(key, -error);
                 now = current_kernel_time();
                 key->expiry = now.tv_sec + timeout;
                 key_schedule_gc(key->expiry + key_gc_delay);
@@ -750,8 +761,8 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
 
         ret = key->type->update(key, prep);
         if (ret == 0)
-                /* updating a negative key instantiates it */
-                clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+                /* Updating a negative key positively instantiates it */
+                mark_key_instantiated(key, 0);
 
         up_write(&key->sem);
 
@@ -934,6 +945,16 @@ error:
          */
         __key_link_end(keyring, &index_key, edit);
 
+        key = key_ref_to_ptr(key_ref);
+        if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) {
+                ret = wait_for_key_construction(key, true);
+                if (ret < 0) {
+                        key_ref_put(key_ref);
+                        key_ref = ERR_PTR(ret);
+                        goto error_free_prep;
+                }
+        }
+
         key_ref = __key_update(key_ref, &prep);
         goto error_free_prep;
 }
@@ -984,8 +1005,8 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
 
         ret = key->type->update(key, &prep);
         if (ret == 0)
-                /* updating a negative key instantiates it */
-                clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+                /* Updating a negative key positively instantiates it */
+                mark_key_instantiated(key, 0);
 
         up_write(&key->sem);
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index ab0b337c84b4..76d22f726ae4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -766,12 +766,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 
         key = key_ref_to_ptr(key_ref);
 
+        ret = key_read_state(key);
+        if (ret < 0)
+                goto error2; /* Negatively instantiated */
+
         /* see if we can read it directly */
         ret = key_permission(key_ref, KEY_NEED_READ);
         if (ret == 0)
                 goto can_read_key;
         if (ret != -EACCES)
-                goto error;
+                goto error2;
 
         /* we can't; see if it's searchable from this process's keyrings
          * - we automatically take account of the fact that it may be
@@ -896,7 +900,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
                 atomic_dec(&key->user->nkeys);
                 atomic_inc(&newowner->nkeys);
 
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+                if (key->state != KEY_IS_UNINSTANTIATED) {
                         atomic_dec(&key->user->nikeys);
                         atomic_inc(&newowner->nikeys);
                 }
@@ -1406,11 +1410,9 @@ long keyctl_assume_authority(key_serial_t id)
         }
 
         ret = keyctl_change_reqkey_auth(authkey);
-        if (ret < 0)
-                goto error;
+        if (ret == 0)
+                ret = authkey->serial;
         key_put(authkey);
-
-        ret = authkey->serial;
 error:
         return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index de81793f9920..a7e51f793867 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -414,7 +414,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
         else
                 seq_puts(m, "[anon]");
 
-        if (key_is_instantiated(keyring)) {
+        if (key_is_positive(keyring)) {
                 if (keyring->keys.nr_leaves_on_tree != 0)
                         seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
                 else
@@ -423,7 +423,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
 }
 
 struct keyring_read_iterator_context {
-        size_t                  qty;
+        size_t                  buflen;
         size_t                  count;
         key_serial_t __user     *buffer;
 };
@@ -435,9 +435,9 @@ static int keyring_read_iterator(const void *object, void *data)
         int ret;
 
         kenter("{%s,%d},,{%zu/%zu}",
-               key->type->name, key->serial, ctx->count, ctx->qty);
+               key->type->name, key->serial, ctx->count, ctx->buflen);
 
-        if (ctx->count >= ctx->qty)
+        if (ctx->count >= ctx->buflen)
                 return 1;
 
         ret = put_user(key->serial, ctx->buffer);
@@ -472,16 +472,12 @@ static long keyring_read(const struct key *keyring,
                 return 0;
 
         /* Calculate how much data we could return */
-        ctx.qty = nr_keys * sizeof(key_serial_t);
-
         if (!buffer || !buflen)
-                return ctx.qty;
-
-        if (buflen > ctx.qty)
-                ctx.qty = buflen;
+                return nr_keys * sizeof(key_serial_t);
 
         /* Copy the IDs of the subscribed keys into the buffer */
         ctx.buffer = (key_serial_t __user *)buffer;
+        ctx.buflen = buflen;
         ctx.count = 0;
         ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
         if (ret < 0) {
@@ -557,7 +553,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 {
         struct keyring_search_context *ctx = iterator_data;
         const struct key *key = keyring_ptr_to_key(object);
-        unsigned long kflags = key->flags;
+        unsigned long kflags = READ_ONCE(key->flags);
+        short state = READ_ONCE(key->state);
 
         kenter("{%d}", key->serial);
 
@@ -569,6 +566,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 
         /* skip invalidated, revoked and expired keys */
         if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+                time_t expiry = READ_ONCE(key->expiry);
+
                 if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
                               (1 << KEY_FLAG_REVOKED))) {
                         ctx->result = ERR_PTR(-EKEYREVOKED);
@@ -576,7 +575,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
                         goto skipped;
                 }
 
-                if (key->expiry && ctx->now.tv_sec >= key->expiry) {
+                if (expiry && ctx->now.tv_sec >= expiry) {
                         if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))
                                 ctx->result = ERR_PTR(-EKEYEXPIRED);
                         kleave(" = %d [expire]", ctx->skipped_ret);
@@ -601,9 +600,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 
         if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
                 /* we set a different error code if we pass a negative key */
-                if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
-                        smp_rmb();
-                        ctx->result = ERR_PTR(key->reject_error);
+                if (state < 0) {
+                        ctx->result = ERR_PTR(state);
                         kleave(" = %d [neg]", ctx->skipped_ret);
                         goto skipped;
                 }
@@ -1101,15 +1099,15 @@ found:
 /*
  * Find a keyring with the specified name.
  *
- * All named keyrings in the current user namespace are searched, provided they
- * grant Search permission directly to the caller (unless this check is
- * skipped).  Keyrings whose usage points have reached zero or who have been
- * revoked are skipped.
+ * Only keyrings that have nonzero refcount, are not revoked, and are owned by a
+ * user in the current user namespace are considered.  If @uid_keyring is %true,
+ * the keyring additionally must have been allocated as a user or user session
+ * keyring; otherwise, it must grant Search permission directly to the caller.
  *
  * Returns a pointer to the keyring with the keyring's refcount having being
  * incremented on success.  -ENOKEY is returned if a key could not be found.
  */
-struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+struct key *find_keyring_by_name(const char *name, bool uid_keyring)
 {
         struct key *keyring;
         int bucket;
@@ -1137,10 +1135,15 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                         if (strcmp(keyring->description, name) != 0)
                                 continue;
 
-                        if (!skip_perm_check &&
-                            key_permission(make_key_ref(keyring, 0),
-                                           KEY_NEED_SEARCH) < 0)
-                                continue;
+                        if (uid_keyring) {
+                                if (!test_bit(KEY_FLAG_UID_KEYRING,
+                                              &keyring->flags))
+                                        continue;
+                        } else {
+                                if (key_permission(make_key_ref(keyring, 0),
+                                                   KEY_NEED_SEARCH) < 0)
+                                        continue;
+                        }
 
                         /* we've got a match but we might end up racing with
                          * key_cleanup() if the keyring is currently 'dead'
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 732cc0beffdf..a72b4dd70c8a 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -88,7 +88,8 @@ EXPORT_SYMBOL(key_task_permission);
  */
 int key_validate(const struct key *key)
 {
-        unsigned long flags = key->flags;
+        unsigned long flags = READ_ONCE(key->flags);
+        time_t expiry = READ_ONCE(key->expiry);
 
         if (flags & (1 << KEY_FLAG_INVALIDATED))
                 return -ENOKEY;
@@ -99,9 +100,9 @@ int key_validate(const struct key *key)
                 return -EKEYREVOKED;
 
         /* check it hasn't expired */
-        if (key->expiry) {
+        if (expiry) {
                 struct timespec now = current_kernel_time();
-                if (now.tv_sec >= key->expiry)
+                if (now.tv_sec >= expiry)
                         return -EKEYEXPIRED;
         }
 
diff --git a/security/keys/proc.c b/security/keys/proc.c
index bf08d02b6646..6d1fcbba1e09 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -179,15 +179,18 @@ static int proc_keys_show(struct seq_file *m, void *v)
         struct rb_node *_p = v;
         struct key *key = rb_entry(_p, struct key, serial_node);
         struct timespec now;
+        time_t expiry;
         unsigned long timo;
+        unsigned long flags;
         key_ref_t key_ref, skey_ref;
         char xbuf[16];
+        short state;
         int rc;
 
         struct keyring_search_context ctx = {
                 .index_key.type         = key->type,
                 .index_key.description  = key->description,
-                .cred                   = current_cred(),
+                .cred                   = m->file->f_cred,
                 .match_data.cmp         = lookup_user_key_possessed,
                 .match_data.raw_data    = key,
                 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
@@ -207,11 +210,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
                 }
         }
 
-        /* check whether the current task is allowed to view the key (assuming
-         * non-possession)
-         * - the caller holds a spinlock, and thus the RCU read lock, making our
-         *   access to __current_cred() safe
-         */
+        /* check whether the current task is allowed to view the key */
         rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
         if (rc < 0)
                 return 0;
@@ -221,12 +220,13 @@ static int proc_keys_show(struct seq_file *m, void *v)
         rcu_read_lock();
 
         /* come up with a suitable timeout value */
-        if (key->expiry == 0) {
+        expiry = READ_ONCE(key->expiry);
+        if (expiry == 0) {
                 memcpy(xbuf, "perm", 5);
-        } else if (now.tv_sec >= key->expiry) {
+        } else if (now.tv_sec >= expiry) {
                 memcpy(xbuf, "expd", 5);
         } else {
-                timo = key->expiry - now.tv_sec;
+                timo = expiry - now.tv_sec;
 
                 if (timo < 60)
                         sprintf(xbuf, "%lus", timo);
@@ -240,18 +240,21 @@ static int proc_keys_show(struct seq_file *m, void *v)
                         sprintf(xbuf, "%luw", timo / (60*60*24*7));
         }
 
-#define showflag(KEY, LETTER, FLAG) \
-        (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-')
+        state = key_read_state(key);
+
+#define showflag(FLAGS, LETTER, FLAG) \
+        ((FLAGS & (1 << FLAG)) ? LETTER : '-')
 
+        flags = READ_ONCE(key->flags);
         seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
                    key->serial,
-                   showflag(key, 'I', KEY_FLAG_INSTANTIATED),
-                   showflag(key, 'R', KEY_FLAG_REVOKED),
-                   showflag(key, 'D', KEY_FLAG_DEAD),
-                   showflag(key, 'Q', KEY_FLAG_IN_QUOTA),
-                   showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT),
-                   showflag(key, 'N', KEY_FLAG_NEGATIVE),
-                   showflag(key, 'i', KEY_FLAG_INVALIDATED),
+                   state != KEY_IS_UNINSTANTIATED ? 'I' : '-',
+                   showflag(flags, 'R', KEY_FLAG_REVOKED),
+                   showflag(flags, 'D', KEY_FLAG_DEAD),
+                   showflag(flags, 'Q', KEY_FLAG_IN_QUOTA),
+                   showflag(flags, 'U', KEY_FLAG_USER_CONSTRUCT),
+                   state < 0 ? 'N' : '-',
+                   showflag(flags, 'i', KEY_FLAG_INVALIDATED),
                    refcount_read(&key->usage),
                    xbuf,
                    key->perm,
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 86bced9fdbdf..740affd65ee9 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -77,7 +77,8 @@ int install_user_keyrings(void)
                 if (IS_ERR(uid_keyring)) {
                         uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID,
                                                     cred, user_keyring_perm,
-                                                    KEY_ALLOC_IN_QUOTA,
+                                                    KEY_ALLOC_UID_KEYRING |
+                                                        KEY_ALLOC_IN_QUOTA,
                                                     NULL, NULL);
                         if (IS_ERR(uid_keyring)) {
                                 ret = PTR_ERR(uid_keyring);
@@ -94,7 +95,8 @@ int install_user_keyrings(void)
                         session_keyring =
                                 keyring_alloc(buf, user->uid, INVALID_GID,
                                               cred, user_keyring_perm,
-                                              KEY_ALLOC_IN_QUOTA,
+                                              KEY_ALLOC_UID_KEYRING |
+                                                  KEY_ALLOC_IN_QUOTA,
                                               NULL, NULL);
                         if (IS_ERR(session_keyring)) {
                                 ret = PTR_ERR(session_keyring);
@@ -728,7 +730,7 @@ try_again:
 
         ret = -EIO;
         if (!(lflags & KEY_LOOKUP_PARTIAL) &&
-            !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+            key_read_state(key) == KEY_IS_UNINSTANTIATED)
                 goto invalid_key;
 
         /* check the permissions */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 63e63a42db3c..e8036cd0ad54 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -595,10 +595,9 @@ int wait_for_key_construction(struct key *key, bool intr)
                           intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
         if (ret)
                 return -ERESTARTSYS;
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
-                smp_rmb();
-                return key->reject_error;
-        }
+        ret = key_read_state(key);
+        if (ret < 0)
+                return ret;
         return key_validate(key);
 }
 EXPORT_SYMBOL(wait_for_key_construction);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index afe9d22ab361..424e1d90412e 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -73,7 +73,7 @@ static void request_key_auth_describe(const struct key *key,
 
         seq_puts(m, "key:");
         seq_puts(m, key->description);
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
 }
 
@@ -120,6 +120,18 @@ static void request_key_auth_revoke(struct key *key)
         }
 }
 
+static void free_request_key_auth(struct request_key_auth *rka)
+{
+        if (!rka)
+                return;
+        key_put(rka->target_key);
+        key_put(rka->dest_keyring);
+        if (rka->cred)
+                put_cred(rka->cred);
+        kfree(rka->callout_info);
+        kfree(rka);
+}
+
 /*
  * Destroy an instantiation authorisation token key.
  */
@@ -129,15 +141,7 @@ static void request_key_auth_destroy(struct key *key)
 
         kenter("{%d}", key->serial);
 
-        if (rka->cred) {
-                put_cred(rka->cred);
-                rka->cred = NULL;
-        }
-
-        key_put(rka->target_key);
-        key_put(rka->dest_keyring);
-        kfree(rka->callout_info);
-        kfree(rka);
+        free_request_key_auth(rka);
 }
 
 /*
@@ -151,22 +155,18 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
         const struct cred *cred = current->cred;
         struct key *authkey = NULL;
         char desc[20];
-        int ret;
+        int ret = -ENOMEM;
 
         kenter("%d,", target->serial);
 
         /* allocate a auth record */
-        rka = kmalloc(sizeof(*rka), GFP_KERNEL);
-        if (!rka) {
-                kleave(" = -ENOMEM");
-                return ERR_PTR(-ENOMEM);
-        }
-        rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
-        if (!rka->callout_info) {
-                kleave(" = -ENOMEM");
-                kfree(rka);
-                return ERR_PTR(-ENOMEM);
-        }
+        rka = kzalloc(sizeof(*rka), GFP_KERNEL);
+        if (!rka)
+                goto error;
+        rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
+        if (!rka->callout_info)
+                goto error_free_rka;
+        rka->callout_len = callout_len;
 
         /* see if the calling process is already servicing the key request of
          * another process */
@@ -176,8 +176,12 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
 
                 /* if the auth key has been revoked, then the key we're
                  * servicing is already instantiated */
-                if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
-                        goto auth_key_revoked;
+                if (test_bit(KEY_FLAG_REVOKED,
+                             &cred->request_key_auth->flags)) {
+                        up_read(&cred->request_key_auth->sem);
+                        ret = -EKEYREVOKED;
+                        goto error_free_rka;
+                }
 
                 irka = cred->request_key_auth->payload.data[0];
                 rka->cred = get_cred(irka->cred);
@@ -193,8 +197,6 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
 
         rka->target_key = key_get(target);
         rka->dest_keyring = key_get(dest_keyring);
-        memcpy(rka->callout_info, callout_info, callout_len);
-        rka->callout_len = callout_len;
 
         /* allocate the auth key */
         sprintf(desc, "%x", target->serial);
@@ -205,32 +207,22 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                             KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
         if (IS_ERR(authkey)) {
                 ret = PTR_ERR(authkey);
-                goto error_alloc;
+                goto error_free_rka;
         }
 
         /* construct the auth key */
         ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
         if (ret < 0)
-                goto error_inst;
+                goto error_put_authkey;
 
         kleave(" = {%d,%d}", authkey->serial, refcount_read(&authkey->usage));
         return authkey;
 
-auth_key_revoked:
-        up_read(&cred->request_key_auth->sem);
-        kfree(rka->callout_info);
-        kfree(rka);
-        kleave("= -EKEYREVOKED");
-        return ERR_PTR(-EKEYREVOKED);
-
-error_inst:
-        key_revoke(authkey);
+error_put_authkey:
         key_put(authkey);
-error_alloc:
-        key_put(rka->target_key);
-        key_put(rka->dest_keyring);
-        kfree(rka->callout_info);
-        kfree(rka);
+error_free_rka:
+        free_request_key_auth(rka);
+error:
         kleave("= %d", ret);
         return ERR_PTR(ret);
 }
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index ddfaebf60fc8..bd85315cbfeb 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1066,7 +1066,7 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         char *datablob;
         int ret = 0;
 
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_negative(key))
                 return -ENOKEY;
         p = key->payload.data[0];
         if (!p->migratable)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 3d8c68eba516..9f558bedba23 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -114,7 +114,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
 
         /* attach the new data, displacing the old */
         key->expiry = prep->expiry;
-        if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_positive(key))
                 zap = dereference_key_locked(key);
         rcu_assign_keypointer(key, prep->payload.data[0]);
         prep->payload.data[0] = NULL;
@@ -162,7 +162,7 @@ EXPORT_SYMBOL_GPL(user_destroy);
 void user_describe(const struct key *key, struct seq_file *m)
 {
         seq_puts(m, key->description);
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                 seq_printf(m, ": %u", key->datalen);
 }
 
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 319add31b4a4..286171a16ed2 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1473,7 +1473,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
  * @inode: the object
  * @name: attribute name
  * @buffer: where to put the result
- * @alloc: unused
+ * @alloc: duplicate memory
  *
  * Returns the size of the attribute or an error code
  */
@@ -1486,43 +1486,38 @@ static int smack_inode_getsecurity(struct inode *inode,
         struct super_block *sbp;
         struct inode *ip = (struct inode *)inode;
         struct smack_known *isp;
-        int ilen;
-        int rc = 0;
 
-        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
+        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
                 isp = smk_of_inode(inode);
-                ilen = strlen(isp->smk_known);
-                *buffer = isp->smk_known;
-                return ilen;
-        }
+        else {
+                /*
+                 * The rest of the Smack xattrs are only on sockets.
+                 */
+                sbp = ip->i_sb;
+                if (sbp->s_magic != SOCKFS_MAGIC)
+                        return -EOPNOTSUPP;
 
-        /*
-         * The rest of the Smack xattrs are only on sockets.
-         */
-        sbp = ip->i_sb;
-        if (sbp->s_magic != SOCKFS_MAGIC)
-                return -EOPNOTSUPP;
+                sock = SOCKET_I(ip);
+                if (sock == NULL || sock->sk == NULL)
+                        return -EOPNOTSUPP;
 
-        sock = SOCKET_I(ip);
-        if (sock == NULL || sock->sk == NULL)
-                return -EOPNOTSUPP;
-
-        ssp = sock->sk->sk_security;
+                ssp = sock->sk->sk_security;
 
-        if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-                isp = ssp->smk_in;
-        else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
-                isp = ssp->smk_out;
-        else
-                return -EOPNOTSUPP;
+                if (strcmp(name, XATTR_SMACK_IPIN) == 0)
+                        isp = ssp->smk_in;
+                else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
+                        isp = ssp->smk_out;
+                else
+                        return -EOPNOTSUPP;
+        }
 
-        ilen = strlen(isp->smk_known);
-        if (rc == 0) {
-                *buffer = isp->smk_known;
-                rc = ilen;
+        if (alloc) {
+                *buffer = kstrdup(isp->smk_known, GFP_KERNEL);
+                if (*buffer == NULL)
+                        return -ENOMEM;
         }
 
-        return rc;
+        return strlen(isp->smk_known);
 }
 
 
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index fec1dfdb14ad..4490a699030b 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -948,14 +948,13 @@ static const struct file_operations snd_compr_file_ops = {
 static int snd_compress_dev_register(struct snd_device *device)
 {
         int ret = -EINVAL;
-        char str[16];
         struct snd_compr *compr;
 
         if (snd_BUG_ON(!device || !device->device_data))
                 return -EBADFD;
         compr = device->device_data;
 
-        pr_debug("reg %s for device %s, direction %d\n", str, compr->name,
+        pr_debug("reg device %s, direction %d\n", compr->name,
                         compr->direction);
         /* register compressed device */
         ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS,
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 3a1cc7b97e46..b719d0bd833e 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -547,6 +547,7 @@ struct snd_pcm_mmap_status_x32 {
         u32 pad2; /* alignment */
         struct timespec tstamp;
         s32 suspended_state;
+        s32 pad3;
         struct timespec audio_tstamp;
 } __packed;
 
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index ea2d0ae85bd3..6c9cba2166d9 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1259,6 +1259,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
         struct snd_seq_port_info *info = arg;
         struct snd_seq_client_port *port;
         struct snd_seq_port_callback *callback;
+        int port_idx;
 
         /* it is not allowed to create the port for an another client */
         if (info->addr.client != client->number)
@@ -1269,7 +1270,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
                 return -ENOMEM;
 
         if (client->type == USER_CLIENT && info->kernel) {
-                snd_seq_delete_port(client, port->addr.port);
+                port_idx = port->addr.port;
+                snd_seq_port_unlock(port);
+                snd_seq_delete_port(client, port_idx);
                 return -EINVAL;
         }
         if (client->type == KERNEL_CLIENT) {
@@ -1290,6 +1293,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
 
         snd_seq_set_port_info(port, info);
         snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
+        snd_seq_port_unlock(port);
 
         return 0;
 }
diff --git a/sound/core/seq/seq_lock.c b/sound/core/seq/seq_lock.c
index 0ff7926a5a69..cda64b489e42 100644
--- a/sound/core/seq/seq_lock.c
+++ b/sound/core/seq/seq_lock.c
@@ -23,8 +23,6 @@
 #include <sound/core.h>
 #include "seq_lock.h"
 
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
 /* wait until all locks are released */
 void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
 {
@@ -41,5 +39,3 @@ void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
         }
 }
 EXPORT_SYMBOL(snd_use_lock_sync_helper);
-
-#endif
diff --git a/sound/core/seq/seq_lock.h b/sound/core/seq/seq_lock.h
index 54044bc2c9ef..ac38031c370e 100644
--- a/sound/core/seq/seq_lock.h
+++ b/sound/core/seq/seq_lock.h
@@ -3,8 +3,6 @@
 
 #include <linux/sched.h>
 
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
 typedef atomic_t snd_use_lock_t;
 
 /* initialize lock */
@@ -20,14 +18,4 @@ typedef atomic_t snd_use_lock_t;
 void snd_use_lock_sync_helper(snd_use_lock_t *lock, const char *file, int line);
 #define snd_use_lock_sync(lockp) snd_use_lock_sync_helper(lockp, __BASE_FILE__, __LINE__)
 
-#else /* SMP || CONFIG_SND_DEBUG */
-
-typedef spinlock_t snd_use_lock_t;      /* dummy */
-#define snd_use_lock_init(lockp) /**/
-#define snd_use_lock_use(lockp) /**/
-#define snd_use_lock_free(lockp) /**/
-#define snd_use_lock_sync(lockp) /**/
-
-#endif /* SMP || CONFIG_SND_DEBUG */
-
 #endif /* __SND_SEQ_LOCK_H */
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 0a7020c82bfc..d21ece9f8d73 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp)
 }
 
 
-/* create a port, port number is returned (-1 on failure) */
+/* create a port, port number is returned (-1 on failure);
+ * the caller needs to unref the port via snd_seq_port_unlock() appropriately
+ */
 struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
                                                 int port)
 {
@@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         snd_use_lock_init(&new_port->use_lock);
         port_subs_info_init(&new_port->c_src);
         port_subs_info_init(&new_port->c_dest);
+        snd_use_lock_use(&new_port->use_lock);
 
         num = port >= 0 ? port : 0;
         mutex_lock(&client->ports_mutex);
@@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         list_add_tail(&new_port->list, &p->list);
         client->num_ports++;
         new_port->addr.port = num;      /* store the port number in the port */
+        sprintf(new_port->name, "port-%d", num);
         write_unlock_irqrestore(&client->ports_lock, flags);
         mutex_unlock(&client->ports_mutex);
-        sprintf(new_port->name, "port-%d", num);
 
         return new_port;
 }
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index 8d93a4021c78..f48a4cd24ffc 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
  * decode input event and put to read buffer of each opened file
  */
 static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
-                                         struct snd_seq_event *ev)
+                                         struct snd_seq_event *ev,
+                                         bool atomic)
 {
         struct snd_virmidi *vmidi;
         unsigned char msg[4];
         int len;
 
-        read_lock(&rdev->filelist_lock);
+        if (atomic)
+                read_lock(&rdev->filelist_lock);
+        else
+                down_read(&rdev->filelist_sem);
         list_for_each_entry(vmidi, &rdev->filelist, list) {
                 if (!vmidi->trigger)
                         continue;
@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
                                 snd_rawmidi_receive(vmidi->substream, msg, len);
                 }
         }
-        read_unlock(&rdev->filelist_lock);
+        if (atomic)
+                read_unlock(&rdev->filelist_lock);
+        else
+                up_read(&rdev->filelist_sem);
 
         return 0;
 }
@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmidi *rmidi, struct snd_seq_event *ev)
         struct snd_virmidi_dev *rdev;
 
         rdev = rmidi->private_data;
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, true);
 }
 #endif  /*  0  */
 
@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struct snd_seq_event *ev, int direct,
         rdev = private_data;
         if (!(rdev->flags & SNDRV_VIRMIDI_USE))
                 return 0; /* ignored */
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, atomic);
 }
 
 /*
@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
         struct snd_virmidi *vmidi;
-        unsigned long flags;
 
         vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
         if (vmidi == NULL)
@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         vmidi->client = rdev->client;
         vmidi->port = rdev->port;       
         runtime->private_data = vmidi;
-        write_lock_irqsave(&rdev->filelist_lock, flags);
+        down_write(&rdev->filelist_sem);
+        write_lock_irq(&rdev->filelist_lock);
         list_add_tail(&vmidi->list, &rdev->filelist);
-        write_unlock_irqrestore(&rdev->filelist_lock, flags);
+        write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         vmidi->rdev = rdev;
         return 0;
 }
@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_virmidi *vmidi = substream->runtime->private_data;
 
+        down_write(&rdev->filelist_sem);
         write_lock_irq(&rdev->filelist_lock);
         list_del(&vmidi->list);
         write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         snd_midi_event_free(vmidi->parser);
         substream->runtime->private_data = NULL;
         kfree(vmidi);
@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *card, int device, struct snd_rawmidi **rrmi
         rdev->rmidi = rmidi;
         rdev->device = device;
         rdev->client = -1;
+        init_rwsem(&rdev->filelist_sem);
         rwlock_init(&rdev->filelist_lock);
         INIT_LIST_HEAD(&rdev->filelist);
         rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
index 6c58e6f73a01..e43af18d4383 100644
--- a/sound/core/vmaster.c
+++ b/sound/core/vmaster.c
@@ -484,3 +484,34 @@ void snd_ctl_sync_vmaster(struct snd_kcontrol *kcontrol, bool hook_only)
                 master->hook(master->hook_private_data, master->val);
 }
 EXPORT_SYMBOL_GPL(snd_ctl_sync_vmaster);
+
+/**
+ * snd_ctl_apply_vmaster_slaves - Apply function to each vmaster slave
+ * @kctl: vmaster kctl element
+ * @func: function to apply
+ * @arg: optional function argument
+ *
+ * Apply the function @func to each slave kctl of the given vmaster kctl.
+ * Returns 0 if successful, or a negative error code.
+ */
+int snd_ctl_apply_vmaster_slaves(struct snd_kcontrol *kctl,
+                                 int (*func)(struct snd_kcontrol *, void *),
+                                 void *arg)
+{
+        struct link_master *master;
+        struct link_slave *slave;
+        int err;
+
+        master = snd_kcontrol_chip(kctl);
+        err = master_init(master);
+        if (err < 0)
+                return err;
+        list_for_each_entry(slave, &master->slaves, list) {
+                err = func(&slave->slave, arg);
+                if (err < 0)
+                        return err;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(snd_ctl_apply_vmaster_slaves);
diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index 978dc1801b3a..f6d2985b2520 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -284,6 +284,11 @@ int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
                 dev_dbg(bus->dev, "HDA capability ID: 0x%x\n",
                         (cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF);
 
+                if (cur_cap == -1) {
+                        dev_dbg(bus->dev, "Invalid capability reg read\n");
+                        break;
+                }
+
                 switch ((cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF) {
                 case AZX_ML_CAP_ID:
                         dev_dbg(bus->dev, "Found ML capability\n");
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 7e3aa50b21f9..5badd08e1d69 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -103,6 +103,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         void __user *puhr;
         union hpi_message_buffer_v1 *hm;
         union hpi_response_buffer_v1 *hr;
+        u16 msg_size;
         u16 res_max_size;
         u32 uncopied_bytes;
         int err = 0;
@@ -127,22 +128,25 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         }
 
         /* Now read the message size and data from user space.  */
-        if (get_user(hm->h.size, (u16 __user *)puhm)) {
+        if (get_user(msg_size, (u16 __user *)puhm)) {
                 err = -EFAULT;
                 goto out;
         }
-        if (hm->h.size > sizeof(*hm))
-                hm->h.size = sizeof(*hm);
+        if (msg_size > sizeof(*hm))
+                msg_size = sizeof(*hm);
 
         /* printk(KERN_INFO "message size %d\n", hm->h.wSize); */
 
-        uncopied_bytes = copy_from_user(hm, puhm, hm->h.size);
+        uncopied_bytes = copy_from_user(hm, puhm, msg_size);
         if (uncopied_bytes) {
                 HPI_DEBUG_LOG(ERROR, "uncopied bytes %d\n", uncopied_bytes);
                 err = -EFAULT;
                 goto out;
         }
 
+        /* Override h.size in case it is changed between two userspace fetches */
+        hm->h.size = msg_size;
+
         if (get_user(res_max_size, (u16 __user *)puhr)) {
                 err = -EFAULT;
                 goto out;
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 7326695bca33..d68f99e076a8 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol,
 
         chip = snd_kcontrol_chip(kcontrol);
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 1;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = ECHOGAIN_MAXOUT;
         uinfo->dimen.d[0] = num_busses_out(chip);
         uinfo->dimen.d[1] = num_busses_in(chip);
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1];
         return 0;
 }
 
@@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct snd_kcontrol *kcontrol,
 
         chip = snd_kcontrol_chip(kcontrol);
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 1;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = ECHOGAIN_MAXOUT;
         uinfo->dimen.d[0] = num_busses_out(chip);
         uinfo->dimen.d[1] = num_pipes_out(chip);
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1];
         return 0;
 }
 
@@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol,
                                   struct snd_ctl_elem_info *uinfo)
 {
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 96;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = 0;
 #ifdef ECHOCARD_HAS_VMIXER
@@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol,
 #endif
         uinfo->dimen.d[1] = 16; /* 16 channels */
         uinfo->dimen.d[2] = 2;  /* 0=level, 1=peak */
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1] * uinfo->dimen.d[2];
         return 0;
 }
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 3db26c451837..a0989d231fd0 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1803,36 +1803,6 @@ static int check_slave_present(struct hda_codec *codec,
         return 1;
 }
 
-/* guess the value corresponding to 0dB */
-static int get_kctl_0dB_offset(struct hda_codec *codec,
-                               struct snd_kcontrol *kctl, int *step_to_check)
-{
-        int _tlv[4];
-        const int *tlv = NULL;
-        int val = -1;
-
-        if ((kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) &&
-            kctl->tlv.c == snd_hda_mixer_amp_tlv) {
-                get_ctl_amp_tlv(kctl, _tlv);
-                tlv = _tlv;
-        } else if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_READ)
-                tlv = kctl->tlv.p;
-        if (tlv && tlv[0] == SNDRV_CTL_TLVT_DB_SCALE) {
-                int step = tlv[3];
-                step &= ~TLV_DB_SCALE_MUTE;
-                if (!step)
-                        return -1;
-                if (*step_to_check && *step_to_check != step) {
-                        codec_err(codec, "Mismatching dB step for vmaster slave (%d!=%d)\n",
--                                  *step_to_check, step);
-                        return -1;
-                }
-                *step_to_check = step;
-                val = -tlv[2] / step;
-        }
-        return val;
-}
-
 /* call kctl->put with the given value(s) */
 static int put_kctl_with_value(struct snd_kcontrol *kctl, int val)
 {
@@ -1847,19 +1817,58 @@ static int put_kctl_with_value(struct snd_kcontrol *kctl, int val)
         return 0;
 }
 
-/* initialize the slave volume with 0dB */
-static int init_slave_0dB(struct hda_codec *codec,
-                          void *data, struct snd_kcontrol *slave)
+struct slave_init_arg {
+        struct hda_codec *codec;
+        int step;
+};
+
+/* initialize the slave volume with 0dB via snd_ctl_apply_vmaster_slaves() */
+static int init_slave_0dB(struct snd_kcontrol *kctl, void *_arg)
 {
-        int offset = get_kctl_0dB_offset(codec, slave, data);
-        if (offset > 0)
-                put_kctl_with_value(slave, offset);
+        struct slave_init_arg *arg = _arg;
+        int _tlv[4];
+        const int *tlv = NULL;
+        int step;
+        int val;
+
+        if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
+                if (kctl->tlv.c != snd_hda_mixer_amp_tlv) {
+                        codec_err(arg->codec,
+                                  "Unexpected TLV callback for slave %s:%d\n",
+                                  kctl->id.name, kctl->id.index);
+                        return 0; /* ignore */
+                }
+                get_ctl_amp_tlv(kctl, _tlv);
+                tlv = _tlv;
+        } else if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_READ)
+                tlv = kctl->tlv.p;
+
+        if (!tlv || tlv[0] != SNDRV_CTL_TLVT_DB_SCALE)
+                return 0;
+
+        step = tlv[3];
+        step &= ~TLV_DB_SCALE_MUTE;
+        if (!step)
+                return 0;
+        if (arg->step && arg->step != step) {
+                codec_err(arg->codec,
+                          "Mismatching dB step for vmaster slave (%d!=%d)\n",
+                          arg->step, step);
+                return 0;
+        }
+
+        arg->step = step;
+        val = -tlv[2] / step;
+        if (val > 0) {
+                put_kctl_with_value(kctl, val);
+                return val;
+        }
+
         return 0;
 }
 
-/* unmute the slave */
-static int init_slave_unmute(struct hda_codec *codec,
-                             void *data, struct snd_kcontrol *slave)
+/* unmute the slave via snd_ctl_apply_vmaster_slaves() */
+static int init_slave_unmute(struct snd_kcontrol *slave, void *_arg)
 {
         return put_kctl_with_value(slave, 1);
 }
@@ -1919,9 +1928,13 @@ int __snd_hda_add_vmaster(struct hda_codec *codec, char *name,
         /* init with master mute & zero volume */
         put_kctl_with_value(kctl, 0);
         if (init_slave_vol) {
-                int step = 0;
-                map_slaves(codec, slaves, suffix,
-                           tlv ? init_slave_0dB : init_slave_unmute, &step);
+                struct slave_init_arg arg = {
+                        .codec = codec,
+                        .step = 0,
+                };
+                snd_ctl_apply_vmaster_slaves(kctl,
+                                             tlv ? init_slave_0dB : init_slave_unmute,
+                                             &arg);
         }
 
         if (ctl_ret)
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 2b64fabd5faa..c19c81d230bd 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -906,6 +906,7 @@ static int hdmi_setup_stream(struct hda_codec *codec, hda_nid_t cvt_nid,
                               hda_nid_t pin_nid, u32 stream_tag, int format)
 {
         struct hdmi_spec *spec = codec->spec;
+        unsigned int param;
         int err;
 
         err = spec->ops.pin_hbr_setup(codec, pin_nid, is_hbr_format(format));
@@ -915,6 +916,26 @@ static int hdmi_setup_stream(struct hda_codec *codec, hda_nid_t cvt_nid,
                 return err;
         }
 
+        if (is_haswell_plus(codec)) {
+
+                /*
+                 * on recent platforms IEC Coding Type is required for HBR
+                 * support, read current Digital Converter settings and set
+                 * ICT bitfield if needed.
+                 */
+                param = snd_hda_codec_read(codec, cvt_nid, 0,
+                                           AC_VERB_GET_DIGI_CONVERT_1, 0);
+
+                param = (param >> 16) & ~(AC_DIG3_ICT);
+
+                /* on recent platforms ICT mode is required for HBR support */
+                if (is_hbr_format(format))
+                        param |= 0x1;
+
+                snd_hda_codec_write(codec, cvt_nid, 0,
+                                    AC_VERB_SET_DIGI_CONVERT_3, param);
+        }
+
         snd_hda_codec_setup_stream(codec, cvt_nid, stream_tag, 0, format);
         return 0;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0ce71111b4e3..546d515f3c1f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -327,6 +327,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0215:
         case 0x10ec0225:
         case 0x10ec0233:
+        case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
         case 0x10ec0282:
@@ -911,6 +912,7 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
         { 0x10ec0275, 0x1028, 0, "ALC3260" },
         { 0x10ec0899, 0x1028, 0, "ALC3861" },
         { 0x10ec0298, 0x1028, 0, "ALC3266" },
+        { 0x10ec0236, 0x1028, 0, "ALC3204" },
         { 0x10ec0256, 0x1028, 0, "ALC3246" },
         { 0x10ec0225, 0x1028, 0, "ALC3253" },
         { 0x10ec0295, 0x1028, 0, "ALC3254" },
@@ -3930,6 +3932,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
                 alc_process_coef_fw(codec, coef0255_1);
                 alc_process_coef_fw(codec, coef0255);
                 break;
+        case 0x10ec0236:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0256);
                 alc_process_coef_fw(codec, coef0255);
@@ -4028,6 +4031,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
         };
 
         switch (codec->core.vendor_id) {
+        case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
                 alc_write_coef_idx(codec, 0x45, 0xc489);
@@ -4160,6 +4164,7 @@ static void alc_headset_mode_default(struct hda_codec *codec)
                 alc_process_coef_fw(codec, alc225_pre_hsmode);
                 alc_process_coef_fw(codec, coef0225);
                 break;
+        case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
@@ -4256,6 +4261,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
         case 0x10ec0255:
                 alc_process_coef_fw(codec, coef0255);
                 break;
+        case 0x10ec0236:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0256);
                 break;
@@ -4366,6 +4372,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
         case 0x10ec0255:
                 alc_process_coef_fw(codec, coef0255);
                 break;
+        case 0x10ec0236:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0256);
                 break;
@@ -4451,6 +4458,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
         };
 
         switch (codec->core.vendor_id) {
+        case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
@@ -4705,6 +4713,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
         case 0x10ec0255:
                 alc_process_coef_fw(codec, alc255fw);
                 break;
+        case 0x10ec0236:
         case 0x10ec0256:
                 alc_process_coef_fw(codec, alc256fw);
                 break;
@@ -6419,6 +6428,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 ALC225_STANDARD_PINS,
                 {0x12, 0xb7a60130},
                 {0x1b, 0x90170110}),
+        SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x14, 0x90170110},
+                {0x21, 0x02211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60140},
+                {0x14, 0x90170150},
+                {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
@@ -6806,6 +6823,7 @@ static int patch_alc269(struct hda_codec *codec)
         case 0x10ec0255:
                 spec->codec_variant = ALC269_TYPE_ALC255;
                 break;
+        case 0x10ec0236:
         case 0x10ec0256:
                 spec->codec_variant = ALC269_TYPE_ALC256;
                 spec->shutup = alc256_shutup;
@@ -7857,6 +7875,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0234, "ALC234", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260),
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 0fb6b1b79261..d8409d9ae55b 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
         if (err)
-                return err;
+                goto err_kill_urb;
 
-        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ))
-                return -ENODEV;
+        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
+                err = -ENODEV;
+                goto err_kill_urb;
+        }
 
         usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
                    cdev->vendor_name, CAIAQ_USB_STR_LEN);
@@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         setup_card(cdev);
         return 0;
+
+ err_kill_urb:
+        usb_kill_urb(&cdev->ep1_in_urb);
+        return err;
 }
 
 static int snd_probe(struct usb_interface *intf,
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 3dc36d913550..23d1d23aefec 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
         struct usb_interface_descriptor *altsd;
         void *control_header;
         int i, protocol;
+        int rest_bytes;
 
         /* find audiocontrol interface */
         host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0];
@@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
                 return -EINVAL;
         }
 
+        rest_bytes = (void *)(host_iface->extra + host_iface->extralen) -
+                control_header;
+
+        /* just to be sure -- this shouldn't hit at all */
+        if (rest_bytes <= 0) {
+                dev_err(&dev->dev, "invalid control header\n");
+                return -EINVAL;
+        }
+
         switch (protocol) {
         default:
                 dev_warn(&dev->dev,
@@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
         case UAC_VERSION_1: {
                 struct uac1_ac_header_descriptor *h1 = control_header;
 
+                if (rest_bytes < sizeof(*h1)) {
+                        dev_err(&dev->dev, "too short v1 buffer descriptor\n");
+                        return -EINVAL;
+                }
+
                 if (!h1->bInCollection) {
                         dev_info(&dev->dev, "skipping empty audio interface (v1)\n");
                         return -EINVAL;
                 }
 
+                if (rest_bytes < h1->bLength) {
+                        dev_err(&dev->dev, "invalid buffer length (v1)\n");
+                        return -EINVAL;
+                }
+
                 if (h1->bLength < sizeof(*h1) + h1->bInCollection) {
                         dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n");
                         return -EINVAL;
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 0ff5a7d2e19f..c8f723c3a033 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -779,9 +779,10 @@ int line6_probe(struct usb_interface *interface,
         return 0;
 
  error:
-        if (line6->disconnect)
-                line6->disconnect(line6);
-        snd_card_free(card);
+        /* we can call disconnect callback here because no close-sync is
+         * needed yet at this point
+         */
+        line6_disconnect(interface);
         return ret;
 }
 EXPORT_SYMBOL_GPL(line6_probe);
diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
index 956f847a96e4..451007c27743 100644
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -301,7 +301,8 @@ static void podhd_disconnect(struct usb_line6 *line6)
 
                 intf = usb_ifnum_to_if(line6->usbdev,
                                         pod->line6.properties->ctrl_if);
-                usb_driver_release_interface(&podhd_driver, intf);
+                if (intf)
+                        usb_driver_release_interface(&podhd_driver, intf);
         }
 }
 
@@ -317,6 +318,9 @@ static int podhd_init(struct usb_line6 *line6,
 
         line6->disconnect = podhd_disconnect;
 
+        init_timer(&pod->startup_timer);
+        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
+
         if (pod->line6.properties->capabilities & LINE6_CAP_CONTROL) {
                 /* claim the data interface */
                 intf = usb_ifnum_to_if(line6->usbdev,
@@ -358,8 +362,6 @@ static int podhd_init(struct usb_line6 *line6,
         }
 
         /* init device and delay registering */
-        init_timer(&pod->startup_timer);
-        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
         podhd_startup(pod);
         return 0;
 }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9732edf77f86..91bc8f18791e 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2234,6 +2234,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
 
 static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
 {
+        /* kill pending URBs */
+        snd_usb_mixer_disconnect(mixer);
+
         kfree(mixer->id_elems);
         if (mixer->urb) {
                 kfree(mixer->urb->transfer_buffer);
@@ -2584,8 +2587,13 @@ _error:
 
 void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
 {
-        usb_kill_urb(mixer->urb);
-        usb_kill_urb(mixer->rc_urb);
+        if (mixer->disconnected)
+                return;
+        if (mixer->urb)
+                usb_kill_urb(mixer->urb);
+        if (mixer->rc_urb)
+                usb_kill_urb(mixer->rc_urb);
+        mixer->disconnected = true;
 }
 
 #ifdef CONFIG_PM
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 2b4b067646ab..545d99b09706 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -22,6 +22,8 @@ struct usb_mixer_interface {
         struct urb *rc_urb;
         struct usb_ctrlrequest *rc_setup_packet;
         u8 rc_buffer[6];
+
+        bool disconnected;
 };
 
 #define MAX_CHANNELS    16      /* max logical channels */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 913552078285..4f5f18f22974 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1137,6 +1137,9 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x047F, 0x02F7): /* Plantronics BT-600 */
         case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
         case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+        case USB_ID(0x047F, 0xC022): /* Plantronics C310 */
+        case USB_ID(0x047F, 0xC02F): /* Plantronics P610 */
+        case USB_ID(0x047F, 0xC036): /* Plantronics C520-M */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
@@ -1351,6 +1354,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
         case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
         case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
+        case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
                 if (fp->altsetting == 2)
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
index 4dab49080700..e229abd21652 100644
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
         }
 
         pg = get_order(read_size);
-        sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+        sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+                                          __GFP_NOWARN, pg);
         if (!sk->s) {
                 snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
                 goto out;
@@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
         pg = get_order(write_size);
 
         sk->write_page =
-                (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+                (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+                                         __GFP_NOWARN, pg);
         if (!sk->write_page) {
                 snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
                 usb_stream_free(sk);
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 69d09c39bbcd..cd7359e23d86 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -88,6 +88,12 @@ struct kvm_s390_io_adapter_req {
 /* kvm attributes for KVM_S390_VM_TOD */
 #define KVM_S390_VM_TOD_LOW             0
 #define KVM_S390_VM_TOD_HIGH            1
+#define KVM_S390_VM_TOD_EXT             2
+
+struct kvm_s390_vm_tod_clock {
+        __u8  epoch_idx;
+        __u64 tod;
+};
 
 /* kvm attributes for KVM_S390_VM_CPU_MODEL */
 /* processor related attributes are r/w */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 8ea315a11fe0..2519c6c801c9 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -196,6 +196,7 @@
 
 #define X86_FEATURE_HW_PSTATE   ( 7*32+ 8) /* AMD HW-PState */
 #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
+#define X86_FEATURE_SME         ( 7*32+10) /* AMD Secure Memory Encryption */
 
 #define X86_FEATURE_INTEL_PPIN  ( 7*32+14) /* Intel Processor Inventory Number */
 #define X86_FEATURE_INTEL_PT    ( 7*32+15) /* Intel Processor Trace */
@@ -287,6 +288,7 @@
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
 #define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
+#define X86_FEATURE_VGIF        (15*32+16) /* Virtual GIF */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
 #define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 5dff775af7cd..c10c9128f54e 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -21,11 +21,13 @@
 # define DISABLE_K6_MTRR        (1<<(X86_FEATURE_K6_MTRR & 31))
 # define DISABLE_CYRIX_ARR      (1<<(X86_FEATURE_CYRIX_ARR & 31))
 # define DISABLE_CENTAUR_MCR    (1<<(X86_FEATURE_CENTAUR_MCR & 31))
+# define DISABLE_PCID           0
 #else
 # define DISABLE_VME            0
 # define DISABLE_K6_MTRR        0
 # define DISABLE_CYRIX_ARR      0
 # define DISABLE_CENTAUR_MCR    0
+# define DISABLE_PCID           (1<<(X86_FEATURE_PCID & 31))
 #endif /* CONFIG_X86_64 */
 
 #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
@@ -49,7 +51,7 @@
 #define DISABLED_MASK1  0
 #define DISABLED_MASK2  0
 #define DISABLED_MASK3  (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR)
-#define DISABLED_MASK4  0
+#define DISABLED_MASK4  (DISABLE_PCID)
 #define DISABLED_MASK5  0
 #define DISABLED_MASK6  0
 #define DISABLED_MASK7  0
diff --git a/tools/include/asm-generic/hugetlb_encode.h b/tools/include/asm-generic/hugetlb_encode.h
new file mode 100644
index 000000000000..e4732d3c2998
--- /dev/null
+++ b/tools/include/asm-generic/hugetlb_encode.h
@@ -0,0 +1,34 @@
+#ifndef _ASM_GENERIC_HUGETLB_ENCODE_H_
+#define _ASM_GENERIC_HUGETLB_ENCODE_H_
+
+/*
+ * Several system calls take a flag to request "hugetlb" huge pages.
+ * Without further specification, these system calls will use the
+ * system's default huge page size.  If a system supports multiple
+ * huge page sizes, the desired huge page size can be specified in
+ * bits [26:31] of the flag arguments.  The value in these 6 bits
+ * will encode the log2 of the huge page size.
+ *
+ * The following definitions are associated with this huge page size
+ * encoding in flag arguments.  System call specific header files
+ * that use this encoding should include this file.  They can then
+ * provide definitions based on these with their own specific prefix.
+ * for example:
+ * #define MAP_HUGE_SHIFT HUGETLB_FLAG_ENCODE_SHIFT
+ */
+
+#define HUGETLB_FLAG_ENCODE_SHIFT       26
+#define HUGETLB_FLAG_ENCODE_MASK        0x3f
+
+#define HUGETLB_FLAG_ENCODE_64KB        (16 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_512KB       (19 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_1MB         (20 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_2MB         (21 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_8MB         (23 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_16MB        (24 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_256MB       (28 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_1GB         (30 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_2GB         (31 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_16GB        (34 << HUGETLB_FLAG_ENCODE_SHIFT)
+
+#endif /* _ASM_GENERIC_HUGETLB_ENCODE_H_ */
diff --git a/tools/include/uapi/asm-generic/mman-common.h b/tools/include/uapi/asm-generic/mman-common.h
index 8c27db0c5c08..203268f9231e 100644
--- a/tools/include/uapi/asm-generic/mman-common.h
+++ b/tools/include/uapi/asm-generic/mman-common.h
@@ -58,20 +58,12 @@
                                            overrides the coredump filter bits */
 #define MADV_DODUMP     17              /* Clear the MADV_DONTDUMP flag */
 
+#define MADV_WIPEONFORK 18              /* Zero memory on fork, child only */
+#define MADV_KEEPONFORK 19              /* Undo MADV_WIPEONFORK */
+
 /* compatibility flags */
 #define MAP_FILE        0
 
-/*
- * When MAP_HUGETLB is set bits [26:31] encode the log2 of the huge page size.
- * This gives us 6 bits, which is enough until someone invents 128 bit address
- * spaces.
- *
- * Assume these are all power of twos.
- * When 0 use the default page size.
- */
-#define MAP_HUGE_SHIFT  26
-#define MAP_HUGE_MASK   0x3f
-
 #define PKEY_DISABLE_ACCESS     0x1
 #define PKEY_DISABLE_WRITE      0x2
 #define PKEY_ACCESS_MASK        (PKEY_DISABLE_ACCESS |\
diff --git a/tools/include/uapi/drm/drm.h b/tools/include/uapi/drm/drm.h
index 101593ab10ac..97677cd6964d 100644
--- a/tools/include/uapi/drm/drm.h
+++ b/tools/include/uapi/drm/drm.h
@@ -700,6 +700,7 @@ struct drm_prime_handle {
 
 struct drm_syncobj_create {
         __u32 handle;
+#define DRM_SYNCOBJ_CREATE_SIGNALED (1 << 0)
         __u32 flags;
 };
 
@@ -718,6 +719,24 @@ struct drm_syncobj_handle {
         __u32 pad;
 };
 
+#define DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL (1 << 0)
+#define DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT (1 << 1)
+struct drm_syncobj_wait {
+        __u64 handles;
+        /* absolute timeout */
+        __s64 timeout_nsec;
+        __u32 count_handles;
+        __u32 flags;
+        __u32 first_signaled; /* only valid when not waiting all */
+        __u32 pad;
+};
+
+struct drm_syncobj_array {
+        __u64 handles;
+        __u32 count_handles;
+        __u32 pad;
+};
+
 #if defined(__cplusplus)
 }
 #endif
@@ -840,6 +859,9 @@ extern "C" {
 #define DRM_IOCTL_SYNCOBJ_DESTROY       DRM_IOWR(0xC0, struct drm_syncobj_destroy)
 #define DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD  DRM_IOWR(0xC1, struct drm_syncobj_handle)
 #define DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE  DRM_IOWR(0xC2, struct drm_syncobj_handle)
+#define DRM_IOCTL_SYNCOBJ_WAIT          DRM_IOWR(0xC3, struct drm_syncobj_wait)
+#define DRM_IOCTL_SYNCOBJ_RESET         DRM_IOWR(0xC4, struct drm_syncobj_array)
+#define DRM_IOCTL_SYNCOBJ_SIGNAL        DRM_IOWR(0xC5, struct drm_syncobj_array)
 
 /**
  * Device specific ioctls should only be in their respective headers
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 7ccbd6a2bbe0..6598fb76d2c2 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -260,6 +260,8 @@ typedef struct _drm_i915_sarea {
 #define DRM_I915_GEM_CONTEXT_GETPARAM   0x34
 #define DRM_I915_GEM_CONTEXT_SETPARAM   0x35
 #define DRM_I915_PERF_OPEN              0x36
+#define DRM_I915_PERF_ADD_CONFIG        0x37
+#define DRM_I915_PERF_REMOVE_CONFIG     0x38
 
 #define DRM_IOCTL_I915_INIT             DRM_IOW( DRM_COMMAND_BASE + DRM_I915_INIT, drm_i915_init_t)
 #define DRM_IOCTL_I915_FLUSH            DRM_IO ( DRM_COMMAND_BASE + DRM_I915_FLUSH)
@@ -315,6 +317,8 @@ typedef struct _drm_i915_sarea {
 #define DRM_IOCTL_I915_GEM_CONTEXT_GETPARAM     DRM_IOWR (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_GETPARAM, struct drm_i915_gem_context_param)
 #define DRM_IOCTL_I915_GEM_CONTEXT_SETPARAM     DRM_IOWR (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_SETPARAM, struct drm_i915_gem_context_param)
 #define DRM_IOCTL_I915_PERF_OPEN        DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_OPEN, struct drm_i915_perf_open_param)
+#define DRM_IOCTL_I915_PERF_ADD_CONFIG  DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_ADD_CONFIG, struct drm_i915_perf_oa_config)
+#define DRM_IOCTL_I915_PERF_REMOVE_CONFIG       DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_REMOVE_CONFIG, __u64)
 
 /* Allow drivers to submit batchbuffers directly to hardware, relying
  * on the security mechanisms provided by hardware.
@@ -431,6 +435,11 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_BATCH_FIRST  48
 
+/* Query whether DRM_I915_GEM_EXECBUFFER2 supports supplying an array of
+ * drm_i915_gem_exec_fence structures.  See I915_EXEC_FENCE_ARRAY.
+ */
+#define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
@@ -812,6 +821,17 @@ struct drm_i915_gem_exec_object2 {
         __u64 rsvd2;
 };
 
+struct drm_i915_gem_exec_fence {
+        /**
+         * User's handle for a drm_syncobj to wait on or signal.
+         */
+        __u32 handle;
+
+#define I915_EXEC_FENCE_WAIT            (1<<0)
+#define I915_EXEC_FENCE_SIGNAL          (1<<1)
+        __u32 flags;
+};
+
 struct drm_i915_gem_execbuffer2 {
         /**
          * List of gem_exec_object2 structs
@@ -826,7 +846,11 @@ struct drm_i915_gem_execbuffer2 {
         __u32 DR1;
         __u32 DR4;
         __u32 num_cliprects;
-        /** This is a struct drm_clip_rect *cliprects */
+        /**
+         * This is a struct drm_clip_rect *cliprects if I915_EXEC_FENCE_ARRAY
+         * is not set.  If I915_EXEC_FENCE_ARRAY is set, then this is a
+         * struct drm_i915_gem_exec_fence *fences.
+         */
         __u64 cliprects_ptr;
 #define I915_EXEC_RING_MASK              (7<<0)
 #define I915_EXEC_DEFAULT                (0<<0)
@@ -927,7 +951,14 @@ struct drm_i915_gem_execbuffer2 {
  * element).
  */
 #define I915_EXEC_BATCH_FIRST           (1<<18)
-#define __I915_EXEC_UNKNOWN_FLAGS (-(I915_EXEC_BATCH_FIRST<<1))
+
+/* Setting I915_FENCE_ARRAY implies that num_cliprects and cliprects_ptr
+ * define an array of i915_gem_exec_fence structures which specify a set of
+ * dma fences to wait upon or signal.
+ */
+#define I915_EXEC_FENCE_ARRAY   (1<<19)
+
+#define __I915_EXEC_UNKNOWN_FLAGS (-(I915_EXEC_FENCE_ARRAY<<1))
 
 #define I915_EXEC_CONTEXT_ID_MASK       (0xffffffff)
 #define i915_execbuffer2_set_context_id(eb2, context) \
@@ -1467,6 +1498,22 @@ enum drm_i915_perf_record_type {
         DRM_I915_PERF_RECORD_MAX /* non-ABI */
 };
 
+/**
+ * Structure to upload perf dynamic configuration into the kernel.
+ */
+struct drm_i915_perf_oa_config {
+        /** String formatted like "%08x-%04x-%04x-%04x-%012x" */
+        char uuid[36];
+
+        __u32 n_mux_regs;
+        __u32 n_boolean_regs;
+        __u32 n_flex_regs;
+
+        __u64 __user mux_regs_ptr;
+        __u64 __user boolean_regs_ptr;
+        __u64 __user flex_regs_ptr;
+};
+
 #if defined(__cplusplus)
 }
 #endif
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 461811e57140..01cc7ba39924 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -143,12 +143,6 @@ enum bpf_attach_type {
 
 #define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE
 
-enum bpf_sockmap_flags {
-        BPF_SOCKMAP_UNSPEC,
-        BPF_SOCKMAP_STRPARSER,
-        __MAX_BPF_SOCKMAP_FLAG
-};
-
 /* If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command
  * to the given target_fd cgroup the descendent cgroup will be able to
  * override effective bpf program that was inherited from this cgroup
@@ -318,7 +312,7 @@ union bpf_attr {
  *     jump into another BPF program
  *     @ctx: context pointer passed to next program
  *     @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY
- *     @index: index inside array that selects specific program to run
+ *     @index: 32-bit index inside array that selects specific program to run
  *     Return: 0 on success or negative error
  *
  * int bpf_clone_redirect(skb, ifindex, flags)
@@ -368,9 +362,20 @@ union bpf_attr {
  * int bpf_redirect(ifindex, flags)
  *     redirect to another netdev
  *     @ifindex: ifindex of the net device
- *     @flags: bit 0 - if set, redirect to ingress instead of egress
- *             other bits - reserved
- *     Return: TC_ACT_REDIRECT
+ *     @flags:
+ *        cls_bpf:
+ *          bit 0 - if set, redirect to ingress instead of egress
+ *          other bits - reserved
+ *        xdp_bpf:
+ *          all bits - reserved
+ *     Return: cls_bpf: TC_ACT_REDIRECT on success or TC_ACT_SHOT on error
+ *             xdp_bfp: XDP_REDIRECT on success or XDP_ABORT on error
+ * int bpf_redirect_map(map, key, flags)
+ *     redirect to endpoint in map
+ *     @map: pointer to dev map
+ *     @key: index in map to lookup
+ *     @flags: --
+ *     Return: XDP_REDIRECT on success or XDP_ABORT on error
  *
  * u32 bpf_get_route_realm(skb)
  *     retrieve a dst's tclassid
@@ -564,13 +569,14 @@ union bpf_attr {
  *     @flags: reserved for future use
  *     Return: 0 on success or negative error code
  *
- * int bpf_sk_redirect_map(map, key, flags)
+ * int bpf_sk_redirect_map(skb, map, key, flags)
  *     Redirect skb to a sock in map using key as a lookup key for the
  *     sock in map.
+ *     @skb: pointer to skb
  *     @map: pointer to sockmap
  *     @key: key to lookup sock in map
  *     @flags: reserved for future use
- *     Return: SK_REDIRECT
+ *     Return: SK_PASS
  *
  * int bpf_sock_map_update(skops, map, key, flags)
  *      @skops: pointer to bpf_sock_ops
@@ -632,7 +638,7 @@ union bpf_attr {
         FN(skb_adjust_room),            \
         FN(redirect_map),               \
         FN(sk_redirect_map),            \
-        FN(sock_map_update),
+        FN(sock_map_update),            \
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -753,20 +759,23 @@ struct bpf_sock {
         __u32 family;
         __u32 type;
         __u32 protocol;
+        __u32 mark;
+        __u32 priority;
 };
 
 #define XDP_PACKET_HEADROOM 256
 
 /* User return codes for XDP prog type.
  * A valid XDP program must return one of these defined values. All other
- * return codes are reserved for future use. Unknown return codes will result
- * in packet drop.
+ * return codes are reserved for future use. Unknown return codes will
+ * result in packet drops and a warning via bpf_warn_invalid_xdp_action().
  */
 enum xdp_action {
         XDP_ABORTED = 0,
         XDP_DROP,
         XDP_PASS,
         XDP_TX,
+        XDP_REDIRECT,
 };
 
 /* user accessible metadata for XDP packet hook
@@ -778,9 +787,8 @@ struct xdp_md {
 };
 
 enum sk_action {
-        SK_ABORTED = 0,
-        SK_DROP,
-        SK_REDIRECT,
+        SK_DROP = 0,
+        SK_PASS,
 };
 
 #define BPF_TAG_SIZE    8
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 6cd63c18708a..838887587411 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -711,7 +711,8 @@ struct kvm_ppc_one_seg_page_size {
 struct kvm_ppc_smmu_info {
         __u64 flags;
         __u32 slb_size;
-        __u32 pad;
+        __u16 data_keys;        /* # storage keys supported for data */
+        __u16 instr_keys;       /* # storage keys supported for instructions */
         struct kvm_ppc_one_seg_page_size sps[KVM_PPC_PAGE_SIZES_MAX_SZ];
 };
 
diff --git a/tools/include/uapi/linux/mman.h b/tools/include/uapi/linux/mman.h
index 81d8edf11789..a937480d7cd3 100644
--- a/tools/include/uapi/linux/mman.h
+++ b/tools/include/uapi/linux/mman.h
@@ -1,7 +1,8 @@
 #ifndef _UAPI_LINUX_MMAN_H
 #define _UAPI_LINUX_MMAN_H
 
-#include <uapi/asm/mman.h>
+#include <asm/mman.h>
+#include <asm-generic/hugetlb_encode.h>
 
 #define MREMAP_MAYMOVE  1
 #define MREMAP_FIXED    2
@@ -10,4 +11,25 @@
 #define OVERCOMMIT_ALWAYS               1
 #define OVERCOMMIT_NEVER                2
 
+/*
+ * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
+ * size other than the default is desired.  See hugetlb_encode.h.
+ * All known huge page size encodings are provided here.  It is the
+ * responsibility of the application to know which sizes are supported on
+ * the running system.  See mmap(2) man page for details.
+ */
+#define MAP_HUGE_SHIFT  HUGETLB_FLAG_ENCODE_SHIFT
+#define MAP_HUGE_MASK   HUGETLB_FLAG_ENCODE_MASK
+
+#define MAP_HUGE_64KB   HUGETLB_FLAG_ENCODE_64KB
+#define MAP_HUGE_512KB  HUGETLB_FLAG_ENCODE_512KB
+#define MAP_HUGE_1MB    HUGETLB_FLAG_ENCODE_1MB
+#define MAP_HUGE_2MB    HUGETLB_FLAG_ENCODE_2MB
+#define MAP_HUGE_8MB    HUGETLB_FLAG_ENCODE_8MB
+#define MAP_HUGE_16MB   HUGETLB_FLAG_ENCODE_16MB
+#define MAP_HUGE_256MB  HUGETLB_FLAG_ENCODE_256MB
+#define MAP_HUGE_1GB    HUGETLB_FLAG_ENCODE_1GB
+#define MAP_HUGE_2GB    HUGETLB_FLAG_ENCODE_2GB
+#define MAP_HUGE_16GB   HUGETLB_FLAG_ENCODE_16GB
+
 #endif /* _UAPI_LINUX_MMAN_H */
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 0f22768c0d4d..34a579f806e3 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -284,11 +284,16 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
         case 0x8d:
                 if (sib == 0x24 && rex_w && !rex_b && !rex_x) {
 
-                        /* lea disp(%rsp), reg */
                         *type = INSN_STACK;
-                        op->src.type = OP_SRC_ADD;
+                        if (!insn.displacement.value) {
+                                /* lea (%rsp), reg */
+                                op->src.type = OP_SRC_REG;
+                        } else {
+                                /* lea disp(%rsp), reg */
+                                op->src.type = OP_SRC_ADD;
+                                op->src.offset = insn.displacement.value;
+                        }
                         op->src.reg = CFI_SP;
-                        op->src.offset = insn.displacement.value;
                         op->dest.type = OP_DEST_REG;
                         op->dest.reg = op_to_cfi_reg[modrm_reg][rex_r];
 
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index a0c518ecf085..c0e26ad1fa7e 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -267,12 +267,13 @@ static int decode_instructions(struct objtool_file *file)
                                                       &insn->immediate,
                                                       &insn->stack_op);
                         if (ret)
-                                return ret;
+                                goto err;
 
                         if (!insn->type || insn->type > INSN_LAST) {
                                 WARN_FUNC("invalid instruction type %d",
                                           insn->sec, insn->offset, insn->type);
-                                return -1;
+                                ret = -1;
+                                goto err;
                         }
 
                         hash_add(file->insn_hash, &insn->hash, insn->offset);
@@ -296,6 +297,10 @@ static int decode_instructions(struct objtool_file *file)
         }
 
         return 0;
+
+err:
+        free(insn);
+        return ret;
 }
 
 /*
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index e397453e5a46..63526f4416ea 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -8,8 +8,8 @@ perf-record - Run a command and record its profile into perf.data
 SYNOPSIS
 --------
 [verse]
-'perf record' [-e <EVENT> | --event=EVENT] [-l] [-a] <command>
-'perf record' [-e <EVENT> | --event=EVENT] [-l] [-a] -- <command> [<options>]
+'perf record' [-e <EVENT> | --event=EVENT] [-a] <command>
+'perf record' [-e <EVENT> | --event=EVENT] [-a] -- <command> [<options>]
 
 DESCRIPTION
 -----------
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 62072822dc85..627b7cada144 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,34 +1,8 @@
 tools/perf
-tools/arch/alpha/include/asm/barrier.h
-tools/arch/arm/include/asm/barrier.h
-tools/arch/arm64/include/asm/barrier.h
-tools/arch/ia64/include/asm/barrier.h
-tools/arch/mips/include/asm/barrier.h
-tools/arch/powerpc/include/asm/barrier.h
-tools/arch/s390/include/asm/barrier.h
-tools/arch/sh/include/asm/barrier.h
-tools/arch/sparc/include/asm/barrier.h
-tools/arch/sparc/include/asm/barrier_32.h
-tools/arch/sparc/include/asm/barrier_64.h
-tools/arch/tile/include/asm/barrier.h
-tools/arch/x86/include/asm/barrier.h
-tools/arch/x86/include/asm/cmpxchg.h
-tools/arch/x86/include/asm/cpufeatures.h
-tools/arch/x86/include/asm/disabled-features.h
-tools/arch/x86/include/asm/required-features.h
-tools/arch/x86/include/uapi/asm/svm.h
-tools/arch/x86/include/uapi/asm/vmx.h
-tools/arch/x86/include/uapi/asm/kvm.h
-tools/arch/x86/include/uapi/asm/kvm_perf.h
-tools/arch/x86/lib/memcpy_64.S
-tools/arch/x86/lib/memset_64.S
-tools/arch/s390/include/uapi/asm/kvm_perf.h
-tools/arch/s390/include/uapi/asm/sie.h
-tools/arch/xtensa/include/asm/barrier.h
+tools/arch
 tools/scripts
 tools/build
-tools/arch/x86/include/asm/atomic.h
-tools/arch/x86/include/asm/rmwcc.h
+tools/include
 tools/lib/traceevent
 tools/lib/api
 tools/lib/bpf
@@ -42,60 +16,3 @@ tools/lib/find_bit.c
 tools/lib/bitmap.c
 tools/lib/str_error_r.c
 tools/lib/vsprintf.c
-tools/include/asm/alternative-asm.h
-tools/include/asm/atomic.h
-tools/include/asm/barrier.h
-tools/include/asm/bug.h
-tools/include/asm-generic/atomic-gcc.h
-tools/include/asm-generic/barrier.h
-tools/include/asm-generic/bitops/arch_hweight.h
-tools/include/asm-generic/bitops/atomic.h
-tools/include/asm-generic/bitops/const_hweight.h
-tools/include/asm-generic/bitops/__ffs.h
-tools/include/asm-generic/bitops/__ffz.h
-tools/include/asm-generic/bitops/__fls.h
-tools/include/asm-generic/bitops/find.h
-tools/include/asm-generic/bitops/fls64.h
-tools/include/asm-generic/bitops/fls.h
-tools/include/asm-generic/bitops/hweight.h
-tools/include/asm-generic/bitops.h
-tools/include/linux/atomic.h
-tools/include/linux/bitops.h
-tools/include/linux/compiler.h
-tools/include/linux/compiler-gcc.h
-tools/include/linux/coresight-pmu.h
-tools/include/linux/bug.h
-tools/include/linux/filter.h
-tools/include/linux/hash.h
-tools/include/linux/kernel.h
-tools/include/linux/list.h
-tools/include/linux/log2.h
-tools/include/uapi/asm-generic/fcntl.h
-tools/include/uapi/asm-generic/ioctls.h
-tools/include/uapi/asm-generic/mman-common.h
-tools/include/uapi/asm-generic/mman.h
-tools/include/uapi/drm/drm.h
-tools/include/uapi/drm/i915_drm.h
-tools/include/uapi/linux/bpf.h
-tools/include/uapi/linux/bpf_common.h
-tools/include/uapi/linux/fcntl.h
-tools/include/uapi/linux/hw_breakpoint.h
-tools/include/uapi/linux/kvm.h
-tools/include/uapi/linux/mman.h
-tools/include/uapi/linux/perf_event.h
-tools/include/uapi/linux/sched.h
-tools/include/uapi/linux/stat.h
-tools/include/uapi/linux/vhost.h
-tools/include/uapi/sound/asound.h
-tools/include/linux/poison.h
-tools/include/linux/rbtree.h
-tools/include/linux/rbtree_augmented.h
-tools/include/linux/refcount.h
-tools/include/linux/string.h
-tools/include/linux/stringify.h
-tools/include/linux/types.h
-tools/include/linux/err.h
-tools/include/linux/bitmap.h
-tools/include/linux/time64.h
-tools/arch/*/include/uapi/asm/mman.h
-tools/arch/*/include/uapi/asm/perf_regs.h
diff --git a/tools/perf/arch/s390/util/Build b/tools/perf/arch/s390/util/Build
index bd518b623d7a..5bd7b9260cc0 100644
--- a/tools/perf/arch/s390/util/Build
+++ b/tools/perf/arch/s390/util/Build
@@ -1,5 +1,4 @@
 libperf-y += header.o
-libperf-y += sym-handling.o
 libperf-y += kvm-stat.o
 
 libperf-$(CONFIG_DWARF) += dwarf-regs.o
diff --git a/tools/perf/arch/s390/util/sym-handling.c b/tools/perf/arch/s390/util/sym-handling.c
deleted file mode 100644
index e103f6e46afe..000000000000
--- a/tools/perf/arch/s390/util/sym-handling.c
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Architecture specific ELF symbol handling and relocation mapping.
- *
- * Copyright 2017 IBM Corp.
- * Author(s): Thomas Richter <tmricht@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- */
-
-#include "symbol.h"
-
-#ifdef HAVE_LIBELF_SUPPORT
-bool elf__needs_adjust_symbols(GElf_Ehdr ehdr)
-{
-        if (ehdr.e_type == ET_EXEC)
-                return false;
-        return ehdr.e_type == ET_REL || ehdr.e_type == ET_DYN;
-}
-
-void arch__adjust_sym_map_offset(GElf_Sym *sym,
-                                 GElf_Shdr *shdr __maybe_unused,
-                                 struct map *map)
-{
-        if (map->type == MAP__FUNCTION)
-                sym->st_value += map->start;
-}
-#endif
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 3d4c3b5e1868..0c977b6e0f8b 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -586,7 +586,7 @@ static void print_sample_brstack(struct perf_sample *sample,
                         thread__find_addr_map(thread, sample->cpumode, MAP__FUNCTION, to, &alt);
                 }
 
-                printf("0x%"PRIx64, from);
+                printf(" 0x%"PRIx64, from);
                 if (PRINT_FIELD(DSO)) {
                         printf("(");
                         map__fprintf_dsoname(alf.map, stdout);
@@ -681,7 +681,7 @@ static void print_sample_brstackoff(struct perf_sample *sample,
                 if (alt.map && !alt.map->dso->adjust_symbols)
                         to = map__map_ip(alt.map, to);
 
-                printf("0x%"PRIx64, from);
+                printf(" 0x%"PRIx64, from);
                 if (PRINT_FIELD(DSO)) {
                         printf("(");
                         map__fprintf_dsoname(alf.map, stdout);
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 462fc755092e..7a84d73324e3 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -10,6 +10,9 @@
 
 . $(dirname $0)/lib/probe.sh
 
+ld=$(realpath /lib64/ld*.so.* | uniq)
+libc=$(echo $ld | sed 's/ld/libc/g')
+
 trace_libc_inet_pton_backtrace() {
         idx=0
         expected[0]="PING.*bytes"
@@ -18,8 +21,8 @@ trace_libc_inet_pton_backtrace() {
         expected[3]=".*packets transmitted.*"
         expected[4]="rtt min.*"
         expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
-        expected[6]=".*inet_pton[[:space:]]\(/usr/lib.*/libc-[0-9]+\.[0-9]+\.so\)$"
-        expected[7]="getaddrinfo[[:space:]]\(/usr/lib.*/libc-[0-9]+\.[0-9]+\.so\)$"
+        expected[6]=".*inet_pton[[:space:]]\($libc\)$"
+        expected[7]="getaddrinfo[[:space:]]\($libc\)$"
         expected[8]=".*\(.*/bin/ping.*\)$"
 
         perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
@@ -35,7 +38,7 @@ trace_libc_inet_pton_backtrace() {
 }
 
 skip_if_no_perf_probe && \
-perf probe -q /lib64/libc-*.so inet_pton && \
+perf probe -q $libc inet_pton && \
 trace_libc_inet_pton_backtrace
 err=$?
 rm -f ${file}
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index ddb2c6fbdf91..db79017a6e56 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -532,7 +532,7 @@ void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
 
 void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
 {
-        list_del(&format->list);
+        list_del_init(&format->list);
 }
 
 void perf_hpp__cancel_cumulate(void)
@@ -606,6 +606,13 @@ next:
 
 static void fmt_free(struct perf_hpp_fmt *fmt)
 {
+        /*
+         * At this point fmt should be completely
+         * unhooked, if not it's a bug.
+         */
+        BUG_ON(!list_empty(&fmt->list));
+        BUG_ON(!list_empty(&fmt->sort_list));
+
         if (fmt->free)
                 fmt->free(fmt);
 }
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 510b513e0f01..a971caf3759d 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -65,8 +65,6 @@ static int parse_callchain_mode(const char *value)
                 callchain_param.mode = CHAIN_FOLDED;
                 return 0;
         }
-
-        pr_err("Invalid callchain mode: %s\n", value);
         return -1;
 }
 
@@ -82,8 +80,6 @@ static int parse_callchain_order(const char *value)
                 callchain_param.order_set = true;
                 return 0;
         }
-
-        pr_err("Invalid callchain order: %s\n", value);
         return -1;
 }
 
@@ -105,8 +101,6 @@ static int parse_callchain_sort_key(const char *value)
                 callchain_param.branch_callstack = 1;
                 return 0;
         }
-
-        pr_err("Invalid callchain sort key: %s\n", value);
         return -1;
 }
 
@@ -124,8 +118,6 @@ static int parse_callchain_value(const char *value)
                 callchain_param.value = CCVAL_COUNT;
                 return 0;
         }
-
-        pr_err("Invalid callchain config key: %s\n", value);
         return -1;
 }
 
@@ -319,12 +311,27 @@ int perf_callchain_config(const char *var, const char *value)
 
                 return ret;
         }
-        if (!strcmp(var, "print-type"))
-                return parse_callchain_mode(value);
-        if (!strcmp(var, "order"))
-                return parse_callchain_order(value);
-        if (!strcmp(var, "sort-key"))
-                return parse_callchain_sort_key(value);
+        if (!strcmp(var, "print-type")){
+                int ret;
+                ret = parse_callchain_mode(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain mode: %s\n", value);
+                return ret;
+        }
+        if (!strcmp(var, "order")){
+                int ret;
+                ret = parse_callchain_order(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain order: %s\n", value);
+                return ret;
+        }
+        if (!strcmp(var, "sort-key")){
+                int ret;
+                ret = parse_callchain_sort_key(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain sort key: %s\n", value);
+                return ret;
+        }
         if (!strcmp(var, "threshold")) {
                 callchain_param.min_percent = strtod(value, &endptr);
                 if (value == endptr) {
@@ -678,6 +685,8 @@ static enum match_result match_chain(struct callchain_cursor_node *node,
 {
         struct symbol *sym = node->sym;
         u64 left, right;
+        struct dso *left_dso = NULL;
+        struct dso *right_dso = NULL;
 
         if (callchain_param.key == CCKEY_SRCLINE) {
                 enum match_result match = match_chain_srcline(node, cnode);
@@ -689,12 +698,14 @@ static enum match_result match_chain(struct callchain_cursor_node *node,
         if (cnode->ms.sym && sym && callchain_param.key == CCKEY_FUNCTION) {
                 left = cnode->ms.sym->start;
                 right = sym->start;
+                left_dso = cnode->ms.map->dso;
+                right_dso = node->map->dso;
         } else {
                 left = cnode->ip;
                 right = node->ip;
         }
 
-        if (left == right) {
+        if (left == right && left_dso == right_dso) {
                 if (node->branch) {
                         cnode->branch_count++;
 
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 4bb89373eb52..0dccdb89572c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -271,12 +271,17 @@ struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx)
         return evsel;
 }
 
+static bool perf_event_can_profile_kernel(void)
+{
+        return geteuid() == 0 || perf_event_paranoid() == -1;
+}
+
 struct perf_evsel *perf_evsel__new_cycles(bool precise)
 {
         struct perf_event_attr attr = {
                 .type   = PERF_TYPE_HARDWARE,
                 .config = PERF_COUNT_HW_CPU_CYCLES,
-                .exclude_kernel = geteuid() != 0,
+                .exclude_kernel = !perf_event_can_profile_kernel(),
         };
         struct perf_evsel *evsel;
 
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index f6257fb4f08c..39b15968eab1 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -309,10 +309,11 @@ static char *get_config_name(struct list_head *head_terms)
 static struct perf_evsel *
 __add_event(struct list_head *list, int *idx,
             struct perf_event_attr *attr,
-            char *name, struct cpu_map *cpus,
+            char *name, struct perf_pmu *pmu,
             struct list_head *config_terms, bool auto_merge_stats)
 {
         struct perf_evsel *evsel;
+        struct cpu_map *cpus = pmu ? pmu->cpus : NULL;
 
         event_attr_init(attr);
 
@@ -323,7 +324,7 @@ __add_event(struct list_head *list, int *idx,
         (*idx)++;
         evsel->cpus        = cpu_map__get(cpus);
         evsel->own_cpus    = cpu_map__get(cpus);
-        evsel->system_wide = !!cpus;
+        evsel->system_wide = pmu ? pmu->is_uncore : false;
         evsel->auto_merge_stats = auto_merge_stats;
 
         if (name)
@@ -1233,7 +1234,7 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state,
 
         if (!head_config) {
                 attr.type = pmu->type;
-                evsel = __add_event(list, &parse_state->idx, &attr, NULL, pmu->cpus, NULL, auto_merge_stats);
+                evsel = __add_event(list, &parse_state->idx, &attr, NULL, pmu, NULL, auto_merge_stats);
                 return evsel ? 0 : -ENOMEM;
         }
 
@@ -1254,7 +1255,7 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state,
                 return -EINVAL;
 
         evsel = __add_event(list, &parse_state->idx, &attr,
-                            get_config_name(head_config), pmu->cpus,
+                            get_config_name(head_config), pmu,
                             &config_terms, auto_merge_stats);
         if (evsel) {
                 evsel->unit = info.unit;
diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
index c42edeac451f..dcfdafdc2f1c 100644
--- a/tools/perf/util/parse-events.l
+++ b/tools/perf/util/parse-events.l
@@ -8,6 +8,9 @@
 
 %{
 #include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
 #include "../perf.h"
 #include "parse-events.h"
 #include "parse-events-bison.h"
@@ -53,9 +56,8 @@ static int str(yyscan_t scanner, int token)
         return token;
 }
 
-static bool isbpf(yyscan_t scanner)
+static bool isbpf_suffix(char *text)
 {
-        char *text = parse_events_get_text(scanner);
         int len = strlen(text);
 
         if (len < 2)
@@ -68,6 +70,17 @@ static bool isbpf(yyscan_t scanner)
         return false;
 }
 
+static bool isbpf(yyscan_t scanner)
+{
+        char *text = parse_events_get_text(scanner);
+        struct stat st;
+
+        if (!isbpf_suffix(text))
+                return false;
+
+        return stat(text, &st) == 0;
+}
+
 /*
  * This function is called when the parser gets two kind of input:
  *
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index ac16a9db1fb5..1c4d7b4e4fb5 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -470,17 +470,36 @@ static void pmu_read_sysfs(void)
         closedir(dir);
 }
 
+static struct cpu_map *__pmu_cpumask(const char *path)
+{
+        FILE *file;
+        struct cpu_map *cpus;
+
+        file = fopen(path, "r");
+        if (!file)
+                return NULL;
+
+        cpus = cpu_map__read(file);
+        fclose(file);
+        return cpus;
+}
+
+/*
+ * Uncore PMUs have a "cpumask" file under sysfs. CPU PMUs (e.g. on arm/arm64)
+ * may have a "cpus" file.
+ */
+#define CPUS_TEMPLATE_UNCORE    "%s/bus/event_source/devices/%s/cpumask"
+#define CPUS_TEMPLATE_CPU       "%s/bus/event_source/devices/%s/cpus"
+
 static struct cpu_map *pmu_cpumask(const char *name)
 {
-        struct stat st;
         char path[PATH_MAX];
-        FILE *file;
         struct cpu_map *cpus;
         const char *sysfs = sysfs__mountpoint();
         const char *templates[] = {
-                 "%s/bus/event_source/devices/%s/cpumask",
-                 "%s/bus/event_source/devices/%s/cpus",
-                 NULL
+                CPUS_TEMPLATE_UNCORE,
+                CPUS_TEMPLATE_CPU,
+                NULL
         };
         const char **template;
 
@@ -489,20 +508,25 @@ static struct cpu_map *pmu_cpumask(const char *name)
 
         for (template = templates; *template; template++) {
                 snprintf(path, PATH_MAX, *template, sysfs, name);
-                if (stat(path, &st) == 0)
-                        break;
+                cpus = __pmu_cpumask(path);
+                if (cpus)
+                        return cpus;
         }
 
-        if (!*template)
-                return NULL;
+        return NULL;
+}
 
-        file = fopen(path, "r");
-        if (!file)
-                return NULL;
+static bool pmu_is_uncore(const char *name)
+{
+        char path[PATH_MAX];
+        struct cpu_map *cpus;
+        const char *sysfs = sysfs__mountpoint();
 
-        cpus = cpu_map__read(file);
-        fclose(file);
-        return cpus;
+        snprintf(path, PATH_MAX, CPUS_TEMPLATE_UNCORE, sysfs, name);
+        cpus = __pmu_cpumask(path);
+        cpu_map__put(cpus);
+
+        return !!cpus;
 }
 
 /*
@@ -617,6 +641,8 @@ static struct perf_pmu *pmu_lookup(const char *name)
 
         pmu->cpus = pmu_cpumask(name);
 
+        pmu->is_uncore = pmu_is_uncore(name);
+
         INIT_LIST_HEAD(&pmu->format);
         INIT_LIST_HEAD(&pmu->aliases);
         list_splice(&format, &pmu->format);
diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
index 389e9729331f..fe0de0502ce2 100644
--- a/tools/perf/util/pmu.h
+++ b/tools/perf/util/pmu.h
@@ -22,6 +22,7 @@ struct perf_pmu {
         char *name;
         __u32 type;
         bool selectable;
+        bool is_uncore;
         struct perf_event_attr *default_config;
         struct cpu_map *cpus;
         struct list_head format;  /* HEAD struct perf_pmu_format -> list */
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index a7ebd9fe8e40..76ab0709a20c 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -374,6 +374,8 @@ void perf_tool__fill_defaults(struct perf_tool *tool)
                 tool->mmap2 = process_event_stub;
         if (tool->comm == NULL)
                 tool->comm = process_event_stub;
+        if (tool->namespaces == NULL)
+                tool->namespaces = process_event_stub;
         if (tool->fork == NULL)
                 tool->fork = process_event_stub;
         if (tool->exit == NULL)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 5c39f420111e..9cf781f0d8a2 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -810,12 +810,6 @@ static u64 ref_reloc(struct kmap *kmap)
 void __weak arch__sym_update(struct symbol *s __maybe_unused,
                 GElf_Sym *sym __maybe_unused) { }
 
-void __weak arch__adjust_sym_map_offset(GElf_Sym *sym, GElf_Shdr *shdr,
-                                       struct map *map __maybe_unused)
-{
-        sym->st_value -= shdr->sh_addr - shdr->sh_offset;
-}
-
 int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
                   struct symsrc *runtime_ss, int kmodule)
 {
@@ -996,7 +990,7 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
 
                         /* Adjust symbol to map to file offset */
                         if (adjust_kernel_syms)
-                                arch__adjust_sym_map_offset(&sym, &shdr, map);
+                                sym.st_value -= shdr.sh_addr - shdr.sh_offset;
 
                         if (strcmp(section_name,
                                    (curr_dso->short_name +
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 2bd6a1f01a1c..aad99e7e179b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -344,9 +344,6 @@ int setup_intlist(struct intlist **list, const char *list_str,
 #ifdef HAVE_LIBELF_SUPPORT
 bool elf__needs_adjust_symbols(GElf_Ehdr ehdr);
 void arch__sym_update(struct symbol *s, GElf_Sym *sym);
-void arch__adjust_sym_map_offset(GElf_Sym *sym,
-                                 GElf_Shdr *shdr __maybe_unused,
-                                 struct map *map __maybe_unused);
 #endif
 
 #define SYMBOL_A 0
diff --git a/tools/perf/util/syscalltbl.c b/tools/perf/util/syscalltbl.c
index 19e5db90394c..6eea7cff3d4e 100644
--- a/tools/perf/util/syscalltbl.c
+++ b/tools/perf/util/syscalltbl.c
@@ -15,9 +15,9 @@
 
 #include "syscalltbl.h"
 #include <stdlib.h>
+#include <linux/compiler.h>
 
 #ifdef HAVE_SYSCALL_TABLE
-#include <linux/compiler.h>
 #include <string.h>
 #include "string2.h"
 #include "util.h"
diff --git a/tools/perf/util/xyarray.h b/tools/perf/util/xyarray.h
index 4ba726c90870..54af60462130 100644
--- a/tools/perf/util/xyarray.h
+++ b/tools/perf/util/xyarray.h
@@ -23,12 +23,12 @@ static inline void *xyarray__entry(struct xyarray *xy, int x, int y)
 
 static inline int xyarray__max_y(struct xyarray *xy)
 {
-        return xy->max_x;
+        return xy->max_y;
 }
 
 static inline int xyarray__max_x(struct xyarray *xy)
 {
-        return xy->max_y;
+        return xy->max_x;
 }
 
 #endif /* _PERF_XYARRAY_H_ */
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 4c5a481a850c..d6e1c02ddcfe 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -26,7 +26,7 @@ endif
 
 ifneq ($(OUTPUT),)
 # check that the output directory actually exists
-OUTDIR := $(realpath $(OUTPUT))
+OUTDIR := $(shell cd $(OUTPUT) && /bin/pwd)
 $(if $(OUTDIR),, $(error output directory "$(OUTPUT)" does not exist))
 endif
 
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 0dafba2c1e7d..bd9c6b31a504 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -92,7 +92,6 @@ unsigned int do_ring_perf_limit_reasons;
 unsigned int crystal_hz;
 unsigned long long tsc_hz;
 int base_cpu;
-int do_migrate;
 double discover_bclk(unsigned int family, unsigned int model);
 unsigned int has_hwp;   /* IA32_PM_ENABLE, IA32_HWP_CAPABILITIES */
                         /* IA32_HWP_REQUEST, IA32_HWP_STATUS */
@@ -303,9 +302,6 @@ int for_all_cpus(int (func)(struct thread_data *, struct core_data *, struct pkg
 
 int cpu_migrate(int cpu)
 {
-        if (!do_migrate)
-                return 0;
-
         CPU_ZERO_S(cpu_affinity_setsize, cpu_affinity_set);
         CPU_SET_S(cpu, cpu_affinity_setsize, cpu_affinity_set);
         if (sched_setaffinity(0, cpu_affinity_setsize, cpu_affinity_set) == -1)
@@ -5007,7 +5003,6 @@ void cmdline(int argc, char **argv)
                 {"hide",        required_argument,      0, 'H'},        // meh, -h taken by --help
                 {"Joules",      no_argument,            0, 'J'},
                 {"list",        no_argument,            0, 'l'},
-                {"migrate",     no_argument,            0, 'm'},
                 {"out",         required_argument,      0, 'o'},
                 {"quiet",       no_argument,            0, 'q'},
                 {"show",        required_argument,      0, 's'},
@@ -5019,7 +5014,7 @@ void cmdline(int argc, char **argv)
 
         progname = argv[0];
 
-        while ((opt = getopt_long_only(argc, argv, "+C:c:Ddhi:Jmo:qST:v",
+        while ((opt = getopt_long_only(argc, argv, "+C:c:Ddhi:JM:m:o:qST:v",
                                 long_options, &option_index)) != -1) {
                 switch (opt) {
                 case 'a':
@@ -5062,9 +5057,6 @@ void cmdline(int argc, char **argv)
                         list_header_only++;
                         quiet++;
                         break;
-                case 'm':
-                        do_migrate = 1;
-                        break;
                 case 'o':
                         outf = fopen_or_die(optarg, "w");
                         break;
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index 9dc8f078a83c..1e8b6116ba3c 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -1,7 +1,7 @@
 ifneq ($(O),)
 ifeq ($(origin O), command line)
-        ABSOLUTE_O := $(realpath $(O))
-        dummy := $(if $(ABSOLUTE_O),,$(error O=$(O) does not exist))
+        dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
+        ABSOLUTE_O := $(shell cd $(O) ; pwd)
         OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/)
         COMMAND_O := O=$(ABSOLUTE_O)
 ifeq ($(objtree),)
@@ -12,7 +12,7 @@ endif
 
 # check that the output directory actually exists
 ifneq ($(OUTPUT),)
-OUTDIR := $(realpath $(OUTPUT))
+OUTDIR := $(shell cd $(OUTPUT) && /bin/pwd)
 $(if $(OUTDIR),, $(error output directory "$(OUTPUT)" does not exist))
 endif
 
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 26ce4f7168be..ff805643b5f7 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -52,6 +52,10 @@ override LDFLAGS =
 override MAKEFLAGS =
 endif
 
+ifneq ($(KBUILD_SRC),)
+override LDFLAGS =
+endif
+
 BUILD := $(O)
 ifndef BUILD
   BUILD := $(KBUILD_OUTPUT)
@@ -62,32 +66,32 @@ endif
 
 export BUILD
 all:
-        for TARGET in $(TARGETS); do            \
+        @for TARGET in $(TARGETS); do           \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET;\
         done;
 
 run_tests: all
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests;\
         done;
 
 hotplug:
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET;\
         done;
 
 run_hotplug: hotplug
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET run_full_test;\
         done;
 
 clean_hotplug:
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
         done;
@@ -103,7 +107,7 @@ install:
 ifdef INSTALL_PATH
         @# Ask all targets to install their files
         mkdir -p $(INSTALL_PATH)
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install; \
         done;
@@ -128,7 +132,7 @@ else
 endif
 
 clean:
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
         done;
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index 36fb9161b34a..b2e02bdcd098 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -65,7 +65,7 @@ static int (*bpf_xdp_adjust_head)(void *ctx, int offset) =
 static int (*bpf_setsockopt)(void *ctx, int level, int optname, void *optval,
                              int optlen) =
         (void *) BPF_FUNC_setsockopt;
-static int (*bpf_sk_redirect_map)(void *map, int key, int flags) =
+static int (*bpf_sk_redirect_map)(void *ctx, void *map, int key, int flags) =
         (void *) BPF_FUNC_sk_redirect_map;
 static int (*bpf_sock_map_update)(void *map, void *key, void *value,
                                   unsigned long long flags) =
diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
index 20ecbaa0d85d..6c53a8906eff 100644
--- a/tools/testing/selftests/bpf/bpf_util.h
+++ b/tools/testing/selftests/bpf/bpf_util.h
@@ -12,6 +12,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
         unsigned int start, end, possible_cpus = 0;
         char buff[128];
         FILE *fp;
+        int n;
 
         fp = fopen(fcpu, "r");
         if (!fp) {
@@ -20,17 +21,17 @@ static inline unsigned int bpf_num_possible_cpus(void)
         }
 
         while (fgets(buff, sizeof(buff), fp)) {
-                if (sscanf(buff, "%u-%u", &start, &end) == 2) {
-                        possible_cpus = start == 0 ? end + 1 : 0;
-                        break;
+                n = sscanf(buff, "%u-%u", &start, &end);
+                if (n == 0) {
+                        printf("Failed to retrieve # possible CPUs!\n");
+                        exit(1);
+                } else if (n == 1) {
+                        end = start;
                 }
+                possible_cpus = start == 0 ? end + 1 : 0;
+                break;
         }
-
         fclose(fp);
-        if (!possible_cpus) {
-                printf("Failed to retrieve # possible CPUs!\n");
-                exit(1);
-        }
 
         return possible_cpus;
 }
diff --git a/tools/testing/selftests/bpf/sockmap_verdict_prog.c b/tools/testing/selftests/bpf/sockmap_verdict_prog.c
index 9b99bd10807d..2cd2d552938b 100644
--- a/tools/testing/selftests/bpf/sockmap_verdict_prog.c
+++ b/tools/testing/selftests/bpf/sockmap_verdict_prog.c
@@ -61,8 +61,8 @@ int bpf_prog2(struct __sk_buff *skb)
         bpf_printk("verdict: data[0] = redir(%u:%u)\n", map, sk);
 
         if (!map)
-                return bpf_sk_redirect_map(&sock_map_rx, sk, 0);
-        return bpf_sk_redirect_map(&sock_map_tx, sk, 0);
+                return bpf_sk_redirect_map(skb, &sock_map_rx, sk, 0);
+        return bpf_sk_redirect_map(skb, &sock_map_tx, sk, 0);
 }
 
 char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index fe3a443a1102..50ce52d2013d 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -466,7 +466,7 @@ static void test_sockmap(int tasks, void *data)
         int one = 1, map_fd_rx, map_fd_tx, map_fd_break, s, sc, rc;
         struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_break;
         int ports[] = {50200, 50201, 50202, 50204};
-        int err, i, fd, sfd[6] = {0xdeadbeef};
+        int err, i, fd, udp, sfd[6] = {0xdeadbeef};
         u8 buf[20] = {0x0, 0x5, 0x3, 0x2, 0x1, 0x0};
         int parse_prog, verdict_prog;
         struct sockaddr_in addr;
@@ -548,6 +548,16 @@ static void test_sockmap(int tasks, void *data)
                 goto out_sockmap;
         }
 
+        /* Test update with unsupported UDP socket */
+        udp = socket(AF_INET, SOCK_DGRAM, 0);
+        i = 0;
+        err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+        if (!err) {
+                printf("Failed socket SOCK_DGRAM allowed '%i:%i'\n",
+                       i, udp);
+                goto out_sockmap;
+        }
+
         /* Test update without programs */
         for (i = 0; i < 6; i++) {
                 err = bpf_map_update_elem(fd, &i, &sfd[i], BPF_ANY);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 26f3250bdcd2..64ae21f64489 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -1130,15 +1130,27 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid bpf_context access",
         },
         {
-                "check skb->mark is writeable by SK_SKB",
+                "invalid access of skb->mark for SK_SKB",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .result =  REJECT,
+                .prog_type = BPF_PROG_TYPE_SK_SKB,
+                .errstr = "invalid bpf_context access",
+        },
+        {
+                "check skb->mark is not writeable by SK_SKB",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
                                     offsetof(struct __sk_buff, mark)),
                         BPF_EXIT_INSN(),
                 },
-                .result = ACCEPT,
+                .result =  REJECT,
                 .prog_type = BPF_PROG_TYPE_SK_SKB,
+                .errstr = "invalid bpf_context access",
         },
         {
                 "check skb->tc_index is writeable by SK_SKB",
@@ -6645,6 +6657,500 @@ static struct bpf_test tests[] = {
                 .errstr = "BPF_END uses reserved fields",
                 .result = REJECT,
         },
+        {
+                "arithmetic ops make PTR_TO_CTX unusable",
+                .insns = {
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
+                                      offsetof(struct __sk_buff, data) -
+                                      offsetof(struct __sk_buff, mark)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "XDP pkt read, pkt_end mangling, bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end mangling, bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' > pkt_end, good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' > pkt_end, bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_data' > pkt_end, bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end > pkt_data', good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_end > pkt_data', bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end > pkt_data', bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' < pkt_end, good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_data' < pkt_end, bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' < pkt_end, bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end < pkt_data', good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end < pkt_data', bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_end < pkt_data', bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' >= pkt_end, good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_end >= pkt_data', good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end >= pkt_data', bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_end >= pkt_data', bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' <= pkt_end, good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end <= pkt_data', good access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "XDP pkt read, pkt_end <= pkt_data', bad access 1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+        },
+        {
+                "XDP pkt read, pkt_end <= pkt_data', bad access 2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct xdp_md, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct xdp_md, data_end)),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+                        BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 offset is outside of the packet",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_XDP,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
diff --git a/tools/testing/selftests/breakpoints/Makefile b/tools/testing/selftests/breakpoints/Makefile
index 6b214b7b10fb..247b0a1899d7 100644
--- a/tools/testing/selftests/breakpoints/Makefile
+++ b/tools/testing/selftests/breakpoints/Makefile
@@ -2,14 +2,14 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
 ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
 
+TEST_GEN_PROGS := step_after_suspend_test
+
 ifeq ($(ARCH),x86)
-TEST_GEN_PROGS := breakpoint_test
+TEST_GEN_PROGS += breakpoint_test
 endif
 ifneq (,$(filter $(ARCH),aarch64 arm64))
-TEST_GEN_PROGS := breakpoint_test_arm64
+TEST_GEN_PROGS += breakpoint_test_arm64
 endif
 
-TEST_GEN_PROGS += step_after_suspend_test
-
 include ../lib.mk
 
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
index 2a1cb9908746..a4fd4c851a5b 100644
--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
@@ -1,6 +1,8 @@
 #!/bin/sh
 # description: Register/unregister many kprobe events
 
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
 # ftrace fentry skip size depends on the machine architecture.
 # Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc64le
 case `uname -m` in
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index 7c647f619d63..f0c0369ccb79 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -7,14 +7,17 @@ TEST_PROGS := run.sh
 include ../lib.mk
 
 all:
-        for DIR in $(SUBDIRS); do               \
+        @for DIR in $(SUBDIRS); do              \
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
+                if [ -e $$DIR/$(TEST_PROGS) ]; then
+                        rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/;
+                fi
         done
 
 override define RUN_TESTS
-        $(OUTPUT)/run.sh
+        @cd $(OUTPUT); ./run.sh
 endef
 
 override define INSTALL_RULE
@@ -33,7 +36,7 @@ override define EMIT_TESTS
 endef
 
 override define CLEAN
-        for DIR in $(SUBDIRS); do               \
+        @for DIR in $(SUBDIRS); do              \
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
diff --git a/tools/testing/selftests/intel_pstate/Makefile b/tools/testing/selftests/intel_pstate/Makefile
index 849a90ffe8dd..a97e24edde39 100644
--- a/tools/testing/selftests/intel_pstate/Makefile
+++ b/tools/testing/selftests/intel_pstate/Makefile
@@ -1,7 +1,9 @@
 CFLAGS := $(CFLAGS) -Wall -D_GNU_SOURCE
 LDLIBS := $(LDLIBS) -lm
 
+ifeq (,$(filter $(ARCH),x86))
 TEST_GEN_FILES := msr aperf
+endif
 
 TEST_PROGS := run.sh
 
diff --git a/tools/testing/selftests/intel_pstate/run.sh b/tools/testing/selftests/intel_pstate/run.sh
index 7868c106b8b1..d3ab48f91cd6 100755
--- a/tools/testing/selftests/intel_pstate/run.sh
+++ b/tools/testing/selftests/intel_pstate/run.sh
@@ -29,13 +29,12 @@
 
 EVALUATE_ONLY=0
 
-max_cpus=$(($(nproc)-1))
+if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then
+        echo "$0 # Skipped: Test can only run on x86 architectures."
+        exit 0
+fi
 
-# compile programs
-gcc aperf.c -Wall -D_GNU_SOURCE -o aperf  -lm
-[ $? -ne 0 ] && echo "Problem compiling aperf.c." && exit 1
-gcc -o msr msr.c -lm
-[ $? -ne 0 ] && echo "Problem compiling msr.c." && exit 1
+max_cpus=$(($(nproc)-1))
 
 function run_test () {
 
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 693616651da5..f65886af7c0c 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -6,7 +6,14 @@ ifeq (0,$(MAKELEVEL))
 OUTPUT := $(shell pwd)
 endif
 
+# The following are built by lib.mk common compile rules.
+# TEST_CUSTOM_PROGS should be used by tests that require
+# custom build rule and prevent common build rule use.
+# TEST_PROGS are for test shell scripts.
+# TEST_CUSTOM_PROGS and TEST_PROGS will be run by common run_tests
+# and install targets. Common clean doesn't touch them.
 TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
+TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
 TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
 
 all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
@@ -20,17 +27,28 @@ define RUN_TESTS
                 test_num=`echo $$test_num+1 | bc`;      \
                 echo "selftests: $$BASENAME_TEST";      \
                 echo "========================================";        \
-                if [ ! -x $$BASENAME_TEST ]; then       \
+                if [ ! -x $$TEST ]; then        \
                         echo "selftests: Warning: file $$BASENAME_TEST is not executable, correct this.";\
                         echo "not ok 1..$$test_num selftests: $$BASENAME_TEST [FAIL]"; \
                 else                                    \
-                        cd `dirname $$TEST` > /dev/null; (./$$BASENAME_TEST && echo "ok 1..$$test_num selftests: $$BASENAME_TEST [PASS]") || echo "not ok 1..$$test_num selftests:  $$BASENAME_TEST [FAIL]"; cd - > /dev/null;\
+                        cd `dirname $$TEST` > /dev/null; (./$$BASENAME_TEST > /tmp/$$BASENAME_TEST 2>&1 && echo "ok 1..$$test_num selftests: $$BASENAME_TEST [PASS]") || echo "not ok 1..$$test_num selftests:  $$BASENAME_TEST [FAIL]"; cd - > /dev/null;\
                 fi;                                     \
         done;
 endef
 
 run_tests: all
-        $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_PROGS))
+ifneq ($(KBUILD_SRC),)
+        @if [ "X$(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES)" != "X" ]; then
+                @rsync -aq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT)
+        fi
+        @if [ "X$(TEST_PROGS)" != "X" ]; then
+                $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(OUTPUT)/$(TEST_PROGS))
+        else
+                $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS))
+        fi
+else
+        $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS))
+endif
 
 define INSTALL_RULE
         @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then                                        \
@@ -38,10 +56,10 @@ define INSTALL_RULE
                 echo "rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/";    \
                 rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/;           \
         fi
-        @if [ "X$(TEST_GEN_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then                                    \
+        @if [ "X$(TEST_GEN_PROGS)$(TEST_CUSTOM_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then                                        \
                 mkdir -p ${INSTALL_PATH};                                                                               \
-                echo "rsync -a $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/";        \
-                rsync -a $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/;               \
+                echo "rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/";   \
+                rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/;          \
         fi
 endef
 
@@ -53,15 +71,20 @@ else
 endif
 
 define EMIT_TESTS
-        @for TEST in $(TEST_GEN_PROGS) $(TEST_PROGS); do \
+        @for TEST in $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS); do \
                 BASENAME_TEST=`basename $$TEST`;        \
-                echo "(./$$BASENAME_TEST && echo \"selftests: $$BASENAME_TEST [PASS]\") || echo \"selftests: $$BASENAME_TEST [FAIL]\""; \
+                echo "(./$$BASENAME_TEST > /tmp/$$BASENAME_TEST 2>&1 && echo \"selftests: $$BASENAME_TEST [PASS]\") || echo \"selftests: $$BASENAME_TEST [FAIL]\""; \
         done;
 endef
 
 emit_tests:
         $(EMIT_TESTS)
 
+# define if isn't already. It is undefined in make O= case.
+ifeq ($(RM),)
+RM := rm -f
+endif
+
 define CLEAN
         $(RM) -r $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(EXTRA_CLEAN)
 endef
@@ -69,6 +92,15 @@ endef
 clean:
         $(CLEAN)
 
+# When make O= with kselftest target from main level
+# the following aren't defined.
+#
+ifneq ($(KBUILD_SRC),)
+LINK.c = $(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH)
+COMPILE.S = $(CC) $(ASFLAGS) $(CPPFLAGS) $(TARGET_ARCH) -c
+LINK.S = $(CC) $(ASFLAGS) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH)
+endif
+
 $(OUTPUT)/%:%.c
         $(LINK.c) $^ $(LDLIBS) -o $@
 
diff --git a/tools/testing/selftests/memfd/run_tests.sh b/tools/testing/selftests/memfd/run_tests.sh
index daabb350697c..daabb350697c 100644..100755
--- a/tools/testing/selftests/memfd/run_tests.sh
+++ b/tools/testing/selftests/memfd/run_tests.sh
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 79a664aeb8d7..152823b6cb21 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -5,8 +5,8 @@ TEST_GEN_PROGS := mq_open_tests mq_perf_tests
 include ../lib.mk
 
 override define RUN_TESTS
-        @./mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
-        @./mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
+        @$(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
+        @$(OUTPUT)/mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
 endef
 
 override define EMIT_TESTS
diff --git a/tools/testing/selftests/net/.gitignore b/tools/testing/selftests/net/.gitignore
index 9801253e4802..c612d6e38c62 100644
--- a/tools/testing/selftests/net/.gitignore
+++ b/tools/testing/selftests/net/.gitignore
@@ -6,3 +6,4 @@ reuseport_bpf
 reuseport_bpf_cpu
 reuseport_bpf_numa
 reuseport_dualstack
+reuseaddr_conflict
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index de1f5772b878..d86bca991f45 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,9 +5,9 @@ CFLAGS += -I../../../../usr/include/
 
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
 TEST_GEN_FILES =  socket
-TEST_GEN_FILES += psock_fanout psock_tpacket
-TEST_GEN_FILES += reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
-TEST_GEN_FILES += reuseport_dualstack msg_zerocopy
+TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
+TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
+TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
index 40232af5b023..3ab6ec403905 100644
--- a/tools/testing/selftests/net/msg_zerocopy.c
+++ b/tools/testing/selftests/net/msg_zerocopy.c
@@ -55,7 +55,7 @@
 #include <unistd.h>
 
 #ifndef SO_EE_ORIGIN_ZEROCOPY
-#define SO_EE_ORIGIN_ZEROCOPY           SO_EE_ORIGIN_UPAGE
+#define SO_EE_ORIGIN_ZEROCOPY           5
 #endif
 
 #ifndef SO_ZEROCOPY
diff --git a/tools/testing/selftests/net/netdevice.sh b/tools/testing/selftests/net/netdevice.sh
index 4e00568d70c2..90cb903c3381 100755
--- a/tools/testing/selftests/net/netdevice.sh
+++ b/tools/testing/selftests/net/netdevice.sh
@@ -178,7 +178,7 @@ if [ "$(id -u)" -ne 0 ];then
         exit 0
 fi
 
-ip -Version 2>/dev/null >/dev/null
+ip link show 2>/dev/null >/dev/null
 if [ $? -ne 0 ];then
         echo "SKIP: Could not run test without the ip tool"
         exit 0
diff --git a/tools/testing/selftests/net/reuseaddr_conflict.c b/tools/testing/selftests/net/reuseaddr_conflict.c
new file mode 100644
index 000000000000..7c5b12664b03
--- /dev/null
+++ b/tools/testing/selftests/net/reuseaddr_conflict.c
@@ -0,0 +1,114 @@
+/*
+ * Test for the regression introduced by
+ *
+ * b9470c27607b ("inet: kill smallest_size and smallest_port")
+ *
+ * If we open an ipv4 socket on a port with reuseaddr we shouldn't reset the tb
+ * when we open the ipv6 conterpart, which is what was happening previously.
+ */
+#include <errno.h>
+#include <error.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define PORT 9999
+
+int open_port(int ipv6, int any)
+{
+        int fd = -1;
+        int reuseaddr = 1;
+        int v6only = 1;
+        int addrlen;
+        int ret = -1;
+        struct sockaddr *addr;
+        int family = ipv6 ? AF_INET6 : AF_INET;
+
+        struct sockaddr_in6 addr6 = {
+                .sin6_family = AF_INET6,
+                .sin6_port = htons(PORT),
+                .sin6_addr = in6addr_any
+        };
+        struct sockaddr_in addr4 = {
+                .sin_family = AF_INET,
+                .sin_port = htons(PORT),
+                .sin_addr.s_addr = any ? htonl(INADDR_ANY) : inet_addr("127.0.0.1"),
+        };
+
+
+        if (ipv6) {
+                addr = (struct sockaddr*)&addr6;
+                addrlen = sizeof(addr6);
+        } else {
+                addr = (struct sockaddr*)&addr4;
+                addrlen = sizeof(addr4);
+        }
+
+        if ((fd = socket(family, SOCK_STREAM, IPPROTO_TCP)) < 0) {
+                perror("socket");
+                goto out;
+        }
+
+        if (ipv6 && setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&v6only,
+                               sizeof(v6only)) < 0) {
+                perror("setsockopt IPV6_V6ONLY");
+                goto out;
+        }
+
+        if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuseaddr,
+                       sizeof(reuseaddr)) < 0) {
+                perror("setsockopt SO_REUSEADDR");
+                goto out;
+        }
+
+        if (bind(fd, addr, addrlen) < 0) {
+                perror("bind");
+                goto out;
+        }
+
+        if (any)
+                return fd;
+
+        if (listen(fd, 1) < 0) {
+                perror("listen");
+                goto out;
+        }
+        return fd;
+out:
+        close(fd);
+        return ret;
+}
+
+int main(void)
+{
+        int listenfd;
+        int fd1, fd2;
+
+        fprintf(stderr, "Opening 127.0.0.1:%d\n", PORT);
+        listenfd = open_port(0, 0);
+        if (listenfd < 0)
+                error(1, errno, "Couldn't open listen socket");
+        fprintf(stderr, "Opening INADDR_ANY:%d\n", PORT);
+        fd1 = open_port(0, 1);
+        if (fd1 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on a already bound non-reuseport socket");
+        fprintf(stderr, "Opening in6addr_any:%d\n", PORT);
+        fd1 = open_port(1, 1);
+        if (fd1 < 0)
+                error(1, errno, "Couldn't open ipv6 reuseport");
+        fprintf(stderr, "Opening INADDR_ANY:%d\n", PORT);
+        fd2 = open_port(0, 1);
+        if (fd2 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on a already bound non-reuseport socket");
+        close(fd1);
+        fprintf(stderr, "Opening INADDR_ANY:%d after closing ipv6 socket\n", PORT);
+        fd1 = open_port(0, 1);
+        if (fd1 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6");
+        fprintf(stderr, "Success");
+        return 0;
+}
diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
index 00f286661dcd..dd4162fc0419 100644
--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
@@ -341,7 +341,7 @@ int main(int argc, char **argv)
                         return 0;
                 case 'n':
                         t = atoi(optarg);
-                        if (t > ARRAY_SIZE(test_cases))
+                        if (t >= ARRAY_SIZE(test_cases))
                                 error(1, 0, "Invalid test case: %d", t);
                         all_tests = false;
                         test_cases[t].enabled = true;
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 67c3e2764303..24dbf634e2dd 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -6,10 +6,18 @@
  */
 
 #include <sys/types.h>
-#include <asm/siginfo.h>
-#define __have_siginfo_t 1
-#define __have_sigval_t 1
-#define __have_sigevent_t 1
+
+/*
+ * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
+ * we need to use the kernel's siginfo.h file and trick glibc
+ * into accepting it.
+ */
+#if !__GLIBC_PREREQ(2, 26)
+# include <asm/siginfo.h>
+# define __have_siginfo_t 1
+# define __have_sigval_t 1
+# define __have_sigevent_t 1
+#endif
 
 #include <errno.h>
 #include <linux/filter.h>
@@ -884,7 +892,7 @@ TEST_F_SIGNAL(TRAP, ign, SIGSYS)
         syscall(__NR_getpid);
 }
 
-static struct siginfo TRAP_info;
+static siginfo_t TRAP_info;
 static volatile int TRAP_nr;
 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
 {
diff --git a/tools/testing/selftests/sigaltstack/sas.c b/tools/testing/selftests/sigaltstack/sas.c
index 7d406c3973ba..97bb150837df 100644
--- a/tools/testing/selftests/sigaltstack/sas.c
+++ b/tools/testing/selftests/sigaltstack/sas.c
@@ -39,7 +39,11 @@ void my_usr1(int sig, siginfo_t *si, void *u)
         stack_t stk;
         struct stk_data *p;
 
+#if __s390x__
+        register unsigned long sp asm("%15");
+#else
         register unsigned long sp asm("sp");
+#endif
 
         if (sp < (unsigned long)sstack ||
                         sp >= (unsigned long)sstack + SIGSTKSZ) {
diff --git a/tools/testing/selftests/sync/Makefile b/tools/testing/selftests/sync/Makefile
index 4981c6b6d050..8e04d0afcbd7 100644
--- a/tools/testing/selftests/sync/Makefile
+++ b/tools/testing/selftests/sync/Makefile
@@ -2,12 +2,16 @@ CFLAGS += -O2 -g -std=gnu89 -pthread -Wall -Wextra
 CFLAGS += -I../../../../usr/include/
 LDFLAGS += -pthread
 
-TEST_PROGS = sync_test
-
-all: $(TEST_PROGS)
+.PHONY: all clean
 
 include ../lib.mk
 
+# lib.mk TEST_CUSTOM_PROGS var is for custom tests that need special
+# build rules. lib.mk will run and install them.
+
+TEST_CUSTOM_PROGS := $(OUTPUT)/sync_test
+all: $(TEST_CUSTOM_PROGS)
+
 OBJS = sync_test.o sync.o
 
 TESTS += sync_alloc.o
@@ -18,6 +22,16 @@ TESTS += sync_stress_parallelism.o
 TESTS += sync_stress_consumer.o
 TESTS += sync_stress_merge.o
 
-sync_test: $(OBJS) $(TESTS)
+OBJS := $(patsubst %,$(OUTPUT)/%,$(OBJS))
+TESTS := $(patsubst %,$(OUTPUT)/%,$(TESTS))
+
+$(TEST_CUSTOM_PROGS): $(TESTS) $(OBJS)
+        $(CC) -o $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS) $(CFLAGS) $(LDFLAGS)
+
+$(OBJS): $(OUTPUT)/%.o: %.c
+        $(CC) -c $^ -o $@
+
+$(TESTS): $(OUTPUT)/%.o: %.c
+        $(CC) -c $^ -o $@
 
-EXTRA_CLEAN := sync_test $(OBJS) $(TESTS)
+EXTRA_CLEAN := $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
index c727b96a59b0..5fa02d86b35f 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
@@ -17,5 +17,26 @@
         "teardown": [
             "$TC qdisc del dev $DEV1 ingress"
         ]
+    },
+    {
+        "id": "d052",
+        "name": "Add 1M filters with the same action",
+        "category": [
+            "filter",
+            "flower"
+        ],
+        "setup": [
+            "$TC qdisc add dev $DEV2 ingress",
+            "./tdc_batch.py $DEV2 $BATCH_FILE --share_action -n 1000000"
+        ],
+        "cmdUnderTest": "$TC -b $BATCH_FILE",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action gact",
+        "matchPattern": "action order 0: gact action drop.*index 1 ref 1000000 bind 1000000",
+        "matchCount": "1",
+        "teardown": [
+            "$TC qdisc del dev $DEV2 ingress",
+            "/bin/rm $BATCH_FILE"
+        ]
     }
-]
\ No newline at end of file
+]
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index cd61b7844c0d..a8981c5d0aaf 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -88,7 +88,7 @@ def prepare_env(cmdlist):
             exit(1)
 
 
-def test_runner(filtered_tests):
+def test_runner(filtered_tests, args):
     """
     Driver function for the unit tests.
 
@@ -105,6 +105,8 @@ def test_runner(filtered_tests):
     for tidx in testlist:
         result = True
         tresult = ""
+        if "flower" in tidx["category"] and args.device == None:
+            continue
         print("Test " + tidx["id"] + ": " + tidx["name"])
         prepare_env(tidx["setup"])
         (p, procout) = exec_cmd(tidx["cmdUnderTest"])
@@ -150,7 +152,11 @@ def ns_create():
         exec_cmd(cmd, False)
         cmd = 'ip link set $DEV0 up'
         exec_cmd(cmd, False)
-        cmd = 'ip -s $NS link set $DEV1 up'
+        cmd = 'ip -n $NS link set $DEV1 up'
+        exec_cmd(cmd, False)
+        cmd = 'ip link set $DEV2 netns $NS'
+        exec_cmd(cmd, False)
+        cmd = 'ip -n $NS link set $DEV2 up'
         exec_cmd(cmd, False)
 
 
@@ -211,7 +217,8 @@ def set_args(parser):
                         help='Execute the single test case with specified ID')
     parser.add_argument('-i', '--id', action='store_true', dest='gen_id',
                         help='Generate ID numbers for new test cases')
-    return parser
+    parser.add_argument('-d', '--device',
+                        help='Execute the test case in flower category')
     return parser
 
 
@@ -225,6 +232,8 @@ def check_default_settings(args):
 
     if args.path != None:
          NAMES['TC'] = args.path
+    if args.device != None:
+         NAMES['DEV2'] = args.device
     if not os.path.isfile(NAMES['TC']):
         print("The specified tc path " + NAMES['TC'] + " does not exist.")
         exit(1)
@@ -381,14 +390,17 @@ def set_operation_mode(args):
             if (len(alltests) == 0):
                 print("Cannot find a test case with ID matching " + target_id)
                 exit(1)
-        catresults = test_runner(alltests)
+        catresults = test_runner(alltests, args)
         print("All test results: " + "\n\n" + catresults)
     elif (len(target_category) > 0):
+        if (target_category == "flower") and args.device == None:
+            print("Please specify a NIC device (-d) to run category flower")
+            exit(1)
         if (target_category not in ucat):
             print("Specified category is not present in this file.")
             exit(1)
         else:
-            catresults = test_runner(testcases[target_category])
+            catresults = test_runner(testcases[target_category], args)
             print("Category " + target_category + "\n\n" + catresults)
 
     ns_destroy()
diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py b/tools/testing/selftests/tc-testing/tdc_batch.py
new file mode 100755
index 000000000000..707c6bfef689
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tdc_batch.py
@@ -0,0 +1,62 @@
+#!/usr/bin/python3
+
+"""
+tdc_batch.py - a script to generate TC batch file
+
+Copyright (C) 2017 Chris Mi <chrism@mellanox.com>
+"""
+
+import argparse
+
+parser = argparse.ArgumentParser(description='TC batch file generator')
+parser.add_argument("device", help="device name")
+parser.add_argument("file", help="batch file name")
+parser.add_argument("-n", "--number", type=int,
+                    help="how many lines in batch file")
+parser.add_argument("-o", "--skip_sw",
+                    help="skip_sw (offload), by default skip_hw",
+                    action="store_true")
+parser.add_argument("-s", "--share_action",
+                    help="all filters share the same action",
+                    action="store_true")
+parser.add_argument("-p", "--prio",
+                    help="all filters have different prio",
+                    action="store_true")
+args = parser.parse_args()
+
+device = args.device
+file = open(args.file, 'w')
+
+number = 1
+if args.number:
+    number = args.number
+
+skip = "skip_hw"
+if args.skip_sw:
+    skip = "skip_sw"
+
+share_action = ""
+if args.share_action:
+    share_action = "index 1"
+
+prio = "prio 1"
+if args.prio:
+    prio = ""
+    if number > 0x4000:
+        number = 0x4000
+
+index = 0
+for i in range(0x100):
+    for j in range(0x100):
+        for k in range(0x100):
+            mac = ("%02x:%02x:%02x" % (i, j, k))
+            src_mac = "e4:11:00:" + mac
+            dst_mac = "e4:12:00:" + mac
+            cmd = ("filter add dev %s %s protocol ip parent ffff: flower %s "
+                   "src_mac %s dst_mac %s action drop %s" %
+                   (device, prio, skip, src_mac, dst_mac, share_action))
+            file.write("%s\n" % cmd)
+            index += 1
+            if index >= number:
+                file.close()
+                exit(0)
diff --git a/tools/testing/selftests/tc-testing/tdc_config.py b/tools/testing/selftests/tc-testing/tdc_config.py
index 01087375a7c3..b6352515c1b5 100644
--- a/tools/testing/selftests/tc-testing/tdc_config.py
+++ b/tools/testing/selftests/tc-testing/tdc_config.py
@@ -12,6 +12,8 @@ NAMES = {
           # Name of veth devices to be created for the namespace
           'DEV0': 'v0p0',
           'DEV1': 'v0p1',
+          'DEV2': '',
+          'BATCH_FILE': './batch.txt',
           # Name of the namespace to use
           'NS': 'tcut'
         }
diff --git a/tools/testing/selftests/timers/set-timer-lat.c b/tools/testing/selftests/timers/set-timer-lat.c
index 9c92b7bd5641..50da45437daa 100644
--- a/tools/testing/selftests/timers/set-timer-lat.c
+++ b/tools/testing/selftests/timers/set-timer-lat.c
@@ -143,7 +143,8 @@ int setup_timer(int clock_id, int flags, int interval, timer_t *tm1)
                         printf("%-22s %s missing CAP_WAKE_ALARM?    : [UNSUPPORTED]\n",
                                         clockstring(clock_id),
                                         flags ? "ABSTIME":"RELTIME");
-                        return 0;
+                        /* Indicate timer isn't set, so caller doesn't wait */
+                        return 1;
                 }
                 printf("%s - timer_create() failed\n", clockstring(clock_id));
                 return -1;
@@ -213,8 +214,9 @@ int do_timer(int clock_id, int flags)
         int err;
 
         err = setup_timer(clock_id, flags, interval, &tm1);
+        /* Unsupported case - return 0 to not fail the test */
         if (err)
-                return err;
+                return err == 1 ? 0 : err;
 
         while (alarmcount < 5)
                 sleep(1);
@@ -228,18 +230,17 @@ int do_timer_oneshot(int clock_id, int flags)
         timer_t tm1;
         const int interval = 0;
         struct timeval timeout;
-        fd_set fds;
         int err;
 
         err = setup_timer(clock_id, flags, interval, &tm1);
+        /* Unsupported case - return 0 to not fail the test */
         if (err)
-                return err;
+                return err == 1 ? 0 : err;
 
         memset(&timeout, 0, sizeof(timeout));
         timeout.tv_sec = 5;
-        FD_ZERO(&fds);
         do {
-                err = select(FD_SETSIZE, &fds, NULL, NULL, &timeout);
+                err = select(0, NULL, NULL, NULL, &timeout);
         } while (err == -1 && errno == EINTR);
 
         timer_delete(tm1);
diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
index a2c53a3d223d..de2f9ec8a87f 100644
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -397,7 +397,7 @@ static void retry_copy_page(int ufd, struct uffdio_copy *uffdio_copy,
         }
 }
 
-static int copy_page(int ufd, unsigned long offset)
+static int __copy_page(int ufd, unsigned long offset, bool retry)
 {
         struct uffdio_copy uffdio_copy;
 
@@ -418,7 +418,7 @@ static int copy_page(int ufd, unsigned long offset)
                 fprintf(stderr, "UFFDIO_COPY unexpected copy %Ld\n",
                         uffdio_copy.copy), exit(1);
         } else {
-                if (test_uffdio_copy_eexist) {
+                if (test_uffdio_copy_eexist && retry) {
                         test_uffdio_copy_eexist = false;
                         retry_copy_page(ufd, &uffdio_copy, offset);
                 }
@@ -427,6 +427,16 @@ static int copy_page(int ufd, unsigned long offset)
         return 0;
 }
 
+static int copy_page_retry(int ufd, unsigned long offset)
+{
+        return __copy_page(ufd, offset, true);
+}
+
+static int copy_page(int ufd, unsigned long offset)
+{
+        return __copy_page(ufd, offset, false);
+}
+
 static void *uffd_poll_thread(void *arg)
 {
         unsigned long cpu = (unsigned long) arg;
@@ -544,7 +554,7 @@ static void *background_thread(void *arg)
         for (page_nr = cpu * nr_pages_per_cpu;
              page_nr < (cpu+1) * nr_pages_per_cpu;
              page_nr++)
-                copy_page(uffd, page_nr * page_size);
+                copy_page_retry(uffd, page_nr * page_size);
 
         return NULL;
 }
@@ -779,7 +789,7 @@ static void retry_uffdio_zeropage(int ufd,
         }
 }
 
-static int uffdio_zeropage(int ufd, unsigned long offset)
+static int __uffdio_zeropage(int ufd, unsigned long offset, bool retry)
 {
         struct uffdio_zeropage uffdio_zeropage;
         int ret;
@@ -814,7 +824,7 @@ static int uffdio_zeropage(int ufd, unsigned long offset)
                         fprintf(stderr, "UFFDIO_ZEROPAGE unexpected %Ld\n",
                                 uffdio_zeropage.zeropage), exit(1);
                 } else {
-                        if (test_uffdio_zeropage_eexist) {
+                        if (test_uffdio_zeropage_eexist && retry) {
                                 test_uffdio_zeropage_eexist = false;
                                 retry_uffdio_zeropage(ufd, &uffdio_zeropage,
                                                       offset);
@@ -830,6 +840,11 @@ static int uffdio_zeropage(int ufd, unsigned long offset)
         return 0;
 }
 
+static int uffdio_zeropage(int ufd, unsigned long offset)
+{
+        return __uffdio_zeropage(ufd, offset, false);
+}
+
 /* exercise UFFDIO_ZEROPAGE */
 static int userfaultfd_zeropage_test(void)
 {
diff --git a/tools/testing/selftests/watchdog/Makefile b/tools/testing/selftests/watchdog/Makefile
index f863c664e3d1..ee068511fd0b 100644
--- a/tools/testing/selftests/watchdog/Makefile
+++ b/tools/testing/selftests/watchdog/Makefile
@@ -1,8 +1,3 @@
-TEST_PROGS := watchdog-test
-
-all: $(TEST_PROGS)
+TEST_GEN_PROGS := watchdog-test
 
 include ../lib.mk
-
-clean:
-        rm -fr $(TEST_PROGS)
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 97f187e2663f..0a74a20ca32b 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -20,7 +20,7 @@ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32))
 BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
-CFLAGS := -O2 -g -std=gnu99 -pthread -Wall
+CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
 UNAME_M := $(shell uname -m)
 CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)